@modootoday/envs 0.1.0

package/dist/chunk-STHFIZRP.js

@@ -0,0 +1,1310 @@
+// src/format/parse.ts
+var KEY_PATTERN = /^[\w.-]+$/;
+var EXPORT_PREFIX = /^export\s+/;
+function expandDoubleQuoted(raw) {
+  return raw.replace(/\\n/g, "\n").replace(/\\r/g, "\r");
+}
+function isQuote(ch) {
+  return ch === '"' || ch === "'" || ch === "`";
+}
+function scanQuoted(text, start, quote) {
+  let i = start + 1;
+  let out = "";
+  while (i < text.length) {
+    const ch = text[i];
+    if (ch === "\\" && i + 1 < text.length) {
+      out += ch + text[i + 1];
+      i += 2;
+      continue;
+    }
+    if (ch === quote) {
+      return {
+        value: quote === '"' ? expandDoubleQuoted(out) : out,
+        quote,
+        next: i + 1,
+        unterminated: false
+      };
+    }
+    out += ch;
+    i += 1;
+  }
+  return { value: out, quote, next: text.length, unterminated: true };
+}
+function scanBare(text, start) {
+  let i = start;
+  while (i < text.length && text[i] !== "\n" && text[i] !== "#") i += 1;
+  return {
+    value: text.slice(start, i).trim(),
+    quote: null,
+    next: i,
+    unterminated: false
+  };
+}
+function countLines(text, from, to) {
+  let n = 0;
+  for (let i = from; i < to; i += 1) if (text[i] === "\n") n += 1;
+  return n;
+}
+function restOfLineIsClean(text, from) {
+  let i = from;
+  while (i < text.length && text[i] !== "\n") {
+    const ch = text[i];
+    if (ch === "#") return true;
+    if (ch !== " " && ch !== "	") return false;
+    i += 1;
+  }
+  return true;
+}
+function parseEnv(input) {
+  const text = input.replace(/\r\n?/g, "\n");
+  const entries = [];
+  const findings = [];
+  let i = 0;
+  let line = 1;
+  const skipToNextLine = (from) => {
+    const nl = text.indexOf("\n", from);
+    return nl === -1 ? text.length : nl + 1;
+  };
+  while (i < text.length) {
+    const eol = text.indexOf("\n", i);
+    const lineEnd = eol === -1 ? text.length : eol;
+    const raw = text.slice(i, lineEnd);
+    const trimmed = raw.trim();
+    if (trimmed === "") {
+      entries.push({ kind: "blank", line, endLine: line });
+      i = lineEnd + 1;
+      line += 1;
+      continue;
+    }
+    if (trimmed.startsWith("#")) {
+      entries.push({ kind: "comment", line, endLine: line });
+      i = lineEnd + 1;
+      line += 1;
+      continue;
+    }
+    const lead = raw.length - raw.trimStart().length;
+    const body = raw.slice(lead);
+    const exported = EXPORT_PREFIX.test(body);
+    const afterExport = exported ? body.replace(EXPORT_PREFIX, "") : body;
+    const keyOffset = i + lead + (body.length - afterExport.length);
+    const eq = afterExport.indexOf("=");
+    if (eq === -1) {
+      findings.push({ code: "NOT_ENV_LINE", line });
+      i = lineEnd + 1;
+      line += 1;
+      continue;
+    }
+    const key = afterExport.slice(0, eq).trim();
+    if (key === "") {
+      findings.push({ code: "EMPTY_KEY", line });
+      i = lineEnd + 1;
+      line += 1;
+      continue;
+    }
+    if (!KEY_PATTERN.test(key)) {
+      findings.push({ code: "INVALID_KEY", line });
+      i = lineEnd + 1;
+      line += 1;
+      continue;
+    }
+    let cursor = keyOffset + eq + 1;
+    while (cursor < text.length && (text[cursor] === " " || text[cursor] === "	")) {
+      cursor += 1;
+    }
+    const ch = text[cursor];
+    const scan = ch !== void 0 && isQuote(ch) ? scanQuoted(text, cursor, ch) : scanBare(text, cursor);
+    if (scan.unterminated) {
+      findings.push({ code: "UNTERMINATED_QUOTE", line });
+      i = text.length;
+      break;
+    }
+    const endLine = line + countLines(text, i, scan.next);
+    if (!restOfLineIsClean(text, scan.next)) {
+      findings.push({ code: "TRAILING_CONTENT", line: endLine });
+      i = skipToNextLine(scan.next);
+      line = endLine + 1;
+      continue;
+    }
+    entries.push({
+      kind: "assignment",
+      line,
+      endLine,
+      key,
+      value: scan.value,
+      quote: scan.quote,
+      exported
+    });
+    i = skipToNextLine(scan.next);
+    line = endLine + 1;
+  }
+  return { ok: findings.length === 0, entries, findings };
+}
+function toRecord(result) {
+  if (!result.ok) return null;
+  const out = {};
+  for (const entry of result.entries) {
+    if (entry.kind === "assignment") out[entry.key] = entry.value;
+  }
+  return out;
+}
+
+// src/sqlite/provider.ts
+var onBun = () => typeof globalThis["Bun"] !== "undefined";
+var PROVIDERS = [
+  {
+    backend: "bun",
+    specifier: "bun:sqlite",
+    exportName: "Database",
+    builtIn: true,
+    // Rejects {} and {readonly:false}; a writable handle needs create.
+    openOptions: (readOnly) => readOnly ? { readonly: true } : { readonly: false, create: true },
+    eligible: onBun,
+    bindKey: (_bare, token) => token
+  },
+  {
+    backend: "node",
+    specifier: "node:sqlite",
+    exportName: "DatabaseSync",
+    builtIn: true,
+    // Spells it readOnly and silently ignores the lowercase name, which would
+    // hand back a writable database.
+    openOptions: (readOnly) => ({ readOnly }),
+    eligible: () => !onBun(),
+    bindKey: (_bare, token) => token
+  },
+  {
+    backend: "better-sqlite3",
+    specifier: "better-sqlite3",
+    exportName: "default",
+    builtIn: false,
+    // Wants the lowercase name and rejects the other as a misspelling.
+    openOptions: (readOnly) => ({ readonly: readOnly }),
+    // Never attempted on bun: the load is a process panic, not an exception.
+    eligible: () => !onBun(),
+    bindKey: (bare) => bare
+  }
+];
+function providerFor(backend) {
+  return PROVIDERS.find((provider) => provider.backend === backend);
+}
+
+// src/sqlite/open.ts
+import { createRequire } from "module";
+var SqliteUnavailableError = class extends Error {
+  constructor(attempts) {
+    super(
+      `no sqlite backend available; tried ${attempts.map(([spec, reason]) => `${spec} (${reason})`).join(
+        ", "
+      )}. On a runtime without node:sqlite, install better-sqlite3.`
+    );
+    this.attempts = attempts;
+    this.name = "SqliteUnavailableError";
+  }
+  attempts;
+};
+var SqliteBindError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SqliteBindError";
+  }
+};
+var NUL = String.fromCharCode(0);
+var bindings = /* @__PURE__ */ new Map();
+async function importModule(specifier) {
+  return await import(
+    /* @vite-ignore */
+    specifier
+  );
+}
+function readEnv(name) {
+  return globalThis.process?.env?.[name];
+}
+function shortlist(pinned) {
+  const name = pinned ?? readEnv("ENVS_SQLITE_BACKEND");
+  if (name === void 0 || name === "") return PROVIDERS;
+  const provider = providerFor(name);
+  if (provider === void 0) {
+    throw new SqliteUnavailableError([
+      [
+        "backend pin",
+        `"${name}" is not one of ${PROVIDERS.map((p) => p.backend).join(", ")}`
+      ]
+    ]);
+  }
+  return [provider];
+}
+async function loadBinding(pinned) {
+  const attempts = [];
+  for (const provider of shortlist(pinned)) {
+    if (!provider.eligible()) {
+      attempts.push([provider.specifier, "not eligible in this runtime"]);
+      continue;
+    }
+    const already = bindings.get(provider.backend);
+    if (already) return already;
+    try {
+      const mod = await importModule(provider.specifier);
+      const ctor = mod[provider.exportName];
+      if (typeof ctor !== "function") {
+        attempts.push([provider.specifier, `no ${provider.exportName} export`]);
+        continue;
+      }
+      const binding = { provider, ctor };
+      bindings.set(provider.backend, binding);
+      return binding;
+    } catch (error) {
+      attempts.push([provider.specifier, error.message]);
+    }
+  }
+  throw new SqliteUnavailableError(attempts);
+}
+function normalise(value, where) {
+  if (typeof value === "boolean") return value ? 1 : 0;
+  if (value === void 0) {
+    throw new SqliteBindError(
+      `undefined bound at ${where}; pass null to mean NULL`
+    );
+  }
+  if (typeof value === "string" && value.includes(NUL)) {
+    throw new SqliteBindError(
+      `value at ${where} contains a NUL byte, which sqlite TEXT truncates; store it as bytes instead`
+    );
+  }
+  return value;
+}
+function scanPlaceholders(sql) {
+  const found = /* @__PURE__ */ new Map();
+  let i = 0;
+  while (i < sql.length) {
+    const ch = sql[i];
+    if (ch === "'" || ch === '"' || ch === "`") {
+      i += 1;
+      while (i < sql.length && sql[i] !== ch) i += 1;
+      i += 1;
+      continue;
+    }
+    if (ch === "-" && sql[i + 1] === "-") {
+      while (i < sql.length && sql[i] !== "\n") i += 1;
+      continue;
+    }
+    if (ch === "/" && sql[i + 1] === "*") {
+      i += 2;
+      while (i < sql.length && !(sql[i] === "*" && sql[i + 1] === "/")) i += 1;
+      i += 2;
+      continue;
+    }
+    if (ch === "$" || ch === ":" || ch === "@") {
+      let j = i + 1;
+      while (j < sql.length && /[A-Za-z0-9_]/.test(sql[j])) j += 1;
+      if (j > i + 1) {
+        const token = sql.slice(i, j);
+        found.set(token.slice(1), token);
+        i = j;
+        continue;
+      }
+    }
+    i += 1;
+  }
+  return found;
+}
+function bindArgs(params, placeholders, provider) {
+  if (params === void 0) return [];
+  if (Array.isArray(params)) {
+    return params.map(
+      (value, index) => normalise(value, `position ${index + 1}`)
+    );
+  }
+  const out = {};
+  const seen = /* @__PURE__ */ new Set();
+  for (const [key, value] of Object.entries(
+    params
+  )) {
+    const bare = key.replace(/^[$:@]/, "");
+    const token = placeholders.get(bare);
+    if (token === void 0) {
+      throw new SqliteBindError(
+        `named parameter "${key}" has no placeholder in the statement`
+      );
+    }
+    if (seen.has(bare)) {
+      throw new SqliteBindError(`named parameter "${bare}" given twice`);
+    }
+    seen.add(bare);
+    out[provider.bindKey(bare, token)] = normalise(value, `parameter ${key}`);
+  }
+  for (const bare of placeholders.keys()) {
+    if (!seen.has(bare)) {
+      throw new SqliteBindError(`placeholder "${bare}" has no value`);
+    }
+  }
+  return [out];
+}
+function wrapStatement(raw, sql, provider) {
+  const placeholders = scanPlaceholders(sql);
+  const args = (params) => bindArgs(params, placeholders, provider);
+  return {
+    // Measured: with no matching row bun returns null and node undefined, so a
+    // caller's `!== undefined` check passes on one runtime and dereferences
+    // null on the other. One absent value for both.
+    get: (params) => raw.get(...args(params)) ?? void 0,
+    all: (params) => raw.all(...args(params)),
+    run: (params) => raw.run(...args(params))
+  };
+}
+var IN_MEMORY = /* @__PURE__ */ new Set([":memory:", ""]);
+var JOURNAL_SQL = Object.freeze({
+  WAL: "PRAGMA journal_mode = WAL",
+  DELETE: "PRAGMA journal_mode = DELETE",
+  MEMORY: "PRAGMA journal_mode = MEMORY"
+});
+function build(binding, path, options) {
+  const { provider, ctor } = binding;
+  const readOnly = options.readOnly ?? false;
+  const raw = new ctor(path, provider.openOptions(readOnly));
+  const journalMode = options.journalMode ?? (IN_MEMORY.has(path) ? "MEMORY" : "WAL");
+  const journalSql = JOURNAL_SQL[journalMode];
+  if (journalSql === void 0) {
+    throw new SqliteBindError(`unknown journal mode ${String(journalMode)}`);
+  }
+  if (!readOnly) raw.exec(journalSql);
+  let inTransaction = false;
+  return {
+    backend: provider.backend,
+    exec: (sql) => raw.exec(sql),
+    prepare: (sql) => wrapStatement(raw.prepare(sql), sql, provider),
+    transaction(fn) {
+      if (inTransaction) throw new Error("transaction() is not nestable");
+      inTransaction = true;
+      raw.exec("BEGIN");
+      try {
+        const result = fn();
+        raw.exec("COMMIT");
+        return result;
+      } catch (error) {
+        raw.exec("ROLLBACK");
+        throw error;
+      } finally {
+        inTransaction = false;
+      }
+    },
+    close: () => raw.close()
+  };
+}
+async function openDatabase(path, options = {}) {
+  return build(await loadBinding(options.backend), path, options);
+}
+function moduleBase() {
+  return typeof __filename === "string" ? __filename : import.meta.url;
+}
+function loadBindingSync(pinned) {
+  const attempts = [];
+  const require2 = createRequire(moduleBase());
+  for (const provider of shortlist(pinned)) {
+    if (!provider.eligible()) {
+      attempts.push([provider.specifier, "not eligible in this runtime"]);
+      continue;
+    }
+    const already = bindings.get(provider.backend);
+    if (already) return already;
+    try {
+      const mod = require2(provider.specifier);
+      const ctor = provider.exportName === "default" ? mod.default ?? mod : mod[provider.exportName];
+      if (typeof ctor !== "function") {
+        attempts.push([provider.specifier, `no ${provider.exportName} export`]);
+        continue;
+      }
+      const binding = { provider, ctor };
+      bindings.set(provider.backend, binding);
+      return binding;
+    } catch (error) {
+      attempts.push([provider.specifier, error.message]);
+    }
+  }
+  throw new SqliteUnavailableError(attempts);
+}
+function openDatabaseSync(path, options = {}) {
+  return build(loadBindingSync(options.backend), path, options);
+}
+async function availableBackends() {
+  const found = [];
+  for (const provider of PROVIDERS) {
+    if (!provider.eligible()) continue;
+    try {
+      await loadBinding(provider.backend);
+      found.push(provider.backend);
+    } catch {
+    }
+  }
+  return found;
+}
+function resetBindingCache() {
+  bindings.clear();
+}
+
+// src/crypto/envelope.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHmac,
+  randomBytes
+} from "crypto";
+var MAGIC = new Uint8Array([69, 78, 86, 67]);
+var FORMAT_AES_256_GCM = 1;
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+var KEK_BYTES = 32;
+var HEADER_FIXED = MAGIC.length + 1 + 4 + 1;
+var EnvelopeFormatError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "EnvelopeFormatError";
+  }
+};
+var EnvelopeAuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "EnvelopeAuthError";
+  }
+};
+function concat(parts) {
+  const total = parts.reduce((n, p) => n + p.length, 0);
+  const out = new Uint8Array(total);
+  let at = 0;
+  for (const part of parts) {
+    out.set(part, at);
+    at += part.length;
+  }
+  return out;
+}
+function bytesEqual(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i += 1) if (a[i] !== b[i]) return false;
+  return true;
+}
+function checkKek(kek) {
+  if (kek.length !== KEK_BYTES) {
+    throw new EnvelopeFormatError(
+      `KEK must be ${KEK_BYTES} bytes for AES-256-GCM, got ${kek.length}`
+    );
+  }
+}
+function encodeHeader(header) {
+  const out = new Uint8Array(HEADER_FIXED + header.iv.length);
+  out.set(MAGIC, 0);
+  out[MAGIC.length] = header.format;
+  new DataView(out.buffer).setUint32(
+    MAGIC.length + 1,
+    header.kekVersion,
+    false
+  );
+  out[MAGIC.length + 5] = header.iv.length;
+  out.set(header.iv, HEADER_FIXED);
+  return out;
+}
+function decodeHeader(blob) {
+  if (blob.length < HEADER_FIXED) {
+    throw new EnvelopeFormatError("blob shorter than the envelope header");
+  }
+  if (!bytesEqual(blob.subarray(0, MAGIC.length), MAGIC)) {
+    throw new EnvelopeFormatError("not an ENVC envelope");
+  }
+  const format = blob[MAGIC.length];
+  if (format !== FORMAT_AES_256_GCM) {
+    throw new EnvelopeFormatError(`unknown envelope format ${format}`);
+  }
+  const view = new DataView(blob.buffer, blob.byteOffset, blob.byteLength);
+  const kekVersion = view.getUint32(MAGIC.length + 1, false);
+  const ivLen = blob[MAGIC.length + 5];
+  const headerLength = HEADER_FIXED + ivLen;
+  if (blob.length < headerLength + TAG_BYTES) {
+    throw new EnvelopeFormatError("blob too short for its declared iv and tag");
+  }
+  return {
+    header: {
+      format,
+      kekVersion,
+      iv: blob.subarray(HEADER_FIXED, headerLength)
+    },
+    headerBytes: blob.subarray(0, headerLength),
+    // The tag trails the ciphertext, as Web Crypto lays it out; node:crypto
+    // keeps the two apart, so the split happens here and nowhere else.
+    ciphertext: blob.subarray(headerLength, blob.length - TAG_BYTES),
+    tag: blob.subarray(blob.length - TAG_BYTES)
+  };
+}
+function seal(input) {
+  checkKek(input.kek);
+  const iv = input.iv ?? new Uint8Array(randomBytes(IV_BYTES));
+  if (iv.length === 0 || iv.length > 255) {
+    throw new EnvelopeFormatError(`iv length ${iv.length} is not encodable`);
+  }
+  const headerBytes = encodeHeader({
+    format: FORMAT_AES_256_GCM,
+    kekVersion: input.kekVersion,
+    iv
+  });
+  const cipher = createCipheriv("aes-256-gcm", input.kek, iv);
+  cipher.setAAD(concat([headerBytes, input.context]));
+  const body = new Uint8Array(
+    Buffer.concat([cipher.update(input.plaintext), cipher.final()])
+  );
+  return concat([headerBytes, body, new Uint8Array(cipher.getAuthTag())]);
+}
+function open(input) {
+  checkKek(input.kek);
+  const { header, headerBytes, ciphertext, tag } = decodeHeader(input.blob);
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", input.kek, header.iv);
+    decipher.setAAD(concat([headerBytes, input.context]));
+    decipher.setAuthTag(tag);
+    return new Uint8Array(
+      Buffer.concat([decipher.update(ciphertext), decipher.final()])
+    );
+  } catch {
+    throw new EnvelopeAuthError(
+      "envelope did not authenticate: wrong key, wrong context, or altered bytes"
+    );
+  }
+}
+function readHeader(blob) {
+  return decodeHeader(blob).header;
+}
+function hashKeyName(kek, name) {
+  checkKek(kek);
+  const ns = createHmac("sha256", kek).update("envs:key-name:v1").digest();
+  return new Uint8Array(createHmac("sha256", ns).update(name, "utf8").digest());
+}
+
+// src/crypto/keyring.ts
+import {
+  hkdfSync,
+  randomBytes as randomBytes2,
+  scryptSync,
+  timingSafeEqual
+} from "crypto";
+var DEK_BYTES = 32;
+var SALT_BYTES = 16;
+var CODE_BITS = 130;
+var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+var GROUP = 5;
+function kdfFor(method) {
+  return method === "recovery" ? "scrypt" : "hkdf";
+}
+var RecoveryCodeError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "RecoveryCodeError";
+  }
+};
+var KeyringLockedError = class extends Error {
+  constructor(tried) {
+    super(
+      `none of the ${tried} wraps opened with the secret given; try another recovery code or the KEK`
+    );
+    this.tried = tried;
+    this.name = "KeyringLockedError";
+  }
+  tried;
+};
+var SCRYPT = Object.freeze({ n: 1 << 15, r: 8, p: 1 });
+function formatRecoveryCode(raw) {
+  const groups = [];
+  for (let i = 0; i < raw.length; i += GROUP)
+    groups.push(raw.slice(i, i + GROUP));
+  return groups.join("-");
+}
+function generateRecoveryCode() {
+  const chars = Math.ceil(CODE_BITS / 5);
+  const source = randomBytes2(chars);
+  let out = "";
+  for (let i = 0; i < chars; i += 1) {
+    out += ALPHABET[source[i] % ALPHABET.length];
+  }
+  return formatRecoveryCode(out);
+}
+function normaliseRecoveryCode(input) {
+  const cleaned = input.toUpperCase().replace(/[\s-]/g, "").replace(/[IL]/g, "1").replace(/O/g, "0");
+  if (cleaned.length === 0) {
+    throw new RecoveryCodeError("recovery code is empty");
+  }
+  for (const ch of cleaned) {
+    if (!ALPHABET.includes(ch)) {
+      throw new RecoveryCodeError(
+        `recovery code contains "${ch}", which is not in the alphabet`
+      );
+    }
+  }
+  return cleaned;
+}
+function wrapKeyFrom(secret, salt, method, cost) {
+  if (kdfFor(method) === "hkdf") {
+    return new Uint8Array(
+      hkdfSync("sha256", secret, salt, "envs:dek-wrap:v1", DEK_BYTES)
+    );
+  }
+  return new Uint8Array(
+    scryptSync(secret, salt, DEK_BYTES, {
+      N: cost.n,
+      r: cost.r,
+      p: cost.p,
+      // scrypt's default cap is below what N=32768 needs.
+      maxmem: 256 * cost.n * cost.r
+    })
+  );
+}
+var encoder = new TextEncoder();
+function wrapContext(wrapId, method) {
+  return encoder.encode(`envs:dek-wrap:v1:${method}:${wrapId}`);
+}
+function makeWrap(dek, secret, method, wrapId) {
+  const salt = new Uint8Array(randomBytes2(SALT_BYTES));
+  const key = wrapKeyFrom(secret, salt, method, SCRYPT);
+  return {
+    wrapId,
+    method,
+    salt,
+    n: SCRYPT.n,
+    r: SCRYPT.r,
+    p: SCRYPT.p,
+    envelope: seal({
+      kek: key,
+      kekVersion: 1,
+      plaintext: dek,
+      context: wrapContext(wrapId, method)
+    })
+  };
+}
+function createKeyring(options) {
+  const dek = options.dek ?? new Uint8Array(randomBytes2(DEK_BYTES));
+  const newId = options.newId ?? (() => crypto.randomUUID());
+  const newCode = options.newCode ?? generateRecoveryCode;
+  const wraps = [makeWrap(dek, options.kek, "kek", newId())];
+  const codes = [];
+  for (let i = 0; i < (options.recoveryCodes ?? 0); i += 1) {
+    const code = newCode();
+    codes.push(code);
+    wraps.push(
+      makeWrap(
+        dek,
+        encoder.encode(normaliseRecoveryCode(code)),
+        "recovery",
+        newId()
+      )
+    );
+  }
+  return { dek, wraps, recoveryCodes: codes };
+}
+function unlockDek(wraps, unlock) {
+  const method = "kek" in unlock ? "kek" : "recovery";
+  const secret = "kek" in unlock ? unlock.kek : encoder.encode(normaliseRecoveryCode(unlock.recoveryCode));
+  const candidates = wraps.filter((wrap) => wrap.method === method);
+  for (const wrap of candidates) {
+    const key = wrapKeyFrom(secret, wrap.salt, wrap.method, wrap);
+    try {
+      return open({
+        kek: key,
+        blob: wrap.envelope,
+        context: wrapContext(wrap.wrapId, wrap.method)
+      });
+    } catch (error) {
+      if (!(error instanceof EnvelopeAuthError)) throw error;
+    }
+  }
+  throw new KeyringLockedError(candidates.length);
+}
+function addWrap(dek, unlock, wrapId) {
+  const method = "kek" in unlock ? "kek" : "recovery";
+  const secret = "kek" in unlock ? unlock.kek : encoder.encode(normaliseRecoveryCode(unlock.recoveryCode));
+  return makeWrap(dek, secret, method, wrapId);
+}
+function sameKey(a, b) {
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
+// src/catalog/schema.ts
+var SCHEMA_VERSION = 4;
+var V1 = [
+  `CREATE TABLE schema_meta (
+     id           INTEGER PRIMARY KEY CHECK (id = 1),
+     version      INTEGER NOT NULL,
+     catalog_id   TEXT    NOT NULL,
+     created_at   TEXT    NOT NULL
+   )`,
+  `CREATE TABLE sources (
+     source_id     TEXT PRIMARY KEY,
+     path          TEXT NOT NULL UNIQUE,
+     alias         TEXT NOT NULL UNIQUE,
+     kind          TEXT NOT NULL,
+     digest        TEXT,
+     added_at      TEXT NOT NULL,
+     last_seen_at  TEXT,
+     retired_at    TEXT
+   )`,
+  // A retired alias is never reused: the same name must not come to mean a
+  // different file for a script that already refers to it.
+  `CREATE TABLE alias_retired (
+     alias       TEXT PRIMARY KEY,
+     source_id   TEXT NOT NULL,
+     retired_at  TEXT NOT NULL
+   )`,
+  // Names are stored as HMACs. Opening the file without the key shows neither
+  // values nor which keys exist.
+  `CREATE TABLE keys (
+     key_hash       BLOB PRIMARY KEY,
+     first_seen_at  TEXT NOT NULL
+   )`,
+  `CREATE TABLE releases (
+     revision_id  TEXT PRIMARY KEY,
+     created_at   TEXT NOT NULL,
+     note         TEXT
+   )`,
+  `CREATE TABLE items (
+     source_id    TEXT NOT NULL REFERENCES sources (source_id),
+     key_hash     BLOB NOT NULL REFERENCES keys (key_hash),
+     revision_id  TEXT NOT NULL REFERENCES releases (revision_id),
+     envelope     BLOB NOT NULL,
+     kek_version  INTEGER NOT NULL,
+     created_at   TEXT NOT NULL,
+     PRIMARY KEY (source_id, key_hash, revision_id)
+   )`,
+  `CREATE INDEX items_by_revision ON items (revision_id)`,
+  `CREATE INDEX items_by_key ON items (key_hash)`,
+  // One row. The pointer is what a rollback moves.
+  `CREATE TABLE pointer (
+     id           INTEGER PRIMARY KEY CHECK (id = 1),
+     revision_id  TEXT NOT NULL REFERENCES releases (revision_id),
+     updated_at   TEXT NOT NULL
+   )`,
+  `CREATE TABLE audit (
+     id       INTEGER PRIMARY KEY AUTOINCREMENT,
+     at       TEXT NOT NULL,
+     action   TEXT NOT NULL,
+     subject  TEXT,
+     detail   TEXT
+   )`,
+  `CREATE TABLE kek_history (
+     version      INTEGER PRIMARY KEY,
+     fingerprint  TEXT NOT NULL,
+     created_at   TEXT NOT NULL,
+     retired_at   TEXT
+   )`,
+  // One row per way of recovering the DEK: the KEK, and each recovery code.
+  // Only the wrapped DEK is here. A recovery code is printed once at init and
+  // never stored, so this table cannot give one back.
+  `CREATE TABLE dek_wraps (
+     wrap_id     TEXT PRIMARY KEY,
+     method      TEXT NOT NULL CHECK (method IN ('kek', 'recovery')),
+     salt        BLOB NOT NULL,
+     scrypt_n    INTEGER NOT NULL,
+     scrypt_r    INTEGER NOT NULL,
+     scrypt_p    INTEGER NOT NULL,
+     envelope    BLOB NOT NULL,
+     created_at  TEXT NOT NULL,
+     last_used_at TEXT,
+     retired_at  TEXT
+   )`
+];
+var V2 = [
+  `CREATE TABLE watch_targets (
+     target_id  TEXT PRIMARY KEY,
+     pattern    TEXT NOT NULL UNIQUE,
+     mode       TEXT NOT NULL CHECK (mode IN ('include', 'exclude')),
+     added_at   TEXT NOT NULL
+   )`
+];
+var V3 = [`ALTER TABLE keys ADD COLUMN sensitivity TEXT`];
+var V4 = [
+  `CREATE TABLE template_ref (
+     name        TEXT PRIMARY KEY,
+     version     INTEGER NOT NULL,
+     digest      TEXT NOT NULL,
+     payload     TEXT NOT NULL,
+     applied_at  TEXT NOT NULL
+   )`
+];
+var MIGRATIONS = [
+  { version: 1, statements: V1 },
+  { version: 2, statements: V2 },
+  { version: 3, statements: V3 },
+  { version: 4, statements: V4 }
+];
+var CatalogVersionError = class extends Error {
+  constructor(found, supported, message) {
+    super(message);
+    this.found = found;
+    this.supported = supported;
+    this.name = "CatalogVersionError";
+  }
+  found;
+  supported;
+};
+function tableExists(db, name) {
+  const row = db.prepare(
+    "SELECT count(*) AS n FROM sqlite_master WHERE type = 'table' AND name = $name"
+  ).get({ name });
+  return (row?.n ?? 0) > 0;
+}
+function readMeta(db) {
+  if (!tableExists(db, "schema_meta")) return void 0;
+  const row = db.prepare(
+    "SELECT version, catalog_id, created_at FROM schema_meta WHERE id = 1"
+  ).get();
+  if (row === void 0) return void 0;
+  return {
+    version: Number(row.version),
+    catalogId: row.catalog_id,
+    createdAt: row.created_at
+  };
+}
+function applyMigrations(db, from, to) {
+  for (const migration of MIGRATIONS) {
+    if (migration.version <= from || migration.version > to) continue;
+    for (const statement of migration.statements) db.exec(statement);
+  }
+}
+function createSchema(db, options = {}) {
+  const catalogId = options.catalogId ?? crypto.randomUUID();
+  const createdAt = (options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString()))();
+  db.transaction(() => {
+    applyMigrations(db, 0, SCHEMA_VERSION);
+    db.prepare(
+      "INSERT INTO schema_meta (id, version, catalog_id, created_at) VALUES (1, $version, $catalogId, $createdAt)"
+    ).run({ version: SCHEMA_VERSION, catalogId, createdAt });
+  });
+  return { version: SCHEMA_VERSION, catalogId, createdAt };
+}
+function checkVersion(meta) {
+  if (meta.version > SCHEMA_VERSION) {
+    throw new CatalogVersionError(
+      meta.version,
+      SCHEMA_VERSION,
+      `catalog is at schema ${meta.version} and this build understands ${SCHEMA_VERSION}; upgrade @modootoday/envs`
+    );
+  }
+  if (meta.version < SCHEMA_VERSION) {
+    throw new CatalogVersionError(
+      meta.version,
+      SCHEMA_VERSION,
+      `catalog is at schema ${meta.version} and this build is at ${SCHEMA_VERSION}; run "envs migrate" to upgrade it`
+    );
+  }
+}
+async function openCatalog(path, options = {}) {
+  const db = await openDatabase(path, options);
+  let meta = readMeta(db);
+  if (meta === void 0) {
+    if (options.create !== true) {
+      db.close();
+      throw new CatalogVersionError(
+        0,
+        SCHEMA_VERSION,
+        `no catalog at ${path}; run "envs init" first`
+      );
+    }
+    meta = createSchema(db, options);
+  } else {
+    try {
+      checkVersion(meta);
+    } catch (error) {
+      db.close();
+      throw error;
+    }
+  }
+  return { db, meta };
+}
+function migrate(db) {
+  const meta = readMeta(db);
+  if (meta === void 0) {
+    throw new CatalogVersionError(0, SCHEMA_VERSION, "no catalog to migrate");
+  }
+  if (meta.version > SCHEMA_VERSION) {
+    throw new CatalogVersionError(
+      meta.version,
+      SCHEMA_VERSION,
+      `catalog is at schema ${meta.version}, newer than this build`
+    );
+  }
+  if (meta.version === SCHEMA_VERSION) return meta;
+  db.transaction(() => {
+    applyMigrations(db, meta.version, SCHEMA_VERSION);
+    db.prepare("UPDATE schema_meta SET version = $version WHERE id = 1").run({
+      version: SCHEMA_VERSION
+    });
+  });
+  return { ...meta, version: SCHEMA_VERSION };
+}
+
+// src/loader/locate.ts
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { dirname, join, resolve } from "path";
+var DIR_NAME = ".envs";
+var CATALOG_FILE = "catalog.sqlite";
+var ROOT_MARKERS = [
+  "bun.lock",
+  "bun.lockb",
+  "pnpm-workspace.yaml",
+  "package-lock.json",
+  "yarn.lock",
+  ".git",
+  "package.json"
+];
+function findProjectRoot(from) {
+  let dir = resolve(from);
+  for (; ; ) {
+    for (const marker of ROOT_MARKERS) {
+      if (existsSync(join(dir, marker))) return dir;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function globalDir(home = homedir()) {
+  return join(home, DIR_NAME);
+}
+function locateCatalogs(options = {}) {
+  const env = options.env ?? process.env;
+  const cwd = options.cwd ?? process.cwd();
+  const home = options.home ?? env["HOME"] ?? homedir();
+  const explicit = env["ENVS_CATALOG_PATH"];
+  if (explicit !== void 0 && explicit !== "") {
+    return { project: resolve(explicit), source: "explicit" };
+  }
+  const globalPath = join(globalDir(home), CATALOG_FILE);
+  const root = findProjectRoot(cwd);
+  if (root === void 0) {
+    return { project: globalPath, source: "global" };
+  }
+  return {
+    project: join(root, DIR_NAME, CATALOG_FILE),
+    global: globalPath,
+    projectRoot: root,
+    source: "project"
+  };
+}
+function cacheDir(options = {}) {
+  const argv1 = process.argv[1] ?? "";
+  const ephemeral = /[\\/]_npx[\\/]/.test(argv1);
+  const root = findProjectRoot(options.cwd ?? process.cwd());
+  if (!ephemeral && root !== void 0) {
+    return join(root, "node_modules", ".cache", "envs");
+  }
+  return join(globalDir(options.home ?? homedir()), "cache");
+}
+
+// src/crypto/digest.ts
+function toHex(bytes) {
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join(
+    ""
+  );
+}
+async function sha256Hex(bytes) {
+  const copy = bytes.slice();
+  return toHex(new Uint8Array(await crypto.subtle.digest("SHA-256", copy)));
+}
+
+// src/loader/read.ts
+var NoReleaseError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "NoReleaseError";
+  }
+};
+var decoder = new TextDecoder();
+var encoder2 = new TextEncoder();
+function itemContext(sourceId, keyHash, revisionId) {
+  return encoder2.encode(
+    `envs:item:v1:${sourceId}:${toHex(keyHash)}:${revisionId}`
+  );
+}
+function assertReadable(db) {
+  const meta = readMeta(db);
+  if (meta !== void 0 && meta.version > SCHEMA_VERSION) {
+    throw new CatalogVersionError(
+      meta.version,
+      SCHEMA_VERSION,
+      `this catalog was written by a newer envs (schema ${String(meta.version)}, this build reads ${String(SCHEMA_VERSION)}); upgrade @modootoday/envs`
+    );
+  }
+}
+function readWraps(db) {
+  assertReadable(db);
+  return db.prepare(
+    "SELECT wrap_id, method, salt, scrypt_n, scrypt_r, scrypt_p, envelope FROM dek_wraps WHERE retired_at IS NULL"
+  ).all().map((row) => ({
+    wrapId: row.wrap_id,
+    method: row.method === "kek" ? "kek" : "recovery",
+    salt: new Uint8Array(row.salt),
+    n: Number(row.scrypt_n),
+    r: Number(row.scrypt_r),
+    p: Number(row.scrypt_p),
+    envelope: new Uint8Array(row.envelope)
+  }));
+}
+function currentRevision(db) {
+  return db.prepare(
+    "SELECT revision_id FROM pointer WHERE id = 1"
+  ).get()?.revision_id;
+}
+function readEntries(db, options) {
+  const revision = options.revisionId ?? currentRevision(db);
+  if (revision === void 0) {
+    throw new NoReleaseError(
+      'catalog has no current release; run "envs pull" or "envs load" first'
+    );
+  }
+  const dek = unlockDek(readWraps(db), options.unlock);
+  const rows = db.prepare(
+    `SELECT i.source_id, s.alias, s.path, i.key_hash, i.envelope
+         FROM items i
+         JOIN sources s ON s.source_id = i.source_id
+        WHERE i.revision_id = $revision
+          AND s.retired_at IS NULL
+        ORDER BY s.added_at, s.source_id, i.rowid`
+  ).all({ revision });
+  const wanted = options.aliases === void 0 ? void 0 : new Set(options.aliases);
+  const entries = [];
+  for (const row of rows) {
+    if (wanted !== void 0 && !wanted.has(row.alias)) continue;
+    const plain = open({
+      kek: dek,
+      blob: new Uint8Array(row.envelope),
+      context: itemContext(
+        row.source_id,
+        new Uint8Array(row.key_hash),
+        revision
+      )
+    });
+    const text = decoder.decode(plain);
+    const split = text.indexOf("=");
+    if (split <= 0) {
+      throw new Error(
+        `item in source ${row.alias} does not carry a key name; the catalog is corrupt`
+      );
+    }
+    entries.push({
+      key: text.slice(0, split),
+      value: text.slice(split + 1),
+      sourceId: row.source_id,
+      alias: row.alias,
+      path: row.path
+    });
+  }
+  if (options.aliases === void 0) return entries;
+  const rank = new Map(options.aliases.map((alias, index) => [alias, index]));
+  return [...entries].sort(
+    (a, b) => (rank.get(a.alias) ?? 0) - (rank.get(b.alias) ?? 0)
+  );
+}
+
+// src/loader/config.ts
+import { existsSync as existsSync2, readFileSync } from "fs";
+var ConflictError = class extends Error {
+  constructor(key, first, second) {
+    super(
+      `key "${key}" is declared by ${first.layer}:${first.from} and ${second.layer}:${second.from}`
+    );
+    this.key = key;
+    this.first = first;
+    this.second = second;
+    this.name = "ConflictError";
+  }
+  key;
+  first;
+  second;
+};
+var KekMissingError = class extends Error {
+  constructor() {
+    super(
+      "no key available: set ENVS_KEK, or pass unlock explicitly. Values stay sealed without it."
+    );
+    this.name = "KekMissingError";
+  }
+};
+function decodeKek(raw) {
+  const bytes = new Uint8Array(Buffer.from(raw, "base64"));
+  if (bytes.length !== 32) {
+    throw new KekMissingError();
+  }
+  return bytes;
+}
+function resolveUnlock(options, env) {
+  if (options.unlock !== void 0) return options.unlock;
+  const raw = env["ENVS_KEK"];
+  if (raw === void 0 || raw === "") throw new KekMissingError();
+  return { kek: decodeKek(raw) };
+}
+function isTruthy(value) {
+  return value !== void 0 && value !== "" && value !== "0" && value !== "false";
+}
+function fileEntries(paths, encoding) {
+  const entries = [];
+  for (const path of paths) {
+    if (!existsSync2(path)) continue;
+    const parsed = parseEnv(readFileSync(path, encoding));
+    const record = toRecord(parsed);
+    if (record === null) {
+      return {
+        entries,
+        error: new Error(
+          `${path} is not env format: ${parsed.findings.map((f) => `${f.code} at line ${f.line}`).join(", ")}`
+        )
+      };
+    }
+    for (const [key, value] of Object.entries(record)) {
+      entries.push({ key, value, sourceId: path, alias: path, path });
+    }
+  }
+  return { entries };
+}
+function catalogEntries(path, options, unlock) {
+  if (!existsSync2(path)) return [];
+  let db;
+  try {
+    db = openDatabaseSync(path, { readOnly: true });
+    return readEntries(db, {
+      unlock,
+      ...options.aliases ? { aliases: options.aliases } : {}
+    });
+  } finally {
+    db?.close();
+  }
+}
+function merge(ordered, override, onConflict, debug) {
+  const parsed = {};
+  const seen = /* @__PURE__ */ new Map();
+  for (const { entry, layer } of ordered) {
+    const here = { key: entry.key, layer, from: entry.alias };
+    const earlier = seen.get(entry.key);
+    if (earlier === void 0) {
+      parsed[entry.key] = entry.value;
+      seen.set(entry.key, here);
+      continue;
+    }
+    if (onConflict === "throw")
+      throw new ConflictError(entry.key, earlier, here);
+    if (onConflict === "warn") {
+      debug(
+        `[envs] "${entry.key}" declared by ${earlier.layer}:${earlier.from} and ${here.layer}:${here.from}`
+      );
+    }
+    if (override) {
+      parsed[entry.key] = entry.value;
+      seen.set(entry.key, here);
+    }
+  }
+  return { parsed, provenance: [...seen.values()] };
+}
+function config(options = {}) {
+  const env = options.env ?? process.env;
+  const target = options.processEnv ?? process.env;
+  const override = options.override ?? false;
+  const onConflict = options.onConflict ?? "ignore";
+  const quiet = options.quiet ?? false;
+  const debugOn = options.debug ?? false;
+  const debug = (message) => {
+    if (debugOn || !quiet) process.stderr.write(`${message}
+`);
+  };
+  try {
+    const locateOptions = {
+      ...options.cwd ? { cwd: options.cwd } : {},
+      ...options.home ? { home: options.home } : {},
+      env
+    };
+    const located = locateCatalogs(locateOptions);
+    const useGlobal = (options.global ?? true) && !isTruthy(env["ENVS_NO_GLOBAL"]);
+    const ordered = [];
+    if (options.path !== void 0) {
+      const paths = typeof options.path === "string" ? [options.path] : options.path;
+      const read = fileEntries(paths, options.encoding ?? "utf8");
+      if (read.error) return { error: read.error };
+      for (const entry of read.entries) ordered.push({ entry, layer: "file" });
+    }
+    const sawCatalog = existsSync2(located.project) || useGlobal && located.global !== void 0 && existsSync2(located.global);
+    if (!sawCatalog && options.path === void 0) {
+      return {
+        error: new Error(
+          `no catalog at ${located.project}; run "envs init" first`
+        )
+      };
+    }
+    if (sawCatalog) {
+      const unlock = resolveUnlock(options, env);
+      for (const entry of catalogEntries(located.project, options, unlock)) {
+        ordered.push({ entry, layer: "project" });
+      }
+      if (useGlobal && located.global !== void 0) {
+        for (const entry of catalogEntries(located.global, options, unlock)) {
+          ordered.push({ entry, layer: "global" });
+        }
+      }
+    }
+    const { parsed, provenance } = merge(ordered, override, onConflict, debug);
+    const applied = [];
+    for (const [key, value] of Object.entries(parsed)) {
+      const present = Object.prototype.hasOwnProperty.call(target, key);
+      if (present && !override) {
+        applied.push({ key, layer: "process", from: "process.env" });
+        continue;
+      }
+      target[key] = value;
+      applied.push(provenance.find((p) => p.key === key));
+    }
+    return { parsed, provenance: applied };
+  } catch (error) {
+    return { error };
+  }
+}
+
+export {
+  parseEnv,
+  toRecord,
+  PROVIDERS,
+  SqliteUnavailableError,
+  SqliteBindError,
+  scanPlaceholders,
+  openDatabase,
+  openDatabaseSync,
+  availableBackends,
+  resetBindingCache,
+  FORMAT_AES_256_GCM,
+  EnvelopeFormatError,
+  EnvelopeAuthError,
+  seal,
+  open,
+  readHeader,
+  hashKeyName,
+  DEK_BYTES,
+  RecoveryCodeError,
+  KeyringLockedError,
+  formatRecoveryCode,
+  generateRecoveryCode,
+  normaliseRecoveryCode,
+  createKeyring,
+  unlockDek,
+  addWrap,
+  sameKey,
+  SCHEMA_VERSION,
+  MIGRATIONS,
+  CatalogVersionError,
+  readMeta,
+  createSchema,
+  checkVersion,
+  openCatalog,
+  migrate,
+  findProjectRoot,
+  globalDir,
+  locateCatalogs,
+  cacheDir,
+  sha256Hex,
+  NoReleaseError,
+  itemContext,
+  readWraps,
+  currentRevision,
+  readEntries,
+  ConflictError,
+  KekMissingError,
+  config
+};