@modootoday/envs 0.1.0

package/dist/cli.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/cli.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import {
+  dispatch
+} from "./chunk-47XO3SDE.js";
+import "./chunk-STHFIZRP.js";
+
+// src/cli.ts
+void Promise.resolve(dispatch(process.argv.slice(2))).then((code) => {
+  process.exitCode = code;
+});

package/dist/config-DKLCgBZX.d.cts

@@ -0,0 +1,116 @@
+/**
+ * Key hierarchy. Values are sealed under a random DEK, and the DEK is wrapped
+ * once per way of getting it back: the KEK, and each recovery code. Losing one
+ * way costs nothing as long as another wrap survives.
+ */
+declare const DEK_BYTES = 32;
+type WrapMethod = "kek" | "recovery";
+interface DekWrap {
+    readonly wrapId: string;
+    readonly method: WrapMethod;
+    readonly salt: Uint8Array;
+    /** scrypt cost, stored so a future default cannot orphan an old wrap. */
+    readonly n: number;
+    readonly r: number;
+    readonly p: number;
+    readonly envelope: Uint8Array;
+}
+interface Keyring {
+    readonly dek: Uint8Array;
+    readonly wraps: readonly DekWrap[];
+    /** Shown once at creation. Never stored, never recoverable from the wraps. */
+    readonly recoveryCodes: readonly string[];
+}
+declare class RecoveryCodeError extends Error {
+    constructor(message: string);
+}
+declare class KeyringLockedError extends Error {
+    readonly tried: number;
+    constructor(tried: number);
+}
+declare function formatRecoveryCode(raw: string): string;
+declare function generateRecoveryCode(): string;
+/**
+ * Accepts what a person actually types: any case, any separators, and the
+ * letters Crockford treats as digits. A code rejected for a typo that the
+ * alphabet was designed to absorb is a lost catalog.
+ */
+declare function normaliseRecoveryCode(input: string): string;
+interface CreateKeyringOptions {
+    readonly kek: Uint8Array;
+    /** How many recovery codes to mint. Zero means the KEK is the only way back. */
+    readonly recoveryCodes?: number;
+    /** Injectable so a test can assert on fixed material. */
+    readonly dek?: Uint8Array;
+    readonly newId?: () => string;
+    readonly newCode?: () => string;
+}
+declare function createKeyring(options: CreateKeyringOptions): Keyring;
+type Unlock = {
+    readonly kek: Uint8Array;
+} | {
+    readonly recoveryCode: string;
+};
+/**
+ * Tries every wrap of the matching method. A recovery code is checked against
+ * all of them because the holder cannot know which wrap is theirs.
+ */
+declare function unlockDek(wraps: readonly DekWrap[], unlock: Unlock): Uint8Array;
+/** Same DEK, a new wrap: adds a way back without re-encrypting any value. */
+declare function addWrap(dek: Uint8Array, unlock: Unlock, wrapId: string): DekWrap;
+/** Constant-time comparison, for callers verifying a DEK round trip. */
+declare function sameKey(a: Uint8Array, b: Uint8Array): boolean;
+
+/**
+ * config(), shaped like dotenv's and resolving a store rather than a file. Fully
+ * synchronous: this is a side-effect import, so nothing here may await.
+ */
+
+type OnConflict = "ignore" | "warn" | "throw";
+/**
+ * Node's BufferEncoding, restated. The published declarations must not need an
+ * ambient global a consumer may not have loaded.
+ */
+type Encoding = "ascii" | "utf8" | "utf-8" | "utf16le" | "utf-16le" | "ucs2" | "ucs-2" | "base64" | "base64url" | "latin1" | "binary" | "hex";
+type Layer = "process" | "project" | "global" | "file";
+interface Provenance {
+    readonly key: string;
+    readonly layer: Layer;
+    /** Alias for a catalog source, absolute path for a file. */
+    readonly from: string;
+}
+interface ConfigOptions {
+    readonly path?: string | readonly string[];
+    readonly encoding?: Encoding;
+    readonly debug?: boolean;
+    readonly override?: boolean;
+    readonly quiet?: boolean;
+    readonly processEnv?: Record<string, string | undefined>;
+    /** Source aliases to load, in precedence order. */
+    readonly aliases?: readonly string[];
+    readonly onConflict?: OnConflict;
+    /** Read the machine-wide layer. CI should turn this off. */
+    readonly global?: boolean;
+    readonly unlock?: Unlock;
+    readonly cwd?: string;
+    readonly home?: string;
+    readonly env?: Readonly<Record<string, string | undefined>>;
+}
+interface ConfigResult {
+    readonly parsed?: Record<string, string>;
+    readonly error?: Error;
+    /** Where each key came from. `doctor` prints this; values are never in it. */
+    readonly provenance?: readonly Provenance[];
+}
+declare class ConflictError extends Error {
+    readonly key: string;
+    readonly first: Provenance;
+    readonly second: Provenance;
+    constructor(key: string, first: Provenance, second: Provenance);
+}
+declare class KekMissingError extends Error {
+    constructor();
+}
+declare function config(options?: ConfigOptions): ConfigResult;
+
+export { type ConfigResult as C, type DekWrap as D, type Encoding as E, KekMissingError as K, type Layer as L, type OnConflict as O, type Provenance as P, RecoveryCodeError as R, type Unlock as U, type WrapMethod as W, type ConfigOptions as a, ConflictError as b, type CreateKeyringOptions as c, DEK_BYTES as d, type Keyring as e, KeyringLockedError as f, addWrap as g, config as h, createKeyring as i, formatRecoveryCode as j, generateRecoveryCode as k, normaliseRecoveryCode as n, sameKey as s, unlockDek as u };

package/dist/config-DKLCgBZX.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Key hierarchy. Values are sealed under a random DEK, and the DEK is wrapped
+ * once per way of getting it back: the KEK, and each recovery code. Losing one
+ * way costs nothing as long as another wrap survives.
+ */
+declare const DEK_BYTES = 32;
+type WrapMethod = "kek" | "recovery";
+interface DekWrap {
+    readonly wrapId: string;
+    readonly method: WrapMethod;
+    readonly salt: Uint8Array;
+    /** scrypt cost, stored so a future default cannot orphan an old wrap. */
+    readonly n: number;
+    readonly r: number;
+    readonly p: number;
+    readonly envelope: Uint8Array;
+}
+interface Keyring {
+    readonly dek: Uint8Array;
+    readonly wraps: readonly DekWrap[];
+    /** Shown once at creation. Never stored, never recoverable from the wraps. */
+    readonly recoveryCodes: readonly string[];
+}
+declare class RecoveryCodeError extends Error {
+    constructor(message: string);
+}
+declare class KeyringLockedError extends Error {
+    readonly tried: number;
+    constructor(tried: number);
+}
+declare function formatRecoveryCode(raw: string): string;
+declare function generateRecoveryCode(): string;
+/**
+ * Accepts what a person actually types: any case, any separators, and the
+ * letters Crockford treats as digits. A code rejected for a typo that the
+ * alphabet was designed to absorb is a lost catalog.
+ */
+declare function normaliseRecoveryCode(input: string): string;
+interface CreateKeyringOptions {
+    readonly kek: Uint8Array;
+    /** How many recovery codes to mint. Zero means the KEK is the only way back. */
+    readonly recoveryCodes?: number;
+    /** Injectable so a test can assert on fixed material. */
+    readonly dek?: Uint8Array;
+    readonly newId?: () => string;
+    readonly newCode?: () => string;
+}
+declare function createKeyring(options: CreateKeyringOptions): Keyring;
+type Unlock = {
+    readonly kek: Uint8Array;
+} | {
+    readonly recoveryCode: string;
+};
+/**
+ * Tries every wrap of the matching method. A recovery code is checked against
+ * all of them because the holder cannot know which wrap is theirs.
+ */
+declare function unlockDek(wraps: readonly DekWrap[], unlock: Unlock): Uint8Array;
+/** Same DEK, a new wrap: adds a way back without re-encrypting any value. */
+declare function addWrap(dek: Uint8Array, unlock: Unlock, wrapId: string): DekWrap;
+/** Constant-time comparison, for callers verifying a DEK round trip. */
+declare function sameKey(a: Uint8Array, b: Uint8Array): boolean;
+
+/**
+ * config(), shaped like dotenv's and resolving a store rather than a file. Fully
+ * synchronous: this is a side-effect import, so nothing here may await.
+ */
+
+type OnConflict = "ignore" | "warn" | "throw";
+/**
+ * Node's BufferEncoding, restated. The published declarations must not need an
+ * ambient global a consumer may not have loaded.
+ */
+type Encoding = "ascii" | "utf8" | "utf-8" | "utf16le" | "utf-16le" | "ucs2" | "ucs-2" | "base64" | "base64url" | "latin1" | "binary" | "hex";
+type Layer = "process" | "project" | "global" | "file";
+interface Provenance {
+    readonly key: string;
+    readonly layer: Layer;
+    /** Alias for a catalog source, absolute path for a file. */
+    readonly from: string;
+}
+interface ConfigOptions {
+    readonly path?: string | readonly string[];
+    readonly encoding?: Encoding;
+    readonly debug?: boolean;
+    readonly override?: boolean;
+    readonly quiet?: boolean;
+    readonly processEnv?: Record<string, string | undefined>;
+    /** Source aliases to load, in precedence order. */
+    readonly aliases?: readonly string[];
+    readonly onConflict?: OnConflict;
+    /** Read the machine-wide layer. CI should turn this off. */
+    readonly global?: boolean;
+    readonly unlock?: Unlock;
+    readonly cwd?: string;
+    readonly home?: string;
+    readonly env?: Readonly<Record<string, string | undefined>>;
+}
+interface ConfigResult {
+    readonly parsed?: Record<string, string>;
+    readonly error?: Error;
+    /** Where each key came from. `doctor` prints this; values are never in it. */
+    readonly provenance?: readonly Provenance[];
+}
+declare class ConflictError extends Error {
+    readonly key: string;
+    readonly first: Provenance;
+    readonly second: Provenance;
+    constructor(key: string, first: Provenance, second: Provenance);
+}
+declare class KekMissingError extends Error {
+    constructor();
+}
+declare function config(options?: ConfigOptions): ConfigResult;
+
+export { type ConfigResult as C, type DekWrap as D, type Encoding as E, KekMissingError as K, type Layer as L, type OnConflict as O, type Provenance as P, RecoveryCodeError as R, type Unlock as U, type WrapMethod as W, type ConfigOptions as a, ConflictError as b, type CreateKeyringOptions as c, DEK_BYTES as d, type Keyring as e, KeyringLockedError as f, addWrap as g, config as h, createKeyring as i, formatRecoveryCode as j, generateRecoveryCode as k, normaliseRecoveryCode as n, sameKey as s, unlockDek as u };