@modootoday/envs 0.1.0

package/dist/config.cjs

@@ -0,0 +1,940 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/config.ts
+var config_exports = {};
+__export(config_exports, {
+  result: () => result
+});
+module.exports = __toCommonJS(config_exports);
+
+// src/loader/config.ts
+var import_node_fs2 = require("fs");
+
+// src/format/parse.ts
+var KEY_PATTERN = /^[\w.-]+$/;
+var EXPORT_PREFIX = /^export\s+/;
+function expandDoubleQuoted(raw) {
+  return raw.replace(/\\n/g, "\n").replace(/\\r/g, "\r");
+}
+function isQuote(ch) {
+  return ch === '"' || ch === "'" || ch === "`";
+}
+function scanQuoted(text, start, quote) {
+  let i = start + 1;
+  let out = "";
+  while (i < text.length) {
+    const ch = text[i];
+    if (ch === "\\" && i + 1 < text.length) {
+      out += ch + text[i + 1];
+      i += 2;
+      continue;
+    }
+    if (ch === quote) {
+      return {
+        value: quote === '"' ? expandDoubleQuoted(out) : out,
+        quote,
+        next: i + 1,
+        unterminated: false
+      };
+    }
+    out += ch;
+    i += 1;
+  }
+  return { value: out, quote, next: text.length, unterminated: true };
+}
+function scanBare(text, start) {
+  let i = start;
+  while (i < text.length && text[i] !== "\n" && text[i] !== "#") i += 1;
+  return {
+    value: text.slice(start, i).trim(),
+    quote: null,
+    next: i,
+    unterminated: false
+  };
+}
+function countLines(text, from, to) {
+  let n = 0;
+  for (let i = from; i < to; i += 1) if (text[i] === "\n") n += 1;
+  return n;
+}
+function restOfLineIsClean(text, from) {
+  let i = from;
+  while (i < text.length && text[i] !== "\n") {
+    const ch = text[i];
+    if (ch === "#") return true;
+    if (ch !== " " && ch !== "	") return false;
+    i += 1;
+  }
+  return true;
+}
+function parseEnv(input) {
+  const text = input.replace(/\r\n?/g, "\n");
+  const entries = [];
+  const findings = [];
+  let i = 0;
+  let line = 1;
+  const skipToNextLine = (from) => {
+    const nl = text.indexOf("\n", from);
+    return nl === -1 ? text.length : nl + 1;
+  };
+  while (i < text.length) {
+    const eol = text.indexOf("\n", i);
+    const lineEnd = eol === -1 ? text.length : eol;
+    const raw = text.slice(i, lineEnd);
+    const trimmed = raw.trim();
+    if (trimmed === "") {
+      entries.push({ kind: "blank", line, endLine: line });
+      i = lineEnd + 1;
+      line += 1;
+      continue;
+    }
+    if (trimmed.startsWith("#")) {
+      entries.push({ kind: "comment", line, endLine: line });
+      i = lineEnd + 1;
+      line += 1;
+      continue;
+    }
+    const lead = raw.length - raw.trimStart().length;
+    const body = raw.slice(lead);
+    const exported = EXPORT_PREFIX.test(body);
+    const afterExport = exported ? body.replace(EXPORT_PREFIX, "") : body;
+    const keyOffset = i + lead + (body.length - afterExport.length);
+    const eq = afterExport.indexOf("=");
+    if (eq === -1) {
+      findings.push({ code: "NOT_ENV_LINE", line });
+      i = lineEnd + 1;
+      line += 1;
+      continue;
+    }
+    const key = afterExport.slice(0, eq).trim();
+    if (key === "") {
+      findings.push({ code: "EMPTY_KEY", line });
+      i = lineEnd + 1;
+      line += 1;
+      continue;
+    }
+    if (!KEY_PATTERN.test(key)) {
+      findings.push({ code: "INVALID_KEY", line });
+      i = lineEnd + 1;
+      line += 1;
+      continue;
+    }
+    let cursor = keyOffset + eq + 1;
+    while (cursor < text.length && (text[cursor] === " " || text[cursor] === "	")) {
+      cursor += 1;
+    }
+    const ch = text[cursor];
+    const scan = ch !== void 0 && isQuote(ch) ? scanQuoted(text, cursor, ch) : scanBare(text, cursor);
+    if (scan.unterminated) {
+      findings.push({ code: "UNTERMINATED_QUOTE", line });
+      i = text.length;
+      break;
+    }
+    const endLine = line + countLines(text, i, scan.next);
+    if (!restOfLineIsClean(text, scan.next)) {
+      findings.push({ code: "TRAILING_CONTENT", line: endLine });
+      i = skipToNextLine(scan.next);
+      line = endLine + 1;
+      continue;
+    }
+    entries.push({
+      kind: "assignment",
+      line,
+      endLine,
+      key,
+      value: scan.value,
+      quote: scan.quote,
+      exported
+    });
+    i = skipToNextLine(scan.next);
+    line = endLine + 1;
+  }
+  return { ok: findings.length === 0, entries, findings };
+}
+function toRecord(result2) {
+  if (!result2.ok) return null;
+  const out = {};
+  for (const entry of result2.entries) {
+    if (entry.kind === "assignment") out[entry.key] = entry.value;
+  }
+  return out;
+}
+
+// src/sqlite/open.ts
+var import_node_module = require("module");
+
+// src/sqlite/provider.ts
+var onBun = () => typeof globalThis["Bun"] !== "undefined";
+var PROVIDERS = [
+  {
+    backend: "bun",
+    specifier: "bun:sqlite",
+    exportName: "Database",
+    builtIn: true,
+    // Rejects {} and {readonly:false}; a writable handle needs create.
+    openOptions: (readOnly) => readOnly ? { readonly: true } : { readonly: false, create: true },
+    eligible: onBun,
+    bindKey: (_bare, token) => token
+  },
+  {
+    backend: "node",
+    specifier: "node:sqlite",
+    exportName: "DatabaseSync",
+    builtIn: true,
+    // Spells it readOnly and silently ignores the lowercase name, which would
+    // hand back a writable database.
+    openOptions: (readOnly) => ({ readOnly }),
+    eligible: () => !onBun(),
+    bindKey: (_bare, token) => token
+  },
+  {
+    backend: "better-sqlite3",
+    specifier: "better-sqlite3",
+    exportName: "default",
+    builtIn: false,
+    // Wants the lowercase name and rejects the other as a misspelling.
+    openOptions: (readOnly) => ({ readonly: readOnly }),
+    // Never attempted on bun: the load is a process panic, not an exception.
+    eligible: () => !onBun(),
+    bindKey: (bare) => bare
+  }
+];
+function providerFor(backend) {
+  return PROVIDERS.find((provider) => provider.backend === backend);
+}
+
+// src/sqlite/open.ts
+var import_meta = {};
+var SqliteUnavailableError = class extends Error {
+  constructor(attempts) {
+    super(
+      `no sqlite backend available; tried ${attempts.map(([spec, reason]) => `${spec} (${reason})`).join(
+        ", "
+      )}. On a runtime without node:sqlite, install better-sqlite3.`
+    );
+    this.attempts = attempts;
+    this.name = "SqliteUnavailableError";
+  }
+  attempts;
+};
+var SqliteBindError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SqliteBindError";
+  }
+};
+var NUL = String.fromCharCode(0);
+var bindings = /* @__PURE__ */ new Map();
+function readEnv(name) {
+  return globalThis.process?.env?.[name];
+}
+function shortlist(pinned) {
+  const name = pinned ?? readEnv("ENVS_SQLITE_BACKEND");
+  if (name === void 0 || name === "") return PROVIDERS;
+  const provider = providerFor(name);
+  if (provider === void 0) {
+    throw new SqliteUnavailableError([
+      [
+        "backend pin",
+        `"${name}" is not one of ${PROVIDERS.map((p) => p.backend).join(", ")}`
+      ]
+    ]);
+  }
+  return [provider];
+}
+function normalise(value, where) {
+  if (typeof value === "boolean") return value ? 1 : 0;
+  if (value === void 0) {
+    throw new SqliteBindError(
+      `undefined bound at ${where}; pass null to mean NULL`
+    );
+  }
+  if (typeof value === "string" && value.includes(NUL)) {
+    throw new SqliteBindError(
+      `value at ${where} contains a NUL byte, which sqlite TEXT truncates; store it as bytes instead`
+    );
+  }
+  return value;
+}
+function scanPlaceholders(sql) {
+  const found = /* @__PURE__ */ new Map();
+  let i = 0;
+  while (i < sql.length) {
+    const ch = sql[i];
+    if (ch === "'" || ch === '"' || ch === "`") {
+      i += 1;
+      while (i < sql.length && sql[i] !== ch) i += 1;
+      i += 1;
+      continue;
+    }
+    if (ch === "-" && sql[i + 1] === "-") {
+      while (i < sql.length && sql[i] !== "\n") i += 1;
+      continue;
+    }
+    if (ch === "/" && sql[i + 1] === "*") {
+      i += 2;
+      while (i < sql.length && !(sql[i] === "*" && sql[i + 1] === "/")) i += 1;
+      i += 2;
+      continue;
+    }
+    if (ch === "$" || ch === ":" || ch === "@") {
+      let j = i + 1;
+      while (j < sql.length && /[A-Za-z0-9_]/.test(sql[j])) j += 1;
+      if (j > i + 1) {
+        const token = sql.slice(i, j);
+        found.set(token.slice(1), token);
+        i = j;
+        continue;
+      }
+    }
+    i += 1;
+  }
+  return found;
+}
+function bindArgs(params, placeholders, provider) {
+  if (params === void 0) return [];
+  if (Array.isArray(params)) {
+    return params.map(
+      (value, index) => normalise(value, `position ${index + 1}`)
+    );
+  }
+  const out = {};
+  const seen = /* @__PURE__ */ new Set();
+  for (const [key, value] of Object.entries(
+    params
+  )) {
+    const bare = key.replace(/^[$:@]/, "");
+    const token = placeholders.get(bare);
+    if (token === void 0) {
+      throw new SqliteBindError(
+        `named parameter "${key}" has no placeholder in the statement`
+      );
+    }
+    if (seen.has(bare)) {
+      throw new SqliteBindError(`named parameter "${bare}" given twice`);
+    }
+    seen.add(bare);
+    out[provider.bindKey(bare, token)] = normalise(value, `parameter ${key}`);
+  }
+  for (const bare of placeholders.keys()) {
+    if (!seen.has(bare)) {
+      throw new SqliteBindError(`placeholder "${bare}" has no value`);
+    }
+  }
+  return [out];
+}
+function wrapStatement(raw, sql, provider) {
+  const placeholders = scanPlaceholders(sql);
+  const args = (params) => bindArgs(params, placeholders, provider);
+  return {
+    // Measured: with no matching row bun returns null and node undefined, so a
+    // caller's `!== undefined` check passes on one runtime and dereferences
+    // null on the other. One absent value for both.
+    get: (params) => raw.get(...args(params)) ?? void 0,
+    all: (params) => raw.all(...args(params)),
+    run: (params) => raw.run(...args(params))
+  };
+}
+var IN_MEMORY = /* @__PURE__ */ new Set([":memory:", ""]);
+var JOURNAL_SQL = Object.freeze({
+  WAL: "PRAGMA journal_mode = WAL",
+  DELETE: "PRAGMA journal_mode = DELETE",
+  MEMORY: "PRAGMA journal_mode = MEMORY"
+});
+function build(binding, path, options) {
+  const { provider, ctor } = binding;
+  const readOnly = options.readOnly ?? false;
+  const raw = new ctor(path, provider.openOptions(readOnly));
+  const journalMode = options.journalMode ?? (IN_MEMORY.has(path) ? "MEMORY" : "WAL");
+  const journalSql = JOURNAL_SQL[journalMode];
+  if (journalSql === void 0) {
+    throw new SqliteBindError(`unknown journal mode ${String(journalMode)}`);
+  }
+  if (!readOnly) raw.exec(journalSql);
+  let inTransaction = false;
+  return {
+    backend: provider.backend,
+    exec: (sql) => raw.exec(sql),
+    prepare: (sql) => wrapStatement(raw.prepare(sql), sql, provider),
+    transaction(fn) {
+      if (inTransaction) throw new Error("transaction() is not nestable");
+      inTransaction = true;
+      raw.exec("BEGIN");
+      try {
+        const result2 = fn();
+        raw.exec("COMMIT");
+        return result2;
+      } catch (error) {
+        raw.exec("ROLLBACK");
+        throw error;
+      } finally {
+        inTransaction = false;
+      }
+    },
+    close: () => raw.close()
+  };
+}
+function moduleBase() {
+  return typeof __filename === "string" ? __filename : import_meta.url;
+}
+function loadBindingSync(pinned) {
+  const attempts = [];
+  const require2 = (0, import_node_module.createRequire)(moduleBase());
+  for (const provider of shortlist(pinned)) {
+    if (!provider.eligible()) {
+      attempts.push([provider.specifier, "not eligible in this runtime"]);
+      continue;
+    }
+    const already = bindings.get(provider.backend);
+    if (already) return already;
+    try {
+      const mod = require2(provider.specifier);
+      const ctor = provider.exportName === "default" ? mod.default ?? mod : mod[provider.exportName];
+      if (typeof ctor !== "function") {
+        attempts.push([provider.specifier, `no ${provider.exportName} export`]);
+        continue;
+      }
+      const binding = { provider, ctor };
+      bindings.set(provider.backend, binding);
+      return binding;
+    } catch (error) {
+      attempts.push([provider.specifier, error.message]);
+    }
+  }
+  throw new SqliteUnavailableError(attempts);
+}
+function openDatabaseSync(path, options = {}) {
+  return build(loadBindingSync(options.backend), path, options);
+}
+
+// src/loader/locate.ts
+var import_node_fs = require("fs");
+var import_node_os = require("os");
+var import_node_path = require("path");
+var DIR_NAME = ".envs";
+var CATALOG_FILE = "catalog.sqlite";
+var ROOT_MARKERS = [
+  "bun.lock",
+  "bun.lockb",
+  "pnpm-workspace.yaml",
+  "package-lock.json",
+  "yarn.lock",
+  ".git",
+  "package.json"
+];
+function findProjectRoot(from) {
+  let dir = (0, import_node_path.resolve)(from);
+  for (; ; ) {
+    for (const marker of ROOT_MARKERS) {
+      if ((0, import_node_fs.existsSync)((0, import_node_path.join)(dir, marker))) return dir;
+    }
+    const parent = (0, import_node_path.dirname)(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function globalDir(home = (0, import_node_os.homedir)()) {
+  return (0, import_node_path.join)(home, DIR_NAME);
+}
+function locateCatalogs(options = {}) {
+  const env = options.env ?? process.env;
+  const cwd = options.cwd ?? process.cwd();
+  const home = options.home ?? env["HOME"] ?? (0, import_node_os.homedir)();
+  const explicit = env["ENVS_CATALOG_PATH"];
+  if (explicit !== void 0 && explicit !== "") {
+    return { project: (0, import_node_path.resolve)(explicit), source: "explicit" };
+  }
+  const globalPath = (0, import_node_path.join)(globalDir(home), CATALOG_FILE);
+  const root = findProjectRoot(cwd);
+  if (root === void 0) {
+    return { project: globalPath, source: "global" };
+  }
+  return {
+    project: (0, import_node_path.join)(root, DIR_NAME, CATALOG_FILE),
+    global: globalPath,
+    projectRoot: root,
+    source: "project"
+  };
+}
+
+// src/catalog/schema.ts
+var SCHEMA_VERSION = 4;
+var CatalogVersionError = class extends Error {
+  constructor(found, supported, message) {
+    super(message);
+    this.found = found;
+    this.supported = supported;
+    this.name = "CatalogVersionError";
+  }
+  found;
+  supported;
+};
+function tableExists(db, name) {
+  const row = db.prepare(
+    "SELECT count(*) AS n FROM sqlite_master WHERE type = 'table' AND name = $name"
+  ).get({ name });
+  return (row?.n ?? 0) > 0;
+}
+function readMeta(db) {
+  if (!tableExists(db, "schema_meta")) return void 0;
+  const row = db.prepare(
+    "SELECT version, catalog_id, created_at FROM schema_meta WHERE id = 1"
+  ).get();
+  if (row === void 0) return void 0;
+  return {
+    version: Number(row.version),
+    catalogId: row.catalog_id,
+    createdAt: row.created_at
+  };
+}
+
+// src/crypto/digest.ts
+function toHex(bytes) {
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join(
+    ""
+  );
+}
+
+// src/crypto/envelope.ts
+var import_node_crypto = require("crypto");
+var MAGIC = new Uint8Array([69, 78, 86, 67]);
+var FORMAT_AES_256_GCM = 1;
+var TAG_BYTES = 16;
+var KEK_BYTES = 32;
+var HEADER_FIXED = MAGIC.length + 1 + 4 + 1;
+var EnvelopeFormatError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "EnvelopeFormatError";
+  }
+};
+var EnvelopeAuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "EnvelopeAuthError";
+  }
+};
+function concat(parts) {
+  const total = parts.reduce((n, p) => n + p.length, 0);
+  const out = new Uint8Array(total);
+  let at = 0;
+  for (const part of parts) {
+    out.set(part, at);
+    at += part.length;
+  }
+  return out;
+}
+function bytesEqual(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i += 1) if (a[i] !== b[i]) return false;
+  return true;
+}
+function checkKek(kek) {
+  if (kek.length !== KEK_BYTES) {
+    throw new EnvelopeFormatError(
+      `KEK must be ${KEK_BYTES} bytes for AES-256-GCM, got ${kek.length}`
+    );
+  }
+}
+function decodeHeader(blob) {
+  if (blob.length < HEADER_FIXED) {
+    throw new EnvelopeFormatError("blob shorter than the envelope header");
+  }
+  if (!bytesEqual(blob.subarray(0, MAGIC.length), MAGIC)) {
+    throw new EnvelopeFormatError("not an ENVC envelope");
+  }
+  const format = blob[MAGIC.length];
+  if (format !== FORMAT_AES_256_GCM) {
+    throw new EnvelopeFormatError(`unknown envelope format ${format}`);
+  }
+  const view = new DataView(blob.buffer, blob.byteOffset, blob.byteLength);
+  const kekVersion = view.getUint32(MAGIC.length + 1, false);
+  const ivLen = blob[MAGIC.length + 5];
+  const headerLength = HEADER_FIXED + ivLen;
+  if (blob.length < headerLength + TAG_BYTES) {
+    throw new EnvelopeFormatError("blob too short for its declared iv and tag");
+  }
+  return {
+    header: {
+      format,
+      kekVersion,
+      iv: blob.subarray(HEADER_FIXED, headerLength)
+    },
+    headerBytes: blob.subarray(0, headerLength),
+    // The tag trails the ciphertext, as Web Crypto lays it out; node:crypto
+    // keeps the two apart, so the split happens here and nowhere else.
+    ciphertext: blob.subarray(headerLength, blob.length - TAG_BYTES),
+    tag: blob.subarray(blob.length - TAG_BYTES)
+  };
+}
+function open(input) {
+  checkKek(input.kek);
+  const { header, headerBytes, ciphertext, tag } = decodeHeader(input.blob);
+  try {
+    const decipher = (0, import_node_crypto.createDecipheriv)("aes-256-gcm", input.kek, header.iv);
+    decipher.setAAD(concat([headerBytes, input.context]));
+    decipher.setAuthTag(tag);
+    return new Uint8Array(
+      Buffer.concat([decipher.update(ciphertext), decipher.final()])
+    );
+  } catch {
+    throw new EnvelopeAuthError(
+      "envelope did not authenticate: wrong key, wrong context, or altered bytes"
+    );
+  }
+}
+
+// src/crypto/keyring.ts
+var import_node_crypto2 = require("crypto");
+var DEK_BYTES = 32;
+var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function kdfFor(method) {
+  return method === "recovery" ? "scrypt" : "hkdf";
+}
+var RecoveryCodeError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "RecoveryCodeError";
+  }
+};
+var KeyringLockedError = class extends Error {
+  constructor(tried) {
+    super(
+      `none of the ${tried} wraps opened with the secret given; try another recovery code or the KEK`
+    );
+    this.tried = tried;
+    this.name = "KeyringLockedError";
+  }
+  tried;
+};
+var SCRYPT = Object.freeze({ n: 1 << 15, r: 8, p: 1 });
+function normaliseRecoveryCode(input) {
+  const cleaned = input.toUpperCase().replace(/[\s-]/g, "").replace(/[IL]/g, "1").replace(/O/g, "0");
+  if (cleaned.length === 0) {
+    throw new RecoveryCodeError("recovery code is empty");
+  }
+  for (const ch of cleaned) {
+    if (!ALPHABET.includes(ch)) {
+      throw new RecoveryCodeError(
+        `recovery code contains "${ch}", which is not in the alphabet`
+      );
+    }
+  }
+  return cleaned;
+}
+function wrapKeyFrom(secret, salt, method, cost) {
+  if (kdfFor(method) === "hkdf") {
+    return new Uint8Array(
+      (0, import_node_crypto2.hkdfSync)("sha256", secret, salt, "envs:dek-wrap:v1", DEK_BYTES)
+    );
+  }
+  return new Uint8Array(
+    (0, import_node_crypto2.scryptSync)(secret, salt, DEK_BYTES, {
+      N: cost.n,
+      r: cost.r,
+      p: cost.p,
+      // scrypt's default cap is below what N=32768 needs.
+      maxmem: 256 * cost.n * cost.r
+    })
+  );
+}
+var encoder = new TextEncoder();
+function wrapContext(wrapId, method) {
+  return encoder.encode(`envs:dek-wrap:v1:${method}:${wrapId}`);
+}
+function unlockDek(wraps, unlock) {
+  const method = "kek" in unlock ? "kek" : "recovery";
+  const secret = "kek" in unlock ? unlock.kek : encoder.encode(normaliseRecoveryCode(unlock.recoveryCode));
+  const candidates = wraps.filter((wrap) => wrap.method === method);
+  for (const wrap of candidates) {
+    const key = wrapKeyFrom(secret, wrap.salt, wrap.method, wrap);
+    try {
+      return open({
+        kek: key,
+        blob: wrap.envelope,
+        context: wrapContext(wrap.wrapId, wrap.method)
+      });
+    } catch (error) {
+      if (!(error instanceof EnvelopeAuthError)) throw error;
+    }
+  }
+  throw new KeyringLockedError(candidates.length);
+}
+
+// src/loader/read.ts
+var NoReleaseError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "NoReleaseError";
+  }
+};
+var decoder = new TextDecoder();
+var encoder2 = new TextEncoder();
+function itemContext(sourceId, keyHash, revisionId) {
+  return encoder2.encode(
+    `envs:item:v1:${sourceId}:${toHex(keyHash)}:${revisionId}`
+  );
+}
+function assertReadable(db) {
+  const meta = readMeta(db);
+  if (meta !== void 0 && meta.version > SCHEMA_VERSION) {
+    throw new CatalogVersionError(
+      meta.version,
+      SCHEMA_VERSION,
+      `this catalog was written by a newer envs (schema ${String(meta.version)}, this build reads ${String(SCHEMA_VERSION)}); upgrade @modootoday/envs`
+    );
+  }
+}
+function readWraps(db) {
+  assertReadable(db);
+  return db.prepare(
+    "SELECT wrap_id, method, salt, scrypt_n, scrypt_r, scrypt_p, envelope FROM dek_wraps WHERE retired_at IS NULL"
+  ).all().map((row) => ({
+    wrapId: row.wrap_id,
+    method: row.method === "kek" ? "kek" : "recovery",
+    salt: new Uint8Array(row.salt),
+    n: Number(row.scrypt_n),
+    r: Number(row.scrypt_r),
+    p: Number(row.scrypt_p),
+    envelope: new Uint8Array(row.envelope)
+  }));
+}
+function currentRevision(db) {
+  return db.prepare(
+    "SELECT revision_id FROM pointer WHERE id = 1"
+  ).get()?.revision_id;
+}
+function readEntries(db, options) {
+  const revision = options.revisionId ?? currentRevision(db);
+  if (revision === void 0) {
+    throw new NoReleaseError(
+      'catalog has no current release; run "envs pull" or "envs load" first'
+    );
+  }
+  const dek = unlockDek(readWraps(db), options.unlock);
+  const rows = db.prepare(
+    `SELECT i.source_id, s.alias, s.path, i.key_hash, i.envelope
+         FROM items i
+         JOIN sources s ON s.source_id = i.source_id
+        WHERE i.revision_id = $revision
+          AND s.retired_at IS NULL
+        ORDER BY s.added_at, s.source_id, i.rowid`
+  ).all({ revision });
+  const wanted = options.aliases === void 0 ? void 0 : new Set(options.aliases);
+  const entries = [];
+  for (const row of rows) {
+    if (wanted !== void 0 && !wanted.has(row.alias)) continue;
+    const plain = open({
+      kek: dek,
+      blob: new Uint8Array(row.envelope),
+      context: itemContext(
+        row.source_id,
+        new Uint8Array(row.key_hash),
+        revision
+      )
+    });
+    const text = decoder.decode(plain);
+    const split = text.indexOf("=");
+    if (split <= 0) {
+      throw new Error(
+        `item in source ${row.alias} does not carry a key name; the catalog is corrupt`
+      );
+    }
+    entries.push({
+      key: text.slice(0, split),
+      value: text.slice(split + 1),
+      sourceId: row.source_id,
+      alias: row.alias,
+      path: row.path
+    });
+  }
+  if (options.aliases === void 0) return entries;
+  const rank = new Map(options.aliases.map((alias, index) => [alias, index]));
+  return [...entries].sort(
+    (a, b) => (rank.get(a.alias) ?? 0) - (rank.get(b.alias) ?? 0)
+  );
+}
+
+// src/loader/config.ts
+var ConflictError = class extends Error {
+  constructor(key, first, second) {
+    super(
+      `key "${key}" is declared by ${first.layer}:${first.from} and ${second.layer}:${second.from}`
+    );
+    this.key = key;
+    this.first = first;
+    this.second = second;
+    this.name = "ConflictError";
+  }
+  key;
+  first;
+  second;
+};
+var KekMissingError = class extends Error {
+  constructor() {
+    super(
+      "no key available: set ENVS_KEK, or pass unlock explicitly. Values stay sealed without it."
+    );
+    this.name = "KekMissingError";
+  }
+};
+function decodeKek(raw) {
+  const bytes = new Uint8Array(Buffer.from(raw, "base64"));
+  if (bytes.length !== 32) {
+    throw new KekMissingError();
+  }
+  return bytes;
+}
+function resolveUnlock(options, env) {
+  if (options.unlock !== void 0) return options.unlock;
+  const raw = env["ENVS_KEK"];
+  if (raw === void 0 || raw === "") throw new KekMissingError();
+  return { kek: decodeKek(raw) };
+}
+function isTruthy(value) {
+  return value !== void 0 && value !== "" && value !== "0" && value !== "false";
+}
+function fileEntries(paths, encoding) {
+  const entries = [];
+  for (const path of paths) {
+    if (!(0, import_node_fs2.existsSync)(path)) continue;
+    const parsed = parseEnv((0, import_node_fs2.readFileSync)(path, encoding));
+    const record = toRecord(parsed);
+    if (record === null) {
+      return {
+        entries,
+        error: new Error(
+          `${path} is not env format: ${parsed.findings.map((f) => `${f.code} at line ${f.line}`).join(", ")}`
+        )
+      };
+    }
+    for (const [key, value] of Object.entries(record)) {
+      entries.push({ key, value, sourceId: path, alias: path, path });
+    }
+  }
+  return { entries };
+}
+function catalogEntries(path, options, unlock) {
+  if (!(0, import_node_fs2.existsSync)(path)) return [];
+  let db;
+  try {
+    db = openDatabaseSync(path, { readOnly: true });
+    return readEntries(db, {
+      unlock,
+      ...options.aliases ? { aliases: options.aliases } : {}
+    });
+  } finally {
+    db?.close();
+  }
+}
+function merge(ordered, override, onConflict, debug) {
+  const parsed = {};
+  const seen = /* @__PURE__ */ new Map();
+  for (const { entry, layer } of ordered) {
+    const here = { key: entry.key, layer, from: entry.alias };
+    const earlier = seen.get(entry.key);
+    if (earlier === void 0) {
+      parsed[entry.key] = entry.value;
+      seen.set(entry.key, here);
+      continue;
+    }
+    if (onConflict === "throw")
+      throw new ConflictError(entry.key, earlier, here);
+    if (onConflict === "warn") {
+      debug(
+        `[envs] "${entry.key}" declared by ${earlier.layer}:${earlier.from} and ${here.layer}:${here.from}`
+      );
+    }
+    if (override) {
+      parsed[entry.key] = entry.value;
+      seen.set(entry.key, here);
+    }
+  }
+  return { parsed, provenance: [...seen.values()] };
+}
+function config(options = {}) {
+  const env = options.env ?? process.env;
+  const target = options.processEnv ?? process.env;
+  const override = options.override ?? false;
+  const onConflict = options.onConflict ?? "ignore";
+  const quiet = options.quiet ?? false;
+  const debugOn = options.debug ?? false;
+  const debug = (message) => {
+    if (debugOn || !quiet) process.stderr.write(`${message}
+`);
+  };
+  try {
+    const locateOptions = {
+      ...options.cwd ? { cwd: options.cwd } : {},
+      ...options.home ? { home: options.home } : {},
+      env
+    };
+    const located = locateCatalogs(locateOptions);
+    const useGlobal = (options.global ?? true) && !isTruthy(env["ENVS_NO_GLOBAL"]);
+    const ordered = [];
+    if (options.path !== void 0) {
+      const paths = typeof options.path === "string" ? [options.path] : options.path;
+      const read = fileEntries(paths, options.encoding ?? "utf8");
+      if (read.error) return { error: read.error };
+      for (const entry of read.entries) ordered.push({ entry, layer: "file" });
+    }
+    const sawCatalog = (0, import_node_fs2.existsSync)(located.project) || useGlobal && located.global !== void 0 && (0, import_node_fs2.existsSync)(located.global);
+    if (!sawCatalog && options.path === void 0) {
+      return {
+        error: new Error(
+          `no catalog at ${located.project}; run "envs init" first`
+        )
+      };
+    }
+    if (sawCatalog) {
+      const unlock = resolveUnlock(options, env);
+      for (const entry of catalogEntries(located.project, options, unlock)) {
+        ordered.push({ entry, layer: "project" });
+      }
+      if (useGlobal && located.global !== void 0) {
+        for (const entry of catalogEntries(located.global, options, unlock)) {
+          ordered.push({ entry, layer: "global" });
+        }
+      }
+    }
+    const { parsed, provenance } = merge(ordered, override, onConflict, debug);
+    const applied = [];
+    for (const [key, value] of Object.entries(parsed)) {
+      const present = Object.prototype.hasOwnProperty.call(target, key);
+      if (present && !override) {
+        applied.push({ key, layer: "process", from: "process.env" });
+        continue;
+      }
+      target[key] = value;
+      applied.push(provenance.find((p) => p.key === key));
+    }
+    return { parsed, provenance: applied };
+  } catch (error) {
+    return { error };
+  }
+}
+
+// src/config.ts
+var result = config();
+if (result.error) throw result.error;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  result
+});