@mudah-cli/config 0.8.0 → 0.9.2

package/dist/redact.js

@@ -0,0 +1,61 @@
+import { isPlainObject } from './paths.js';
+/** Key names whose values are treated as secrets and masked in dumps. */
+export const REDACT_KEYS = [
+    /password/i,
+    /passwd/i,
+    /secret/i,
+    /token/i,
+    /api[-_]?key/i,
+    /access[-_]?key/i,
+    /credential/i,
+    /private[-_]?key/i,
+    /^url$/i,
+    /^dsn$/i,
+    /^connection[-_]?string$/i,
+    /^authorization$/i,
+    /^bearer$/i,
+    /^pwd$/i,
+    /^pass$/i,
+];
+/**
+ * Recursively replace values whose key is sensitive. Scalars under matching
+ * keys become `mask`; objects/arrays recurse so sensitive leaves are masked
+ * regardless of depth. Non-sensitive scalars and arrays pass through unchanged.
+ */
+export function redactSecrets(value, options = {}) {
+    const patterns = options.keys ?? REDACT_KEYS;
+    const mask = options.mask ?? '[redacted]';
+    const matches = (name) => {
+        for (const pattern of patterns) {
+            // A caller-supplied `/g` pattern carries `lastIndex` between calls, which
+            // would make redaction alternate between masking and leaking. Test with a
+            // non-global clone.
+            const safe = pattern.global ? new RegExp(pattern.source, pattern.flags.replace(/g/g, '')) : pattern;
+            if (safe.test(name))
+                return true;
+        }
+        return false;
+    };
+    const seen = new WeakSet();
+    const walk = (input) => {
+        if (Array.isArray(input)) {
+            if (seen.has(input))
+                return mask;
+            seen.add(input);
+            return input.map(walk);
+        }
+        if (isPlainObject(input)) {
+            if (seen.has(input))
+                return mask;
+            seen.add(input);
+            const out = {};
+            for (const [key, v] of Object.entries(input)) {
+                out[key] = matches(key) ? mask : walk(v);
+            }
+            return out;
+        }
+        return input;
+    };
+    return walk(value);
+}
+//# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,yEAAyE;AACzE,MAAM,CAAC,MAAM,WAAW,GAA0B;IAChD,WAAW;IACX,SAAS;IACT,SAAS;IACT,QAAQ;IACR,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,kBAAkB;IAClB,QAAQ;IACR,QAAQ;IACR,0BAA0B;IAC1B,kBAAkB;IAClB,WAAW;IACX,QAAQ;IACR,SAAS;CACV,CAAC;AASF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,OAAO,GAAkB,EAAE;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC;IAE1C,MAAM,OAAO,GAAG,CAAC,IAAY,EAAW,EAAE;QACxC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,0EAA0E;YAC1E,0EAA0E;YAC1E,oBAAoB;YACpB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACpG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QACnC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IAEnC,MAAM,IAAI,GAAG,CAAC,KAAc,EAAW,EAAE;QACvC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,MAAM,GAAG,GAA4B,EAAE,CAAC;YACxC,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;AACrB,CAAC"}

package/dist/remote.d.ts

@@ -0,0 +1,47 @@
+/** Default cache lifetime — same 24h window as the update nudge. */
+export declare const REMOTE_CONFIG_TTL_MS: number;
+/** Filename written under `cacheDir` (or `.mudah/cache`). */
+export declare const REMOTE_CONFIG_CACHE_FILE = "remote-config.json";
+export interface LoadRemoteConfigOptions {
+    /** Directory that holds `remote-config.json`. Default `.mudah/cache`. */
+    cacheDir?: string;
+    /** Cache lifetime in milliseconds. Default 24h. */
+    ttlMs?: number;
+    /** Fetch implementation (tests inject a stub). */
+    fetch?: typeof fetch;
+    /** Clock used for cache freshness (tests inject a stub). */
+    now?: () => number;
+    /** Exact cache file path; wins over `cacheDir`. */
+    cachePath?: string;
+    /** Alternate URL (`{ remote: url }` form). Wins over the first argument. */
+    remote?: string;
+    /** Allow loopback and RFC1918 hosts. Default false. */
+    allowPrivate?: boolean;
+}
+/**
+ * Resolve a `remote:` URL. Accepts a bare URL, a `remote:`-prefixed URL, or
+ * an options object with `{ remote }`.
+ */
+export declare function resolveRemoteUrl(url: string | {
+    remote: string;
+}, options?: Pick<LoadRemoteConfigOptions, 'remote'>): string;
+/**
+ * Reject non-http(s) URLs, link-local / metadata hosts, and (unless
+ * `allowPrivate`) loopback plus RFC1918 addresses.
+ */
+export declare function assertRemoteUrl(url: string, options?: {
+    allowPrivate?: boolean;
+}): string;
+/**
+ * Load configuration from a remote URL.
+ *
+ * Fresh cache (younger than `ttlMs`, default 24h) is reused without hitting
+ * the network. A failed fetch returns the last cache entry when one exists,
+ * otherwise `{}` — so a machine that has cached once keeps working offline.
+ *
+ * The `remote:` prefix is stripped (`remote:https://…` and `{ remote: url }`
+ * are equivalent to the bare URL).
+ */
+export declare function loadRemoteConfig(url: string | (LoadRemoteConfigOptions & {
+    remote: string;
+}), options?: LoadRemoteConfigOptions): Promise<Record<string, unknown>>;

package/dist/remote.js

@@ -0,0 +1,266 @@
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isPlainObject } from './paths.js';
+/** Default cache lifetime — same 24h window as the update nudge. */
+export const REMOTE_CONFIG_TTL_MS = 24 * 60 * 60 * 1000;
+/** Filename written under `cacheDir` (or `.mudah/cache`). */
+export const REMOTE_CONFIG_CACHE_FILE = 'remote-config.json';
+/**
+ * Resolve a `remote:` URL. Accepts a bare URL, a `remote:`-prefixed URL, or
+ * an options object with `{ remote }`.
+ */
+export function resolveRemoteUrl(url, options = {}) {
+    const raw = options.remote ?? (typeof url === 'string' ? url : url.remote);
+    return raw.replace(/^remote:/i, '').trim();
+}
+const BLOCKED_HOSTS = new Set(['metadata.google.internal', 'metadata.goog', '169.254.169.254']);
+function isIpv4(host) {
+    const parts = host.split('.');
+    if (parts.length !== 4)
+        return undefined;
+    const nums = parts.map((p) => Number(p));
+    if (nums.some((n) => !Number.isInteger(n) || n < 0 || n > 255))
+        return undefined;
+    return nums;
+}
+/**
+ * Unwrap an IPv6 literal into its 8 hextets, resolving `::`, or `undefined`
+ * when the text is not a valid IPv6 address. A trailing dotted-quad
+ * (`::ffff:127.0.0.1`) is folded into hex hextets.
+ */
+function parseIpv6(host) {
+    let text = host;
+    if (!text.includes(':'))
+        return undefined;
+    // Fold a trailing IPv4 dotted-quad into two hextets.
+    const lastColon = text.lastIndexOf(':');
+    const tail = text.slice(lastColon + 1);
+    const tailV4 = isIpv4(tail);
+    if (tailV4) {
+        const high = ((tailV4[0] << 8) | tailV4[1]).toString(16);
+        const low = ((tailV4[2] << 8) | tailV4[3]).toString(16);
+        text = `${text.slice(0, lastColon + 1)}${high}:${low}`;
+    }
+    const halves = text.split('::');
+    if (halves.length > 2)
+        return undefined;
+    const parseGroups = (part) => {
+        if (part === '')
+            return [];
+        const out = [];
+        for (const group of part.split(':')) {
+            if (!/^[0-9a-f]{1,4}$/.test(group))
+                return undefined;
+            out.push(Number.parseInt(group, 16));
+        }
+        return out;
+    };
+    const head = parseGroups(halves[0] ?? '');
+    const tailGroups = halves.length === 2 ? parseGroups(halves[1] ?? '') : [];
+    if (head === undefined || tailGroups === undefined)
+        return undefined;
+    if (halves.length === 1)
+        return head.length === 8 ? head : undefined;
+    const missing = 8 - head.length - tailGroups.length;
+    if (missing < 1)
+        return undefined;
+    return [...head, ...Array.from({ length: missing }, () => 0), ...tailGroups];
+}
+/** True for loopback, unspecified, link-local, ULA, and IPv4-mapped private hosts. */
+function isPrivateIpv6(hextets) {
+    const [h0, h1, h2, h3, h4, h5] = hextets;
+    // ::1 loopback, :: unspecified
+    const allZeroPrefix = h0 === 0 && h1 === 0 && h2 === 0 && h3 === 0 && h4 === 0;
+    if (allZeroPrefix && h5 === 0 && hextets[6] === 0 && (hextets[7] === 1 || hextets[7] === 0)) {
+        return true;
+    }
+    // fe80::/10 link-local
+    if ((h0 & 0xffc0) === 0xfe80)
+        return true;
+    // fc00::/7 unique-local
+    if ((h0 & 0xfe00) === 0xfc00)
+        return true;
+    // ::ffff:a.b.c.d IPv4-mapped — re-check the embedded IPv4
+    if (h0 === 0 && h1 === 0 && h2 === 0 && h3 === 0 && h4 === 0 && h5 === 0xffff) {
+        const ip = [hextets[6] >> 8, hextets[6] & 0xff, hextets[7] >> 8, hextets[7] & 0xff];
+        return isPrivateIpv4(ip);
+    }
+    return false;
+}
+function isPrivateIpv4(ip) {
+    const [a, b] = ip;
+    if (a === undefined || b === undefined)
+        return false;
+    if (a === 127 || a === 0 || a === 10)
+        return true;
+    if (a === 192 && b === 168)
+        return true;
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    if (a === 169 && b === 254)
+        return true;
+    return false;
+}
+function isPrivateOrLocal(host) {
+    const h = host.toLowerCase().replace(/^\[|\]$/g, '');
+    if (h === 'localhost' || h === '0.0.0.0')
+        return true;
+    if (h.includes(':')) {
+        const hextets = parseIpv6(h);
+        return hextets === undefined ? true : isPrivateIpv6(hextets);
+    }
+    const ip = isIpv4(h);
+    if (!ip)
+        return false;
+    return isPrivateIpv4(ip);
+}
+/**
+ * Reject non-http(s) URLs, link-local / metadata hosts, and (unless
+ * `allowPrivate`) loopback plus RFC1918 addresses.
+ */
+export function assertRemoteUrl(url, options = {}) {
+    const trimmed = url.trim();
+    let parsed;
+    try {
+        parsed = new URL(trimmed);
+    }
+    catch {
+        throw new Error(`[config] Invalid remote URL "${url}".`);
+    }
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        throw new Error(`[config] Remote config must be http(s), got "${parsed.protocol}".`);
+    }
+    const host = parsed.hostname.toLowerCase();
+    if (BLOCKED_HOSTS.has(host) || host.endsWith('.internal')) {
+        throw new Error(`[config] Remote config host "${host}" is blocked.`);
+    }
+    const ip = isIpv4(host);
+    if (ip && ip[0] === 169 && ip[1] === 254) {
+        throw new Error(`[config] Remote config host "${host}" is blocked.`);
+    }
+    if (!options.allowPrivate && isPrivateOrLocal(host)) {
+        throw new Error(`[config] Remote config host "${host}" is private. Pass allowPrivate to permit it.`);
+    }
+    return parsed.href;
+}
+function defaultCacheDir() {
+    return join(process.cwd(), '.mudah', 'cache');
+}
+function cacheFile(options) {
+    if (options.cachePath !== undefined && options.cachePath.length > 0) {
+        return options.cachePath;
+    }
+    return join(options.cacheDir ?? defaultCacheDir(), REMOTE_CONFIG_CACHE_FILE);
+}
+/**
+ * Read the cache entry for `url`. An entry written for a different URL (or a
+ * legacy entry with no recorded URL) is a miss, so two remote sources never
+ * share one cached payload.
+ */
+function readCache(file, url) {
+    try {
+        const parsed = JSON.parse(readFileSync(file, 'utf8'));
+        if (!isPlainObject(parsed))
+            return null;
+        const checkedAt = parsed['checkedAt'];
+        const data = parsed['data'];
+        const cachedUrl = parsed['url'];
+        if (typeof checkedAt !== 'number' || !isPlainObject(data))
+            return null;
+        if (typeof cachedUrl !== 'string' || cachedUrl !== url)
+            return null;
+        return { url: cachedUrl, checkedAt, data };
+    }
+    catch {
+        return null;
+    }
+}
+function writeCache(file, entry) {
+    try {
+        mkdirSync(join(file, '..'), { recursive: true });
+        writeFileSync(file, JSON.stringify(entry), 'utf8');
+    }
+    catch {
+        // A read-only filesystem just means no caching next time.
+    }
+}
+/** Max redirect hops followed while validating every hop. */
+const MAX_REDIRECTS = 5;
+/**
+ * Fetch JSON, following redirects one hop at a time so each `Location` is
+ * re-checked. A plain `fetch` follows redirects automatically, which would let
+ * a public URL bounce the client to a private or link-local address after
+ * validation had already passed.
+ */
+async function fetchConfig(url, doFetch, options = {}) {
+    let current = url;
+    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+        let response;
+        try {
+            response = await doFetch(current, {
+                headers: { accept: 'application/json' },
+                redirect: 'manual',
+            });
+        }
+        catch {
+            // Offline / DNS failure / abort: fail soft.
+            return null;
+        }
+        const location = response.headers?.get?.('location') ?? null;
+        if (response.status >= 300 && response.status < 400 && location !== null) {
+            let next;
+            try {
+                next = new URL(location, current).href;
+            }
+            catch {
+                return null;
+            }
+            // A blocked/private redirect target is a configuration error, not an
+            // offline blip — surface it instead of silently returning null.
+            assertRemoteUrl(next, { allowPrivate: options.allowPrivate });
+            current = next;
+            continue;
+        }
+        if (!response.ok)
+            return null;
+        try {
+            const body = (await response.json());
+            return isPlainObject(body) ? body : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    return null;
+}
+/**
+ * Load configuration from a remote URL.
+ *
+ * Fresh cache (younger than `ttlMs`, default 24h) is reused without hitting
+ * the network. A failed fetch returns the last cache entry when one exists,
+ * otherwise `{}` — so a machine that has cached once keeps working offline.
+ *
+ * The `remote:` prefix is stripped (`remote:https://…` and `{ remote: url }`
+ * are equivalent to the bare URL).
+ */
+export async function loadRemoteConfig(url, options = {}) {
+    const opts = typeof url === 'object' ? { ...options, ...url } : options;
+    const resolved = resolveRemoteUrl(typeof url === 'string' ? url : url.remote, opts);
+    if (resolved.length > 0)
+        assertRemoteUrl(resolved, { allowPrivate: opts.allowPrivate });
+    const ttlMs = opts.ttlMs ?? REMOTE_CONFIG_TTL_MS;
+    const now = opts.now ?? Date.now;
+    const file = cacheFile(opts);
+    const cached = readCache(file, resolved);
+    if (cached !== null && now() - cached.checkedAt < ttlMs) {
+        return cached.data;
+    }
+    const doFetch = opts.fetch ?? fetch;
+    const data = resolved.length === 0 ? null : await fetchConfig(resolved, doFetch, { allowPrivate: opts.allowPrivate });
+    if (data !== null) {
+        writeCache(file, { url: resolved, checkedAt: now(), data });
+        return data;
+    }
+    return cached !== null ? cached.data : {};
+}
+//# sourceMappingURL=remote.js.map

package/dist/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AA0B7D;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAgC,EAChC,OAAO,GAA4C,EAAE;IAErD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3E,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,0BAA0B,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEhG,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1C,qDAAqD;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAwB,EAAE;QACzD,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,IAAI,IAAI,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAErE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IACpD,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC;AAC/E,CAAC;AAED,sFAAsF;AACtF,SAAS,aAAa,CAAC,OAAiB;IACtC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,OAShC,CAAC;IACF,+BAA+B;IAC/B,MAAM,aAAa,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/E,IAAI,aAAa,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,uBAAuB;IACvB,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC1C,wBAAwB;IACxB,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC1C,0DAA0D;IAC1D,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;QAC9E,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAE,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,CAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC;QACxF,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,EAAY;IACjC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,OAAO,GAA+B,EAAE;IACnF,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,gDAAgD,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,+CAA+C,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,OAAgC;IACjD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,OAAO,OAAO,CAAC,SAAS,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,EAAE,EAAE,wBAAwB,CAAC,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;QACjE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACvE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACpE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAuB;IACvD,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,OAAqB,EACrB,OAAO,GAA+B,EAAE;IAExC,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC;QAC9C,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE;gBAChC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;QAC7D,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACzE,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,qEAAqE;YACrE,gEAAgE;YAChE,eAAe,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;YAC9D,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;YAChD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAA4D,EAC5D,OAAO,GAA4B,EAAE;IAErC,MAAM,IAAI,GAA4B,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACjG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,eAAe,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEzC,IAAI,MAAM,KAAK,IAAI,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,KAAK,EAAE,CAAC;QACxD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,IAAI,GACR,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3G,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC"}

package/dist/schema.d.ts

@@ -115,6 +115,11 @@ export declare const s: {
     /** Accept anything at this key. */
     any(): AnySchemaBuilder;
 };
+/**
+ * Walk an object schema along a dotted path (`app.port`). Returns the node
+ * at that path, or `undefined` when a segment is missing or not an object.
+ */
+export declare function schemaAt(schema: Schema<unknown>, path: string): Schema<unknown> | undefined;
 /** Validate `value` against `schema`. Collects every issue; never throws. */
 export declare function validateSchema<T>(schema: Schema<T>, value: unknown, path?: string): SchemaResult<T>;
 /**

package/dist/schema.js

@@ -59,8 +59,11 @@ class BaseSchema {
     parse(value, path, issues) {
         if (value === undefined) {
             const fallback = this.fallback();
+            // Validate the default too, so an invalid default (or a defaulted object
+            // whose nested keys need their own defaults) is caught rather than
+            // silently accepted.
             if (fallback !== undefined)
-                return fallback;
+                return this.check(fallback, path, issues);
             if (!this.isOptional) {
                 issues.push({ path, message: `is required` });
             }
@@ -141,6 +144,10 @@ class NumberSchema extends BaseSchema {
             this.fail(issues, path, `expected number, got ${typeName(value)}`);
             return 0;
         }
+        if (!Number.isFinite(value)) {
+            this.fail(issues, path, `must be a finite number`);
+            return 0;
+        }
         if (this.integerOnly && !Number.isInteger(value)) {
             this.fail(issues, path, `must be an integer`);
         }
@@ -219,14 +226,14 @@ class ObjectSchema extends BaseSchema {
         const output = {};
         for (const [key, node] of Object.entries(this.shape)) {
             const childPath = path === '' ? key : `${path}.${key}`;
-            const present = Object.prototype.hasOwnProperty.call(source, key);
+            const present = Object.hasOwn(source, key);
             const parsed = node.parse(present ? source[key] : undefined, childPath, issues);
             if (present || parsed !== undefined)
                 output[key] = parsed;
         }
         if (this.strictMode) {
             for (const key of Object.keys(source)) {
-                if (!(key in this.shape)) {
+                if (!Object.hasOwn(this.shape, key)) {
                     this.fail(issues, path === '' ? key : `${path}.${key}`, `is not a known key`);
                 }
             }
@@ -234,7 +241,7 @@ class ObjectSchema extends BaseSchema {
         else {
             // Keep undeclared keys so partial schemas don't silently drop config.
             for (const key of Object.keys(source)) {
-                if (!(key in this.shape))
+                if (!Object.hasOwn(this.shape, key))
                     output[key] = source[key];
             }
         }
@@ -281,6 +288,23 @@ export const s = {
         return new AnySchema();
     },
 };
+/**
+ * Walk an object schema along a dotted path (`app.port`). Returns the node
+ * at that path, or `undefined` when a segment is missing or not an object.
+ */
+export function schemaAt(schema, path) {
+    if (path === '')
+        return schema;
+    let current = schema;
+    for (const part of path.split('.')) {
+        if (current === undefined || current.type !== 'object' || !('shape' in current)) {
+            return undefined;
+        }
+        const shape = current.shape;
+        current = shape[part];
+    }
+    return current;
+}
 /** Validate `value` against `schema`. Collects every issue; never throws. */
 export function validateSchema(schema, value, path = '') {
     const issues = [];

package/dist/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAiBH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,MAAM,CAAyB;IAExC,YAAY,MAA8B;QACxC,KAAK,CACH,2BAA2B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAmBD,MAAe,UAAU;IAEvB,UAAU,GAAG,KAAK,CAAC;IACX,SAAS,GAA6B,SAAS,CAAC;IAChD,UAAU,GAAuB,SAAS,CAAC;IAInD,oCAAoC;IACpC,QAAQ;QACN,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2DAA2D;IAC3D,OAAO,CAAC,KAAQ;QACd,IAAI,CAAC,SAAS,GAAG,EAAE,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yDAAyD;IACzD,QAAQ,CAAC,IAAY;QACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC;IAC/B,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,KAAc,EAAE,IAAY,EAAE,MAAqB;QACvD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjC,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,SAAc,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAES,IAAI,CAAC,MAAqB,EAAE,IAAY,EAAE,OAAe;QACjE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACjC,CAAC;CAGF;AAED,MAAM,YAAa,SAAQ,UAAkB;IAClC,IAAI,GAAG,QAAQ,CAAC;IAChB,KAAK,GAAG,QAAQ,CAAC;IAClB,SAAS,CAAqB;IAC9B,SAAS,CAAqB;IAC9B,OAAO,CAAqB;IACnB,OAAO,CAAgC;IAExD,YAAY,OAA2B;QACrC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,GAAG,CAAC,MAAc;QAChB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,MAAc;QAChB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,OAAe;QACnB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAES,KAAK,CAAC,KAAc,EAAE,IAAY,EAAE,MAAqB;QACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnE,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,IAAI,CAAC,SAAS,aAAa,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAI,CAAC,SAAS,aAAa,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,MAAM,YAAa,SAAQ,UAAkB;IAClC,IAAI,GAAG,QAAQ,CAAC;IAChB,KAAK,GAAG,QAAQ,CAAC;IAClB,OAAO,CAAqB;IAC5B,OAAO,CAAqB;IAC5B,WAAW,GAAG,KAAK,CAAC;IAE5B,GAAG,CAAC,KAAa;QACf,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,KAAa;QACf,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG;QACD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAES,KAAK,CAAC,KAAc,EAAE,IAAY,EAAE,MAAqB;QACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,MAAM,aAAc,SAAQ,UAAmB;IACpC,IAAI,GAAG,SAAS,CAAC;IACjB,KAAK,GAAG,SAAS,CAAC;IAEjB,KAAK,CAAC,KAAc,EAAE,IAAY,EAAE,MAAqB;QACjE,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,yBAAyB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,MAAM,WAAe,SAAQ,UAAe;IAMb,IAAI;IALxB,IAAI,GAAG,OAAO,CAAC;IACf,KAAK,GAAG,OAAO,CAAC;IACjB,OAAO,CAAqB;IAC5B,OAAO,CAAqB;IAEpC,YAA6B,IAAe;QAC1C,KAAK,EAAE,CAAC;oBADmB,IAAI;IAEjC,CAAC;IAED,GAAG,CAAC,MAAc;QAChB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,MAAc;QAChB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAES,KAAK,CAAC,KAAc,EAAE,IAAY,EAAE,MAAqB;QACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,uBAAuB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClE,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAI,CAAC,OAAO,UAAU,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAI,CAAC,OAAO,UAAU,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACzF,CAAC;CACF;AAOD,MAAM,YAAoC,SAAQ,UAA2B;IAKtD,KAAK;IAJjB,IAAI,GAAG,QAAQ,CAAC;IAChB,KAAK,GAAG,QAAQ,CAAC;IAClB,UAAU,GAAG,KAAK,CAAC;IAE3B,YAAqB,KAAQ;QAC3B,KAAK,EAAE,CAAC;qBADW,KAAK;IAE1B,CAAC;IAED,8CAA8C;IAC9C,MAAM;QACJ,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAES,KAAK,CAAC,KAAc,EAAE,IAAY,EAAE,MAAqB;QACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnE,OAAO,EAAqB,CAAC;QAC/B,CAAC;QAED,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,SAAS,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;YACvD,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAChF,IAAI,OAAO,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QAC5D,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAED,OAAO,MAAyB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,SAAU,SAAQ,UAAmB;IAChC,IAAI,GAAG,KAAK,CAAC;IACb,KAAK,GAAG,KAAK,CAAC;IAEb,KAAK,CAAC,KAAc;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO,OAAO,KAAK,CAAC;AACtB,CAAC;AAwDD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,CAAC,GAAG;IACf,MAAM;QACJ,OAAO,IAAI,YAAY,EAAE,CAAC;IAC5B,CAAC;IACD,uCAAuC;IACvC,IAAI,CAAmB,MAAoB;QACzC,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,MAAM;QACJ,OAAO,IAAI,YAAY,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO;QACL,OAAO,IAAI,aAAa,EAAE,CAAC;IAC7B,CAAC;IACD,KAAK,CAAI,IAAe;QACtB,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,CAAwB,KAAQ;QACpC,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,mCAAmC;IACnC,GAAG;QACD,OAAO,IAAI,SAAS,EAAE,CAAC;IACzB,CAAC;CACF,CAAC;AAEF,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAC5B,MAAiB,EACjB,KAAc,EACd,IAAI,GAAG,EAAE;IAET,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAI,MAAiB,EAAE,KAAc,EAAE,IAAI,GAAG,EAAE;IAC1E,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAiBH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,MAAM,CAAyB;IAExC,YAAY,MAA8B;QACxC,KAAK,CACH,2BAA2B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAmBD,MAAe,UAAU;IAEvB,UAAU,GAAG,KAAK,CAAC;IACX,SAAS,GAA6B,SAAS,CAAC;IAChD,UAAU,GAAuB,SAAS,CAAC;IAInD,oCAAoC;IACpC,QAAQ;QACN,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2DAA2D;IAC3D,OAAO,CAAC,KAAQ;QACd,IAAI,CAAC,SAAS,GAAG,EAAE,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yDAAyD;IACzD,QAAQ,CAAC,IAAY;QACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC;IAC/B,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,KAAc,EAAE,IAAY,EAAE,MAAqB;QACvD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjC,yEAAyE;YACzE,mEAAmE;YACnE,qBAAqB;YACrB,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,SAAc,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAES,IAAI,CAAC,MAAqB,EAAE,IAAY,EAAE,OAAe;QACjE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACjC,CAAC;CAGF;AAED,MAAM,YAAa,SAAQ,UAAkB;IAClC,IAAI,GAAG,QAAQ,CAAC;IAChB,KAAK,GAAG,QAAQ,CAAC;IAClB,SAAS,CAAqB;IAC9B,SAAS,CAAqB;IAC9B,OAAO,CAAqB;IACnB,OAAO,CAAgC;IAExD,YAAY,OAA2B;QACrC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,GAAG,CAAC,MAAc;QAChB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,MAAc;QAChB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,OAAe;QACnB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAES,KAAK,CAAC,KAAc,EAAE,IAAY,EAAE,MAAqB;QACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnE,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,IAAI,CAAC,SAAS,aAAa,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAI,CAAC,SAAS,aAAa,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,MAAM,YAAa,SAAQ,UAAkB;IAClC,IAAI,GAAG,QAAQ,CAAC;IAChB,KAAK,GAAG,QAAQ,CAAC;IAClB,OAAO,CAAqB;IAC5B,OAAO,CAAqB;IAC5B,WAAW,GAAG,KAAK,CAAC;IAE5B,GAAG,CAAC,KAAa;QACf,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,KAAa;QACf,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG;QACD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAES,KAAK,CAAC,KAAc,EAAE,IAAY,EAAE,MAAqB;QACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,MAAM,aAAc,SAAQ,UAAmB;IACpC,IAAI,GAAG,SAAS,CAAC;IACjB,KAAK,GAAG,SAAS,CAAC;IAEjB,KAAK,CAAC,KAAc,EAAE,IAAY,EAAE,MAAqB;QACjE,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,yBAAyB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,MAAM,WAAe,SAAQ,UAAe;IAMb,IAAI;IALxB,IAAI,GAAG,OAAO,CAAC;IACf,KAAK,GAAG,OAAO,CAAC;IACjB,OAAO,CAAqB;IAC5B,OAAO,CAAqB;IAEpC,YAA6B,IAAe;QAC1C,KAAK,EAAE,CAAC;oBADmB,IAAI;IAEjC,CAAC;IAED,GAAG,CAAC,MAAc;QAChB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,MAAc;QAChB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAES,KAAK,CAAC,KAAc,EAAE,IAAY,EAAE,MAAqB;QACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,uBAAuB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClE,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAI,CAAC,OAAO,UAAU,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAI,CAAC,OAAO,UAAU,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACzF,CAAC;CACF;AAOD,MAAM,YAAoC,SAAQ,UAA2B;IAKtD,KAAK;IAJjB,IAAI,GAAG,QAAQ,CAAC;IAChB,KAAK,GAAG,QAAQ,CAAC;IAClB,UAAU,GAAG,KAAK,CAAC;IAE3B,YAAqB,KAAQ;QAC3B,KAAK,EAAE,CAAC;qBADW,KAAK;IAE1B,CAAC;IAED,8CAA8C;IAC9C,MAAM;QACJ,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAES,KAAK,CAAC,KAAc,EAAE,IAAY,EAAE,MAAqB;QACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnE,OAAO,EAAqB,CAAC;QAC/B,CAAC;QAED,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,SAAS,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;YACvD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAChF,IAAI,OAAO,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QAC5D,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;oBACpC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,OAAO,MAAyB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,SAAU,SAAQ,UAAmB;IAChC,IAAI,GAAG,KAAK,CAAC;IACb,KAAK,GAAG,KAAK,CAAC;IAEb,KAAK,CAAC,KAAc;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO,OAAO,KAAK,CAAC;AACtB,CAAC;AAwDD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,CAAC,GAAG;IACf,MAAM;QACJ,OAAO,IAAI,YAAY,EAAE,CAAC;IAC5B,CAAC;IACD,uCAAuC;IACvC,IAAI,CAAmB,MAAoB;QACzC,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,MAAM;QACJ,OAAO,IAAI,YAAY,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO;QACL,OAAO,IAAI,aAAa,EAAE,CAAC;IAC7B,CAAC;IACD,KAAK,CAAI,IAAe;QACtB,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,CAAwB,KAAQ;QACpC,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,mCAAmC;IACnC,GAAG;QACD,OAAO,IAAI,SAAS,EAAE,CAAC;IACzB,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAuB,EAAE,IAAY;IAC5D,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC;IAC/B,IAAI,OAAO,GAAgC,MAAM,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;YAChF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GACT,OACD,CAAC,KAAK,CAAC;QACR,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAI,MAAiB,EAAE,KAAc,EAAE,IAAI,GAAG,EAAE;IAC5E,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAI,MAAiB,EAAE,KAAc,EAAE,IAAI,GAAG,EAAE;IAC1E,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC"}

package/dist/secrets.d.ts

@@ -0,0 +1,81 @@
+/** A backend that can store and retrieve named secrets. */
+export interface SecretDriver {
+    readonly name: string;
+    get(name: string): string | undefined;
+    set(name: string, value: string): void;
+    delete(name: string): boolean;
+    list(): string[];
+}
+export interface SecretStoreOptions {
+    /** Drivers consulted in order. `get` is first-win. */
+    drivers: SecretDriver[];
+}
+export interface ResolveSecretOptions {
+    /** Env map used by `env:` refs (default `process.env`). */
+    env?: NodeJS.ProcessEnv;
+    /** Directory (or JSON file) used by `file:` refs. */
+    fileDir?: string;
+    /** Options forwarded to the keyring driver for `keyring:` refs. */
+    keyring?: KeyringDriverOptions;
+}
+export type KeyringSpawnResult = {
+    status: number;
+    stdout: string;
+};
+/**
+ * Injected process runner for the OS keyring. Return `null` when the
+ * command is not available (tests, missing tools).
+ */
+export type KeyringSpawn = (command: string, args: readonly string[], options?: {
+    input?: string;
+}) => KeyringSpawnResult | null;
+export interface KeyringDriverOptions {
+    /** Process runner (tests inject a stub). */
+    spawn?: KeyringSpawn;
+    /** Home directory for the file fallback. Default `os.homedir()`. */
+    home?: string;
+    /** Platform used to pick `security` vs `secret-tool`. */
+    platform?: NodeJS.Platform;
+    /** Exact fallback file path. Default `~/.mudah/keyring.json`. */
+    filePath?: string;
+}
+/**
+ * Read secrets from the environment. `get('FOO')` looks at
+ * `MUDAH_SECRET_FOO`, then `process.env.FOO`.
+ */
+export declare function envSecretDriver(env?: NodeJS.ProcessEnv): SecretDriver;
+/**
+ * Persist secrets as a JSON object. `dir` is a directory (`secrets.json`
+ * inside it) or a `.json` file path.
+ */
+export declare function fileSecretDriver(dir: string): SecretDriver;
+/**
+ * Best-effort OS keyring. Tries `secret-tool` (libsecret) or `security`
+ * (macOS) via an injectable spawn. When neither tool is available, secrets
+ * live in `~/.mudah/keyring.json`.
+ */
+export declare function keyringSecretDriver(options?: KeyringDriverOptions): SecretDriver;
+/**
+ * First-win secret store. `get` returns the first driver that has the name;
+ * `set` writes to the first driver; `delete` removes the name from every
+ * driver so a later one can't resurrect it.
+ */
+export declare class SecretStore {
+    private readonly drivers;
+    constructor(options: SecretStoreOptions);
+    get(name: string): string | undefined;
+    set(name: string, value: string): void;
+    delete(name: string): boolean;
+    list(): string[];
+    /** Redacted view of every stored secret. Safe for `dump` / debug output. */
+    dump(): Record<string, unknown>;
+    /** Alias of {@link dump} for debug printers. */
+    debug(): Record<string, unknown>;
+}
+/** Build a {@link SecretStore} from an ordered driver list. */
+export declare function createSecretStore(options: SecretStoreOptions): SecretStore;
+/**
+ * Resolve a secret reference (`env:FOO`, `file:token`, `keyring:api`).
+ * Unknown or empty refs return `undefined`.
+ */
+export declare function resolveSecret(ref: string, options?: ResolveSecretOptions): string | undefined;