@nage-api/config 1.0.0-beta.2

package/dist/define-config.d.ts

@@ -0,0 +1,69 @@
+/**
+ * `defineConfig()` — the typed replacement for the legacy functional config blob
+ * (PLAN.md §11.2).
+ *
+ * It is deliberately not just an identity function. It:
+ *   - types the literal against `NageConfig`, so a typo is a compile error
+ *     rather than an `undefined` at runtime,
+ *   - merges workspace defaults with app overrides (§11.1 layers 2 and 3),
+ *   - and applies framework defaults (layer 1) at read time via `withDefaults`.
+ */
+import type { NageConfig } from '@nage-api/contracts';
+/** A config fragment: any subset of the full shape, for shared defaults. */
+export type ConfigFragment = DeepPartialConfig<NageConfig>;
+type DeepPartialConfig<T> = {
+    [K in keyof T]?: T[K] extends readonly (infer U)[] ? readonly U[] : T[K] extends object | undefined ? DeepPartialConfig<NonNullable<T[K]>> : T[K];
+};
+export interface DefineConfigOptions {
+    /**
+     * Shared workspace defaults this app extends (§11.1 layer 2). Later entries
+     * win, and the app's own literal wins over all of them.
+     */
+    readonly extends?: readonly ConfigFragment[];
+}
+/**
+ * Deep-merge for config layers. Arrays replace rather than concatenate: a CORS
+ * allow-list or a MIME list is a complete statement of policy, and appending to
+ * an inherited one is how an override accidentally widens it.
+ */
+export declare function mergeConfig<TTarget extends object>(base: TTarget, override: unknown): TTarget;
+/**
+ * Declare an application's configuration.
+ *
+ * ```ts
+ * export default defineConfig({
+ *   app: { name: 'my-api', environment: env.NODE_ENV, port: env.PORT },
+ *   http: { cors: { origins: env.CORS_ORIGINS } },
+ *   database: { enabled: true, driver: 'postgres', url: env.DATABASE_URL, ssl: 'verify-full' },
+ * });
+ * ```
+ */
+export declare function defineConfig(config: NageConfig, options?: DefineConfigOptions): NageConfig;
+/** Reusable fragment for workspace-level defaults (`@app/config`). */
+export declare function defineConfigFragment(fragment: ConfigFragment): ConfigFragment;
+/** Framework defaults — §11.1 layer 1. Applied at read time, never persisted. */
+export declare const FRAMEWORK_DEFAULTS: {
+    readonly port: 3000;
+    readonly host: "0.0.0.0";
+    readonly apiVersion: 1;
+    readonly logLevel: "info";
+    readonly databaseSsl: "verify-full";
+    readonly maxQueryLimit: 100;
+    readonly jwtAlgorithm: "RS256";
+    readonly accessTtl: "15m";
+    readonly refreshTtl: "30d";
+    readonly passwordAlgorithm: "argon2id";
+    readonly passwordMinLength: 12;
+    readonly otpLength: 6;
+    readonly otpTtl: "10m";
+    readonly lockoutMaxAttempts: 5;
+    readonly lockoutWindow: "15m";
+};
+/**
+ * Fill in framework defaults for the values `@nage-api/core` and the feature
+ * packages read most often, so every consumer sees the same answer instead of
+ * repeating `?? 3000` at each call site.
+ */
+export declare function withDefaults(config: NageConfig): NageConfig;
+export {};
+//# sourceMappingURL=define-config.d.ts.map

package/dist/define-config.js

@@ -0,0 +1,131 @@
+"use strict";
+/**
+ * `defineConfig()` — the typed replacement for the legacy functional config blob
+ * (PLAN.md §11.2).
+ *
+ * It is deliberately not just an identity function. It:
+ *   - types the literal against `NageConfig`, so a typo is a compile error
+ *     rather than an `undefined` at runtime,
+ *   - merges workspace defaults with app overrides (§11.1 layers 2 and 3),
+ *   - and applies framework defaults (layer 1) at read time via `withDefaults`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FRAMEWORK_DEFAULTS = void 0;
+exports.mergeConfig = mergeConfig;
+exports.defineConfig = defineConfig;
+exports.defineConfigFragment = defineConfigFragment;
+exports.withDefaults = withDefaults;
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Deep-merge for config layers. Arrays replace rather than concatenate: a CORS
+ * allow-list or a MIME list is a complete statement of policy, and appending to
+ * an inherited one is how an override accidentally widens it.
+ */
+function mergeConfig(base, override) {
+    if (!isPlainObject(override))
+        return base;
+    const result = { ...base };
+    for (const [key, value] of Object.entries(override)) {
+        if (value === undefined)
+            continue;
+        const existing = result[key];
+        result[key] =
+            isPlainObject(existing) && isPlainObject(value) ? mergeConfig(existing, value) : value;
+    }
+    return result;
+}
+/**
+ * Declare an application's configuration.
+ *
+ * ```ts
+ * export default defineConfig({
+ *   app: { name: 'my-api', environment: env.NODE_ENV, port: env.PORT },
+ *   http: { cors: { origins: env.CORS_ORIGINS } },
+ *   database: { enabled: true, driver: 'postgres', url: env.DATABASE_URL, ssl: 'verify-full' },
+ * });
+ * ```
+ */
+function defineConfig(config, options = {}) {
+    const merged = (options.extends ?? []).reduce((accumulated, fragment) => mergeConfig(accumulated, fragment), {});
+    return mergeConfig(merged, config);
+}
+/** Reusable fragment for workspace-level defaults (`@app/config`). */
+function defineConfigFragment(fragment) {
+    return fragment;
+}
+/** Framework defaults — §11.1 layer 1. Applied at read time, never persisted. */
+exports.FRAMEWORK_DEFAULTS = {
+    port: 3000,
+    host: '0.0.0.0',
+    apiVersion: 1,
+    logLevel: 'info',
+    databaseSsl: 'verify-full',
+    maxQueryLimit: 100,
+    jwtAlgorithm: 'RS256',
+    accessTtl: '15m',
+    refreshTtl: '30d',
+    passwordAlgorithm: 'argon2id',
+    passwordMinLength: 12,
+    otpLength: 6,
+    otpTtl: '10m',
+    lockoutMaxAttempts: 5,
+    lockoutWindow: '15m',
+};
+/**
+ * Fill in framework defaults for the values `@nage-api/core` and the feature
+ * packages read most often, so every consumer sees the same answer instead of
+ * repeating `?? 3000` at each call site.
+ */
+function withDefaults(config) {
+    const environment = config.app.environment;
+    return mergeConfig({
+        app: {
+            port: exports.FRAMEWORK_DEFAULTS.port,
+            host: exports.FRAMEWORK_DEFAULTS.host,
+            version: exports.FRAMEWORK_DEFAULTS.apiVersion,
+        },
+        versioning: { enabled: true, defaultVersion: exports.FRAMEWORK_DEFAULTS.apiVersion },
+        validation: { enabled: true, whitelist: true, forbidNonWhitelisted: true, transform: true },
+        shutdown: { enabled: true },
+        logging: {
+            level: exports.FRAMEWORK_DEFAULTS.logLevel,
+            json: environment !== 'development',
+        },
+        ...(config.database === undefined
+            ? {}
+            : {
+                database: {
+                    ssl: exports.FRAMEWORK_DEFAULTS.databaseSsl,
+                    maxQueryLimit: exports.FRAMEWORK_DEFAULTS.maxQueryLimit,
+                },
+            }),
+        ...(config.auth === undefined
+            ? {}
+            : {
+                auth: {
+                    strategy: 'jwt',
+                    jwt: {
+                        algorithm: exports.FRAMEWORK_DEFAULTS.jwtAlgorithm,
+                        accessTtl: exports.FRAMEWORK_DEFAULTS.accessTtl,
+                    },
+                    refresh: {
+                        ttl: exports.FRAMEWORK_DEFAULTS.refreshTtl,
+                        rotate: true,
+                        reuseDetection: true,
+                    },
+                    password: {
+                        algorithm: exports.FRAMEWORK_DEFAULTS.passwordAlgorithm,
+                        minLength: exports.FRAMEWORK_DEFAULTS.passwordMinLength,
+                    },
+                    otp: { length: exports.FRAMEWORK_DEFAULTS.otpLength, ttl: exports.FRAMEWORK_DEFAULTS.otpTtl },
+                    lockout: {
+                        maxAttempts: exports.FRAMEWORK_DEFAULTS.lockoutMaxAttempts,
+                        window: exports.FRAMEWORK_DEFAULTS.lockoutWindow,
+                    },
+                },
+            }),
+    }, config);
+}
+//# sourceMappingURL=define-config.js.map

package/dist/env/base-env.schema.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Env fragments every application needs (PLAN.md §11.3).
+ *
+ * Applications compose these with their own variables rather than restating
+ * them, so `NODE_ENV`, `PORT` and the CORS allow-list are parsed the same way
+ * everywhere — including by `nage doctor` (Phase 4/6).
+ */
+import { z } from 'zod';
+/** `production` is not the default: a deployment must say what it is. */
+export declare const nodeEnvSchema: z.ZodEnum<{
+    development: "development";
+    test: "test";
+    staging: "staging";
+    production: "production";
+}>;
+/** Ports are numeric and bounded; `parseInt(...) || 3000` hid typos. */
+export declare const portSchema: z.ZodCoercedNumber<unknown>;
+export declare const logLevelSchema: z.ZodEnum<{
+    info: "info";
+    trace: "trace";
+    debug: "debug";
+    warn: "warn";
+    error: "error";
+    fatal: "fatal";
+}>;
+/** Comma-separated origin allow-list → array. Empty entries are dropped. */
+export declare const originListSchema: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string[], string>>, z.ZodArray<z.ZodURL>>;
+/**
+ * A secret that must actually be set to something. No default, ever — a default
+ * secret is the vulnerability the legacy `admin@admin.com/123456` seed was (§12).
+ */
+export declare const secretSchema: z.ZodString;
+export declare const durationSchema: z.ZodString;
+/** The variables `@nage-api/core` itself reads. Extend it per app. */
+export declare const baseEnvSchema: z.ZodObject<{
+    NODE_ENV: z.ZodEnum<{
+        development: "development";
+        test: "test";
+        staging: "staging";
+        production: "production";
+    }>;
+    PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    HOST: z.ZodDefault<z.ZodString>;
+    LOG_LEVEL: z.ZodDefault<z.ZodEnum<{
+        info: "info";
+        trace: "trace";
+        debug: "debug";
+        warn: "warn";
+        error: "error";
+        fatal: "fatal";
+    }>>;
+    CORS_ORIGINS: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string[], string>>, z.ZodArray<z.ZodURL>>>;
+}, z.core.$strip>;
+export type BaseEnv = z.infer<typeof baseEnvSchema>;
+//# sourceMappingURL=base-env.schema.d.ts.map

package/dist/env/base-env.schema.js

@@ -0,0 +1,42 @@
+"use strict";
+/**
+ * Env fragments every application needs (PLAN.md §11.3).
+ *
+ * Applications compose these with their own variables rather than restating
+ * them, so `NODE_ENV`, `PORT` and the CORS allow-list are parsed the same way
+ * everywhere — including by `nage doctor` (Phase 4/6).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.baseEnvSchema = exports.durationSchema = exports.secretSchema = exports.originListSchema = exports.logLevelSchema = exports.portSchema = exports.nodeEnvSchema = void 0;
+const zod_1 = require("zod");
+/** `production` is not the default: a deployment must say what it is. */
+exports.nodeEnvSchema = zod_1.z.enum(['development', 'test', 'staging', 'production']);
+/** Ports are numeric and bounded; `parseInt(...) || 3000` hid typos. */
+exports.portSchema = zod_1.z.coerce.number().int().min(1).max(65_535);
+exports.logLevelSchema = zod_1.z.enum(['trace', 'debug', 'info', 'warn', 'error', 'fatal']);
+/** Comma-separated origin allow-list → array. Empty entries are dropped. */
+exports.originListSchema = zod_1.z
+    .string()
+    .transform((value) => value
+    .split(',')
+    .map((origin) => origin.trim())
+    .filter((origin) => origin.length > 0))
+    .pipe(zod_1.z.array(zod_1.z.url()).min(1));
+/**
+ * A secret that must actually be set to something. No default, ever — a default
+ * secret is the vulnerability the legacy `admin@admin.com/123456` seed was (§12).
+ */
+exports.secretSchema = zod_1.z.string().min(16, 'must be at least 16 characters');
+exports.durationSchema = zod_1.z
+    .string()
+    .regex(/^\d+(ms|s|m|h|d)$/, 'must be a duration such as 15m, 24h or 30d');
+/** The variables `@nage-api/core` itself reads. Extend it per app. */
+exports.baseEnvSchema = zod_1.z.object({
+    NODE_ENV: exports.nodeEnvSchema,
+    PORT: exports.portSchema.default(3000),
+    HOST: zod_1.z.string().default('0.0.0.0'),
+    LOG_LEVEL: exports.logLevelSchema.default('info'),
+    /** Omit to disable CORS entirely — the safe default (§12). */
+    CORS_ORIGINS: exports.originListSchema.optional(),
+});
+//# sourceMappingURL=base-env.schema.js.map

package/dist/env/fail-fast.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Fail-fast boot (PLAN.md §11.3, §21).
+ *
+ * A process that cannot validate its own configuration must not start. It exits
+ * non-zero so an orchestrator restarts or rolls back, instead of serving traffic
+ * with half its settings undefined.
+ */
+import { type EnvSchema, type LoadEnvOptions } from './load-env.js';
+export interface FailFastOptions extends LoadEnvOptions {
+    /** Where the report goes. Injectable so tests can read it. */
+    readonly write?: (message: string) => void;
+    /** How the process ends. Injectable so tests do not kill the runner. */
+    readonly exit?: (code: number) => never;
+}
+/**
+ * Validate the environment or terminate the process.
+ *
+ * ```ts
+ * // apps/api/src/main.ts
+ * const env = loadEnvOrExit(EnvSchema);
+ * void bootstrap({ module: AppModule, config: buildConfig(env) });
+ * ```
+ */
+export declare function loadEnvOrExit<TEnv>(schema: EnvSchema<TEnv>, options?: FailFastOptions): TEnv;
+//# sourceMappingURL=fail-fast.d.ts.map

package/dist/env/fail-fast.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * Fail-fast boot (PLAN.md §11.3, §21).
+ *
+ * A process that cannot validate its own configuration must not start. It exits
+ * non-zero so an orchestrator restarts or rolls back, instead of serving traffic
+ * with half its settings undefined.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadEnvOrExit = loadEnvOrExit;
+const load_env_js_1 = require("./load-env.js");
+const defaultWrite = (message) => {
+    process.stderr.write(message);
+};
+const defaultExit = (code) => process.exit(code);
+/**
+ * Validate the environment or terminate the process.
+ *
+ * ```ts
+ * // apps/api/src/main.ts
+ * const env = loadEnvOrExit(EnvSchema);
+ * void bootstrap({ module: AppModule, config: buildConfig(env) });
+ * ```
+ */
+function loadEnvOrExit(schema, options = {}) {
+    const write = options.write ?? defaultWrite;
+    const exit = options.exit ?? defaultExit;
+    try {
+        return (0, load_env_js_1.loadEnv)(schema, options);
+    }
+    catch (error) {
+        if (error instanceof load_env_js_1.EnvValidationError) {
+            write(`\n${error.report}\n`);
+            return exit(1);
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=fail-fast.js.map

package/dist/env/load-env.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Environment validation (PLAN.md §11.3).
+ *
+ * The legacy framework had no env schema: a missing `DATABASE_URL` surfaced as a
+ * connection error minutes into runtime, and `parseInt(process.env.PORT) || 3000`
+ * silently swallowed typos. Here every variable an app reads is declared in a
+ * zod schema, validated once at boot, and reported in full — all failures at
+ * once, not one per restart.
+ */
+import { ConfigurationError } from '@nage-api/core';
+import type { ZodError, ZodType } from 'zod';
+/** A schema over the environment. Output is what the application then reads. */
+export type EnvSchema<TEnv> = ZodType<TEnv>;
+/** Raw environment source; `process.env` by default. */
+export type EnvSource = Record<string, string | undefined>;
+export interface EnvIssue {
+    readonly variable: string;
+    readonly message: string;
+    /** True when the variable is absent rather than malformed. */
+    readonly missing: boolean;
+}
+export interface LoadEnvOptions {
+    readonly source?: EnvSource;
+    /** Prefix stripped from variable names before validation, e.g. `APP_`. */
+    readonly prefix?: string;
+}
+/**
+ * Turn a `ZodError` into per-variable issues.
+ *
+ * Messages are scrubbed for secret-shaped variables: an env validation failure
+ * is often printed to a CI log, and "expected url, received postgres://user:pw@…"
+ * would publish the credential it was validating.
+ */
+export declare function toEnvIssues(error: ZodError): readonly EnvIssue[];
+/** Human-readable, copy-pasteable report — what an operator actually needs. */
+export declare function formatEnvIssues(issues: readonly EnvIssue[]): string;
+/** Thrown when the environment does not satisfy the schema. */
+export declare class EnvValidationError extends ConfigurationError {
+    readonly issues: readonly EnvIssue[];
+    constructor(issues: readonly EnvIssue[]);
+    /** The report an operator sees on stderr. */
+    get report(): string;
+}
+/**
+ * Validate `source` against `schema`.
+ *
+ * @throws EnvValidationError listing **every** problem, so a misconfigured
+ *   deployment is fixed in one pass rather than one restart per variable.
+ */
+export declare function loadEnv<TEnv>(schema: EnvSchema<TEnv>, options?: LoadEnvOptions): TEnv;
+//# sourceMappingURL=load-env.d.ts.map

package/dist/env/load-env.js

@@ -0,0 +1,94 @@
+"use strict";
+/**
+ * Environment validation (PLAN.md §11.3).
+ *
+ * The legacy framework had no env schema: a missing `DATABASE_URL` surfaced as a
+ * connection error minutes into runtime, and `parseInt(process.env.PORT) || 3000`
+ * silently swallowed typos. Here every variable an app reads is declared in a
+ * zod schema, validated once at boot, and reported in full — all failures at
+ * once, not one per restart.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnvValidationError = void 0;
+exports.toEnvIssues = toEnvIssues;
+exports.formatEnvIssues = formatEnvIssues;
+exports.loadEnv = loadEnv;
+const core_1 = require("@nage-api/core");
+/** Names that look like a secret, and so must never appear in an error message. */
+const SECRET_NAME_PATTERN = /(SECRET|PASSWORD|TOKEN|KEY|CREDENTIAL|DSN|URL|URI)/i;
+function variableOf(issue) {
+    return issue.path.map(String).join('.') || '(root)';
+}
+function isMissing(issue) {
+    // zod 4 reports an absent key as an invalid_type whose input is undefined.
+    return issue.code === 'invalid_type' && /received undefined|expected/i.test(issue.message);
+}
+/**
+ * Turn a `ZodError` into per-variable issues.
+ *
+ * Messages are scrubbed for secret-shaped variables: an env validation failure
+ * is often printed to a CI log, and "expected url, received postgres://user:pw@…"
+ * would publish the credential it was validating.
+ */
+function toEnvIssues(error) {
+    return error.issues.map((issue) => {
+        const variable = variableOf(issue);
+        const missing = isMissing(issue);
+        const message = SECRET_NAME_PATTERN.test(variable)
+            ? missing
+                ? 'is required but not set'
+                : 'is set but has the wrong shape (value hidden)'
+            : issue.message;
+        return { variable, message, missing };
+    });
+}
+/** Human-readable, copy-pasteable report — what an operator actually needs. */
+function formatEnvIssues(issues) {
+    const lines = [
+        `Environment validation failed (${issues.length} ${issues.length === 1 ? 'problem' : 'problems'}):`,
+        '',
+        ...issues.map((issue) => `  ✖ ${issue.variable} — ${issue.message}`),
+        '',
+    ];
+    const missing = issues.filter((issue) => issue.missing).map((issue) => issue.variable);
+    if (missing.length > 0) {
+        lines.push(`Set the missing variables in your environment or .env file: ${missing.join(', ')}`, '');
+    }
+    return lines.join('\n');
+}
+/** Thrown when the environment does not satisfy the schema. */
+class EnvValidationError extends core_1.ConfigurationError {
+    issues;
+    constructor(issues) {
+        super({
+            detail: 'Invalid environment configuration',
+            meta: { issues: issues.map((issue) => `${issue.variable}: ${issue.message}`) },
+        });
+        this.issues = issues;
+    }
+    /** The report an operator sees on stderr. */
+    get report() {
+        return formatEnvIssues(this.issues);
+    }
+}
+exports.EnvValidationError = EnvValidationError;
+/**
+ * Validate `source` against `schema`.
+ *
+ * @throws EnvValidationError listing **every** problem, so a misconfigured
+ *   deployment is fixed in one pass rather than one restart per variable.
+ */
+function loadEnv(schema, options = {}) {
+    const source = options.source ?? process.env;
+    const { prefix } = options;
+    const input = prefix === undefined
+        ? source
+        : Object.fromEntries(Object.entries(source)
+            .filter(([key]) => key.startsWith(prefix))
+            .map(([key, value]) => [key.slice(prefix.length), value]));
+    const result = schema.safeParse(input);
+    if (!result.success)
+        throw new EnvValidationError(toEnvIssues(result.error));
+    return result.data;
+}
+//# sourceMappingURL=load-env.js.map

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `@nage-api/config` — one typed configuration, validated once at boot
+ * (PLAN.md §11).
+ *
+ * Replaces the legacy pair of an `env.ts` singleton and `@nestjs/config` with a
+ * single source: `defineConfig()` for committed settings, a zod schema for the
+ * environment, and a `SecretProviderPort` for everything that must not be
+ * committed.
+ */
+export { defineConfig, defineConfigFragment, mergeConfig, withDefaults, FRAMEWORK_DEFAULTS, type ConfigFragment, type DefineConfigOptions, } from './define-config.js';
+export { loadEnv, formatEnvIssues, toEnvIssues, EnvValidationError, type EnvIssue, type EnvSchema, type EnvSource, type LoadEnvOptions, } from './env/load-env.js';
+export { loadEnvOrExit, type FailFastOptions } from './env/fail-fast.js';
+export { baseEnvSchema, durationSchema, logLevelSchema, nodeEnvSchema, originListSchema, portSchema, secretSchema, type BaseEnv, } from './env/base-env.schema.js';
+export { EnvSecretProvider, type EnvSecretProviderOptions } from './secrets/env.secret-provider.js';
+export { AwsSecretProvider, type AwsSecretProviderOptions, type GetSecretValueCommandFactory, type SecretsManagerLike, } from './secrets/aws.secret-provider.js';
+export { CachingSecretProvider, type CachingSecretProviderOptions, } from './secrets/caching.secret-provider.js';
+export { ConfigService, type EnvRecord } from './config.service.js';
+export { NAGE_ENV, NAGE_SECRET_PROVIDER } from './tokens.js';
+export { NageConfigModule, createSecretProvider, type NageConfigModuleOptions, } from './config.module.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,48 @@
+"use strict";
+/**
+ * `@nage-api/config` — one typed configuration, validated once at boot
+ * (PLAN.md §11).
+ *
+ * Replaces the legacy pair of an `env.ts` singleton and `@nestjs/config` with a
+ * single source: `defineConfig()` for committed settings, a zod schema for the
+ * environment, and a `SecretProviderPort` for everything that must not be
+ * committed.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSecretProvider = exports.NageConfigModule = exports.NAGE_SECRET_PROVIDER = exports.NAGE_ENV = exports.ConfigService = exports.CachingSecretProvider = exports.AwsSecretProvider = exports.EnvSecretProvider = exports.secretSchema = exports.portSchema = exports.originListSchema = exports.nodeEnvSchema = exports.logLevelSchema = exports.durationSchema = exports.baseEnvSchema = exports.loadEnvOrExit = exports.EnvValidationError = exports.toEnvIssues = exports.formatEnvIssues = exports.loadEnv = exports.FRAMEWORK_DEFAULTS = exports.withDefaults = exports.mergeConfig = exports.defineConfigFragment = exports.defineConfig = void 0;
+var define_config_js_1 = require("./define-config.js");
+Object.defineProperty(exports, "defineConfig", { enumerable: true, get: function () { return define_config_js_1.defineConfig; } });
+Object.defineProperty(exports, "defineConfigFragment", { enumerable: true, get: function () { return define_config_js_1.defineConfigFragment; } });
+Object.defineProperty(exports, "mergeConfig", { enumerable: true, get: function () { return define_config_js_1.mergeConfig; } });
+Object.defineProperty(exports, "withDefaults", { enumerable: true, get: function () { return define_config_js_1.withDefaults; } });
+Object.defineProperty(exports, "FRAMEWORK_DEFAULTS", { enumerable: true, get: function () { return define_config_js_1.FRAMEWORK_DEFAULTS; } });
+var load_env_js_1 = require("./env/load-env.js");
+Object.defineProperty(exports, "loadEnv", { enumerable: true, get: function () { return load_env_js_1.loadEnv; } });
+Object.defineProperty(exports, "formatEnvIssues", { enumerable: true, get: function () { return load_env_js_1.formatEnvIssues; } });
+Object.defineProperty(exports, "toEnvIssues", { enumerable: true, get: function () { return load_env_js_1.toEnvIssues; } });
+Object.defineProperty(exports, "EnvValidationError", { enumerable: true, get: function () { return load_env_js_1.EnvValidationError; } });
+var fail_fast_js_1 = require("./env/fail-fast.js");
+Object.defineProperty(exports, "loadEnvOrExit", { enumerable: true, get: function () { return fail_fast_js_1.loadEnvOrExit; } });
+var base_env_schema_js_1 = require("./env/base-env.schema.js");
+Object.defineProperty(exports, "baseEnvSchema", { enumerable: true, get: function () { return base_env_schema_js_1.baseEnvSchema; } });
+Object.defineProperty(exports, "durationSchema", { enumerable: true, get: function () { return base_env_schema_js_1.durationSchema; } });
+Object.defineProperty(exports, "logLevelSchema", { enumerable: true, get: function () { return base_env_schema_js_1.logLevelSchema; } });
+Object.defineProperty(exports, "nodeEnvSchema", { enumerable: true, get: function () { return base_env_schema_js_1.nodeEnvSchema; } });
+Object.defineProperty(exports, "originListSchema", { enumerable: true, get: function () { return base_env_schema_js_1.originListSchema; } });
+Object.defineProperty(exports, "portSchema", { enumerable: true, get: function () { return base_env_schema_js_1.portSchema; } });
+Object.defineProperty(exports, "secretSchema", { enumerable: true, get: function () { return base_env_schema_js_1.secretSchema; } });
+var env_secret_provider_js_1 = require("./secrets/env.secret-provider.js");
+Object.defineProperty(exports, "EnvSecretProvider", { enumerable: true, get: function () { return env_secret_provider_js_1.EnvSecretProvider; } });
+var aws_secret_provider_js_1 = require("./secrets/aws.secret-provider.js");
+Object.defineProperty(exports, "AwsSecretProvider", { enumerable: true, get: function () { return aws_secret_provider_js_1.AwsSecretProvider; } });
+var caching_secret_provider_js_1 = require("./secrets/caching.secret-provider.js");
+Object.defineProperty(exports, "CachingSecretProvider", { enumerable: true, get: function () { return caching_secret_provider_js_1.CachingSecretProvider; } });
+var config_service_js_1 = require("./config.service.js");
+Object.defineProperty(exports, "ConfigService", { enumerable: true, get: function () { return config_service_js_1.ConfigService; } });
+var tokens_js_1 = require("./tokens.js");
+Object.defineProperty(exports, "NAGE_ENV", { enumerable: true, get: function () { return tokens_js_1.NAGE_ENV; } });
+Object.defineProperty(exports, "NAGE_SECRET_PROVIDER", { enumerable: true, get: function () { return tokens_js_1.NAGE_SECRET_PROVIDER; } });
+var config_module_js_1 = require("./config.module.js");
+Object.defineProperty(exports, "NageConfigModule", { enumerable: true, get: function () { return config_module_js_1.NageConfigModule; } });
+Object.defineProperty(exports, "createSecretProvider", { enumerable: true, get: function () { return config_module_js_1.createSecretProvider; } });
+//# sourceMappingURL=index.js.map

package/dist/secrets/aws.secret-provider.d.ts

@@ -0,0 +1,49 @@
+/**
+ * AWS Secrets Manager provider (PLAN.md §11.1 layer 5).
+ *
+ * The SDK is an **optional peer** loaded lazily: an application using env-based
+ * secrets should not carry an AWS client in its image. The client is also
+ * injectable, which is what makes this testable without the SDK installed and
+ * without a network — the legacy AWS-only singleton was neither.
+ */
+import type { SecretProviderPort } from '@nage-api/contracts';
+/** The slice of the SDK client this provider uses. */
+export interface SecretsManagerLike {
+    send(command: unknown): Promise<{
+        SecretString?: string | undefined;
+    }>;
+}
+/** Builds the `GetSecretValue` command; supplied with the client. */
+export type GetSecretValueCommandFactory = (input: {
+    SecretId: string;
+}) => unknown;
+/** The two SDK exports this provider needs. */
+export interface SecretsManagerSdk {
+    readonly SecretsManagerClient: new (config: {
+        region?: string;
+    }) => SecretsManagerLike;
+    readonly GetSecretValueCommand: new (input: {
+        SecretId: string;
+    }) => unknown;
+}
+export interface AwsSecretProviderOptions {
+    readonly region?: string;
+    /** Prepended to every secret name, e.g. `prod/my-app/`. */
+    readonly prefix?: string;
+    /** Pre-built client. When omitted, the SDK is imported on first use. */
+    readonly client?: SecretsManagerLike;
+    readonly commandFactory?: GetSecretValueCommandFactory;
+    /**
+     * How the SDK is loaded. Injectable so both paths — present and absent — are
+     * testable, rather than depending on what happens to be installed.
+     */
+    readonly importSdk?: () => Promise<SecretsManagerSdk>;
+}
+export declare class AwsSecretProvider implements SecretProviderPort {
+    #private;
+    readonly provider = "aws-secrets-manager";
+    constructor(options?: AwsSecretProviderOptions);
+    get(name: string): Promise<string | null>;
+    require(name: string): Promise<string>;
+}
+//# sourceMappingURL=aws.secret-provider.d.ts.map