@puristic/env 0.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Artur Kurowski
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/classify.d.ts

@@ -0,0 +1,15 @@
+import type { LeafDescriptorPublic } from "./inspectSchema.js";
+export type VarStatus = "ok" | "missing-required" | "using-default" | "invalid" | "unknown" | "secret-encrypted" | "secret-plaintext" | "no-schema";
+export interface ClassifyInput {
+    descriptor: LeafDescriptorPublic | undefined;
+    present: boolean;
+    isEncrypted: boolean;
+    validationOk: boolean | undefined;
+    validationMessage: string | undefined;
+}
+export interface Classification {
+    status: VarStatus;
+    message?: string;
+}
+export declare function classify(input: ClassifyInput): Classification;
+//# sourceMappingURL=classify.d.ts.map

package/dist/classify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../src/classify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAI/D,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,kBAAkB,GAAG,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,kBAAkB,GAAG,kBAAkB,GAAG,WAAW,CAAC;AAEpJ,MAAM,WAAW,aAAa;IAC1B,UAAU,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAED,MAAM,WAAW,cAAc;IAC3B,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CAwB7D"}

package/dist/classify.js

@@ -0,0 +1,42 @@
+export function classify(input) {
+    const descriptor = input.descriptor;
+    if (descriptor === undefined) {
+        return { status: "unknown", message: "Not defined in the schema" };
+    }
+    if (descriptor.secret) {
+        if (!input.present) {
+            return missing(descriptor, "Required secret is missing");
+        }
+        if (input.isEncrypted) {
+            return { status: "secret-encrypted" };
+        }
+        return { status: "secret-plaintext", message: "Secret stored as plaintext — encrypt it" };
+    }
+    if (!input.present) {
+        return missing(descriptor, "Required value is missing");
+    }
+    if (input.validationOk === false) {
+        return { status: "invalid", message: invalidMessage(descriptor, input.validationMessage) };
+    }
+    return { status: "ok" };
+}
+function missing(descriptor, requiredMessage) {
+    if (descriptor.required) {
+        return { status: "missing-required", message: requiredMessage };
+    }
+    return { status: "using-default", message: defaultHint(descriptor) };
+}
+function defaultHint(descriptor) {
+    if (!descriptor.hasDefault) {
+        return "Optional — not set";
+    }
+    return descriptor.default !== undefined ? `Using default: ${String(descriptor.default)}` : "Using schema default";
+}
+function invalidMessage(descriptor, message) {
+    const base = message ?? "Invalid value";
+    if ((descriptor.type === "number" || descriptor.type === "boolean") && !descriptor.coerce) {
+        return `${base} — schema isn't coercion-enabled; use z.coerce.${descriptor.type}()`;
+    }
+    return base;
+}
+//# sourceMappingURL=classify.js.map

package/dist/classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.js","sourceRoot":"","sources":["../src/classify.ts"],"names":[],"mappings":"AAmBA,MAAM,UAAU,QAAQ,CAAC,KAAoB;IACzC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,OAAO,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IAC9F,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;IAC/F,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,OAAO,CAAC,UAAgC,EAAE,eAAuB;IACtE,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,WAAW,CAAC,UAAgC;IACjD,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QACzB,OAAO,oBAAoB,CAAC;IAChC,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;AACtH,CAAC;AAED,SAAS,cAAc,CAAC,UAAgC,EAAE,OAA2B;IACjF,MAAM,IAAI,GAAG,OAAO,IAAI,eAAe,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACxF,OAAO,GAAG,IAAI,kDAAkD,UAAU,CAAC,IAAI,IAAI,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/dist/codegen/formatLeafComment.d.ts

@@ -0,0 +1,3 @@
+import type { LeafDescriptorPublic } from "../inspectSchema.js";
+export declare function formatLeafComment(descriptor: LeafDescriptorPublic): string;
+//# sourceMappingURL=formatLeafComment.d.ts.map

package/dist/codegen/formatLeafComment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatLeafComment.d.ts","sourceRoot":"","sources":["../../src/codegen/formatLeafComment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAIhE,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,oBAAoB,GAAG,MAAM,CAS1E"}

package/dist/codegen/formatLeafComment.js

@@ -0,0 +1,20 @@
+export function formatLeafComment(descriptor) {
+    const parts = [typeLabel(descriptor), descriptor.required ? "required" : "optional"];
+    if (descriptor.hasDefault && descriptor.default !== undefined) {
+        parts.push(`default: ${JSON.stringify(descriptor.default)}`);
+    }
+    if (descriptor.secret) {
+        parts.push("secret");
+    }
+    return parts.join(" — ");
+}
+function typeLabel(descriptor) {
+    if (descriptor.enumValues !== undefined) {
+        return `enum (${descriptor.enumValues.join(" | ")})`;
+    }
+    if (descriptor.constraints.length === 0) {
+        return descriptor.type;
+    }
+    return `${descriptor.type} (${descriptor.constraints.map((constraint) => constraint.label).join(", ")})`;
+}
+//# sourceMappingURL=formatLeafComment.js.map

package/dist/codegen/formatLeafComment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatLeafComment.js","sourceRoot":"","sources":["../../src/codegen/formatLeafComment.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,iBAAiB,CAAC,UAAgC;IAC9D,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACrF,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,SAAS,CAAC,UAAgC;IAC/C,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,SAAS,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;IACzD,CAAC;IACD,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC,IAAI,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAC7G,CAAC"}

package/dist/codegen/generateDts.d.ts

@@ -0,0 +1,4 @@
+import type { LeafDescriptorPublic } from "../inspectSchema.js";
+import type { CodegenOptions } from "./generateEnvExample.js";
+export declare function generateDts(descriptors: LeafDescriptorPublic[], options?: CodegenOptions): string;
+//# sourceMappingURL=generateDts.d.ts.map

package/dist/codegen/generateDts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generateDts.d.ts","sourceRoot":"","sources":["../../src/codegen/generateDts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAe,MAAM,qBAAqB,CAAC;AAE7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAoB9D,wBAAgB,WAAW,CAAC,WAAW,EAAE,oBAAoB,EAAE,EAAE,OAAO,GAAE,cAAmB,GAAG,MAAM,CAcrG"}

package/dist/codegen/generateDts.js

@@ -0,0 +1,78 @@
+import { formatLeafComment } from "./formatLeafComment.js";
+const BANNER = "// Generated by puristic gen — DO NOT EDIT.";
+const SCALAR = {
+    string: "string",
+    number: "number",
+    boolean: "boolean",
+    bigint: "bigint",
+    date: "Date",
+    enum: "string",
+    literal: "string",
+    unknown: "unknown",
+};
+export function generateDts(descriptors, options = {}) {
+    const lines = [BANNER];
+    if (options.source !== undefined) {
+        lines.push(`// Source: ${options.source}`);
+    }
+    lines.push("", "export {};", "", "declare global {", "    namespace NodeJS {", "        interface ProcessEnv {");
+    for (const descriptor of descriptors) {
+        lines.push(`            /** ${formatLeafComment(descriptor)} */`);
+        lines.push(`            ${descriptor.envName}${rawOptional(descriptor) ? "?" : ""}: ${rawType(descriptor)};`);
+    }
+    lines.push("        }", "    }", "}", "");
+    lines.push("/** Parsed + coerced config — the shape returned by createConfig(definition).load(). */");
+    lines.push(`export interface PuristicConfig ${renderBranch(buildTree(descriptors), 0)}`);
+    return `${lines.join("\n")}\n`;
+}
+function rawOptional(descriptor) {
+    return descriptor.optional || descriptor.hasDefault;
+}
+function rawType(descriptor) {
+    return descriptor.enumValues !== undefined ? union(descriptor.enumValues) : "string";
+}
+function buildTree(descriptors) {
+    const root = new Map();
+    for (const descriptor of descriptors) {
+        let branch = root;
+        for (let i = 0; i < descriptor.path.length - 1; i++) {
+            const key = descriptor.path[i] ?? "";
+            const child = branch.get(key);
+            if (child instanceof Map) {
+                branch = child;
+            }
+            else {
+                const created = new Map();
+                branch.set(key, created);
+                branch = created;
+            }
+        }
+        branch.set(descriptor.path[descriptor.path.length - 1] ?? descriptor.envName, descriptor);
+    }
+    return root;
+}
+function renderBranch(branch, depth) {
+    const pad = "    ".repeat(depth + 1);
+    const lines = ["{"];
+    for (const [key, value] of branch) {
+        if (value instanceof Map) {
+            lines.push(`${pad}${key}: ${renderBranch(value, depth + 1)};`);
+        }
+        else {
+            lines.push(`${pad}${key}${configOptional(value) ? "?" : ""}: ${configType(value)};`);
+        }
+    }
+    lines.push(`${"    ".repeat(depth)}}`);
+    return lines.join("\n");
+}
+function configOptional(descriptor) {
+    return descriptor.optional || descriptor.hasDefault;
+}
+function configType(descriptor) {
+    const base = descriptor.enumValues !== undefined ? union(descriptor.enumValues) : SCALAR[descriptor.type];
+    return descriptor.nullable ? `${base} | null` : base;
+}
+function union(values) {
+    return values.map((value) => JSON.stringify(value)).join(" | ");
+}
+//# sourceMappingURL=generateDts.js.map

package/dist/codegen/generateDts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generateDts.js","sourceRoot":"","sources":["../../src/codegen/generateDts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAG3D,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAG7D,MAAM,MAAM,GAAgC;IACxC,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,QAAQ;IACd,OAAO,EAAE,QAAQ;IACjB,OAAO,EAAE,SAAS;CACrB,CAAC;AAMF,MAAM,UAAU,WAAW,CAAC,WAAmC,EAAE,UAA0B,EAAE;IACzF,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,gCAAgC,CAAC,CAAC;IACjH,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,mBAAmB,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,eAAe,UAAU,CAAC,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAClH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,yFAAyF,CAAC,CAAC;IACtG,KAAK,CAAC,IAAI,CAAC,mCAAmC,YAAY,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACzF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,UAAgC;IACjD,OAAO,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC;AACxD,CAAC;AAED,SAAS,OAAO,CAAC,UAAgC;IAC7C,OAAO,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzF,CAAC;AAED,SAAS,SAAS,CAAC,WAAmC;IAClD,MAAM,IAAI,GAAW,IAAI,GAAG,EAAE,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACnC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;gBACvB,MAAM,GAAG,KAAK,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACJ,MAAM,OAAO,GAAW,IAAI,GAAG,EAAE,CAAC;gBAClC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACzB,MAAM,GAAG,OAAO,CAAC;YACrB,CAAC;QACL,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,KAAa;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAChC,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,KAAK,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACJ,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzF,CAAC;IACL,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,cAAc,CAAC,UAAgC;IACpD,OAAO,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,UAAgC;IAChD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1G,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,SAAS,KAAK,CAAC,MAAgB;IAC3B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC"}

package/dist/codegen/generateEnvExample.d.ts

@@ -0,0 +1,6 @@
+import type { LeafDescriptorPublic } from "../inspectSchema.js";
+export interface CodegenOptions {
+    source?: string;
+}
+export declare function generateEnvExample(descriptors: LeafDescriptorPublic[], options?: CodegenOptions): string;
+//# sourceMappingURL=generateEnvExample.d.ts.map

package/dist/codegen/generateEnvExample.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generateEnvExample.d.ts","sourceRoot":"","sources":["../../src/codegen/generateEnvExample.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAKhE,MAAM,WAAW,cAAc;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAID,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,oBAAoB,EAAE,EAAE,OAAO,GAAE,cAAmB,GAAG,MAAM,CA4B5G"}

package/dist/codegen/generateEnvExample.js

@@ -0,0 +1,47 @@
+import { formatLeafComment } from "./formatLeafComment.js";
+const BANNER = "# Generated by puristic gen — DO NOT EDIT.";
+export function generateEnvExample(descriptors, options = {}) {
+    const header = options.source === undefined ? [BANNER] : [BANNER, `# Source: ${options.source}`];
+    const rootLeaves = [];
+    const sections = new Map();
+    for (const descriptor of descriptors) {
+        if (descriptor.path.length <= 1) {
+            rootLeaves.push(descriptor);
+            continue;
+        }
+        const section = descriptor.path[0] ?? "";
+        const existing = sections.get(section);
+        if (existing === undefined) {
+            sections.set(section, [descriptor]);
+        }
+        else {
+            existing.push(descriptor);
+        }
+    }
+    const blocks = [];
+    if (rootLeaves.length > 0) {
+        blocks.push(rootLeaves.map(entry).join("\n"));
+    }
+    for (const [section, leaves] of sections) {
+        blocks.push(`# --- ${section} ---\n${leaves.map(entry).join("\n")}`);
+    }
+    return `${header.join("\n")}\n\n${blocks.join("\n\n")}\n`;
+}
+function entry(descriptor) {
+    const lines = [`# ${formatLeafComment(descriptor)}`];
+    if (descriptor.secret) {
+        lines.push("# secret: set via `puristic encrypt`, or paste an encrypted:v1: envelope");
+        lines.push(`${descriptor.envName}=`);
+        return lines.join("\n");
+    }
+    if (descriptor.hasDefault && descriptor.default !== undefined) {
+        lines.push(`${descriptor.envName}=${literal(descriptor.default)}`);
+        return lines.join("\n");
+    }
+    lines.push(`${descriptor.envName}=`);
+    return lines.join("\n");
+}
+function literal(value) {
+    return typeof value === "string" ? value : String(value);
+}
+//# sourceMappingURL=generateEnvExample.js.map

package/dist/codegen/generateEnvExample.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generateEnvExample.js","sourceRoot":"","sources":["../../src/codegen/generateEnvExample.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,MAAM,GAAG,4CAA4C,CAAC;AAQ5D,MAAM,UAAU,kBAAkB,CAAC,WAAmC,EAAE,UAA0B,EAAE;IAChG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjG,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;IAC3D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACnC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC9B,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5B,SAAS;QACb,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACJ,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,SAAS,OAAO,SAAS,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,KAAK,CAAC,UAAgC;IAC3C,MAAM,KAAK,GAAG,CAAC,KAAK,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;QACvF,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC3B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC"}

package/dist/codegen/generateJsonSchema.d.ts

@@ -0,0 +1,3 @@
+import { z } from "zod";
+export declare function generateJsonSchema(schema: z.ZodType): string;
+//# sourceMappingURL=generateJsonSchema.d.ts.map

package/dist/codegen/generateJsonSchema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generateJsonSchema.d.ts","sourceRoot":"","sources":["../../src/codegen/generateJsonSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,MAAM,CAI5D"}

package/dist/codegen/generateJsonSchema.js

@@ -0,0 +1,26 @@
+import { z } from "zod";
+export function generateJsonSchema(schema) {
+    const json = z.toJSONSchema(schema, { unrepresentable: "any" });
+    scrubSecrets(json);
+    return `${JSON.stringify(json, null, 4)}\n`;
+}
+function scrubSecrets(node) {
+    if (Array.isArray(node)) {
+        for (const item of node) {
+            scrubSecrets(item);
+        }
+        return;
+    }
+    if (node === null || typeof node !== "object") {
+        return;
+    }
+    const object = node;
+    if (object["secret"] === true) {
+        delete object["default"];
+        delete object["examples"];
+    }
+    for (const value of Object.values(object)) {
+        scrubSecrets(value);
+    }
+}
+//# sourceMappingURL=generateJsonSchema.js.map

package/dist/codegen/generateJsonSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generateJsonSchema.js","sourceRoot":"","sources":["../../src/codegen/generateJsonSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,MAAM,UAAU,kBAAkB,CAAC,MAAiB;IAChD,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAA4B,CAAC;IAC3F,YAAY,CAAC,IAAI,CAAC,CAAC;IACnB,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,IAAa;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACtB,YAAY,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;IACX,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO;IACX,CAAC;IACD,MAAM,MAAM,GAAG,IAA+B,CAAC;IAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,YAAY,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;AACL,CAAC"}

package/dist/createConfig.d.ts

@@ -0,0 +1,14 @@
+import type { z } from "zod";
+import { type DecryptOptions } from "./crypto/resolveKey.js";
+import type { Source } from "./source.js";
+export interface ConfigDefinition<S extends z.ZodType> {
+    schema: S;
+    sources: Source[];
+    decrypt?: DecryptOptions;
+}
+export interface ConfigHandle<S extends z.ZodType> {
+    load: () => z.infer<S>;
+    get: () => z.infer<S>;
+}
+export declare function createConfig<S extends z.ZodType>(definition: ConfigDefinition<S>): ConfigHandle<S>;
+//# sourceMappingURL=createConfig.d.ts.map

package/dist/createConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createConfig.d.ts","sourceRoot":"","sources":["../src/createConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,EAAE,KAAK,cAAc,EAAqB,MAAM,wBAAwB,CAAC;AAGhF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,gBAAgB,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO;IACjD,MAAM,EAAE,CAAC,CAAC;IACV,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO;IAC7C,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;CACzB;AAED,wBAAgB,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAoBlG"}

package/dist/createConfig.js

@@ -0,0 +1,26 @@
+import { decryptSecretsInPlace } from "./crypto/decryptInPlace.js";
+import { resolvePrivateKey } from "./crypto/resolveKey.js";
+import { deepFreeze } from "./freeze.js";
+import { mergeSources } from "./merge.js";
+export function createConfig(definition) {
+    let holder;
+    return {
+        load() {
+            const merged = mergeSources(definition.sources, definition.schema);
+            if (definition.decrypt?.disabled !== true) {
+                decryptSecretsInPlace(merged, definition.schema, () => resolvePrivateKey(definition.decrypt));
+            }
+            const parsed = definition.schema.parse(merged);
+            const frozen = deepFreeze(parsed);
+            holder = frozen;
+            return frozen;
+        },
+        get() {
+            if (holder === undefined) {
+                throw new Error("Config not loaded — call load() in your bootstrap before accessing config values");
+            }
+            return holder;
+        },
+    };
+}
+//# sourceMappingURL=createConfig.js.map

package/dist/createConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createConfig.js","sourceRoot":"","sources":["../src/createConfig.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAuB,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAc1C,MAAM,UAAU,YAAY,CAAsB,UAA+B;IAC7E,IAAI,MAA8B,CAAC;IACnC,OAAO;QACH,IAAI;YACA,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YACnE,IAAI,UAAU,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACxC,qBAAqB,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YAClG,CAAC;YACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAe,CAAC;YAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,GAAG,MAAM,CAAC;YAChB,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,GAAG;YACC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;YACxG,CAAC;YACD,OAAO,MAAM,CAAC;QAClB,CAAC;KACJ,CAAC;AACN,CAAC"}

package/dist/crypto/decrypt.d.ts

@@ -0,0 +1,2 @@
+export declare function decrypt(envelope: string, privateKey: string | Uint8Array): string;
+//# sourceMappingURL=decrypt.d.ts.map

package/dist/crypto/decrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../src/crypto/decrypt.ts"],"names":[],"mappings":"AAIA,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAQjF"}

package/dist/crypto/decrypt.js

@@ -0,0 +1,13 @@
+import { createDecipheriv } from "node:crypto";
+import { ml_kem512 } from "@noble/post-quantum/ml-kem.js";
+import { base64urlDecode, decodeEnvelope } from "./format.js";
+export function decrypt(envelope, privateKey) {
+    const sk = typeof privateKey === "string" ? base64urlDecode(privateKey) : privateKey;
+    const { kemCt, nonce, tag, ct } = decodeEnvelope(envelope);
+    const sharedSecret = ml_kem512.decapsulate(kemCt, sk);
+    const decipher = createDecipheriv("aes-256-gcm", sharedSecret, nonce);
+    decipher.setAuthTag(tag);
+    const plaintext = Buffer.concat([decipher.update(ct), decipher.final()]);
+    return plaintext.toString("utf8");
+}
+//# sourceMappingURL=decrypt.js.map

package/dist/crypto/decrypt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../../src/crypto/decrypt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE9D,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,UAA+B;IACrE,MAAM,EAAE,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACrF,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IACtE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzE,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC"}

package/dist/crypto/decryptInPlace.d.ts

@@ -0,0 +1,3 @@
+import type { z } from "zod";
+export declare function decryptSecretsInPlace(record: Record<string, unknown>, schema: z.ZodType, resolveKey: () => Uint8Array): void;
+//# sourceMappingURL=decryptInPlace.d.ts.map

package/dist/crypto/decryptInPlace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decryptInPlace.d.ts","sourceRoot":"","sources":["../../src/crypto/decryptInPlace.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAM7B,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,GAAG,IAAI,CAiB5H"}

package/dist/crypto/decryptInPlace.js

@@ -0,0 +1,24 @@
+import { enumerateLeafPaths } from "../enumerateLeafPaths.js";
+import { setPath } from "../setPath.js";
+import { decrypt } from "./decrypt.js";
+import { getPath } from "./getPath.js";
+export function decryptSecretsInPlace(record, schema, resolveKey) {
+    const secretLeaves = enumerateLeafPaths(schema).filter((leaf) => leaf.meta?.["secret"] === true);
+    let key;
+    for (const leaf of secretLeaves) {
+        const value = getPath(record, leaf.path);
+        if (typeof value !== "string" || !value.startsWith("encrypted:")) {
+            continue;
+        }
+        if (key === undefined) {
+            try {
+                key = resolveKey();
+            }
+            catch (cause) {
+                throw new Error(`Cannot decrypt secret at path "${leaf.path.join(".")}": ${cause.message}`);
+            }
+        }
+        setPath(record, leaf.path, decrypt(value, key));
+    }
+}
+//# sourceMappingURL=decryptInPlace.js.map

package/dist/crypto/decryptInPlace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decryptInPlace.js","sourceRoot":"","sources":["../../src/crypto/decryptInPlace.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,UAAU,qBAAqB,CAAC,MAA+B,EAAE,MAAiB,EAAE,UAA4B;IAClH,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;IACjG,IAAI,GAA2B,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/D,SAAS;QACb,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC;gBACD,GAAG,GAAG,UAAU,EAAE,CAAC;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3G,CAAC;QACL,CAAC;QACD,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACpD,CAAC;AACL,CAAC"}

package/dist/crypto/encrypt.d.ts

@@ -0,0 +1,2 @@
+export declare function encrypt(plaintext: string, publicKey: string | Uint8Array): string;
+//# sourceMappingURL=encrypt.d.ts.map

package/dist/crypto/encrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt.d.ts","sourceRoot":"","sources":["../../src/crypto/encrypt.ts"],"names":[],"mappings":"AAIA,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAQjF"}

package/dist/crypto/encrypt.js

@@ -0,0 +1,13 @@
+import { createCipheriv, randomBytes } from "node:crypto";
+import { ml_kem512 } from "@noble/post-quantum/ml-kem.js";
+import { base64urlDecode, encodeEnvelope } from "./format.js";
+export function encrypt(plaintext, publicKey) {
+    const pk = typeof publicKey === "string" ? base64urlDecode(publicKey) : publicKey;
+    const { cipherText: kemCt, sharedSecret } = ml_kem512.encapsulate(pk);
+    const nonce = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", sharedSecret, nonce);
+    const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return encodeEnvelope(kemCt, nonce, tag, ct);
+}
+//# sourceMappingURL=encrypt.js.map

package/dist/crypto/encrypt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt.js","sourceRoot":"","sources":["../../src/crypto/encrypt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE9D,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,SAA8B;IACrE,MAAM,EAAE,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC"}

package/dist/crypto/format.d.ts

@@ -0,0 +1,16 @@
+export declare const ENVELOPE_PREFIX = "encrypted:v1:";
+export declare const KEM_CT_LEN = 768;
+export declare const NONCE_LEN = 12;
+export declare const GCM_TAG_LEN = 16;
+export interface Envelope {
+    kemCt: Uint8Array;
+    nonce: Uint8Array;
+    tag: Uint8Array;
+    ct: Uint8Array;
+}
+export declare function encodeEnvelope(kemCt: Uint8Array, nonce: Uint8Array, tag: Uint8Array, ct: Uint8Array): string;
+export declare function decodeEnvelope(value: string): Envelope;
+export declare function isEnvelope(value: unknown): value is string;
+export declare function base64urlEncode(bytes: Uint8Array): string;
+export declare function base64urlDecode(text: string): Uint8Array;
+//# sourceMappingURL=format.d.ts.map

package/dist/crypto/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/crypto/format.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C,eAAO,MAAM,UAAU,MAAM,CAAC;AAC9B,eAAO,MAAM,SAAS,KAAK,CAAC;AAC5B,eAAO,MAAM,WAAW,KAAK,CAAC;AAG9B,MAAM,WAAW,QAAQ;IACrB,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,UAAU,CAAC;IAClB,GAAG,EAAE,UAAU,CAAC;IAChB,EAAE,EAAE,UAAU,CAAC;CAClB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,GAAG,MAAM,CAgB5G;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CActD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE1D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEzD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAExD"}

package/dist/crypto/format.js

@@ -0,0 +1,47 @@
+export const ENVELOPE_PREFIX = "encrypted:v1:";
+export const KEM_CT_LEN = 768;
+export const NONCE_LEN = 12;
+export const GCM_TAG_LEN = 16;
+const HEADER_LEN = KEM_CT_LEN + NONCE_LEN + GCM_TAG_LEN;
+export function encodeEnvelope(kemCt, nonce, tag, ct) {
+    if (kemCt.length !== KEM_CT_LEN) {
+        throw new Error(`encodeEnvelope: kemCt must be ${KEM_CT_LEN} bytes, got ${kemCt.length}`);
+    }
+    if (nonce.length !== NONCE_LEN) {
+        throw new Error(`encodeEnvelope: nonce must be ${NONCE_LEN} bytes, got ${nonce.length}`);
+    }
+    if (tag.length !== GCM_TAG_LEN) {
+        throw new Error(`encodeEnvelope: tag must be ${GCM_TAG_LEN} bytes, got ${tag.length}`);
+    }
+    const body = new Uint8Array(HEADER_LEN + ct.length);
+    body.set(kemCt, 0);
+    body.set(nonce, KEM_CT_LEN);
+    body.set(tag, KEM_CT_LEN + NONCE_LEN);
+    body.set(ct, HEADER_LEN);
+    return ENVELOPE_PREFIX + base64urlEncode(body);
+}
+export function decodeEnvelope(value) {
+    if (!value.startsWith(ENVELOPE_PREFIX)) {
+        throw new Error(`decodeEnvelope: expected prefix "${ENVELOPE_PREFIX}"`);
+    }
+    const body = base64urlDecode(value.slice(ENVELOPE_PREFIX.length));
+    if (body.length < HEADER_LEN) {
+        throw new Error(`decodeEnvelope: payload too short (${body.length} < ${HEADER_LEN})`);
+    }
+    return {
+        kemCt: body.subarray(0, KEM_CT_LEN),
+        nonce: body.subarray(KEM_CT_LEN, KEM_CT_LEN + NONCE_LEN),
+        tag: body.subarray(KEM_CT_LEN + NONCE_LEN, HEADER_LEN),
+        ct: body.subarray(HEADER_LEN),
+    };
+}
+export function isEnvelope(value) {
+    return typeof value === "string" && value.startsWith("encrypted:");
+}
+export function base64urlEncode(bytes) {
+    return Buffer.from(bytes).toString("base64url");
+}
+export function base64urlDecode(text) {
+    return new Uint8Array(Buffer.from(text, "base64url"));
+}
+//# sourceMappingURL=format.js.map

package/dist/crypto/format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../src/crypto/format.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAE/C,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC;AAC9B,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC;AAC5B,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAC9B,MAAM,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;AASxD,MAAM,UAAU,cAAc,CAAC,KAAiB,EAAE,KAAiB,EAAE,GAAe,EAAE,EAAc;IAChG,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,iCAAiC,UAAU,eAAe,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,iCAAiC,SAAS,eAAe,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+BAA+B,WAAW,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,UAAU,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACzB,OAAO,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IACxC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,oCAAoC,eAAe,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO;QACH,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC;QACnC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;QACxD,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,GAAG,SAAS,EAAE,UAAU,CAAC;QACtD,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;KAChC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IACxC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/crypto/getPath.d.ts

@@ -0,0 +1,2 @@
+export declare function getPath(source: Record<string, unknown>, path: string[]): unknown;
+//# sourceMappingURL=getPath.d.ts.map

package/dist/crypto/getPath.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getPath.d.ts","sourceRoot":"","sources":["../../src/crypto/getPath.ts"],"names":[],"mappings":"AAEA,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAShF"}

package/dist/crypto/getPath.js

@@ -0,0 +1,12 @@
+import { isPlainObject } from "../setPath.js";
+export function getPath(source, path) {
+    let cursor = source;
+    for (const segment of path) {
+        if (!isPlainObject(cursor)) {
+            return undefined;
+        }
+        cursor = cursor[segment];
+    }
+    return cursor;
+}
+//# sourceMappingURL=getPath.js.map

package/dist/crypto/getPath.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getPath.js","sourceRoot":"","sources":["../../src/crypto/getPath.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,MAAM,UAAU,OAAO,CAAC,MAA+B,EAAE,IAAc;IACnE,IAAI,MAAM,GAAY,MAAM,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/crypto/keygen.d.ts

@@ -0,0 +1,6 @@
+export interface Keypair {
+    publicKey: string;
+    privateKey: string;
+}
+export declare function generateKeypair(): Keypair;
+//# sourceMappingURL=keygen.d.ts.map

package/dist/crypto/keygen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen.d.ts","sourceRoot":"","sources":["../../src/crypto/keygen.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,OAAO;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,eAAe,IAAI,OAAO,CAMzC"}

package/dist/crypto/keygen.js

@@ -0,0 +1,10 @@
+import { ml_kem512 } from "@noble/post-quantum/ml-kem.js";
+import { base64urlEncode } from "./format.js";
+export function generateKeypair() {
+    const { publicKey, secretKey } = ml_kem512.keygen();
+    return {
+        publicKey: base64urlEncode(publicKey),
+        privateKey: base64urlEncode(secretKey),
+    };
+}
+//# sourceMappingURL=keygen.js.map

package/dist/crypto/keygen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen.js","sourceRoot":"","sources":["../../src/crypto/keygen.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAO9C,MAAM,UAAU,eAAe;IAC3B,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;IACpD,OAAO;QACH,SAAS,EAAE,eAAe,CAAC,SAAS,CAAC;QACrC,UAAU,EAAE,eAAe,CAAC,SAAS,CAAC;KACzC,CAAC;AACN,CAAC"}

package/dist/crypto/resolveKey.d.ts

@@ -0,0 +1,11 @@
+export declare const PUBLIC_KEY_PATH = ".config/puristic-pub.key";
+export interface DecryptOptions {
+    privateKey?: string | Uint8Array;
+    privateKeyPath?: string;
+    disabled?: boolean;
+}
+export declare function resolvePublicKey(cwd?: string): Uint8Array;
+export declare function resolvePrivateKey(options?: DecryptOptions): Uint8Array;
+export declare function defaultPrivateKeyPath(cwd: string): string;
+export declare function resolveProjectName(cwd?: string): string;
+//# sourceMappingURL=resolveKey.d.ts.map