@rawnodes/config-loader 1.4.0 → 1.5.0

package/README.md

@@ -6,6 +6,8 @@ Flexible YAML configuration loader for Node.js applications with environment ove
 
 - **YAML Configuration** - Load config from YAML files with environment-specific overrides
 - **Environment Variables** - Replace `${VAR}` placeholders with env values
+- **HashiCorp Vault** - Read secrets from Vault using `${vault:path:field}` syntax
+- **AWS Secrets Manager** - Read secrets from AWS using `${aws:secret-name:field}` syntax
 - **Zod Validation** - Optional schema validation with detailed error messages
 - **Docker/K8s Ready** - Mount additional config files via `overrideDir`
 - **Secret Masking** - Automatic masking of sensitive values in logs
@@ -103,6 +105,21 @@ interface ConfigLoaderOptions<T> {
   // Remove empty strings and empty objects from config (default: false)
   // Useful for optional fields with ${VAR:} placeholders
   stripEmpty?: boolean;
+
+  // HashiCorp Vault options (requires loadConfigAsync)
+  vault?: {
+    endpoint: string;     // Vault server URL
+    roleId: string;       // AppRole role_id
+    secretId: string;     // AppRole secret_id
+    namespace?: string;   // Optional Vault Enterprise namespace
+  };
+
+  // AWS Secrets Manager options (requires loadConfigAsync)
+  aws?: {
+    region: string;          // AWS region
+    accessKeyId: string;     // AWS access key ID
+    secretAccessKey: string; // AWS secret access key
+  };
 }
 ```
 
@@ -161,6 +178,116 @@ const { config } = loadConfig({
 - Arrays: empty strings filtered out
 - Other falsy values (`0`, `false`, `null`) are preserved
 
+## HashiCorp Vault Integration
+
+Read secrets directly from HashiCorp Vault using AppRole authentication.
+
+### Setup
+
+```yaml
+# config/base.yml
+database:
+  host: localhost
+  password: ${vault:secret/data/api:DB_PASSWORD}
+  port: ${vault:secret/data/api:DB_PORT:5432}  # with default value
+```
+
+```typescript
+import { loadConfigAsync } from '@rawnodes/config-loader';
+
+const { config } = await loadConfigAsync({
+  configDir: './config',
+  vault: {
+    endpoint: 'https://vault.example.com',
+    roleId: process.env.VAULT_ROLE_ID!,
+    secretId: process.env.VAULT_SECRET_ID!,
+    namespace: 'optional-namespace',  // for Vault Enterprise
+  },
+});
+```
+
+### Syntax
+
+```
+${vault:PATH:FIELD}           - Required secret
+${vault:PATH:FIELD:DEFAULT}   - With default value (used if secret not found)
+```
+
+**Examples:**
+```yaml
+database:
+  # Read DB_PASSWORD from secret/data/api
+  password: ${vault:secret/data/api:DB_PASSWORD}
+
+  # With default value (supports colons in default)
+  url: ${vault:secret/data/db:URL:postgres://localhost:5432/app}
+
+  # Mix with env variables
+  host: ${DB_HOST:localhost}
+```
+
+### Notes
+
+- Use `loadConfigAsync()` instead of `loadConfig()` when using Vault
+- Secrets are cached per path during config load (multiple fields from same path = 1 API call)
+- Supports Vault KV v1 and v2 secret engines
+
+## AWS Secrets Manager Integration
+
+Read secrets from AWS Secrets Manager.
+
+### Setup
+
+```yaml
+# config/base.yml
+database:
+  password: ${aws:my-app/database:DB_PASSWORD}
+  host: ${aws:my-app/database:DB_HOST:localhost}
+api:
+  key: ${aws:my-app/api-key}  # plain string secret (no field)
+```
+
+```typescript
+import { loadConfigAsync } from '@rawnodes/config-loader';
+
+const { config } = await loadConfigAsync({
+  configDir: './config',
+  aws: {
+    region: 'us-east-1',
+    accessKeyId: process.env.AWS_ACCESS_KEY_ID!,
+    secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!,
+  },
+});
+```
+
+### Syntax
+
+```
+${aws:SECRET_NAME}              - Plain string secret (entire value)
+${aws:SECRET_NAME:FIELD}        - JSON secret, extract field
+${aws:SECRET_NAME:FIELD:DEFAULT} - With default value
+```
+
+**Examples:**
+```yaml
+database:
+  # JSON secret: {"DB_PASSWORD": "secret", "DB_USER": "admin"}
+  password: ${aws:my-app/database:DB_PASSWORD}
+  user: ${aws:my-app/database:DB_USER}
+
+  # Plain string secret (no field)
+  api_key: ${aws:my-app/api-key}
+
+  # With default value
+  host: ${aws:my-app/database:DB_HOST:localhost}
+```
+
+### Notes
+
+- Use `loadConfigAsync()` instead of `loadConfig()` when using AWS
+- Secrets are cached per secret name during config load
+- Supports both JSON and plain string secrets
+
 ## Zod Validation
 
 ```typescript
@@ -234,7 +361,7 @@ export class ConfigModule {}
 
 ### `loadConfig<T>(options?): ConfigLoaderResult<T>`
 
-Loads and merges configuration files.
+Loads and merges configuration files synchronously.
 
 **Returns:**
 ```typescript
@@ -245,6 +372,21 @@ interface ConfigLoaderResult<T> {
 }
 ```
 
+### `loadConfigAsync<T>(options?): Promise<ConfigLoaderResult<T>>`
+
+Async version with Vault support. Required when using `vault` option.
+
+```typescript
+const { config } = await loadConfigAsync({
+  configDir: './config',
+  vault: {
+    endpoint: 'https://vault.example.com',
+    roleId: 'role-id',
+    secretId: 'secret-id',
+  },
+});
+```
+
 ### `maskSecrets(obj): unknown`
 
 Masks sensitive values in an object. Useful for logging.

package/dist/index.d.mts

@@ -1,5 +1,39 @@
 import { z } from 'zod';
 
+interface VaultOptions {
+    /**
+     * Vault server endpoint URL
+     * @example 'https://vault.example.com'
+     */
+    endpoint: string;
+    /**
+     * AppRole role_id for authentication
+     */
+    roleId: string;
+    /**
+     * AppRole secret_id for authentication
+     */
+    secretId: string;
+    /**
+     * Optional namespace for Vault Enterprise
+     */
+    namespace?: string;
+}
+interface AwsSecretsOptions {
+    /**
+     * AWS region
+     * @example 'us-east-1'
+     */
+    region: string;
+    /**
+     * AWS access key ID
+     */
+    accessKeyId: string;
+    /**
+     * AWS secret access key
+     */
+    secretAccessKey: string;
+}
 interface DotenvOptions {
     /**
      * Path to .env file
@@ -63,6 +97,18 @@ interface ConfigLoaderOptions<T = unknown> {
      * @default false
      */
     stripEmpty?: boolean;
+    /**
+     * HashiCorp Vault options for secret retrieval
+     * If provided, ${vault:path:field} placeholders will be resolved
+     * Requires using loadConfigAsync() instead of loadConfig()
+     */
+    vault?: VaultOptions;
+    /**
+     * AWS Secrets Manager options for secret retrieval
+     * If provided, ${aws:secret-name:field} placeholders will be resolved
+     * Requires using loadConfigAsync() instead of loadConfig()
+     */
+    aws?: AwsSecretsOptions;
 }
 interface ConfigLoaderResult<T> {
     config: T;
@@ -71,14 +117,37 @@ interface ConfigLoaderResult<T> {
 }
 
 declare function loadConfig<T>(options?: ConfigLoaderOptions<T>): ConfigLoaderResult<T>;
+declare function loadConfigAsync<T>(options?: ConfigLoaderOptions<T>): Promise<ConfigLoaderResult<T>>;
 
 type DeepObject = Record<string, unknown>;
 declare function deepMerge(base: DeepObject, override: DeepObject): DeepObject;
 
-declare function replacePlaceholders(obj: unknown): unknown;
+interface VaultSecretCache {
+    [path: string]: Record<string, unknown>;
+}
+interface VaultClient {
+    fetchSecrets(obj: unknown): Promise<VaultSecretCache>;
+    getSecret(path: string, field: string): unknown;
+}
+declare function createVaultClient(options: VaultOptions): Promise<VaultClient>;
+
+interface AwsSecretsCache {
+    [secretName: string]: string | Record<string, unknown>;
+}
+interface AwsSecretsClient {
+    fetchSecrets(obj: unknown): Promise<AwsSecretsCache>;
+    getSecret(secretName: string, field?: string): unknown;
+}
+declare function createAwsSecretsClient(options: AwsSecretsOptions): Promise<AwsSecretsClient>;
+
+interface ReplacePlaceholdersOptions {
+    vaultClient?: VaultClient;
+    awsClient?: AwsSecretsClient;
+}
+declare function replacePlaceholders(obj: unknown, options?: ReplacePlaceholdersOptions): unknown;
 
 declare function maskSecrets(obj: unknown): unknown;
 
 declare function stripEmpty(obj: unknown): unknown;
 
-export { type ConfigLoaderOptions, type ConfigLoaderResult, type DotenvOptions, deepMerge, loadConfig, maskSecrets, replacePlaceholders, stripEmpty };
+export { type AwsSecretsCache, type AwsSecretsClient, type AwsSecretsOptions, type ConfigLoaderOptions, type ConfigLoaderResult, type DotenvOptions, type VaultClient, type VaultOptions, type VaultSecretCache, createAwsSecretsClient, createVaultClient, deepMerge, loadConfig, loadConfigAsync, maskSecrets, replacePlaceholders, stripEmpty };

package/dist/index.d.ts

@@ -1,5 +1,39 @@
 import { z } from 'zod';
 
+interface VaultOptions {
+    /**
+     * Vault server endpoint URL
+     * @example 'https://vault.example.com'
+     */
+    endpoint: string;
+    /**
+     * AppRole role_id for authentication
+     */
+    roleId: string;
+    /**
+     * AppRole secret_id for authentication
+     */
+    secretId: string;
+    /**
+     * Optional namespace for Vault Enterprise
+     */
+    namespace?: string;
+}
+interface AwsSecretsOptions {
+    /**
+     * AWS region
+     * @example 'us-east-1'
+     */
+    region: string;
+    /**
+     * AWS access key ID
+     */
+    accessKeyId: string;
+    /**
+     * AWS secret access key
+     */
+    secretAccessKey: string;
+}
 interface DotenvOptions {
     /**
      * Path to .env file
@@ -63,6 +97,18 @@ interface ConfigLoaderOptions<T = unknown> {
      * @default false
      */
     stripEmpty?: boolean;
+    /**
+     * HashiCorp Vault options for secret retrieval
+     * If provided, ${vault:path:field} placeholders will be resolved
+     * Requires using loadConfigAsync() instead of loadConfig()
+     */
+    vault?: VaultOptions;
+    /**
+     * AWS Secrets Manager options for secret retrieval
+     * If provided, ${aws:secret-name:field} placeholders will be resolved
+     * Requires using loadConfigAsync() instead of loadConfig()
+     */
+    aws?: AwsSecretsOptions;
 }
 interface ConfigLoaderResult<T> {
     config: T;
@@ -71,14 +117,37 @@ interface ConfigLoaderResult<T> {
 }
 
 declare function loadConfig<T>(options?: ConfigLoaderOptions<T>): ConfigLoaderResult<T>;
+declare function loadConfigAsync<T>(options?: ConfigLoaderOptions<T>): Promise<ConfigLoaderResult<T>>;
 
 type DeepObject = Record<string, unknown>;
 declare function deepMerge(base: DeepObject, override: DeepObject): DeepObject;
 
-declare function replacePlaceholders(obj: unknown): unknown;
+interface VaultSecretCache {
+    [path: string]: Record<string, unknown>;
+}
+interface VaultClient {
+    fetchSecrets(obj: unknown): Promise<VaultSecretCache>;
+    getSecret(path: string, field: string): unknown;
+}
+declare function createVaultClient(options: VaultOptions): Promise<VaultClient>;
+
+interface AwsSecretsCache {
+    [secretName: string]: string | Record<string, unknown>;
+}
+interface AwsSecretsClient {
+    fetchSecrets(obj: unknown): Promise<AwsSecretsCache>;
+    getSecret(secretName: string, field?: string): unknown;
+}
+declare function createAwsSecretsClient(options: AwsSecretsOptions): Promise<AwsSecretsClient>;
+
+interface ReplacePlaceholdersOptions {
+    vaultClient?: VaultClient;
+    awsClient?: AwsSecretsClient;
+}
+declare function replacePlaceholders(obj: unknown, options?: ReplacePlaceholdersOptions): unknown;
 
 declare function maskSecrets(obj: unknown): unknown;
 
 declare function stripEmpty(obj: unknown): unknown;
 
-export { type ConfigLoaderOptions, type ConfigLoaderResult, type DotenvOptions, deepMerge, loadConfig, maskSecrets, replacePlaceholders, stripEmpty };
+export { type AwsSecretsCache, type AwsSecretsClient, type AwsSecretsOptions, type ConfigLoaderOptions, type ConfigLoaderResult, type DotenvOptions, type VaultClient, type VaultOptions, type VaultSecretCache, createAwsSecretsClient, createVaultClient, deepMerge, loadConfig, loadConfigAsync, maskSecrets, replacePlaceholders, stripEmpty };

package/dist/index.js

@@ -4,6 +4,10 @@ var fs = require('fs');
 var yaml = require('js-yaml');
 var dotenv = require('dotenv');
 var path = require('path');
+var NodeVault = require('node-vault');
+var clientSecretsManager = require('@aws-sdk/client-secrets-manager');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 function _interopNamespace(e) {
   if (e && e.__esModule) return e;
@@ -25,6 +29,7 @@ function _interopNamespace(e) {
 
 var yaml__namespace = /*#__PURE__*/_interopNamespace(yaml);
 var dotenv__namespace = /*#__PURE__*/_interopNamespace(dotenv);
+var NodeVault__default = /*#__PURE__*/_interopDefault(NodeVault);
 
 // src/loader.ts
 
@@ -48,41 +53,104 @@ function isPlainObject(value) {
 
 // src/utils/env-replacer.ts
 var ENV_PLACEHOLDER_REGEX = /\${(.*?)}/g;
-function replacePlaceholders(obj) {
+var VAULT_PREFIX = "vault:";
+var AWS_PREFIX = "aws:";
+function replacePlaceholders(obj, options = {}) {
   if (typeof obj === "string") {
-    return replaceStringPlaceholders(obj);
+    return replaceStringPlaceholders(obj, options);
   }
   if (Array.isArray(obj)) {
-    return obj.map((item) => replacePlaceholders(item));
+    return obj.map((item) => replacePlaceholders(item, options));
   }
   if (isPlainObject2(obj)) {
     const result = {};
     for (const key of Object.keys(obj)) {
-      result[key] = replacePlaceholders(obj[key]);
+      result[key] = replacePlaceholders(obj[key], options);
     }
     return result;
   }
   return obj;
 }
-function replaceStringPlaceholders(str) {
+function replaceStringPlaceholders(str, options) {
   return str.replace(ENV_PLACEHOLDER_REGEX, (match, key) => {
-    const [envKey, ...rest] = key.split(":");
-    const defaultValue = rest.length > 0 ? rest.join(":") : void 0;
-    const envValue = process.env[envKey];
-    let value;
-    if (envValue !== void 0) {
-      value = envValue;
-    } else if (defaultValue !== void 0) {
-      value = defaultValue;
-    } else {
-      throw new Error(`Environment variable "${envKey}" is not defined and no default value provided`);
+    if (key.startsWith(VAULT_PREFIX)) {
+      return resolveVaultPlaceholder(key, match, options);
     }
-    if (value.includes("${")) {
-      return replacePlaceholders(value);
+    if (key.startsWith(AWS_PREFIX)) {
+      return resolveAwsPlaceholder(key, match, options);
     }
-    return value;
+    return resolveEnvPlaceholder(key, match, options);
   });
 }
+function resolveVaultPlaceholder(key, originalMatch, options) {
+  const parts = key.substring(VAULT_PREFIX.length).split(":");
+  if (parts.length < 2) {
+    throw new Error(
+      `Invalid Vault placeholder format "${originalMatch}". Expected \${vault:path:field} or \${vault:path:field:default}`
+    );
+  }
+  const [path, field, ...defaultParts] = parts;
+  const defaultValue = defaultParts.length > 0 ? defaultParts.join(":") : void 0;
+  if (!options.vaultClient) {
+    if (defaultValue !== void 0) {
+      return defaultValue;
+    }
+    throw new Error(`Vault placeholder "${originalMatch}" found but no Vault options provided`);
+  }
+  const secretValue = options.vaultClient.getSecret(path, field);
+  if (secretValue !== void 0) {
+    return String(secretValue);
+  }
+  if (defaultValue !== void 0) {
+    return defaultValue;
+  }
+  throw new Error(`Vault secret "${field}" not found at path "${path}" and no default value provided`);
+}
+function resolveAwsPlaceholder(key, originalMatch, options) {
+  const parts = key.substring(AWS_PREFIX.length).split(":");
+  if (parts.length < 1 || !parts[0]) {
+    throw new Error(
+      `Invalid AWS placeholder format "${originalMatch}". Expected \${aws:secret-name} or \${aws:secret-name:field} or \${aws:secret-name:field:default}`
+    );
+  }
+  const [secretName, field, ...defaultParts] = parts;
+  const defaultValue = defaultParts.length > 0 ? defaultParts.join(":") : void 0;
+  if (!options.awsClient) {
+    if (defaultValue !== void 0) {
+      return defaultValue;
+    }
+    throw new Error(`AWS placeholder "${originalMatch}" found but no AWS options provided`);
+  }
+  const secretValue = options.awsClient.getSecret(secretName, field || void 0);
+  if (secretValue !== void 0) {
+    return String(secretValue);
+  }
+  if (defaultValue !== void 0) {
+    return defaultValue;
+  }
+  if (field) {
+    throw new Error(`AWS secret field "${field}" not found in "${secretName}" and no default value provided`);
+  } else {
+    throw new Error(`AWS secret "${secretName}" not found and no default value provided`);
+  }
+}
+function resolveEnvPlaceholder(key, _match, options) {
+  const [envKey, ...rest] = key.split(":");
+  const defaultValue = rest.length > 0 ? rest.join(":") : void 0;
+  const envValue = process.env[envKey];
+  let value;
+  if (envValue !== void 0) {
+    value = envValue;
+  } else if (defaultValue !== void 0) {
+    value = defaultValue;
+  } else {
+    throw new Error(`Environment variable "${envKey}" is not defined and no default value provided`);
+  }
+  if (value.includes("${")) {
+    return replacePlaceholders(value, options);
+  }
+  return value;
+}
 function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -161,6 +229,129 @@ function stripEmpty(obj) {
 function isPlainObject4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+var VAULT_PLACEHOLDER_REGEX = /\${vault:([^:}]+):([^:}]+)(?::([^}]*))?}/g;
+async function createVaultClient(options) {
+  const vault = NodeVault__default.default({
+    endpoint: options.endpoint,
+    apiVersion: "v1",
+    namespace: options.namespace
+  });
+  const loginResult = await vault.approleLogin({
+    role_id: options.roleId,
+    secret_id: options.secretId
+  });
+  vault.token = loginResult.auth.client_token;
+  const cache = {};
+  return {
+    async fetchSecrets(obj) {
+      const paths = extractVaultPaths(obj);
+      await Promise.all(
+        paths.map(async (path) => {
+          if (!cache[path]) {
+            try {
+              const result = await vault.read(path);
+              cache[path] = result.data?.data ?? result.data ?? {};
+            } catch {
+              cache[path] = {};
+            }
+          }
+        })
+      );
+      return cache;
+    },
+    getSecret(path, field) {
+      return cache[path]?.[field];
+    }
+  };
+}
+function extractVaultPaths(obj) {
+  const paths = /* @__PURE__ */ new Set();
+  function traverse(value) {
+    if (typeof value === "string") {
+      let match;
+      while ((match = VAULT_PLACEHOLDER_REGEX.exec(value)) !== null) {
+        paths.add(match[1]);
+      }
+      VAULT_PLACEHOLDER_REGEX.lastIndex = 0;
+    } else if (Array.isArray(value)) {
+      value.forEach(traverse);
+    } else if (value !== null && typeof value === "object") {
+      Object.values(value).forEach(traverse);
+    }
+  }
+  traverse(obj);
+  return Array.from(paths);
+}
+var AWS_PLACEHOLDER_REGEX = /\${aws:([^:}]+)(?::([^:}]+))?(?::([^}]*))?}/g;
+async function createAwsSecretsClient(options) {
+  const client = new clientSecretsManager.SecretsManagerClient({
+    region: options.region,
+    credentials: {
+      accessKeyId: options.accessKeyId,
+      secretAccessKey: options.secretAccessKey
+    }
+  });
+  const cache = {};
+  return {
+    async fetchSecrets(obj) {
+      const secretNames = extractAwsSecretNames(obj);
+      await Promise.all(
+        secretNames.map(async (secretName) => {
+          if (cache[secretName] === void 0) {
+            try {
+              const command = new clientSecretsManager.GetSecretValueCommand({ SecretId: secretName });
+              const response = await client.send(command);
+              const secretString = response.SecretString;
+              if (secretString) {
+                try {
+                  cache[secretName] = JSON.parse(secretString);
+                } catch {
+                  cache[secretName] = secretString;
+                }
+              } else {
+                cache[secretName] = {};
+              }
+            } catch {
+              cache[secretName] = {};
+            }
+          }
+        })
+      );
+      return cache;
+    },
+    getSecret(secretName, field) {
+      const secret = cache[secretName];
+      if (secret === void 0) {
+        return void 0;
+      }
+      if (!field) {
+        return typeof secret === "string" ? secret : void 0;
+      }
+      if (typeof secret === "object" && secret !== null) {
+        return secret[field];
+      }
+      return void 0;
+    }
+  };
+}
+function extractAwsSecretNames(obj) {
+  const names = /* @__PURE__ */ new Set();
+  function traverse(value) {
+    if (typeof value === "string") {
+      let match;
+      while ((match = AWS_PLACEHOLDER_REGEX.exec(value)) !== null) {
+        names.add(match[1]);
+      }
+      AWS_PLACEHOLDER_REGEX.lastIndex = 0;
+    } else if (Array.isArray(value)) {
+      value.forEach(traverse);
+    } else if (value !== null && typeof value === "object") {
+      Object.values(value).forEach(traverse);
+    }
+  }
+  traverse(obj);
+  return Array.from(names);
+}
 
 // src/loader.ts
 var DEFAULT_OPTIONS = {
@@ -171,6 +362,9 @@ var DEFAULT_OPTIONS = {
   overrideDir: "/etc/app/config"
 };
 function loadConfig(options = {}) {
+  if (options.vault || options.aws) {
+    throw new Error("Vault/AWS options require async loading. Use loadConfigAsync() instead of loadConfig()");
+  }
   const opts = { ...DEFAULT_OPTIONS, ...options };
   const { configDir, baseFileName, environment, extension } = opts;
   if (options.dotenv) {
@@ -214,6 +408,60 @@ ${JSON.stringify(maskedConfig, null, 2)}`);
     configDir: resolvedConfigDir
   };
 }
+async function loadConfigAsync(options = {}) {
+  const opts = { ...DEFAULT_OPTIONS, ...options };
+  const { configDir, baseFileName, environment, extension } = opts;
+  if (options.dotenv) {
+    loadDotenv(options.dotenv, environment);
+  }
+  const resolvedConfigDir = resolveConfigDir(configDir);
+  const baseConfig = loadYamlFile(resolvedConfigDir, `${baseFileName}.${extension}`);
+  const envConfig = loadYamlFile(resolvedConfigDir, `${environment}.${extension}`);
+  let mergedConfig = deepMerge(baseConfig, envConfig);
+  const overrideDir = options.overrideDir !== false ? options.overrideDir ?? DEFAULT_OPTIONS.overrideDir : null;
+  if (overrideDir) {
+    const overrideConfigs = loadOverrideDir(overrideDir);
+    for (const override of overrideConfigs) {
+      mergedConfig = deepMerge(mergedConfig, override);
+    }
+  }
+  let vaultClient;
+  if (options.vault) {
+    vaultClient = await createVaultClient(options.vault);
+    await vaultClient.fetchSecrets(mergedConfig);
+  }
+  let awsClient;
+  if (options.aws) {
+    awsClient = await createAwsSecretsClient(options.aws);
+    await awsClient.fetchSecrets(mergedConfig);
+  }
+  let config2 = replacePlaceholders(mergedConfig, { vaultClient, awsClient });
+  if (options.stripEmpty) {
+    config2 = stripEmpty(config2);
+  }
+  if (options.postProcess) {
+    config2 = options.postProcess(config2);
+  }
+  if (options.schema) {
+    const result = options.schema.safeParse(config2);
+    if (!result.success) {
+      const errors = result.error.issues.map((e) => `  - ${e.path.join(".")}: ${e.message}`).join("\n");
+      throw new Error(`Config validation failed:
+${errors}`);
+    }
+    config2 = result.data;
+  }
+  if (options.logger) {
+    const maskedConfig = maskSecrets(config2);
+    options.logger(`Config loaded (${environment}):
+${JSON.stringify(maskedConfig, null, 2)}`);
+  }
+  return {
+    config: config2,
+    environment,
+    configDir: resolvedConfigDir
+  };
+}
 function loadDotenv(dotenvOption, environment) {
   let envPath;
   if (typeof dotenvOption === "object" && dotenvOption.path) {
@@ -256,8 +504,11 @@ function loadOverrideDir(dir) {
   return files.map((file) => loadYamlFile(dir, file));
 }
 
+exports.createAwsSecretsClient = createAwsSecretsClient;
+exports.createVaultClient = createVaultClient;
 exports.deepMerge = deepMerge;
 exports.loadConfig = loadConfig;
+exports.loadConfigAsync = loadConfigAsync;
 exports.maskSecrets = maskSecrets;
 exports.replacePlaceholders = replacePlaceholders;
 exports.stripEmpty = stripEmpty;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/utils/deep-merge.ts","../src/utils/env-replacer.ts","../src/utils/mask-secrets.ts","../src/utils/strip-empty.ts","../src/loader.ts"],"names":["isPlainObject","config","dotenv","join","path","existsSync","readFileSync","yaml","readdirSync"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEO,SAAS,SAAA,CAAU,MAAkB,QAAA,EAAkC;AAC5E,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,IAAA,EAAK;AAEzB,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,IAAA,MAAM,aAAA,GAAgB,SAAS,GAAG,CAAA;AAClC,IAAA,MAAM,SAAA,GAAY,KAAK,GAAG,CAAA;AAE1B,IAAA,IAAI,aAAA,CAAc,aAAa,CAAA,IAAK,aAAA,CAAc,SAAS,CAAA,EAAG;AAC5D,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,SAAA,CAAU,SAAA,EAAyB,aAA2B,CAAA;AAAA,IAC9E,CAAA,MAAO;AACL,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,aAAA;AAAA,IAChB;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,cAAc,KAAA,EAAqC;AAC1D,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;;;ACrBA,IAAM,qBAAA,GAAwB,YAAA;AAEvB,SAAS,oBAAoB,GAAA,EAAuB;AACzD,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,OAAO,0BAA0B,GAAG,CAAA;AAAA,EACtC;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,OAAO,IAAI,GAAA,CAAI,CAAC,IAAA,KAAS,mBAAA,CAAoB,IAAI,CAAC,CAAA;AAAA,EACpD;AAEA,EAAA,IAAIA,cAAAA,CAAc,GAAG,CAAA,EAAG;AACtB,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AAClC,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,mBAAA,CAAoB,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,IAC5C;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,0BAA0B,GAAA,EAAqB;AACtD,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,qBAAA,EAAuB,CAAC,OAAO,GAAA,KAAQ;AACxD,IAAA,MAAM,CAAC,MAAA,EAAQ,GAAG,IAAI,CAAA,GAAI,GAAA,CAAI,MAAM,GAAG,CAAA;AACvC,IAAA,MAAM,eAAe,IAAA,CAAK,MAAA,GAAS,IAAI,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AACxD,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA;AAEnC,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,KAAA,GAAQ,QAAA;AAAA,IACV,CAAA,MAAA,IAAW,iBAAiB,MAAA,EAAW;AACrC,MAAA,KAAA,GAAQ,YAAA;AAAA,IACV,CAAA,MAAO;AACL,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,IACjG;AAEA,IAAA,IAAI,KAAA,CAAM,QAAA,CAAS,IAAI,CAAA,EAAG;AACxB,MAAA,OAAO,oBAAoB,KAAK,CAAA;AAAA,IAClC;AAEA,IAAA,OAAO,KAAA;AAAA,EACT,CAAC,CAAA;AACH;AAEA,SAASA,eAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;;;AC/CA,IAAM,eAAA,GAAkB,CAAC,OAAA,EAAS,UAAA,EAAY,UAAU,KAAA,EAAO,QAAA,EAAU,WAAW,YAAY,CAAA;AAEhG,IAAM,0BAAA,GAA6B,sCAAA;AAE5B,SAAS,YAAY,GAAA,EAAuB;AACjD,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,OAAO,mBAAmB,GAAG,CAAA;AAAA,EAC/B;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,OAAO,IAAI,GAAA,CAAI,CAAC,IAAA,KAAS,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5C;AAEA,EAAA,IAAIA,cAAAA,CAAc,GAAG,CAAA,EAAG;AACtB,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AAClC,MAAA,MAAM,KAAA,GAAQ,IAAI,GAAG,CAAA;AACrB,MAAA,IAAI,WAAA,CAAY,GAAG,CAAA,EAAG;AACpB,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,SAAA,CAAU,KAAK,CAAA;AAAA,MAC/B,CAAA,MAAO;AACL,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,WAAA,CAAY,KAAK,CAAA;AAAA,MACjC;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,YAAY,GAAA,EAAsB;AACzC,EAAA,MAAM,QAAA,GAAW,IAAI,WAAA,EAAY;AACjC,EAAA,OAAO,gBAAgB,IAAA,CAAK,CAAC,YAAY,QAAA,CAAS,QAAA,CAAS,OAAO,CAAC,CAAA;AACrE;AAEA,SAAS,UAAU,KAAA,EAAwB;AACzC,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,KAAA,CAAM,UAAU,CAAA,EAAG;AACrB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA,CAAM,MAAM,CAAA,EAAG,CAAC,IAAI,KAAA,GAAQ,KAAA,CAAM,MAAM,EAAE,CAAA;AACnD;AAEA,SAAS,mBAAmB,GAAA,EAAqB;AAC/C,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,0BAA0B,CAAA;AAClD,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAM,GAAG,QAAA,EAAU,IAAA,IAAQ,IAAI,CAAA,GAAI,KAAA;AACnC,IAAA,OAAO,CAAA,EAAG,QAAQ,CAAA,EAAG,IAAI,QAAQ,IAAI,CAAA,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAASA,eAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;;;ACvDO,SAAS,WAAW,GAAA,EAAuB;AAChD,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,OAAO,GAAA,KAAQ,KAAK,MAAA,GAAY,GAAA;AAAA,EAClC;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,OAAO,GAAA,CAAI,GAAA,CAAI,CAAC,IAAA,KAAS,UAAA,CAAW,IAAI,CAAC,CAAA,CAAE,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,KAAS,MAAS,CAAA;AAAA,EAChF;AAEA,EAAA,IAAIA,cAAAA,CAAc,GAAG,CAAA,EAAG;AACtB,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,IAAI,SAAA,GAAY,KAAA;AAEhB,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AAClC,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,GAAG,CAAC,CAAA;AACjC,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AACd,QAAA,SAAA,GAAY,IAAA;AAAA,MACd;AAAA,IACF;AAEA,IAAA,OAAO,YAAY,MAAA,GAAS,MAAA;AAAA,EAC9B;AAEA,EAAA,OAAO,GAAA;AACT;AAEA,SAASA,eAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;;;ACtBA,IAAM,eAAA,GAAkB;AAAA,EACtB,SAAA,EAAW,QAAQ,GAAA,EAAI;AAAA,EACvB,YAAA,EAAc,MAAA;AAAA,EACd,WAAA,EAAa,OAAA,CAAQ,GAAA,CAAI,QAAA,IAAY,OAAA;AAAA,EACrC,SAAA,EAAW,KAAA;AAAA,EACX,WAAA,EAAa;AACf,CAAA;AAEO,SAAS,UAAA,CAAc,OAAA,GAAkC,EAAC,EAA0B;AACzF,EAAA,MAAM,IAAA,GAAO,EAAE,GAAG,eAAA,EAAiB,GAAG,OAAA,EAAQ;AAC9C,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,WAAA,EAAa,WAAU,GAAI,IAAA;AAG5D,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,UAAA,CAAW,OAAA,CAAQ,QAAQ,WAAW,CAAA;AAAA,EACxC;AAEA,EAAA,MAAM,iBAAA,GAAoB,iBAAiB,SAAS,CAAA;AAEpD,EAAA,MAAM,aAAa,YAAA,CAAa,iBAAA,EAAmB,GAAG,YAAY,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AACjF,EAAA,MAAM,YAAY,YAAA,CAAa,iBAAA,EAAmB,GAAG,WAAW,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AAE/E,EAAA,IAAI,YAAA,GAAe,SAAA,CAAU,UAAA,EAAY,SAAS,CAAA;AAGlD,EAAA,MAAM,cAAc,OAAA,CAAQ,WAAA,KAAgB,QAAS,OAAA,CAAQ,WAAA,IAAe,gBAAgB,WAAA,GAAe,IAAA;AAC3G,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,MAAM,eAAA,GAAkB,gBAAgB,WAAW,CAAA;AACnD,IAAA,KAAA,MAAW,YAAY,eAAA,EAAiB;AACtC,MAAA,YAAA,GAAe,SAAA,CAAU,cAAc,QAAQ,CAAA;AAAA,IACjD;AAAA,EACF;AAEA,EAAA,IAAIC,OAAAA,GAAS,oBAAoB,YAAY,CAAA;AAG7C,EAAA,IAAI,QAAQ,UAAA,EAAY;AACtB,IAAAA,OAAAA,GAAS,WAAWA,OAAM,CAAA;AAAA,EAC5B;AAGA,EAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,IAAAA,OAAAA,GAAS,OAAA,CAAQ,WAAA,CAAYA,OAAM,CAAA;AAAA,EACrC;AAGA,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,SAAA,CAAUA,OAAM,CAAA;AAC9C,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,SAAS,MAAA,CAAO,KAAA,CAAM,OACzB,GAAA,CAAI,CAAC,MAAM,CAAA,IAAA,EAAO,CAAA,CAAE,KAAK,IAAA,CAAK,GAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA,CAClD,KAAK,IAAI,CAAA;AACZ,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA;AAAA,EAA8B,MAAM,CAAA,CAAE,CAAA;AAAA,IACxD;AACA,IAAAA,UAAS,MAAA,CAAO,IAAA;AAAA,EAClB;AAGA,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,MAAM,YAAA,GAAe,YAAYA,OAAM,CAAA;AACvC,IAAA,OAAA,CAAQ,MAAA,CAAO,kBAAkB,WAAW,CAAA;AAAA,EAAO,KAAK,SAAA,CAAU,YAAA,EAAc,IAAA,EAAM,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC5F;AAEA,EAAA,OAAO;AAAA,IACL,MAAA,EAAAA,OAAAA;AAAA,IACA,WAAA;AAAA,IACA,SAAA,EAAW;AAAA,GACb;AACF;AAEA,SAAS,UAAA,CACP,cACA,WAAA,EACM;AACN,EAAA,IAAI,OAAA;AAEJ,EAAA,IAAI,OAAO,YAAA,KAAiB,QAAA,IAAY,YAAA,CAAa,IAAA,EAAM;AACzD,IAAA,OAAA,GAAU,YAAA,CAAa,IAAA;AAAA,EACzB,CAAA,MAAO;AACL,IAAA,OAAA,GAAU,WAAA,KAAgB,YAAA,GAAe,MAAA,GAAS,CAAA,KAAA,EAAQ,WAAW,CAAA,CAAA;AAAA,EACvE;AAEA,EAAOC,iBAAA,CAAA,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,CAAA;AACjC;AAEA,SAAS,iBAAiB,SAAA,EAA2B;AACnD,EAAA,MAAM,aAAA,GAAgB;AAAA,IACpBC,SAAA,CAAK,SAAA,EAAW,KAAA,EAAO,QAAQ,CAAA;AAAA,IAC/BA,SAAA,CAAK,SAAA,EAAW,MAAA,EAAQ,QAAQ,CAAA;AAAA,IAChCA,SAAA,CAAK,WAAW,QAAQ,CAAA;AAAA,IACxB;AAAA,GACF;AAEA,EAAA,KAAA,MAAWC,UAAQ,aAAA,EAAe;AAChC,IAAA,IAAIC,aAAA,CAAWF,SAAA,CAAKC,MAAA,EAAM,UAAU,CAAC,CAAA,IAAKC,aAAA,CAAWF,SAAA,CAAKC,MAAA,EAAM,WAAW,CAAC,CAAA,EAAG;AAC7E,MAAA,OAAOA,MAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA;AAAA,EAAyC,aAAA,CAAc,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,GAC1F;AACF;AAEA,SAAS,YAAA,CAAa,KAAa,QAAA,EAA2C;AAC5E,EAAA,MAAM,QAAA,GAAWD,SAAA,CAAK,GAAA,EAAK,QAAQ,CAAA;AAEnC,EAAA,IAAI,CAACE,aAAA,CAAW,QAAQ,CAAA,EAAG;AACzB,IAAA,OAAO,EAAC;AAAA,EACV;AAEA,EAAA,MAAM,OAAA,GAAUC,eAAA,CAAa,QAAA,EAAU,MAAM,CAAA;AAC7C,EAAA,OAAaC,eAAA,CAAA,IAAA,CAAK,OAAO,CAAA,IAAiC,EAAC;AAC7D;AAEA,SAAS,gBAAgB,GAAA,EAAwC;AAC/D,EAAA,IAAI,CAACF,aAAA,CAAW,GAAG,CAAA,EAAG;AACpB,IAAA,OAAO,EAAC;AAAA,EACV;AAEA,EAAA,MAAM,QAAQG,cAAA,CAAY,GAAG,CAAA,CAC1B,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,MAAM,KAAK,CAAA,CAAE,QAAA,CAAS,OAAO,CAAC,EACvD,IAAA,EAAK;AAER,EAAA,OAAO,MAAM,GAAA,CAAI,CAAC,SAAS,YAAA,CAAa,GAAA,EAAK,IAAI,CAAC,CAAA;AACpD","file":"index.js","sourcesContent":["type DeepObject = Record<string, unknown>;\n\nexport function deepMerge(base: DeepObject, override: DeepObject): DeepObject {\n  const merged = { ...base };\n\n  for (const key in override) {\n    const overrideValue = override[key];\n    const baseValue = base[key];\n\n    if (isPlainObject(overrideValue) && isPlainObject(baseValue)) {\n      merged[key] = deepMerge(baseValue as DeepObject, overrideValue as DeepObject);\n    } else {\n      merged[key] = overrideValue;\n    }\n  }\n\n  return merged;\n}\n\nfunction isPlainObject(value: unknown): value is DeepObject {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n","const ENV_PLACEHOLDER_REGEX = /\\${(.*?)}/g;\n\nexport function replacePlaceholders(obj: unknown): unknown {\n  if (typeof obj === 'string') {\n    return replaceStringPlaceholders(obj);\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) => replacePlaceholders(item));\n  }\n\n  if (isPlainObject(obj)) {\n    const result: Record<string, unknown> = {};\n    for (const key of Object.keys(obj)) {\n      result[key] = replacePlaceholders(obj[key]);\n    }\n    return result;\n  }\n\n  return obj;\n}\n\nfunction replaceStringPlaceholders(str: string): string {\n  return str.replace(ENV_PLACEHOLDER_REGEX, (match, key) => {\n    const [envKey, ...rest] = key.split(':');\n    const defaultValue = rest.length > 0 ? rest.join(':') : undefined;\n    const envValue = process.env[envKey];\n\n    let value: string;\n    if (envValue !== undefined) {\n      value = envValue;\n    } else if (defaultValue !== undefined) {\n      value = defaultValue;\n    } else {\n      throw new Error(`Environment variable \"${envKey}\" is not defined and no default value provided`);\n    }\n\n    if (value.includes('${')) {\n      return replacePlaceholders(value) as string;\n    }\n\n    return value;\n  });\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n","const SECRET_PATTERNS = ['token', 'password', 'secret', 'key', 'apikey', 'api_key', 'credential'];\n\nconst URL_WITH_CREDENTIALS_REGEX = /^([a-z]+:\\/\\/)([^:]+):([^@]+)@(.+)$/i;\n\nexport function maskSecrets(obj: unknown): unknown {\n  if (typeof obj === 'string') {\n    return maskUrlCredentials(obj);\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) => maskSecrets(item));\n  }\n\n  if (isPlainObject(obj)) {\n    const result: Record<string, unknown> = {};\n    for (const key of Object.keys(obj)) {\n      const value = obj[key];\n      if (isSecretKey(key)) {\n        result[key] = maskValue(value);\n      } else {\n        result[key] = maskSecrets(value);\n      }\n    }\n    return result;\n  }\n\n  return obj;\n}\n\nfunction isSecretKey(key: string): boolean {\n  const lowerKey = key.toLowerCase();\n  return SECRET_PATTERNS.some((pattern) => lowerKey.includes(pattern));\n}\n\nfunction maskValue(value: unknown): string {\n  if (typeof value !== 'string') {\n    return '***';\n  }\n  if (value.length <= 4) {\n    return '***';\n  }\n  return value.slice(0, 2) + '***' + value.slice(-2);\n}\n\nfunction maskUrlCredentials(url: string): string {\n  const match = url.match(URL_WITH_CREDENTIALS_REGEX);\n  if (match) {\n    const [, protocol, user, , host] = match;\n    return `${protocol}${user}:***@${host}`;\n  }\n  return url;\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n","export function stripEmpty(obj: unknown): unknown {\n  if (typeof obj === 'string') {\n    return obj === '' ? undefined : obj;\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) => stripEmpty(item)).filter((item) => item !== undefined);\n  }\n\n  if (isPlainObject(obj)) {\n    const result: Record<string, unknown> = {};\n    let hasValues = false;\n\n    for (const key of Object.keys(obj)) {\n      const value = stripEmpty(obj[key]);\n      if (value !== undefined) {\n        result[key] = value;\n        hasValues = true;\n      }\n    }\n\n    return hasValues ? result : undefined;\n  }\n\n  return obj;\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n","import { readFileSync, existsSync, readdirSync } from 'fs';\nimport * as yaml from 'js-yaml';\nimport * as dotenv from 'dotenv';\nimport { join } from 'path';\nimport type { ConfigLoaderOptions, ConfigLoaderResult } from './types.js';\nimport { deepMerge, replacePlaceholders, maskSecrets, stripEmpty } from './utils/index.js';\n\nconst DEFAULT_OPTIONS = {\n  configDir: process.cwd(),\n  baseFileName: 'base',\n  environment: process.env.NODE_ENV || 'local',\n  extension: 'yml' as const,\n  overrideDir: '/etc/app/config',\n};\n\nexport function loadConfig<T>(options: ConfigLoaderOptions<T> = {}): ConfigLoaderResult<T> {\n  const opts = { ...DEFAULT_OPTIONS, ...options };\n  const { configDir, baseFileName, environment, extension } = opts;\n\n  // Load .env if requested\n  if (options.dotenv) {\n    loadDotenv(options.dotenv, environment);\n  }\n\n  const resolvedConfigDir = resolveConfigDir(configDir);\n\n  const baseConfig = loadYamlFile(resolvedConfigDir, `${baseFileName}.${extension}`);\n  const envConfig = loadYamlFile(resolvedConfigDir, `${environment}.${extension}`);\n\n  let mergedConfig = deepMerge(baseConfig, envConfig);\n\n  // Load override files from directory\n  const overrideDir = options.overrideDir !== false ? (options.overrideDir ?? DEFAULT_OPTIONS.overrideDir) : null;\n  if (overrideDir) {\n    const overrideConfigs = loadOverrideDir(overrideDir);\n    for (const override of overrideConfigs) {\n      mergedConfig = deepMerge(mergedConfig, override);\n    }\n  }\n\n  let config = replacePlaceholders(mergedConfig) as T;\n\n  // Strip empty strings and objects\n  if (options.stripEmpty) {\n    config = stripEmpty(config) as T;\n  }\n\n  // Post-process\n  if (options.postProcess) {\n    config = options.postProcess(config);\n  }\n\n  // Validate with Zod schema\n  if (options.schema) {\n    const result = options.schema.safeParse(config);\n    if (!result.success) {\n      const errors = result.error.issues\n        .map((e) => `  - ${e.path.join('.')}: ${e.message}`)\n        .join('\\n');\n      throw new Error(`Config validation failed:\\n${errors}`);\n    }\n    config = result.data;\n  }\n\n  // Log config with masked secrets\n  if (options.logger) {\n    const maskedConfig = maskSecrets(config);\n    options.logger(`Config loaded (${environment}):\\n${JSON.stringify(maskedConfig, null, 2)}`);\n  }\n\n  return {\n    config,\n    environment,\n    configDir: resolvedConfigDir,\n  };\n}\n\nfunction loadDotenv(\n  dotenvOption: boolean | { path?: string },\n  environment: string,\n): void {\n  let envPath: string;\n\n  if (typeof dotenvOption === 'object' && dotenvOption.path) {\n    envPath = dotenvOption.path;\n  } else {\n    envPath = environment === 'production' ? '.env' : `.env.${environment}`;\n  }\n\n  dotenv.config({ path: envPath });\n}\n\nfunction resolveConfigDir(configDir: string): string {\n  const possiblePaths = [\n    join(configDir, 'src', 'config'),\n    join(configDir, 'dist', 'config'),\n    join(configDir, 'config'),\n    configDir,\n  ];\n\n  for (const path of possiblePaths) {\n    if (existsSync(join(path, 'base.yml')) || existsSync(join(path, 'base.yaml'))) {\n      return path;\n    }\n  }\n\n  throw new Error(\n    `Config files not found. Searched in:\\n${possiblePaths.map((p) => `  - ${p}`).join('\\n')}`,\n  );\n}\n\nfunction loadYamlFile(dir: string, filename: string): Record<string, unknown> {\n  const filePath = join(dir, filename);\n\n  if (!existsSync(filePath)) {\n    return {};\n  }\n\n  const content = readFileSync(filePath, 'utf8');\n  return (yaml.load(content) as Record<string, unknown>) || {};\n}\n\nfunction loadOverrideDir(dir: string): Record<string, unknown>[] {\n  if (!existsSync(dir)) {\n    return [];\n  }\n\n  const files = readdirSync(dir)\n    .filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'))\n    .sort();\n\n  return files.map((file) => loadYamlFile(dir, file));\n}\n"]}
+{"version":3,"sources":["../src/utils/deep-merge.ts","../src/utils/env-replacer.ts","../src/utils/mask-secrets.ts","../src/utils/strip-empty.ts","../src/utils/vault-client.ts","../src/utils/aws-secrets-client.ts","../src/loader.ts"],"names":["isPlainObject","NodeVault","SecretsManagerClient","GetSecretValueCommand","config","dotenv","join","path","existsSync","readFileSync","yaml","readdirSync"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEO,SAAS,SAAA,CAAU,MAAkB,QAAA,EAAkC;AAC5E,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,IAAA,EAAK;AAEzB,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,IAAA,MAAM,aAAA,GAAgB,SAAS,GAAG,CAAA;AAClC,IAAA,MAAM,SAAA,GAAY,KAAK,GAAG,CAAA;AAE1B,IAAA,IAAI,aAAA,CAAc,aAAa,CAAA,IAAK,aAAA,CAAc,SAAS,CAAA,EAAG;AAC5D,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,SAAA,CAAU,SAAA,EAAyB,aAA2B,CAAA;AAAA,IAC9E,CAAA,MAAO;AACL,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,aAAA;AAAA,IAChB;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,cAAc,KAAA,EAAqC;AAC1D,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;;;AClBA,IAAM,qBAAA,GAAwB,YAAA;AAC9B,IAAM,YAAA,GAAe,QAAA;AACrB,IAAM,UAAA,GAAa,MAAA;AAOZ,SAAS,mBAAA,CAAoB,GAAA,EAAc,OAAA,GAAsC,EAAC,EAAY;AACnG,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,OAAO,yBAAA,CAA0B,KAAK,OAAO,CAAA;AAAA,EAC/C;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,OAAO,IAAI,GAAA,CAAI,CAAC,SAAS,mBAAA,CAAoB,IAAA,EAAM,OAAO,CAAC,CAAA;AAAA,EAC7D;AAEA,EAAA,IAAIA,cAAAA,CAAc,GAAG,CAAA,EAAG;AACtB,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AAClC,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,mBAAA,CAAoB,GAAA,CAAI,GAAG,GAAG,OAAO,CAAA;AAAA,IACrD;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,yBAAA,CAA0B,KAAa,OAAA,EAA6C;AAC3F,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,qBAAA,EAAuB,CAAC,OAAO,GAAA,KAAQ;AAExD,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAChC,MAAA,OAAO,uBAAA,CAAwB,GAAA,EAAK,KAAA,EAAO,OAAO,CAAA;AAAA,IACpD;AAGA,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,UAAU,CAAA,EAAG;AAC9B,MAAA,OAAO,qBAAA,CAAsB,GAAA,EAAK,KAAA,EAAO,OAAO,CAAA;AAAA,IAClD;AAGA,IAAA,OAAO,qBAAA,CAAsB,GAAA,EAAK,KAAA,EAAO,OAAO,CAAA;AAAA,EAClD,CAAC,CAAA;AACH;AAEA,SAAS,uBAAA,CACP,GAAA,EACA,aAAA,EACA,OAAA,EACQ;AAER,EAAA,MAAM,QAAQ,GAAA,CAAI,SAAA,CAAU,aAAa,MAAM,CAAA,CAAE,MAAM,GAAG,CAAA;AAE1D,EAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,qCAAqC,aAAa,CAAA,gEAAA;AAAA,KAEpD;AAAA,EACF;AAEA,EAAA,MAAM,CAAC,IAAA,EAAM,KAAA,EAAO,GAAG,YAAY,CAAA,GAAI,KAAA;AACvC,EAAA,MAAM,eAAe,YAAA,CAAa,MAAA,GAAS,IAAI,YAAA,CAAa,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AAExE,EAAA,IAAI,CAAC,QAAQ,WAAA,EAAa;AACxB,IAAA,IAAI,iBAAiB,MAAA,EAAW;AAC9B,MAAA,OAAO,YAAA;AAAA,IACT;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,aAAa,CAAA,qCAAA,CAAuC,CAAA;AAAA,EAC5F;AAEA,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,WAAA,CAAY,SAAA,CAAU,MAAM,KAAK,CAAA;AAE7D,EAAA,IAAI,gBAAgB,MAAA,EAAW;AAC7B,IAAA,OAAO,OAAO,WAAW,CAAA;AAAA,EAC3B;AAEA,EAAA,IAAI,iBAAiB,MAAA,EAAW;AAC9B,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,cAAA,EAAiB,KAAK,CAAA,qBAAA,EAAwB,IAAI,CAAA,+BAAA,CAAiC,CAAA;AACrG;AAEA,SAAS,qBAAA,CACP,GAAA,EACA,aAAA,EACA,OAAA,EACQ;AAER,EAAA,MAAM,QAAQ,GAAA,CAAI,SAAA,CAAU,WAAW,MAAM,CAAA,CAAE,MAAM,GAAG,CAAA;AAExD,EAAA,IAAI,MAAM,MAAA,GAAS,CAAA,IAAK,CAAC,KAAA,CAAM,CAAC,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,mCAAmC,aAAa,CAAA,iGAAA;AAAA,KAElD;AAAA,EACF;AAEA,EAAA,MAAM,CAAC,UAAA,EAAY,KAAA,EAAO,GAAG,YAAY,CAAA,GAAI,KAAA;AAC7C,EAAA,MAAM,eAAe,YAAA,CAAa,MAAA,GAAS,IAAI,YAAA,CAAa,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AAExE,EAAA,IAAI,CAAC,QAAQ,SAAA,EAAW;AACtB,IAAA,IAAI,iBAAiB,MAAA,EAAW;AAC9B,MAAA,OAAO,YAAA;AAAA,IACT;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,aAAa,CAAA,mCAAA,CAAqC,CAAA;AAAA,EACxF;AAEA,EAAA,MAAM,cAAc,OAAA,CAAQ,SAAA,CAAU,SAAA,CAAU,UAAA,EAAY,SAAS,MAAS,CAAA;AAE9E,EAAA,IAAI,gBAAgB,MAAA,EAAW;AAC7B,IAAA,OAAO,OAAO,WAAW,CAAA;AAAA,EAC3B;AAEA,EAAA,IAAI,iBAAiB,MAAA,EAAW;AAC9B,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,KAAK,CAAA,gBAAA,EAAmB,UAAU,CAAA,+BAAA,CAAiC,CAAA;AAAA,EAC1G,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,YAAA,EAAe,UAAU,CAAA,yCAAA,CAA2C,CAAA;AAAA,EACtF;AACF;AAEA,SAAS,qBAAA,CAAsB,GAAA,EAAa,MAAA,EAAgB,OAAA,EAA6C;AACvG,EAAA,MAAM,CAAC,MAAA,EAAQ,GAAG,IAAI,CAAA,GAAI,GAAA,CAAI,MAAM,GAAG,CAAA;AACvC,EAAA,MAAM,eAAe,IAAA,CAAK,MAAA,GAAS,IAAI,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AACxD,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA;AAEnC,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,IAAA,KAAA,GAAQ,QAAA;AAAA,EACV,CAAA,MAAA,IAAW,iBAAiB,MAAA,EAAW;AACrC,IAAA,KAAA,GAAQ,YAAA;AAAA,EACV,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,EACjG;AAGA,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,IAAI,CAAA,EAAG;AACxB,IAAA,OAAO,mBAAA,CAAoB,OAAO,OAAO,CAAA;AAAA,EAC3C;AAEA,EAAA,OAAO,KAAA;AACT;AAEA,SAASA,eAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;;;ACzJA,IAAM,eAAA,GAAkB,CAAC,OAAA,EAAS,UAAA,EAAY,UAAU,KAAA,EAAO,QAAA,EAAU,WAAW,YAAY,CAAA;AAEhG,IAAM,0BAAA,GAA6B,sCAAA;AAE5B,SAAS,YAAY,GAAA,EAAuB;AACjD,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,OAAO,mBAAmB,GAAG,CAAA;AAAA,EAC/B;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,OAAO,IAAI,GAAA,CAAI,CAAC,IAAA,KAAS,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5C;AAEA,EAAA,IAAIA,cAAAA,CAAc,GAAG,CAAA,EAAG;AACtB,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AAClC,MAAA,MAAM,KAAA,GAAQ,IAAI,GAAG,CAAA;AACrB,MAAA,IAAI,WAAA,CAAY,GAAG,CAAA,EAAG;AACpB,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,SAAA,CAAU,KAAK,CAAA;AAAA,MAC/B,CAAA,MAAO;AACL,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,WAAA,CAAY,KAAK,CAAA;AAAA,MACjC;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,YAAY,GAAA,EAAsB;AACzC,EAAA,MAAM,QAAA,GAAW,IAAI,WAAA,EAAY;AACjC,EAAA,OAAO,gBAAgB,IAAA,CAAK,CAAC,YAAY,QAAA,CAAS,QAAA,CAAS,OAAO,CAAC,CAAA;AACrE;AAEA,SAAS,UAAU,KAAA,EAAwB;AACzC,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,KAAA,CAAM,UAAU,CAAA,EAAG;AACrB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA,CAAM,MAAM,CAAA,EAAG,CAAC,IAAI,KAAA,GAAQ,KAAA,CAAM,MAAM,EAAE,CAAA;AACnD;AAEA,SAAS,mBAAmB,GAAA,EAAqB;AAC/C,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,0BAA0B,CAAA;AAClD,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAM,GAAG,QAAA,EAAU,IAAA,IAAQ,IAAI,CAAA,GAAI,KAAA;AACnC,IAAA,OAAO,CAAA,EAAG,QAAQ,CAAA,EAAG,IAAI,QAAQ,IAAI,CAAA,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAASA,eAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;;;ACvDO,SAAS,WAAW,GAAA,EAAuB;AAChD,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,OAAO,GAAA,KAAQ,KAAK,MAAA,GAAY,GAAA;AAAA,EAClC;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,OAAO,GAAA,CAAI,GAAA,CAAI,CAAC,IAAA,KAAS,UAAA,CAAW,IAAI,CAAC,CAAA,CAAE,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,KAAS,MAAS,CAAA;AAAA,EAChF;AAEA,EAAA,IAAIA,cAAAA,CAAc,GAAG,CAAA,EAAG;AACtB,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,IAAI,SAAA,GAAY,KAAA;AAEhB,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AAClC,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,GAAG,CAAC,CAAA;AACjC,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AACd,QAAA,SAAA,GAAY,IAAA;AAAA,MACd;AAAA,IACF;AAEA,IAAA,OAAO,YAAY,MAAA,GAAS,MAAA;AAAA,EAC9B;AAEA,EAAA,OAAO,GAAA;AACT;AAEA,SAASA,eAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AC1BA,IAAM,uBAAA,GAA0B,2CAAA;AAWhC,eAAsB,kBAAkB,OAAA,EAA6C;AACnF,EAAA,MAAM,QAAQC,0BAAA,CAAU;AAAA,IACtB,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,UAAA,EAAY,IAAA;AAAA,IACZ,WAAW,OAAA,CAAQ;AAAA,GACpB,CAAA;AAGD,EAAA,MAAM,WAAA,GAAc,MAAM,KAAA,CAAM,YAAA,CAAa;AAAA,IAC3C,SAAS,OAAA,CAAQ,MAAA;AAAA,IACjB,WAAW,OAAA,CAAQ;AAAA,GACpB,CAAA;AAED,EAAA,KAAA,CAAM,KAAA,GAAQ,YAAY,IAAA,CAAK,YAAA;AAE/B,EAAA,MAAM,QAA0B,EAAC;AAEjC,EAAA,OAAO;AAAA,IACL,MAAM,aAAa,GAAA,EAAyC;AAC1D,MAAA,MAAM,KAAA,GAAQ,kBAAkB,GAAG,CAAA;AAGnC,MAAA,MAAM,OAAA,CAAQ,GAAA;AAAA,QACZ,KAAA,CAAM,GAAA,CAAI,OAAO,IAAA,KAAS;AACxB,UAAA,IAAI,CAAC,KAAA,CAAM,IAAI,CAAA,EAAG;AAChB,YAAA,IAAI;AACF,cAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAGpC,cAAA,KAAA,CAAM,IAAI,CAAA,GAAI,MAAA,CAAO,MAAM,IAAA,IAAQ,MAAA,CAAO,QAAQ,EAAC;AAAA,YACrD,CAAA,CAAA,MAAQ;AAEN,cAAA,KAAA,CAAM,IAAI,IAAI,EAAC;AAAA,YACjB;AAAA,UACF;AAAA,QACF,CAAC;AAAA,OACH;AAEA,MAAA,OAAO,KAAA;AAAA,IACT,CAAA;AAAA,IAEA,SAAA,CAAU,MAAc,KAAA,EAAwB;AAC9C,MAAA,OAAO,KAAA,CAAM,IAAI,CAAA,GAAI,KAAK,CAAA;AAAA,IAC5B;AAAA,GACF;AACF;AAKA,SAAS,kBAAkB,GAAA,EAAwB;AACjD,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAE9B,EAAA,SAAS,SAAS,KAAA,EAAsB;AACtC,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,MAAA,IAAI,KAAA;AACJ,MAAA,OAAA,CAAQ,KAAA,GAAQ,uBAAA,CAAwB,IAAA,CAAK,KAAK,OAAO,IAAA,EAAM;AAC7D,QAAA,KAAA,CAAM,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,MACpB;AACA,MAAA,uBAAA,CAAwB,SAAA,GAAY,CAAA;AAAA,IACtC,CAAA,MAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC/B,MAAA,KAAA,CAAM,QAAQ,QAAQ,CAAA;AAAA,IACxB,CAAA,MAAA,IAAW,KAAA,KAAU,IAAA,IAAQ,OAAO,UAAU,QAAA,EAAU;AACtD,MAAA,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,CAAE,OAAA,CAAQ,QAAQ,CAAA;AAAA,IACvC;AAAA,EACF;AAEA,EAAA,QAAA,CAAS,GAAG,CAAA;AACZ,EAAA,OAAO,KAAA,CAAM,KAAK,KAAK,CAAA;AACzB;AChFA,IAAM,qBAAA,GAAwB,8CAAA;AAW9B,eAAsB,uBAAuB,OAAA,EAAuD;AAClG,EAAA,MAAM,MAAA,GAAS,IAAIC,yCAAA,CAAqB;AAAA,IACtC,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,WAAA,EAAa;AAAA,MACX,aAAa,OAAA,CAAQ,WAAA;AAAA,MACrB,iBAAiB,OAAA,CAAQ;AAAA;AAC3B,GACD,CAAA;AAED,EAAA,MAAM,QAAyB,EAAC;AAEhC,EAAA,OAAO;AAAA,IACL,MAAM,aAAa,GAAA,EAAwC;AACzD,MAAA,MAAM,WAAA,GAAc,sBAAsB,GAAG,CAAA;AAG7C,MAAA,MAAM,OAAA,CAAQ,GAAA;AAAA,QACZ,WAAA,CAAY,GAAA,CAAI,OAAO,UAAA,KAAe;AACpC,UAAA,IAAI,KAAA,CAAM,UAAU,CAAA,KAAM,MAAA,EAAW;AACnC,YAAA,IAAI;AACF,cAAA,MAAM,UAAU,IAAIC,0CAAA,CAAsB,EAAE,QAAA,EAAU,YAAY,CAAA;AAClE,cAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA;AAE1C,cAAA,MAAM,eAAe,QAAA,CAAS,YAAA;AAC9B,cAAA,IAAI,YAAA,EAAc;AAEhB,gBAAA,IAAI;AACF,kBAAA,KAAA,CAAM,UAAU,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,YAAY,CAAA;AAAA,gBAC7C,CAAA,CAAA,MAAQ;AACN,kBAAA,KAAA,CAAM,UAAU,CAAA,GAAI,YAAA;AAAA,gBACtB;AAAA,cACF,CAAA,MAAO;AACL,gBAAA,KAAA,CAAM,UAAU,IAAI,EAAC;AAAA,cACvB;AAAA,YACF,CAAA,CAAA,MAAQ;AAEN,cAAA,KAAA,CAAM,UAAU,IAAI,EAAC;AAAA,YACvB;AAAA,UACF;AAAA,QACF,CAAC;AAAA,OACH;AAEA,MAAA,OAAO,KAAA;AAAA,IACT,CAAA;AAAA,IAEA,SAAA,CAAU,YAAoB,KAAA,EAAyB;AACrD,MAAA,MAAM,MAAA,GAAS,MAAM,UAAU,CAAA;AAE/B,MAAA,IAAI,WAAW,MAAA,EAAW;AACxB,QAAA,OAAO,MAAA;AAAA,MACT;AAGA,MAAA,IAAI,CAAC,KAAA,EAAO;AACV,QAAA,OAAO,OAAO,MAAA,KAAW,QAAA,GAAW,MAAA,GAAS,MAAA;AAAA,MAC/C;AAGA,MAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,IAAA,EAAM;AACjD,QAAA,OAAQ,OAAmC,KAAK,CAAA;AAAA,MAClD;AAEA,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,GACF;AACF;AAKA,SAAS,sBAAsB,GAAA,EAAwB;AACrD,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAE9B,EAAA,SAAS,SAAS,KAAA,EAAsB;AACtC,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,MAAA,IAAI,KAAA;AACJ,MAAA,OAAA,CAAQ,KAAA,GAAQ,qBAAA,CAAsB,IAAA,CAAK,KAAK,OAAO,IAAA,EAAM;AAC3D,QAAA,KAAA,CAAM,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,MACpB;AACA,MAAA,qBAAA,CAAsB,SAAA,GAAY,CAAA;AAAA,IACpC,CAAA,MAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC/B,MAAA,KAAA,CAAM,QAAQ,QAAQ,CAAA;AAAA,IACxB,CAAA,MAAA,IAAW,KAAA,KAAU,IAAA,IAAQ,OAAO,UAAU,QAAA,EAAU;AACtD,MAAA,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,CAAE,OAAA,CAAQ,QAAQ,CAAA;AAAA,IACvC;AAAA,EACF;AAEA,EAAA,QAAA,CAAS,GAAG,CAAA;AACZ,EAAA,OAAO,KAAA,CAAM,KAAK,KAAK,CAAA;AACzB;;;ACvFA,IAAM,eAAA,GAAkB;AAAA,EACtB,SAAA,EAAW,QAAQ,GAAA,EAAI;AAAA,EACvB,YAAA,EAAc,MAAA;AAAA,EACd,WAAA,EAAa,OAAA,CAAQ,GAAA,CAAI,QAAA,IAAY,OAAA;AAAA,EACrC,SAAA,EAAW,KAAA;AAAA,EACX,WAAA,EAAa;AACf,CAAA;AAEO,SAAS,UAAA,CAAc,OAAA,GAAkC,EAAC,EAA0B;AACzF,EAAA,IAAI,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,GAAA,EAAK;AAChC,IAAA,MAAM,IAAI,MAAM,wFAAwF,CAAA;AAAA,EAC1G;AAEA,EAAA,MAAM,IAAA,GAAO,EAAE,GAAG,eAAA,EAAiB,GAAG,OAAA,EAAQ;AAC9C,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,WAAA,EAAa,WAAU,GAAI,IAAA;AAG5D,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,UAAA,CAAW,OAAA,CAAQ,QAAQ,WAAW,CAAA;AAAA,EACxC;AAEA,EAAA,MAAM,iBAAA,GAAoB,iBAAiB,SAAS,CAAA;AAEpD,EAAA,MAAM,aAAa,YAAA,CAAa,iBAAA,EAAmB,GAAG,YAAY,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AACjF,EAAA,MAAM,YAAY,YAAA,CAAa,iBAAA,EAAmB,GAAG,WAAW,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AAE/E,EAAA,IAAI,YAAA,GAAe,SAAA,CAAU,UAAA,EAAY,SAAS,CAAA;AAGlD,EAAA,MAAM,cAAc,OAAA,CAAQ,WAAA,KAAgB,QAAS,OAAA,CAAQ,WAAA,IAAe,gBAAgB,WAAA,GAAe,IAAA;AAC3G,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,MAAM,eAAA,GAAkB,gBAAgB,WAAW,CAAA;AACnD,IAAA,KAAA,MAAW,YAAY,eAAA,EAAiB;AACtC,MAAA,YAAA,GAAe,SAAA,CAAU,cAAc,QAAQ,CAAA;AAAA,IACjD;AAAA,EACF;AAEA,EAAA,IAAIC,OAAAA,GAAS,oBAAoB,YAAY,CAAA;AAG7C,EAAA,IAAI,QAAQ,UAAA,EAAY;AACtB,IAAAA,OAAAA,GAAS,WAAWA,OAAM,CAAA;AAAA,EAC5B;AAGA,EAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,IAAAA,OAAAA,GAAS,OAAA,CAAQ,WAAA,CAAYA,OAAM,CAAA;AAAA,EACrC;AAGA,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,SAAA,CAAUA,OAAM,CAAA;AAC9C,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,SAAS,MAAA,CAAO,KAAA,CAAM,OACzB,GAAA,CAAI,CAAC,MAAM,CAAA,IAAA,EAAO,CAAA,CAAE,KAAK,IAAA,CAAK,GAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA,CAClD,KAAK,IAAI,CAAA;AACZ,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA;AAAA,EAA8B,MAAM,CAAA,CAAE,CAAA;AAAA,IACxD;AACA,IAAAA,UAAS,MAAA,CAAO,IAAA;AAAA,EAClB;AAGA,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,MAAM,YAAA,GAAe,YAAYA,OAAM,CAAA;AACvC,IAAA,OAAA,CAAQ,MAAA,CAAO,kBAAkB,WAAW,CAAA;AAAA,EAAO,KAAK,SAAA,CAAU,YAAA,EAAc,IAAA,EAAM,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC5F;AAEA,EAAA,OAAO;AAAA,IACL,MAAA,EAAAA,OAAAA;AAAA,IACA,WAAA;AAAA,IACA,SAAA,EAAW;AAAA,GACb;AACF;AAEA,eAAsB,eAAA,CACpB,OAAA,GAAkC,EAAC,EACH;AAChC,EAAA,MAAM,IAAA,GAAO,EAAE,GAAG,eAAA,EAAiB,GAAG,OAAA,EAAQ;AAC9C,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,WAAA,EAAa,WAAU,GAAI,IAAA;AAG5D,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,UAAA,CAAW,OAAA,CAAQ,QAAQ,WAAW,CAAA;AAAA,EACxC;AAEA,EAAA,MAAM,iBAAA,GAAoB,iBAAiB,SAAS,CAAA;AAEpD,EAAA,MAAM,aAAa,YAAA,CAAa,iBAAA,EAAmB,GAAG,YAAY,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AACjF,EAAA,MAAM,YAAY,YAAA,CAAa,iBAAA,EAAmB,GAAG,WAAW,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AAE/E,EAAA,IAAI,YAAA,GAAe,SAAA,CAAU,UAAA,EAAY,SAAS,CAAA;AAGlD,EAAA,MAAM,cAAc,OAAA,CAAQ,WAAA,KAAgB,QAAS,OAAA,CAAQ,WAAA,IAAe,gBAAgB,WAAA,GAAe,IAAA;AAC3G,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,MAAM,eAAA,GAAkB,gBAAgB,WAAW,CAAA;AACnD,IAAA,KAAA,MAAW,YAAY,eAAA,EAAiB;AACtC,MAAA,YAAA,GAAe,SAAA,CAAU,cAAc,QAAQ,CAAA;AAAA,IACjD;AAAA,EACF;AAGA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,WAAA,GAAc,MAAM,iBAAA,CAAkB,OAAA,CAAQ,KAAK,CAAA;AACnD,IAAA,MAAM,WAAA,CAAY,aAAa,YAAY,CAAA;AAAA,EAC7C;AAGA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,QAAQ,GAAA,EAAK;AACf,IAAA,SAAA,GAAY,MAAM,sBAAA,CAAuB,OAAA,CAAQ,GAAG,CAAA;AACpD,IAAA,MAAM,SAAA,CAAU,aAAa,YAAY,CAAA;AAAA,EAC3C;AAGA,EAAA,IAAIA,UAAS,mBAAA,CAAoB,YAAA,EAAc,EAAE,WAAA,EAAa,WAAW,CAAA;AAGzE,EAAA,IAAI,QAAQ,UAAA,EAAY;AACtB,IAAAA,OAAAA,GAAS,WAAWA,OAAM,CAAA;AAAA,EAC5B;AAGA,EAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,IAAAA,OAAAA,GAAS,OAAA,CAAQ,WAAA,CAAYA,OAAM,CAAA;AAAA,EACrC;AAGA,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,SAAA,CAAUA,OAAM,CAAA;AAC9C,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,SAAS,MAAA,CAAO,KAAA,CAAM,OACzB,GAAA,CAAI,CAAC,MAAM,CAAA,IAAA,EAAO,CAAA,CAAE,KAAK,IAAA,CAAK,GAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA,CAClD,KAAK,IAAI,CAAA;AACZ,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA;AAAA,EAA8B,MAAM,CAAA,CAAE,CAAA;AAAA,IACxD;AACA,IAAAA,UAAS,MAAA,CAAO,IAAA;AAAA,EAClB;AAGA,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,MAAM,YAAA,GAAe,YAAYA,OAAM,CAAA;AACvC,IAAA,OAAA,CAAQ,MAAA,CAAO,kBAAkB,WAAW,CAAA;AAAA,EAAO,KAAK,SAAA,CAAU,YAAA,EAAc,IAAA,EAAM,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC5F;AAEA,EAAA,OAAO;AAAA,IACL,MAAA,EAAAA,OAAAA;AAAA,IACA,WAAA;AAAA,IACA,SAAA,EAAW;AAAA,GACb;AACF;AAEA,SAAS,UAAA,CACP,cACA,WAAA,EACM;AACN,EAAA,IAAI,OAAA;AAEJ,EAAA,IAAI,OAAO,YAAA,KAAiB,QAAA,IAAY,YAAA,CAAa,IAAA,EAAM;AACzD,IAAA,OAAA,GAAU,YAAA,CAAa,IAAA;AAAA,EACzB,CAAA,MAAO;AACL,IAAA,OAAA,GAAU,WAAA,KAAgB,YAAA,GAAe,MAAA,GAAS,CAAA,KAAA,EAAQ,WAAW,CAAA,CAAA;AAAA,EACvE;AAEA,EAAOC,iBAAA,CAAA,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,CAAA;AACjC;AAEA,SAAS,iBAAiB,SAAA,EAA2B;AACnD,EAAA,MAAM,aAAA,GAAgB;AAAA,IACpBC,SAAA,CAAK,SAAA,EAAW,KAAA,EAAO,QAAQ,CAAA;AAAA,IAC/BA,SAAA,CAAK,SAAA,EAAW,MAAA,EAAQ,QAAQ,CAAA;AAAA,IAChCA,SAAA,CAAK,WAAW,QAAQ,CAAA;AAAA,IACxB;AAAA,GACF;AAEA,EAAA,KAAA,MAAWC,UAAQ,aAAA,EAAe;AAChC,IAAA,IAAIC,aAAA,CAAWF,SAAA,CAAKC,MAAA,EAAM,UAAU,CAAC,CAAA,IAAKC,aAAA,CAAWF,SAAA,CAAKC,MAAA,EAAM,WAAW,CAAC,CAAA,EAAG;AAC7E,MAAA,OAAOA,MAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA;AAAA,EAAyC,aAAA,CAAc,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,GAC1F;AACF;AAEA,SAAS,YAAA,CAAa,KAAa,QAAA,EAA2C;AAC5E,EAAA,MAAM,QAAA,GAAWD,SAAA,CAAK,GAAA,EAAK,QAAQ,CAAA;AAEnC,EAAA,IAAI,CAACE,aAAA,CAAW,QAAQ,CAAA,EAAG;AACzB,IAAA,OAAO,EAAC;AAAA,EACV;AAEA,EAAA,MAAM,OAAA,GAAUC,eAAA,CAAa,QAAA,EAAU,MAAM,CAAA;AAC7C,EAAA,OAAaC,eAAA,CAAA,IAAA,CAAK,OAAO,CAAA,IAAiC,EAAC;AAC7D;AAEA,SAAS,gBAAgB,GAAA,EAAwC;AAC/D,EAAA,IAAI,CAACF,aAAA,CAAW,GAAG,CAAA,EAAG;AACpB,IAAA,OAAO,EAAC;AAAA,EACV;AAEA,EAAA,MAAM,QAAQG,cAAA,CAAY,GAAG,CAAA,CAC1B,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,MAAM,KAAK,CAAA,CAAE,QAAA,CAAS,OAAO,CAAC,EACvD,IAAA,EAAK;AAER,EAAA,OAAO,MAAM,GAAA,CAAI,CAAC,SAAS,YAAA,CAAa,GAAA,EAAK,IAAI,CAAC,CAAA;AACpD","file":"index.js","sourcesContent":["type DeepObject = Record<string, unknown>;\n\nexport function deepMerge(base: DeepObject, override: DeepObject): DeepObject {\n  const merged = { ...base };\n\n  for (const key in override) {\n    const overrideValue = override[key];\n    const baseValue = base[key];\n\n    if (isPlainObject(overrideValue) && isPlainObject(baseValue)) {\n      merged[key] = deepMerge(baseValue as DeepObject, overrideValue as DeepObject);\n    } else {\n      merged[key] = overrideValue;\n    }\n  }\n\n  return merged;\n}\n\nfunction isPlainObject(value: unknown): value is DeepObject {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n","import type { VaultClient } from './vault-client.js';\nimport type { AwsSecretsClient } from './aws-secrets-client.js';\n\nconst ENV_PLACEHOLDER_REGEX = /\\${(.*?)}/g;\nconst VAULT_PREFIX = 'vault:';\nconst AWS_PREFIX = 'aws:';\n\nexport interface ReplacePlaceholdersOptions {\n  vaultClient?: VaultClient;\n  awsClient?: AwsSecretsClient;\n}\n\nexport function replacePlaceholders(obj: unknown, options: ReplacePlaceholdersOptions = {}): unknown {\n  if (typeof obj === 'string') {\n    return replaceStringPlaceholders(obj, options);\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) => replacePlaceholders(item, options));\n  }\n\n  if (isPlainObject(obj)) {\n    const result: Record<string, unknown> = {};\n    for (const key of Object.keys(obj)) {\n      result[key] = replacePlaceholders(obj[key], options);\n    }\n    return result;\n  }\n\n  return obj;\n}\n\nfunction replaceStringPlaceholders(str: string, options: ReplacePlaceholdersOptions): string {\n  return str.replace(ENV_PLACEHOLDER_REGEX, (match, key) => {\n    // Handle Vault placeholders: ${vault:path:field} or ${vault:path:field:default}\n    if (key.startsWith(VAULT_PREFIX)) {\n      return resolveVaultPlaceholder(key, match, options);\n    }\n\n    // Handle AWS placeholders: ${aws:secret:field} or ${aws:secret:field:default} or ${aws:secret}\n    if (key.startsWith(AWS_PREFIX)) {\n      return resolveAwsPlaceholder(key, match, options);\n    }\n\n    // Handle environment variable placeholders: ${VAR} or ${VAR:default}\n    return resolveEnvPlaceholder(key, match, options);\n  });\n}\n\nfunction resolveVaultPlaceholder(\n  key: string,\n  originalMatch: string,\n  options: ReplacePlaceholdersOptions,\n): string {\n  // Parse: vault:secret/data/api:DB_PASSWORD:default_value\n  const parts = key.substring(VAULT_PREFIX.length).split(':');\n\n  if (parts.length < 2) {\n    throw new Error(\n      `Invalid Vault placeholder format \"${originalMatch}\". ` +\n        `Expected \\${vault:path:field} or \\${vault:path:field:default}`,\n    );\n  }\n\n  const [path, field, ...defaultParts] = parts;\n  const defaultValue = defaultParts.length > 0 ? defaultParts.join(':') : undefined;\n\n  if (!options.vaultClient) {\n    if (defaultValue !== undefined) {\n      return defaultValue;\n    }\n    throw new Error(`Vault placeholder \"${originalMatch}\" found but no Vault options provided`);\n  }\n\n  const secretValue = options.vaultClient.getSecret(path, field);\n\n  if (secretValue !== undefined) {\n    return String(secretValue);\n  }\n\n  if (defaultValue !== undefined) {\n    return defaultValue;\n  }\n\n  throw new Error(`Vault secret \"${field}\" not found at path \"${path}\" and no default value provided`);\n}\n\nfunction resolveAwsPlaceholder(\n  key: string,\n  originalMatch: string,\n  options: ReplacePlaceholdersOptions,\n): string {\n  // Parse: aws:secret-name:field:default or aws:secret-name:field or aws:secret-name\n  const parts = key.substring(AWS_PREFIX.length).split(':');\n\n  if (parts.length < 1 || !parts[0]) {\n    throw new Error(\n      `Invalid AWS placeholder format \"${originalMatch}\". ` +\n        `Expected \\${aws:secret-name} or \\${aws:secret-name:field} or \\${aws:secret-name:field:default}`,\n    );\n  }\n\n  const [secretName, field, ...defaultParts] = parts;\n  const defaultValue = defaultParts.length > 0 ? defaultParts.join(':') : undefined;\n\n  if (!options.awsClient) {\n    if (defaultValue !== undefined) {\n      return defaultValue;\n    }\n    throw new Error(`AWS placeholder \"${originalMatch}\" found but no AWS options provided`);\n  }\n\n  const secretValue = options.awsClient.getSecret(secretName, field || undefined);\n\n  if (secretValue !== undefined) {\n    return String(secretValue);\n  }\n\n  if (defaultValue !== undefined) {\n    return defaultValue;\n  }\n\n  if (field) {\n    throw new Error(`AWS secret field \"${field}\" not found in \"${secretName}\" and no default value provided`);\n  } else {\n    throw new Error(`AWS secret \"${secretName}\" not found and no default value provided`);\n  }\n}\n\nfunction resolveEnvPlaceholder(key: string, _match: string, options: ReplacePlaceholdersOptions): string {\n  const [envKey, ...rest] = key.split(':');\n  const defaultValue = rest.length > 0 ? rest.join(':') : undefined;\n  const envValue = process.env[envKey];\n\n  let value: string;\n  if (envValue !== undefined) {\n    value = envValue;\n  } else if (defaultValue !== undefined) {\n    value = defaultValue;\n  } else {\n    throw new Error(`Environment variable \"${envKey}\" is not defined and no default value provided`);\n  }\n\n  // Handle nested placeholders\n  if (value.includes('${')) {\n    return replacePlaceholders(value, options) as string;\n  }\n\n  return value;\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n","const SECRET_PATTERNS = ['token', 'password', 'secret', 'key', 'apikey', 'api_key', 'credential'];\n\nconst URL_WITH_CREDENTIALS_REGEX = /^([a-z]+:\\/\\/)([^:]+):([^@]+)@(.+)$/i;\n\nexport function maskSecrets(obj: unknown): unknown {\n  if (typeof obj === 'string') {\n    return maskUrlCredentials(obj);\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) => maskSecrets(item));\n  }\n\n  if (isPlainObject(obj)) {\n    const result: Record<string, unknown> = {};\n    for (const key of Object.keys(obj)) {\n      const value = obj[key];\n      if (isSecretKey(key)) {\n        result[key] = maskValue(value);\n      } else {\n        result[key] = maskSecrets(value);\n      }\n    }\n    return result;\n  }\n\n  return obj;\n}\n\nfunction isSecretKey(key: string): boolean {\n  const lowerKey = key.toLowerCase();\n  return SECRET_PATTERNS.some((pattern) => lowerKey.includes(pattern));\n}\n\nfunction maskValue(value: unknown): string {\n  if (typeof value !== 'string') {\n    return '***';\n  }\n  if (value.length <= 4) {\n    return '***';\n  }\n  return value.slice(0, 2) + '***' + value.slice(-2);\n}\n\nfunction maskUrlCredentials(url: string): string {\n  const match = url.match(URL_WITH_CREDENTIALS_REGEX);\n  if (match) {\n    const [, protocol, user, , host] = match;\n    return `${protocol}${user}:***@${host}`;\n  }\n  return url;\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n","export function stripEmpty(obj: unknown): unknown {\n  if (typeof obj === 'string') {\n    return obj === '' ? undefined : obj;\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) => stripEmpty(item)).filter((item) => item !== undefined);\n  }\n\n  if (isPlainObject(obj)) {\n    const result: Record<string, unknown> = {};\n    let hasValues = false;\n\n    for (const key of Object.keys(obj)) {\n      const value = stripEmpty(obj[key]);\n      if (value !== undefined) {\n        result[key] = value;\n        hasValues = true;\n      }\n    }\n\n    return hasValues ? result : undefined;\n  }\n\n  return obj;\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n","import NodeVault from 'node-vault';\nimport type { VaultOptions } from '../types.js';\n\nconst VAULT_PLACEHOLDER_REGEX = /\\${vault:([^:}]+):([^:}]+)(?::([^}]*))?}/g;\n\nexport interface VaultSecretCache {\n  [path: string]: Record<string, unknown>;\n}\n\nexport interface VaultClient {\n  fetchSecrets(obj: unknown): Promise<VaultSecretCache>;\n  getSecret(path: string, field: string): unknown;\n}\n\nexport async function createVaultClient(options: VaultOptions): Promise<VaultClient> {\n  const vault = NodeVault({\n    endpoint: options.endpoint,\n    apiVersion: 'v1',\n    namespace: options.namespace,\n  });\n\n  // Authenticate with AppRole\n  const loginResult = await vault.approleLogin({\n    role_id: options.roleId,\n    secret_id: options.secretId,\n  });\n\n  vault.token = loginResult.auth.client_token;\n\n  const cache: VaultSecretCache = {};\n\n  return {\n    async fetchSecrets(obj: unknown): Promise<VaultSecretCache> {\n      const paths = extractVaultPaths(obj);\n\n      // Fetch all unique paths in parallel\n      await Promise.all(\n        paths.map(async (path) => {\n          if (!cache[path]) {\n            try {\n              const result = await vault.read(path);\n              // Vault KV v2 stores data under result.data.data\n              // KV v1 stores under result.data\n              cache[path] = result.data?.data ?? result.data ?? {};\n            } catch {\n              // Store empty object for failed paths - will use defaults or throw later\n              cache[path] = {};\n            }\n          }\n        }),\n      );\n\n      return cache;\n    },\n\n    getSecret(path: string, field: string): unknown {\n      return cache[path]?.[field];\n    },\n  };\n}\n\n/**\n * Extract all unique Vault paths from config object\n */\nfunction extractVaultPaths(obj: unknown): string[] {\n  const paths = new Set<string>();\n\n  function traverse(value: unknown): void {\n    if (typeof value === 'string') {\n      let match;\n      while ((match = VAULT_PLACEHOLDER_REGEX.exec(value)) !== null) {\n        paths.add(match[1]); // path is first capture group\n      }\n      VAULT_PLACEHOLDER_REGEX.lastIndex = 0; // Reset regex state\n    } else if (Array.isArray(value)) {\n      value.forEach(traverse);\n    } else if (value !== null && typeof value === 'object') {\n      Object.values(value).forEach(traverse);\n    }\n  }\n\n  traverse(obj);\n  return Array.from(paths);\n}\n","import { SecretsManagerClient, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager';\nimport type { AwsSecretsOptions } from '../types.js';\n\nconst AWS_PLACEHOLDER_REGEX = /\\${aws:([^:}]+)(?::([^:}]+))?(?::([^}]*))?}/g;\n\nexport interface AwsSecretsCache {\n  [secretName: string]: string | Record<string, unknown>;\n}\n\nexport interface AwsSecretsClient {\n  fetchSecrets(obj: unknown): Promise<AwsSecretsCache>;\n  getSecret(secretName: string, field?: string): unknown;\n}\n\nexport async function createAwsSecretsClient(options: AwsSecretsOptions): Promise<AwsSecretsClient> {\n  const client = new SecretsManagerClient({\n    region: options.region,\n    credentials: {\n      accessKeyId: options.accessKeyId,\n      secretAccessKey: options.secretAccessKey,\n    },\n  });\n\n  const cache: AwsSecretsCache = {};\n\n  return {\n    async fetchSecrets(obj: unknown): Promise<AwsSecretsCache> {\n      const secretNames = extractAwsSecretNames(obj);\n\n      // Fetch all unique secrets in parallel\n      await Promise.all(\n        secretNames.map(async (secretName) => {\n          if (cache[secretName] === undefined) {\n            try {\n              const command = new GetSecretValueCommand({ SecretId: secretName });\n              const response = await client.send(command);\n\n              const secretString = response.SecretString;\n              if (secretString) {\n                // Try to parse as JSON, fallback to plain string\n                try {\n                  cache[secretName] = JSON.parse(secretString);\n                } catch {\n                  cache[secretName] = secretString;\n                }\n              } else {\n                cache[secretName] = {};\n              }\n            } catch {\n              // Store empty object for failed secrets - will use defaults or throw later\n              cache[secretName] = {};\n            }\n          }\n        }),\n      );\n\n      return cache;\n    },\n\n    getSecret(secretName: string, field?: string): unknown {\n      const secret = cache[secretName];\n\n      if (secret === undefined) {\n        return undefined;\n      }\n\n      // If no field specified, return the whole secret (plain string or parsed JSON)\n      if (!field) {\n        return typeof secret === 'string' ? secret : undefined;\n      }\n\n      // If field specified, secret must be an object\n      if (typeof secret === 'object' && secret !== null) {\n        return (secret as Record<string, unknown>)[field];\n      }\n\n      return undefined;\n    },\n  };\n}\n\n/**\n * Extract all unique AWS secret names from config object\n */\nfunction extractAwsSecretNames(obj: unknown): string[] {\n  const names = new Set<string>();\n\n  function traverse(value: unknown): void {\n    if (typeof value === 'string') {\n      let match;\n      while ((match = AWS_PLACEHOLDER_REGEX.exec(value)) !== null) {\n        names.add(match[1]); // secret name is first capture group\n      }\n      AWS_PLACEHOLDER_REGEX.lastIndex = 0; // Reset regex state\n    } else if (Array.isArray(value)) {\n      value.forEach(traverse);\n    } else if (value !== null && typeof value === 'object') {\n      Object.values(value).forEach(traverse);\n    }\n  }\n\n  traverse(obj);\n  return Array.from(names);\n}\n","import { readFileSync, existsSync, readdirSync } from 'fs';\nimport * as yaml from 'js-yaml';\nimport * as dotenv from 'dotenv';\nimport { join } from 'path';\nimport type { ConfigLoaderOptions, ConfigLoaderResult } from './types.js';\nimport {\n  deepMerge,\n  replacePlaceholders,\n  maskSecrets,\n  stripEmpty,\n  createVaultClient,\n  createAwsSecretsClient,\n  type VaultClient,\n  type AwsSecretsClient,\n} from './utils/index.js';\n\nconst DEFAULT_OPTIONS = {\n  configDir: process.cwd(),\n  baseFileName: 'base',\n  environment: process.env.NODE_ENV || 'local',\n  extension: 'yml' as const,\n  overrideDir: '/etc/app/config',\n};\n\nexport function loadConfig<T>(options: ConfigLoaderOptions<T> = {}): ConfigLoaderResult<T> {\n  if (options.vault || options.aws) {\n    throw new Error('Vault/AWS options require async loading. Use loadConfigAsync() instead of loadConfig()');\n  }\n\n  const opts = { ...DEFAULT_OPTIONS, ...options };\n  const { configDir, baseFileName, environment, extension } = opts;\n\n  // Load .env if requested\n  if (options.dotenv) {\n    loadDotenv(options.dotenv, environment);\n  }\n\n  const resolvedConfigDir = resolveConfigDir(configDir);\n\n  const baseConfig = loadYamlFile(resolvedConfigDir, `${baseFileName}.${extension}`);\n  const envConfig = loadYamlFile(resolvedConfigDir, `${environment}.${extension}`);\n\n  let mergedConfig = deepMerge(baseConfig, envConfig);\n\n  // Load override files from directory\n  const overrideDir = options.overrideDir !== false ? (options.overrideDir ?? DEFAULT_OPTIONS.overrideDir) : null;\n  if (overrideDir) {\n    const overrideConfigs = loadOverrideDir(overrideDir);\n    for (const override of overrideConfigs) {\n      mergedConfig = deepMerge(mergedConfig, override);\n    }\n  }\n\n  let config = replacePlaceholders(mergedConfig) as T;\n\n  // Strip empty strings and objects\n  if (options.stripEmpty) {\n    config = stripEmpty(config) as T;\n  }\n\n  // Post-process\n  if (options.postProcess) {\n    config = options.postProcess(config);\n  }\n\n  // Validate with Zod schema\n  if (options.schema) {\n    const result = options.schema.safeParse(config);\n    if (!result.success) {\n      const errors = result.error.issues\n        .map((e) => `  - ${e.path.join('.')}: ${e.message}`)\n        .join('\\n');\n      throw new Error(`Config validation failed:\\n${errors}`);\n    }\n    config = result.data;\n  }\n\n  // Log config with masked secrets\n  if (options.logger) {\n    const maskedConfig = maskSecrets(config);\n    options.logger(`Config loaded (${environment}):\\n${JSON.stringify(maskedConfig, null, 2)}`);\n  }\n\n  return {\n    config,\n    environment,\n    configDir: resolvedConfigDir,\n  };\n}\n\nexport async function loadConfigAsync<T>(\n  options: ConfigLoaderOptions<T> = {},\n): Promise<ConfigLoaderResult<T>> {\n  const opts = { ...DEFAULT_OPTIONS, ...options };\n  const { configDir, baseFileName, environment, extension } = opts;\n\n  // Load .env if requested\n  if (options.dotenv) {\n    loadDotenv(options.dotenv, environment);\n  }\n\n  const resolvedConfigDir = resolveConfigDir(configDir);\n\n  const baseConfig = loadYamlFile(resolvedConfigDir, `${baseFileName}.${extension}`);\n  const envConfig = loadYamlFile(resolvedConfigDir, `${environment}.${extension}`);\n\n  let mergedConfig = deepMerge(baseConfig, envConfig);\n\n  // Load override files from directory\n  const overrideDir = options.overrideDir !== false ? (options.overrideDir ?? DEFAULT_OPTIONS.overrideDir) : null;\n  if (overrideDir) {\n    const overrideConfigs = loadOverrideDir(overrideDir);\n    for (const override of overrideConfigs) {\n      mergedConfig = deepMerge(mergedConfig, override);\n    }\n  }\n\n  // Create Vault client and pre-fetch secrets if Vault options provided\n  let vaultClient: VaultClient | undefined;\n  if (options.vault) {\n    vaultClient = await createVaultClient(options.vault);\n    await vaultClient.fetchSecrets(mergedConfig);\n  }\n\n  // Create AWS Secrets Manager client and pre-fetch secrets if AWS options provided\n  let awsClient: AwsSecretsClient | undefined;\n  if (options.aws) {\n    awsClient = await createAwsSecretsClient(options.aws);\n    await awsClient.fetchSecrets(mergedConfig);\n  }\n\n  // Replace placeholders (with Vault and AWS support)\n  let config = replacePlaceholders(mergedConfig, { vaultClient, awsClient }) as T;\n\n  // Strip empty strings and objects\n  if (options.stripEmpty) {\n    config = stripEmpty(config) as T;\n  }\n\n  // Post-process\n  if (options.postProcess) {\n    config = options.postProcess(config);\n  }\n\n  // Validate with Zod schema\n  if (options.schema) {\n    const result = options.schema.safeParse(config);\n    if (!result.success) {\n      const errors = result.error.issues\n        .map((e) => `  - ${e.path.join('.')}: ${e.message}`)\n        .join('\\n');\n      throw new Error(`Config validation failed:\\n${errors}`);\n    }\n    config = result.data;\n  }\n\n  // Log config with masked secrets\n  if (options.logger) {\n    const maskedConfig = maskSecrets(config);\n    options.logger(`Config loaded (${environment}):\\n${JSON.stringify(maskedConfig, null, 2)}`);\n  }\n\n  return {\n    config,\n    environment,\n    configDir: resolvedConfigDir,\n  };\n}\n\nfunction loadDotenv(\n  dotenvOption: boolean | { path?: string },\n  environment: string,\n): void {\n  let envPath: string;\n\n  if (typeof dotenvOption === 'object' && dotenvOption.path) {\n    envPath = dotenvOption.path;\n  } else {\n    envPath = environment === 'production' ? '.env' : `.env.${environment}`;\n  }\n\n  dotenv.config({ path: envPath });\n}\n\nfunction resolveConfigDir(configDir: string): string {\n  const possiblePaths = [\n    join(configDir, 'src', 'config'),\n    join(configDir, 'dist', 'config'),\n    join(configDir, 'config'),\n    configDir,\n  ];\n\n  for (const path of possiblePaths) {\n    if (existsSync(join(path, 'base.yml')) || existsSync(join(path, 'base.yaml'))) {\n      return path;\n    }\n  }\n\n  throw new Error(\n    `Config files not found. Searched in:\\n${possiblePaths.map((p) => `  - ${p}`).join('\\n')}`,\n  );\n}\n\nfunction loadYamlFile(dir: string, filename: string): Record<string, unknown> {\n  const filePath = join(dir, filename);\n\n  if (!existsSync(filePath)) {\n    return {};\n  }\n\n  const content = readFileSync(filePath, 'utf8');\n  return (yaml.load(content) as Record<string, unknown>) || {};\n}\n\nfunction loadOverrideDir(dir: string): Record<string, unknown>[] {\n  if (!existsSync(dir)) {\n    return [];\n  }\n\n  const files = readdirSync(dir)\n    .filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'))\n    .sort();\n\n  return files.map((file) => loadYamlFile(dir, file));\n}\n"]}

package/dist/index.mjs

@@ -2,6 +2,8 @@ import { existsSync, readFileSync, readdirSync } from 'fs';
 import * as yaml from 'js-yaml';
 import * as dotenv from 'dotenv';
 import { join } from 'path';
+import NodeVault from 'node-vault';
+import { SecretsManagerClient, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager';
 
 // src/loader.ts
 
@@ -25,41 +27,104 @@ function isPlainObject(value) {
 
 // src/utils/env-replacer.ts
 var ENV_PLACEHOLDER_REGEX = /\${(.*?)}/g;
-function replacePlaceholders(obj) {
+var VAULT_PREFIX = "vault:";
+var AWS_PREFIX = "aws:";
+function replacePlaceholders(obj, options = {}) {
   if (typeof obj === "string") {
-    return replaceStringPlaceholders(obj);
+    return replaceStringPlaceholders(obj, options);
   }
   if (Array.isArray(obj)) {
-    return obj.map((item) => replacePlaceholders(item));
+    return obj.map((item) => replacePlaceholders(item, options));
   }
   if (isPlainObject2(obj)) {
     const result = {};
     for (const key of Object.keys(obj)) {
-      result[key] = replacePlaceholders(obj[key]);
+      result[key] = replacePlaceholders(obj[key], options);
     }
     return result;
   }
   return obj;
 }
-function replaceStringPlaceholders(str) {
+function replaceStringPlaceholders(str, options) {
   return str.replace(ENV_PLACEHOLDER_REGEX, (match, key) => {
-    const [envKey, ...rest] = key.split(":");
-    const defaultValue = rest.length > 0 ? rest.join(":") : void 0;
-    const envValue = process.env[envKey];
-    let value;
-    if (envValue !== void 0) {
-      value = envValue;
-    } else if (defaultValue !== void 0) {
-      value = defaultValue;
-    } else {
-      throw new Error(`Environment variable "${envKey}" is not defined and no default value provided`);
+    if (key.startsWith(VAULT_PREFIX)) {
+      return resolveVaultPlaceholder(key, match, options);
     }
-    if (value.includes("${")) {
-      return replacePlaceholders(value);
+    if (key.startsWith(AWS_PREFIX)) {
+      return resolveAwsPlaceholder(key, match, options);
     }
-    return value;
+    return resolveEnvPlaceholder(key, match, options);
   });
 }
+function resolveVaultPlaceholder(key, originalMatch, options) {
+  const parts = key.substring(VAULT_PREFIX.length).split(":");
+  if (parts.length < 2) {
+    throw new Error(
+      `Invalid Vault placeholder format "${originalMatch}". Expected \${vault:path:field} or \${vault:path:field:default}`
+    );
+  }
+  const [path, field, ...defaultParts] = parts;
+  const defaultValue = defaultParts.length > 0 ? defaultParts.join(":") : void 0;
+  if (!options.vaultClient) {
+    if (defaultValue !== void 0) {
+      return defaultValue;
+    }
+    throw new Error(`Vault placeholder "${originalMatch}" found but no Vault options provided`);
+  }
+  const secretValue = options.vaultClient.getSecret(path, field);
+  if (secretValue !== void 0) {
+    return String(secretValue);
+  }
+  if (defaultValue !== void 0) {
+    return defaultValue;
+  }
+  throw new Error(`Vault secret "${field}" not found at path "${path}" and no default value provided`);
+}
+function resolveAwsPlaceholder(key, originalMatch, options) {
+  const parts = key.substring(AWS_PREFIX.length).split(":");
+  if (parts.length < 1 || !parts[0]) {
+    throw new Error(
+      `Invalid AWS placeholder format "${originalMatch}". Expected \${aws:secret-name} or \${aws:secret-name:field} or \${aws:secret-name:field:default}`
+    );
+  }
+  const [secretName, field, ...defaultParts] = parts;
+  const defaultValue = defaultParts.length > 0 ? defaultParts.join(":") : void 0;
+  if (!options.awsClient) {
+    if (defaultValue !== void 0) {
+      return defaultValue;
+    }
+    throw new Error(`AWS placeholder "${originalMatch}" found but no AWS options provided`);
+  }
+  const secretValue = options.awsClient.getSecret(secretName, field || void 0);
+  if (secretValue !== void 0) {
+    return String(secretValue);
+  }
+  if (defaultValue !== void 0) {
+    return defaultValue;
+  }
+  if (field) {
+    throw new Error(`AWS secret field "${field}" not found in "${secretName}" and no default value provided`);
+  } else {
+    throw new Error(`AWS secret "${secretName}" not found and no default value provided`);
+  }
+}
+function resolveEnvPlaceholder(key, _match, options) {
+  const [envKey, ...rest] = key.split(":");
+  const defaultValue = rest.length > 0 ? rest.join(":") : void 0;
+  const envValue = process.env[envKey];
+  let value;
+  if (envValue !== void 0) {
+    value = envValue;
+  } else if (defaultValue !== void 0) {
+    value = defaultValue;
+  } else {
+    throw new Error(`Environment variable "${envKey}" is not defined and no default value provided`);
+  }
+  if (value.includes("${")) {
+    return replacePlaceholders(value, options);
+  }
+  return value;
+}
 function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -138,6 +203,129 @@ function stripEmpty(obj) {
 function isPlainObject4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+var VAULT_PLACEHOLDER_REGEX = /\${vault:([^:}]+):([^:}]+)(?::([^}]*))?}/g;
+async function createVaultClient(options) {
+  const vault = NodeVault({
+    endpoint: options.endpoint,
+    apiVersion: "v1",
+    namespace: options.namespace
+  });
+  const loginResult = await vault.approleLogin({
+    role_id: options.roleId,
+    secret_id: options.secretId
+  });
+  vault.token = loginResult.auth.client_token;
+  const cache = {};
+  return {
+    async fetchSecrets(obj) {
+      const paths = extractVaultPaths(obj);
+      await Promise.all(
+        paths.map(async (path) => {
+          if (!cache[path]) {
+            try {
+              const result = await vault.read(path);
+              cache[path] = result.data?.data ?? result.data ?? {};
+            } catch {
+              cache[path] = {};
+            }
+          }
+        })
+      );
+      return cache;
+    },
+    getSecret(path, field) {
+      return cache[path]?.[field];
+    }
+  };
+}
+function extractVaultPaths(obj) {
+  const paths = /* @__PURE__ */ new Set();
+  function traverse(value) {
+    if (typeof value === "string") {
+      let match;
+      while ((match = VAULT_PLACEHOLDER_REGEX.exec(value)) !== null) {
+        paths.add(match[1]);
+      }
+      VAULT_PLACEHOLDER_REGEX.lastIndex = 0;
+    } else if (Array.isArray(value)) {
+      value.forEach(traverse);
+    } else if (value !== null && typeof value === "object") {
+      Object.values(value).forEach(traverse);
+    }
+  }
+  traverse(obj);
+  return Array.from(paths);
+}
+var AWS_PLACEHOLDER_REGEX = /\${aws:([^:}]+)(?::([^:}]+))?(?::([^}]*))?}/g;
+async function createAwsSecretsClient(options) {
+  const client = new SecretsManagerClient({
+    region: options.region,
+    credentials: {
+      accessKeyId: options.accessKeyId,
+      secretAccessKey: options.secretAccessKey
+    }
+  });
+  const cache = {};
+  return {
+    async fetchSecrets(obj) {
+      const secretNames = extractAwsSecretNames(obj);
+      await Promise.all(
+        secretNames.map(async (secretName) => {
+          if (cache[secretName] === void 0) {
+            try {
+              const command = new GetSecretValueCommand({ SecretId: secretName });
+              const response = await client.send(command);
+              const secretString = response.SecretString;
+              if (secretString) {
+                try {
+                  cache[secretName] = JSON.parse(secretString);
+                } catch {
+                  cache[secretName] = secretString;
+                }
+              } else {
+                cache[secretName] = {};
+              }
+            } catch {
+              cache[secretName] = {};
+            }
+          }
+        })
+      );
+      return cache;
+    },
+    getSecret(secretName, field) {
+      const secret = cache[secretName];
+      if (secret === void 0) {
+        return void 0;
+      }
+      if (!field) {
+        return typeof secret === "string" ? secret : void 0;
+      }
+      if (typeof secret === "object" && secret !== null) {
+        return secret[field];
+      }
+      return void 0;
+    }
+  };
+}
+function extractAwsSecretNames(obj) {
+  const names = /* @__PURE__ */ new Set();
+  function traverse(value) {
+    if (typeof value === "string") {
+      let match;
+      while ((match = AWS_PLACEHOLDER_REGEX.exec(value)) !== null) {
+        names.add(match[1]);
+      }
+      AWS_PLACEHOLDER_REGEX.lastIndex = 0;
+    } else if (Array.isArray(value)) {
+      value.forEach(traverse);
+    } else if (value !== null && typeof value === "object") {
+      Object.values(value).forEach(traverse);
+    }
+  }
+  traverse(obj);
+  return Array.from(names);
+}
 
 // src/loader.ts
 var DEFAULT_OPTIONS = {
@@ -148,6 +336,9 @@ var DEFAULT_OPTIONS = {
   overrideDir: "/etc/app/config"
 };
 function loadConfig(options = {}) {
+  if (options.vault || options.aws) {
+    throw new Error("Vault/AWS options require async loading. Use loadConfigAsync() instead of loadConfig()");
+  }
   const opts = { ...DEFAULT_OPTIONS, ...options };
   const { configDir, baseFileName, environment, extension } = opts;
   if (options.dotenv) {
@@ -191,6 +382,60 @@ ${JSON.stringify(maskedConfig, null, 2)}`);
     configDir: resolvedConfigDir
   };
 }
+async function loadConfigAsync(options = {}) {
+  const opts = { ...DEFAULT_OPTIONS, ...options };
+  const { configDir, baseFileName, environment, extension } = opts;
+  if (options.dotenv) {
+    loadDotenv(options.dotenv, environment);
+  }
+  const resolvedConfigDir = resolveConfigDir(configDir);
+  const baseConfig = loadYamlFile(resolvedConfigDir, `${baseFileName}.${extension}`);
+  const envConfig = loadYamlFile(resolvedConfigDir, `${environment}.${extension}`);
+  let mergedConfig = deepMerge(baseConfig, envConfig);
+  const overrideDir = options.overrideDir !== false ? options.overrideDir ?? DEFAULT_OPTIONS.overrideDir : null;
+  if (overrideDir) {
+    const overrideConfigs = loadOverrideDir(overrideDir);
+    for (const override of overrideConfigs) {
+      mergedConfig = deepMerge(mergedConfig, override);
+    }
+  }
+  let vaultClient;
+  if (options.vault) {
+    vaultClient = await createVaultClient(options.vault);
+    await vaultClient.fetchSecrets(mergedConfig);
+  }
+  let awsClient;
+  if (options.aws) {
+    awsClient = await createAwsSecretsClient(options.aws);
+    await awsClient.fetchSecrets(mergedConfig);
+  }
+  let config2 = replacePlaceholders(mergedConfig, { vaultClient, awsClient });
+  if (options.stripEmpty) {
+    config2 = stripEmpty(config2);
+  }
+  if (options.postProcess) {
+    config2 = options.postProcess(config2);
+  }
+  if (options.schema) {
+    const result = options.schema.safeParse(config2);
+    if (!result.success) {
+      const errors = result.error.issues.map((e) => `  - ${e.path.join(".")}: ${e.message}`).join("\n");
+      throw new Error(`Config validation failed:
+${errors}`);
+    }
+    config2 = result.data;
+  }
+  if (options.logger) {
+    const maskedConfig = maskSecrets(config2);
+    options.logger(`Config loaded (${environment}):
+${JSON.stringify(maskedConfig, null, 2)}`);
+  }
+  return {
+    config: config2,
+    environment,
+    configDir: resolvedConfigDir
+  };
+}
 function loadDotenv(dotenvOption, environment) {
   let envPath;
   if (typeof dotenvOption === "object" && dotenvOption.path) {
@@ -233,6 +478,6 @@ function loadOverrideDir(dir) {
   return files.map((file) => loadYamlFile(dir, file));
 }
 
-export { deepMerge, loadConfig, maskSecrets, replacePlaceholders, stripEmpty };
+export { createAwsSecretsClient, createVaultClient, deepMerge, loadConfig, loadConfigAsync, maskSecrets, replacePlaceholders, stripEmpty };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/utils/deep-merge.ts","../src/utils/env-replacer.ts","../src/utils/mask-secrets.ts","../src/utils/strip-empty.ts","../src/loader.ts"],"names":["isPlainObject","config"],"mappings":";;;;;;;;AAEO,SAAS,SAAA,CAAU,MAAkB,QAAA,EAAkC;AAC5E,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,IAAA,EAAK;AAEzB,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,IAAA,MAAM,aAAA,GAAgB,SAAS,GAAG,CAAA;AAClC,IAAA,MAAM,SAAA,GAAY,KAAK,GAAG,CAAA;AAE1B,IAAA,IAAI,aAAA,CAAc,aAAa,CAAA,IAAK,aAAA,CAAc,SAAS,CAAA,EAAG;AAC5D,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,SAAA,CAAU,SAAA,EAAyB,aAA2B,CAAA;AAAA,IAC9E,CAAA,MAAO;AACL,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,aAAA;AAAA,IAChB;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,cAAc,KAAA,EAAqC;AAC1D,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;;;ACrBA,IAAM,qBAAA,GAAwB,YAAA;AAEvB,SAAS,oBAAoB,GAAA,EAAuB;AACzD,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,OAAO,0BAA0B,GAAG,CAAA;AAAA,EACtC;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,OAAO,IAAI,GAAA,CAAI,CAAC,IAAA,KAAS,mBAAA,CAAoB,IAAI,CAAC,CAAA;AAAA,EACpD;AAEA,EAAA,IAAIA,cAAAA,CAAc,GAAG,CAAA,EAAG;AACtB,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AAClC,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,mBAAA,CAAoB,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,IAC5C;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,0BAA0B,GAAA,EAAqB;AACtD,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,qBAAA,EAAuB,CAAC,OAAO,GAAA,KAAQ;AACxD,IAAA,MAAM,CAAC,MAAA,EAAQ,GAAG,IAAI,CAAA,GAAI,GAAA,CAAI,MAAM,GAAG,CAAA;AACvC,IAAA,MAAM,eAAe,IAAA,CAAK,MAAA,GAAS,IAAI,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AACxD,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA;AAEnC,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,KAAA,GAAQ,QAAA;AAAA,IACV,CAAA,MAAA,IAAW,iBAAiB,MAAA,EAAW;AACrC,MAAA,KAAA,GAAQ,YAAA;AAAA,IACV,CAAA,MAAO;AACL,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,IACjG;AAEA,IAAA,IAAI,KAAA,CAAM,QAAA,CAAS,IAAI,CAAA,EAAG;AACxB,MAAA,OAAO,oBAAoB,KAAK,CAAA;AAAA,IAClC;AAEA,IAAA,OAAO,KAAA;AAAA,EACT,CAAC,CAAA;AACH;AAEA,SAASA,eAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;;;AC/CA,IAAM,eAAA,GAAkB,CAAC,OAAA,EAAS,UAAA,EAAY,UAAU,KAAA,EAAO,QAAA,EAAU,WAAW,YAAY,CAAA;AAEhG,IAAM,0BAAA,GAA6B,sCAAA;AAE5B,SAAS,YAAY,GAAA,EAAuB;AACjD,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,OAAO,mBAAmB,GAAG,CAAA;AAAA,EAC/B;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,OAAO,IAAI,GAAA,CAAI,CAAC,IAAA,KAAS,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5C;AAEA,EAAA,IAAIA,cAAAA,CAAc,GAAG,CAAA,EAAG;AACtB,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AAClC,MAAA,MAAM,KAAA,GAAQ,IAAI,GAAG,CAAA;AACrB,MAAA,IAAI,WAAA,CAAY,GAAG,CAAA,EAAG;AACpB,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,SAAA,CAAU,KAAK,CAAA;AAAA,MAC/B,CAAA,MAAO;AACL,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,WAAA,CAAY,KAAK,CAAA;AAAA,MACjC;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,YAAY,GAAA,EAAsB;AACzC,EAAA,MAAM,QAAA,GAAW,IAAI,WAAA,EAAY;AACjC,EAAA,OAAO,gBAAgB,IAAA,CAAK,CAAC,YAAY,QAAA,CAAS,QAAA,CAAS,OAAO,CAAC,CAAA;AACrE;AAEA,SAAS,UAAU,KAAA,EAAwB;AACzC,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,KAAA,CAAM,UAAU,CAAA,EAAG;AACrB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA,CAAM,MAAM,CAAA,EAAG,CAAC,IAAI,KAAA,GAAQ,KAAA,CAAM,MAAM,EAAE,CAAA;AACnD;AAEA,SAAS,mBAAmB,GAAA,EAAqB;AAC/C,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,0BAA0B,CAAA;AAClD,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAM,GAAG,QAAA,EAAU,IAAA,IAAQ,IAAI,CAAA,GAAI,KAAA;AACnC,IAAA,OAAO,CAAA,EAAG,QAAQ,CAAA,EAAG,IAAI,QAAQ,IAAI,CAAA,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAASA,eAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;;;ACvDO,SAAS,WAAW,GAAA,EAAuB;AAChD,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,OAAO,GAAA,KAAQ,KAAK,MAAA,GAAY,GAAA;AAAA,EAClC;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,OAAO,GAAA,CAAI,GAAA,CAAI,CAAC,IAAA,KAAS,UAAA,CAAW,IAAI,CAAC,CAAA,CAAE,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,KAAS,MAAS,CAAA;AAAA,EAChF;AAEA,EAAA,IAAIA,cAAAA,CAAc,GAAG,CAAA,EAAG;AACtB,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,IAAI,SAAA,GAAY,KAAA;AAEhB,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AAClC,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,GAAG,CAAC,CAAA;AACjC,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AACd,QAAA,SAAA,GAAY,IAAA;AAAA,MACd;AAAA,IACF;AAEA,IAAA,OAAO,YAAY,MAAA,GAAS,MAAA;AAAA,EAC9B;AAEA,EAAA,OAAO,GAAA;AACT;AAEA,SAASA,eAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;;;ACtBA,IAAM,eAAA,GAAkB;AAAA,EACtB,SAAA,EAAW,QAAQ,GAAA,EAAI;AAAA,EACvB,YAAA,EAAc,MAAA;AAAA,EACd,WAAA,EAAa,OAAA,CAAQ,GAAA,CAAI,QAAA,IAAY,OAAA;AAAA,EACrC,SAAA,EAAW,KAAA;AAAA,EACX,WAAA,EAAa;AACf,CAAA;AAEO,SAAS,UAAA,CAAc,OAAA,GAAkC,EAAC,EAA0B;AACzF,EAAA,MAAM,IAAA,GAAO,EAAE,GAAG,eAAA,EAAiB,GAAG,OAAA,EAAQ;AAC9C,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,WAAA,EAAa,WAAU,GAAI,IAAA;AAG5D,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,UAAA,CAAW,OAAA,CAAQ,QAAQ,WAAW,CAAA;AAAA,EACxC;AAEA,EAAA,MAAM,iBAAA,GAAoB,iBAAiB,SAAS,CAAA;AAEpD,EAAA,MAAM,aAAa,YAAA,CAAa,iBAAA,EAAmB,GAAG,YAAY,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AACjF,EAAA,MAAM,YAAY,YAAA,CAAa,iBAAA,EAAmB,GAAG,WAAW,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AAE/E,EAAA,IAAI,YAAA,GAAe,SAAA,CAAU,UAAA,EAAY,SAAS,CAAA;AAGlD,EAAA,MAAM,cAAc,OAAA,CAAQ,WAAA,KAAgB,QAAS,OAAA,CAAQ,WAAA,IAAe,gBAAgB,WAAA,GAAe,IAAA;AAC3G,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,MAAM,eAAA,GAAkB,gBAAgB,WAAW,CAAA;AACnD,IAAA,KAAA,MAAW,YAAY,eAAA,EAAiB;AACtC,MAAA,YAAA,GAAe,SAAA,CAAU,cAAc,QAAQ,CAAA;AAAA,IACjD;AAAA,EACF;AAEA,EAAA,IAAIC,OAAAA,GAAS,oBAAoB,YAAY,CAAA;AAG7C,EAAA,IAAI,QAAQ,UAAA,EAAY;AACtB,IAAAA,OAAAA,GAAS,WAAWA,OAAM,CAAA;AAAA,EAC5B;AAGA,EAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,IAAAA,OAAAA,GAAS,OAAA,CAAQ,WAAA,CAAYA,OAAM,CAAA;AAAA,EACrC;AAGA,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,SAAA,CAAUA,OAAM,CAAA;AAC9C,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,SAAS,MAAA,CAAO,KAAA,CAAM,OACzB,GAAA,CAAI,CAAC,MAAM,CAAA,IAAA,EAAO,CAAA,CAAE,KAAK,IAAA,CAAK,GAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA,CAClD,KAAK,IAAI,CAAA;AACZ,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA;AAAA,EAA8B,MAAM,CAAA,CAAE,CAAA;AAAA,IACxD;AACA,IAAAA,UAAS,MAAA,CAAO,IAAA;AAAA,EAClB;AAGA,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,MAAM,YAAA,GAAe,YAAYA,OAAM,CAAA;AACvC,IAAA,OAAA,CAAQ,MAAA,CAAO,kBAAkB,WAAW,CAAA;AAAA,EAAO,KAAK,SAAA,CAAU,YAAA,EAAc,IAAA,EAAM,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC5F;AAEA,EAAA,OAAO;AAAA,IACL,MAAA,EAAAA,OAAAA;AAAA,IACA,WAAA;AAAA,IACA,SAAA,EAAW;AAAA,GACb;AACF;AAEA,SAAS,UAAA,CACP,cACA,WAAA,EACM;AACN,EAAA,IAAI,OAAA;AAEJ,EAAA,IAAI,OAAO,YAAA,KAAiB,QAAA,IAAY,YAAA,CAAa,IAAA,EAAM;AACzD,IAAA,OAAA,GAAU,YAAA,CAAa,IAAA;AAAA,EACzB,CAAA,MAAO;AACL,IAAA,OAAA,GAAU,WAAA,KAAgB,YAAA,GAAe,MAAA,GAAS,CAAA,KAAA,EAAQ,WAAW,CAAA,CAAA;AAAA,EACvE;AAEA,EAAO,MAAA,CAAA,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,CAAA;AACjC;AAEA,SAAS,iBAAiB,SAAA,EAA2B;AACnD,EAAA,MAAM,aAAA,GAAgB;AAAA,IACpB,IAAA,CAAK,SAAA,EAAW,KAAA,EAAO,QAAQ,CAAA;AAAA,IAC/B,IAAA,CAAK,SAAA,EAAW,MAAA,EAAQ,QAAQ,CAAA;AAAA,IAChC,IAAA,CAAK,WAAW,QAAQ,CAAA;AAAA,IACxB;AAAA,GACF;AAEA,EAAA,KAAA,MAAW,QAAQ,aAAA,EAAe;AAChC,IAAA,IAAI,UAAA,CAAW,IAAA,CAAK,IAAA,EAAM,UAAU,CAAC,CAAA,IAAK,UAAA,CAAW,IAAA,CAAK,IAAA,EAAM,WAAW,CAAC,CAAA,EAAG;AAC7E,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA;AAAA,EAAyC,aAAA,CAAc,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,GAC1F;AACF;AAEA,SAAS,YAAA,CAAa,KAAa,QAAA,EAA2C;AAC5E,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAK,QAAQ,CAAA;AAEnC,EAAA,IAAI,CAAC,UAAA,CAAW,QAAQ,CAAA,EAAG;AACzB,IAAA,OAAO,EAAC;AAAA,EACV;AAEA,EAAA,MAAM,OAAA,GAAU,YAAA,CAAa,QAAA,EAAU,MAAM,CAAA;AAC7C,EAAA,OAAa,IAAA,CAAA,IAAA,CAAK,OAAO,CAAA,IAAiC,EAAC;AAC7D;AAEA,SAAS,gBAAgB,GAAA,EAAwC;AAC/D,EAAA,IAAI,CAAC,UAAA,CAAW,GAAG,CAAA,EAAG;AACpB,IAAA,OAAO,EAAC;AAAA,EACV;AAEA,EAAA,MAAM,QAAQ,WAAA,CAAY,GAAG,CAAA,CAC1B,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,MAAM,KAAK,CAAA,CAAE,QAAA,CAAS,OAAO,CAAC,EACvD,IAAA,EAAK;AAER,EAAA,OAAO,MAAM,GAAA,CAAI,CAAC,SAAS,YAAA,CAAa,GAAA,EAAK,IAAI,CAAC,CAAA;AACpD","file":"index.mjs","sourcesContent":["type DeepObject = Record<string, unknown>;\n\nexport function deepMerge(base: DeepObject, override: DeepObject): DeepObject {\n  const merged = { ...base };\n\n  for (const key in override) {\n    const overrideValue = override[key];\n    const baseValue = base[key];\n\n    if (isPlainObject(overrideValue) && isPlainObject(baseValue)) {\n      merged[key] = deepMerge(baseValue as DeepObject, overrideValue as DeepObject);\n    } else {\n      merged[key] = overrideValue;\n    }\n  }\n\n  return merged;\n}\n\nfunction isPlainObject(value: unknown): value is DeepObject {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n","const ENV_PLACEHOLDER_REGEX = /\\${(.*?)}/g;\n\nexport function replacePlaceholders(obj: unknown): unknown {\n  if (typeof obj === 'string') {\n    return replaceStringPlaceholders(obj);\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) => replacePlaceholders(item));\n  }\n\n  if (isPlainObject(obj)) {\n    const result: Record<string, unknown> = {};\n    for (const key of Object.keys(obj)) {\n      result[key] = replacePlaceholders(obj[key]);\n    }\n    return result;\n  }\n\n  return obj;\n}\n\nfunction replaceStringPlaceholders(str: string): string {\n  return str.replace(ENV_PLACEHOLDER_REGEX, (match, key) => {\n    const [envKey, ...rest] = key.split(':');\n    const defaultValue = rest.length > 0 ? rest.join(':') : undefined;\n    const envValue = process.env[envKey];\n\n    let value: string;\n    if (envValue !== undefined) {\n      value = envValue;\n    } else if (defaultValue !== undefined) {\n      value = defaultValue;\n    } else {\n      throw new Error(`Environment variable \"${envKey}\" is not defined and no default value provided`);\n    }\n\n    if (value.includes('${')) {\n      return replacePlaceholders(value) as string;\n    }\n\n    return value;\n  });\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n","const SECRET_PATTERNS = ['token', 'password', 'secret', 'key', 'apikey', 'api_key', 'credential'];\n\nconst URL_WITH_CREDENTIALS_REGEX = /^([a-z]+:\\/\\/)([^:]+):([^@]+)@(.+)$/i;\n\nexport function maskSecrets(obj: unknown): unknown {\n  if (typeof obj === 'string') {\n    return maskUrlCredentials(obj);\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) => maskSecrets(item));\n  }\n\n  if (isPlainObject(obj)) {\n    const result: Record<string, unknown> = {};\n    for (const key of Object.keys(obj)) {\n      const value = obj[key];\n      if (isSecretKey(key)) {\n        result[key] = maskValue(value);\n      } else {\n        result[key] = maskSecrets(value);\n      }\n    }\n    return result;\n  }\n\n  return obj;\n}\n\nfunction isSecretKey(key: string): boolean {\n  const lowerKey = key.toLowerCase();\n  return SECRET_PATTERNS.some((pattern) => lowerKey.includes(pattern));\n}\n\nfunction maskValue(value: unknown): string {\n  if (typeof value !== 'string') {\n    return '***';\n  }\n  if (value.length <= 4) {\n    return '***';\n  }\n  return value.slice(0, 2) + '***' + value.slice(-2);\n}\n\nfunction maskUrlCredentials(url: string): string {\n  const match = url.match(URL_WITH_CREDENTIALS_REGEX);\n  if (match) {\n    const [, protocol, user, , host] = match;\n    return `${protocol}${user}:***@${host}`;\n  }\n  return url;\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n","export function stripEmpty(obj: unknown): unknown {\n  if (typeof obj === 'string') {\n    return obj === '' ? undefined : obj;\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) => stripEmpty(item)).filter((item) => item !== undefined);\n  }\n\n  if (isPlainObject(obj)) {\n    const result: Record<string, unknown> = {};\n    let hasValues = false;\n\n    for (const key of Object.keys(obj)) {\n      const value = stripEmpty(obj[key]);\n      if (value !== undefined) {\n        result[key] = value;\n        hasValues = true;\n      }\n    }\n\n    return hasValues ? result : undefined;\n  }\n\n  return obj;\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n","import { readFileSync, existsSync, readdirSync } from 'fs';\nimport * as yaml from 'js-yaml';\nimport * as dotenv from 'dotenv';\nimport { join } from 'path';\nimport type { ConfigLoaderOptions, ConfigLoaderResult } from './types.js';\nimport { deepMerge, replacePlaceholders, maskSecrets, stripEmpty } from './utils/index.js';\n\nconst DEFAULT_OPTIONS = {\n  configDir: process.cwd(),\n  baseFileName: 'base',\n  environment: process.env.NODE_ENV || 'local',\n  extension: 'yml' as const,\n  overrideDir: '/etc/app/config',\n};\n\nexport function loadConfig<T>(options: ConfigLoaderOptions<T> = {}): ConfigLoaderResult<T> {\n  const opts = { ...DEFAULT_OPTIONS, ...options };\n  const { configDir, baseFileName, environment, extension } = opts;\n\n  // Load .env if requested\n  if (options.dotenv) {\n    loadDotenv(options.dotenv, environment);\n  }\n\n  const resolvedConfigDir = resolveConfigDir(configDir);\n\n  const baseConfig = loadYamlFile(resolvedConfigDir, `${baseFileName}.${extension}`);\n  const envConfig = loadYamlFile(resolvedConfigDir, `${environment}.${extension}`);\n\n  let mergedConfig = deepMerge(baseConfig, envConfig);\n\n  // Load override files from directory\n  const overrideDir = options.overrideDir !== false ? (options.overrideDir ?? DEFAULT_OPTIONS.overrideDir) : null;\n  if (overrideDir) {\n    const overrideConfigs = loadOverrideDir(overrideDir);\n    for (const override of overrideConfigs) {\n      mergedConfig = deepMerge(mergedConfig, override);\n    }\n  }\n\n  let config = replacePlaceholders(mergedConfig) as T;\n\n  // Strip empty strings and objects\n  if (options.stripEmpty) {\n    config = stripEmpty(config) as T;\n  }\n\n  // Post-process\n  if (options.postProcess) {\n    config = options.postProcess(config);\n  }\n\n  // Validate with Zod schema\n  if (options.schema) {\n    const result = options.schema.safeParse(config);\n    if (!result.success) {\n      const errors = result.error.issues\n        .map((e) => `  - ${e.path.join('.')}: ${e.message}`)\n        .join('\\n');\n      throw new Error(`Config validation failed:\\n${errors}`);\n    }\n    config = result.data;\n  }\n\n  // Log config with masked secrets\n  if (options.logger) {\n    const maskedConfig = maskSecrets(config);\n    options.logger(`Config loaded (${environment}):\\n${JSON.stringify(maskedConfig, null, 2)}`);\n  }\n\n  return {\n    config,\n    environment,\n    configDir: resolvedConfigDir,\n  };\n}\n\nfunction loadDotenv(\n  dotenvOption: boolean | { path?: string },\n  environment: string,\n): void {\n  let envPath: string;\n\n  if (typeof dotenvOption === 'object' && dotenvOption.path) {\n    envPath = dotenvOption.path;\n  } else {\n    envPath = environment === 'production' ? '.env' : `.env.${environment}`;\n  }\n\n  dotenv.config({ path: envPath });\n}\n\nfunction resolveConfigDir(configDir: string): string {\n  const possiblePaths = [\n    join(configDir, 'src', 'config'),\n    join(configDir, 'dist', 'config'),\n    join(configDir, 'config'),\n    configDir,\n  ];\n\n  for (const path of possiblePaths) {\n    if (existsSync(join(path, 'base.yml')) || existsSync(join(path, 'base.yaml'))) {\n      return path;\n    }\n  }\n\n  throw new Error(\n    `Config files not found. Searched in:\\n${possiblePaths.map((p) => `  - ${p}`).join('\\n')}`,\n  );\n}\n\nfunction loadYamlFile(dir: string, filename: string): Record<string, unknown> {\n  const filePath = join(dir, filename);\n\n  if (!existsSync(filePath)) {\n    return {};\n  }\n\n  const content = readFileSync(filePath, 'utf8');\n  return (yaml.load(content) as Record<string, unknown>) || {};\n}\n\nfunction loadOverrideDir(dir: string): Record<string, unknown>[] {\n  if (!existsSync(dir)) {\n    return [];\n  }\n\n  const files = readdirSync(dir)\n    .filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'))\n    .sort();\n\n  return files.map((file) => loadYamlFile(dir, file));\n}\n"]}
+{"version":3,"sources":["../src/utils/deep-merge.ts","../src/utils/env-replacer.ts","../src/utils/mask-secrets.ts","../src/utils/strip-empty.ts","../src/utils/vault-client.ts","../src/utils/aws-secrets-client.ts","../src/loader.ts"],"names":["isPlainObject","config"],"mappings":";;;;;;;;;;AAEO,SAAS,SAAA,CAAU,MAAkB,QAAA,EAAkC;AAC5E,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,IAAA,EAAK;AAEzB,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,IAAA,MAAM,aAAA,GAAgB,SAAS,GAAG,CAAA;AAClC,IAAA,MAAM,SAAA,GAAY,KAAK,GAAG,CAAA;AAE1B,IAAA,IAAI,aAAA,CAAc,aAAa,CAAA,IAAK,aAAA,CAAc,SAAS,CAAA,EAAG;AAC5D,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,SAAA,CAAU,SAAA,EAAyB,aAA2B,CAAA;AAAA,IAC9E,CAAA,MAAO;AACL,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,aAAA;AAAA,IAChB;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,cAAc,KAAA,EAAqC;AAC1D,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;;;AClBA,IAAM,qBAAA,GAAwB,YAAA;AAC9B,IAAM,YAAA,GAAe,QAAA;AACrB,IAAM,UAAA,GAAa,MAAA;AAOZ,SAAS,mBAAA,CAAoB,GAAA,EAAc,OAAA,GAAsC,EAAC,EAAY;AACnG,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,OAAO,yBAAA,CAA0B,KAAK,OAAO,CAAA;AAAA,EAC/C;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,OAAO,IAAI,GAAA,CAAI,CAAC,SAAS,mBAAA,CAAoB,IAAA,EAAM,OAAO,CAAC,CAAA;AAAA,EAC7D;AAEA,EAAA,IAAIA,cAAAA,CAAc,GAAG,CAAA,EAAG;AACtB,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AAClC,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,mBAAA,CAAoB,GAAA,CAAI,GAAG,GAAG,OAAO,CAAA;AAAA,IACrD;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,yBAAA,CAA0B,KAAa,OAAA,EAA6C;AAC3F,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,qBAAA,EAAuB,CAAC,OAAO,GAAA,KAAQ;AAExD,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAChC,MAAA,OAAO,uBAAA,CAAwB,GAAA,EAAK,KAAA,EAAO,OAAO,CAAA;AAAA,IACpD;AAGA,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,UAAU,CAAA,EAAG;AAC9B,MAAA,OAAO,qBAAA,CAAsB,GAAA,EAAK,KAAA,EAAO,OAAO,CAAA;AAAA,IAClD;AAGA,IAAA,OAAO,qBAAA,CAAsB,GAAA,EAAK,KAAA,EAAO,OAAO,CAAA;AAAA,EAClD,CAAC,CAAA;AACH;AAEA,SAAS,uBAAA,CACP,GAAA,EACA,aAAA,EACA,OAAA,EACQ;AAER,EAAA,MAAM,QAAQ,GAAA,CAAI,SAAA,CAAU,aAAa,MAAM,CAAA,CAAE,MAAM,GAAG,CAAA;AAE1D,EAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,qCAAqC,aAAa,CAAA,gEAAA;AAAA,KAEpD;AAAA,EACF;AAEA,EAAA,MAAM,CAAC,IAAA,EAAM,KAAA,EAAO,GAAG,YAAY,CAAA,GAAI,KAAA;AACvC,EAAA,MAAM,eAAe,YAAA,CAAa,MAAA,GAAS,IAAI,YAAA,CAAa,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AAExE,EAAA,IAAI,CAAC,QAAQ,WAAA,EAAa;AACxB,IAAA,IAAI,iBAAiB,MAAA,EAAW;AAC9B,MAAA,OAAO,YAAA;AAAA,IACT;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,aAAa,CAAA,qCAAA,CAAuC,CAAA;AAAA,EAC5F;AAEA,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,WAAA,CAAY,SAAA,CAAU,MAAM,KAAK,CAAA;AAE7D,EAAA,IAAI,gBAAgB,MAAA,EAAW;AAC7B,IAAA,OAAO,OAAO,WAAW,CAAA;AAAA,EAC3B;AAEA,EAAA,IAAI,iBAAiB,MAAA,EAAW;AAC9B,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,cAAA,EAAiB,KAAK,CAAA,qBAAA,EAAwB,IAAI,CAAA,+BAAA,CAAiC,CAAA;AACrG;AAEA,SAAS,qBAAA,CACP,GAAA,EACA,aAAA,EACA,OAAA,EACQ;AAER,EAAA,MAAM,QAAQ,GAAA,CAAI,SAAA,CAAU,WAAW,MAAM,CAAA,CAAE,MAAM,GAAG,CAAA;AAExD,EAAA,IAAI,MAAM,MAAA,GAAS,CAAA,IAAK,CAAC,KAAA,CAAM,CAAC,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,mCAAmC,aAAa,CAAA,iGAAA;AAAA,KAElD;AAAA,EACF;AAEA,EAAA,MAAM,CAAC,UAAA,EAAY,KAAA,EAAO,GAAG,YAAY,CAAA,GAAI,KAAA;AAC7C,EAAA,MAAM,eAAe,YAAA,CAAa,MAAA,GAAS,IAAI,YAAA,CAAa,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AAExE,EAAA,IAAI,CAAC,QAAQ,SAAA,EAAW;AACtB,IAAA,IAAI,iBAAiB,MAAA,EAAW;AAC9B,MAAA,OAAO,YAAA;AAAA,IACT;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,aAAa,CAAA,mCAAA,CAAqC,CAAA;AAAA,EACxF;AAEA,EAAA,MAAM,cAAc,OAAA,CAAQ,SAAA,CAAU,SAAA,CAAU,UAAA,EAAY,SAAS,MAAS,CAAA;AAE9E,EAAA,IAAI,gBAAgB,MAAA,EAAW;AAC7B,IAAA,OAAO,OAAO,WAAW,CAAA;AAAA,EAC3B;AAEA,EAAA,IAAI,iBAAiB,MAAA,EAAW;AAC9B,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,KAAK,CAAA,gBAAA,EAAmB,UAAU,CAAA,+BAAA,CAAiC,CAAA;AAAA,EAC1G,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,YAAA,EAAe,UAAU,CAAA,yCAAA,CAA2C,CAAA;AAAA,EACtF;AACF;AAEA,SAAS,qBAAA,CAAsB,GAAA,EAAa,MAAA,EAAgB,OAAA,EAA6C;AACvG,EAAA,MAAM,CAAC,MAAA,EAAQ,GAAG,IAAI,CAAA,GAAI,GAAA,CAAI,MAAM,GAAG,CAAA;AACvC,EAAA,MAAM,eAAe,IAAA,CAAK,MAAA,GAAS,IAAI,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AACxD,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA;AAEnC,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,IAAA,KAAA,GAAQ,QAAA;AAAA,EACV,CAAA,MAAA,IAAW,iBAAiB,MAAA,EAAW;AACrC,IAAA,KAAA,GAAQ,YAAA;AAAA,EACV,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,MAAM,CAAA,8CAAA,CAAgD,CAAA;AAAA,EACjG;AAGA,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,IAAI,CAAA,EAAG;AACxB,IAAA,OAAO,mBAAA,CAAoB,OAAO,OAAO,CAAA;AAAA,EAC3C;AAEA,EAAA,OAAO,KAAA;AACT;AAEA,SAASA,eAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;;;ACzJA,IAAM,eAAA,GAAkB,CAAC,OAAA,EAAS,UAAA,EAAY,UAAU,KAAA,EAAO,QAAA,EAAU,WAAW,YAAY,CAAA;AAEhG,IAAM,0BAAA,GAA6B,sCAAA;AAE5B,SAAS,YAAY,GAAA,EAAuB;AACjD,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,OAAO,mBAAmB,GAAG,CAAA;AAAA,EAC/B;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,OAAO,IAAI,GAAA,CAAI,CAAC,IAAA,KAAS,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5C;AAEA,EAAA,IAAIA,cAAAA,CAAc,GAAG,CAAA,EAAG;AACtB,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AAClC,MAAA,MAAM,KAAA,GAAQ,IAAI,GAAG,CAAA;AACrB,MAAA,IAAI,WAAA,CAAY,GAAG,CAAA,EAAG;AACpB,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,SAAA,CAAU,KAAK,CAAA;AAAA,MAC/B,CAAA,MAAO;AACL,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,WAAA,CAAY,KAAK,CAAA;AAAA,MACjC;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,YAAY,GAAA,EAAsB;AACzC,EAAA,MAAM,QAAA,GAAW,IAAI,WAAA,EAAY;AACjC,EAAA,OAAO,gBAAgB,IAAA,CAAK,CAAC,YAAY,QAAA,CAAS,QAAA,CAAS,OAAO,CAAC,CAAA;AACrE;AAEA,SAAS,UAAU,KAAA,EAAwB;AACzC,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,KAAA,CAAM,UAAU,CAAA,EAAG;AACrB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA,CAAM,MAAM,CAAA,EAAG,CAAC,IAAI,KAAA,GAAQ,KAAA,CAAM,MAAM,EAAE,CAAA;AACnD;AAEA,SAAS,mBAAmB,GAAA,EAAqB;AAC/C,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,0BAA0B,CAAA;AAClD,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAM,GAAG,QAAA,EAAU,IAAA,IAAQ,IAAI,CAAA,GAAI,KAAA;AACnC,IAAA,OAAO,CAAA,EAAG,QAAQ,CAAA,EAAG,IAAI,QAAQ,IAAI,CAAA,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAASA,eAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;;;ACvDO,SAAS,WAAW,GAAA,EAAuB;AAChD,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,OAAO,GAAA,KAAQ,KAAK,MAAA,GAAY,GAAA;AAAA,EAClC;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtB,IAAA,OAAO,GAAA,CAAI,GAAA,CAAI,CAAC,IAAA,KAAS,UAAA,CAAW,IAAI,CAAC,CAAA,CAAE,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,KAAS,MAAS,CAAA;AAAA,EAChF;AAEA,EAAA,IAAIA,cAAAA,CAAc,GAAG,CAAA,EAAG;AACtB,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,IAAI,SAAA,GAAY,KAAA;AAEhB,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AAClC,MAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,GAAG,CAAC,CAAA;AACjC,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AACd,QAAA,SAAA,GAAY,IAAA;AAAA,MACd;AAAA,IACF;AAEA,IAAA,OAAO,YAAY,MAAA,GAAS,MAAA;AAAA,EAC9B;AAEA,EAAA,OAAO,GAAA;AACT;AAEA,SAASA,eAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AC1BA,IAAM,uBAAA,GAA0B,2CAAA;AAWhC,eAAsB,kBAAkB,OAAA,EAA6C;AACnF,EAAA,MAAM,QAAQ,SAAA,CAAU;AAAA,IACtB,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,UAAA,EAAY,IAAA;AAAA,IACZ,WAAW,OAAA,CAAQ;AAAA,GACpB,CAAA;AAGD,EAAA,MAAM,WAAA,GAAc,MAAM,KAAA,CAAM,YAAA,CAAa;AAAA,IAC3C,SAAS,OAAA,CAAQ,MAAA;AAAA,IACjB,WAAW,OAAA,CAAQ;AAAA,GACpB,CAAA;AAED,EAAA,KAAA,CAAM,KAAA,GAAQ,YAAY,IAAA,CAAK,YAAA;AAE/B,EAAA,MAAM,QAA0B,EAAC;AAEjC,EAAA,OAAO;AAAA,IACL,MAAM,aAAa,GAAA,EAAyC;AAC1D,MAAA,MAAM,KAAA,GAAQ,kBAAkB,GAAG,CAAA;AAGnC,MAAA,MAAM,OAAA,CAAQ,GAAA;AAAA,QACZ,KAAA,CAAM,GAAA,CAAI,OAAO,IAAA,KAAS;AACxB,UAAA,IAAI,CAAC,KAAA,CAAM,IAAI,CAAA,EAAG;AAChB,YAAA,IAAI;AACF,cAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAGpC,cAAA,KAAA,CAAM,IAAI,CAAA,GAAI,MAAA,CAAO,MAAM,IAAA,IAAQ,MAAA,CAAO,QAAQ,EAAC;AAAA,YACrD,CAAA,CAAA,MAAQ;AAEN,cAAA,KAAA,CAAM,IAAI,IAAI,EAAC;AAAA,YACjB;AAAA,UACF;AAAA,QACF,CAAC;AAAA,OACH;AAEA,MAAA,OAAO,KAAA;AAAA,IACT,CAAA;AAAA,IAEA,SAAA,CAAU,MAAc,KAAA,EAAwB;AAC9C,MAAA,OAAO,KAAA,CAAM,IAAI,CAAA,GAAI,KAAK,CAAA;AAAA,IAC5B;AAAA,GACF;AACF;AAKA,SAAS,kBAAkB,GAAA,EAAwB;AACjD,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAE9B,EAAA,SAAS,SAAS,KAAA,EAAsB;AACtC,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,MAAA,IAAI,KAAA;AACJ,MAAA,OAAA,CAAQ,KAAA,GAAQ,uBAAA,CAAwB,IAAA,CAAK,KAAK,OAAO,IAAA,EAAM;AAC7D,QAAA,KAAA,CAAM,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,MACpB;AACA,MAAA,uBAAA,CAAwB,SAAA,GAAY,CAAA;AAAA,IACtC,CAAA,MAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC/B,MAAA,KAAA,CAAM,QAAQ,QAAQ,CAAA;AAAA,IACxB,CAAA,MAAA,IAAW,KAAA,KAAU,IAAA,IAAQ,OAAO,UAAU,QAAA,EAAU;AACtD,MAAA,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,CAAE,OAAA,CAAQ,QAAQ,CAAA;AAAA,IACvC;AAAA,EACF;AAEA,EAAA,QAAA,CAAS,GAAG,CAAA;AACZ,EAAA,OAAO,KAAA,CAAM,KAAK,KAAK,CAAA;AACzB;AChFA,IAAM,qBAAA,GAAwB,8CAAA;AAW9B,eAAsB,uBAAuB,OAAA,EAAuD;AAClG,EAAA,MAAM,MAAA,GAAS,IAAI,oBAAA,CAAqB;AAAA,IACtC,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,WAAA,EAAa;AAAA,MACX,aAAa,OAAA,CAAQ,WAAA;AAAA,MACrB,iBAAiB,OAAA,CAAQ;AAAA;AAC3B,GACD,CAAA;AAED,EAAA,MAAM,QAAyB,EAAC;AAEhC,EAAA,OAAO;AAAA,IACL,MAAM,aAAa,GAAA,EAAwC;AACzD,MAAA,MAAM,WAAA,GAAc,sBAAsB,GAAG,CAAA;AAG7C,MAAA,MAAM,OAAA,CAAQ,GAAA;AAAA,QACZ,WAAA,CAAY,GAAA,CAAI,OAAO,UAAA,KAAe;AACpC,UAAA,IAAI,KAAA,CAAM,UAAU,CAAA,KAAM,MAAA,EAAW;AACnC,YAAA,IAAI;AACF,cAAA,MAAM,UAAU,IAAI,qBAAA,CAAsB,EAAE,QAAA,EAAU,YAAY,CAAA;AAClE,cAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA;AAE1C,cAAA,MAAM,eAAe,QAAA,CAAS,YAAA;AAC9B,cAAA,IAAI,YAAA,EAAc;AAEhB,gBAAA,IAAI;AACF,kBAAA,KAAA,CAAM,UAAU,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,YAAY,CAAA;AAAA,gBAC7C,CAAA,CAAA,MAAQ;AACN,kBAAA,KAAA,CAAM,UAAU,CAAA,GAAI,YAAA;AAAA,gBACtB;AAAA,cACF,CAAA,MAAO;AACL,gBAAA,KAAA,CAAM,UAAU,IAAI,EAAC;AAAA,cACvB;AAAA,YACF,CAAA,CAAA,MAAQ;AAEN,cAAA,KAAA,CAAM,UAAU,IAAI,EAAC;AAAA,YACvB;AAAA,UACF;AAAA,QACF,CAAC;AAAA,OACH;AAEA,MAAA,OAAO,KAAA;AAAA,IACT,CAAA;AAAA,IAEA,SAAA,CAAU,YAAoB,KAAA,EAAyB;AACrD,MAAA,MAAM,MAAA,GAAS,MAAM,UAAU,CAAA;AAE/B,MAAA,IAAI,WAAW,MAAA,EAAW;AACxB,QAAA,OAAO,MAAA;AAAA,MACT;AAGA,MAAA,IAAI,CAAC,KAAA,EAAO;AACV,QAAA,OAAO,OAAO,MAAA,KAAW,QAAA,GAAW,MAAA,GAAS,MAAA;AAAA,MAC/C;AAGA,MAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,IAAA,EAAM;AACjD,QAAA,OAAQ,OAAmC,KAAK,CAAA;AAAA,MAClD;AAEA,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,GACF;AACF;AAKA,SAAS,sBAAsB,GAAA,EAAwB;AACrD,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAE9B,EAAA,SAAS,SAAS,KAAA,EAAsB;AACtC,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,MAAA,IAAI,KAAA;AACJ,MAAA,OAAA,CAAQ,KAAA,GAAQ,qBAAA,CAAsB,IAAA,CAAK,KAAK,OAAO,IAAA,EAAM;AAC3D,QAAA,KAAA,CAAM,GAAA,CAAI,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,MACpB;AACA,MAAA,qBAAA,CAAsB,SAAA,GAAY,CAAA;AAAA,IACpC,CAAA,MAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC/B,MAAA,KAAA,CAAM,QAAQ,QAAQ,CAAA;AAAA,IACxB,CAAA,MAAA,IAAW,KAAA,KAAU,IAAA,IAAQ,OAAO,UAAU,QAAA,EAAU;AACtD,MAAA,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,CAAE,OAAA,CAAQ,QAAQ,CAAA;AAAA,IACvC;AAAA,EACF;AAEA,EAAA,QAAA,CAAS,GAAG,CAAA;AACZ,EAAA,OAAO,KAAA,CAAM,KAAK,KAAK,CAAA;AACzB;;;ACvFA,IAAM,eAAA,GAAkB;AAAA,EACtB,SAAA,EAAW,QAAQ,GAAA,EAAI;AAAA,EACvB,YAAA,EAAc,MAAA;AAAA,EACd,WAAA,EAAa,OAAA,CAAQ,GAAA,CAAI,QAAA,IAAY,OAAA;AAAA,EACrC,SAAA,EAAW,KAAA;AAAA,EACX,WAAA,EAAa;AACf,CAAA;AAEO,SAAS,UAAA,CAAc,OAAA,GAAkC,EAAC,EAA0B;AACzF,EAAA,IAAI,OAAA,CAAQ,KAAA,IAAS,OAAA,CAAQ,GAAA,EAAK;AAChC,IAAA,MAAM,IAAI,MAAM,wFAAwF,CAAA;AAAA,EAC1G;AAEA,EAAA,MAAM,IAAA,GAAO,EAAE,GAAG,eAAA,EAAiB,GAAG,OAAA,EAAQ;AAC9C,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,WAAA,EAAa,WAAU,GAAI,IAAA;AAG5D,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,UAAA,CAAW,OAAA,CAAQ,QAAQ,WAAW,CAAA;AAAA,EACxC;AAEA,EAAA,MAAM,iBAAA,GAAoB,iBAAiB,SAAS,CAAA;AAEpD,EAAA,MAAM,aAAa,YAAA,CAAa,iBAAA,EAAmB,GAAG,YAAY,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AACjF,EAAA,MAAM,YAAY,YAAA,CAAa,iBAAA,EAAmB,GAAG,WAAW,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AAE/E,EAAA,IAAI,YAAA,GAAe,SAAA,CAAU,UAAA,EAAY,SAAS,CAAA;AAGlD,EAAA,MAAM,cAAc,OAAA,CAAQ,WAAA,KAAgB,QAAS,OAAA,CAAQ,WAAA,IAAe,gBAAgB,WAAA,GAAe,IAAA;AAC3G,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,MAAM,eAAA,GAAkB,gBAAgB,WAAW,CAAA;AACnD,IAAA,KAAA,MAAW,YAAY,eAAA,EAAiB;AACtC,MAAA,YAAA,GAAe,SAAA,CAAU,cAAc,QAAQ,CAAA;AAAA,IACjD;AAAA,EACF;AAEA,EAAA,IAAIC,OAAAA,GAAS,oBAAoB,YAAY,CAAA;AAG7C,EAAA,IAAI,QAAQ,UAAA,EAAY;AACtB,IAAAA,OAAAA,GAAS,WAAWA,OAAM,CAAA;AAAA,EAC5B;AAGA,EAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,IAAAA,OAAAA,GAAS,OAAA,CAAQ,WAAA,CAAYA,OAAM,CAAA;AAAA,EACrC;AAGA,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,SAAA,CAAUA,OAAM,CAAA;AAC9C,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,SAAS,MAAA,CAAO,KAAA,CAAM,OACzB,GAAA,CAAI,CAAC,MAAM,CAAA,IAAA,EAAO,CAAA,CAAE,KAAK,IAAA,CAAK,GAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA,CAClD,KAAK,IAAI,CAAA;AACZ,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA;AAAA,EAA8B,MAAM,CAAA,CAAE,CAAA;AAAA,IACxD;AACA,IAAAA,UAAS,MAAA,CAAO,IAAA;AAAA,EAClB;AAGA,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,MAAM,YAAA,GAAe,YAAYA,OAAM,CAAA;AACvC,IAAA,OAAA,CAAQ,MAAA,CAAO,kBAAkB,WAAW,CAAA;AAAA,EAAO,KAAK,SAAA,CAAU,YAAA,EAAc,IAAA,EAAM,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC5F;AAEA,EAAA,OAAO;AAAA,IACL,MAAA,EAAAA,OAAAA;AAAA,IACA,WAAA;AAAA,IACA,SAAA,EAAW;AAAA,GACb;AACF;AAEA,eAAsB,eAAA,CACpB,OAAA,GAAkC,EAAC,EACH;AAChC,EAAA,MAAM,IAAA,GAAO,EAAE,GAAG,eAAA,EAAiB,GAAG,OAAA,EAAQ;AAC9C,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAc,WAAA,EAAa,WAAU,GAAI,IAAA;AAG5D,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,UAAA,CAAW,OAAA,CAAQ,QAAQ,WAAW,CAAA;AAAA,EACxC;AAEA,EAAA,MAAM,iBAAA,GAAoB,iBAAiB,SAAS,CAAA;AAEpD,EAAA,MAAM,aAAa,YAAA,CAAa,iBAAA,EAAmB,GAAG,YAAY,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AACjF,EAAA,MAAM,YAAY,YAAA,CAAa,iBAAA,EAAmB,GAAG,WAAW,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AAE/E,EAAA,IAAI,YAAA,GAAe,SAAA,CAAU,UAAA,EAAY,SAAS,CAAA;AAGlD,EAAA,MAAM,cAAc,OAAA,CAAQ,WAAA,KAAgB,QAAS,OAAA,CAAQ,WAAA,IAAe,gBAAgB,WAAA,GAAe,IAAA;AAC3G,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,MAAM,eAAA,GAAkB,gBAAgB,WAAW,CAAA;AACnD,IAAA,KAAA,MAAW,YAAY,eAAA,EAAiB;AACtC,MAAA,YAAA,GAAe,SAAA,CAAU,cAAc,QAAQ,CAAA;AAAA,IACjD;AAAA,EACF;AAGA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,WAAA,GAAc,MAAM,iBAAA,CAAkB,OAAA,CAAQ,KAAK,CAAA;AACnD,IAAA,MAAM,WAAA,CAAY,aAAa,YAAY,CAAA;AAAA,EAC7C;AAGA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,QAAQ,GAAA,EAAK;AACf,IAAA,SAAA,GAAY,MAAM,sBAAA,CAAuB,OAAA,CAAQ,GAAG,CAAA;AACpD,IAAA,MAAM,SAAA,CAAU,aAAa,YAAY,CAAA;AAAA,EAC3C;AAGA,EAAA,IAAIA,UAAS,mBAAA,CAAoB,YAAA,EAAc,EAAE,WAAA,EAAa,WAAW,CAAA;AAGzE,EAAA,IAAI,QAAQ,UAAA,EAAY;AACtB,IAAAA,OAAAA,GAAS,WAAWA,OAAM,CAAA;AAAA,EAC5B;AAGA,EAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,IAAAA,OAAAA,GAAS,OAAA,CAAQ,WAAA,CAAYA,OAAM,CAAA;AAAA,EACrC;AAGA,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,SAAA,CAAUA,OAAM,CAAA;AAC9C,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,SAAS,MAAA,CAAO,KAAA,CAAM,OACzB,GAAA,CAAI,CAAC,MAAM,CAAA,IAAA,EAAO,CAAA,CAAE,KAAK,IAAA,CAAK,GAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA,CAClD,KAAK,IAAI,CAAA;AACZ,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA;AAAA,EAA8B,MAAM,CAAA,CAAE,CAAA;AAAA,IACxD;AACA,IAAAA,UAAS,MAAA,CAAO,IAAA;AAAA,EAClB;AAGA,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAA,MAAM,YAAA,GAAe,YAAYA,OAAM,CAAA;AACvC,IAAA,OAAA,CAAQ,MAAA,CAAO,kBAAkB,WAAW,CAAA;AAAA,EAAO,KAAK,SAAA,CAAU,YAAA,EAAc,IAAA,EAAM,CAAC,CAAC,CAAA,CAAE,CAAA;AAAA,EAC5F;AAEA,EAAA,OAAO;AAAA,IACL,MAAA,EAAAA,OAAAA;AAAA,IACA,WAAA;AAAA,IACA,SAAA,EAAW;AAAA,GACb;AACF;AAEA,SAAS,UAAA,CACP,cACA,WAAA,EACM;AACN,EAAA,IAAI,OAAA;AAEJ,EAAA,IAAI,OAAO,YAAA,KAAiB,QAAA,IAAY,YAAA,CAAa,IAAA,EAAM;AACzD,IAAA,OAAA,GAAU,YAAA,CAAa,IAAA;AAAA,EACzB,CAAA,MAAO;AACL,IAAA,OAAA,GAAU,WAAA,KAAgB,YAAA,GAAe,MAAA,GAAS,CAAA,KAAA,EAAQ,WAAW,CAAA,CAAA;AAAA,EACvE;AAEA,EAAO,MAAA,CAAA,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,CAAA;AACjC;AAEA,SAAS,iBAAiB,SAAA,EAA2B;AACnD,EAAA,MAAM,aAAA,GAAgB;AAAA,IACpB,IAAA,CAAK,SAAA,EAAW,KAAA,EAAO,QAAQ,CAAA;AAAA,IAC/B,IAAA,CAAK,SAAA,EAAW,MAAA,EAAQ,QAAQ,CAAA;AAAA,IAChC,IAAA,CAAK,WAAW,QAAQ,CAAA;AAAA,IACxB;AAAA,GACF;AAEA,EAAA,KAAA,MAAW,QAAQ,aAAA,EAAe;AAChC,IAAA,IAAI,UAAA,CAAW,IAAA,CAAK,IAAA,EAAM,UAAU,CAAC,CAAA,IAAK,UAAA,CAAW,IAAA,CAAK,IAAA,EAAM,WAAW,CAAC,CAAA,EAAG;AAC7E,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,CAAA;AAAA,EAAyC,aAAA,CAAc,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,GAC1F;AACF;AAEA,SAAS,YAAA,CAAa,KAAa,QAAA,EAA2C;AAC5E,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAK,QAAQ,CAAA;AAEnC,EAAA,IAAI,CAAC,UAAA,CAAW,QAAQ,CAAA,EAAG;AACzB,IAAA,OAAO,EAAC;AAAA,EACV;AAEA,EAAA,MAAM,OAAA,GAAU,YAAA,CAAa,QAAA,EAAU,MAAM,CAAA;AAC7C,EAAA,OAAa,IAAA,CAAA,IAAA,CAAK,OAAO,CAAA,IAAiC,EAAC;AAC7D;AAEA,SAAS,gBAAgB,GAAA,EAAwC;AAC/D,EAAA,IAAI,CAAC,UAAA,CAAW,GAAG,CAAA,EAAG;AACpB,IAAA,OAAO,EAAC;AAAA,EACV;AAEA,EAAA,MAAM,QAAQ,WAAA,CAAY,GAAG,CAAA,CAC1B,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,CAAS,MAAM,KAAK,CAAA,CAAE,QAAA,CAAS,OAAO,CAAC,EACvD,IAAA,EAAK;AAER,EAAA,OAAO,MAAM,GAAA,CAAI,CAAC,SAAS,YAAA,CAAa,GAAA,EAAK,IAAI,CAAC,CAAA;AACpD","file":"index.mjs","sourcesContent":["type DeepObject = Record<string, unknown>;\n\nexport function deepMerge(base: DeepObject, override: DeepObject): DeepObject {\n  const merged = { ...base };\n\n  for (const key in override) {\n    const overrideValue = override[key];\n    const baseValue = base[key];\n\n    if (isPlainObject(overrideValue) && isPlainObject(baseValue)) {\n      merged[key] = deepMerge(baseValue as DeepObject, overrideValue as DeepObject);\n    } else {\n      merged[key] = overrideValue;\n    }\n  }\n\n  return merged;\n}\n\nfunction isPlainObject(value: unknown): value is DeepObject {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n","import type { VaultClient } from './vault-client.js';\nimport type { AwsSecretsClient } from './aws-secrets-client.js';\n\nconst ENV_PLACEHOLDER_REGEX = /\\${(.*?)}/g;\nconst VAULT_PREFIX = 'vault:';\nconst AWS_PREFIX = 'aws:';\n\nexport interface ReplacePlaceholdersOptions {\n  vaultClient?: VaultClient;\n  awsClient?: AwsSecretsClient;\n}\n\nexport function replacePlaceholders(obj: unknown, options: ReplacePlaceholdersOptions = {}): unknown {\n  if (typeof obj === 'string') {\n    return replaceStringPlaceholders(obj, options);\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) => replacePlaceholders(item, options));\n  }\n\n  if (isPlainObject(obj)) {\n    const result: Record<string, unknown> = {};\n    for (const key of Object.keys(obj)) {\n      result[key] = replacePlaceholders(obj[key], options);\n    }\n    return result;\n  }\n\n  return obj;\n}\n\nfunction replaceStringPlaceholders(str: string, options: ReplacePlaceholdersOptions): string {\n  return str.replace(ENV_PLACEHOLDER_REGEX, (match, key) => {\n    // Handle Vault placeholders: ${vault:path:field} or ${vault:path:field:default}\n    if (key.startsWith(VAULT_PREFIX)) {\n      return resolveVaultPlaceholder(key, match, options);\n    }\n\n    // Handle AWS placeholders: ${aws:secret:field} or ${aws:secret:field:default} or ${aws:secret}\n    if (key.startsWith(AWS_PREFIX)) {\n      return resolveAwsPlaceholder(key, match, options);\n    }\n\n    // Handle environment variable placeholders: ${VAR} or ${VAR:default}\n    return resolveEnvPlaceholder(key, match, options);\n  });\n}\n\nfunction resolveVaultPlaceholder(\n  key: string,\n  originalMatch: string,\n  options: ReplacePlaceholdersOptions,\n): string {\n  // Parse: vault:secret/data/api:DB_PASSWORD:default_value\n  const parts = key.substring(VAULT_PREFIX.length).split(':');\n\n  if (parts.length < 2) {\n    throw new Error(\n      `Invalid Vault placeholder format \"${originalMatch}\". ` +\n        `Expected \\${vault:path:field} or \\${vault:path:field:default}`,\n    );\n  }\n\n  const [path, field, ...defaultParts] = parts;\n  const defaultValue = defaultParts.length > 0 ? defaultParts.join(':') : undefined;\n\n  if (!options.vaultClient) {\n    if (defaultValue !== undefined) {\n      return defaultValue;\n    }\n    throw new Error(`Vault placeholder \"${originalMatch}\" found but no Vault options provided`);\n  }\n\n  const secretValue = options.vaultClient.getSecret(path, field);\n\n  if (secretValue !== undefined) {\n    return String(secretValue);\n  }\n\n  if (defaultValue !== undefined) {\n    return defaultValue;\n  }\n\n  throw new Error(`Vault secret \"${field}\" not found at path \"${path}\" and no default value provided`);\n}\n\nfunction resolveAwsPlaceholder(\n  key: string,\n  originalMatch: string,\n  options: ReplacePlaceholdersOptions,\n): string {\n  // Parse: aws:secret-name:field:default or aws:secret-name:field or aws:secret-name\n  const parts = key.substring(AWS_PREFIX.length).split(':');\n\n  if (parts.length < 1 || !parts[0]) {\n    throw new Error(\n      `Invalid AWS placeholder format \"${originalMatch}\". ` +\n        `Expected \\${aws:secret-name} or \\${aws:secret-name:field} or \\${aws:secret-name:field:default}`,\n    );\n  }\n\n  const [secretName, field, ...defaultParts] = parts;\n  const defaultValue = defaultParts.length > 0 ? defaultParts.join(':') : undefined;\n\n  if (!options.awsClient) {\n    if (defaultValue !== undefined) {\n      return defaultValue;\n    }\n    throw new Error(`AWS placeholder \"${originalMatch}\" found but no AWS options provided`);\n  }\n\n  const secretValue = options.awsClient.getSecret(secretName, field || undefined);\n\n  if (secretValue !== undefined) {\n    return String(secretValue);\n  }\n\n  if (defaultValue !== undefined) {\n    return defaultValue;\n  }\n\n  if (field) {\n    throw new Error(`AWS secret field \"${field}\" not found in \"${secretName}\" and no default value provided`);\n  } else {\n    throw new Error(`AWS secret \"${secretName}\" not found and no default value provided`);\n  }\n}\n\nfunction resolveEnvPlaceholder(key: string, _match: string, options: ReplacePlaceholdersOptions): string {\n  const [envKey, ...rest] = key.split(':');\n  const defaultValue = rest.length > 0 ? rest.join(':') : undefined;\n  const envValue = process.env[envKey];\n\n  let value: string;\n  if (envValue !== undefined) {\n    value = envValue;\n  } else if (defaultValue !== undefined) {\n    value = defaultValue;\n  } else {\n    throw new Error(`Environment variable \"${envKey}\" is not defined and no default value provided`);\n  }\n\n  // Handle nested placeholders\n  if (value.includes('${')) {\n    return replacePlaceholders(value, options) as string;\n  }\n\n  return value;\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n","const SECRET_PATTERNS = ['token', 'password', 'secret', 'key', 'apikey', 'api_key', 'credential'];\n\nconst URL_WITH_CREDENTIALS_REGEX = /^([a-z]+:\\/\\/)([^:]+):([^@]+)@(.+)$/i;\n\nexport function maskSecrets(obj: unknown): unknown {\n  if (typeof obj === 'string') {\n    return maskUrlCredentials(obj);\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) => maskSecrets(item));\n  }\n\n  if (isPlainObject(obj)) {\n    const result: Record<string, unknown> = {};\n    for (const key of Object.keys(obj)) {\n      const value = obj[key];\n      if (isSecretKey(key)) {\n        result[key] = maskValue(value);\n      } else {\n        result[key] = maskSecrets(value);\n      }\n    }\n    return result;\n  }\n\n  return obj;\n}\n\nfunction isSecretKey(key: string): boolean {\n  const lowerKey = key.toLowerCase();\n  return SECRET_PATTERNS.some((pattern) => lowerKey.includes(pattern));\n}\n\nfunction maskValue(value: unknown): string {\n  if (typeof value !== 'string') {\n    return '***';\n  }\n  if (value.length <= 4) {\n    return '***';\n  }\n  return value.slice(0, 2) + '***' + value.slice(-2);\n}\n\nfunction maskUrlCredentials(url: string): string {\n  const match = url.match(URL_WITH_CREDENTIALS_REGEX);\n  if (match) {\n    const [, protocol, user, , host] = match;\n    return `${protocol}${user}:***@${host}`;\n  }\n  return url;\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n","export function stripEmpty(obj: unknown): unknown {\n  if (typeof obj === 'string') {\n    return obj === '' ? undefined : obj;\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) => stripEmpty(item)).filter((item) => item !== undefined);\n  }\n\n  if (isPlainObject(obj)) {\n    const result: Record<string, unknown> = {};\n    let hasValues = false;\n\n    for (const key of Object.keys(obj)) {\n      const value = stripEmpty(obj[key]);\n      if (value !== undefined) {\n        result[key] = value;\n        hasValues = true;\n      }\n    }\n\n    return hasValues ? result : undefined;\n  }\n\n  return obj;\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n","import NodeVault from 'node-vault';\nimport type { VaultOptions } from '../types.js';\n\nconst VAULT_PLACEHOLDER_REGEX = /\\${vault:([^:}]+):([^:}]+)(?::([^}]*))?}/g;\n\nexport interface VaultSecretCache {\n  [path: string]: Record<string, unknown>;\n}\n\nexport interface VaultClient {\n  fetchSecrets(obj: unknown): Promise<VaultSecretCache>;\n  getSecret(path: string, field: string): unknown;\n}\n\nexport async function createVaultClient(options: VaultOptions): Promise<VaultClient> {\n  const vault = NodeVault({\n    endpoint: options.endpoint,\n    apiVersion: 'v1',\n    namespace: options.namespace,\n  });\n\n  // Authenticate with AppRole\n  const loginResult = await vault.approleLogin({\n    role_id: options.roleId,\n    secret_id: options.secretId,\n  });\n\n  vault.token = loginResult.auth.client_token;\n\n  const cache: VaultSecretCache = {};\n\n  return {\n    async fetchSecrets(obj: unknown): Promise<VaultSecretCache> {\n      const paths = extractVaultPaths(obj);\n\n      // Fetch all unique paths in parallel\n      await Promise.all(\n        paths.map(async (path) => {\n          if (!cache[path]) {\n            try {\n              const result = await vault.read(path);\n              // Vault KV v2 stores data under result.data.data\n              // KV v1 stores under result.data\n              cache[path] = result.data?.data ?? result.data ?? {};\n            } catch {\n              // Store empty object for failed paths - will use defaults or throw later\n              cache[path] = {};\n            }\n          }\n        }),\n      );\n\n      return cache;\n    },\n\n    getSecret(path: string, field: string): unknown {\n      return cache[path]?.[field];\n    },\n  };\n}\n\n/**\n * Extract all unique Vault paths from config object\n */\nfunction extractVaultPaths(obj: unknown): string[] {\n  const paths = new Set<string>();\n\n  function traverse(value: unknown): void {\n    if (typeof value === 'string') {\n      let match;\n      while ((match = VAULT_PLACEHOLDER_REGEX.exec(value)) !== null) {\n        paths.add(match[1]); // path is first capture group\n      }\n      VAULT_PLACEHOLDER_REGEX.lastIndex = 0; // Reset regex state\n    } else if (Array.isArray(value)) {\n      value.forEach(traverse);\n    } else if (value !== null && typeof value === 'object') {\n      Object.values(value).forEach(traverse);\n    }\n  }\n\n  traverse(obj);\n  return Array.from(paths);\n}\n","import { SecretsManagerClient, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager';\nimport type { AwsSecretsOptions } from '../types.js';\n\nconst AWS_PLACEHOLDER_REGEX = /\\${aws:([^:}]+)(?::([^:}]+))?(?::([^}]*))?}/g;\n\nexport interface AwsSecretsCache {\n  [secretName: string]: string | Record<string, unknown>;\n}\n\nexport interface AwsSecretsClient {\n  fetchSecrets(obj: unknown): Promise<AwsSecretsCache>;\n  getSecret(secretName: string, field?: string): unknown;\n}\n\nexport async function createAwsSecretsClient(options: AwsSecretsOptions): Promise<AwsSecretsClient> {\n  const client = new SecretsManagerClient({\n    region: options.region,\n    credentials: {\n      accessKeyId: options.accessKeyId,\n      secretAccessKey: options.secretAccessKey,\n    },\n  });\n\n  const cache: AwsSecretsCache = {};\n\n  return {\n    async fetchSecrets(obj: unknown): Promise<AwsSecretsCache> {\n      const secretNames = extractAwsSecretNames(obj);\n\n      // Fetch all unique secrets in parallel\n      await Promise.all(\n        secretNames.map(async (secretName) => {\n          if (cache[secretName] === undefined) {\n            try {\n              const command = new GetSecretValueCommand({ SecretId: secretName });\n              const response = await client.send(command);\n\n              const secretString = response.SecretString;\n              if (secretString) {\n                // Try to parse as JSON, fallback to plain string\n                try {\n                  cache[secretName] = JSON.parse(secretString);\n                } catch {\n                  cache[secretName] = secretString;\n                }\n              } else {\n                cache[secretName] = {};\n              }\n            } catch {\n              // Store empty object for failed secrets - will use defaults or throw later\n              cache[secretName] = {};\n            }\n          }\n        }),\n      );\n\n      return cache;\n    },\n\n    getSecret(secretName: string, field?: string): unknown {\n      const secret = cache[secretName];\n\n      if (secret === undefined) {\n        return undefined;\n      }\n\n      // If no field specified, return the whole secret (plain string or parsed JSON)\n      if (!field) {\n        return typeof secret === 'string' ? secret : undefined;\n      }\n\n      // If field specified, secret must be an object\n      if (typeof secret === 'object' && secret !== null) {\n        return (secret as Record<string, unknown>)[field];\n      }\n\n      return undefined;\n    },\n  };\n}\n\n/**\n * Extract all unique AWS secret names from config object\n */\nfunction extractAwsSecretNames(obj: unknown): string[] {\n  const names = new Set<string>();\n\n  function traverse(value: unknown): void {\n    if (typeof value === 'string') {\n      let match;\n      while ((match = AWS_PLACEHOLDER_REGEX.exec(value)) !== null) {\n        names.add(match[1]); // secret name is first capture group\n      }\n      AWS_PLACEHOLDER_REGEX.lastIndex = 0; // Reset regex state\n    } else if (Array.isArray(value)) {\n      value.forEach(traverse);\n    } else if (value !== null && typeof value === 'object') {\n      Object.values(value).forEach(traverse);\n    }\n  }\n\n  traverse(obj);\n  return Array.from(names);\n}\n","import { readFileSync, existsSync, readdirSync } from 'fs';\nimport * as yaml from 'js-yaml';\nimport * as dotenv from 'dotenv';\nimport { join } from 'path';\nimport type { ConfigLoaderOptions, ConfigLoaderResult } from './types.js';\nimport {\n  deepMerge,\n  replacePlaceholders,\n  maskSecrets,\n  stripEmpty,\n  createVaultClient,\n  createAwsSecretsClient,\n  type VaultClient,\n  type AwsSecretsClient,\n} from './utils/index.js';\n\nconst DEFAULT_OPTIONS = {\n  configDir: process.cwd(),\n  baseFileName: 'base',\n  environment: process.env.NODE_ENV || 'local',\n  extension: 'yml' as const,\n  overrideDir: '/etc/app/config',\n};\n\nexport function loadConfig<T>(options: ConfigLoaderOptions<T> = {}): ConfigLoaderResult<T> {\n  if (options.vault || options.aws) {\n    throw new Error('Vault/AWS options require async loading. Use loadConfigAsync() instead of loadConfig()');\n  }\n\n  const opts = { ...DEFAULT_OPTIONS, ...options };\n  const { configDir, baseFileName, environment, extension } = opts;\n\n  // Load .env if requested\n  if (options.dotenv) {\n    loadDotenv(options.dotenv, environment);\n  }\n\n  const resolvedConfigDir = resolveConfigDir(configDir);\n\n  const baseConfig = loadYamlFile(resolvedConfigDir, `${baseFileName}.${extension}`);\n  const envConfig = loadYamlFile(resolvedConfigDir, `${environment}.${extension}`);\n\n  let mergedConfig = deepMerge(baseConfig, envConfig);\n\n  // Load override files from directory\n  const overrideDir = options.overrideDir !== false ? (options.overrideDir ?? DEFAULT_OPTIONS.overrideDir) : null;\n  if (overrideDir) {\n    const overrideConfigs = loadOverrideDir(overrideDir);\n    for (const override of overrideConfigs) {\n      mergedConfig = deepMerge(mergedConfig, override);\n    }\n  }\n\n  let config = replacePlaceholders(mergedConfig) as T;\n\n  // Strip empty strings and objects\n  if (options.stripEmpty) {\n    config = stripEmpty(config) as T;\n  }\n\n  // Post-process\n  if (options.postProcess) {\n    config = options.postProcess(config);\n  }\n\n  // Validate with Zod schema\n  if (options.schema) {\n    const result = options.schema.safeParse(config);\n    if (!result.success) {\n      const errors = result.error.issues\n        .map((e) => `  - ${e.path.join('.')}: ${e.message}`)\n        .join('\\n');\n      throw new Error(`Config validation failed:\\n${errors}`);\n    }\n    config = result.data;\n  }\n\n  // Log config with masked secrets\n  if (options.logger) {\n    const maskedConfig = maskSecrets(config);\n    options.logger(`Config loaded (${environment}):\\n${JSON.stringify(maskedConfig, null, 2)}`);\n  }\n\n  return {\n    config,\n    environment,\n    configDir: resolvedConfigDir,\n  };\n}\n\nexport async function loadConfigAsync<T>(\n  options: ConfigLoaderOptions<T> = {},\n): Promise<ConfigLoaderResult<T>> {\n  const opts = { ...DEFAULT_OPTIONS, ...options };\n  const { configDir, baseFileName, environment, extension } = opts;\n\n  // Load .env if requested\n  if (options.dotenv) {\n    loadDotenv(options.dotenv, environment);\n  }\n\n  const resolvedConfigDir = resolveConfigDir(configDir);\n\n  const baseConfig = loadYamlFile(resolvedConfigDir, `${baseFileName}.${extension}`);\n  const envConfig = loadYamlFile(resolvedConfigDir, `${environment}.${extension}`);\n\n  let mergedConfig = deepMerge(baseConfig, envConfig);\n\n  // Load override files from directory\n  const overrideDir = options.overrideDir !== false ? (options.overrideDir ?? DEFAULT_OPTIONS.overrideDir) : null;\n  if (overrideDir) {\n    const overrideConfigs = loadOverrideDir(overrideDir);\n    for (const override of overrideConfigs) {\n      mergedConfig = deepMerge(mergedConfig, override);\n    }\n  }\n\n  // Create Vault client and pre-fetch secrets if Vault options provided\n  let vaultClient: VaultClient | undefined;\n  if (options.vault) {\n    vaultClient = await createVaultClient(options.vault);\n    await vaultClient.fetchSecrets(mergedConfig);\n  }\n\n  // Create AWS Secrets Manager client and pre-fetch secrets if AWS options provided\n  let awsClient: AwsSecretsClient | undefined;\n  if (options.aws) {\n    awsClient = await createAwsSecretsClient(options.aws);\n    await awsClient.fetchSecrets(mergedConfig);\n  }\n\n  // Replace placeholders (with Vault and AWS support)\n  let config = replacePlaceholders(mergedConfig, { vaultClient, awsClient }) as T;\n\n  // Strip empty strings and objects\n  if (options.stripEmpty) {\n    config = stripEmpty(config) as T;\n  }\n\n  // Post-process\n  if (options.postProcess) {\n    config = options.postProcess(config);\n  }\n\n  // Validate with Zod schema\n  if (options.schema) {\n    const result = options.schema.safeParse(config);\n    if (!result.success) {\n      const errors = result.error.issues\n        .map((e) => `  - ${e.path.join('.')}: ${e.message}`)\n        .join('\\n');\n      throw new Error(`Config validation failed:\\n${errors}`);\n    }\n    config = result.data;\n  }\n\n  // Log config with masked secrets\n  if (options.logger) {\n    const maskedConfig = maskSecrets(config);\n    options.logger(`Config loaded (${environment}):\\n${JSON.stringify(maskedConfig, null, 2)}`);\n  }\n\n  return {\n    config,\n    environment,\n    configDir: resolvedConfigDir,\n  };\n}\n\nfunction loadDotenv(\n  dotenvOption: boolean | { path?: string },\n  environment: string,\n): void {\n  let envPath: string;\n\n  if (typeof dotenvOption === 'object' && dotenvOption.path) {\n    envPath = dotenvOption.path;\n  } else {\n    envPath = environment === 'production' ? '.env' : `.env.${environment}`;\n  }\n\n  dotenv.config({ path: envPath });\n}\n\nfunction resolveConfigDir(configDir: string): string {\n  const possiblePaths = [\n    join(configDir, 'src', 'config'),\n    join(configDir, 'dist', 'config'),\n    join(configDir, 'config'),\n    configDir,\n  ];\n\n  for (const path of possiblePaths) {\n    if (existsSync(join(path, 'base.yml')) || existsSync(join(path, 'base.yaml'))) {\n      return path;\n    }\n  }\n\n  throw new Error(\n    `Config files not found. Searched in:\\n${possiblePaths.map((p) => `  - ${p}`).join('\\n')}`,\n  );\n}\n\nfunction loadYamlFile(dir: string, filename: string): Record<string, unknown> {\n  const filePath = join(dir, filename);\n\n  if (!existsSync(filePath)) {\n    return {};\n  }\n\n  const content = readFileSync(filePath, 'utf8');\n  return (yaml.load(content) as Record<string, unknown>) || {};\n}\n\nfunction loadOverrideDir(dir: string): Record<string, unknown>[] {\n  if (!existsSync(dir)) {\n    return [];\n  }\n\n  const files = readdirSync(dir)\n    .filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'))\n    .sort();\n\n  return files.map((file) => loadYamlFile(dir, file));\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rawnodes/config-loader",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Flexible YAML config loader with environment overrides, Zod validation, and Docker-friendly features",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -52,8 +52,10 @@
     "node": ">=18"
   },
   "dependencies": {
+    "@aws-sdk/client-secrets-manager": "^3.964.0",
     "dotenv": "^16.4.5",
-    "js-yaml": "^4.1.0"
+    "js-yaml": "^4.1.0",
+    "node-vault": "^0.10.9"
   },
   "peerDependencies": {
     "zod": "^3.0.0 || ^4.0.0"