@rusamer/envgod 0.0.1 → 0.0.4

package/README.md

@@ -33,6 +33,14 @@ The SDK automatically reads the following environment variables:
 | `ENVGOD_ENV` | Environment Name (e.g., prod) |
 | `ENVGOD_SERVICE` | Service Name |
 
+```env
+ENVGOD_API_URL=https://api.example.com
+ENVGOD_API_KEY=sk_xxx
+ENVGOD_PROJECT=myapp
+ENVGOD_ENV=prod
+ENVGOD_SERVICE=web
+```
+
 ## Usage
 
 ### Node.js
@@ -76,7 +84,7 @@ export default async function Page() {
 ## Security Notes
 
 1. **Server-Only**: This SDK is designed strictly for server environments. It explicitly checks for `window` and imports `server-only` in the Next.js entrypoint.
-2. **No Persistance**: Secrets are held in memory. Restarting the server will trigger a fresh fetch.
+2. **No Persistence**: Secrets are held in memory. Restarting the server will trigger a fresh fetch.
 3. **Logs**: The SDK does not log secret values.
 
 ## For Maintainers

package/dist/index.js

@@ -1,16 +1,16 @@
 'use strict';
 
+var keytar = require('keytar');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var keytar__default = /*#__PURE__*/_interopDefault(keytar);
+
 // src/index.ts
-var state = {
-  token: null,
-  tokenExpiresAt: null,
-  bundle: null
-};
+var cache = /* @__PURE__ */ new Map();
 var pendingLoadPromise = null;
 function _resetState() {
-  state.token = null;
-  state.tokenExpiresAt = null;
-  state.bundle = null;
+  cache.clear();
   pendingLoadPromise = null;
 }
 function getEnvGodConfig(options) {
@@ -22,9 +22,8 @@ function getEnvGodConfig(options) {
     env: options?.config?.env ?? env.ENVGOD_ENV,
     service: options?.config?.service ?? env.ENVGOD_SERVICE
   };
-  const missing = Object.entries(config).filter(([_, v]) => !v).map(([k]) => k);
-  if (missing.length > 0) {
-    throw new Error(`[EnvGod] Missing required configuration: ${missing.join(", ")}`);
+  if (!config.apiUrl) {
+    throw new Error("[EnvGod] Missing required configuration: apiUrl is required.");
   }
   return config;
 }
@@ -49,7 +48,7 @@ async function fetchWithTimeout(url, init) {
     clearTimeout(id);
   }
 }
-async function exchangeToken(config, timeout) {
+async function exchangeToken(config, timeout, state) {
   const res = await fetchWithTimeout(`${config.apiUrl}/v1/auth/exchange`, {
     method: "POST",
     headers: {
@@ -71,6 +70,38 @@ async function exchangeToken(config, timeout) {
   state.tokenExpiresAt = new Date(data.expiresAt).getTime();
   return data.token;
 }
+var KEYTAR_SERVICE = "envgod-cli";
+var KEYTAR_ACCOUNT = "default";
+async function getAccessToken() {
+  const data = await keytar__default.default.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
+  if (!data) return null;
+  try {
+    const parsed = JSON.parse(data);
+    return parsed.accessToken || parsed.refreshToken || null;
+  } catch {
+    return null;
+  }
+}
+async function fetchSecretsWithUserToken(config, userToken, timeout) {
+  const res = await fetchWithTimeout(`${config.apiUrl}/v1/secrets`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "Authorization": `Bearer ${userToken}`
+    },
+    body: JSON.stringify({
+      project: config.project,
+      env: config.env,
+      service: config.service
+    }),
+    timeout
+  });
+  if (!res.ok) {
+    throw new Error(`[EnvGod] Failed to fetch secrets: ${res.status} ${res.statusText}`);
+  }
+  const data = await res.json();
+  return data.values;
+}
 async function fetchBundle(config, token, timeout) {
   const res = await fetchWithTimeout(`${config.apiUrl}/v1/bundle`, {
     method: "GET",
@@ -88,15 +119,34 @@ async function fetchBundle(config, token, timeout) {
   const data = await res.json();
   return data.values;
 }
+function getConfigFingerprint(config) {
+  const keyPrefix = config.apiKey ? config.apiKey.substring(0, 8) : "interactive";
+  return [config.apiUrl, keyPrefix, config.project, config.env, config.service].join("|");
+}
 async function loadEnvInternal(options) {
   checkBrowser();
   const config = getEnvGodConfig(options);
+  if (!config.apiKey) {
+    const userToken = await getAccessToken();
+    if (!userToken) {
+      throw new Error("[EnvGod] Not logged in. Please run `envgod login`.");
+    }
+    const values = await fetchSecretsWithUserToken(config, userToken, options?.timeout ?? 5e3);
+    Object.assign(process.env, values);
+    return values;
+  }
   const timeout = options?.timeout ?? 5e3;
   const now = Date.now();
+  const TOKEN_SKEW_MS = 30 * 1e3;
+  const fingerprint = getConfigFingerprint(config);
+  if (!cache.has(fingerprint)) {
+    cache.set(fingerprint, { token: null, tokenExpiresAt: null, bundle: null });
+  }
+  const state = cache.get(fingerprint);
   let token = state.token;
-  let tokenValid = token && state.tokenExpiresAt && state.tokenExpiresAt > now;
+  let tokenValid = token && state.tokenExpiresAt && state.tokenExpiresAt > now + TOKEN_SKEW_MS;
   if (!tokenValid) {
-    token = await exchangeToken(config, timeout);
+    token = await exchangeToken(config, timeout, state);
   }
   if (state.bundle && tokenValid) {
     Object.assign(process.env, state.bundle);
@@ -111,7 +161,7 @@ async function loadEnvInternal(options) {
     if (err.message === "401") {
       state.token = null;
       state.bundle = null;
-      const newToken = await exchangeToken(config, timeout);
+      const newToken = await exchangeToken(config, timeout, state);
       const values = await fetchBundle(config, newToken, timeout);
       state.bundle = values;
       Object.assign(process.env, values);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AASA,IAAM,KAAA,GAAoB;AAAA,EACtB,KAAA,EAAO,IAAA;AAAA,EACP,cAAA,EAAgB,IAAA;AAAA,EAChB,MAAA,EAAQ;AACZ,CAAA;AAEA,IAAI,kBAAA,GAA6D,IAAA;AAG1D,SAAS,WAAA,GAAc;AAC1B,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,EAAA,KAAA,CAAM,cAAA,GAAiB,IAAA;AACvB,EAAA,KAAA,CAAM,MAAA,GAAS,IAAA;AACf,EAAA,kBAAA,GAAqB,IAAA;AACzB;AAQO,SAAS,gBAAgB,OAAA,EAAwC;AACpE,EAAA,MAAM,MAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,MAAM,MAAA,GAAS;AAAA,IACX,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,MAAA,IAAU,GAAA,CAAI,cAAA;AAAA,IACvC,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,MAAA,IAAU,GAAA,CAAI,cAAA;AAAA,IACvC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,CAAI,cAAA;AAAA,IACzC,GAAA,EAAK,OAAA,EAAS,MAAA,EAAQ,GAAA,IAAO,GAAA,CAAI,UAAA;AAAA,IACjC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,CAAI;AAAA,GAC7C;AAEA,EAAA,MAAM,UAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAChC,MAAA,CAAO,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAC,CAAC,CAAA,CACrB,GAAA,CAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAEnB,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yCAAA,EAA4C,QAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,EACpF;AAEA,EAAA,OAAO,MAAA;AACX;AAKA,SAAS,YAAA,GAAe;AACpB,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,IAAA,MAAM,IAAI,MAAM,sGAAsG,CAAA;AAAA,EAC1H;AACJ;AAKA,eAAe,gBAAA,CAAiB,KAAa,IAAA,EAA0C;AACnF,EAAA,MAAM,EAAE,OAAA,GAAU,GAAA,EAAM,GAAG,MAAK,GAAI,IAAA;AACpC,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,KAAK,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,OAAO,CAAA;AAEvD,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,SAAS,GAAA,EAAU;AACf,IAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,OAAO,CAAA,EAAA,CAAI,CAAA;AAAA,IACnE;AACA,IAAA,MAAM,GAAA;AAAA,EACV,CAAA,SAAE;AACE,IAAA,YAAA,CAAa,EAAE,CAAA;AAAA,EACnB;AACJ;AAIA,eAAe,aAAA,CAAc,QAAsB,OAAA,EAAkC;AACjF,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,iBAAA,CAAA,EAAqB;AAAA,IACpE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,eAAA,EAAiB,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA;AAAA,KAC5C;AAAA,IACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACjB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,SAAS,MAAA,CAAO;AAAA,KACnB,CAAA;AAAA,IACD;AAAA,GACH,CAAA;AAED,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,+BAAA,EAAkC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACpF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,KAAA,CAAM,QAAQ,IAAA,CAAK,KAAA;AACnB,EAAA,KAAA,CAAM,iBAAiB,IAAI,IAAA,CAAK,IAAA,CAAK,SAAS,EAAE,OAAA,EAAQ;AACxD,EAAA,OAAO,IAAA,CAAK,KAAA;AAChB;AAEA,eAAe,WAAA,CAAY,MAAA,EAAsB,KAAA,EAAe,OAAA,EAAkD;AAC9G,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,UAAA,CAAA,EAAc;AAAA,IAC7D,MAAA,EAAQ,KAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,eAAA,EAAiB,UAAU,KAAK,CAAA;AAAA,KACpC;AAAA,IACA;AAAA,GACH,CAAA;AAED,EAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACpB,IAAA,MAAM,IAAI,MAAM,KAAK,CAAA;AAAA,EACzB;AAEA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACnF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,OAAO,IAAA,CAAK,MAAA;AAChB;AAEA,eAAe,gBAAgB,OAAA,EAA2D;AACtF,EAAA,YAAA,EAAa;AACb,EAAA,MAAM,MAAA,GAAS,gBAAgB,OAAO,CAAA;AACtC,EAAA,MAAM,OAAA,GAAU,SAAS,OAAA,IAAW,GAAA;AACpC,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AAGrB,EAAA,IAAI,QAAQ,KAAA,CAAM,KAAA;AAClB,EAAA,IAAI,UAAA,GAAa,KAAA,IAAS,KAAA,CAAM,cAAA,IAAkB,MAAM,cAAA,GAAiB,GAAA;AAGzE,EAAA,IAAI,CAAC,UAAA,EAAY;AACb,IAAA,KAAA,GAAQ,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAO,CAAA;AAAA,EAC/C;AAGA,EAAA,IAAI,KAAA,CAAM,UAAU,UAAA,EAAY;AAC5B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,KAAA,CAAM,MAAM,CAAA;AACvC,IAAA,OAAO,KAAA,CAAM,MAAA;AAAA,EACjB;AAGA,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,OAAQ,OAAO,CAAA;AACxD,IAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AACf,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,IAAA,OAAO,MAAA;AAAA,EACX,SAAS,GAAA,EAAU;AACf,IAAA,IAAI,GAAA,CAAI,YAAY,KAAA,EAAO;AAEvB,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,KAAA,CAAM,MAAA,GAAS,IAAA;AAEf,MAAA,MAAM,QAAA,GAAW,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAO,CAAA;AACpD,MAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,UAAU,OAAO,CAAA;AAC1D,MAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AACf,MAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,MAAA,OAAO,MAAA;AAAA,IACX;AACA,IAAA,MAAM,GAAA;AAAA,EACV;AACJ;AAMO,SAAS,QAAQ,OAAA,EAA2D;AAC/E,EAAA,IAAI,kBAAA,EAAoB;AACpB,IAAA,OAAO,kBAAA;AAAA,EACX;AAEA,EAAA,kBAAA,GAAqB,eAAA,CAAgB,OAAO,CAAA,CACvC,OAAA,CAAQ,MAAM;AACX,IAAA,kBAAA,GAAqB,IAAA;AAAA,EACzB,CAAC,CAAA;AAEL,EAAA,OAAO,kBAAA;AACX","file":"index.js","sourcesContent":["import type { EnvGodConfig, LoadEnvOptions, AuthExchangeResponse, BundleResponse } from './types.js';\r\n\r\n// --- State ---\r\ninterface CacheState {\r\n    token: string | null;\r\n    tokenExpiresAt: number | null; // Timestamp in ms\r\n    bundle: Record<string, string> | null;\r\n}\r\n\r\nconst state: CacheState = {\r\n    token: null,\r\n    tokenExpiresAt: null,\r\n    bundle: null,\r\n};\r\n\r\nlet pendingLoadPromise: Promise<Record<string, string>> | null = null;\r\n\r\n/** @internal For testing only */\r\nexport function _resetState() {\r\n    state.token = null;\r\n    state.tokenExpiresAt = null;\r\n    state.bundle = null;\r\n    pendingLoadPromise = null;\r\n}\r\n\r\n// --- Helpers ---\r\n\r\n/**\r\n * Validates and returns the configuration.\r\n * Prioritizes options > process.env.\r\n */\r\nexport function getEnvGodConfig(options?: LoadEnvOptions): EnvGodConfig {\r\n    const env = process.env;\r\n    const config = {\r\n        apiUrl: options?.config?.apiUrl ?? env.ENVGOD_API_URL,\r\n        apiKey: options?.config?.apiKey ?? env.ENVGOD_API_KEY,\r\n        project: options?.config?.project ?? env.ENVGOD_PROJECT,\r\n        env: options?.config?.env ?? env.ENVGOD_ENV,\r\n        service: options?.config?.service ?? env.ENVGOD_SERVICE,\r\n    };\r\n\r\n    const missing = Object.entries(config)\r\n        .filter(([_, v]) => !v)\r\n        .map(([k]) => k);\r\n\r\n    if (missing.length > 0) {\r\n        throw new Error(`[EnvGod] Missing required configuration: ${missing.join(', ')}`);\r\n    }\r\n\r\n    return config as EnvGodConfig;\r\n}\r\n\r\n/**\r\n * Checks if the current environment is a browser.\r\n */\r\nfunction checkBrowser() {\r\n    if (typeof window !== 'undefined') {\r\n        throw new Error('[EnvGod] Security Warning: SDK execution attempting in browser environment. This SDK is server-only.');\r\n    }\r\n}\r\n\r\n/**\r\n * Fetches with timeout.\r\n */\r\nasync function fetchWithTimeout(url: string, init: RequestInit & { timeout?: number }) {\r\n    const { timeout = 5000, ...rest } = init;\r\n    const controller = new AbortController();\r\n    const id = setTimeout(() => controller.abort(), timeout);\r\n\r\n    try {\r\n        const res = await fetch(url, { ...rest, signal: controller.signal });\r\n        return res;\r\n    } catch (err: any) {\r\n        if (err.name === 'AbortError') {\r\n            throw new Error(`[EnvGod] Request timed out after ${timeout}ms`);\r\n        }\r\n        throw err;\r\n    } finally {\r\n        clearTimeout(id);\r\n    }\r\n}\r\n\r\n// --- Core Logic ---\r\n\r\nasync function exchangeToken(config: EnvGodConfig, timeout: number): Promise<string> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/auth/exchange`, {\r\n        method: 'POST',\r\n        headers: {\r\n            'Content-Type': 'application/json',\r\n            'Authorization': `Bearer ${config.apiKey}`,\r\n        },\r\n        body: JSON.stringify({\r\n            project: config.project,\r\n            env: config.env,\r\n            service: config.service,\r\n        }),\r\n        timeout,\r\n    });\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Auth exchange failed: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as AuthExchangeResponse;\r\n    state.token = data.token;\r\n    state.tokenExpiresAt = new Date(data.expiresAt).getTime();\r\n    return data.token;\r\n}\r\n\r\nasync function fetchBundle(config: EnvGodConfig, token: string, timeout: number): Promise<Record<string, string>> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/bundle`, {\r\n        method: 'GET',\r\n        headers: {\r\n            'Authorization': `Bearer ${token}`,\r\n        },\r\n        timeout,\r\n    });\r\n\r\n    if (res.status === 401) {\r\n        throw new Error('401'); // Signal to retry\r\n    }\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Fetch bundle failed: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as BundleResponse;\r\n    return data.values;\r\n}\r\n\r\nasync function loadEnvInternal(options?: LoadEnvOptions): Promise<Record<string, string>> {\r\n    checkBrowser();\r\n    const config = getEnvGodConfig(options);\r\n    const timeout = options?.timeout ?? 5000;\r\n    const now = Date.now();\r\n\r\n    // 1. Check if we have a valid token\r\n    let token = state.token;\r\n    let tokenValid = token && state.tokenExpiresAt && state.tokenExpiresAt > now;\r\n\r\n    // 2. If token invalid, exchange\r\n    if (!tokenValid) {\r\n        token = await exchangeToken(config, timeout);\r\n    }\r\n\r\n    // 3. If we have a cached bundle and the token is still the same/valid, return it?\r\n    if (state.bundle && tokenValid) {\r\n        Object.assign(process.env, state.bundle);\r\n        return state.bundle;\r\n    }\r\n\r\n    // 4. Fetch bundle with retry logic\r\n    try {\r\n        const values = await fetchBundle(config, token!, timeout);\r\n        state.bundle = values;\r\n        Object.assign(process.env, values);\r\n        return values;\r\n    } catch (err: any) {\r\n        if (err.message === '401') {\r\n            // Retry ONCE: Re-exchange and Re-fetch\r\n            state.token = null;\r\n            state.bundle = null;\r\n\r\n            const newToken = await exchangeToken(config, timeout);\r\n            const values = await fetchBundle(config, newToken, timeout);\r\n            state.bundle = values;\r\n            Object.assign(process.env, values);\r\n            return values;\r\n        }\r\n        throw err;\r\n    }\r\n}\r\n\r\n/**\r\n * Main entry point to load environment variables.\r\n * Uses Singleflight pattern to prevent concurrent network requests.\r\n */\r\nexport function loadEnv(options?: LoadEnvOptions): Promise<Record<string, string>> {\r\n    if (pendingLoadPromise) {\r\n        return pendingLoadPromise;\r\n    }\r\n\r\n    pendingLoadPromise = loadEnvInternal(options)\r\n        .finally(() => {\r\n            pendingLoadPromise = null;\r\n        });\r\n\r\n    return pendingLoadPromise;\r\n}\r\n\r\nexport * from './types.js';\r\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["keytar"],"mappings":";;;;;;;;;AAUA,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAC1C,IAAI,kBAAA,GAA6D,IAAA;AAG1D,SAAS,WAAA,GAAc;AAC1B,EAAA,KAAA,CAAM,KAAA,EAAM;AACZ,EAAA,kBAAA,GAAqB,IAAA;AACzB;AAQO,SAAS,gBAAgB,OAAA,EAAwC;AACpE,EAAA,MAAM,MAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,MAAM,MAAA,GAAS;AAAA,IACX,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,MAAA,IAAU,GAAA,CAAI,cAAA;AAAA,IACvC,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,MAAA,IAAU,GAAA,CAAI,cAAA;AAAA,IACvC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,CAAI,cAAA;AAAA,IACzC,GAAA,EAAK,OAAA,EAAS,MAAA,EAAQ,GAAA,IAAO,GAAA,CAAI,UAAA;AAAA,IACjC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,CAAI;AAAA,GAC7C;AAEA,EAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAChB,IAAA,MAAM,IAAI,MAAM,8DAA8D,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,MAAA;AACX;AAKA,SAAS,YAAA,GAAe;AACpB,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,IAAA,MAAM,IAAI,MAAM,sGAAsG,CAAA;AAAA,EAC1H;AACJ;AAKA,eAAe,gBAAA,CAAiB,KAAa,IAAA,EAA0C;AACnF,EAAA,MAAM,EAAE,OAAA,GAAU,GAAA,EAAM,GAAG,MAAK,GAAI,IAAA;AACpC,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,KAAK,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,OAAO,CAAA;AAEvD,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,SAAS,GAAA,EAAU;AACf,IAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,OAAO,CAAA,EAAA,CAAI,CAAA;AAAA,IACnE;AACA,IAAA,MAAM,GAAA;AAAA,EACV,CAAA,SAAE;AACE,IAAA,YAAA,CAAa,EAAE,CAAA;AAAA,EACnB;AACJ;AAIA,eAAe,aAAA,CAAc,MAAA,EAAsB,OAAA,EAAiB,KAAA,EAAoC;AACpG,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,iBAAA,CAAA,EAAqB;AAAA,IACpE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,eAAA,EAAiB,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA;AAAA,KAC5C;AAAA,IACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACjB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,SAAS,MAAA,CAAO;AAAA,KACnB,CAAA;AAAA,IACD;AAAA,GACH,CAAA;AAED,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,+BAAA,EAAkC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACpF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,KAAA,CAAM,QAAQ,IAAA,CAAK,KAAA;AACnB,EAAA,KAAA,CAAM,iBAAiB,IAAI,IAAA,CAAK,IAAA,CAAK,SAAS,EAAE,OAAA,EAAQ;AACxD,EAAA,OAAO,IAAA,CAAK,KAAA;AAChB;AAEA,IAAM,cAAA,GAAiB,YAAA;AACvB,IAAM,cAAA,GAAiB,SAAA;AAEvB,eAAe,cAAA,GAAyC;AACpD,EAAA,MAAM,IAAA,GAAO,MAAMA,uBAAA,CAAO,WAAA,CAAY,gBAAgB,cAAc,CAAA;AACpE,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAE9B,IAAA,OAAO,MAAA,CAAO,WAAA,IAAe,MAAA,CAAO,YAAA,IAAgB,IAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;AAEA,eAAe,yBAAA,CAA0B,MAAA,EAAsB,SAAA,EAAmB,OAAA,EAAkD;AAChI,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,WAAA,CAAA,EAAe;AAAA,IAC9D,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,eAAA,EAAiB,UAAU,SAAS,CAAA;AAAA,KACxC;AAAA,IACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACjB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,SAAS,MAAA,CAAO;AAAA,KACnB,CAAA;AAAA,IACD;AAAA,GACH,CAAA;AAED,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,kCAAA,EAAqC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACvF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,OAAO,IAAA,CAAK,MAAA;AAChB;AAEA,eAAe,WAAA,CAAY,MAAA,EAAsB,KAAA,EAAe,OAAA,EAAkD;AAC9G,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,UAAA,CAAA,EAAc;AAAA,IAC7D,MAAA,EAAQ,KAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,eAAA,EAAiB,UAAU,KAAK,CAAA;AAAA,KACpC;AAAA,IACA;AAAA,GACH,CAAA;AAED,EAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACpB,IAAA,MAAM,IAAI,MAAM,KAAK,CAAA;AAAA,EACzB;AAEA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACnF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,OAAO,IAAA,CAAK,MAAA;AAChB;AAEA,SAAS,qBAAqB,MAAA,EAA8B;AACxD,EAAA,MAAM,SAAA,GAAY,OAAO,MAAA,GAAS,MAAA,CAAO,OAAO,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA,GAAI,aAAA;AAClE,EAAA,OAAO,CAAC,MAAA,CAAO,MAAA,EAAQ,SAAA,EAAW,MAAA,CAAO,OAAA,EAAS,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAC1F;AAEA,eAAe,gBAAgB,OAAA,EAA2D;AACtF,EAAA,YAAA,EAAa;AACb,EAAA,MAAM,MAAA,GAAS,gBAAgB,OAAO,CAAA;AAGtC,EAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAChB,IAAA,MAAM,SAAA,GAAY,MAAM,cAAA,EAAe;AACvC,IAAA,IAAI,CAAC,SAAA,EAAW;AACZ,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACxE;AACA,IAAA,MAAM,SAAS,MAAM,yBAAA,CAA0B,QAAQ,SAAA,EAAW,OAAA,EAAS,WAAW,GAAI,CAAA;AAC1F,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,IAAA,OAAO,MAAA;AAAA,EACX;AAEA,EAAA,MAAM,OAAA,GAAU,SAAS,OAAA,IAAW,GAAA;AACpC,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,gBAAgB,EAAA,GAAK,GAAA;AAE3B,EAAA,MAAM,WAAA,GAAc,qBAAqB,MAAM,CAAA;AAC/C,EAAA,IAAI,CAAC,KAAA,CAAM,GAAA,CAAI,WAAW,CAAA,EAAG;AACzB,IAAA,KAAA,CAAM,GAAA,CAAI,aAAa,EAAE,KAAA,EAAO,MAAM,cAAA,EAAgB,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,EAC9E;AACA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,CAAI,WAAW,CAAA;AAEnC,EAAA,IAAI,QAAQ,KAAA,CAAM,KAAA;AAClB,EAAA,IAAI,aAAa,KAAA,IAAS,KAAA,CAAM,cAAA,IAAkB,KAAA,CAAM,iBAAkB,GAAA,GAAM,aAAA;AAEhF,EAAA,IAAI,CAAC,UAAA,EAAY;AACb,IAAA,KAAA,GAAQ,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAA,EAAS,KAAK,CAAA;AAAA,EACtD;AAEA,EAAA,IAAI,KAAA,CAAM,UAAU,UAAA,EAAY;AAC5B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,KAAA,CAAM,MAAM,CAAA;AACvC,IAAA,OAAO,KAAA,CAAM,MAAA;AAAA,EACjB;AAEA,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,OAAQ,OAAO,CAAA;AACxD,IAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AACf,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,IAAA,OAAO,MAAA;AAAA,EACX,SAAS,GAAA,EAAU;AACf,IAAA,IAAI,GAAA,CAAI,YAAY,KAAA,EAAO;AACvB,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,KAAA,CAAM,MAAA,GAAS,IAAA;AACf,MAAA,MAAM,QAAA,GAAW,MAAM,aAAA,CAAc,MAAA,EAAQ,SAAS,KAAK,CAAA;AAC3D,MAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,UAAU,OAAO,CAAA;AAC1D,MAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AACf,MAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,MAAA,OAAO,MAAA;AAAA,IACX;AACA,IAAA,MAAM,GAAA;AAAA,EACV;AACJ;AAMO,SAAS,QAAQ,OAAA,EAA2D;AAC/E,EAAA,IAAI,kBAAA,EAAoB;AACpB,IAAA,OAAO,kBAAA;AAAA,EACX;AAEA,EAAA,kBAAA,GAAqB,eAAA,CAAgB,OAAO,CAAA,CACvC,OAAA,CAAQ,MAAM;AACX,IAAA,kBAAA,GAAqB,IAAA;AAAA,EACzB,CAAC,CAAA;AAEL,EAAA,OAAO,kBAAA;AACX","file":"index.js","sourcesContent":["import keytar from 'keytar';\r\nimport type { EnvGodConfig, LoadEnvOptions, AuthExchangeResponse, BundleResponse } from './types.js';\r\n\r\n// --- State ---\r\ninterface CacheState {\r\n    token: string | null;\r\n    tokenExpiresAt: number | null; // Timestamp in ms\r\n    bundle: Record<string, string> | null;\r\n}\r\n\r\nconst cache = new Map<string, CacheState>();\r\nlet pendingLoadPromise: Promise<Record<string, string>> | null = null;\r\n\r\n/** @internal For testing only */\r\nexport function _resetState() {\r\n    cache.clear();\r\n    pendingLoadPromise = null;\r\n}\r\n\r\n// --- Helpers ---\r\n\r\n/**\r\n * Validates and returns the configuration.\r\n * Prioritizes options > process.env.\r\n */\r\nexport function getEnvGodConfig(options?: LoadEnvOptions): EnvGodConfig {\r\n    const env = process.env;\r\n    const config = {\r\n        apiUrl: options?.config?.apiUrl ?? env.ENVGOD_API_URL,\r\n        apiKey: options?.config?.apiKey ?? env.ENVGOD_API_KEY,\r\n        project: options?.config?.project ?? env.ENVGOD_PROJECT,\r\n        env: options?.config?.env ?? env.ENVGOD_ENV,\r\n        service: options?.config?.service ?? env.ENVGOD_SERVICE,\r\n    };\r\n\r\n    if (!config.apiUrl) {\r\n        throw new Error('[EnvGod] Missing required configuration: apiUrl is required.');\r\n    }\r\n\r\n    return config as EnvGodConfig;\r\n}\r\n\r\n/**\r\n * Checks if the current environment is a browser.\r\n */\r\nfunction checkBrowser() {\r\n    if (typeof window !== 'undefined') {\r\n        throw new Error('[EnvGod] Security Warning: SDK execution attempting in browser environment. This SDK is server-only.');\r\n    }\r\n}\r\n\r\n/**\r\n * Fetches with timeout.\r\n */\r\nasync function fetchWithTimeout(url: string, init: RequestInit & { timeout?: number }) {\r\n    const { timeout = 5000, ...rest } = init;\r\n    const controller = new AbortController();\r\n    const id = setTimeout(() => controller.abort(), timeout);\r\n\r\n    try {\r\n        const res = await fetch(url, { ...rest, signal: controller.signal });\r\n        return res;\r\n    } catch (err: any) {\r\n        if (err.name === 'AbortError') {\r\n            throw new Error(`[EnvGod] Request timed out after ${timeout}ms`);\r\n        }\r\n        throw err;\r\n    } finally {\r\n        clearTimeout(id);\r\n    }\r\n}\r\n\r\n// --- Core Logic ---\r\n\r\nasync function exchangeToken(config: EnvGodConfig, timeout: number, state: CacheState): Promise<string> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/auth/exchange`, {\r\n        method: 'POST',\r\n        headers: {\r\n            'Content-Type': 'application/json',\r\n            'Authorization': `Bearer ${config.apiKey}`,\r\n        },\r\n        body: JSON.stringify({\r\n            project: config.project,\r\n            env: config.env,\r\n            service: config.service,\r\n        }),\r\n        timeout,\r\n    });\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Auth exchange failed: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as AuthExchangeResponse;\r\n    state.token = data.token;\r\n    state.tokenExpiresAt = new Date(data.expiresAt).getTime();\r\n    return data.token;\r\n}\r\n\r\nconst KEYTAR_SERVICE = 'envgod-cli';\r\nconst KEYTAR_ACCOUNT = 'default';\r\n\r\nasync function getAccessToken(): Promise<string | null> {\r\n    const data = await keytar.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);\r\n    if (!data) return null;\r\n    try {\r\n        const parsed = JSON.parse(data);\r\n        // The CLI's device flow currently stores the access token in both slots.\r\n        return parsed.accessToken || parsed.refreshToken || null;\r\n    } catch {\r\n        return null;\r\n    }\r\n}\r\n\r\nasync function fetchSecretsWithUserToken(config: EnvGodConfig, userToken: string, timeout: number): Promise<Record<string, string>> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/secrets`, {\r\n        method: 'POST',\r\n        headers: {\r\n            'Content-Type': 'application/json',\r\n            'Authorization': `Bearer ${userToken}`,\r\n        },\r\n        body: JSON.stringify({\r\n            project: config.project,\r\n            env: config.env,\r\n            service: config.service,\r\n        }),\r\n        timeout,\r\n    });\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Failed to fetch secrets: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as BundleResponse;\r\n    return data.values;\r\n}\r\n\r\nasync function fetchBundle(config: EnvGodConfig, token: string, timeout: number): Promise<Record<string, string>> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/bundle`, {\r\n        method: 'GET',\r\n        headers: {\r\n            'Authorization': `Bearer ${token}`,\r\n        },\r\n        timeout,\r\n    });\r\n\r\n    if (res.status === 401) {\r\n        throw new Error('401'); // Signal to retry\r\n    }\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Fetch bundle failed: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as BundleResponse;\r\n    return data.values;\r\n}\r\n\r\nfunction getConfigFingerprint(config: EnvGodConfig): string {\r\n    const keyPrefix = config.apiKey ? config.apiKey.substring(0, 8) : 'interactive';\r\n    return [config.apiUrl, keyPrefix, config.project, config.env, config.service].join('|');\r\n}\r\n\r\nasync function loadEnvInternal(options?: LoadEnvOptions): Promise<Record<string, string>> {\r\n    checkBrowser();\r\n    const config = getEnvGodConfig(options);\r\n\r\n    // Interactive mode: Use user token if no API key is provided\r\n    if (!config.apiKey) {\r\n        const userToken = await getAccessToken();\r\n        if (!userToken) {\r\n            throw new Error('[EnvGod] Not logged in. Please run `envgod login`.');\r\n        }\r\n        const values = await fetchSecretsWithUserToken(config, userToken, options?.timeout ?? 5000);\r\n        Object.assign(process.env, values);\r\n        return values;\r\n    }\r\n\r\n    const timeout = options?.timeout ?? 5000;\r\n    const now = Date.now();\r\n    const TOKEN_SKEW_MS = 30 * 1000; // 30 seconds\r\n\r\n    const fingerprint = getConfigFingerprint(config);\r\n    if (!cache.has(fingerprint)) {\r\n        cache.set(fingerprint, { token: null, tokenExpiresAt: null, bundle: null });\r\n    }\r\n    const state = cache.get(fingerprint)!;\r\n\r\n    let token = state.token;\r\n    let tokenValid = token && state.tokenExpiresAt && state.tokenExpiresAt > (now + TOKEN_SKEW_MS);\r\n\r\n    if (!tokenValid) {\r\n        token = await exchangeToken(config, timeout, state);\r\n    }\r\n\r\n    if (state.bundle && tokenValid) {\r\n        Object.assign(process.env, state.bundle);\r\n        return state.bundle;\r\n    }\r\n\r\n    try {\r\n        const values = await fetchBundle(config, token!, timeout);\r\n        state.bundle = values;\r\n        Object.assign(process.env, values);\r\n        return values;\r\n    } catch (err: any) {\r\n        if (err.message === '401') {\r\n            state.token = null;\r\n            state.bundle = null;\r\n            const newToken = await exchangeToken(config, timeout, state);\r\n            const values = await fetchBundle(config, newToken, timeout);\r\n            state.bundle = values;\r\n            Object.assign(process.env, values);\r\n            return values;\r\n        }\r\n        throw err;\r\n    }\r\n}\r\n\r\n/**\r\n * Main entry point to load environment variables.\r\n * Uses Singleflight pattern to prevent concurrent network requests.\r\n */\r\nexport function loadEnv(options?: LoadEnvOptions): Promise<Record<string, string>> {\r\n    if (pendingLoadPromise) {\r\n        return pendingLoadPromise;\r\n    }\r\n\r\n    pendingLoadPromise = loadEnvInternal(options)\r\n        .finally(() => {\r\n            pendingLoadPromise = null;\r\n        });\r\n\r\n    return pendingLoadPromise;\r\n}\r\n\r\nexport * from './types.js';\r\n"]}

package/dist/index.mjs

@@ -1,14 +1,10 @@
+import keytar from 'keytar';
+
 // src/index.ts
-var state = {
-  token: null,
-  tokenExpiresAt: null,
-  bundle: null
-};
+var cache = /* @__PURE__ */ new Map();
 var pendingLoadPromise = null;
 function _resetState() {
-  state.token = null;
-  state.tokenExpiresAt = null;
-  state.bundle = null;
+  cache.clear();
   pendingLoadPromise = null;
 }
 function getEnvGodConfig(options) {
@@ -20,9 +16,8 @@ function getEnvGodConfig(options) {
     env: options?.config?.env ?? env.ENVGOD_ENV,
     service: options?.config?.service ?? env.ENVGOD_SERVICE
   };
-  const missing = Object.entries(config).filter(([_, v]) => !v).map(([k]) => k);
-  if (missing.length > 0) {
-    throw new Error(`[EnvGod] Missing required configuration: ${missing.join(", ")}`);
+  if (!config.apiUrl) {
+    throw new Error("[EnvGod] Missing required configuration: apiUrl is required.");
   }
   return config;
 }
@@ -47,7 +42,7 @@ async function fetchWithTimeout(url, init) {
     clearTimeout(id);
   }
 }
-async function exchangeToken(config, timeout) {
+async function exchangeToken(config, timeout, state) {
   const res = await fetchWithTimeout(`${config.apiUrl}/v1/auth/exchange`, {
     method: "POST",
     headers: {
@@ -69,6 +64,38 @@ async function exchangeToken(config, timeout) {
   state.tokenExpiresAt = new Date(data.expiresAt).getTime();
   return data.token;
 }
+var KEYTAR_SERVICE = "envgod-cli";
+var KEYTAR_ACCOUNT = "default";
+async function getAccessToken() {
+  const data = await keytar.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
+  if (!data) return null;
+  try {
+    const parsed = JSON.parse(data);
+    return parsed.accessToken || parsed.refreshToken || null;
+  } catch {
+    return null;
+  }
+}
+async function fetchSecretsWithUserToken(config, userToken, timeout) {
+  const res = await fetchWithTimeout(`${config.apiUrl}/v1/secrets`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "Authorization": `Bearer ${userToken}`
+    },
+    body: JSON.stringify({
+      project: config.project,
+      env: config.env,
+      service: config.service
+    }),
+    timeout
+  });
+  if (!res.ok) {
+    throw new Error(`[EnvGod] Failed to fetch secrets: ${res.status} ${res.statusText}`);
+  }
+  const data = await res.json();
+  return data.values;
+}
 async function fetchBundle(config, token, timeout) {
   const res = await fetchWithTimeout(`${config.apiUrl}/v1/bundle`, {
     method: "GET",
@@ -86,15 +113,34 @@ async function fetchBundle(config, token, timeout) {
   const data = await res.json();
   return data.values;
 }
+function getConfigFingerprint(config) {
+  const keyPrefix = config.apiKey ? config.apiKey.substring(0, 8) : "interactive";
+  return [config.apiUrl, keyPrefix, config.project, config.env, config.service].join("|");
+}
 async function loadEnvInternal(options) {
   checkBrowser();
   const config = getEnvGodConfig(options);
+  if (!config.apiKey) {
+    const userToken = await getAccessToken();
+    if (!userToken) {
+      throw new Error("[EnvGod] Not logged in. Please run `envgod login`.");
+    }
+    const values = await fetchSecretsWithUserToken(config, userToken, options?.timeout ?? 5e3);
+    Object.assign(process.env, values);
+    return values;
+  }
   const timeout = options?.timeout ?? 5e3;
   const now = Date.now();
+  const TOKEN_SKEW_MS = 30 * 1e3;
+  const fingerprint = getConfigFingerprint(config);
+  if (!cache.has(fingerprint)) {
+    cache.set(fingerprint, { token: null, tokenExpiresAt: null, bundle: null });
+  }
+  const state = cache.get(fingerprint);
   let token = state.token;
-  let tokenValid = token && state.tokenExpiresAt && state.tokenExpiresAt > now;
+  let tokenValid = token && state.tokenExpiresAt && state.tokenExpiresAt > now + TOKEN_SKEW_MS;
   if (!tokenValid) {
-    token = await exchangeToken(config, timeout);
+    token = await exchangeToken(config, timeout, state);
   }
   if (state.bundle && tokenValid) {
     Object.assign(process.env, state.bundle);
@@ -109,7 +155,7 @@ async function loadEnvInternal(options) {
     if (err.message === "401") {
       state.token = null;
       state.bundle = null;
-      const newToken = await exchangeToken(config, timeout);
+      const newToken = await exchangeToken(config, timeout, state);
       const values = await fetchBundle(config, newToken, timeout);
       state.bundle = values;
       Object.assign(process.env, values);

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";AASA,IAAM,KAAA,GAAoB;AAAA,EACtB,KAAA,EAAO,IAAA;AAAA,EACP,cAAA,EAAgB,IAAA;AAAA,EAChB,MAAA,EAAQ;AACZ,CAAA;AAEA,IAAI,kBAAA,GAA6D,IAAA;AAG1D,SAAS,WAAA,GAAc;AAC1B,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,EAAA,KAAA,CAAM,cAAA,GAAiB,IAAA;AACvB,EAAA,KAAA,CAAM,MAAA,GAAS,IAAA;AACf,EAAA,kBAAA,GAAqB,IAAA;AACzB;AAQO,SAAS,gBAAgB,OAAA,EAAwC;AACpE,EAAA,MAAM,MAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,MAAM,MAAA,GAAS;AAAA,IACX,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,MAAA,IAAU,GAAA,CAAI,cAAA;AAAA,IACvC,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,MAAA,IAAU,GAAA,CAAI,cAAA;AAAA,IACvC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,CAAI,cAAA;AAAA,IACzC,GAAA,EAAK,OAAA,EAAS,MAAA,EAAQ,GAAA,IAAO,GAAA,CAAI,UAAA;AAAA,IACjC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,CAAI;AAAA,GAC7C;AAEA,EAAA,MAAM,UAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAChC,MAAA,CAAO,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAC,CAAC,CAAA,CACrB,GAAA,CAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAEnB,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yCAAA,EAA4C,QAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,EACpF;AAEA,EAAA,OAAO,MAAA;AACX;AAKA,SAAS,YAAA,GAAe;AACpB,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,IAAA,MAAM,IAAI,MAAM,sGAAsG,CAAA;AAAA,EAC1H;AACJ;AAKA,eAAe,gBAAA,CAAiB,KAAa,IAAA,EAA0C;AACnF,EAAA,MAAM,EAAE,OAAA,GAAU,GAAA,EAAM,GAAG,MAAK,GAAI,IAAA;AACpC,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,KAAK,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,OAAO,CAAA;AAEvD,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,SAAS,GAAA,EAAU;AACf,IAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,OAAO,CAAA,EAAA,CAAI,CAAA;AAAA,IACnE;AACA,IAAA,MAAM,GAAA;AAAA,EACV,CAAA,SAAE;AACE,IAAA,YAAA,CAAa,EAAE,CAAA;AAAA,EACnB;AACJ;AAIA,eAAe,aAAA,CAAc,QAAsB,OAAA,EAAkC;AACjF,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,iBAAA,CAAA,EAAqB;AAAA,IACpE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,eAAA,EAAiB,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA;AAAA,KAC5C;AAAA,IACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACjB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,SAAS,MAAA,CAAO;AAAA,KACnB,CAAA;AAAA,IACD;AAAA,GACH,CAAA;AAED,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,+BAAA,EAAkC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACpF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,KAAA,CAAM,QAAQ,IAAA,CAAK,KAAA;AACnB,EAAA,KAAA,CAAM,iBAAiB,IAAI,IAAA,CAAK,IAAA,CAAK,SAAS,EAAE,OAAA,EAAQ;AACxD,EAAA,OAAO,IAAA,CAAK,KAAA;AAChB;AAEA,eAAe,WAAA,CAAY,MAAA,EAAsB,KAAA,EAAe,OAAA,EAAkD;AAC9G,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,UAAA,CAAA,EAAc;AAAA,IAC7D,MAAA,EAAQ,KAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,eAAA,EAAiB,UAAU,KAAK,CAAA;AAAA,KACpC;AAAA,IACA;AAAA,GACH,CAAA;AAED,EAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACpB,IAAA,MAAM,IAAI,MAAM,KAAK,CAAA;AAAA,EACzB;AAEA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACnF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,OAAO,IAAA,CAAK,MAAA;AAChB;AAEA,eAAe,gBAAgB,OAAA,EAA2D;AACtF,EAAA,YAAA,EAAa;AACb,EAAA,MAAM,MAAA,GAAS,gBAAgB,OAAO,CAAA;AACtC,EAAA,MAAM,OAAA,GAAU,SAAS,OAAA,IAAW,GAAA;AACpC,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AAGrB,EAAA,IAAI,QAAQ,KAAA,CAAM,KAAA;AAClB,EAAA,IAAI,UAAA,GAAa,KAAA,IAAS,KAAA,CAAM,cAAA,IAAkB,MAAM,cAAA,GAAiB,GAAA;AAGzE,EAAA,IAAI,CAAC,UAAA,EAAY;AACb,IAAA,KAAA,GAAQ,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAO,CAAA;AAAA,EAC/C;AAGA,EAAA,IAAI,KAAA,CAAM,UAAU,UAAA,EAAY;AAC5B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,KAAA,CAAM,MAAM,CAAA;AACvC,IAAA,OAAO,KAAA,CAAM,MAAA;AAAA,EACjB;AAGA,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,OAAQ,OAAO,CAAA;AACxD,IAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AACf,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,IAAA,OAAO,MAAA;AAAA,EACX,SAAS,GAAA,EAAU;AACf,IAAA,IAAI,GAAA,CAAI,YAAY,KAAA,EAAO;AAEvB,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,KAAA,CAAM,MAAA,GAAS,IAAA;AAEf,MAAA,MAAM,QAAA,GAAW,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAO,CAAA;AACpD,MAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,UAAU,OAAO,CAAA;AAC1D,MAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AACf,MAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,MAAA,OAAO,MAAA;AAAA,IACX;AACA,IAAA,MAAM,GAAA;AAAA,EACV;AACJ;AAMO,SAAS,QAAQ,OAAA,EAA2D;AAC/E,EAAA,IAAI,kBAAA,EAAoB;AACpB,IAAA,OAAO,kBAAA;AAAA,EACX;AAEA,EAAA,kBAAA,GAAqB,eAAA,CAAgB,OAAO,CAAA,CACvC,OAAA,CAAQ,MAAM;AACX,IAAA,kBAAA,GAAqB,IAAA;AAAA,EACzB,CAAC,CAAA;AAEL,EAAA,OAAO,kBAAA;AACX","file":"index.mjs","sourcesContent":["import type { EnvGodConfig, LoadEnvOptions, AuthExchangeResponse, BundleResponse } from './types.js';\r\n\r\n// --- State ---\r\ninterface CacheState {\r\n    token: string | null;\r\n    tokenExpiresAt: number | null; // Timestamp in ms\r\n    bundle: Record<string, string> | null;\r\n}\r\n\r\nconst state: CacheState = {\r\n    token: null,\r\n    tokenExpiresAt: null,\r\n    bundle: null,\r\n};\r\n\r\nlet pendingLoadPromise: Promise<Record<string, string>> | null = null;\r\n\r\n/** @internal For testing only */\r\nexport function _resetState() {\r\n    state.token = null;\r\n    state.tokenExpiresAt = null;\r\n    state.bundle = null;\r\n    pendingLoadPromise = null;\r\n}\r\n\r\n// --- Helpers ---\r\n\r\n/**\r\n * Validates and returns the configuration.\r\n * Prioritizes options > process.env.\r\n */\r\nexport function getEnvGodConfig(options?: LoadEnvOptions): EnvGodConfig {\r\n    const env = process.env;\r\n    const config = {\r\n        apiUrl: options?.config?.apiUrl ?? env.ENVGOD_API_URL,\r\n        apiKey: options?.config?.apiKey ?? env.ENVGOD_API_KEY,\r\n        project: options?.config?.project ?? env.ENVGOD_PROJECT,\r\n        env: options?.config?.env ?? env.ENVGOD_ENV,\r\n        service: options?.config?.service ?? env.ENVGOD_SERVICE,\r\n    };\r\n\r\n    const missing = Object.entries(config)\r\n        .filter(([_, v]) => !v)\r\n        .map(([k]) => k);\r\n\r\n    if (missing.length > 0) {\r\n        throw new Error(`[EnvGod] Missing required configuration: ${missing.join(', ')}`);\r\n    }\r\n\r\n    return config as EnvGodConfig;\r\n}\r\n\r\n/**\r\n * Checks if the current environment is a browser.\r\n */\r\nfunction checkBrowser() {\r\n    if (typeof window !== 'undefined') {\r\n        throw new Error('[EnvGod] Security Warning: SDK execution attempting in browser environment. This SDK is server-only.');\r\n    }\r\n}\r\n\r\n/**\r\n * Fetches with timeout.\r\n */\r\nasync function fetchWithTimeout(url: string, init: RequestInit & { timeout?: number }) {\r\n    const { timeout = 5000, ...rest } = init;\r\n    const controller = new AbortController();\r\n    const id = setTimeout(() => controller.abort(), timeout);\r\n\r\n    try {\r\n        const res = await fetch(url, { ...rest, signal: controller.signal });\r\n        return res;\r\n    } catch (err: any) {\r\n        if (err.name === 'AbortError') {\r\n            throw new Error(`[EnvGod] Request timed out after ${timeout}ms`);\r\n        }\r\n        throw err;\r\n    } finally {\r\n        clearTimeout(id);\r\n    }\r\n}\r\n\r\n// --- Core Logic ---\r\n\r\nasync function exchangeToken(config: EnvGodConfig, timeout: number): Promise<string> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/auth/exchange`, {\r\n        method: 'POST',\r\n        headers: {\r\n            'Content-Type': 'application/json',\r\n            'Authorization': `Bearer ${config.apiKey}`,\r\n        },\r\n        body: JSON.stringify({\r\n            project: config.project,\r\n            env: config.env,\r\n            service: config.service,\r\n        }),\r\n        timeout,\r\n    });\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Auth exchange failed: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as AuthExchangeResponse;\r\n    state.token = data.token;\r\n    state.tokenExpiresAt = new Date(data.expiresAt).getTime();\r\n    return data.token;\r\n}\r\n\r\nasync function fetchBundle(config: EnvGodConfig, token: string, timeout: number): Promise<Record<string, string>> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/bundle`, {\r\n        method: 'GET',\r\n        headers: {\r\n            'Authorization': `Bearer ${token}`,\r\n        },\r\n        timeout,\r\n    });\r\n\r\n    if (res.status === 401) {\r\n        throw new Error('401'); // Signal to retry\r\n    }\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Fetch bundle failed: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as BundleResponse;\r\n    return data.values;\r\n}\r\n\r\nasync function loadEnvInternal(options?: LoadEnvOptions): Promise<Record<string, string>> {\r\n    checkBrowser();\r\n    const config = getEnvGodConfig(options);\r\n    const timeout = options?.timeout ?? 5000;\r\n    const now = Date.now();\r\n\r\n    // 1. Check if we have a valid token\r\n    let token = state.token;\r\n    let tokenValid = token && state.tokenExpiresAt && state.tokenExpiresAt > now;\r\n\r\n    // 2. If token invalid, exchange\r\n    if (!tokenValid) {\r\n        token = await exchangeToken(config, timeout);\r\n    }\r\n\r\n    // 3. If we have a cached bundle and the token is still the same/valid, return it?\r\n    if (state.bundle && tokenValid) {\r\n        Object.assign(process.env, state.bundle);\r\n        return state.bundle;\r\n    }\r\n\r\n    // 4. Fetch bundle with retry logic\r\n    try {\r\n        const values = await fetchBundle(config, token!, timeout);\r\n        state.bundle = values;\r\n        Object.assign(process.env, values);\r\n        return values;\r\n    } catch (err: any) {\r\n        if (err.message === '401') {\r\n            // Retry ONCE: Re-exchange and Re-fetch\r\n            state.token = null;\r\n            state.bundle = null;\r\n\r\n            const newToken = await exchangeToken(config, timeout);\r\n            const values = await fetchBundle(config, newToken, timeout);\r\n            state.bundle = values;\r\n            Object.assign(process.env, values);\r\n            return values;\r\n        }\r\n        throw err;\r\n    }\r\n}\r\n\r\n/**\r\n * Main entry point to load environment variables.\r\n * Uses Singleflight pattern to prevent concurrent network requests.\r\n */\r\nexport function loadEnv(options?: LoadEnvOptions): Promise<Record<string, string>> {\r\n    if (pendingLoadPromise) {\r\n        return pendingLoadPromise;\r\n    }\r\n\r\n    pendingLoadPromise = loadEnvInternal(options)\r\n        .finally(() => {\r\n            pendingLoadPromise = null;\r\n        });\r\n\r\n    return pendingLoadPromise;\r\n}\r\n\r\nexport * from './types.js';\r\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AAUA,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAC1C,IAAI,kBAAA,GAA6D,IAAA;AAG1D,SAAS,WAAA,GAAc;AAC1B,EAAA,KAAA,CAAM,KAAA,EAAM;AACZ,EAAA,kBAAA,GAAqB,IAAA;AACzB;AAQO,SAAS,gBAAgB,OAAA,EAAwC;AACpE,EAAA,MAAM,MAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,MAAM,MAAA,GAAS;AAAA,IACX,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,MAAA,IAAU,GAAA,CAAI,cAAA;AAAA,IACvC,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,MAAA,IAAU,GAAA,CAAI,cAAA;AAAA,IACvC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,CAAI,cAAA;AAAA,IACzC,GAAA,EAAK,OAAA,EAAS,MAAA,EAAQ,GAAA,IAAO,GAAA,CAAI,UAAA;AAAA,IACjC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,CAAI;AAAA,GAC7C;AAEA,EAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAChB,IAAA,MAAM,IAAI,MAAM,8DAA8D,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,MAAA;AACX;AAKA,SAAS,YAAA,GAAe;AACpB,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,IAAA,MAAM,IAAI,MAAM,sGAAsG,CAAA;AAAA,EAC1H;AACJ;AAKA,eAAe,gBAAA,CAAiB,KAAa,IAAA,EAA0C;AACnF,EAAA,MAAM,EAAE,OAAA,GAAU,GAAA,EAAM,GAAG,MAAK,GAAI,IAAA;AACpC,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,KAAK,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,OAAO,CAAA;AAEvD,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,SAAS,GAAA,EAAU;AACf,IAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,OAAO,CAAA,EAAA,CAAI,CAAA;AAAA,IACnE;AACA,IAAA,MAAM,GAAA;AAAA,EACV,CAAA,SAAE;AACE,IAAA,YAAA,CAAa,EAAE,CAAA;AAAA,EACnB;AACJ;AAIA,eAAe,aAAA,CAAc,MAAA,EAAsB,OAAA,EAAiB,KAAA,EAAoC;AACpG,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,iBAAA,CAAA,EAAqB;AAAA,IACpE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,eAAA,EAAiB,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA;AAAA,KAC5C;AAAA,IACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACjB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,SAAS,MAAA,CAAO;AAAA,KACnB,CAAA;AAAA,IACD;AAAA,GACH,CAAA;AAED,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,+BAAA,EAAkC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACpF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,KAAA,CAAM,QAAQ,IAAA,CAAK,KAAA;AACnB,EAAA,KAAA,CAAM,iBAAiB,IAAI,IAAA,CAAK,IAAA,CAAK,SAAS,EAAE,OAAA,EAAQ;AACxD,EAAA,OAAO,IAAA,CAAK,KAAA;AAChB;AAEA,IAAM,cAAA,GAAiB,YAAA;AACvB,IAAM,cAAA,GAAiB,SAAA;AAEvB,eAAe,cAAA,GAAyC;AACpD,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,WAAA,CAAY,gBAAgB,cAAc,CAAA;AACpE,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAE9B,IAAA,OAAO,MAAA,CAAO,WAAA,IAAe,MAAA,CAAO,YAAA,IAAgB,IAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;AAEA,eAAe,yBAAA,CAA0B,MAAA,EAAsB,SAAA,EAAmB,OAAA,EAAkD;AAChI,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,WAAA,CAAA,EAAe;AAAA,IAC9D,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,eAAA,EAAiB,UAAU,SAAS,CAAA;AAAA,KACxC;AAAA,IACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACjB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,SAAS,MAAA,CAAO;AAAA,KACnB,CAAA;AAAA,IACD;AAAA,GACH,CAAA;AAED,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,kCAAA,EAAqC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACvF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,OAAO,IAAA,CAAK,MAAA;AAChB;AAEA,eAAe,WAAA,CAAY,MAAA,EAAsB,KAAA,EAAe,OAAA,EAAkD;AAC9G,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,UAAA,CAAA,EAAc;AAAA,IAC7D,MAAA,EAAQ,KAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,eAAA,EAAiB,UAAU,KAAK,CAAA;AAAA,KACpC;AAAA,IACA;AAAA,GACH,CAAA;AAED,EAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACpB,IAAA,MAAM,IAAI,MAAM,KAAK,CAAA;AAAA,EACzB;AAEA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACnF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,OAAO,IAAA,CAAK,MAAA;AAChB;AAEA,SAAS,qBAAqB,MAAA,EAA8B;AACxD,EAAA,MAAM,SAAA,GAAY,OAAO,MAAA,GAAS,MAAA,CAAO,OAAO,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA,GAAI,aAAA;AAClE,EAAA,OAAO,CAAC,MAAA,CAAO,MAAA,EAAQ,SAAA,EAAW,MAAA,CAAO,OAAA,EAAS,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAC1F;AAEA,eAAe,gBAAgB,OAAA,EAA2D;AACtF,EAAA,YAAA,EAAa;AACb,EAAA,MAAM,MAAA,GAAS,gBAAgB,OAAO,CAAA;AAGtC,EAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAChB,IAAA,MAAM,SAAA,GAAY,MAAM,cAAA,EAAe;AACvC,IAAA,IAAI,CAAC,SAAA,EAAW;AACZ,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACxE;AACA,IAAA,MAAM,SAAS,MAAM,yBAAA,CAA0B,QAAQ,SAAA,EAAW,OAAA,EAAS,WAAW,GAAI,CAAA;AAC1F,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,IAAA,OAAO,MAAA;AAAA,EACX;AAEA,EAAA,MAAM,OAAA,GAAU,SAAS,OAAA,IAAW,GAAA;AACpC,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,gBAAgB,EAAA,GAAK,GAAA;AAE3B,EAAA,MAAM,WAAA,GAAc,qBAAqB,MAAM,CAAA;AAC/C,EAAA,IAAI,CAAC,KAAA,CAAM,GAAA,CAAI,WAAW,CAAA,EAAG;AACzB,IAAA,KAAA,CAAM,GAAA,CAAI,aAAa,EAAE,KAAA,EAAO,MAAM,cAAA,EAAgB,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,EAC9E;AACA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,CAAI,WAAW,CAAA;AAEnC,EAAA,IAAI,QAAQ,KAAA,CAAM,KAAA;AAClB,EAAA,IAAI,aAAa,KAAA,IAAS,KAAA,CAAM,cAAA,IAAkB,KAAA,CAAM,iBAAkB,GAAA,GAAM,aAAA;AAEhF,EAAA,IAAI,CAAC,UAAA,EAAY;AACb,IAAA,KAAA,GAAQ,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAA,EAAS,KAAK,CAAA;AAAA,EACtD;AAEA,EAAA,IAAI,KAAA,CAAM,UAAU,UAAA,EAAY;AAC5B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,KAAA,CAAM,MAAM,CAAA;AACvC,IAAA,OAAO,KAAA,CAAM,MAAA;AAAA,EACjB;AAEA,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,OAAQ,OAAO,CAAA;AACxD,IAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AACf,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,IAAA,OAAO,MAAA;AAAA,EACX,SAAS,GAAA,EAAU;AACf,IAAA,IAAI,GAAA,CAAI,YAAY,KAAA,EAAO;AACvB,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,KAAA,CAAM,MAAA,GAAS,IAAA;AACf,MAAA,MAAM,QAAA,GAAW,MAAM,aAAA,CAAc,MAAA,EAAQ,SAAS,KAAK,CAAA;AAC3D,MAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,UAAU,OAAO,CAAA;AAC1D,MAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AACf,MAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,MAAA,OAAO,MAAA;AAAA,IACX;AACA,IAAA,MAAM,GAAA;AAAA,EACV;AACJ;AAMO,SAAS,QAAQ,OAAA,EAA2D;AAC/E,EAAA,IAAI,kBAAA,EAAoB;AACpB,IAAA,OAAO,kBAAA;AAAA,EACX;AAEA,EAAA,kBAAA,GAAqB,eAAA,CAAgB,OAAO,CAAA,CACvC,OAAA,CAAQ,MAAM;AACX,IAAA,kBAAA,GAAqB,IAAA;AAAA,EACzB,CAAC,CAAA;AAEL,EAAA,OAAO,kBAAA;AACX","file":"index.mjs","sourcesContent":["import keytar from 'keytar';\r\nimport type { EnvGodConfig, LoadEnvOptions, AuthExchangeResponse, BundleResponse } from './types.js';\r\n\r\n// --- State ---\r\ninterface CacheState {\r\n    token: string | null;\r\n    tokenExpiresAt: number | null; // Timestamp in ms\r\n    bundle: Record<string, string> | null;\r\n}\r\n\r\nconst cache = new Map<string, CacheState>();\r\nlet pendingLoadPromise: Promise<Record<string, string>> | null = null;\r\n\r\n/** @internal For testing only */\r\nexport function _resetState() {\r\n    cache.clear();\r\n    pendingLoadPromise = null;\r\n}\r\n\r\n// --- Helpers ---\r\n\r\n/**\r\n * Validates and returns the configuration.\r\n * Prioritizes options > process.env.\r\n */\r\nexport function getEnvGodConfig(options?: LoadEnvOptions): EnvGodConfig {\r\n    const env = process.env;\r\n    const config = {\r\n        apiUrl: options?.config?.apiUrl ?? env.ENVGOD_API_URL,\r\n        apiKey: options?.config?.apiKey ?? env.ENVGOD_API_KEY,\r\n        project: options?.config?.project ?? env.ENVGOD_PROJECT,\r\n        env: options?.config?.env ?? env.ENVGOD_ENV,\r\n        service: options?.config?.service ?? env.ENVGOD_SERVICE,\r\n    };\r\n\r\n    if (!config.apiUrl) {\r\n        throw new Error('[EnvGod] Missing required configuration: apiUrl is required.');\r\n    }\r\n\r\n    return config as EnvGodConfig;\r\n}\r\n\r\n/**\r\n * Checks if the current environment is a browser.\r\n */\r\nfunction checkBrowser() {\r\n    if (typeof window !== 'undefined') {\r\n        throw new Error('[EnvGod] Security Warning: SDK execution attempting in browser environment. This SDK is server-only.');\r\n    }\r\n}\r\n\r\n/**\r\n * Fetches with timeout.\r\n */\r\nasync function fetchWithTimeout(url: string, init: RequestInit & { timeout?: number }) {\r\n    const { timeout = 5000, ...rest } = init;\r\n    const controller = new AbortController();\r\n    const id = setTimeout(() => controller.abort(), timeout);\r\n\r\n    try {\r\n        const res = await fetch(url, { ...rest, signal: controller.signal });\r\n        return res;\r\n    } catch (err: any) {\r\n        if (err.name === 'AbortError') {\r\n            throw new Error(`[EnvGod] Request timed out after ${timeout}ms`);\r\n        }\r\n        throw err;\r\n    } finally {\r\n        clearTimeout(id);\r\n    }\r\n}\r\n\r\n// --- Core Logic ---\r\n\r\nasync function exchangeToken(config: EnvGodConfig, timeout: number, state: CacheState): Promise<string> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/auth/exchange`, {\r\n        method: 'POST',\r\n        headers: {\r\n            'Content-Type': 'application/json',\r\n            'Authorization': `Bearer ${config.apiKey}`,\r\n        },\r\n        body: JSON.stringify({\r\n            project: config.project,\r\n            env: config.env,\r\n            service: config.service,\r\n        }),\r\n        timeout,\r\n    });\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Auth exchange failed: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as AuthExchangeResponse;\r\n    state.token = data.token;\r\n    state.tokenExpiresAt = new Date(data.expiresAt).getTime();\r\n    return data.token;\r\n}\r\n\r\nconst KEYTAR_SERVICE = 'envgod-cli';\r\nconst KEYTAR_ACCOUNT = 'default';\r\n\r\nasync function getAccessToken(): Promise<string | null> {\r\n    const data = await keytar.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);\r\n    if (!data) return null;\r\n    try {\r\n        const parsed = JSON.parse(data);\r\n        // The CLI's device flow currently stores the access token in both slots.\r\n        return parsed.accessToken || parsed.refreshToken || null;\r\n    } catch {\r\n        return null;\r\n    }\r\n}\r\n\r\nasync function fetchSecretsWithUserToken(config: EnvGodConfig, userToken: string, timeout: number): Promise<Record<string, string>> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/secrets`, {\r\n        method: 'POST',\r\n        headers: {\r\n            'Content-Type': 'application/json',\r\n            'Authorization': `Bearer ${userToken}`,\r\n        },\r\n        body: JSON.stringify({\r\n            project: config.project,\r\n            env: config.env,\r\n            service: config.service,\r\n        }),\r\n        timeout,\r\n    });\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Failed to fetch secrets: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as BundleResponse;\r\n    return data.values;\r\n}\r\n\r\nasync function fetchBundle(config: EnvGodConfig, token: string, timeout: number): Promise<Record<string, string>> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/bundle`, {\r\n        method: 'GET',\r\n        headers: {\r\n            'Authorization': `Bearer ${token}`,\r\n        },\r\n        timeout,\r\n    });\r\n\r\n    if (res.status === 401) {\r\n        throw new Error('401'); // Signal to retry\r\n    }\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Fetch bundle failed: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as BundleResponse;\r\n    return data.values;\r\n}\r\n\r\nfunction getConfigFingerprint(config: EnvGodConfig): string {\r\n    const keyPrefix = config.apiKey ? config.apiKey.substring(0, 8) : 'interactive';\r\n    return [config.apiUrl, keyPrefix, config.project, config.env, config.service].join('|');\r\n}\r\n\r\nasync function loadEnvInternal(options?: LoadEnvOptions): Promise<Record<string, string>> {\r\n    checkBrowser();\r\n    const config = getEnvGodConfig(options);\r\n\r\n    // Interactive mode: Use user token if no API key is provided\r\n    if (!config.apiKey) {\r\n        const userToken = await getAccessToken();\r\n        if (!userToken) {\r\n            throw new Error('[EnvGod] Not logged in. Please run `envgod login`.');\r\n        }\r\n        const values = await fetchSecretsWithUserToken(config, userToken, options?.timeout ?? 5000);\r\n        Object.assign(process.env, values);\r\n        return values;\r\n    }\r\n\r\n    const timeout = options?.timeout ?? 5000;\r\n    const now = Date.now();\r\n    const TOKEN_SKEW_MS = 30 * 1000; // 30 seconds\r\n\r\n    const fingerprint = getConfigFingerprint(config);\r\n    if (!cache.has(fingerprint)) {\r\n        cache.set(fingerprint, { token: null, tokenExpiresAt: null, bundle: null });\r\n    }\r\n    const state = cache.get(fingerprint)!;\r\n\r\n    let token = state.token;\r\n    let tokenValid = token && state.tokenExpiresAt && state.tokenExpiresAt > (now + TOKEN_SKEW_MS);\r\n\r\n    if (!tokenValid) {\r\n        token = await exchangeToken(config, timeout, state);\r\n    }\r\n\r\n    if (state.bundle && tokenValid) {\r\n        Object.assign(process.env, state.bundle);\r\n        return state.bundle;\r\n    }\r\n\r\n    try {\r\n        const values = await fetchBundle(config, token!, timeout);\r\n        state.bundle = values;\r\n        Object.assign(process.env, values);\r\n        return values;\r\n    } catch (err: any) {\r\n        if (err.message === '401') {\r\n            state.token = null;\r\n            state.bundle = null;\r\n            const newToken = await exchangeToken(config, timeout, state);\r\n            const values = await fetchBundle(config, newToken, timeout);\r\n            state.bundle = values;\r\n            Object.assign(process.env, values);\r\n            return values;\r\n        }\r\n        throw err;\r\n    }\r\n}\r\n\r\n/**\r\n * Main entry point to load environment variables.\r\n * Uses Singleflight pattern to prevent concurrent network requests.\r\n */\r\nexport function loadEnv(options?: LoadEnvOptions): Promise<Record<string, string>> {\r\n    if (pendingLoadPromise) {\r\n        return pendingLoadPromise;\r\n    }\r\n\r\n    pendingLoadPromise = loadEnvInternal(options)\r\n        .finally(() => {\r\n            pendingLoadPromise = null;\r\n        });\r\n\r\n    return pendingLoadPromise;\r\n}\r\n\r\nexport * from './types.js';\r\n"]}

package/dist/next.js

@@ -1,15 +1,14 @@
 'use strict';
 
 require('server-only');
+var keytar = require('keytar');
 
-// src/next.ts
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var keytar__default = /*#__PURE__*/_interopDefault(keytar);
 
-// src/index.ts
-var state = {
-  token: null,
-  tokenExpiresAt: null,
-  bundle: null
-};
+// src/next.ts
+var cache = /* @__PURE__ */ new Map();
 var pendingLoadPromise = null;
 function getEnvGodConfig(options) {
   const env = process.env;
@@ -20,9 +19,8 @@ function getEnvGodConfig(options) {
     env: options?.config?.env ?? env.ENVGOD_ENV,
     service: options?.config?.service ?? env.ENVGOD_SERVICE
   };
-  const missing = Object.entries(config).filter(([_, v]) => !v).map(([k]) => k);
-  if (missing.length > 0) {
-    throw new Error(`[EnvGod] Missing required configuration: ${missing.join(", ")}`);
+  if (!config.apiUrl) {
+    throw new Error("[EnvGod] Missing required configuration: apiUrl is required.");
   }
   return config;
 }
@@ -47,7 +45,7 @@ async function fetchWithTimeout(url, init) {
     clearTimeout(id);
   }
 }
-async function exchangeToken(config, timeout) {
+async function exchangeToken(config, timeout, state) {
   const res = await fetchWithTimeout(`${config.apiUrl}/v1/auth/exchange`, {
     method: "POST",
     headers: {
@@ -69,6 +67,38 @@ async function exchangeToken(config, timeout) {
   state.tokenExpiresAt = new Date(data.expiresAt).getTime();
   return data.token;
 }
+var KEYTAR_SERVICE = "envgod-cli";
+var KEYTAR_ACCOUNT = "default";
+async function getAccessToken() {
+  const data = await keytar__default.default.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
+  if (!data) return null;
+  try {
+    const parsed = JSON.parse(data);
+    return parsed.accessToken || parsed.refreshToken || null;
+  } catch {
+    return null;
+  }
+}
+async function fetchSecretsWithUserToken(config, userToken, timeout) {
+  const res = await fetchWithTimeout(`${config.apiUrl}/v1/secrets`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "Authorization": `Bearer ${userToken}`
+    },
+    body: JSON.stringify({
+      project: config.project,
+      env: config.env,
+      service: config.service
+    }),
+    timeout
+  });
+  if (!res.ok) {
+    throw new Error(`[EnvGod] Failed to fetch secrets: ${res.status} ${res.statusText}`);
+  }
+  const data = await res.json();
+  return data.values;
+}
 async function fetchBundle(config, token, timeout) {
   const res = await fetchWithTimeout(`${config.apiUrl}/v1/bundle`, {
     method: "GET",
@@ -86,15 +116,34 @@ async function fetchBundle(config, token, timeout) {
   const data = await res.json();
   return data.values;
 }
+function getConfigFingerprint(config) {
+  const keyPrefix = config.apiKey ? config.apiKey.substring(0, 8) : "interactive";
+  return [config.apiUrl, keyPrefix, config.project, config.env, config.service].join("|");
+}
 async function loadEnvInternal(options) {
   checkBrowser();
   const config = getEnvGodConfig(options);
+  if (!config.apiKey) {
+    const userToken = await getAccessToken();
+    if (!userToken) {
+      throw new Error("[EnvGod] Not logged in. Please run `envgod login`.");
+    }
+    const values = await fetchSecretsWithUserToken(config, userToken, options?.timeout ?? 5e3);
+    Object.assign(process.env, values);
+    return values;
+  }
   const timeout = options?.timeout ?? 5e3;
   const now = Date.now();
+  const TOKEN_SKEW_MS = 30 * 1e3;
+  const fingerprint = getConfigFingerprint(config);
+  if (!cache.has(fingerprint)) {
+    cache.set(fingerprint, { token: null, tokenExpiresAt: null, bundle: null });
+  }
+  const state = cache.get(fingerprint);
   let token = state.token;
-  let tokenValid = token && state.tokenExpiresAt && state.tokenExpiresAt > now;
+  let tokenValid = token && state.tokenExpiresAt && state.tokenExpiresAt > now + TOKEN_SKEW_MS;
   if (!tokenValid) {
-    token = await exchangeToken(config, timeout);
+    token = await exchangeToken(config, timeout, state);
   }
   if (state.bundle && tokenValid) {
     Object.assign(process.env, state.bundle);
@@ -109,7 +158,7 @@ async function loadEnvInternal(options) {
     if (err.message === "401") {
       state.token = null;
       state.bundle = null;
-      const newToken = await exchangeToken(config, timeout);
+      const newToken = await exchangeToken(config, timeout, state);
       const values = await fetchBundle(config, newToken, timeout);
       state.bundle = values;
       Object.assign(process.env, values);

package/dist/next.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/next.ts"],"names":[],"mappings":";;;;;;;AASA,IAAM,KAAA,GAAoB;AAAA,EACtB,KAAA,EAAO,IAAA;AAAA,EACP,cAAA,EAAgB,IAAA;AAAA,EAChB,MAAA,EAAQ;AACZ,CAAA;AAEA,IAAI,kBAAA,GAA6D,IAAA;AAgB1D,SAAS,gBAAgB,OAAA,EAAwC;AACpE,EAAA,MAAM,MAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,MAAM,MAAA,GAAS;AAAA,IACX,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,MAAA,IAAU,GAAA,CAAI,cAAA;AAAA,IACvC,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,MAAA,IAAU,GAAA,CAAI,cAAA;AAAA,IACvC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,CAAI,cAAA;AAAA,IACzC,GAAA,EAAK,OAAA,EAAS,MAAA,EAAQ,GAAA,IAAO,GAAA,CAAI,UAAA;AAAA,IACjC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,CAAI;AAAA,GAC7C;AAEA,EAAA,MAAM,UAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAChC,MAAA,CAAO,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAC,CAAC,CAAA,CACrB,GAAA,CAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAEnB,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yCAAA,EAA4C,QAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,EACpF;AAEA,EAAA,OAAO,MAAA;AACX;AAKA,SAAS,YAAA,GAAe;AACpB,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,IAAA,MAAM,IAAI,MAAM,sGAAsG,CAAA;AAAA,EAC1H;AACJ;AAKA,eAAe,gBAAA,CAAiB,KAAa,IAAA,EAA0C;AACnF,EAAA,MAAM,EAAE,OAAA,GAAU,GAAA,EAAM,GAAG,MAAK,GAAI,IAAA;AACpC,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,KAAK,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,OAAO,CAAA;AAEvD,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,SAAS,GAAA,EAAU;AACf,IAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,OAAO,CAAA,EAAA,CAAI,CAAA;AAAA,IACnE;AACA,IAAA,MAAM,GAAA;AAAA,EACV,CAAA,SAAE;AACE,IAAA,YAAA,CAAa,EAAE,CAAA;AAAA,EACnB;AACJ;AAIA,eAAe,aAAA,CAAc,QAAsB,OAAA,EAAkC;AACjF,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,iBAAA,CAAA,EAAqB;AAAA,IACpE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,eAAA,EAAiB,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA;AAAA,KAC5C;AAAA,IACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACjB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,SAAS,MAAA,CAAO;AAAA,KACnB,CAAA;AAAA,IACD;AAAA,GACH,CAAA;AAED,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,+BAAA,EAAkC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACpF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,KAAA,CAAM,QAAQ,IAAA,CAAK,KAAA;AACnB,EAAA,KAAA,CAAM,iBAAiB,IAAI,IAAA,CAAK,IAAA,CAAK,SAAS,EAAE,OAAA,EAAQ;AACxD,EAAA,OAAO,IAAA,CAAK,KAAA;AAChB;AAEA,eAAe,WAAA,CAAY,MAAA,EAAsB,KAAA,EAAe,OAAA,EAAkD;AAC9G,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,UAAA,CAAA,EAAc;AAAA,IAC7D,MAAA,EAAQ,KAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,eAAA,EAAiB,UAAU,KAAK,CAAA;AAAA,KACpC;AAAA,IACA;AAAA,GACH,CAAA;AAED,EAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACpB,IAAA,MAAM,IAAI,MAAM,KAAK,CAAA;AAAA,EACzB;AAEA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACnF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,OAAO,IAAA,CAAK,MAAA;AAChB;AAEA,eAAe,gBAAgB,OAAA,EAA2D;AACtF,EAAA,YAAA,EAAa;AACb,EAAA,MAAM,MAAA,GAAS,gBAAgB,OAAO,CAAA;AACtC,EAAA,MAAM,OAAA,GAAU,SAAS,OAAA,IAAW,GAAA;AACpC,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AAGrB,EAAA,IAAI,QAAQ,KAAA,CAAM,KAAA;AAClB,EAAA,IAAI,UAAA,GAAa,KAAA,IAAS,KAAA,CAAM,cAAA,IAAkB,MAAM,cAAA,GAAiB,GAAA;AAGzE,EAAA,IAAI,CAAC,UAAA,EAAY;AACb,IAAA,KAAA,GAAQ,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAO,CAAA;AAAA,EAC/C;AAGA,EAAA,IAAI,KAAA,CAAM,UAAU,UAAA,EAAY;AAC5B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,KAAA,CAAM,MAAM,CAAA;AACvC,IAAA,OAAO,KAAA,CAAM,MAAA;AAAA,EACjB;AAGA,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,OAAQ,OAAO,CAAA;AACxD,IAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AACf,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,IAAA,OAAO,MAAA;AAAA,EACX,SAAS,GAAA,EAAU;AACf,IAAA,IAAI,GAAA,CAAI,YAAY,KAAA,EAAO;AAEvB,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,KAAA,CAAM,MAAA,GAAS,IAAA;AAEf,MAAA,MAAM,QAAA,GAAW,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAO,CAAA;AACpD,MAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,UAAU,OAAO,CAAA;AAC1D,MAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AACf,MAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,MAAA,OAAO,MAAA;AAAA,IACX;AACA,IAAA,MAAM,GAAA;AAAA,EACV;AACJ;AAMO,SAAS,QAAQ,OAAA,EAA2D;AAC/E,EAAA,IAAI,kBAAA,EAAoB;AACpB,IAAA,OAAO,kBAAA;AAAA,EACX;AAEA,EAAA,kBAAA,GAAqB,eAAA,CAAgB,OAAO,CAAA,CACvC,OAAA,CAAQ,MAAM;AACX,IAAA,kBAAA,GAAqB,IAAA;AAAA,EACzB,CAAC,CAAA;AAEL,EAAA,OAAO,kBAAA;AACX;;;ACzLA,eAAsB,cAAc,OAAA,EAA0B;AAC1D,EAAA,OAAO,QAAQ,OAAO,CAAA;AAC1B","file":"next.js","sourcesContent":["import type { EnvGodConfig, LoadEnvOptions, AuthExchangeResponse, BundleResponse } from './types.js';\r\n\r\n// --- State ---\r\ninterface CacheState {\r\n    token: string | null;\r\n    tokenExpiresAt: number | null; // Timestamp in ms\r\n    bundle: Record<string, string> | null;\r\n}\r\n\r\nconst state: CacheState = {\r\n    token: null,\r\n    tokenExpiresAt: null,\r\n    bundle: null,\r\n};\r\n\r\nlet pendingLoadPromise: Promise<Record<string, string>> | null = null;\r\n\r\n/** @internal For testing only */\r\nexport function _resetState() {\r\n    state.token = null;\r\n    state.tokenExpiresAt = null;\r\n    state.bundle = null;\r\n    pendingLoadPromise = null;\r\n}\r\n\r\n// --- Helpers ---\r\n\r\n/**\r\n * Validates and returns the configuration.\r\n * Prioritizes options > process.env.\r\n */\r\nexport function getEnvGodConfig(options?: LoadEnvOptions): EnvGodConfig {\r\n    const env = process.env;\r\n    const config = {\r\n        apiUrl: options?.config?.apiUrl ?? env.ENVGOD_API_URL,\r\n        apiKey: options?.config?.apiKey ?? env.ENVGOD_API_KEY,\r\n        project: options?.config?.project ?? env.ENVGOD_PROJECT,\r\n        env: options?.config?.env ?? env.ENVGOD_ENV,\r\n        service: options?.config?.service ?? env.ENVGOD_SERVICE,\r\n    };\r\n\r\n    const missing = Object.entries(config)\r\n        .filter(([_, v]) => !v)\r\n        .map(([k]) => k);\r\n\r\n    if (missing.length > 0) {\r\n        throw new Error(`[EnvGod] Missing required configuration: ${missing.join(', ')}`);\r\n    }\r\n\r\n    return config as EnvGodConfig;\r\n}\r\n\r\n/**\r\n * Checks if the current environment is a browser.\r\n */\r\nfunction checkBrowser() {\r\n    if (typeof window !== 'undefined') {\r\n        throw new Error('[EnvGod] Security Warning: SDK execution attempting in browser environment. This SDK is server-only.');\r\n    }\r\n}\r\n\r\n/**\r\n * Fetches with timeout.\r\n */\r\nasync function fetchWithTimeout(url: string, init: RequestInit & { timeout?: number }) {\r\n    const { timeout = 5000, ...rest } = init;\r\n    const controller = new AbortController();\r\n    const id = setTimeout(() => controller.abort(), timeout);\r\n\r\n    try {\r\n        const res = await fetch(url, { ...rest, signal: controller.signal });\r\n        return res;\r\n    } catch (err: any) {\r\n        if (err.name === 'AbortError') {\r\n            throw new Error(`[EnvGod] Request timed out after ${timeout}ms`);\r\n        }\r\n        throw err;\r\n    } finally {\r\n        clearTimeout(id);\r\n    }\r\n}\r\n\r\n// --- Core Logic ---\r\n\r\nasync function exchangeToken(config: EnvGodConfig, timeout: number): Promise<string> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/auth/exchange`, {\r\n        method: 'POST',\r\n        headers: {\r\n            'Content-Type': 'application/json',\r\n            'Authorization': `Bearer ${config.apiKey}`,\r\n        },\r\n        body: JSON.stringify({\r\n            project: config.project,\r\n            env: config.env,\r\n            service: config.service,\r\n        }),\r\n        timeout,\r\n    });\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Auth exchange failed: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as AuthExchangeResponse;\r\n    state.token = data.token;\r\n    state.tokenExpiresAt = new Date(data.expiresAt).getTime();\r\n    return data.token;\r\n}\r\n\r\nasync function fetchBundle(config: EnvGodConfig, token: string, timeout: number): Promise<Record<string, string>> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/bundle`, {\r\n        method: 'GET',\r\n        headers: {\r\n            'Authorization': `Bearer ${token}`,\r\n        },\r\n        timeout,\r\n    });\r\n\r\n    if (res.status === 401) {\r\n        throw new Error('401'); // Signal to retry\r\n    }\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Fetch bundle failed: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as BundleResponse;\r\n    return data.values;\r\n}\r\n\r\nasync function loadEnvInternal(options?: LoadEnvOptions): Promise<Record<string, string>> {\r\n    checkBrowser();\r\n    const config = getEnvGodConfig(options);\r\n    const timeout = options?.timeout ?? 5000;\r\n    const now = Date.now();\r\n\r\n    // 1. Check if we have a valid token\r\n    let token = state.token;\r\n    let tokenValid = token && state.tokenExpiresAt && state.tokenExpiresAt > now;\r\n\r\n    // 2. If token invalid, exchange\r\n    if (!tokenValid) {\r\n        token = await exchangeToken(config, timeout);\r\n    }\r\n\r\n    // 3. If we have a cached bundle and the token is still the same/valid, return it?\r\n    if (state.bundle && tokenValid) {\r\n        Object.assign(process.env, state.bundle);\r\n        return state.bundle;\r\n    }\r\n\r\n    // 4. Fetch bundle with retry logic\r\n    try {\r\n        const values = await fetchBundle(config, token!, timeout);\r\n        state.bundle = values;\r\n        Object.assign(process.env, values);\r\n        return values;\r\n    } catch (err: any) {\r\n        if (err.message === '401') {\r\n            // Retry ONCE: Re-exchange and Re-fetch\r\n            state.token = null;\r\n            state.bundle = null;\r\n\r\n            const newToken = await exchangeToken(config, timeout);\r\n            const values = await fetchBundle(config, newToken, timeout);\r\n            state.bundle = values;\r\n            Object.assign(process.env, values);\r\n            return values;\r\n        }\r\n        throw err;\r\n    }\r\n}\r\n\r\n/**\r\n * Main entry point to load environment variables.\r\n * Uses Singleflight pattern to prevent concurrent network requests.\r\n */\r\nexport function loadEnv(options?: LoadEnvOptions): Promise<Record<string, string>> {\r\n    if (pendingLoadPromise) {\r\n        return pendingLoadPromise;\r\n    }\r\n\r\n    pendingLoadPromise = loadEnvInternal(options)\r\n        .finally(() => {\r\n            pendingLoadPromise = null;\r\n        });\r\n\r\n    return pendingLoadPromise;\r\n}\r\n\r\nexport * from './types.js';\r\n","import 'server-only';\r\nimport { loadEnv, type LoadEnvOptions } from './index.js';\r\n\r\nexport async function loadServerEnv(options?: LoadEnvOptions) {\r\n    return loadEnv(options);\r\n}\r\n\r\nexport * from './types.js';\r\n"]}
+{"version":3,"sources":["../src/index.ts","../src/next.ts"],"names":["keytar"],"mappings":";;;;;;;;;;AAUA,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAC1C,IAAI,kBAAA,GAA6D,IAAA;AAc1D,SAAS,gBAAgB,OAAA,EAAwC;AACpE,EAAA,MAAM,MAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,MAAM,MAAA,GAAS;AAAA,IACX,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,MAAA,IAAU,GAAA,CAAI,cAAA;AAAA,IACvC,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,MAAA,IAAU,GAAA,CAAI,cAAA;AAAA,IACvC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,CAAI,cAAA;AAAA,IACzC,GAAA,EAAK,OAAA,EAAS,MAAA,EAAQ,GAAA,IAAO,GAAA,CAAI,UAAA;AAAA,IACjC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,CAAI;AAAA,GAC7C;AAEA,EAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAChB,IAAA,MAAM,IAAI,MAAM,8DAA8D,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,MAAA;AACX;AAKA,SAAS,YAAA,GAAe;AACpB,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,IAAA,MAAM,IAAI,MAAM,sGAAsG,CAAA;AAAA,EAC1H;AACJ;AAKA,eAAe,gBAAA,CAAiB,KAAa,IAAA,EAA0C;AACnF,EAAA,MAAM,EAAE,OAAA,GAAU,GAAA,EAAM,GAAG,MAAK,GAAI,IAAA;AACpC,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,KAAK,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,OAAO,CAAA;AAEvD,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,SAAS,GAAA,EAAU;AACf,IAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,OAAO,CAAA,EAAA,CAAI,CAAA;AAAA,IACnE;AACA,IAAA,MAAM,GAAA;AAAA,EACV,CAAA,SAAE;AACE,IAAA,YAAA,CAAa,EAAE,CAAA;AAAA,EACnB;AACJ;AAIA,eAAe,aAAA,CAAc,MAAA,EAAsB,OAAA,EAAiB,KAAA,EAAoC;AACpG,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,iBAAA,CAAA,EAAqB;AAAA,IACpE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,eAAA,EAAiB,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA;AAAA,KAC5C;AAAA,IACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACjB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,SAAS,MAAA,CAAO;AAAA,KACnB,CAAA;AAAA,IACD;AAAA,GACH,CAAA;AAED,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,+BAAA,EAAkC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACpF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,KAAA,CAAM,QAAQ,IAAA,CAAK,KAAA;AACnB,EAAA,KAAA,CAAM,iBAAiB,IAAI,IAAA,CAAK,IAAA,CAAK,SAAS,EAAE,OAAA,EAAQ;AACxD,EAAA,OAAO,IAAA,CAAK,KAAA;AAChB;AAEA,IAAM,cAAA,GAAiB,YAAA;AACvB,IAAM,cAAA,GAAiB,SAAA;AAEvB,eAAe,cAAA,GAAyC;AACpD,EAAA,MAAM,IAAA,GAAO,MAAMA,uBAAA,CAAO,WAAA,CAAY,gBAAgB,cAAc,CAAA;AACpE,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAE9B,IAAA,OAAO,MAAA,CAAO,WAAA,IAAe,MAAA,CAAO,YAAA,IAAgB,IAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;AAEA,eAAe,yBAAA,CAA0B,MAAA,EAAsB,SAAA,EAAmB,OAAA,EAAkD;AAChI,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,WAAA,CAAA,EAAe;AAAA,IAC9D,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,eAAA,EAAiB,UAAU,SAAS,CAAA;AAAA,KACxC;AAAA,IACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACjB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,SAAS,MAAA,CAAO;AAAA,KACnB,CAAA;AAAA,IACD;AAAA,GACH,CAAA;AAED,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,kCAAA,EAAqC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACvF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,OAAO,IAAA,CAAK,MAAA;AAChB;AAEA,eAAe,WAAA,CAAY,MAAA,EAAsB,KAAA,EAAe,OAAA,EAAkD;AAC9G,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,UAAA,CAAA,EAAc;AAAA,IAC7D,MAAA,EAAQ,KAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,eAAA,EAAiB,UAAU,KAAK,CAAA;AAAA,KACpC;AAAA,IACA;AAAA,GACH,CAAA;AAED,EAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACpB,IAAA,MAAM,IAAI,MAAM,KAAK,CAAA;AAAA,EACzB;AAEA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACnF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,OAAO,IAAA,CAAK,MAAA;AAChB;AAEA,SAAS,qBAAqB,MAAA,EAA8B;AACxD,EAAA,MAAM,SAAA,GAAY,OAAO,MAAA,GAAS,MAAA,CAAO,OAAO,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA,GAAI,aAAA;AAClE,EAAA,OAAO,CAAC,MAAA,CAAO,MAAA,EAAQ,SAAA,EAAW,MAAA,CAAO,OAAA,EAAS,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAC1F;AAEA,eAAe,gBAAgB,OAAA,EAA2D;AACtF,EAAA,YAAA,EAAa;AACb,EAAA,MAAM,MAAA,GAAS,gBAAgB,OAAO,CAAA;AAGtC,EAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAChB,IAAA,MAAM,SAAA,GAAY,MAAM,cAAA,EAAe;AACvC,IAAA,IAAI,CAAC,SAAA,EAAW;AACZ,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACxE;AACA,IAAA,MAAM,SAAS,MAAM,yBAAA,CAA0B,QAAQ,SAAA,EAAW,OAAA,EAAS,WAAW,GAAI,CAAA;AAC1F,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,IAAA,OAAO,MAAA;AAAA,EACX;AAEA,EAAA,MAAM,OAAA,GAAU,SAAS,OAAA,IAAW,GAAA;AACpC,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,gBAAgB,EAAA,GAAK,GAAA;AAE3B,EAAA,MAAM,WAAA,GAAc,qBAAqB,MAAM,CAAA;AAC/C,EAAA,IAAI,CAAC,KAAA,CAAM,GAAA,CAAI,WAAW,CAAA,EAAG;AACzB,IAAA,KAAA,CAAM,GAAA,CAAI,aAAa,EAAE,KAAA,EAAO,MAAM,cAAA,EAAgB,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,EAC9E;AACA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,CAAI,WAAW,CAAA;AAEnC,EAAA,IAAI,QAAQ,KAAA,CAAM,KAAA;AAClB,EAAA,IAAI,aAAa,KAAA,IAAS,KAAA,CAAM,cAAA,IAAkB,KAAA,CAAM,iBAAkB,GAAA,GAAM,aAAA;AAEhF,EAAA,IAAI,CAAC,UAAA,EAAY;AACb,IAAA,KAAA,GAAQ,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAA,EAAS,KAAK,CAAA;AAAA,EACtD;AAEA,EAAA,IAAI,KAAA,CAAM,UAAU,UAAA,EAAY;AAC5B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,KAAA,CAAM,MAAM,CAAA;AACvC,IAAA,OAAO,KAAA,CAAM,MAAA;AAAA,EACjB;AAEA,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,OAAQ,OAAO,CAAA;AACxD,IAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AACf,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,IAAA,OAAO,MAAA;AAAA,EACX,SAAS,GAAA,EAAU;AACf,IAAA,IAAI,GAAA,CAAI,YAAY,KAAA,EAAO;AACvB,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,KAAA,CAAM,MAAA,GAAS,IAAA;AACf,MAAA,MAAM,QAAA,GAAW,MAAM,aAAA,CAAc,MAAA,EAAQ,SAAS,KAAK,CAAA;AAC3D,MAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,UAAU,OAAO,CAAA;AAC1D,MAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AACf,MAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,MAAA,OAAO,MAAA;AAAA,IACX;AACA,IAAA,MAAM,GAAA;AAAA,EACV;AACJ;AAMO,SAAS,QAAQ,OAAA,EAA2D;AAC/E,EAAA,IAAI,kBAAA,EAAoB;AACpB,IAAA,OAAO,kBAAA;AAAA,EACX;AAEA,EAAA,kBAAA,GAAqB,eAAA,CAAgB,OAAO,CAAA,CACvC,OAAA,CAAQ,MAAM;AACX,IAAA,kBAAA,GAAqB,IAAA;AAAA,EACzB,CAAC,CAAA;AAEL,EAAA,OAAO,kBAAA;AACX;;;ACvOA,eAAsB,cAAc,OAAA,EAA0B;AAC1D,EAAA,OAAO,QAAQ,OAAO,CAAA;AAC1B","file":"next.js","sourcesContent":["import keytar from 'keytar';\r\nimport type { EnvGodConfig, LoadEnvOptions, AuthExchangeResponse, BundleResponse } from './types.js';\r\n\r\n// --- State ---\r\ninterface CacheState {\r\n    token: string | null;\r\n    tokenExpiresAt: number | null; // Timestamp in ms\r\n    bundle: Record<string, string> | null;\r\n}\r\n\r\nconst cache = new Map<string, CacheState>();\r\nlet pendingLoadPromise: Promise<Record<string, string>> | null = null;\r\n\r\n/** @internal For testing only */\r\nexport function _resetState() {\r\n    cache.clear();\r\n    pendingLoadPromise = null;\r\n}\r\n\r\n// --- Helpers ---\r\n\r\n/**\r\n * Validates and returns the configuration.\r\n * Prioritizes options > process.env.\r\n */\r\nexport function getEnvGodConfig(options?: LoadEnvOptions): EnvGodConfig {\r\n    const env = process.env;\r\n    const config = {\r\n        apiUrl: options?.config?.apiUrl ?? env.ENVGOD_API_URL,\r\n        apiKey: options?.config?.apiKey ?? env.ENVGOD_API_KEY,\r\n        project: options?.config?.project ?? env.ENVGOD_PROJECT,\r\n        env: options?.config?.env ?? env.ENVGOD_ENV,\r\n        service: options?.config?.service ?? env.ENVGOD_SERVICE,\r\n    };\r\n\r\n    if (!config.apiUrl) {\r\n        throw new Error('[EnvGod] Missing required configuration: apiUrl is required.');\r\n    }\r\n\r\n    return config as EnvGodConfig;\r\n}\r\n\r\n/**\r\n * Checks if the current environment is a browser.\r\n */\r\nfunction checkBrowser() {\r\n    if (typeof window !== 'undefined') {\r\n        throw new Error('[EnvGod] Security Warning: SDK execution attempting in browser environment. This SDK is server-only.');\r\n    }\r\n}\r\n\r\n/**\r\n * Fetches with timeout.\r\n */\r\nasync function fetchWithTimeout(url: string, init: RequestInit & { timeout?: number }) {\r\n    const { timeout = 5000, ...rest } = init;\r\n    const controller = new AbortController();\r\n    const id = setTimeout(() => controller.abort(), timeout);\r\n\r\n    try {\r\n        const res = await fetch(url, { ...rest, signal: controller.signal });\r\n        return res;\r\n    } catch (err: any) {\r\n        if (err.name === 'AbortError') {\r\n            throw new Error(`[EnvGod] Request timed out after ${timeout}ms`);\r\n        }\r\n        throw err;\r\n    } finally {\r\n        clearTimeout(id);\r\n    }\r\n}\r\n\r\n// --- Core Logic ---\r\n\r\nasync function exchangeToken(config: EnvGodConfig, timeout: number, state: CacheState): Promise<string> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/auth/exchange`, {\r\n        method: 'POST',\r\n        headers: {\r\n            'Content-Type': 'application/json',\r\n            'Authorization': `Bearer ${config.apiKey}`,\r\n        },\r\n        body: JSON.stringify({\r\n            project: config.project,\r\n            env: config.env,\r\n            service: config.service,\r\n        }),\r\n        timeout,\r\n    });\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Auth exchange failed: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as AuthExchangeResponse;\r\n    state.token = data.token;\r\n    state.tokenExpiresAt = new Date(data.expiresAt).getTime();\r\n    return data.token;\r\n}\r\n\r\nconst KEYTAR_SERVICE = 'envgod-cli';\r\nconst KEYTAR_ACCOUNT = 'default';\r\n\r\nasync function getAccessToken(): Promise<string | null> {\r\n    const data = await keytar.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);\r\n    if (!data) return null;\r\n    try {\r\n        const parsed = JSON.parse(data);\r\n        // The CLI's device flow currently stores the access token in both slots.\r\n        return parsed.accessToken || parsed.refreshToken || null;\r\n    } catch {\r\n        return null;\r\n    }\r\n}\r\n\r\nasync function fetchSecretsWithUserToken(config: EnvGodConfig, userToken: string, timeout: number): Promise<Record<string, string>> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/secrets`, {\r\n        method: 'POST',\r\n        headers: {\r\n            'Content-Type': 'application/json',\r\n            'Authorization': `Bearer ${userToken}`,\r\n        },\r\n        body: JSON.stringify({\r\n            project: config.project,\r\n            env: config.env,\r\n            service: config.service,\r\n        }),\r\n        timeout,\r\n    });\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Failed to fetch secrets: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as BundleResponse;\r\n    return data.values;\r\n}\r\n\r\nasync function fetchBundle(config: EnvGodConfig, token: string, timeout: number): Promise<Record<string, string>> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/bundle`, {\r\n        method: 'GET',\r\n        headers: {\r\n            'Authorization': `Bearer ${token}`,\r\n        },\r\n        timeout,\r\n    });\r\n\r\n    if (res.status === 401) {\r\n        throw new Error('401'); // Signal to retry\r\n    }\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Fetch bundle failed: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as BundleResponse;\r\n    return data.values;\r\n}\r\n\r\nfunction getConfigFingerprint(config: EnvGodConfig): string {\r\n    const keyPrefix = config.apiKey ? config.apiKey.substring(0, 8) : 'interactive';\r\n    return [config.apiUrl, keyPrefix, config.project, config.env, config.service].join('|');\r\n}\r\n\r\nasync function loadEnvInternal(options?: LoadEnvOptions): Promise<Record<string, string>> {\r\n    checkBrowser();\r\n    const config = getEnvGodConfig(options);\r\n\r\n    // Interactive mode: Use user token if no API key is provided\r\n    if (!config.apiKey) {\r\n        const userToken = await getAccessToken();\r\n        if (!userToken) {\r\n            throw new Error('[EnvGod] Not logged in. Please run `envgod login`.');\r\n        }\r\n        const values = await fetchSecretsWithUserToken(config, userToken, options?.timeout ?? 5000);\r\n        Object.assign(process.env, values);\r\n        return values;\r\n    }\r\n\r\n    const timeout = options?.timeout ?? 5000;\r\n    const now = Date.now();\r\n    const TOKEN_SKEW_MS = 30 * 1000; // 30 seconds\r\n\r\n    const fingerprint = getConfigFingerprint(config);\r\n    if (!cache.has(fingerprint)) {\r\n        cache.set(fingerprint, { token: null, tokenExpiresAt: null, bundle: null });\r\n    }\r\n    const state = cache.get(fingerprint)!;\r\n\r\n    let token = state.token;\r\n    let tokenValid = token && state.tokenExpiresAt && state.tokenExpiresAt > (now + TOKEN_SKEW_MS);\r\n\r\n    if (!tokenValid) {\r\n        token = await exchangeToken(config, timeout, state);\r\n    }\r\n\r\n    if (state.bundle && tokenValid) {\r\n        Object.assign(process.env, state.bundle);\r\n        return state.bundle;\r\n    }\r\n\r\n    try {\r\n        const values = await fetchBundle(config, token!, timeout);\r\n        state.bundle = values;\r\n        Object.assign(process.env, values);\r\n        return values;\r\n    } catch (err: any) {\r\n        if (err.message === '401') {\r\n            state.token = null;\r\n            state.bundle = null;\r\n            const newToken = await exchangeToken(config, timeout, state);\r\n            const values = await fetchBundle(config, newToken, timeout);\r\n            state.bundle = values;\r\n            Object.assign(process.env, values);\r\n            return values;\r\n        }\r\n        throw err;\r\n    }\r\n}\r\n\r\n/**\r\n * Main entry point to load environment variables.\r\n * Uses Singleflight pattern to prevent concurrent network requests.\r\n */\r\nexport function loadEnv(options?: LoadEnvOptions): Promise<Record<string, string>> {\r\n    if (pendingLoadPromise) {\r\n        return pendingLoadPromise;\r\n    }\r\n\r\n    pendingLoadPromise = loadEnvInternal(options)\r\n        .finally(() => {\r\n            pendingLoadPromise = null;\r\n        });\r\n\r\n    return pendingLoadPromise;\r\n}\r\n\r\nexport * from './types.js';\r\n","import 'server-only';\r\nimport { loadEnv, type LoadEnvOptions } from './index.js';\r\n\r\nexport async function loadServerEnv(options?: LoadEnvOptions) {\r\n    return loadEnv(options);\r\n}\r\n\r\nexport * from './types.js';\r\n"]}

package/dist/next.mjs

@@ -1,13 +1,8 @@
 import 'server-only';
+import keytar from 'keytar';
 
 // src/next.ts
-
-// src/index.ts
-var state = {
-  token: null,
-  tokenExpiresAt: null,
-  bundle: null
-};
+var cache = /* @__PURE__ */ new Map();
 var pendingLoadPromise = null;
 function getEnvGodConfig(options) {
   const env = process.env;
@@ -18,9 +13,8 @@ function getEnvGodConfig(options) {
     env: options?.config?.env ?? env.ENVGOD_ENV,
     service: options?.config?.service ?? env.ENVGOD_SERVICE
   };
-  const missing = Object.entries(config).filter(([_, v]) => !v).map(([k]) => k);
-  if (missing.length > 0) {
-    throw new Error(`[EnvGod] Missing required configuration: ${missing.join(", ")}`);
+  if (!config.apiUrl) {
+    throw new Error("[EnvGod] Missing required configuration: apiUrl is required.");
   }
   return config;
 }
@@ -45,7 +39,7 @@ async function fetchWithTimeout(url, init) {
     clearTimeout(id);
   }
 }
-async function exchangeToken(config, timeout) {
+async function exchangeToken(config, timeout, state) {
   const res = await fetchWithTimeout(`${config.apiUrl}/v1/auth/exchange`, {
     method: "POST",
     headers: {
@@ -67,6 +61,38 @@ async function exchangeToken(config, timeout) {
   state.tokenExpiresAt = new Date(data.expiresAt).getTime();
   return data.token;
 }
+var KEYTAR_SERVICE = "envgod-cli";
+var KEYTAR_ACCOUNT = "default";
+async function getAccessToken() {
+  const data = await keytar.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
+  if (!data) return null;
+  try {
+    const parsed = JSON.parse(data);
+    return parsed.accessToken || parsed.refreshToken || null;
+  } catch {
+    return null;
+  }
+}
+async function fetchSecretsWithUserToken(config, userToken, timeout) {
+  const res = await fetchWithTimeout(`${config.apiUrl}/v1/secrets`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "Authorization": `Bearer ${userToken}`
+    },
+    body: JSON.stringify({
+      project: config.project,
+      env: config.env,
+      service: config.service
+    }),
+    timeout
+  });
+  if (!res.ok) {
+    throw new Error(`[EnvGod] Failed to fetch secrets: ${res.status} ${res.statusText}`);
+  }
+  const data = await res.json();
+  return data.values;
+}
 async function fetchBundle(config, token, timeout) {
   const res = await fetchWithTimeout(`${config.apiUrl}/v1/bundle`, {
     method: "GET",
@@ -84,15 +110,34 @@ async function fetchBundle(config, token, timeout) {
   const data = await res.json();
   return data.values;
 }
+function getConfigFingerprint(config) {
+  const keyPrefix = config.apiKey ? config.apiKey.substring(0, 8) : "interactive";
+  return [config.apiUrl, keyPrefix, config.project, config.env, config.service].join("|");
+}
 async function loadEnvInternal(options) {
   checkBrowser();
   const config = getEnvGodConfig(options);
+  if (!config.apiKey) {
+    const userToken = await getAccessToken();
+    if (!userToken) {
+      throw new Error("[EnvGod] Not logged in. Please run `envgod login`.");
+    }
+    const values = await fetchSecretsWithUserToken(config, userToken, options?.timeout ?? 5e3);
+    Object.assign(process.env, values);
+    return values;
+  }
   const timeout = options?.timeout ?? 5e3;
   const now = Date.now();
+  const TOKEN_SKEW_MS = 30 * 1e3;
+  const fingerprint = getConfigFingerprint(config);
+  if (!cache.has(fingerprint)) {
+    cache.set(fingerprint, { token: null, tokenExpiresAt: null, bundle: null });
+  }
+  const state = cache.get(fingerprint);
   let token = state.token;
-  let tokenValid = token && state.tokenExpiresAt && state.tokenExpiresAt > now;
+  let tokenValid = token && state.tokenExpiresAt && state.tokenExpiresAt > now + TOKEN_SKEW_MS;
   if (!tokenValid) {
-    token = await exchangeToken(config, timeout);
+    token = await exchangeToken(config, timeout, state);
   }
   if (state.bundle && tokenValid) {
     Object.assign(process.env, state.bundle);
@@ -107,7 +152,7 @@ async function loadEnvInternal(options) {
     if (err.message === "401") {
       state.token = null;
       state.bundle = null;
-      const newToken = await exchangeToken(config, timeout);
+      const newToken = await exchangeToken(config, timeout, state);
       const values = await fetchBundle(config, newToken, timeout);
       state.bundle = values;
       Object.assign(process.env, values);

package/dist/next.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/next.ts"],"names":[],"mappings":";;;;;AASA,IAAM,KAAA,GAAoB;AAAA,EACtB,KAAA,EAAO,IAAA;AAAA,EACP,cAAA,EAAgB,IAAA;AAAA,EAChB,MAAA,EAAQ;AACZ,CAAA;AAEA,IAAI,kBAAA,GAA6D,IAAA;AAgB1D,SAAS,gBAAgB,OAAA,EAAwC;AACpE,EAAA,MAAM,MAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,MAAM,MAAA,GAAS;AAAA,IACX,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,MAAA,IAAU,GAAA,CAAI,cAAA;AAAA,IACvC,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,MAAA,IAAU,GAAA,CAAI,cAAA;AAAA,IACvC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,CAAI,cAAA;AAAA,IACzC,GAAA,EAAK,OAAA,EAAS,MAAA,EAAQ,GAAA,IAAO,GAAA,CAAI,UAAA;AAAA,IACjC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,CAAI;AAAA,GAC7C;AAEA,EAAA,MAAM,UAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAChC,MAAA,CAAO,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAC,CAAC,CAAA,CACrB,GAAA,CAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAEnB,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACpB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yCAAA,EAA4C,QAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,EACpF;AAEA,EAAA,OAAO,MAAA;AACX;AAKA,SAAS,YAAA,GAAe;AACpB,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,IAAA,MAAM,IAAI,MAAM,sGAAsG,CAAA;AAAA,EAC1H;AACJ;AAKA,eAAe,gBAAA,CAAiB,KAAa,IAAA,EAA0C;AACnF,EAAA,MAAM,EAAE,OAAA,GAAU,GAAA,EAAM,GAAG,MAAK,GAAI,IAAA;AACpC,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,KAAK,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,OAAO,CAAA;AAEvD,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,SAAS,GAAA,EAAU;AACf,IAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,OAAO,CAAA,EAAA,CAAI,CAAA;AAAA,IACnE;AACA,IAAA,MAAM,GAAA;AAAA,EACV,CAAA,SAAE;AACE,IAAA,YAAA,CAAa,EAAE,CAAA;AAAA,EACnB;AACJ;AAIA,eAAe,aAAA,CAAc,QAAsB,OAAA,EAAkC;AACjF,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,iBAAA,CAAA,EAAqB;AAAA,IACpE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,eAAA,EAAiB,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA;AAAA,KAC5C;AAAA,IACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACjB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,SAAS,MAAA,CAAO;AAAA,KACnB,CAAA;AAAA,IACD;AAAA,GACH,CAAA;AAED,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,+BAAA,EAAkC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACpF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,KAAA,CAAM,QAAQ,IAAA,CAAK,KAAA;AACnB,EAAA,KAAA,CAAM,iBAAiB,IAAI,IAAA,CAAK,IAAA,CAAK,SAAS,EAAE,OAAA,EAAQ;AACxD,EAAA,OAAO,IAAA,CAAK,KAAA;AAChB;AAEA,eAAe,WAAA,CAAY,MAAA,EAAsB,KAAA,EAAe,OAAA,EAAkD;AAC9G,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,UAAA,CAAA,EAAc;AAAA,IAC7D,MAAA,EAAQ,KAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,eAAA,EAAiB,UAAU,KAAK,CAAA;AAAA,KACpC;AAAA,IACA;AAAA,GACH,CAAA;AAED,EAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACpB,IAAA,MAAM,IAAI,MAAM,KAAK,CAAA;AAAA,EACzB;AAEA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACnF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,OAAO,IAAA,CAAK,MAAA;AAChB;AAEA,eAAe,gBAAgB,OAAA,EAA2D;AACtF,EAAA,YAAA,EAAa;AACb,EAAA,MAAM,MAAA,GAAS,gBAAgB,OAAO,CAAA;AACtC,EAAA,MAAM,OAAA,GAAU,SAAS,OAAA,IAAW,GAAA;AACpC,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AAGrB,EAAA,IAAI,QAAQ,KAAA,CAAM,KAAA;AAClB,EAAA,IAAI,UAAA,GAAa,KAAA,IAAS,KAAA,CAAM,cAAA,IAAkB,MAAM,cAAA,GAAiB,GAAA;AAGzE,EAAA,IAAI,CAAC,UAAA,EAAY;AACb,IAAA,KAAA,GAAQ,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAO,CAAA;AAAA,EAC/C;AAGA,EAAA,IAAI,KAAA,CAAM,UAAU,UAAA,EAAY;AAC5B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,KAAA,CAAM,MAAM,CAAA;AACvC,IAAA,OAAO,KAAA,CAAM,MAAA;AAAA,EACjB;AAGA,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,OAAQ,OAAO,CAAA;AACxD,IAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AACf,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,IAAA,OAAO,MAAA;AAAA,EACX,SAAS,GAAA,EAAU;AACf,IAAA,IAAI,GAAA,CAAI,YAAY,KAAA,EAAO;AAEvB,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,KAAA,CAAM,MAAA,GAAS,IAAA;AAEf,MAAA,MAAM,QAAA,GAAW,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAO,CAAA;AACpD,MAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,UAAU,OAAO,CAAA;AAC1D,MAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AACf,MAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,MAAA,OAAO,MAAA;AAAA,IACX;AACA,IAAA,MAAM,GAAA;AAAA,EACV;AACJ;AAMO,SAAS,QAAQ,OAAA,EAA2D;AAC/E,EAAA,IAAI,kBAAA,EAAoB;AACpB,IAAA,OAAO,kBAAA;AAAA,EACX;AAEA,EAAA,kBAAA,GAAqB,eAAA,CAAgB,OAAO,CAAA,CACvC,OAAA,CAAQ,MAAM;AACX,IAAA,kBAAA,GAAqB,IAAA;AAAA,EACzB,CAAC,CAAA;AAEL,EAAA,OAAO,kBAAA;AACX;;;ACzLA,eAAsB,cAAc,OAAA,EAA0B;AAC1D,EAAA,OAAO,QAAQ,OAAO,CAAA;AAC1B","file":"next.mjs","sourcesContent":["import type { EnvGodConfig, LoadEnvOptions, AuthExchangeResponse, BundleResponse } from './types.js';\r\n\r\n// --- State ---\r\ninterface CacheState {\r\n    token: string | null;\r\n    tokenExpiresAt: number | null; // Timestamp in ms\r\n    bundle: Record<string, string> | null;\r\n}\r\n\r\nconst state: CacheState = {\r\n    token: null,\r\n    tokenExpiresAt: null,\r\n    bundle: null,\r\n};\r\n\r\nlet pendingLoadPromise: Promise<Record<string, string>> | null = null;\r\n\r\n/** @internal For testing only */\r\nexport function _resetState() {\r\n    state.token = null;\r\n    state.tokenExpiresAt = null;\r\n    state.bundle = null;\r\n    pendingLoadPromise = null;\r\n}\r\n\r\n// --- Helpers ---\r\n\r\n/**\r\n * Validates and returns the configuration.\r\n * Prioritizes options > process.env.\r\n */\r\nexport function getEnvGodConfig(options?: LoadEnvOptions): EnvGodConfig {\r\n    const env = process.env;\r\n    const config = {\r\n        apiUrl: options?.config?.apiUrl ?? env.ENVGOD_API_URL,\r\n        apiKey: options?.config?.apiKey ?? env.ENVGOD_API_KEY,\r\n        project: options?.config?.project ?? env.ENVGOD_PROJECT,\r\n        env: options?.config?.env ?? env.ENVGOD_ENV,\r\n        service: options?.config?.service ?? env.ENVGOD_SERVICE,\r\n    };\r\n\r\n    const missing = Object.entries(config)\r\n        .filter(([_, v]) => !v)\r\n        .map(([k]) => k);\r\n\r\n    if (missing.length > 0) {\r\n        throw new Error(`[EnvGod] Missing required configuration: ${missing.join(', ')}`);\r\n    }\r\n\r\n    return config as EnvGodConfig;\r\n}\r\n\r\n/**\r\n * Checks if the current environment is a browser.\r\n */\r\nfunction checkBrowser() {\r\n    if (typeof window !== 'undefined') {\r\n        throw new Error('[EnvGod] Security Warning: SDK execution attempting in browser environment. This SDK is server-only.');\r\n    }\r\n}\r\n\r\n/**\r\n * Fetches with timeout.\r\n */\r\nasync function fetchWithTimeout(url: string, init: RequestInit & { timeout?: number }) {\r\n    const { timeout = 5000, ...rest } = init;\r\n    const controller = new AbortController();\r\n    const id = setTimeout(() => controller.abort(), timeout);\r\n\r\n    try {\r\n        const res = await fetch(url, { ...rest, signal: controller.signal });\r\n        return res;\r\n    } catch (err: any) {\r\n        if (err.name === 'AbortError') {\r\n            throw new Error(`[EnvGod] Request timed out after ${timeout}ms`);\r\n        }\r\n        throw err;\r\n    } finally {\r\n        clearTimeout(id);\r\n    }\r\n}\r\n\r\n// --- Core Logic ---\r\n\r\nasync function exchangeToken(config: EnvGodConfig, timeout: number): Promise<string> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/auth/exchange`, {\r\n        method: 'POST',\r\n        headers: {\r\n            'Content-Type': 'application/json',\r\n            'Authorization': `Bearer ${config.apiKey}`,\r\n        },\r\n        body: JSON.stringify({\r\n            project: config.project,\r\n            env: config.env,\r\n            service: config.service,\r\n        }),\r\n        timeout,\r\n    });\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Auth exchange failed: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as AuthExchangeResponse;\r\n    state.token = data.token;\r\n    state.tokenExpiresAt = new Date(data.expiresAt).getTime();\r\n    return data.token;\r\n}\r\n\r\nasync function fetchBundle(config: EnvGodConfig, token: string, timeout: number): Promise<Record<string, string>> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/bundle`, {\r\n        method: 'GET',\r\n        headers: {\r\n            'Authorization': `Bearer ${token}`,\r\n        },\r\n        timeout,\r\n    });\r\n\r\n    if (res.status === 401) {\r\n        throw new Error('401'); // Signal to retry\r\n    }\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Fetch bundle failed: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as BundleResponse;\r\n    return data.values;\r\n}\r\n\r\nasync function loadEnvInternal(options?: LoadEnvOptions): Promise<Record<string, string>> {\r\n    checkBrowser();\r\n    const config = getEnvGodConfig(options);\r\n    const timeout = options?.timeout ?? 5000;\r\n    const now = Date.now();\r\n\r\n    // 1. Check if we have a valid token\r\n    let token = state.token;\r\n    let tokenValid = token && state.tokenExpiresAt && state.tokenExpiresAt > now;\r\n\r\n    // 2. If token invalid, exchange\r\n    if (!tokenValid) {\r\n        token = await exchangeToken(config, timeout);\r\n    }\r\n\r\n    // 3. If we have a cached bundle and the token is still the same/valid, return it?\r\n    if (state.bundle && tokenValid) {\r\n        Object.assign(process.env, state.bundle);\r\n        return state.bundle;\r\n    }\r\n\r\n    // 4. Fetch bundle with retry logic\r\n    try {\r\n        const values = await fetchBundle(config, token!, timeout);\r\n        state.bundle = values;\r\n        Object.assign(process.env, values);\r\n        return values;\r\n    } catch (err: any) {\r\n        if (err.message === '401') {\r\n            // Retry ONCE: Re-exchange and Re-fetch\r\n            state.token = null;\r\n            state.bundle = null;\r\n\r\n            const newToken = await exchangeToken(config, timeout);\r\n            const values = await fetchBundle(config, newToken, timeout);\r\n            state.bundle = values;\r\n            Object.assign(process.env, values);\r\n            return values;\r\n        }\r\n        throw err;\r\n    }\r\n}\r\n\r\n/**\r\n * Main entry point to load environment variables.\r\n * Uses Singleflight pattern to prevent concurrent network requests.\r\n */\r\nexport function loadEnv(options?: LoadEnvOptions): Promise<Record<string, string>> {\r\n    if (pendingLoadPromise) {\r\n        return pendingLoadPromise;\r\n    }\r\n\r\n    pendingLoadPromise = loadEnvInternal(options)\r\n        .finally(() => {\r\n            pendingLoadPromise = null;\r\n        });\r\n\r\n    return pendingLoadPromise;\r\n}\r\n\r\nexport * from './types.js';\r\n","import 'server-only';\r\nimport { loadEnv, type LoadEnvOptions } from './index.js';\r\n\r\nexport async function loadServerEnv(options?: LoadEnvOptions) {\r\n    return loadEnv(options);\r\n}\r\n\r\nexport * from './types.js';\r\n"]}
+{"version":3,"sources":["../src/index.ts","../src/next.ts"],"names":[],"mappings":";;;;AAUA,IAAM,KAAA,uBAAY,GAAA,EAAwB;AAC1C,IAAI,kBAAA,GAA6D,IAAA;AAc1D,SAAS,gBAAgB,OAAA,EAAwC;AACpE,EAAA,MAAM,MAAM,OAAA,CAAQ,GAAA;AACpB,EAAA,MAAM,MAAA,GAAS;AAAA,IACX,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,MAAA,IAAU,GAAA,CAAI,cAAA;AAAA,IACvC,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,MAAA,IAAU,GAAA,CAAI,cAAA;AAAA,IACvC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,CAAI,cAAA;AAAA,IACzC,GAAA,EAAK,OAAA,EAAS,MAAA,EAAQ,GAAA,IAAO,GAAA,CAAI,UAAA;AAAA,IACjC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAA,IAAW,GAAA,CAAI;AAAA,GAC7C;AAEA,EAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAChB,IAAA,MAAM,IAAI,MAAM,8DAA8D,CAAA;AAAA,EAClF;AAEA,EAAA,OAAO,MAAA;AACX;AAKA,SAAS,YAAA,GAAe;AACpB,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAC/B,IAAA,MAAM,IAAI,MAAM,sGAAsG,CAAA;AAAA,EAC1H;AACJ;AAKA,eAAe,gBAAA,CAAiB,KAAa,IAAA,EAA0C;AACnF,EAAA,MAAM,EAAE,OAAA,GAAU,GAAA,EAAM,GAAG,MAAK,GAAI,IAAA;AACpC,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,KAAK,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,OAAO,CAAA;AAEvD,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,SAAS,GAAA,EAAU;AACf,IAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,OAAO,CAAA,EAAA,CAAI,CAAA;AAAA,IACnE;AACA,IAAA,MAAM,GAAA;AAAA,EACV,CAAA,SAAE;AACE,IAAA,YAAA,CAAa,EAAE,CAAA;AAAA,EACnB;AACJ;AAIA,eAAe,aAAA,CAAc,MAAA,EAAsB,OAAA,EAAiB,KAAA,EAAoC;AACpG,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,iBAAA,CAAA,EAAqB;AAAA,IACpE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,eAAA,EAAiB,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA;AAAA,KAC5C;AAAA,IACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACjB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,SAAS,MAAA,CAAO;AAAA,KACnB,CAAA;AAAA,IACD;AAAA,GACH,CAAA;AAED,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,+BAAA,EAAkC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACpF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,KAAA,CAAM,QAAQ,IAAA,CAAK,KAAA;AACnB,EAAA,KAAA,CAAM,iBAAiB,IAAI,IAAA,CAAK,IAAA,CAAK,SAAS,EAAE,OAAA,EAAQ;AACxD,EAAA,OAAO,IAAA,CAAK,KAAA;AAChB;AAEA,IAAM,cAAA,GAAiB,YAAA;AACvB,IAAM,cAAA,GAAiB,SAAA;AAEvB,eAAe,cAAA,GAAyC;AACpD,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,WAAA,CAAY,gBAAgB,cAAc,CAAA;AACpE,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAE9B,IAAA,OAAO,MAAA,CAAO,WAAA,IAAe,MAAA,CAAO,YAAA,IAAgB,IAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;AAEA,eAAe,yBAAA,CAA0B,MAAA,EAAsB,SAAA,EAAmB,OAAA,EAAkD;AAChI,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,WAAA,CAAA,EAAe;AAAA,IAC9D,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,cAAA,EAAgB,kBAAA;AAAA,MAChB,eAAA,EAAiB,UAAU,SAAS,CAAA;AAAA,KACxC;AAAA,IACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACjB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,KAAK,MAAA,CAAO,GAAA;AAAA,MACZ,SAAS,MAAA,CAAO;AAAA,KACnB,CAAA;AAAA,IACD;AAAA,GACH,CAAA;AAED,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,kCAAA,EAAqC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACvF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,OAAO,IAAA,CAAK,MAAA;AAChB;AAEA,eAAe,WAAA,CAAY,MAAA,EAAsB,KAAA,EAAe,OAAA,EAAkD;AAC9G,EAAA,MAAM,MAAM,MAAM,gBAAA,CAAiB,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,UAAA,CAAA,EAAc;AAAA,IAC7D,MAAA,EAAQ,KAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACL,eAAA,EAAiB,UAAU,KAAK,CAAA;AAAA,KACpC;AAAA,IACA;AAAA,GACH,CAAA;AAED,EAAA,IAAI,GAAA,CAAI,WAAW,GAAA,EAAK;AACpB,IAAA,MAAM,IAAI,MAAM,KAAK,CAAA;AAAA,EACzB;AAEA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,IAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACnF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,EAAA,OAAO,IAAA,CAAK,MAAA;AAChB;AAEA,SAAS,qBAAqB,MAAA,EAA8B;AACxD,EAAA,MAAM,SAAA,GAAY,OAAO,MAAA,GAAS,MAAA,CAAO,OAAO,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA,GAAI,aAAA;AAClE,EAAA,OAAO,CAAC,MAAA,CAAO,MAAA,EAAQ,SAAA,EAAW,MAAA,CAAO,OAAA,EAAS,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAC1F;AAEA,eAAe,gBAAgB,OAAA,EAA2D;AACtF,EAAA,YAAA,EAAa;AACb,EAAA,MAAM,MAAA,GAAS,gBAAgB,OAAO,CAAA;AAGtC,EAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAChB,IAAA,MAAM,SAAA,GAAY,MAAM,cAAA,EAAe;AACvC,IAAA,IAAI,CAAC,SAAA,EAAW;AACZ,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACxE;AACA,IAAA,MAAM,SAAS,MAAM,yBAAA,CAA0B,QAAQ,SAAA,EAAW,OAAA,EAAS,WAAW,GAAI,CAAA;AAC1F,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,IAAA,OAAO,MAAA;AAAA,EACX;AAEA,EAAA,MAAM,OAAA,GAAU,SAAS,OAAA,IAAW,GAAA;AACpC,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,gBAAgB,EAAA,GAAK,GAAA;AAE3B,EAAA,MAAM,WAAA,GAAc,qBAAqB,MAAM,CAAA;AAC/C,EAAA,IAAI,CAAC,KAAA,CAAM,GAAA,CAAI,WAAW,CAAA,EAAG;AACzB,IAAA,KAAA,CAAM,GAAA,CAAI,aAAa,EAAE,KAAA,EAAO,MAAM,cAAA,EAAgB,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,EAC9E;AACA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,CAAI,WAAW,CAAA;AAEnC,EAAA,IAAI,QAAQ,KAAA,CAAM,KAAA;AAClB,EAAA,IAAI,aAAa,KAAA,IAAS,KAAA,CAAM,cAAA,IAAkB,KAAA,CAAM,iBAAkB,GAAA,GAAM,aAAA;AAEhF,EAAA,IAAI,CAAC,UAAA,EAAY;AACb,IAAA,KAAA,GAAQ,MAAM,aAAA,CAAc,MAAA,EAAQ,OAAA,EAAS,KAAK,CAAA;AAAA,EACtD;AAEA,EAAA,IAAI,KAAA,CAAM,UAAU,UAAA,EAAY;AAC5B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,KAAA,CAAM,MAAM,CAAA;AACvC,IAAA,OAAO,KAAA,CAAM,MAAA;AAAA,EACjB;AAEA,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,OAAQ,OAAO,CAAA;AACxD,IAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AACf,IAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,IAAA,OAAO,MAAA;AAAA,EACX,SAAS,GAAA,EAAU;AACf,IAAA,IAAI,GAAA,CAAI,YAAY,KAAA,EAAO;AACvB,MAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,MAAA,KAAA,CAAM,MAAA,GAAS,IAAA;AACf,MAAA,MAAM,QAAA,GAAW,MAAM,aAAA,CAAc,MAAA,EAAQ,SAAS,KAAK,CAAA;AAC3D,MAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,MAAA,EAAQ,UAAU,OAAO,CAAA;AAC1D,MAAA,KAAA,CAAM,MAAA,GAAS,MAAA;AACf,MAAA,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,GAAA,EAAK,MAAM,CAAA;AACjC,MAAA,OAAO,MAAA;AAAA,IACX;AACA,IAAA,MAAM,GAAA;AAAA,EACV;AACJ;AAMO,SAAS,QAAQ,OAAA,EAA2D;AAC/E,EAAA,IAAI,kBAAA,EAAoB;AACpB,IAAA,OAAO,kBAAA;AAAA,EACX;AAEA,EAAA,kBAAA,GAAqB,eAAA,CAAgB,OAAO,CAAA,CACvC,OAAA,CAAQ,MAAM;AACX,IAAA,kBAAA,GAAqB,IAAA;AAAA,EACzB,CAAC,CAAA;AAEL,EAAA,OAAO,kBAAA;AACX;;;ACvOA,eAAsB,cAAc,OAAA,EAA0B;AAC1D,EAAA,OAAO,QAAQ,OAAO,CAAA;AAC1B","file":"next.mjs","sourcesContent":["import keytar from 'keytar';\r\nimport type { EnvGodConfig, LoadEnvOptions, AuthExchangeResponse, BundleResponse } from './types.js';\r\n\r\n// --- State ---\r\ninterface CacheState {\r\n    token: string | null;\r\n    tokenExpiresAt: number | null; // Timestamp in ms\r\n    bundle: Record<string, string> | null;\r\n}\r\n\r\nconst cache = new Map<string, CacheState>();\r\nlet pendingLoadPromise: Promise<Record<string, string>> | null = null;\r\n\r\n/** @internal For testing only */\r\nexport function _resetState() {\r\n    cache.clear();\r\n    pendingLoadPromise = null;\r\n}\r\n\r\n// --- Helpers ---\r\n\r\n/**\r\n * Validates and returns the configuration.\r\n * Prioritizes options > process.env.\r\n */\r\nexport function getEnvGodConfig(options?: LoadEnvOptions): EnvGodConfig {\r\n    const env = process.env;\r\n    const config = {\r\n        apiUrl: options?.config?.apiUrl ?? env.ENVGOD_API_URL,\r\n        apiKey: options?.config?.apiKey ?? env.ENVGOD_API_KEY,\r\n        project: options?.config?.project ?? env.ENVGOD_PROJECT,\r\n        env: options?.config?.env ?? env.ENVGOD_ENV,\r\n        service: options?.config?.service ?? env.ENVGOD_SERVICE,\r\n    };\r\n\r\n    if (!config.apiUrl) {\r\n        throw new Error('[EnvGod] Missing required configuration: apiUrl is required.');\r\n    }\r\n\r\n    return config as EnvGodConfig;\r\n}\r\n\r\n/**\r\n * Checks if the current environment is a browser.\r\n */\r\nfunction checkBrowser() {\r\n    if (typeof window !== 'undefined') {\r\n        throw new Error('[EnvGod] Security Warning: SDK execution attempting in browser environment. This SDK is server-only.');\r\n    }\r\n}\r\n\r\n/**\r\n * Fetches with timeout.\r\n */\r\nasync function fetchWithTimeout(url: string, init: RequestInit & { timeout?: number }) {\r\n    const { timeout = 5000, ...rest } = init;\r\n    const controller = new AbortController();\r\n    const id = setTimeout(() => controller.abort(), timeout);\r\n\r\n    try {\r\n        const res = await fetch(url, { ...rest, signal: controller.signal });\r\n        return res;\r\n    } catch (err: any) {\r\n        if (err.name === 'AbortError') {\r\n            throw new Error(`[EnvGod] Request timed out after ${timeout}ms`);\r\n        }\r\n        throw err;\r\n    } finally {\r\n        clearTimeout(id);\r\n    }\r\n}\r\n\r\n// --- Core Logic ---\r\n\r\nasync function exchangeToken(config: EnvGodConfig, timeout: number, state: CacheState): Promise<string> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/auth/exchange`, {\r\n        method: 'POST',\r\n        headers: {\r\n            'Content-Type': 'application/json',\r\n            'Authorization': `Bearer ${config.apiKey}`,\r\n        },\r\n        body: JSON.stringify({\r\n            project: config.project,\r\n            env: config.env,\r\n            service: config.service,\r\n        }),\r\n        timeout,\r\n    });\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Auth exchange failed: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as AuthExchangeResponse;\r\n    state.token = data.token;\r\n    state.tokenExpiresAt = new Date(data.expiresAt).getTime();\r\n    return data.token;\r\n}\r\n\r\nconst KEYTAR_SERVICE = 'envgod-cli';\r\nconst KEYTAR_ACCOUNT = 'default';\r\n\r\nasync function getAccessToken(): Promise<string | null> {\r\n    const data = await keytar.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);\r\n    if (!data) return null;\r\n    try {\r\n        const parsed = JSON.parse(data);\r\n        // The CLI's device flow currently stores the access token in both slots.\r\n        return parsed.accessToken || parsed.refreshToken || null;\r\n    } catch {\r\n        return null;\r\n    }\r\n}\r\n\r\nasync function fetchSecretsWithUserToken(config: EnvGodConfig, userToken: string, timeout: number): Promise<Record<string, string>> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/secrets`, {\r\n        method: 'POST',\r\n        headers: {\r\n            'Content-Type': 'application/json',\r\n            'Authorization': `Bearer ${userToken}`,\r\n        },\r\n        body: JSON.stringify({\r\n            project: config.project,\r\n            env: config.env,\r\n            service: config.service,\r\n        }),\r\n        timeout,\r\n    });\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Failed to fetch secrets: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as BundleResponse;\r\n    return data.values;\r\n}\r\n\r\nasync function fetchBundle(config: EnvGodConfig, token: string, timeout: number): Promise<Record<string, string>> {\r\n    const res = await fetchWithTimeout(`${config.apiUrl}/v1/bundle`, {\r\n        method: 'GET',\r\n        headers: {\r\n            'Authorization': `Bearer ${token}`,\r\n        },\r\n        timeout,\r\n    });\r\n\r\n    if (res.status === 401) {\r\n        throw new Error('401'); // Signal to retry\r\n    }\r\n\r\n    if (!res.ok) {\r\n        throw new Error(`[EnvGod] Fetch bundle failed: ${res.status} ${res.statusText}`);\r\n    }\r\n\r\n    const data = (await res.json()) as BundleResponse;\r\n    return data.values;\r\n}\r\n\r\nfunction getConfigFingerprint(config: EnvGodConfig): string {\r\n    const keyPrefix = config.apiKey ? config.apiKey.substring(0, 8) : 'interactive';\r\n    return [config.apiUrl, keyPrefix, config.project, config.env, config.service].join('|');\r\n}\r\n\r\nasync function loadEnvInternal(options?: LoadEnvOptions): Promise<Record<string, string>> {\r\n    checkBrowser();\r\n    const config = getEnvGodConfig(options);\r\n\r\n    // Interactive mode: Use user token if no API key is provided\r\n    if (!config.apiKey) {\r\n        const userToken = await getAccessToken();\r\n        if (!userToken) {\r\n            throw new Error('[EnvGod] Not logged in. Please run `envgod login`.');\r\n        }\r\n        const values = await fetchSecretsWithUserToken(config, userToken, options?.timeout ?? 5000);\r\n        Object.assign(process.env, values);\r\n        return values;\r\n    }\r\n\r\n    const timeout = options?.timeout ?? 5000;\r\n    const now = Date.now();\r\n    const TOKEN_SKEW_MS = 30 * 1000; // 30 seconds\r\n\r\n    const fingerprint = getConfigFingerprint(config);\r\n    if (!cache.has(fingerprint)) {\r\n        cache.set(fingerprint, { token: null, tokenExpiresAt: null, bundle: null });\r\n    }\r\n    const state = cache.get(fingerprint)!;\r\n\r\n    let token = state.token;\r\n    let tokenValid = token && state.tokenExpiresAt && state.tokenExpiresAt > (now + TOKEN_SKEW_MS);\r\n\r\n    if (!tokenValid) {\r\n        token = await exchangeToken(config, timeout, state);\r\n    }\r\n\r\n    if (state.bundle && tokenValid) {\r\n        Object.assign(process.env, state.bundle);\r\n        return state.bundle;\r\n    }\r\n\r\n    try {\r\n        const values = await fetchBundle(config, token!, timeout);\r\n        state.bundle = values;\r\n        Object.assign(process.env, values);\r\n        return values;\r\n    } catch (err: any) {\r\n        if (err.message === '401') {\r\n            state.token = null;\r\n            state.bundle = null;\r\n            const newToken = await exchangeToken(config, timeout, state);\r\n            const values = await fetchBundle(config, newToken, timeout);\r\n            state.bundle = values;\r\n            Object.assign(process.env, values);\r\n            return values;\r\n        }\r\n        throw err;\r\n    }\r\n}\r\n\r\n/**\r\n * Main entry point to load environment variables.\r\n * Uses Singleflight pattern to prevent concurrent network requests.\r\n */\r\nexport function loadEnv(options?: LoadEnvOptions): Promise<Record<string, string>> {\r\n    if (pendingLoadPromise) {\r\n        return pendingLoadPromise;\r\n    }\r\n\r\n    pendingLoadPromise = loadEnvInternal(options)\r\n        .finally(() => {\r\n            pendingLoadPromise = null;\r\n        });\r\n\r\n    return pendingLoadPromise;\r\n}\r\n\r\nexport * from './types.js';\r\n","import 'server-only';\r\nimport { loadEnv, type LoadEnvOptions } from './index.js';\r\n\r\nexport async function loadServerEnv(options?: LoadEnvOptions) {\r\n    return loadEnv(options);\r\n}\r\n\r\nexport * from './types.js';\r\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rusamer/envgod",
-  "version": "0.0.1",
+  "version": "0.0.4",
   "description": "Secure Node.js/Next.js SDK for EnvGod",
   "repository": {
     "type": "git",
@@ -45,13 +45,14 @@
   "license": "MIT",
   "sideEffects": false,
   "devDependencies": {
-    "@types/node": "^20.0.0",
+    "@types/node": "^20.19.27",
     "tsup": "^8.0.0",
     "typescript": "^5.0.0",
     "undici": "^6.0.0",
     "vitest": "^1.0.0"
   },
   "dependencies": {
+    "keytar": "^7.9.0",
     "server-only": "^0.0.1"
   }
-}
+}