@zodal/dials-core 0.1.0

package/dist/index.cjs

@@ -0,0 +1,739 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  UNSET: () => UNSET,
+  applyDependentDefaults: () => applyDependentDefaults,
+  applyJsonPatch: () => applyJsonPatch,
+  applyMergePatch: () => applyMergePatch,
+  baseType: () => baseType,
+  classifySensitivity: () => classifySensitivity,
+  defineDials: () => defineDials,
+  deserializeLayer: () => deserializeLayer,
+  diffJsonPatch: () => diffJsonPatch,
+  evaluateConstraints: () => evaluateConstraints,
+  extractDefaults: () => extractDefaults,
+  getObjectShape: () => getObjectShape,
+  invertJsonPatch: () => invertJsonPatch,
+  isSecretRef: () => isSecretRef,
+  isUnset: () => isUnset,
+  keyMergeStrategy: () => keyMergeStrategy,
+  layerToMergePatch: () => layerToMergePatch,
+  makeSecretRef: () => makeSecretRef,
+  maskEffectiveResult: () => maskEffectiveResult,
+  maskSecrets: () => maskSecrets,
+  mergeValues: () => mergeValues,
+  readMeta: () => readMeta,
+  redactSecretsFromLayer: () => redactSecretsFromLayer,
+  resolve: () => resolve,
+  serializeLayer: () => serializeLayer,
+  splitBySensitivity: () => splitBySensitivity
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/model.ts
+var UNSET = /* @__PURE__ */ Symbol.for("@zodal/dials.UNSET");
+function isUnset(v) {
+  return v === UNSET;
+}
+function isSecretRef(v) {
+  return typeof v === "object" && v !== null && v._tag === "SecretRef";
+}
+
+// src/util.ts
+var PROTO_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function setOwn(obj, key, value) {
+  if (PROTO_KEYS.has(key)) {
+    Object.defineProperty(obj, key, { value, writable: true, enumerable: true, configurable: true });
+  } else {
+    obj[key] = value;
+  }
+}
+function isPlainObject(v) {
+  if (typeof v !== "object" || v === null || Array.isArray(v)) return false;
+  const proto = Object.getPrototypeOf(v);
+  return proto === Object.prototype || proto === null;
+}
+function deepClone(v) {
+  if (Array.isArray(v)) return v.map((x) => deepClone(x));
+  if (isPlainObject(v)) {
+    const out = {};
+    for (const [k, val] of Object.entries(v)) setOwn(out, k, deepClone(val));
+    return out;
+  }
+  return v;
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    return a.length === b.length && a.every((x, i) => deepEqual(x, b[i]));
+  }
+  if (isPlainObject(a) && isPlainObject(b)) {
+    const ak = Object.keys(a);
+    const bk = Object.keys(b);
+    return ak.length === bk.length && ak.every((k) => Object.prototype.hasOwnProperty.call(b, k) && deepEqual(a[k], b[k]));
+  }
+  return false;
+}
+function deepMerge(a, b) {
+  if (isPlainObject(a) && isPlainObject(b)) {
+    const out = deepClone(a);
+    for (const [k, vb] of Object.entries(b)) {
+      setOwn(out, k, Object.prototype.hasOwnProperty.call(out, k) ? deepMerge(out[k], vb) : deepClone(vb));
+    }
+    return out;
+  }
+  return deepClone(b);
+}
+
+// src/merge.ts
+function mergeValues(values, strategy) {
+  if (values.length === 0) return void 0;
+  switch (strategy) {
+    case "replace":
+      return deepClone(values[values.length - 1]);
+    case "deep-merge":
+      return deepClone(
+        values.reduce((acc, v) => isPlainObject(acc) && isPlainObject(v) ? deepMerge(acc, v) : deepClone(v))
+      );
+    case "append": {
+      const out = [];
+      let sawArray = false;
+      for (const v of values) {
+        if (Array.isArray(v)) {
+          sawArray = true;
+          out.push(...deepClone(v));
+        }
+      }
+      return sawArray ? out : deepClone(values[values.length - 1]);
+    }
+  }
+}
+
+// src/cascade.ts
+function resolve(stack, options = {}) {
+  const strategyFor = options.strategyFor ?? (() => "replace");
+  const band = stack.length + 1;
+  const byKey = /* @__PURE__ */ new Map();
+  stack.forEach((sl, index) => {
+    const managed = sl.managed === true;
+    const precedence = (managed ? band : 0) + index;
+    for (const [key, raw] of Object.entries(sl.layer)) {
+      const entry = { scope: sl.scope, value: isUnset(raw) ? void 0 : raw, isUnset: isUnset(raw), managed, precedence };
+      const list = byKey.get(key);
+      if (list) list.push(entry);
+      else byKey.set(key, [entry]);
+    }
+  });
+  const effective = {};
+  const provenance = {};
+  const conflicts = [];
+  for (const [key, rawEntries] of byKey) {
+    const entries = [...rawEntries].sort((a, b) => b.precedence - a.precedence);
+    const contributors = entries.filter((e) => !e.isUnset);
+    const shadowed = entries.map((e) => ({
+      scope: e.scope,
+      value: e.isUnset ? "UNSET" : e.value,
+      managed: e.managed
+    }));
+    if (contributors.length === 0) {
+      continue;
+    }
+    const strategy = strategyFor(key);
+    const winner = contributors[0];
+    let value;
+    let mergedFrom;
+    if (strategy === "deep-merge") {
+      const lowToHigh = [...contributors].reverse();
+      value = mergeValues(lowToHigh.map((e) => e.value), "deep-merge");
+      const contributing = deepMergeContributors(contributors, value);
+      mergedFrom = contributing.length > 1 ? contributing : void 0;
+    } else if (strategy === "append") {
+      const lowToHigh = [...contributors].reverse();
+      value = mergeValues(lowToHigh.map((e) => e.value), "append");
+      const contributing = contributingScopes(lowToHigh, "append", value);
+      mergedFrom = contributing.length > 1 ? contributing : void 0;
+    } else {
+      value = deepClone(winner.value);
+    }
+    effective[key] = value;
+    provenance[key] = {
+      key,
+      winningScope: winner.scope,
+      value,
+      managed: winner.managed,
+      mergeStrategy: strategy,
+      shadowed: shadowed.filter((s, i) => !(entries[i].scope === winner.scope && entries[i].precedence === winner.precedence)),
+      mergedFrom
+    };
+    const distinct = [];
+    for (const c of contributors) if (!distinct.some((d) => deepEqual(d, c.value))) distinct.push(c.value);
+    if (distinct.length > 1) {
+      const overriddenByPolicy = winner.managed && contributors.some((c) => !c.managed && !deepEqual(c.value, winner.value));
+      conflicts.push({
+        key,
+        contributors: contributors.map((c) => ({ scope: c.scope, value: c.value, managed: c.managed })),
+        overriddenByPolicy
+      });
+    }
+  }
+  return { effective, provenance, conflicts };
+}
+function flattenLeaves(value, prefix, out) {
+  if (isPlainObject(value)) {
+    for (const [k, v] of Object.entries(value)) flattenLeaves(v, `${prefix}/${k}`, out);
+  } else {
+    out.set(prefix, value);
+  }
+}
+function deepMergeContributors(contributorsHighToLow, merged) {
+  const mergedLeaves = /* @__PURE__ */ new Map();
+  flattenLeaves(merged, "", mergedLeaves);
+  const perEntry = contributorsHighToLow.map((e) => {
+    const m = /* @__PURE__ */ new Map();
+    flattenLeaves(e.value, "", m);
+    return m;
+  });
+  const owners = /* @__PURE__ */ new Set();
+  for (const [path, val] of mergedLeaves) {
+    for (let i = 0; i < contributorsHighToLow.length; i += 1) {
+      const leaf = perEntry[i].get(path);
+      if (perEntry[i].has(path) && deepEqual(leaf, val)) {
+        owners.add(contributorsHighToLow[i].scope);
+        break;
+      }
+    }
+  }
+  return [...contributorsHighToLow].reverse().filter((e) => owners.has(e.scope)).map((e) => e.scope);
+}
+function contributingScopes(lowToHigh, strategy, full) {
+  const values = lowToHigh.map((e) => e.value);
+  const out = [];
+  for (let i = 0; i < lowToHigh.length; i += 1) {
+    const without = mergeValues(
+      values.filter((_, j) => j !== i),
+      strategy
+    );
+    if (!deepEqual(without, full)) out.push(lowToHigh[i].scope);
+  }
+  return out;
+}
+
+// src/patch.ts
+var PROTO_KEYS2 = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function applyMergePatch(target, patch) {
+  if (!isPlainObject(patch)) return deepClone(patch);
+  const base = isPlainObject(target) ? deepClone(target) : {};
+  for (const [key, val] of Object.entries(patch)) {
+    if (PROTO_KEYS2.has(key)) continue;
+    if (val === null) delete base[key];
+    else base[key] = applyMergePatch(base[key], val);
+  }
+  return base;
+}
+function serializeLayer(layer) {
+  const values = {};
+  const unset = [];
+  for (const [k, v] of Object.entries(layer)) {
+    if (isUnset(v)) unset.push(k);
+    else values[k] = deepClone(v);
+  }
+  return { values, unset };
+}
+function deserializeLayer(s) {
+  const layer = {};
+  for (const [k, v] of Object.entries(s.values ?? {})) layer[k] = deepClone(v);
+  for (const k of s.unset ?? []) layer[k] = UNSET;
+  return layer;
+}
+function layerToMergePatch(layer) {
+  const patch = {};
+  for (const [k, v] of Object.entries(layer)) patch[k] = isUnset(v) ? null : deepClone(v);
+  return patch;
+}
+var ARRAY_INDEX = /^(?:0|[1-9][0-9]*)$/;
+function parsePointer(pointer) {
+  if (pointer === "") return [];
+  if (pointer[0] !== "/") throw new Error(`Invalid JSON Pointer (must start with "/"): ${pointer}`);
+  return pointer.slice(1).split("/").map((tok) => tok.replace(/~1/g, "/").replace(/~0/g, "~"));
+}
+function arrayIndex(token, length, mode) {
+  if (mode === "add" && token === "-") return length;
+  if (!ARRAY_INDEX.test(token)) throw new Error(`Invalid array index "${token}"`);
+  const idx = Number(token);
+  if (mode === "add" ? idx > length : idx >= length) {
+    throw new Error(`Array index out of bounds: ${token} (length ${length})`);
+  }
+  return idx;
+}
+function getAtPointer(doc, tokens) {
+  let cur = doc;
+  for (const tok of tokens) {
+    if (Array.isArray(cur)) {
+      if (tok === "-" || !ARRAY_INDEX.test(tok)) return void 0;
+      cur = cur[Number(tok)];
+    } else if (isPlainObject(cur)) {
+      if (PROTO_KEYS2.has(tok)) return void 0;
+      cur = cur[tok];
+    } else {
+      return void 0;
+    }
+  }
+  return cur;
+}
+function setAtPointer(doc, tokens, value, insert) {
+  if (tokens.length === 0) return value;
+  const last = tokens[tokens.length - 1];
+  const parent = getAtPointer(doc, tokens.slice(0, -1));
+  if (Array.isArray(parent)) {
+    const idx = arrayIndex(last, parent.length, insert ? "add" : "access");
+    if (insert) parent.splice(idx, 0, value);
+    else parent[idx] = value;
+  } else if (isPlainObject(parent)) {
+    if (PROTO_KEYS2.has(last)) throw new Error(`Refusing to set prototype-polluting key: ${last}`);
+    parent[last] = value;
+  } else {
+    throw new Error(`Cannot set at pointer; parent is not a container: /${tokens.slice(0, -1).join("/")}`);
+  }
+  return doc;
+}
+function removeAtPointer(doc, tokens) {
+  if (tokens.length === 0) throw new Error("Cannot remove the document root");
+  const last = tokens[tokens.length - 1];
+  const parent = getAtPointer(doc, tokens.slice(0, -1));
+  if (Array.isArray(parent)) {
+    const idx = arrayIndex(last, parent.length, "access");
+    parent.splice(idx, 1);
+  } else if (isPlainObject(parent)) {
+    if (PROTO_KEYS2.has(last) || !Object.prototype.hasOwnProperty.call(parent, last)) {
+      throw new Error(`Cannot remove; member does not exist: /${tokens.join("/")}`);
+    }
+    delete parent[last];
+  } else {
+    throw new Error(`Cannot remove at pointer; parent is not a container: /${tokens.slice(0, -1).join("/")}`);
+  }
+  return doc;
+}
+function pointerExists(doc, tokens) {
+  if (tokens.length === 0) return true;
+  const parent = getAtPointer(doc, tokens.slice(0, -1));
+  const last = tokens[tokens.length - 1];
+  if (Array.isArray(parent)) return ARRAY_INDEX.test(last) && Number(last) < parent.length;
+  if (isPlainObject(parent)) return !PROTO_KEYS2.has(last) && Object.prototype.hasOwnProperty.call(parent, last);
+  return false;
+}
+function applyJsonPatch(doc, ops) {
+  let result = deepClone(doc);
+  for (const op of ops) {
+    switch (op.op) {
+      case "add": {
+        result = setAtPointer(result, parsePointer(op.path), deepClone(op.value), true);
+        break;
+      }
+      case "remove": {
+        result = removeAtPointer(result, parsePointer(op.path));
+        break;
+      }
+      case "replace": {
+        const tokens = parsePointer(op.path);
+        if (!pointerExists(result, tokens)) throw new Error(`replace target does not exist: ${op.path}`);
+        result = setAtPointer(result, tokens, deepClone(op.value), false);
+        break;
+      }
+      case "move": {
+        const fromTokens = parsePointer(op.from);
+        if (!pointerExists(result, fromTokens)) throw new Error(`move source does not exist: ${op.from}`);
+        const val = deepClone(getAtPointer(result, fromTokens));
+        result = removeAtPointer(result, fromTokens);
+        result = setAtPointer(result, parsePointer(op.path), val, true);
+        break;
+      }
+      case "copy": {
+        const fromTokens = parsePointer(op.from);
+        if (!pointerExists(result, fromTokens)) throw new Error(`copy source does not exist: ${op.from}`);
+        const val = deepClone(getAtPointer(result, fromTokens));
+        result = setAtPointer(result, parsePointer(op.path), val, true);
+        break;
+      }
+      case "test": {
+        const tokens = parsePointer(op.path);
+        if (!pointerExists(result, tokens) || !deepEqual(getAtPointer(result, tokens), op.value)) {
+          throw new Error(`test failed at ${op.path}`);
+        }
+        break;
+      }
+      default: {
+        throw new Error(`Unknown JSON Patch op: ${op.op}`);
+      }
+    }
+  }
+  return result;
+}
+function diffJsonPatch(before, after, basePath = "") {
+  if (deepEqual(before, after)) return [];
+  if (!isPlainObject(before) || !isPlainObject(after)) {
+    return [{ op: "replace", path: basePath, value: deepClone(after) }];
+  }
+  const ops = [];
+  const enc = (k) => k.replace(/~/g, "~0").replace(/\//g, "~1");
+  for (const k of Object.keys(before)) {
+    const path = `${basePath}/${enc(k)}`;
+    if (!Object.prototype.hasOwnProperty.call(after, k)) ops.push({ op: "remove", path });
+    else ops.push(...diffJsonPatch(before[k], after[k], path));
+  }
+  for (const k of Object.keys(after)) {
+    if (!Object.prototype.hasOwnProperty.call(before, k)) {
+      ops.push({ op: "add", path: `${basePath}/${enc(k)}`, value: deepClone(after[k]) });
+    }
+  }
+  return ops;
+}
+function invertJsonPatch(ops, before) {
+  const inverse = [];
+  let state = deepClone(before);
+  for (const op of ops) {
+    const tokens = "path" in op ? parsePointer(op.path) : [];
+    switch (op.op) {
+      case "add": {
+        const parent = getAtPointer(state, tokens.slice(0, -1));
+        if (Array.isArray(parent)) {
+          inverse.unshift({ op: "remove", path: op.path });
+        } else {
+          const existed = pointerExists(state, tokens);
+          inverse.unshift(
+            existed ? { op: "replace", path: op.path, value: deepClone(getAtPointer(state, tokens)) } : { op: "remove", path: op.path }
+          );
+        }
+        break;
+      }
+      case "remove": {
+        inverse.unshift({ op: "add", path: op.path, value: deepClone(getAtPointer(state, tokens)) });
+        break;
+      }
+      case "replace": {
+        inverse.unshift({ op: "replace", path: op.path, value: deepClone(getAtPointer(state, tokens)) });
+        break;
+      }
+      case "move": {
+        inverse.unshift({ op: "move", from: op.path, path: op.from });
+        break;
+      }
+      case "copy": {
+        const existed = pointerExists(state, tokens);
+        inverse.unshift(
+          existed ? { op: "replace", path: op.path, value: deepClone(getAtPointer(state, tokens)) } : { op: "remove", path: op.path }
+        );
+        break;
+      }
+      case "test": {
+        inverse.unshift(op);
+        break;
+      }
+    }
+    state = applyJsonPatch(state, [op]);
+  }
+  return inverse;
+}
+
+// src/schema.ts
+var import_zod = require("zod");
+var import_core = require("@zodal/core");
+function getObjectShape(schema) {
+  const anySchema = schema;
+  return anySchema._zod?.def?.shape ?? anySchema.shape ?? {};
+}
+function readMeta(schema) {
+  const tryMeta = (s) => {
+    const m = s.meta?.();
+    return m && typeof m === "object" ? m : void 0;
+  };
+  return tryMeta(schema) ?? tryMeta((0, import_core.unwrapZodSchema)(schema)) ?? {};
+}
+function baseType(field) {
+  const s = (0, import_core.unwrapZodSchema)(field);
+  if (s instanceof import_zod.z.ZodObject) return "object";
+  if (s instanceof import_zod.z.ZodRecord) return "object";
+  if (s instanceof import_zod.z.ZodArray) return "array";
+  if (s instanceof import_zod.z.ZodNumber) return "number";
+  if (s instanceof import_zod.z.ZodBoolean) return "boolean";
+  if (s instanceof import_zod.z.ZodString) return "string";
+  if (s instanceof import_zod.z.ZodEnum) return "enum";
+  return "unknown";
+}
+function extractDefaults(schema) {
+  const defaults = {};
+  for (const [key, field] of Object.entries(getObjectShape(schema))) {
+    const r = field.safeParse(void 0);
+    if (r.success && r.data !== void 0) defaults[key] = r.data;
+  }
+  return defaults;
+}
+function keyMergeStrategy(field) {
+  const override = readMeta(field).mergeStrategy;
+  if (override === "replace" || override === "deep-merge" || override === "append") return override;
+  return baseType(field) === "object" ? "deep-merge" : "replace";
+}
+function normalizeKey(key) {
+  return key.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").replace(/[._\-/]+/g, " ").toLowerCase();
+}
+var SECRET_NAME = /(?:^| )(secret|secrets|secret ?id|passwords?|passwd|credentials?|tokens?|api ?keys?|access ?keys?|private ?keys?|client ?secret|refresh ?token|access ?token|auth ?token)(?: |$)/;
+function secretByName(key) {
+  return SECRET_NAME.test(normalizeKey(key));
+}
+var MAX_SECRET_DEPTH = 8;
+function childSchemas(inner) {
+  const a = inner;
+  const def = a._zod?.def ?? {};
+  const kids = [];
+  const push = (c) => {
+    if (c && typeof c === "object" && "_zod" in c) kids.push(c);
+  };
+  push(a.element);
+  push(def.element);
+  push(a.valueType);
+  push(def.valueType);
+  for (const arr of [a.items, def.items, a.options, def.options]) {
+    if (Array.isArray(arr)) for (const c of arr) push(c);
+  }
+  return kids;
+}
+function schemaContainsSecret(field, depth) {
+  if (depth > MAX_SECRET_DEPTH) return false;
+  const meta = readMeta(field);
+  if (meta.secret === true || meta.sensitivity === "secret") return true;
+  const inner = (0, import_core.unwrapZodSchema)(field);
+  if (inner instanceof import_zod.z.ZodObject) {
+    for (const [subKey, subField] of Object.entries(getObjectShape(inner))) {
+      if (secretByName(subKey)) return true;
+      if (schemaContainsSecret(subField, depth + 1)) return true;
+    }
+    return false;
+  }
+  for (const kid of childSchemas(inner)) {
+    if (schemaContainsSecret(kid, depth + 1)) return true;
+  }
+  return false;
+}
+function classifySensitivity(key, field) {
+  if (field) {
+    const meta = readMeta(field);
+    if (meta.secret === true || meta.sensitivity === "secret") return "secret";
+    if (meta.sensitivity === "sensitive") return "sensitive";
+    if (meta.sensitivity === "public") return "public";
+  }
+  if (secretByName(key)) return "secret";
+  if (field && schemaContainsSecret(field, 0)) return "secret";
+  return "public";
+}
+
+// src/secrets.ts
+var SECRET_MASK = "\u2022\u2022\u2022\u2022";
+function makeSecretRef(key, isSet) {
+  return { _tag: "SecretRef", key, isSet, masked: isSet ? "\u2022\u2022\u2022\u2022 (set)" : "not set" };
+}
+function isMeaningfullySet(v) {
+  return !isUnset(v) && v !== void 0 && v !== null && v !== "";
+}
+function maskSecrets(effective, sensitivityFor) {
+  const out = {};
+  for (const [k, v] of Object.entries(effective)) {
+    out[k] = sensitivityFor(k) === "secret" ? makeSecretRef(k, isMeaningfullySet(v)) : v;
+  }
+  return out;
+}
+function maskEffectiveResult(result, sensitivityFor) {
+  const isSecret = (key) => sensitivityFor(key) === "secret";
+  const maskShadowValue = (v) => v === "UNSET" ? "UNSET" : SECRET_MASK;
+  const effective = {};
+  for (const [k, v] of Object.entries(result.effective)) {
+    effective[k] = isSecret(k) ? makeSecretRef(k, isMeaningfullySet(v)) : v;
+  }
+  const provenance = {};
+  for (const [k, p] of Object.entries(result.provenance)) {
+    provenance[k] = isSecret(k) ? {
+      ...p,
+      value: makeSecretRef(k, isMeaningfullySet(p.value)),
+      shadowed: p.shadowed.map((s) => ({ ...s, value: maskShadowValue(s.value) }))
+    } : p;
+  }
+  const conflicts = result.conflicts.map(
+    (c) => isSecret(c.key) ? { ...c, contributors: c.contributors.map((ct) => ({ ...ct, value: maskShadowValue(ct.value) })) } : c
+  );
+  return { effective, provenance, conflicts };
+}
+function splitBySensitivity(layer, sensitivityFor) {
+  const config = {};
+  const secrets = {};
+  for (const [k, v] of Object.entries(layer)) {
+    if (sensitivityFor(k) === "secret") secrets[k] = v;
+    else config[k] = v;
+  }
+  return { config, secrets };
+}
+function redactSecretsFromLayer(serialized, sensitivityFor) {
+  const values = {};
+  for (const [k, v] of Object.entries(serialized.values ?? {})) {
+    if (sensitivityFor(k) !== "secret") values[k] = v;
+  }
+  const unset = (serialized.unset ?? []).filter((k) => sensitivityFor(k) !== "secret");
+  return { values, unset };
+}
+
+// src/constraints.ts
+function evaluateConstraints(values, config = {}) {
+  const errors = [];
+  const warnings = [];
+  if (config.schema) {
+    const r = config.schema.safeParse(values);
+    if (!r.success) {
+      for (const issue of r.error.issues) {
+        errors.push({ message: issue.message, keys: issue.path.map((p) => String(p)) });
+      }
+    }
+  }
+  for (const a of config.assertions ?? []) {
+    let satisfied = false;
+    try {
+      satisfied = a.check(values);
+    } catch {
+      satisfied = false;
+    }
+    if (!satisfied) errors.push({ message: a.message, keys: a.keys ?? [] });
+  }
+  for (const w of config.warnings ?? []) {
+    let hit = false;
+    try {
+      hit = w.when(values);
+    } catch {
+      hit = false;
+    }
+    if (hit) warnings.push(w.message);
+  }
+  return { ok: errors.length === 0, errors, warnings };
+}
+
+// src/derive.ts
+function applyDependentDefaults(values, defaults, options = {}) {
+  const dirty = new Set(options.dirtyKeys ?? []);
+  const out = { ...values };
+  const applied = [];
+  for (const d of defaults) {
+    if (dirty.has(d.key)) continue;
+    let suggestion;
+    try {
+      suggestion = d.derive(out);
+    } catch {
+      continue;
+    }
+    if (suggestion !== void 0) {
+      out[d.key] = suggestion;
+      applied.push(d.key);
+    }
+  }
+  return { values: out, applied };
+}
+
+// src/define-dials.ts
+var import_core2 = require("@zodal/core");
+function defineDials(schema, config = {}) {
+  const shape = getObjectShape(schema);
+  const keys = Object.keys(shape);
+  const defaults = extractDefaults(schema);
+  let collection;
+  try {
+    collection = (0, import_core2.defineCollection)(schema, config.collection);
+  } catch {
+    collection = void 0;
+  }
+  const mergeCache = /* @__PURE__ */ new Map();
+  const sensCache = /* @__PURE__ */ new Map();
+  const mergeStrategyFor = (key) => {
+    if (mergeCache.has(key)) return mergeCache.get(key);
+    const value = shape[key] ? keyMergeStrategy(shape[key]) : "replace";
+    mergeCache.set(key, value);
+    return value;
+  };
+  const sensitivityFor = (key) => {
+    if (sensCache.has(key)) return sensCache.get(key);
+    const value = classifySensitivity(key, shape[key]);
+    sensCache.set(key, value);
+    return value;
+  };
+  const buildStack = (stack, options) => options.includeDefaults === false ? stack : [{ scope: "default", layer: defaults }, ...stack];
+  const doResolve = (stack, options = {}) => {
+    const resolveOptions = { strategyFor: mergeStrategyFor };
+    const result = resolve(buildStack(stack, options), resolveOptions);
+    return options.maskSecrets ? maskEffectiveResult(result, sensitivityFor) : result;
+  };
+  return {
+    schema,
+    collection,
+    defaults,
+    keys,
+    mergeStrategyFor,
+    sensitivityFor,
+    resolve: doResolve,
+    explain: (key, stack, options) => doResolve(stack, options).provenance[key],
+    validate: (values) => evaluateConstraints(values, config.constraints),
+    withDependentDefaults: (values, dirtyKeys) => applyDependentDefaults(values, config.dependentDefaults ?? [], { dirtyKeys }).values,
+    getCapabilities: () => {
+      const mergeStrategies = {};
+      for (const k of keys) mergeStrategies[k] = mergeStrategyFor(k);
+      return {
+        keyCount: keys.length,
+        hasSecrets: keys.some((k) => sensitivityFor(k) === "secret"),
+        hasConstraints: Boolean(config.constraints?.schema || config.constraints?.assertions?.length),
+        hasDependentDefaults: (config.dependentDefaults?.length ?? 0) > 0,
+        mergeStrategies
+      };
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  UNSET,
+  applyDependentDefaults,
+  applyJsonPatch,
+  applyMergePatch,
+  baseType,
+  classifySensitivity,
+  defineDials,
+  deserializeLayer,
+  diffJsonPatch,
+  evaluateConstraints,
+  extractDefaults,
+  getObjectShape,
+  invertJsonPatch,
+  isSecretRef,
+  isUnset,
+  keyMergeStrategy,
+  layerToMergePatch,
+  makeSecretRef,
+  maskEffectiveResult,
+  maskSecrets,
+  mergeValues,
+  readMeta,
+  redactSecretsFromLayer,
+  resolve,
+  serializeLayer,
+  splitBySensitivity
+});
+//# sourceMappingURL=index.cjs.map