@zudojs/config 1.1.0 → 1.2.0

package/README.md

@@ -58,6 +58,16 @@ await `manager.ready()` before reading values.
 A source provides values plus a priority. Higher priority wins; equal
 priorities are applied in registration order (last registered wins).
 
+A source that declares no priority gets `DEFAULT_CONFIG_SOURCE_PRIORITY`
+(`-1`), which is strictly below the priority `initialValues` is seeded
+at (`0`), so an undeclared source layers UNDER the values a manager was
+seeded with. Declare `priority: 0` (or higher) on the source when it
+should override them.
+
+Sources are deduplicated by name — the first occurrence of a name wins,
+both when they are passed to the constructor and through `addSource()`
+(which rejects a duplicate outright).
+
 - `createDefaultsConfigSource(values, name?)` — low-priority defaults.
 - `createMemoryConfigSource(values, { name, priority?, optional? })` —
   in-memory values.
@@ -147,12 +157,21 @@ entry is redacted). Individual values can be validated with
   including secrets.
 - `manager.toSafeObject()` / `store.toSafeObject()` replace sensitive
   values with `"[REDACTED]"` — use these for logging and diagnostics.
+- An entry is marked sensitive automatically by `ConfigStore.set()`, so
+  the same key is redacted however it was written: from a source, from
+  `initialValues`, from `set()` / `setMany()` / `replace()`, or from
+  `manager.set()`. Detection is `isSensitiveConfigEntry` — the key name
+  (`password`, `secret`, `token`, `*_key`, `auth`, `dsn`,
+  `database_url`, …) or a value that is a URL with embedded
+  `user:password@` credentials. Pass `sensitive: false` explicitly to
+  opt a key out.
 
 ## Reloading
 
 `manager.reload()` re-runs all sources. Values set at runtime via
 `manager.set()` and `initialValues` survive loads; sources only
-overwrite entries at equal or higher priority. A reload rebuilds every
+overwrite entries at equal or higher priority, and a source that
+declares no priority ranks below both. A reload rebuilds every
 source-provided value from scratch, so a value a source no longer
 provides disappears (letting a lower-priority default show through), and
 the store is only updated once every source has loaded — a failing

package/dist/configLoader/configLoader.core.js

@@ -1,6 +1,6 @@
 import { cloneConfigValue } from "../configValue/configValue.core.js";
 import { createConfigEntry } from "../configEntry/configEntry.type.js";
-import { loadConfigSourceStrict, sortConfigSources, } from "../configSource/configSource.core.js";
+import { deduplicateConfigSources, loadConfigSourceStrict, sortConfigSources, } from "../configSource/configSource.core.js";
 import { isSensitiveConfigEntry } from "../configSource/configSource.sensitive.js";
 import { commitReloadStaging, createReloadStaging, } from "./configLoader.reload.js";
 import { createConfigStore } from "../configStore/configStore.factory.js";
@@ -23,7 +23,11 @@ export class ConfigLoader {
     disposed = false;
     lastResult;
     constructor(options = {}) {
-        this.sources = [...(options.sources ?? [])];
+        // addSource() rejects a name that is already registered, but the
+        // constructor used to accept duplicates silently — and because a
+        // later duplicate overwrote the earlier one, the LAST occurrence
+        // won, the opposite of the documented "first occurrence wins".
+        this.sources = [...deduplicateConfigSources(options.sources ?? [])];
         this.context = options.context ?? {};
         this.store =
             options.store ??

package/dist/configManager/configManager.core.js

@@ -38,15 +38,21 @@ export class ConfigManager {
         this.store =
             suppliedStore ??
                 createConfigStore({
-                    initialValues: options.initialValues,
                     freeze: options.freeze ?? true,
                 });
         // initialValues used to be wired ONLY into a store the manager
         // created itself: passing `store` or `loader` silently discarded
-        // them. Seed a supplied store explicitly instead.
-        if (suppliedStore && options.initialValues) {
+        // them. Both paths are seeded here instead, at the baseline
+        // priority 0. A source that declares no priority now ranks below
+        // that (DEFAULT_CONFIG_SOURCE_PRIORITY), so it can no longer wipe
+        // the seeds; a source that declares a priority of 0 or above
+        // still overrides them.
+        if (options.initialValues) {
             for (const [key, value] of Object.entries(options.initialValues)) {
-                suppliedStore.set(key, value, { source: "initialValues" });
+                this.store.set(key, value, {
+                    source: "initialValues",
+                    priority: 0,
+                });
             }
         }
         this.name = options.name ?? "config";
@@ -295,7 +301,10 @@ export class ConfigManager {
         return this.store.set(key, value, {
             source: options.source ?? "runtime",
             priority: options.priority ?? Number.MAX_SAFE_INTEGER,
-            sensitive: options.sensitive ?? false,
+            // Left undefined so the store's own secret detection runs; an
+            // explicit `false` here would have disabled it for every runtime
+            // write.
+            sensitive: options.sensitive,
         });
     }
     /**

package/dist/configSource/configSource.core.d.ts

@@ -77,6 +77,16 @@ export interface ConfigSourceOptions {
  * Checks whether a value is a configuration source.
  */
 export declare function isConfigSource(value: unknown): value is ConfigSource;
+/**
+ * Priority given to a source that declares none.
+ *
+ * Strictly below the priority `initialValues` and other baseline store
+ * writes use (0). A source used to default to 0 as well, and because
+ * `applySource` overwrites on EQUAL priority, any undeclared source
+ * silently wiped the values a manager was seeded with. Declaring a
+ * priority of 0 or above still overrides them.
+ */
+export declare const DEFAULT_CONFIG_SOURCE_PRIORITY = -1;
 /**
  * Creates a function-based configuration source.
  */

package/dist/configSource/configSource.core.js

@@ -32,12 +32,22 @@ export function isConfigSource(value) {
         typeof source.optional === "boolean" &&
         typeof source.load === "function");
 }
+/**
+ * Priority given to a source that declares none.
+ *
+ * Strictly below the priority `initialValues` and other baseline store
+ * writes use (0). A source used to default to 0 as well, and because
+ * `applySource` overwrites on EQUAL priority, any undeclared source
+ * silently wiped the values a manager was seeded with. Declaring a
+ * priority of 0 or above still overrides them.
+ */
+export const DEFAULT_CONFIG_SOURCE_PRIORITY = -1;
 /**
  * Creates a function-based configuration source.
  */
 export function createConfigSource(options, loader) {
     const type = options.type ?? ConfigSourceType.CUSTOM;
-    const priority = options.priority ?? 0;
+    const priority = options.priority ?? DEFAULT_CONFIG_SOURCE_PRIORITY;
     if (options.name.trim().length === 0) {
         throw new TypeError("Configuration source name cannot be empty.");
     }

package/dist/configStore/configStore.core.js

@@ -1,5 +1,6 @@
 import { cloneConfigValue, configValuesEqual, defineConfigProperty, freezeConfigValue, } from "../configValue/configValue.core.js";
 import { createConfigEntry, toSafeConfigEntry, } from "../configEntry/configEntry.type.js";
+import { isSensitiveConfigEntry } from "../configSource/configSource.sensitive.js";
 /**
  * Normalizes a configuration key.
  */
@@ -97,7 +98,12 @@ export class ConfigStore {
             source: options.source ?? "runtime",
             sourceType: options.sourceType,
             priority: options.priority ?? 0,
-            sensitive: options.sensitive ?? false,
+            // Secret detection belongs HERE, not at a single caller. It used
+            // to run only inside ConfigLoader.applySource, so the very same
+            // key was redacted when it arrived from a source and printed in
+            // clear when it arrived through initialValues, set(), setMany()
+            // or replace(). Pass `sensitive: false` explicitly to opt out.
+            sensitive: options.sensitive ?? isSensitiveConfigEntry(normalizedKey, value),
             resolved: options.resolved ?? true,
         });
         if (previous &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/config",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Layered configuration management with multiple sources, validation, and environment-specific overrides.",
   "license": "MIT",
   "author": {
@@ -28,8 +28,8 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@zudojs/constants": "1.1.0",
-    "@zudojs/errors": "1.1.0"
+    "@zudojs/constants": "1.1.1",
+    "@zudojs/errors": "1.2.0"
   },
   "devDependencies": {
     "typescript": "7.0.2",