hanzio 1.0.10 → 1.2.0

package/dist/secrets/core.d.ts

@@ -0,0 +1,47 @@
+import { type SecretRequestOptions } from './deadline';
+import { type EnvironmentVariables, type SecretEnvironmentOption } from './environment';
+export type { SecretEnvironment, SecretEnvironmentOption } from './environment';
+export { SecretLoadError } from './errors';
+export type SecretLogAttributes = {
+    readonly environment: string;
+    readonly count: number;
+    readonly durationMs: number;
+    readonly source?: string;
+    readonly sources?: Readonly<Record<string, number>>;
+    readonly code?: string;
+};
+export type SecretLogger = {
+    info: (message: string, attributes: SecretLogAttributes) => void;
+    error: (message: string, attributes: SecretLogAttributes) => void;
+};
+export type SecretSchema<K extends string, Parsed> = {
+    parseAsync: (values: Record<K, string>) => Promise<Parsed>;
+};
+export type CommonSecretSetOptions<K extends string, Parsed = Record<K, string>> = SecretRequestOptions & {
+    readonly environment?: SecretEnvironmentOption;
+    readonly writeToProcessEnv?: boolean;
+    readonly logger?: SecretLogger | false;
+    readonly schema?: SecretSchema<K, Parsed>;
+};
+export type CustomLoaderDefineSecretSetOptions<K extends string, Parsed = Record<K, string>> = CommonSecretSetOptions<K, Parsed> & {
+    readonly loader: SecretSetLoader<K>;
+};
+export type SecretSetLoaderContext<K extends string> = {
+    readonly keys: readonly K[];
+    readonly environment: string;
+    readonly signal?: AbortSignal;
+    readonly timeoutMs?: number;
+    /** Report the source actually selected by a dynamic loader. */
+    readonly reportSource?: (source: string) => void;
+};
+export type SecretSetLoader<K extends string> = ((context: SecretSetLoaderContext<K>) => Promise<Partial<Record<K, string>>>) & {
+    readonly source?: string;
+};
+export type SecretSet<K extends string, Parsed = Record<K, string>> = {
+    secret: (key: K) => string;
+    secrets: () => Record<K, string>;
+    parsed: () => Parsed;
+    sources: () => Record<K, string>;
+    reload: (options?: SecretRequestOptions) => Promise<SecretSet<K, Parsed>>;
+};
+export declare function defineSecretSet<const Keys extends readonly string[], Parsed = Record<Keys[number], string>>(keys: Keys, options: CustomLoaderDefineSecretSetOptions<Keys[number], Parsed>, environmentVariables?: EnvironmentVariables): Promise<SecretSet<Keys[number], Parsed>>;

package/dist/secrets/deadline.d.ts

@@ -0,0 +1,6 @@
+export type SecretRequestOptions = {
+    readonly timeoutMs?: number;
+    readonly signal?: AbortSignal;
+};
+/** One deadline includes authentication, retries, body reads, and validation. */
+export declare function withSecretDeadline<T>(options: SecretRequestOptions, operation: (signal: AbortSignal) => Promise<T>): Promise<T>;

package/dist/secrets/environment.d.ts

@@ -0,0 +1,9 @@
+export type SecretEnvironment = 'dev' | 'staging' | 'prod';
+export type SecretEnvironmentOption = SecretEnvironment | {
+    readonly slug: string;
+} | (() => SecretEnvironment | {
+    readonly slug: string;
+});
+export type EnvironmentVariables = Record<string, string | undefined>;
+export declare function getProcessEnvironment(): EnvironmentVariables | undefined;
+export declare function resolveSecretEnvironment(option?: SecretEnvironmentOption, env?: EnvironmentVariables): string;

package/dist/secrets/errors.d.ts

@@ -0,0 +1,11 @@
+export type SecretErrorCode = 'CONFIGURATION' | 'AUTHENTICATION' | 'HTTP' | 'CLI' | 'VALIDATION' | 'MISSING_SECRETS' | 'TIMEOUT' | 'ABORTED' | 'LOADER';
+/** Contains only safe diagnostic metadata; never attach underlying errors. */
+export declare class SecretLoadError extends Error {
+    readonly code: SecretErrorCode;
+    readonly operation?: string;
+    readonly status?: number;
+    constructor(code: SecretErrorCode, message: string, details?: {
+        operation?: string;
+        status?: number;
+    });
+}

package/dist/secrets/index.d.ts

@@ -1,27 +1,18 @@
-export type SecretEnvironment = 'dev' | 'staging' | 'prod';
-export type DefineSecretSetOptions<SecretKey extends string> = {
-    readonly projectId: string;
-    readonly siteUrl?: string;
-    readonly environment?: SecretEnvironment | (() => SecretEnvironment);
+import { type CommonSecretSetOptions, type CustomLoaderDefineSecretSetOptions, type SecretSet } from './core';
+import { type SecretEnvironment } from './environment';
+import { type InfisicalAuthMode } from './infisical';
+import { type InfisicalProjectOptions } from './infisical-config';
+export * from './core';
+export * from './infisical';
+export * from './loaders';
+export * from './vite';
+export type { SecretRequestOptions } from './deadline';
+export type InfisicalDefineSecretSetOptions<K extends string = string, Parsed = Record<K, string>> = CommonSecretSetOptions<K, Parsed> & InfisicalProjectOptions & {
+    readonly auth?: InfisicalAuthMode;
     readonly clientIdEnvKey?: string;
     readonly clientSecretEnvKey?: string;
-    readonly loader?: SecretSetLoader<SecretKey>;
-};
-export type SecretSetLoaderContext<SecretKey extends string> = {
-    readonly keys: readonly SecretKey[];
-    readonly projectId: string;
-    readonly environment: SecretEnvironment;
-    readonly siteUrl: string;
-    readonly clientIdEnvKey: string;
-    readonly clientSecretEnvKey: string;
+    readonly loader?: undefined;
 };
-export type SecretSetLoader<SecretKey extends string> = (context: SecretSetLoaderContext<SecretKey>) => Promise<Partial<Record<SecretKey, string>>>;
-export type SecretSet<SecretKey extends string> = {
-    secret: (key: SecretKey) => string;
-    secrets: () => Record<SecretKey, string>;
-    reload: () => Promise<SecretSet<SecretKey>>;
-};
-export * from './infisical';
-export * from './vite';
+export type DefineSecretSetOptions<K extends string, Parsed = Record<K, string>> = InfisicalDefineSecretSetOptions<K, Parsed> | CustomLoaderDefineSecretSetOptions<K, Parsed>;
 export declare function getSecretEnvironment(): SecretEnvironment;
-export declare function defineSecretSet<const SecretKeys extends readonly string[]>(keys: SecretKeys, options: DefineSecretSetOptions<SecretKeys[number]>): Promise<SecretSet<SecretKeys[number]>>;
+export declare function defineSecretSet<const Keys extends readonly string[], Parsed = Record<Keys[number], string>>(keys: Keys, options: DefineSecretSetOptions<Keys[number], Parsed>): Promise<SecretSet<Keys[number], Parsed>>;

package/dist/secrets/infisical-cli.d.ts

@@ -0,0 +1,6 @@
+import type { SecretRequestOptions } from './deadline';
+/** Read the active CLI session without a shell or credential-bearing errors. */
+export declare function readInfisicalCliToken(options: SecretRequestOptions & {
+    siteUrl: string;
+    signal: AbortSignal;
+}): Promise<string>;

package/dist/secrets/infisical-config.d.ts

@@ -0,0 +1,17 @@
+import type { SecretRequestOptions } from './deadline';
+/** Project scope shared by the public Infisical loaders. */
+export type InfisicalProjectOptions = {
+    readonly projectId: string;
+    /** Scope CLI user authentication; machine identities already have an organization. */
+    readonly organizationId: string;
+    readonly siteUrl?: string;
+    readonly secretPath?: string;
+};
+export type InfisicalScope<K extends string> = InfisicalProjectOptions & SecretRequestOptions & {
+    readonly keys: readonly K[];
+    readonly environment: string;
+    readonly siteUrl: string;
+};
+export declare function validateInfisicalScope(options: InfisicalScope<string>): void;
+/** Validate at configuration time, including for JavaScript callers and local-only loads. */
+export declare function validateInfisicalOrganizationId(organizationId: unknown): void;

package/dist/secrets/infisical-session.d.ts

@@ -0,0 +1,4 @@
+/** Read routing metadata only. JWT signature and permissions are verified by Infisical. */
+export declare function parseInfisicalSessionToken(token: string): {
+    organizationId?: string;
+};

package/dist/secrets/infisical.d.ts

@@ -1,2 +1,14 @@
-import type { SecretSetLoaderContext } from '.';
-export declare function loadInfisicalSecrets<SecretKey extends string>({ keys, projectId, environment, siteUrl, clientIdEnvKey, clientSecretEnvKey }: SecretSetLoaderContext<SecretKey>): Promise<Partial<Record<SecretKey, string>>>;
+import { type InfisicalScope } from './infisical-config';
+export declare const DEFAULT_INFISICAL_SITE_URL = "https://eu.infisical.com";
+export type InfisicalAuthMode = 'auto' | 'http' | 'cli';
+export declare function fetchInfisicalSecrets<K extends string>(options: InfisicalScope<K> & {
+    readonly clientId: string;
+    readonly clientSecret: string;
+}): Promise<Partial<Record<K, string>>>;
+export type LoadInfisicalSecretsFromEnvOptions<K extends string> = InfisicalScope<K> & {
+    readonly clientIdEnvKey: string;
+    readonly clientSecretEnvKey: string;
+    readonly auth?: InfisicalAuthMode;
+    readonly reportSource?: (source: string) => void;
+};
+export declare function loadInfisicalSecrets<K extends string>(options: LoadInfisicalSecretsFromEnvOptions<K>): Promise<Partial<Record<K, string>>>;

package/dist/secrets/loaders.d.ts

@@ -0,0 +1,9 @@
+import { type InfisicalProjectOptions } from './infisical-config';
+import type { SecretSetLoader, SecretSetLoaderContext } from './core';
+export { cloudflareWorkerEnvLoader } from './worker-loader';
+export declare function infisicalLoader<SecretKey extends string>(config: InfisicalProjectOptions & {
+    readonly clientId: string;
+    readonly clientSecret: string;
+    readonly timeoutMs?: number;
+}): SecretSetLoader<SecretKey>;
+export declare function processEnvLoader<SecretKey extends string>(_ctx: SecretSetLoaderContext<SecretKey>): Promise<Partial<Record<SecretKey, string>>>;

package/dist/secrets/vite.d.ts

@@ -1,9 +1,13 @@
-import type { SecretSet } from '.';
+import type { SecretSet } from './core';
 export type ViteSecretSetPlugin = {
     name: string;
     config: () => {
         define: Record<string, string>;
     };
 };
-export declare function getViteDefine<SecretKey extends string>(secretSet: SecretSet<SecretKey>): Record<string, string>;
-export declare function viteSecretSetPlugin<SecretKey extends string>(secretSet: SecretSet<SecretKey>): ViteSecretSetPlugin;
+export type ViteSecretSetOptions<K extends string> = {
+    /** Explicit acknowledgement that these values may be shipped to browsers. */
+    readonly publicKeys?: readonly K[];
+};
+export declare function getViteDefine<K extends string>(secretSet: Pick<SecretSet<K, unknown>, 'secrets'>, options?: ViteSecretSetOptions<K>): Record<string, string>;
+export declare function viteSecretSetPlugin<K extends string>(secretSet: Pick<SecretSet<K, unknown>, 'secrets'>, options?: ViteSecretSetOptions<K>): ViteSecretSetPlugin;

package/dist/secrets/worker-loader.d.ts

@@ -0,0 +1,9 @@
+import type { SecretSetLoader } from './core';
+/**
+ * Reads secrets from a Cloudflare Worker `env` bindings object (or any similar
+ * `Record`), for Workers where `process.env` is not populated. Pass the same
+ * object you get as `env` in your fetch handler, or values you’d read from
+ * `import { env } from "cloudflare:workers"` in your Worker bundle — this
+ * package does not import that module.
+ */
+export declare function cloudflareWorkerEnvLoader<SecretKey extends string>(workerEnv: Record<string, unknown>): SecretSetLoader<SecretKey>;

package/dist/secrets/worker.d.ts

@@ -0,0 +1,3 @@
+export * from './core';
+export { cloudflareWorkerEnvLoader } from './worker-loader';
+export type { SecretRequestOptions } from './deadline';