hanzio 1.1.0 → 2.0.0

package/dist/index-wjyb9bsd.js

@@ -0,0 +1,263 @@
+import {
+  SecretLoadError2
+} from "./index-srt06xd2.js";
+
+// src/secrets/environment.ts
+function getProcessEnvironment() {
+  return typeof process === "undefined" ? undefined : process.env;
+}
+function resolveSecretEnvironment(option, env) {
+  const explicit = typeof option === "function" ? option() : option;
+  if (typeof explicit === "object" && explicit !== null) {
+    if (typeof explicit.slug !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(explicit.slug)) {
+      throw new SecretLoadError2("CONFIGURATION", "Custom secret environment requires a valid slug.");
+    }
+    return explicit.slug;
+  }
+  const selected = explicit ?? env?.SECRETS_ENV;
+  if (selected !== undefined) {
+    if (selected === "production" || selected === "prod") {
+      return "prod";
+    }
+    if (selected === "development" || selected === "dev") {
+      return "dev";
+    }
+    if (selected === "staging") {
+      return "staging";
+    }
+    throw new SecretLoadError2("CONFIGURATION", "Invalid secret environment. Use dev, staging, prod, or an explicit { slug } option.");
+  }
+  if (env?.NODE_ENV === "production" || env?.NODE_ENV === "prod") {
+    return "prod";
+  }
+  if (env?.NODE_ENV === "staging") {
+    return "staging";
+  }
+  return "dev";
+}
+
+// src/secrets/deadline.ts
+async function withSecretDeadline(options, operation) {
+  const timeoutMs = options.timeoutMs ?? 30000;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2147483647) {
+    throw new SecretLoadError2("CONFIGURATION", "Secret timeoutMs must be a positive finite timer duration.");
+  }
+  const controller = new AbortController;
+  const cancel = () => controller.abort(new SecretLoadError2("ABORTED", "Secret loading was cancelled."));
+  if (options.signal?.aborted) {
+    cancel();
+  } else {
+    options.signal?.addEventListener("abort", cancel, { once: true });
+  }
+  const timer = setTimeout(() => controller.abort(new SecretLoadError2("TIMEOUT", `Secret loading timed out after ${timeoutMs}ms.`)), timeoutMs);
+  let rejectOnAbort = () => {};
+  try {
+    const aborted = new Promise((_, reject) => {
+      rejectOnAbort = () => reject(controller.signal.reason);
+      controller.signal.addEventListener("abort", rejectOnAbort, { once: true });
+    });
+    if (controller.signal.aborted) {
+      throw controller.signal.reason;
+    }
+    return await Promise.race([operation(controller.signal), aborted]);
+  } finally {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", cancel);
+    controller.signal.removeEventListener("abort", rejectOnAbort);
+  }
+}
+
+// src/secrets/core.ts
+var registryKey = Symbol.for("hanzio.secrets.environmentWrites.v1");
+var shared = globalThis;
+var environmentWrites = shared[registryKey] ?? new WeakMap;
+shared[registryKey] = environmentWrites;
+var defaultLogger = {
+  info: (message, attrs) => console.log(`${message} environment=${attrs.environment} count=${attrs.count} source=${attrs.source} durationMs=${attrs.durationMs}`, { sources: attrs.sources }),
+  error: (message, attrs) => console.error(message, attrs)
+};
+function readOverrides(keys, env) {
+  if (!env) {
+    return {};
+  }
+  const writes = environmentWrites.get(env);
+  return Object.fromEntries(keys.flatMap((key) => {
+    const value = Object.hasOwn(env, key) ? env[key] : undefined;
+    if (writes?.has(key)) {
+      if (writes.get(key) === value) {
+        return [];
+      }
+      writes.delete(key);
+    }
+    return value ? [[key, value]] : [];
+  }));
+}
+async function defineSecretSet2(keys, options, environmentVariables) {
+  const keySet = [...new Set(keys)];
+  const environment = resolveSecretEnvironment(options.environment, environmentVariables);
+  const logger = options.logger === false ? undefined : options.logger ?? defaultLogger;
+  let cached;
+  let parsed;
+  let sources;
+  let inFlight;
+  const log = (level, message, attributes) => {
+    try {
+      logger?.[level](message, attributes);
+    } catch {}
+  };
+  const loadSnapshot = async (request, signal) => {
+    const local = readOverrides(keySet, environmentVariables);
+    const missing = keySet.filter((key) => !Object.hasOwn(local, key));
+    let loaderSource = options.loader.source ?? "custom loader";
+    let loaded = {};
+    if (missing.length) {
+      try {
+        loaded = await options.loader({
+          keys: missing,
+          environment,
+          signal,
+          timeoutMs: request.timeoutMs ?? options.timeoutMs ?? 30000,
+          reportSource: (source) => {
+            loaderSource = source;
+          }
+        });
+      } catch (error) {
+        if (error instanceof SecretLoadError2) {
+          throw error;
+        }
+        throw new SecretLoadError2("LOADER", "Secret loader failed.");
+      }
+    }
+    const overrides = readOverrides(keySet, environmentVariables);
+    const next = Object.fromEntries(keySet.map((key) => {
+      if (Object.hasOwn(overrides, key)) {
+        return [key, overrides[key]];
+      }
+      if (Object.hasOwn(loaded, key)) {
+        return [key, loaded[key]];
+      }
+      return [key, undefined];
+    }));
+    const missingKeys = keySet.filter((key) => typeof next[key] !== "string" || !next[key]);
+    if (missingKeys.length) {
+      throw new SecretLoadError2("MISSING_SECRETS", `Missing secrets: ${missingKeys.join(", ")}`);
+    }
+    let nextParsed;
+    try {
+      nextParsed = options.schema ? await options.schema.parseAsync({ ...next }) : { ...next };
+      nextParsed = structuredClone(nextParsed);
+    } catch {
+      throw new SecretLoadError2("VALIDATION", "Secret schema validation failed. Check the configured schema; values are omitted.");
+    }
+    signal.throwIfAborted();
+    const nextSources = Object.fromEntries(keySet.map((key) => [
+      key,
+      Object.hasOwn(overrides, key) ? "process.env" : loaderSource
+    ]));
+    if (options.writeToProcessEnv !== false && environmentVariables) {
+      let writes = environmentWrites.get(environmentVariables);
+      if (!writes) {
+        writes = new Map;
+        environmentWrites.set(environmentVariables, writes);
+      }
+      for (const key of keySet) {
+        if (Object.hasOwn(overrides, key)) {
+          continue;
+        }
+        environmentVariables[key] = next[key];
+        writes.set(key, next[key]);
+      }
+    }
+    cached = next;
+    parsed = nextParsed;
+    sources = nextSources;
+  };
+  const load = (request = {}) => {
+    if (inFlight) {
+      return inFlight;
+    }
+    inFlight = (async () => {
+      const start = Date.now();
+      try {
+        await withSecretDeadline({
+          timeoutMs: request.timeoutMs ?? options.timeoutMs,
+          signal: request.signal ?? options.signal
+        }, (signal) => loadSnapshot(request, signal));
+        const sourceCounts = new Map;
+        for (const key of keySet) {
+          const source = sources[key];
+          sourceCounts.set(source, (sourceCounts.get(source) ?? 0) + 1);
+        }
+        const counts = Object.fromEntries(sourceCounts);
+        log("info", "Loaded secrets", {
+          environment,
+          count: keySet.length,
+          durationMs: Date.now() - start,
+          source: Object.keys(counts).join(" + ") || "none",
+          sources: counts
+        });
+      } catch (error) {
+        const safe = error instanceof SecretLoadError2 ? error : new SecretLoadError2("LOADER", "Secret loading failed.");
+        log("error", "Secret loading failed", {
+          environment,
+          count: keySet.length,
+          durationMs: Date.now() - start,
+          code: safe.code
+        });
+        throw safe;
+      }
+    })().finally(() => {
+      inFlight = undefined;
+    });
+    return inFlight;
+  };
+  const secretSet = {
+    secret(key) {
+      if (!Object.hasOwn(cached, key)) {
+        throw new SecretLoadError2("MISSING_SECRETS", `Secret ${key} not found`);
+      }
+      return cached[key];
+    },
+    secrets: () => ({ ...cached }),
+    parsed: () => structuredClone(parsed),
+    sources: () => ({ ...sources }),
+    async reload(request) {
+      await load(request);
+      return secretSet;
+    }
+  };
+  await load();
+  return secretSet;
+}
+
+// src/secrets/worker-loader.ts
+function cloudflareWorkerEnvLoader2(workerEnv) {
+  const loader = async (ctx) => {
+    const out = Object.create(null);
+    for (const key of ctx.keys) {
+      const str = workerBindingToString(Object.hasOwn(workerEnv, key) ? workerEnv[key] : undefined);
+      if (str !== undefined) {
+        out[key] = str;
+      }
+    }
+    return out;
+  };
+  return Object.assign(loader, { source: "Cloudflare Worker bindings" });
+}
+function workerBindingToString(value) {
+  if (value === undefined || value === null) {
+    return;
+  }
+  if (typeof value === "string") {
+    return value === "" ? undefined : value;
+  }
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  if (typeof value === "object") {
+    return JSON.stringify(value);
+  }
+  return String(value);
+}
+
+export { withSecretDeadline, getProcessEnvironment, resolveSecretEnvironment, defineSecretSet2, cloudflareWorkerEnvLoader2 };

package/dist/index.d.ts

@@ -5,12 +5,12 @@ export * from './promise';
 export * from './cache';
 export * from './state';
 export * from './math';
+export * from './color';
 export * from './date';
 export * from './url';
-export * from './zod';
-export * from './api-wrapper';
-export * from './p-queue';
-export * from './cool-console-log';
-export * from './jwt';
-export * from './sitemap';
-export * from './secrets';
+export * from './error';
+export * from './guard';
+export * from './object';
+export * from './types';
+export * from './function';
+export * from './emitter';

package/dist/jwt/index.d.ts

@@ -1,3 +1,51 @@
+import type { Result } from '../promise';
 export type JWTPayload = Record<string, unknown>;
-export declare function jwtSign<Payload extends JWTPayload>(payload: Payload, secret: string): Promise<string>;
-export declare function jwtVerify<Payload extends JWTPayload>(token: string, secret: string): Promise<Payload | null>;
+export type JwtAlgorithm = 'HS256' | 'HS384' | 'HS512';
+export type JwtHeader = {
+    alg: string;
+    typ?: string;
+} & Record<string, unknown>;
+export type JwtSignOptions = {
+    /** Seconds from now until `exp`. */
+    expiresIn?: number;
+    /** Seconds from now until `nbf`. */
+    notBefore?: number;
+    issuer?: string;
+    audience?: string | string[];
+    /** Default: `'HS256'` */
+    algorithm?: JwtAlgorithm;
+};
+export type JwtVerifyOptions = {
+    /** Clock skew tolerance for `exp`/`nbf`, in seconds. Default: 0 */
+    leewaySec?: number;
+    /** Required `iss` value. */
+    issuer?: string;
+    /** Required `aud` value (matches a string `aud` or an entry of an array `aud`). */
+    audience?: string;
+    /** Accepted header `alg` values. Default: all of HS256/HS384/HS512. */
+    algorithms?: JwtAlgorithm[];
+};
+export type JwtVerifyErrorCode = 'malformed' | 'unsupported_alg' | 'invalid_signature' | 'expired' | 'not_yet_valid' | 'invalid_issuer' | 'invalid_audience';
+export declare class JwtVerifyError extends Error {
+    readonly code: JwtVerifyErrorCode;
+    constructor(code: JwtVerifyErrorCode);
+}
+/**
+ * Signs `payload` as a compact JWS. `iat` is always set to now.
+ * Claims derived from `options` (`exp`, `nbf`, `iss`, `aud`) override the same
+ * claims in `payload`; payload claims are kept when the option is not given.
+ */
+export declare function jwtSign<Payload extends JWTPayload>(payload: Payload, secret: string, options?: JwtSignOptions): Promise<string>;
+/** Verifies a token. Returns `null` for any failure; use `jwtVerifyResult` for the reason. */
+export declare function jwtVerify<Payload extends JWTPayload>(token: string, secret: string, options?: JwtVerifyOptions): Promise<Payload | null>;
+/**
+ * Verifies signature, `exp`/`nbf` and optional `iss`/`aud`.
+ * Token problems are returned as a failed `Result`; configuration problems
+ * (no Web Crypto, empty secret) throw.
+ */
+export declare function jwtVerifyResult<Payload extends JWTPayload>(token: string, secret: string, options?: JwtVerifyOptions): Promise<Result<Payload, JwtVerifyError>>;
+/** Decodes header and payload WITHOUT verifying the signature. Never trust the result for auth. */
+export declare function jwtDecode<Payload extends JWTPayload = JWTPayload>(token: string): {
+    header: JwtHeader;
+    payload: Payload;
+} | null;

package/dist/math/index.d.ts

@@ -1,2 +1,2 @@
-export { linearRegressionTrend } from './linearRegressionTrend';
-export { createResolveColorsByKeys, getHeatmapCellStyle, hashStringToColorIndex, METRICS_SERIES_PALETTE_SIZE, type ResolveColorsByKeysResult, resolveSeriesColorMap, seriesColorKey, withAlpha } from './metricsSeriesColors';
+export { type LinearRegression, linearRegression, linearRegressionTrend } from './linearRegressionTrend';
+export { clamp, lerp, normalize } from './scale';

package/dist/math/linearRegressionTrend.d.ts

@@ -1,5 +1,18 @@
+export type LinearRegression = {
+    slope: number;
+    intercept: number;
+    /** Coefficient of determination (0..1). 1 when all values are equal (exact fit). */
+    r2: number;
+    /** Fitted y for each index. */
+    fitted: number[];
+};
 /**
  * Least-squares linear regression for y at x = 0, 1, …, n − 1.
- * Returns fitted y for each index, or [] if n < 2 or any input is non-finite.
+ * Returns `null` if n < 2 or any input is non-finite.
+ */
+export declare function linearRegression(values: number[]): LinearRegression | null;
+/**
+ * Fitted y for each index of `values` (see `linearRegression`), or [] if n < 2
+ * or any input is non-finite.
  */
 export declare function linearRegressionTrend(values: number[]): number[];

package/dist/math/scale.d.ts

@@ -0,0 +1,8 @@
+export declare function clamp(value: number, min: number, max: number): number;
+/** Linear interpolation: `t = 0` → `start`, `t = 1` → `end`. */
+export declare function lerp(start: number, end: number, t: number): number;
+/**
+ * Position of `value` within `[min, max]` as 0..1 (clamped). Returns 0 when
+ * the range is empty.
+ */
+export declare function normalize(value: number, min: number, max: number): number;

package/dist/object/index.d.ts

@@ -0,0 +1,19 @@
+/** `Object.keys` typed as the object's string keys. */
+export declare function typedKeys<T extends object>(object: T): (keyof T & string)[];
+/** `Object.entries` typed as `[key, value]` pairs per key. */
+export declare function typedEntries<T extends object>(object: T): {
+    [K in keyof T & string]: [K, T[K]];
+}[keyof T & string][];
+/** `Object.fromEntries` typed as `Record<K, V>`. */
+export declare function typedFromEntries<const K extends PropertyKey, V>(entries: Iterable<readonly [K, V]>): Record<K, V>;
+/** Builds a record with one entry per key. */
+export declare function recordFromKeys<const K extends PropertyKey, V>(keys: readonly K[], fn: (key: K) => V): Record<K, V>;
+export declare function mapValues<T extends object, R>(object: T, fn: (value: T[keyof T & string], key: keyof T & string) => R): Record<keyof T & string, R>;
+export declare function pick<T extends object, const K extends keyof T>(object: T, keys: readonly K[]): Pick<T, K>;
+export declare function omit<T extends object, const K extends keyof T>(object: T, keys: readonly K[]): Omit<T, K>;
+type Path = string | readonly (string | number)[];
+/** Reads a nested value by dot path (`a.b.0.c`) or segment array; undefined when missing. */
+export declare function getAtPath(object: unknown, path: Path): unknown;
+/** Writes a nested value in place, creating arrays for numeric segments and objects otherwise. */
+export declare function setAtPath(object: object, path: Path, value: unknown): void;
+export {};

package/dist/p-queue/index.d.ts

@@ -92,4 +92,4 @@ export default class PQueue<QueueType extends Queue<RunFunction, EnqueueOptionsT
     onError(): Promise<never>;
     onSizeLessThan(limit: number): Promise<void>;
 }
-export {};
+export { PQueue };

package/dist/promise/index.d.ts

@@ -4,18 +4,113 @@ export type BackgroundPromiseOptions = {
     scheduler?: (callback: () => void) => void;
 };
 export type Success<T> = {
+    ok: true;
     data: T;
     error: null;
 };
 export type Failure<E> = {
+    ok: false;
     data: null;
     error: E;
 };
 export type Result<T, E = Error> = Success<T> | Failure<E>;
+export declare function ok<T>(data: T): Success<T>;
+export declare function err<E>(error: E): Failure<E>;
 export declare function isSuccess<T, E>(result: Result<T, E>): result is Success<T>;
 export declare function isFailure<T, E>(result: Result<T, E>): result is Failure<E>;
 export declare function unwrapResult<T, E>(result: Result<T, E>): T;
 export declare function backgroundPromise<T>(promiseFactory: () => Promise<T>, options?: BackgroundPromiseOptions): void;
 export declare function backgroundPromiseSync<T>(promiseFactory: () => Promise<T>, options?: BackgroundPromiseOptions): void;
-export declare function promiseTimeout(ms: number): Promise<void>;
-export declare function tryCatch<T, E = Error>(promise: Promise<T>): Promise<Result<T, E>>;
+/** Resolves after `ms`; rejects with `signal.reason` if the signal aborts first. */
+export declare function promiseTimeout(ms: number, options?: {
+    signal?: AbortSignal;
+}): Promise<void>;
+/**
+ * Accepts a promise or a function; sync throws inside the function are
+ * captured too.
+ */
+export declare function tryCatch<T, E = Error>(input: Promise<T> | (() => T | Promise<T>)): Promise<Result<T, E>>;
+export declare class PromiseTimeoutError extends Error {
+    readonly timeoutMs: number;
+    constructor(timeoutMs: number, message?: string);
+}
+/**
+ * Rejects with `PromiseTimeoutError` after `ms`, or with `signal.reason` when
+ * the signal aborts. Pass a function to receive a signal that aborts on
+ * timeout, so the underlying work can stop too.
+ */
+export declare function withTimeout<T>(input: Promise<T> | ((signal: AbortSignal) => Promise<T>), ms: number, options?: {
+    signal?: AbortSignal;
+    message?: string;
+}): Promise<T>;
+export type BackoffOptions = {
+    /** Delay for the first retry (default 300ms). */
+    baseMs?: number;
+    /** Upper bound for any delay (default 30s). */
+    maxMs?: number;
+    /**
+     * `true`/`'full'`: random delay in [0, computed] (default).
+     * `'partial'`: computed plus 0–`jitterRatio` extra (may exceed `maxMs`).
+     */
+    jitter?: boolean | 'full' | 'partial';
+    /** Max extra fraction for `'partial'` jitter (default 0.25). */
+    jitterRatio?: number;
+    /** Source of randomness in [0, 1) (default `Math.random`). */
+    random?: () => number;
+};
+/** Exponential backoff delay for a 1-based retry attempt. */
+export declare function exponentialBackoff(attempt: number, options?: BackoffOptions): number;
+export type RetryOptions = {
+    /** Retries after the first attempt (default 3). */
+    retries?: number;
+    /** Delay before retry `attempt` (1-based). Default: `exponentialBackoff`. */
+    delayMs?: number | ((attempt: number, error: unknown) => number);
+    /** Return false to stop retrying and rethrow (default: always retry). */
+    shouldRetry?: (error: unknown, attempt: number) => boolean;
+    onRetry?: (error: unknown, attempt: number, delayMs: number) => void;
+    signal?: AbortSignal;
+};
+export declare function retry<T>(fn: (context: {
+    attempt: number;
+    signal?: AbortSignal;
+}) => Promise<T> | T, options?: RetryOptions): Promise<T>;
+/** Maps with bounded concurrency; results keep input order. */
+export declare function pMap<T, R>(items: Iterable<T>, fn: (item: T, index: number) => Promise<R> | R, options?: {
+    concurrency?: number;
+    signal?: AbortSignal;
+}): Promise<R[]>;
+/** Starts a clock; call the returned function to read elapsed ms. */
+export declare function startTimer(): () => number;
+/** Runs `fn` and reports how long it took (throws pass through). */
+export declare function timed<T>(fn: () => Promise<T> | T): Promise<{
+    result: T;
+    durationMs: number;
+}>;
+/**
+ * Aborts when any input aborts, with that signal's `reason`. Undefined inputs
+ * are skipped; no inputs gives a signal that never aborts.
+ */
+export declare function anySignal(...signals: (AbortSignal | undefined)[]): AbortSignal;
+/** Aborts with a `TimeoutError` after `ms`, or earlier if `signal` aborts. */
+export declare function timeoutSignal(ms: number, signal?: AbortSignal): AbortSignal;
+/**
+ * Settles like `promise`, but rejects with `signal.reason` as soon as the
+ * signal aborts. The underlying work is not cancelled.
+ */
+export declare function raceAbort<T>(promise: Promise<T>, signal: AbortSignal | undefined): Promise<T>;
+export type LatestGuard = {
+    /** Starts a new generation; earlier tokens become stale. */
+    next(): number;
+    isCurrent(token: number): boolean;
+    /** Marks every outstanding token stale. */
+    invalidate(): void;
+    /** Runs `fn` under a new token; stale results and errors become `{ stale: true }`. */
+    run<T>(fn: () => Promise<T> | T): Promise<{
+        stale: true;
+    } | {
+        stale: false;
+        value: T;
+    }>;
+};
+/** Ignores results of async work superseded by a newer call. */
+export declare function createLatestGuard(): LatestGuard;

package/dist/secrets/core.d.ts

@@ -0,0 +1,47 @@
+import { type SecretRequestOptions } from './deadline';
+import { type EnvironmentVariables, type SecretEnvironmentOption } from './environment';
+export type { SecretEnvironment, SecretEnvironmentOption } from './environment';
+export { SecretLoadError } from './errors';
+export type SecretLogAttributes = {
+    readonly environment: string;
+    readonly count: number;
+    readonly durationMs: number;
+    readonly source?: string;
+    readonly sources?: Readonly<Record<string, number>>;
+    readonly code?: string;
+};
+export type SecretLogger = {
+    info: (message: string, attributes: SecretLogAttributes) => void;
+    error: (message: string, attributes: SecretLogAttributes) => void;
+};
+export type SecretSchema<K extends string, Parsed> = {
+    parseAsync: (values: Record<K, string>) => Promise<Parsed>;
+};
+export type CommonSecretSetOptions<K extends string, Parsed = Record<K, string>> = SecretRequestOptions & {
+    readonly environment?: SecretEnvironmentOption;
+    readonly writeToProcessEnv?: boolean;
+    readonly logger?: SecretLogger | false;
+    readonly schema?: SecretSchema<K, Parsed>;
+};
+export type CustomLoaderDefineSecretSetOptions<K extends string, Parsed = Record<K, string>> = CommonSecretSetOptions<K, Parsed> & {
+    readonly loader: SecretSetLoader<K>;
+};
+export type SecretSetLoaderContext<K extends string> = {
+    readonly keys: readonly K[];
+    readonly environment: string;
+    readonly signal?: AbortSignal;
+    readonly timeoutMs?: number;
+    /** Report the source actually selected by a dynamic loader. */
+    readonly reportSource?: (source: string) => void;
+};
+export type SecretSetLoader<K extends string> = ((context: SecretSetLoaderContext<K>) => Promise<Partial<Record<K, string>>>) & {
+    readonly source?: string;
+};
+export type SecretSet<K extends string, Parsed = Record<K, string>> = {
+    secret: (key: K) => string;
+    secrets: () => Record<K, string>;
+    parsed: () => Parsed;
+    sources: () => Record<K, string>;
+    reload: (options?: SecretRequestOptions) => Promise<SecretSet<K, Parsed>>;
+};
+export declare function defineSecretSet<const Keys extends readonly string[], Parsed = Record<Keys[number], string>>(keys: Keys, options: CustomLoaderDefineSecretSetOptions<Keys[number], Parsed>, environmentVariables?: EnvironmentVariables): Promise<SecretSet<Keys[number], Parsed>>;

package/dist/secrets/deadline.d.ts

@@ -0,0 +1,6 @@
+export type SecretRequestOptions = {
+    readonly timeoutMs?: number;
+    readonly signal?: AbortSignal;
+};
+/** One deadline includes authentication, retries, body reads, and validation. */
+export declare function withSecretDeadline<T>(options: SecretRequestOptions, operation: (signal: AbortSignal) => Promise<T>): Promise<T>;

package/dist/secrets/environment.d.ts

@@ -0,0 +1,9 @@
+export type SecretEnvironment = 'dev' | 'staging' | 'prod';
+export type SecretEnvironmentOption = SecretEnvironment | {
+    readonly slug: string;
+} | (() => SecretEnvironment | {
+    readonly slug: string;
+});
+export type EnvironmentVariables = Record<string, string | undefined>;
+export declare function getProcessEnvironment(): EnvironmentVariables | undefined;
+export declare function resolveSecretEnvironment(option?: SecretEnvironmentOption, env?: EnvironmentVariables): string;

package/dist/secrets/errors.d.ts

@@ -0,0 +1,11 @@
+export type SecretErrorCode = 'CONFIGURATION' | 'AUTHENTICATION' | 'HTTP' | 'CLI' | 'VALIDATION' | 'MISSING_SECRETS' | 'TIMEOUT' | 'ABORTED' | 'LOADER';
+/** Contains only safe diagnostic metadata; never attach underlying errors. */
+export declare class SecretLoadError extends Error {
+    readonly code: SecretErrorCode;
+    readonly operation?: string;
+    readonly status?: number;
+    constructor(code: SecretErrorCode, message: string, details?: {
+        operation?: string;
+        status?: number;
+    });
+}

package/dist/secrets/index.d.ts

@@ -1,30 +1,18 @@
-export type SecretEnvironment = 'dev' | 'staging' | 'prod';
-export type SecretEnvironmentOption = SecretEnvironment | (() => SecretEnvironment);
-export type InfisicalDefineSecretSetOptions = {
-    readonly projectId: string;
-    readonly siteUrl?: string;
-    readonly environment?: SecretEnvironmentOption;
+import { type CommonSecretSetOptions, type CustomLoaderDefineSecretSetOptions, type SecretSet } from './core';
+import { type SecretEnvironment } from './environment';
+import { type InfisicalAuthMode } from './infisical';
+import { type InfisicalProjectOptions } from './infisical-config';
+export * from './core';
+export * from './infisical';
+export * from './loaders';
+export * from './vite';
+export type { SecretRequestOptions } from './deadline';
+export type InfisicalDefineSecretSetOptions<K extends string = string, Parsed = Record<K, string>> = CommonSecretSetOptions<K, Parsed> & InfisicalProjectOptions & {
+    readonly auth?: InfisicalAuthMode;
     readonly clientIdEnvKey?: string;
     readonly clientSecretEnvKey?: string;
     readonly loader?: undefined;
 };
-export type CustomLoaderDefineSecretSetOptions<SecretKey extends string> = {
-    readonly loader: SecretSetLoader<SecretKey>;
-    readonly environment?: SecretEnvironmentOption;
-};
-export type DefineSecretSetOptions<SecretKey extends string> = InfisicalDefineSecretSetOptions | CustomLoaderDefineSecretSetOptions<SecretKey>;
-export type SecretSetLoaderContext<SecretKey extends string> = {
-    readonly keys: readonly SecretKey[];
-    readonly environment: SecretEnvironment;
-};
-export type SecretSetLoader<SecretKey extends string> = (context: SecretSetLoaderContext<SecretKey>) => Promise<Partial<Record<SecretKey, string>>>;
-export type SecretSet<SecretKey extends string> = {
-    secret: (key: SecretKey) => string;
-    secrets: () => Record<SecretKey, string>;
-    reload: () => Promise<SecretSet<SecretKey>>;
-};
-export * from './infisical';
-export * from './loaders';
-export * from './vite';
+export type DefineSecretSetOptions<K extends string, Parsed = Record<K, string>> = InfisicalDefineSecretSetOptions<K, Parsed> | CustomLoaderDefineSecretSetOptions<K, Parsed>;
 export declare function getSecretEnvironment(): SecretEnvironment;
-export declare function defineSecretSet<const SecretKeys extends readonly string[]>(keys: SecretKeys, options: DefineSecretSetOptions<SecretKeys[number]>): Promise<SecretSet<SecretKeys[number]>>;
+export declare function defineSecretSet<const Keys extends readonly string[], Parsed = Record<Keys[number], string>>(keys: Keys, options: DefineSecretSetOptions<Keys[number], Parsed>): Promise<SecretSet<Keys[number], Parsed>>;

package/dist/secrets/infisical-cli.d.ts

@@ -0,0 +1,6 @@
+import type { SecretRequestOptions } from './deadline';
+/** Read the active CLI session without a shell or credential-bearing errors. */
+export declare function readInfisicalCliToken(options: SecretRequestOptions & {
+    siteUrl: string;
+    signal: AbortSignal;
+}): Promise<string>;