hanzio 1.2.0 → 2.1.0

package/dist/index-hyt6c56h.js

@@ -0,0 +1,290 @@
+import {
+  SecretLoadError2
+} from "./index-ktynw3vs.js";
+
+// src/secrets/environment.ts
+function getProcessEnvironment() {
+  return typeof process === "undefined" ? undefined : process.env;
+}
+function resolveSecretEnvironment(option, env) {
+  const explicit = typeof option === "function" ? option() : option;
+  if (typeof explicit === "object" && explicit !== null) {
+    if (typeof explicit.slug !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(explicit.slug)) {
+      throw new SecretLoadError2("CONFIGURATION", "Custom secret environment requires a valid slug.");
+    }
+    return explicit.slug;
+  }
+  const selected = explicit ?? env?.SECRETS_ENV;
+  if (selected !== undefined) {
+    if (selected === "production" || selected === "prod") {
+      return "prod";
+    }
+    if (selected === "development" || selected === "dev") {
+      return "dev";
+    }
+    if (selected === "staging") {
+      return "staging";
+    }
+    throw new SecretLoadError2("CONFIGURATION", "Invalid secret environment. Use dev, staging, prod, or an explicit { slug } option.");
+  }
+  if (env?.NODE_ENV === "production" || env?.NODE_ENV === "prod") {
+    return "prod";
+  }
+  if (env?.NODE_ENV === "staging") {
+    return "staging";
+  }
+  return "dev";
+}
+
+// src/secrets/deadline.ts
+async function withSecretDeadline(options, operation) {
+  const timeoutMs = options.timeoutMs ?? 30000;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2147483647) {
+    throw new SecretLoadError2("CONFIGURATION", "Secret timeoutMs must be a positive finite timer duration.");
+  }
+  const controller = new AbortController;
+  const cancel = () => controller.abort(new SecretLoadError2("ABORTED", "Secret loading was cancelled."));
+  if (options.signal?.aborted) {
+    cancel();
+  } else {
+    options.signal?.addEventListener("abort", cancel, { once: true });
+  }
+  const timer = setTimeout(() => controller.abort(new SecretLoadError2("TIMEOUT", `Secret loading timed out after ${timeoutMs}ms.`)), timeoutMs);
+  let rejectOnAbort = () => {};
+  try {
+    const aborted = new Promise((_, reject) => {
+      rejectOnAbort = () => reject(controller.signal.reason);
+      controller.signal.addEventListener("abort", rejectOnAbort, { once: true });
+    });
+    if (controller.signal.aborted) {
+      throw controller.signal.reason;
+    }
+    return await Promise.race([operation(controller.signal), aborted]);
+  } finally {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", cancel);
+    controller.signal.removeEventListener("abort", rejectOnAbort);
+  }
+}
+
+// src/secrets/core.ts
+var registryKey = Symbol.for("hanzio.secrets.environmentWrites.v1");
+var shared = globalThis;
+var environmentWrites = shared[registryKey] ?? new WeakMap;
+shared[registryKey] = environmentWrites;
+var defaultLogger = {
+  info: (message, attrs) => console.log(`${message} environment=${attrs.environment} count=${attrs.count} source=${attrs.source} durationMs=${attrs.durationMs}`, { sources: attrs.sources }),
+  error: (message, attrs) => console.error(message, attrs)
+};
+function readOverrides(keys, env) {
+  if (!env) {
+    return {};
+  }
+  const writes = environmentWrites.get(env);
+  return Object.fromEntries(keys.flatMap((key) => {
+    const value = Object.hasOwn(env, key) ? env[key] : undefined;
+    if (writes?.has(key)) {
+      if (writes.get(key) === value) {
+        return [];
+      }
+      writes.delete(key);
+    }
+    return value ? [[key, value]] : [];
+  }));
+}
+function createSecretSet2(keys, options, environmentVariables) {
+  const keySet = [...new Set(keys)];
+  let environment;
+  let initialized = false;
+  const logger = options.logger === false ? undefined : options.logger ?? defaultLogger;
+  let cached;
+  let parsed;
+  let sources;
+  let inFlight;
+  const log = (level, message, attributes) => {
+    try {
+      logger?.[level](message, attributes);
+    } catch {}
+  };
+  const loadSnapshot = async (request, signal, environment) => {
+    const local = readOverrides(keySet, environmentVariables);
+    const missing = keySet.filter((key) => !Object.hasOwn(local, key));
+    let loaderSource = options.loader.source ?? "custom loader";
+    let loaded = {};
+    if (missing.length) {
+      try {
+        loaded = await options.loader({
+          keys: missing,
+          environment,
+          signal,
+          timeoutMs: request.timeoutMs ?? options.timeoutMs ?? 30000,
+          reportSource: (source) => {
+            loaderSource = source;
+          }
+        });
+      } catch (error) {
+        if (error instanceof SecretLoadError2) {
+          throw error;
+        }
+        throw new SecretLoadError2("LOADER", "Secret loader failed.");
+      }
+    }
+    const overrides = readOverrides(keySet, environmentVariables);
+    const next = Object.fromEntries(keySet.map((key) => {
+      if (Object.hasOwn(overrides, key)) {
+        return [key, overrides[key]];
+      }
+      if (Object.hasOwn(loaded, key)) {
+        return [key, loaded[key]];
+      }
+      return [key, undefined];
+    }));
+    const missingKeys = keySet.filter((key) => typeof next[key] !== "string" || !next[key]);
+    if (missingKeys.length) {
+      throw new SecretLoadError2("MISSING_SECRETS", `Missing secrets: ${missingKeys.join(", ")}`);
+    }
+    let nextParsed;
+    try {
+      nextParsed = options.schema ? await options.schema.parseAsync({ ...next }) : { ...next };
+      nextParsed = structuredClone(nextParsed);
+    } catch {
+      throw new SecretLoadError2("VALIDATION", "Secret schema validation failed. Check the configured schema; values are omitted.");
+    }
+    signal.throwIfAborted();
+    const nextSources = Object.fromEntries(keySet.map((key) => [
+      key,
+      Object.hasOwn(overrides, key) ? "process.env" : loaderSource
+    ]));
+    if (options.writeToProcessEnv !== false && environmentVariables) {
+      let writes = environmentWrites.get(environmentVariables);
+      if (!writes) {
+        writes = new Map;
+        environmentWrites.set(environmentVariables, writes);
+      }
+      for (const key of keySet) {
+        if (Object.hasOwn(overrides, key)) {
+          continue;
+        }
+        environmentVariables[key] = next[key];
+        writes.set(key, next[key]);
+      }
+    }
+    cached = next;
+    parsed = nextParsed;
+    sources = nextSources;
+    initialized = true;
+  };
+  const load = (request = {}) => {
+    if (inFlight) {
+      return inFlight;
+    }
+    inFlight = (async () => {
+      const start = Date.now();
+      try {
+        environment ??= resolveSecretEnvironment(options.environment, environmentVariables);
+        const resolvedEnvironment = environment;
+        await withSecretDeadline({
+          timeoutMs: request.timeoutMs ?? options.timeoutMs,
+          signal: request.signal ?? options.signal
+        }, (signal) => loadSnapshot(request, signal, resolvedEnvironment));
+        const sourceCounts = new Map;
+        for (const key of keySet) {
+          const source = sources[key];
+          sourceCounts.set(source, (sourceCounts.get(source) ?? 0) + 1);
+        }
+        const counts = Object.fromEntries(sourceCounts);
+        log("info", "Loaded secrets", {
+          environment: resolvedEnvironment,
+          count: keySet.length,
+          durationMs: Date.now() - start,
+          source: Object.keys(counts).join(" + ") || "none",
+          sources: counts
+        });
+      } catch (error) {
+        const safe = error instanceof SecretLoadError2 ? error : new SecretLoadError2("LOADER", "Secret loading failed.");
+        log("error", "Secret loading failed", {
+          environment: environment ?? "unresolved",
+          count: keySet.length,
+          durationMs: Date.now() - start,
+          code: safe.code
+        });
+        throw safe;
+      }
+    })().finally(() => {
+      inFlight = undefined;
+    });
+    return inFlight;
+  };
+  const assertLoaded = () => {
+    if (!initialized) {
+      throw new SecretLoadError2("CONFIGURATION", "Secret set has not been loaded. Await load() before reading values.");
+    }
+  };
+  const secretSet = {
+    secret(key) {
+      assertLoaded();
+      if (!Object.hasOwn(cached, key)) {
+        throw new SecretLoadError2("MISSING_SECRETS", `Secret ${key} not found`);
+      }
+      return cached[key];
+    },
+    secrets() {
+      assertLoaded();
+      return { ...cached };
+    },
+    parsed() {
+      assertLoaded();
+      return structuredClone(parsed);
+    },
+    sources() {
+      assertLoaded();
+      return { ...sources };
+    },
+    async load(request) {
+      if (!initialized) {
+        await load(request);
+      }
+      return secretSet;
+    },
+    async reload(request) {
+      await load(request);
+      return secretSet;
+    }
+  };
+  return secretSet;
+}
+async function defineSecretSet2(keys, options, environmentVariables) {
+  return createSecretSet2(keys, options, environmentVariables).load();
+}
+
+// src/secrets/worker-loader.ts
+function cloudflareWorkerEnvLoader2(workerEnv) {
+  const loader = async (ctx) => {
+    const out = Object.create(null);
+    for (const key of ctx.keys) {
+      const str = workerBindingToString(Object.hasOwn(workerEnv, key) ? workerEnv[key] : undefined);
+      if (str !== undefined) {
+        out[key] = str;
+      }
+    }
+    return out;
+  };
+  return Object.assign(loader, { source: "Cloudflare Worker bindings" });
+}
+function workerBindingToString(value) {
+  if (value === undefined || value === null) {
+    return;
+  }
+  if (typeof value === "string") {
+    return value === "" ? undefined : value;
+  }
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  if (typeof value === "object") {
+    return JSON.stringify(value);
+  }
+  return String(value);
+}
+
+export { withSecretDeadline, getProcessEnvironment, resolveSecretEnvironment, createSecretSet2, defineSecretSet2, cloudflareWorkerEnvLoader2 };