hanzio 2.0.0 → 2.1.0

package/dist/{index-wjyb9bsd.js → index-hyt6c56h.js}

@@ -1,6 +1,6 @@
 import {
   SecretLoadError2
-} from "./index-srt06xd2.js";
+} from "./index-ktynw3vs.js";
 
 // src/secrets/environment.ts
 function getProcessEnvironment() {
@@ -92,9 +92,10 @@ function readOverrides(keys, env) {
     return value ? [[key, value]] : [];
   }));
 }
-async function defineSecretSet2(keys, options, environmentVariables) {
+function createSecretSet2(keys, options, environmentVariables) {
   const keySet = [...new Set(keys)];
-  const environment = resolveSecretEnvironment(options.environment, environmentVariables);
+  let environment;
+  let initialized = false;
   const logger = options.logger === false ? undefined : options.logger ?? defaultLogger;
   let cached;
   let parsed;
@@ -105,7 +106,7 @@ async function defineSecretSet2(keys, options, environmentVariables) {
       logger?.[level](message, attributes);
     } catch {}
   };
-  const loadSnapshot = async (request, signal) => {
+  const loadSnapshot = async (request, signal, environment) => {
     const local = readOverrides(keySet, environmentVariables);
     const missing = keySet.filter((key) => !Object.hasOwn(local, key));
     let loaderSource = options.loader.source ?? "custom loader";
@@ -171,6 +172,7 @@ async function defineSecretSet2(keys, options, environmentVariables) {
     cached = next;
     parsed = nextParsed;
     sources = nextSources;
+    initialized = true;
   };
   const load = (request = {}) => {
     if (inFlight) {
@@ -179,10 +181,12 @@ async function defineSecretSet2(keys, options, environmentVariables) {
     inFlight = (async () => {
       const start = Date.now();
       try {
+        environment ??= resolveSecretEnvironment(options.environment, environmentVariables);
+        const resolvedEnvironment = environment;
         await withSecretDeadline({
           timeoutMs: request.timeoutMs ?? options.timeoutMs,
           signal: request.signal ?? options.signal
-        }, (signal) => loadSnapshot(request, signal));
+        }, (signal) => loadSnapshot(request, signal, resolvedEnvironment));
         const sourceCounts = new Map;
         for (const key of keySet) {
           const source = sources[key];
@@ -190,7 +194,7 @@ async function defineSecretSet2(keys, options, environmentVariables) {
         }
         const counts = Object.fromEntries(sourceCounts);
         log("info", "Loaded secrets", {
-          environment,
+          environment: resolvedEnvironment,
           count: keySet.length,
           durationMs: Date.now() - start,
           source: Object.keys(counts).join(" + ") || "none",
@@ -199,7 +203,7 @@ async function defineSecretSet2(keys, options, environmentVariables) {
       } catch (error) {
         const safe = error instanceof SecretLoadError2 ? error : new SecretLoadError2("LOADER", "Secret loading failed.");
         log("error", "Secret loading failed", {
-          environment,
+          environment: environment ?? "unresolved",
           count: keySet.length,
           durationMs: Date.now() - start,
           code: safe.code
@@ -211,24 +215,47 @@ async function defineSecretSet2(keys, options, environmentVariables) {
     });
     return inFlight;
   };
+  const assertLoaded = () => {
+    if (!initialized) {
+      throw new SecretLoadError2("CONFIGURATION", "Secret set has not been loaded. Await load() before reading values.");
+    }
+  };
   const secretSet = {
     secret(key) {
+      assertLoaded();
       if (!Object.hasOwn(cached, key)) {
         throw new SecretLoadError2("MISSING_SECRETS", `Secret ${key} not found`);
       }
       return cached[key];
     },
-    secrets: () => ({ ...cached }),
-    parsed: () => structuredClone(parsed),
-    sources: () => ({ ...sources }),
+    secrets() {
+      assertLoaded();
+      return { ...cached };
+    },
+    parsed() {
+      assertLoaded();
+      return structuredClone(parsed);
+    },
+    sources() {
+      assertLoaded();
+      return { ...sources };
+    },
+    async load(request) {
+      if (!initialized) {
+        await load(request);
+      }
+      return secretSet;
+    },
     async reload(request) {
       await load(request);
       return secretSet;
     }
   };
-  await load();
   return secretSet;
 }
+async function defineSecretSet2(keys, options, environmentVariables) {
+  return createSecretSet2(keys, options, environmentVariables).load();
+}
 
 // src/secrets/worker-loader.ts
 function cloudflareWorkerEnvLoader2(workerEnv) {
@@ -260,4 +287,4 @@ function workerBindingToString(value) {
   return String(value);
 }
 
-export { withSecretDeadline, getProcessEnvironment, resolveSecretEnvironment, defineSecretSet2, cloudflareWorkerEnvLoader2 };
+export { withSecretDeadline, getProcessEnvironment, resolveSecretEnvironment, createSecretSet2, defineSecretSet2, cloudflareWorkerEnvLoader2 };

package/dist/index-ktynw3vs.js

@@ -0,0 +1,37 @@
+// src/secrets/errors.ts
+class SecretLoadError2 extends Error {
+  code;
+  operation;
+  status;
+  constructor(code, message, details = {}) {
+    super(message);
+    this.name = "SecretLoadError";
+    this.code = code;
+    this.operation = details.operation;
+    this.status = details.status;
+  }
+}
+
+// src/secrets/public-config.ts
+function readPublicConfig2(keys, values) {
+  const snapshot = Object.fromEntries(keys.map((key) => [
+    key,
+    Object.hasOwn(values, key) ? values[key] : undefined
+  ]));
+  const missing = keys.filter((key) => typeof snapshot[key] !== "string" || !snapshot[key]);
+  if (missing.length) {
+    throw new SecretLoadError2("MISSING_SECRETS", `Missing required public configuration: ${missing.join(", ")}`);
+  }
+  const configured = snapshot;
+  return {
+    secret(key) {
+      if (!Object.hasOwn(configured, key)) {
+        throw new SecretLoadError2("CONFIGURATION", `Public key ${key} is not configured.`);
+      }
+      return configured[key];
+    },
+    secrets: () => ({ ...configured })
+  };
+}
+
+export { SecretLoadError2, readPublicConfig2 };

package/dist/{index-181e6vfw.js → index-w882zry3.js}

@@ -1,6 +1,6 @@
 import {
   SecretLoadError2
-} from "./index-srt06xd2.js";
+} from "./index-ktynw3vs.js";
 
 // src/secrets/vite.ts
 function getViteDefine2(secretSet, options = {}) {

package/dist/secrets/core.d.ts

@@ -44,4 +44,11 @@ export type SecretSet<K extends string, Parsed = Record<K, string>> = {
     sources: () => Record<K, string>;
     reload: (options?: SecretRequestOptions) => Promise<SecretSet<K, Parsed>>;
 };
+/** A declaration that must be loaded explicitly before its values can be read. */
+export type LazySecretSet<K extends string, Parsed = Record<K, string>> = SecretSet<K, Parsed> & {
+    /** Initialize once. Concurrent calls share a load; use reload to refresh. */
+    load: (options?: SecretRequestOptions) => Promise<LazySecretSet<K, Parsed>>;
+};
+export declare function createSecretSet<const Keys extends readonly string[], Parsed = Record<Keys[number], string>>(keys: Keys, options: CustomLoaderDefineSecretSetOptions<Keys[number], Parsed>, environmentVariables?: EnvironmentVariables): LazySecretSet<Keys[number], Parsed>;
+/** Compatibility API: declares and loads a complete snapshot before returning. */
 export declare function defineSecretSet<const Keys extends readonly string[], Parsed = Record<Keys[number], string>>(keys: Keys, options: CustomLoaderDefineSecretSetOptions<Keys[number], Parsed>, environmentVariables?: EnvironmentVariables): Promise<SecretSet<Keys[number], Parsed>>;

package/dist/secrets/index.d.ts

@@ -1,4 +1,4 @@
-import { type CommonSecretSetOptions, type CustomLoaderDefineSecretSetOptions, type SecretSet } from './core';
+import { type LazySecretSet, type CommonSecretSetOptions, type CustomLoaderDefineSecretSetOptions, type SecretSet } from './core';
 import { type SecretEnvironment } from './environment';
 import { type InfisicalAuthMode } from './infisical';
 import { type InfisicalProjectOptions } from './infisical-config';
@@ -15,4 +15,6 @@ export type InfisicalDefineSecretSetOptions<K extends string = string, Parsed =
 };
 export type DefineSecretSetOptions<K extends string, Parsed = Record<K, string>> = InfisicalDefineSecretSetOptions<K, Parsed> | CustomLoaderDefineSecretSetOptions<K, Parsed>;
 export declare function getSecretEnvironment(): SecretEnvironment;
+export declare function createSecretSet<const Keys extends readonly string[], Parsed = Record<Keys[number], string>>(keys: Keys, options: DefineSecretSetOptions<Keys[number], Parsed>): LazySecretSet<Keys[number], Parsed>;
+/** Compatibility API: load immediately and fail before application startup. */
 export declare function defineSecretSet<const Keys extends readonly string[], Parsed = Record<Keys[number], string>>(keys: Keys, options: DefineSecretSetOptions<Keys[number], Parsed>): Promise<SecretSet<Keys[number], Parsed>>;

package/dist/secrets/public-config.d.ts

@@ -0,0 +1,7 @@
+import type { SecretSet } from './core';
+/**
+ * Read only explicitly listed public values. No process globals, secret loader,
+ * environment writes, or async initialization; safe in frontend tooling.
+ * Validate application-specific formats with your schema after secrets().
+ */
+export declare function readPublicConfig<const Keys extends readonly string[]>(keys: Keys, values: Readonly<Record<string, string | undefined>>): Pick<SecretSet<Keys[number]>, 'secret' | 'secrets'>;

package/dist/secrets/vite.d.ts

@@ -11,3 +11,4 @@ export type ViteSecretSetOptions<K extends string> = {
 };
 export declare function getViteDefine<K extends string>(secretSet: Pick<SecretSet<K, unknown>, 'secrets'>, options?: ViteSecretSetOptions<K>): Record<string, string>;
 export declare function viteSecretSetPlugin<K extends string>(secretSet: Pick<SecretSet<K, unknown>, 'secrets'>, options?: ViteSecretSetOptions<K>): ViteSecretSetPlugin;
+export { readPublicConfig } from './public-config';

package/dist/secrets/worker.d.ts

@@ -1,3 +1,4 @@
 export * from './core';
 export { cloudflareWorkerEnvLoader } from './worker-loader';
 export type { SecretRequestOptions } from './deadline';
+export { readPublicConfig } from './public-config';

package/dist/src/secrets/index.js

@@ -5,17 +5,18 @@ import {
 import {
   getViteDefine2,
   viteSecretSetPlugin2
-} from "../../index-181e6vfw.js";
+} from "../../index-w882zry3.js";
 import {
   withSecretDeadline,
   getProcessEnvironment,
   resolveSecretEnvironment,
-  defineSecretSet2,
+  createSecretSet2,
   cloudflareWorkerEnvLoader2
-} from "../../index-wjyb9bsd.js";
+} from "../../index-hyt6c56h.js";
 import {
-  SecretLoadError2
-} from "../../index-srt06xd2.js";
+  SecretLoadError2,
+  readPublicConfig2
+} from "../../index-ktynw3vs.js";
 
 // src/secrets/infisical.ts
 import { z as z2 } from "zod";
@@ -328,7 +329,7 @@ Object.assign(processEnvLoader, { source: "process.env" });
 function getSecretEnvironment() {
   return resolveSecretEnvironment(undefined, getProcessEnvironment());
 }
-async function defineSecretSet(keys, options) {
+function createSecretSet(keys, options) {
   let loader;
   if (!options.loader) {
     validateInfisicalOrganizationId(options.organizationId);
@@ -336,7 +337,7 @@ async function defineSecretSet(keys, options) {
   } else {
     loader = options.loader;
   }
-  return defineSecretSet2(keys, { ...options, loader }, getProcessEnvironment());
+  return createSecretSet2(keys, { ...options, loader }, getProcessEnvironment());
 }
 function createDefaultInfisicalLoader(options) {
   return (context) => loadInfisicalSecrets({
@@ -350,10 +351,14 @@ function createDefaultInfisicalLoader(options) {
     clientSecretEnvKey: options.clientSecretEnvKey ?? "INFISICAL_CLIENT_SECRET"
   });
 }
+async function defineSecretSet(keys, options) {
+  return createSecretSet(keys, options).load();
+}
 export {
   DEFAULT_INFISICAL_SITE_URL,
   SecretLoadError2 as SecretLoadError,
   cloudflareWorkerEnvLoader2 as cloudflareWorkerEnvLoader,
+  createSecretSet,
   defineSecretSet,
   fetchInfisicalSecrets,
   getSecretEnvironment,
@@ -361,5 +366,6 @@ export {
   infisicalLoader,
   loadInfisicalSecrets,
   processEnvLoader,
+  readPublicConfig2 as readPublicConfig,
   viteSecretSetPlugin2 as viteSecretSetPlugin
 };

package/dist/src/secrets/vite.js

@@ -1,8 +1,12 @@
 import {
   getViteDefine2,
   viteSecretSetPlugin2
-} from "../../index-181e6vfw.js";
+} from "../../index-w882zry3.js";
+import {
+  readPublicConfig2
+} from "../../index-ktynw3vs.js";
 export {
   getViteDefine2 as getViteDefine,
+  readPublicConfig2 as readPublicConfig,
   viteSecretSetPlugin2 as viteSecretSetPlugin
 };

package/dist/src/secrets/worker.js

@@ -1,12 +1,16 @@
 import {
+  createSecretSet2,
   defineSecretSet2,
   cloudflareWorkerEnvLoader2
-} from "../../index-wjyb9bsd.js";
+} from "../../index-hyt6c56h.js";
 import {
-  SecretLoadError2
-} from "../../index-srt06xd2.js";
+  SecretLoadError2,
+  readPublicConfig2
+} from "../../index-ktynw3vs.js";
 export {
   SecretLoadError2 as SecretLoadError,
   cloudflareWorkerEnvLoader2 as cloudflareWorkerEnvLoader,
-  defineSecretSet2 as defineSecretSet
+  createSecretSet2 as createSecretSet,
+  defineSecretSet2 as defineSecretSet,
+  readPublicConfig2 as readPublicConfig
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hanzio",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "A lightweight set of utility functions for TypeScript",
   "type": "module",
   "module": "./dist/src/index.js",

package/src/secrets/core.ts

@@ -68,6 +68,15 @@ export type SecretSet<K extends string, Parsed = Record<K, string>> = {
 	reload: (options?: SecretRequestOptions) => Promise<SecretSet<K, Parsed>>
 }
 
+/** A declaration that must be loaded explicitly before its values can be read. */
+export type LazySecretSet<
+	K extends string,
+	Parsed = Record<K, string>
+> = SecretSet<K, Parsed> & {
+	/** Initialize once. Concurrent calls share a load; use reload to refresh. */
+	load: (options?: SecretRequestOptions) => Promise<LazySecretSet<K, Parsed>>
+}
+
 // Shared across bundled entry points and package copies in the same JS realm.
 // Only helper-written values are registered; original environment overrides aren't.
 const registryKey = Symbol.for('hanzio.secrets.environmentWrites.v1')
@@ -118,21 +127,19 @@ function readOverrides<K extends string>(
 	) as Partial<Record<K, string>>
 }
 
-export async function defineSecretSet<
+export function createSecretSet<
 	const Keys extends readonly string[],
 	Parsed = Record<Keys[number], string>
 >(
 	keys: Keys,
 	options: CustomLoaderDefineSecretSetOptions<Keys[number], Parsed>,
 	environmentVariables?: EnvironmentVariables
-): Promise<SecretSet<Keys[number], Parsed>> {
+): LazySecretSet<Keys[number], Parsed> {
 	type K = Keys[number]
 
 	const keySet = [...new Set(keys)] as K[]
-	const environment = resolveSecretEnvironment(
-		options.environment,
-		environmentVariables
-	)
+	let environment: string | undefined
+	let initialized = false
 	const logger =
 		options.logger === false ? undefined : (options.logger ?? defaultLogger)
 
@@ -157,7 +164,8 @@ export async function defineSecretSet<
 	// Build, validate, and commit one snapshot under the caller’s deadline.
 	const loadSnapshot = async (
 		request: SecretRequestOptions,
-		signal: AbortSignal
+		signal: AbortSignal,
+		environment: string
 	) => {
 		// Fetch only keys that lack genuine local overrides.
 		const local = readOverrides(keySet, environmentVariables)
@@ -261,6 +269,7 @@ export async function defineSecretSet<
 		cached = next
 		parsed = nextParsed
 		sources = nextSources
+		initialized = true
 	}
 
 	const load = (request: SecretRequestOptions = {}): Promise<void> => {
@@ -273,12 +282,18 @@ export async function defineSecretSet<
 			const start = Date.now()
 
 			try {
+				environment ??= resolveSecretEnvironment(
+					options.environment,
+					environmentVariables
+				)
+				const resolvedEnvironment = environment
+
 				await withSecretDeadline(
 					{
 						timeoutMs: request.timeoutMs ?? options.timeoutMs,
 						signal: request.signal ?? options.signal
 					},
-					(signal) => loadSnapshot(request, signal)
+					(signal) => loadSnapshot(request, signal, resolvedEnvironment)
 				)
 
 				// Report the sources of committed values, not attempted fetches.
@@ -293,7 +308,7 @@ export async function defineSecretSet<
 				const counts = Object.fromEntries(sourceCounts)
 
 				log('info', 'Loaded secrets', {
-					environment,
+					environment: resolvedEnvironment,
 					count: keySet.length,
 					durationMs: Date.now() - start,
 					source: Object.keys(counts).join(' + ') || 'none',
@@ -306,7 +321,7 @@ export async function defineSecretSet<
 						: new SecretLoadError('LOADER', 'Secret loading failed.')
 
 				log('error', 'Secret loading failed', {
-					environment,
+					environment: environment ?? 'unresolved',
 					count: keySet.length,
 					durationMs: Date.now() - start,
 					code: safe.code
@@ -321,8 +336,19 @@ export async function defineSecretSet<
 		return inFlight
 	}
 
-	const secretSet: SecretSet<K, Parsed> = {
+	const assertLoaded = () => {
+		if (!initialized) {
+			throw new SecretLoadError(
+				'CONFIGURATION',
+				'Secret set has not been loaded. Await load() before reading values.'
+			)
+		}
+	}
+
+	const secretSet: LazySecretSet<K, Parsed> = {
 		secret(key) {
+			assertLoaded()
+
 			if (!Object.hasOwn(cached, key)) {
 				throw new SecretLoadError('MISSING_SECRETS', `Secret ${key} not found`)
 			}
@@ -331,9 +357,29 @@ export async function defineSecretSet<
 		},
 
 		// Return copies so consumers cannot mutate the internal snapshots.
-		secrets: () => ({ ...cached }),
-		parsed: () => structuredClone(parsed),
-		sources: () => ({ ...sources }),
+		secrets() {
+			assertLoaded()
+
+			return { ...cached }
+		},
+		parsed() {
+			assertLoaded()
+
+			return structuredClone(parsed)
+		},
+		sources() {
+			assertLoaded()
+
+			return { ...sources }
+		},
+
+		async load(request) {
+			if (!initialized) {
+				await load(request)
+			}
+
+			return secretSet
+		},
 
 		async reload(request) {
 			await load(request)
@@ -342,7 +388,17 @@ export async function defineSecretSet<
 		}
 	}
 
-	await load()
-
 	return secretSet
 }
+
+/** Compatibility API: declares and loads a complete snapshot before returning. */
+export async function defineSecretSet<
+	const Keys extends readonly string[],
+	Parsed = Record<Keys[number], string>
+>(
+	keys: Keys,
+	options: CustomLoaderDefineSecretSetOptions<Keys[number], Parsed>,
+	environmentVariables?: EnvironmentVariables
+): Promise<SecretSet<Keys[number], Parsed>> {
+	return createSecretSet(keys, options, environmentVariables).load()
+}

package/src/secrets/index.ts

@@ -1,5 +1,6 @@
 import {
-	defineSecretSet as defineCoreSecretSet,
+	createSecretSet as createCoreSecretSet,
+	type LazySecretSet,
 	type CommonSecretSetOptions,
 	type CustomLoaderDefineSecretSetOptions,
 	type SecretSet,
@@ -51,13 +52,13 @@ export function getSecretEnvironment(): SecretEnvironment {
 	) as SecretEnvironment
 }
 
-export async function defineSecretSet<
+export function createSecretSet<
 	const Keys extends readonly string[],
 	Parsed = Record<Keys[number], string>
 >(
 	keys: Keys,
 	options: DefineSecretSetOptions<Keys[number], Parsed>
-): Promise<SecretSet<Keys[number], Parsed>> {
+): LazySecretSet<Keys[number], Parsed> {
 	let loader: SecretSetLoader<Keys[number]>
 
 	if (!options.loader) {
@@ -69,7 +70,7 @@ export async function defineSecretSet<
 	}
 
 	// Supply process.env only from this Node/Bun entry point, keeping the core portable.
-	return defineCoreSecretSet(
+	return createCoreSecretSet(
 		keys,
 		{ ...options, loader },
 		getProcessEnvironment()
@@ -92,3 +93,14 @@ function createDefaultInfisicalLoader<K extends string, Parsed>(
 				options.clientSecretEnvKey ?? 'INFISICAL_CLIENT_SECRET'
 		})
 }
+
+/** Compatibility API: load immediately and fail before application startup. */
+export async function defineSecretSet<
+	const Keys extends readonly string[],
+	Parsed = Record<Keys[number], string>
+>(
+	keys: Keys,
+	options: DefineSecretSetOptions<Keys[number], Parsed>
+): Promise<SecretSet<Keys[number], Parsed>> {
+	return createSecretSet(keys, options).load()
+}

package/src/secrets/public-config.ts

@@ -0,0 +1,47 @@
+import type { SecretSet } from './core'
+import { SecretLoadError } from './errors'
+
+/**
+ * Read only explicitly listed public values. No process globals, secret loader,
+ * environment writes, or async initialization; safe in frontend tooling.
+ * Validate application-specific formats with your schema after secrets().
+ */
+export function readPublicConfig<const Keys extends readonly string[]>(
+	keys: Keys,
+	values: Readonly<Record<string, string | undefined>>
+): Pick<SecretSet<Keys[number]>, 'secret' | 'secrets'> {
+	type K = Keys[number]
+
+	const snapshot = Object.fromEntries(
+		keys.map((key) => [
+			key,
+			Object.hasOwn(values, key) ? values[key] : undefined
+		])
+	)
+	const missing = keys.filter(
+		(key) => typeof snapshot[key] !== 'string' || !snapshot[key]
+	)
+
+	if (missing.length) {
+		throw new SecretLoadError(
+			'MISSING_SECRETS',
+			`Missing required public configuration: ${missing.join(', ')}`
+		)
+	}
+
+	const configured = snapshot as Record<K, string>
+
+	return {
+		secret(key) {
+			if (!Object.hasOwn(configured, key)) {
+				throw new SecretLoadError(
+					'CONFIGURATION',
+					`Public key ${key} is not configured.`
+				)
+			}
+
+			return configured[key]
+		},
+		secrets: () => ({ ...configured })
+	}
+}

package/src/secrets/vite.ts

@@ -57,3 +57,5 @@ export function viteSecretSetPlugin<K extends string>(
 		config: () => ({ define: getViteDefine(secretSet, options) })
 	}
 }
+
+export { readPublicConfig } from './public-config'

package/src/secrets/worker.ts

@@ -2,3 +2,5 @@
 export * from './core'
 export { cloudflareWorkerEnvLoader } from './worker-loader'
 export type { SecretRequestOptions } from './deadline'
+
+export { readPublicConfig } from './public-config'

package/dist/index-srt06xd2.js

@@ -1,15 +0,0 @@
-// src/secrets/errors.ts
-class SecretLoadError2 extends Error {
-  code;
-  operation;
-  status;
-  constructor(code, message, details = {}) {
-    super(message);
-    this.name = "SecretLoadError";
-    this.code = code;
-    this.operation = details.operation;
-    this.status = details.status;
-  }
-}
-
-export { SecretLoadError2 };