hanzio 3.2.0 → 3.3.0

package/dist/{index-nfvq3zax.js → index-818f7jz4.js}

@@ -7,8 +7,38 @@ import {
 import { parseArgs } from "node:util";
 
 // src/cli/fields.ts
-import { z } from "zod";
 class UsageError extends Error {
+  kind;
+  constructor(message, kind = "invalid-arguments") {
+    super(message);
+    this.kind = kind;
+  }
+}
+var optionName = (field) => field.flag.startsWith("no-") ? field.key : field.flag;
+var strings = (value, what, key) => {
+  const list = value === undefined ? [] : Array.isArray(value) ? value : [value];
+  if (list.some((item) => typeof item !== "string" || !item))
+    throw new Error(`hanzio/cli: ${what} ${JSON.stringify(value)} of "${key}" must be a string or string[]`);
+  return list;
+};
+var kindOf = (def) => def.type === "boolean" ? "boolean" : def.type === "number" ? "number" : "string";
+function choicesOf(def) {
+  if (def.type === "enum")
+    return Object.values(def.entries).map(String);
+  if (def.type === "literal")
+    return def.values.map(String);
+  return;
+}
+function optionalValueOf(def) {
+  if (def.type !== "union" || def.options.length !== 2)
+    return;
+  const [a, b] = def.options.map(defOf);
+  const flag = (d) => d.type === "boolean" || d.type === "literal" && d.values.includes(true);
+  if (flag(a) && kindOf(b) === "string" && b.type !== "literal")
+    return b;
+  if (flag(b) && kindOf(a) === "string" && a.type !== "literal")
+    return a;
+  return;
 }
 var kebab = (key) => key.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`);
 function fieldsOf(schema) {
@@ -23,7 +53,7 @@ function toField(key, schema) {
   let defaultValue;
   let current = schema;
   for (;; ) {
-    const meta = z.globalRegistry.get(current);
+    const meta = current.meta?.();
     if (meta)
       metas.unshift(meta);
     const def = defOf(current);
@@ -49,22 +79,23 @@ function toField(key, schema) {
     }
     def = defOf(element);
   }
-  const alias = meta.alias;
-  if (alias !== undefined && (typeof alias !== "string" || alias.length !== 1))
-    throw new Error(`hanzio/cli: alias ${JSON.stringify(alias)} of "${key}" must be one character`);
+  const valueDef = multiple ? undefined : optionalValueOf(def);
+  const names = strings(meta.alias, "alias", key);
   return {
     key,
     flag: kebab(key),
-    kind: def.type === "boolean" ? "boolean" : def.type === "number" ? "number" : "string",
+    kind: valueDef ? "string" : kindOf(def),
     multiple,
     positional: meta.positional === true,
     optional,
     hasDefault,
     defaultValue,
     description: typeof meta.description === "string" ? meta.description : undefined,
-    alias,
-    env: typeof meta.env === "string" ? meta.env : undefined,
-    choices: def.type === "enum" ? Object.values(def.entries).map(String) : def.type === "literal" ? def.values.map(String) : undefined
+    alias: names.find((name) => name.length === 1),
+    aliases: names.filter((name) => name.length > 1).map(kebab),
+    env: strings(meta.env, "env", key),
+    optionalValue: valueDef !== undefined,
+    choices: choicesOf(valueDef ?? def)
   };
 }
 function coerce(field, value) {
@@ -82,7 +113,7 @@ function coerce(field, value) {
   }
   return value;
 }
-function readFields(fields, values, positionals, env) {
+function readFields(fields, values, positionals, env, strict = true) {
   const result = {};
   const queue = [...positionals];
   for (const field of fields) {
@@ -90,11 +121,12 @@ function readFields(fields, values, positionals, env) {
     if (field.positional)
       raw = field.multiple ? queue.length ? queue.splice(0) : undefined : queue.shift();
     else
-      raw = values[field.flag];
-    if (raw === undefined && field.env && env[field.env] !== undefined) {
-      const value = env[field.env];
+      raw = values[optionName(field)];
+    if (field.optionalValue && raw === "")
+      raw = true;
+    const value = raw === undefined ? field.env.map((name) => env[name]).find((value) => value?.trim()) : undefined;
+    if (value !== undefined)
       raw = field.multiple ? [value] : value;
-    }
     if (raw === undefined) {
       if (field.optional || field.hasDefault)
         continue;
@@ -107,23 +139,25 @@ function readFields(fields, values, positionals, env) {
     }
     result[field.key] = Array.isArray(raw) ? raw.map((item) => coerce(field, item)) : coerce(field, raw);
   }
-  if (queue.length)
+  if (strict && queue.length)
     throw new UsageError(`Unexpected argument "${queue[0]}"`);
   return result;
 }
 function fieldLabel(field) {
   if (field.positional)
     return field.multiple ? `<${field.flag}...>` : field.optional || field.hasDefault ? `[${field.flag}]` : `<${field.flag}>`;
-  const name = field.kind === "boolean" && field.defaultValue === true ? `--[no-]${field.flag}` : `--${field.flag}`;
-  const value = field.kind === "boolean" ? "" : ` <${field.choices?.join("|") ?? field.kind}>${field.multiple ? "..." : ""}`;
-  return `${field.alias ? `-${field.alias}, ` : ""}${name}${value}`;
+  const name = field.kind === "boolean" && field.defaultValue === true && !field.flag.startsWith("no-") ? `--[no-]${field.flag}` : `--${field.flag}`;
+  const type = `<${field.choices?.join("|") ?? field.kind}>`;
+  const value = field.kind === "boolean" ? "" : field.optionalValue ? `[=${type}]` : ` ${type}${field.multiple ? "..." : ""}`;
+  const aliases = field.aliases.map((alias) => `, --${alias}`).join("");
+  return `${field.alias ? `-${field.alias}, ` : ""}${name}${aliases}${value}`;
 }
 function fieldHelp(field) {
   const showDefault = field.hasDefault && field.defaultValue !== undefined && !(field.kind === "boolean" && field.defaultValue === false);
   return [
     field.description,
     showDefault && `(default: ${JSON.stringify(field.defaultValue)})`,
-    field.env && `[env: ${field.env}]`
+    field.env.length > 0 && `[env: ${field.env.join(", ")}]`
   ].filter(Boolean).join(" ");
 }
 function closest(input, candidates) {
@@ -160,6 +194,19 @@ class CliError2 extends Error {
     this.exitCode = options?.exitCode ?? 1;
   }
 }
+
+class CliUsageError2 extends CliError2 {
+  kind;
+  path;
+  help;
+  constructor(message, details) {
+    super(message, { exitCode: 2 });
+    this.name = "CliUsageError";
+    this.kind = details.kind;
+    this.path = details.path;
+    this.help = details.help;
+  }
+}
 function defineCommand2(definition) {
   return { ...definition, [commandKey]: true };
 }
@@ -174,12 +221,14 @@ async function loadCommand(node) {
   return loadCommand(command);
 }
 function listCommands(group, prefix = []) {
-  return Object.entries(group).flatMap(([name, node]) => typeof node === "function" || isCommand(node) ? [
-    [
-      [...prefix, name],
-      typeof node === "function" ? undefined : node.description
-    ]
-  ] : listCommands(node, [...prefix, name]));
+  return Object.entries(group).flatMap(([name, node]) => {
+    if (typeof node !== "function" && !isCommand(node))
+      return listCommands(node, [...prefix, name]);
+    const command = typeof node === "function" ? undefined : node;
+    const names = [...prefix, name, command?.usage].filter(Boolean).join(" ");
+    return [[names, command?.description?.split(`
+`)[0]]];
+  });
 }
 function table(rows) {
   const width = Math.max(...rows.map(([left]) => left.length));
@@ -190,14 +239,20 @@ var optionRows = (fields) => fields.map((field) => [fieldLabel(field), fieldHelp
 var helpRow = ["-h, --help", "Show help"];
 function defineCli2(config) {
   const root = config.commands;
+  const unknownCommand = config.unknownCommand;
   const builtIn = (group) => group === root && !Object.hasOwn(group, "completion");
   const versionRow = config.version ? [["--version", "Show version"]] : [];
+  const section = (title, fields) => fields.length ? [`${title}:
+${table(optionRows(fields))}`] : [];
+  const positionalsOf = (fields) => fields.filter((field) => field.positional);
+  const optionsOf = (fields) => fields.filter((field) => !field.positional);
   function groupHelp(group, path, globals) {
-    const usage = [config.name, ...path].join(" ");
-    const commands = listCommands(group).map(([names, description]) => [
-      names.join(" "),
-      description
-    ]);
+    const usage = [
+      config.name,
+      ...positionalsOf(globals).map(fieldLabel),
+      ...path
+    ].join(" ");
+    const commands = listCommands(group);
     if (builtIn(group))
       commands.push([
         "completion <bash|zsh>",
@@ -210,13 +265,15 @@ function defineCli2(config) {
         ""
       ],
       `Usage: ${usage} <command> [options]`,
+      ...section(`
+Arguments`, positionalsOf(globals)),
       "",
       "Commands:",
       table(commands),
       "",
       "Options:",
       table([
-        ...optionRows(globals),
+        ...optionRows(optionsOf(globals)),
         helpRow,
         ...path.length ? [] : versionRow
       ]),
@@ -225,34 +282,42 @@ function defineCli2(config) {
     ].join(`
 `);
   }
-  function commandHelp(command, path, fields, globals) {
-    const positionals = fields.filter((field) => field.positional);
-    const options = fields.filter((field) => !field.positional);
-    const sections = [
-      `Usage: ${[config.name, ...path, ...positionals.map(fieldLabel)].join(" ")} [options]`
+  function commandHelp(command, path, globals) {
+    const fields = command.raw ? [] : fieldsOf(command.input);
+    const positionals = [...positionalsOf(globals), ...positionalsOf(fields)];
+    const usage = [
+      config.name,
+      ...positionalsOf(globals).map(fieldLabel),
+      ...path,
+      command.usage ?? [...positionalsOf(fields).map(fieldLabel), "[options]"]
     ];
+    const sections = [`Usage: ${usage.flat().join(" ")}`];
     const description = command.description ?? config.description;
     if (description)
       sections.push(description);
-    if (positionals.length)
-      sections.push(`Arguments:
-${table(optionRows(positionals))}`);
+    sections.push(...section("Arguments", positionals));
     sections.push(`Options:
 ${table([
-      ...optionRows(options),
+      ...optionRows(optionsOf(fields)),
       helpRow,
       ...path.length ? [] : versionRow
     ])}`);
-    if (globals.length)
-      sections.push(`Global options:
-${table(optionRows(globals))}`);
+    sections.push(...section("Global options", optionsOf(globals)));
+    if (command.examples?.length)
+      sections.push(`Examples:
+${command.examples.map((line) => `  ${line}`).join(`
+`)}`);
     return sections.join(`
 
 `);
   }
+  async function helpText(node, path, globals) {
+    const text = isCommand(node) ? commandHelp(node, path, globals) : groupHelp(node, path, globals);
+    return config.help ? config.help(text, { path }) : text;
+  }
   async function completion(shell, globals) {
     const fn = `_${config.name.replace(/\W/g, "_")}_completion`;
-    const flags = (fields) => [...fields, ...globals].filter((field) => !field.positional).map((field) => `--${field.flag}`);
+    const flags = (fields) => optionsOf([...fields, ...globals]).map((field) => `--${field.flag}`);
     const cases = [];
     const visit = async (node, path) => {
       if (typeof node === "function" || isCommand(node)) {
@@ -301,69 +366,112 @@ ${script}`;
       const env = io.env ?? process.env;
       let usage = config.name;
       let json = false;
+      let globalFields = [];
+      let current = {
+        node: {},
+        path: []
+      };
       try {
-        const globalFields = fieldsOf(config.globals);
-        const positional = globalFields.find((field) => field.positional);
-        if (positional)
-          throw new Error(`hanzio/cli: global "${positional.key}" can't be positional`);
-        const valueFlags = new Set(globalFields.filter((field) => field.kind !== "boolean").flatMap((field) => [
+        globalFields = fieldsOf(config.globals);
+        const globalPositionals = positionalsOf(globalFields);
+        const array = globalPositionals.find((field) => field.multiple);
+        if (array)
+          throw new Error(`hanzio/cli: positional global "${array.key}" can't be an array`);
+        const longNames = (field) => [
           `--${field.flag}`,
+          ...field.aliases.map((alias) => `--${alias}`)
+        ];
+        const names = (field) => [
+          ...longNames(field),
           ...field.alias ? [`-${field.alias}`] : []
+        ];
+        const globalOptions = optionsOf(globalFields);
+        const valueFlags = new Set(globalOptions.filter((field) => field.kind !== "boolean" && !field.optionalValue).flatMap(names));
+        const globalFlags = new Set(globalOptions.flatMap((field) => [
+          ...names(field),
+          `--no-${field.flag}`
         ]));
         const isHelp = (token) => token === "--help" || token === "-h";
+        const isVersion = (token) => token === "--version" || token === "-v" && !globalOptions.some((field) => field.alias === "v");
+        const isFlag = (token) => token.startsWith("-") && token !== "-";
+        const args = [...argv];
+        let defaultCommand = typeof config.defaultCommand === "function" ? config.defaultCommand(env) : config.defaultCommand;
+        let injected = -1;
         let node = root;
         const path = [];
         const pre = [];
+        const positionals = [];
         let index = 0;
         while (typeof node !== "function" && !isCommand(node)) {
           const group = node;
-          const token = argv[index];
-          if (token === undefined || token === "--") {
-            if (pre.some(isHelp)) {
-              stdout.write(`${groupHelp(group, path, globalFields)}
+          current = { node: group, path: [...path] };
+          const token = args[index];
+          const end = token === undefined || token === "--";
+          if (end && pre.some(isHelp)) {
+            stdout.write(`${await helpText(group, path, globalFields)}
 `);
-              return 0;
+            return 0;
+          }
+          if (end && !path.length && pre.some(isVersion)) {
+            if (Object.hasOwn(group, "version")) {
+              pre.splice(0, pre.length, ...pre.filter((t) => !isVersion(t)));
+              args.splice(index, 0, "version");
+              injected = index;
+              continue;
             }
-            if (!path.length && config.version && pre.includes("--version")) {
+            if (config.version) {
               stdout.write(`${config.version}
 `);
               return 0;
             }
+          }
+          if (!path.length && defaultCommand !== undefined && (end || isFlag(token) && !isHelp(token) && !isVersion(token) && !globalFlags.has(token.split("=")[0]))) {
+            args.splice(index, 0, defaultCommand);
+            injected = index;
+            defaultCommand = undefined;
+            continue;
+          }
+          if (end)
             throw new UsageError(`${path.length ? `${usage}: missing` : "Missing"} command
 
-${groupHelp(group, path, globalFields)}`);
-          }
+${await helpText(group, path, globalFields)}`, "missing-command");
           index++;
-          if (token.startsWith("-") && token !== "-") {
+          if (isFlag(token)) {
             pre.push(token);
-            if (valueFlags.has(token) && argv[index] !== undefined)
-              pre.push(argv[index++]);
+            if (valueFlags.has(token) && args[index] !== undefined)
+              pre.push(args[index++]);
             continue;
           }
-          if (token === "completion" && builtIn(group)) {
-            const [shell = "bash"] = argv.slice(index);
+          if (token === "completion" && builtIn(group) && !positionals.length) {
+            const [shell = "bash"] = args.slice(index);
             stdout.write(await completion(shell, globalFields));
             return 0;
           }
-          const child = Object.hasOwn(group, token) ? group[token] : undefined;
+          if (!path.length && index - 1 !== injected && positionals.length < globalPositionals.length) {
+            positionals.push(token);
+            usage = `${usage} ${token}`;
+            continue;
+          }
+          const child = (Object.hasOwn(group, token) ? group[token] : undefined) ?? await unknownCommand?.(token, path);
           if (!child) {
             const names = Object.keys(group);
             if (builtIn(group))
               names.push("completion");
             const guess = closest(token, names);
-            throw new UsageError(`Unknown command "${[...path, token].join(" ")}".${guess ? ` Did you mean "${[...path, guess].join(" ")}"?` : ` Commands: ${names.join(", ")}`}`);
+            throw new UsageError(`Unknown command "${[...path, token].join(" ")}".${guess ? ` Did you mean "${[...path, guess].join(" ")}"?` : ` Commands: ${names.join(", ")}`}`, "unknown-command");
           }
           node = child;
           path.push(token);
           usage = `${usage} ${token}`;
         }
         const command = await loadCommand(node);
-        const rest = argv.slice(index);
+        current = { node: command, path };
+        const rest = args.slice(index);
         const fields = command.raw ? [] : fieldsOf(command.input);
         const dash = rest.indexOf("--");
         const tokens = command.raw ? pre : [...pre, ...dash < 0 ? rest : rest.slice(0, dash)];
         if (!command.raw && tokens.some(isHelp)) {
-          stdout.write(`${commandHelp(command, path, fields, globalFields)}
+          stdout.write(`${await helpText(command, path, globalFields)}
 `);
           return 0;
         }
@@ -373,37 +481,50 @@ ${groupHelp(group, path, globalFields)}`);
           return 0;
         }
         const options = {};
-        for (const field of [...globalFields, ...fields]) {
-          if (field.positional)
-            continue;
-          if (field.flag === "help" || Object.hasOwn(options, field.flag))
-            throw new Error(`hanzio/cli: --${field.flag} is declared twice`);
-          options[field.flag] = {
+        const canonical = new Map;
+        const all = optionsOf([...globalFields, ...fields]);
+        for (const field of all) {
+          const name = optionName(field);
+          for (const long of longNames(field)) {
+            if (long === "--help" || canonical.has(long))
+              throw new Error(`hanzio/cli: ${long} is declared twice`);
+            canonical.set(long, field);
+          }
+          options[name] = {
             type: field.kind === "boolean" ? "boolean" : "string",
             multiple: field.multiple,
             ...field.alias ? { short: field.alias } : {}
           };
         }
+        const rewritten = tokens.map((token) => {
+          const eq = token.indexOf("=");
+          const field = canonical.get(eq < 0 ? token : token.slice(0, eq));
+          if (!field)
+            return token;
+          const value = eq < 0 ? field.optionalValue ? "=" : "" : token.slice(eq);
+          return `--${optionName(field)}${value}`;
+        });
+        const strict = command.strict !== false;
         let parsed;
         try {
           parsed = parseArgs({
-            args: tokens,
+            args: rewritten,
             options,
             allowPositionals: true,
             allowNegative: true,
-            strict: true
+            strict
           });
         } catch (error) {
           const message = error instanceof Error ? error.message : String(error);
           const unknown = /^Unknown option '(-[^']*)'/.exec(message)?.[1];
           if (!unknown)
             throw new UsageError(message.split(". ")[0] ?? message);
-          const guess = closest(unknown.replace(/^--?/, ""), Object.keys(options));
+          const guess = closest(unknown.replace(/^--?/, ""), all.flatMap((field) => [field.flag, ...field.aliases]));
           throw new UsageError(`Unknown option ${unknown}.${guess ? ` Did you mean --${guess}?` : ""}`);
         }
         const issues = [];
         const validate = async (schema, fields, positionals) => {
-          const raw = readFields(fields, parsed.values, positionals, env);
+          const raw = readFields(fields, parsed.values, positionals, env, strict);
           if (!schema)
             return raw;
           const result = await schema.safeParseAsync(raw);
@@ -416,7 +537,7 @@ ${groupHelp(group, path, globalFields)}`);
           }
           return raw;
         };
-        const globals = await validate(config.globals, globalFields, []);
+        const globals = await validate(config.globals, globalFields, positionals);
         const input = await validate(command.raw ? undefined : command.input, fields, parsed.positionals);
         if (issues.length)
           throw new UsageError(issues.join(`
@@ -447,20 +568,39 @@ ${groupHelp(group, path, globalFields)}`);
         await output(result, ctx);
         return ctx.exitCode;
       } catch (error) {
-        if (error instanceof UsageError) {
-          stderr.write(`${error.message}
+        const failure = error instanceof UsageError ? new CliUsageError2(error.message, {
+          kind: error.kind,
+          path: current.path,
+          help: config.onError ? `${await helpText(current.node, current.path, globalFields)}
+` : ""
+        }) : error;
+        let printed;
+        const print = () => {
+          if (printed !== undefined)
+            return printed;
+          const message = failure instanceof Error ? failure.message : String(failure);
+          if (failure instanceof CliUsageError2)
+            stderr.write(`${message}
 Run "${usage} --help" for usage.
 `);
-          return 2;
-        }
-        const message = error instanceof Error ? error.message : String(error);
-        if (json)
-          stderr.write(`${JSON.stringify({ error: message })}
+          else if (json)
+            stderr.write(`${JSON.stringify({ error: message })}
 `);
-        else
-          stderr.write(`${error instanceof Error && !(error instanceof CliError2) ? error.stack ?? message : message}
+          else
+            stderr.write(`${failure instanceof Error && !(failure instanceof CliError2) ? failure.stack ?? message : message}
 `);
-        return error instanceof CliError2 ? error.exitCode : 1;
+          printed = failure instanceof CliError2 ? failure.exitCode : 1;
+          return printed;
+        };
+        if (!config.onError)
+          return print();
+        return await config.onError(failure, {
+          stdout,
+          stderr,
+          env,
+          json,
+          print
+        }) ?? print();
       }
     }
   };
@@ -472,4 +612,4 @@ function printResult(result, ctx) {
 `);
 }
 
-export { CliError2, defineCommand2, defineCli2 };
+export { CliError2, CliUsageError2, defineCommand2, defineCli2 };

package/dist/index-zz773050.js

@@ -0,0 +1,135 @@
+import {
+  utf8Encode2,
+  utf8Decode2,
+  encodeBase64Url2,
+  decodeBase64Url2,
+  toBytes,
+  randomBytes2,
+  getSubtleCrypto
+} from "./index-rp5pqghz.js";
+
+// src/crypto/sealer.ts
+var ERROR_MESSAGES = {
+  malformed: "Malformed sealed value",
+  unsupported_version: "Unsupported sealed value version",
+  decrypt_failed: "Could not open sealed value: wrong key or tampered data"
+};
+
+class SealerError2 extends Error {
+  code;
+  constructor(code) {
+    super(ERROR_MESSAGES[code]);
+    this.name = "SealerError";
+    this.code = code;
+  }
+}
+var PREFIX = "enc:v1:";
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+var DEFAULT_INFO = "hanzio.sealer.aes-256-gcm.v1";
+function sealerKeyInputs2(options) {
+  const secret = toBytes(options.secret);
+  if (secret.length === 0) {
+    throw new TypeError("Sealer secret must not be empty");
+  }
+  const contexts = [options, ...options.fallbacks ?? []].map(({ salt = "", info = DEFAULT_INFO }) => ({ salt, info }));
+  return { secret, contexts };
+}
+function formatEnvelope2(iv, tag, ciphertext) {
+  return `${PREFIX}${encodeBase64Url2(iv)}.${encodeBase64Url2(tag)}.${encodeBase64Url2(ciphertext)}`;
+}
+function parseEnvelope2(sealed, passthroughUnsealed = false) {
+  if (typeof sealed !== "string" || !sealed.startsWith(PREFIX)) {
+    const isEnvelope = typeof sealed === "string" && /^enc:v\d+:/.test(sealed);
+    if (isEnvelope)
+      throw new SealerError2("unsupported_version");
+    if (passthroughUnsealed)
+      return null;
+    throw new SealerError2("malformed");
+  }
+  const parts = sealed.slice(PREFIX.length).split(".");
+  let envelope;
+  try {
+    if (parts.length !== 3)
+      throw new Error;
+    envelope = {
+      iv: decodeBase64Url2(parts[0]),
+      tag: decodeBase64Url2(parts[1]),
+      ciphertext: decodeBase64Url2(parts[2])
+    };
+  } catch (_error) {
+    throw new SealerError2("malformed");
+  }
+  if (envelope.iv.length !== IV_BYTES || envelope.tag.length !== TAG_BYTES) {
+    throw new SealerError2("malformed");
+  }
+  return envelope;
+}
+function jsonToSeal2(value) {
+  const json = JSON.stringify(value);
+  if (json === undefined) {
+    throw new TypeError("sealJson value is not JSON-serializable");
+  }
+  return json;
+}
+function createSealer2(options) {
+  const { secret, contexts } = sealerKeyInputs2(options);
+  const keys = [];
+  const getKey = (index) => {
+    let key = keys[index];
+    if (!key) {
+      const context = contexts[index];
+      key = deriveKey(secret, context.salt, context.info);
+      keys[index] = key;
+      key.catch(() => {
+        keys[index] = undefined;
+      });
+    }
+    return key;
+  };
+  const seal = async (plaintext) => {
+    const iv = randomBytes2(IV_BYTES);
+    const encrypted = new Uint8Array(await getSubtleCrypto().encrypt({ name: "AES-GCM", iv }, await getKey(0), utf8Encode2(plaintext)));
+    const tagStart = encrypted.length - TAG_BYTES;
+    return formatEnvelope2(iv, encrypted.subarray(tagStart), encrypted.subarray(0, tagStart));
+  };
+  const openEnvelope = async ({ iv, tag, ciphertext }) => {
+    const encrypted = new Uint8Array(ciphertext.length + TAG_BYTES);
+    encrypted.set(ciphertext);
+    encrypted.set(tag, ciphertext.length);
+    for (let index = 0;index < contexts.length; index++) {
+      const key = await getKey(index);
+      try {
+        return utf8Decode2(await getSubtleCrypto().decrypt({ name: "AES-GCM", iv }, key, encrypted));
+      } catch (_error) {}
+    }
+    throw new SealerError2("decrypt_failed");
+  };
+  const open = async (sealed) => {
+    const envelope = parseEnvelope2(sealed, options.passthroughUnsealed);
+    return envelope ? openEnvelope(envelope) : sealed;
+  };
+  return {
+    seal,
+    open,
+    sealJson: async (value) => seal(jsonToSeal2(value)),
+    async openJson(sealed) {
+      const envelope = parseEnvelope2(sealed, options.passthroughUnsealed);
+      return envelope ? JSON.parse(await openEnvelope(envelope)) : sealed;
+    }
+  };
+}
+async function deriveKey(secret, salt, info) {
+  const subtle = getSubtleCrypto();
+  const baseKey = await subtle.importKey("raw", secret, "HKDF", false, [
+    "deriveKey"
+  ]);
+  return subtle.deriveKey({
+    name: "HKDF",
+    hash: "SHA-256",
+    salt: utf8Encode2(salt),
+    info: utf8Encode2(info)
+  }, baseKey, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+
+export { SealerError2, sealerKeyInputs2, formatEnvelope2, parseEnvelope2, jsonToSeal2, createSealer2 };