typed-settings 0.1.1 → 0.2.1

package/dist/vault/hashicorp.cjs

@@ -1,183 +1,4 @@
-'use strict';
-
-// src/errors.ts
-function byteLengthUtf8(text) {
-  try {
-    const g = globalThis;
-    if (g.TextEncoder) return new g.TextEncoder().encode(text).length;
-    if (g.Buffer) return g.Buffer.byteLength(text, "utf8");
-  } catch {
-  }
-  return text.length;
-}
-var ConfigError = class extends Error {
-  code = "E_INVALID_CONFIG";
-  issues;
-  constructor(issues, code = "E_INVALID_CONFIG") {
-    const lines = issues.map(
-      (i) => `- ${i.path} (from ${i.from}): ${i.message}`
-    );
-    super(`Invalid config (${issues.length} issue${issues.length === 1 ? "" : "s"}):
-${lines.join("\n")}`);
-    this.name = "ConfigError";
-    this.code = code;
-    this.issues = issues;
-  }
-};
-
-// src/vault/shared.ts
-function getFetch(fetchFn) {
-  if (fetchFn) return fetchFn;
-  const g = globalThis;
-  if (g.fetch) return g.fetch.bind(globalThis);
-  throw new ConfigError(
-    [{ path: "<provider>", from: "vault", message: "E_NO_FETCH: global fetch unavailable" }],
-    "E_NO_FETCH"
-  );
-}
-function sameHost(a, b) {
-  return new URL(a).host === new URL(b).host;
-}
-var SENSITIVE_HEADER_RE = /authorization|token|secret|api[-_]?key|cookie|auth/i;
-function stripSensitiveForCrossHost(headers) {
-  const next = new Headers();
-  headers.forEach((value, key) => {
-    if (!SENSITIVE_HEADER_RE.test(key)) next.set(key, value);
-  });
-  return next;
-}
-async function fetchWithRedirectGuard(url, init, fetchFn, maxRedirects = 2) {
-  let current = url;
-  let headers = new Headers(init.headers);
-  for (let i = 0; i <= maxRedirects; i++) {
-    const res = await fetchFn(current, { ...init, headers, redirect: "manual" });
-    const status = res.status;
-    if (![301, 302, 303, 307, 308].includes(status)) return res;
-    const loc = res.headers.get("location");
-    if (!loc) return res;
-    let next;
-    try {
-      next = new URL(loc, current).toString();
-    } catch {
-      throw new ConfigError(
-        [{ path: current, from: "vault", message: "E_REDIRECT: invalid Location header" }],
-        "E_REDIRECT"
-      );
-    }
-    if (i === maxRedirects) {
-      throw new ConfigError(
-        [{ path: next, from: "vault", message: "E_REDIRECT: too many redirects" }],
-        "E_REDIRECT"
-      );
-    }
-    if (!sameHost(current, next)) headers = stripSensitiveForCrossHost(headers);
-    current = next;
-  }
-  throw new ConfigError([{ path: url, from: "vault", message: "E_REDIRECT" }], "E_REDIRECT");
-}
-function normalizeSecretMap(raw, providerName, opts) {
-  const clean = (v) => {
-    if (v === null || v === void 0) return void 0;
-    let s = typeof v === "string" ? v : String(v);
-    s = s.replace(/\r?\n$/, "");
-    return s;
-  };
-  const out = {};
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    throw new ConfigError(
-      [{ path: "<root>", from: providerName, message: "E_SHAPE: provider returned non-object" }],
-      "E_SHAPE"
-    );
-  }
-  for (const [k, v] of Object.entries(raw)) {
-    if (v !== null && typeof v === "object" && !Array.isArray(v)) {
-      out[k] = v;
-      continue;
-    }
-    const c = clean(v);
-    if (c !== void 0) out[k] = c;
-  }
-  return out;
-}
-function statusToCode(status) {
-  if (status === 403 || status === 401) return "E_DENIED";
-  if (status === 404) return "E_NOT_FOUND";
-  if (status === 429) return "E_THROTTLED";
-  if (status >= 500) return "E_UPSTREAM";
-  return "E_PROVIDER";
-}
-
-// src/vault/hashicorp.ts
-function tokenFromEnv(explicit) {
-  if (explicit !== void 0) return explicit || void 0;
-  const g = globalThis;
-  return g.process?.env?.["VAULT_TOKEN"];
-}
-function hashicorpProvider(opts) {
-  const mount = (opts.mount ?? "secret").replace(/^\/+|\/+$/g, "");
-  const timeoutMs = opts.timeoutMs ?? 5e3;
-  const maxBytes = opts.maxBytes ?? 1024 * 1024;
-  const name = `hashicorp://${mount}/${opts.path}`;
-  let inflight = null;
-  async function doLoad() {
-    const token = tokenFromEnv(opts.auth?.token);
-    const fetchFn = getFetch(opts.fetchFn);
-    const base = opts.url.replace(/\/+$/g, "");
-    const p = opts.path.replace(/^\/+/, "");
-    const qs = opts.version !== void 0 ? `?version=${encodeURIComponent(String(opts.version))}` : "";
-    const url = `${base}/v1/${mount}/${p}${qs}`;
-    const headers = new Headers();
-    if (token) headers.set("X-Vault-Token", token);
-    headers.set("Accept", "application/json");
-    let res;
-    try {
-      res = await fetchWithRedirectGuard(
-        url,
-        { headers, signal: AbortSignal.timeout(timeoutMs) },
-        fetchFn
-      );
-    } catch (e) {
-      if (e instanceof ConfigError) throw e;
-      const err = e;
-      const isTimeout = /timeout|abort/i.test(err?.name + err?.message);
-      throw new ConfigError(
-        [{ path: p, from: name, message: `${isTimeout ? "E_TIMEOUT" : "E_CONN"}: ${err?.message ?? String(e)}` }],
-        isTimeout ? "E_TIMEOUT" : "E_CONN"
-      );
-    }
-    if (!res.ok) {
-      const code = statusToCode(res.status);
-      throw new ConfigError([{ path: p, from: name, message: `${code}: HTTP ${res.status}` }], code);
-    }
-    const text = await res.text();
-    if (byteLengthUtf8(text) > maxBytes) {
-      throw new ConfigError([{ path: p, from: name, message: "E_TOO_LARGE: secret >cap" }], "E_TOO_LARGE");
-    }
-    let json;
-    try {
-      json = JSON.parse(text);
-    } catch {
-      throw new ConfigError([{ path: p, from: name, message: "E_PARSE: invalid JSON" }], "E_PARSE");
-    }
-    const data = json.data;
-    const isKv2 = !!data && typeof data === "object" && "data" in data && "metadata" in data;
-    const inner = isKv2 ? data.data : data;
-    if (!inner || typeof inner !== "object" || Array.isArray(inner)) {
-      throw new ConfigError([{ path: p, from: name, message: "E_SHAPE: missing data" }], "E_SHAPE");
-    }
-    return normalizeSecretMap(inner, name);
-  }
-  return {
-    name,
-    load() {
-      if (!inflight) {
-        inflight = doLoad().finally(() => {
-          inflight = null;
-        });
-      }
-      return inflight;
-    }
-  };
-}
-
-exports.hashicorpProvider = hashicorpProvider;
+'use strict';function R(e){try{let n=globalThis;if(n.TextEncoder)return new n.TextEncoder().encode(e).length;if(n.Buffer)return n.Buffer.byteLength(e,"utf8")}catch{}return e.length}var s=class extends Error{code="E_INVALID_CONFIG";issues;static[Symbol.hasInstance](n){return typeof n=="object"&&n!==null&&n.name==="ConfigError"&&typeof n.code=="string"&&Array.isArray(n.issues)}constructor(n=[],o="E_INVALID_CONFIG"){let c=n.map(t=>`- ${t.path} (from ${t.from}): ${t.message}`);super(n.length===0?"Invalid config: unknown error (no issues attached)":`Invalid config (${n.length} issue${n.length===1?"":"s"}):
+${c.join(`
+`)}`),this.name="ConfigError",this.code=o,this.issues=n;}};function A(e){return e.toLowerCase()==="__proto__"}function k(e){if(e)return e;let n=globalThis;if(n.fetch)return n.fetch.bind(globalThis);throw new s([{path:"<provider>",from:"vault",message:"E_NO_FETCH: global fetch unavailable"}],"E_NO_FETCH")}function j(e,n){try{return new URL(e).host===new URL(n).host}catch{return  false}}var M=/authorization|token|secret|api[-_]?key|cookie|auth/i;function F(e,n){try{return new URL(e).protocol==="https:"&&new URL(n).protocol!=="https:"}catch{return  false}}function L(e){let n=new Headers;return e.forEach((o,c)=>{M.test(c)||n.set(c,o);}),n}async function b(e,n,o,c=2){let t=e,a=new Headers(n.headers);for(let i=0;i<=c;i++){let r=await o(t,{...n,headers:a,redirect:"manual"}),u=r.status;if(![301,302,303,307,308].includes(u))return r;let m=r.headers.get("location");if(!m)return r;let f;try{f=new URL(m,t).toString();}catch{throw new s([{path:t,from:"vault",message:"E_REDIRECT: invalid Location header"}],"E_REDIRECT")}if(i===c)throw new s([{path:f,from:"vault",message:"E_REDIRECT: too many redirects"}],"E_REDIRECT");(!j(t,f)||F(t,f))&&(a=L(a)),t=f;}throw new s([{path:e,from:"vault",message:"E_REDIRECT"}],"E_REDIRECT")}function T(e,n,o){let t=i=>{if(i==null)return;let r=typeof i=="string"?i:String(i);return (r=r.replace(/\r?\n$/,"")),r},a={};if(!e||typeof e!="object"||Array.isArray(e))throw new s([{path:"<root>",from:n,message:"E_SHAPE: provider returned non-object"}],"E_SHAPE");for(let[i,r]of Object.entries(e)){if(A(i))throw new s([{path:i,from:n,message:"E_PROTO: forbidden key"}],"E_PROTO");if(r!==null&&typeof r=="object"&&!Array.isArray(r)){a[i]=r;continue}let u=t(r);u!==void 0&&(a[i]=u);}return a}function O(e){return e===403||e===401?"E_DENIED":e===404?"E_NOT_FOUND":e===429?"E_THROTTLED":e===408||e===504?"E_TIMEOUT":e>=500?"E_UPSTREAM":"E_PROVIDER"}function x(e,n){let o=AbortSignal;if(typeof o.timeout=="function")try{return o.timeout(e)}catch{return}}function E(e,n,o){if(!Number.isFinite(e)||e<=0)throw new s([{path:n,from:o,message:`E_USAGE: ${n} must be a positive finite number`}],"E_USAGE")}async function P(e,n,o,c){let t,a=new Promise((i,r)=>{t=setTimeout(()=>r(new s([{path:o,from:c,message:"E_TIMEOUT: request timed out"}],"E_TIMEOUT")),n);});e.catch(()=>{});try{return await Promise.race([e,a])}finally{t&&clearTimeout(t);}}async function I(e,n,o,c,t){let a,i=new Promise((r,u)=>{a=setTimeout(()=>u(new s([{path:n,from:o,message:"E_TIMEOUT: response body timed out"}],"E_TIMEOUT")),t);});try{let r=e.text();r.catch(()=>{});let u=await Promise.race([r,i]);if(R(u)>c)throw new s([{path:n,from:o,message:"E_TOO_LARGE"}],"E_TOO_LARGE");return u}finally{a&&clearTimeout(a);}}function N(e){return e!==void 0?e||void 0:globalThis.process?.env?.VAULT_TOKEN}function G(e){let n=(e.mount??"secret").replace(/^\/+|\/+$/g,""),o=e.timeoutMs??5e3,c=e.maxBytes??1024*1024;E(o,"timeoutMs","hashicorp"),E(c,"maxBytes","hashicorp");let t=`hashicorp://${n}/${e.path}`,a=null;async function i(){let r=N(e.auth?.token),u=k(e.fetchFn),m=e.url.replace(/\/+$/g,""),f=e.path.replace(/^\/+/,""),S=e.version!==void 0?`?version=${encodeURIComponent(String(e.version))}`:"",C=`${m}/v1/${n}/${f}${S}`,h=new Headers;r&&h.set("X-Vault-Token",r),h.has("Accept")||h.set("Accept","application/json");let d;try{d=await P(b(C,{headers:h,signal:x(o)},u),o,f,t);}catch(l){if(l instanceof s)throw l;let w=l,y=/timeout|abort/i.test(w?.name+w?.message);throw new s([{path:f,from:t,message:`${y?"E_TIMEOUT":"E_CONN"}: ${w?.message??String(l)}`}],y?"E_TIMEOUT":"E_CONN")}if(!d.ok){let l=O(d.status);throw new s([{path:f,from:t,message:`${l}: HTTP ${d.status}`}],l)}let $=await I(d,f,t,c,o),_;try{_=JSON.parse($);}catch{throw new s([{path:f,from:t,message:"E_PARSE: invalid JSON"}],"E_PARSE")}let g=_.data,p=!!g&&typeof g=="object"&&Object.hasOwn(g,"data")&&Object.hasOwn(g,"metadata")?g.data:g;if(!p||typeof p!="object"||Array.isArray(p))throw new s([{path:f,from:t,message:"E_SHAPE: missing data"}],"E_SHAPE");return T(p,t)}return {name:t,load(){return a||(a=i().finally(()=>{a=null;})),a}}}
+exports.hashicorpProvider=G;

package/dist/vault/hashicorp.d.cts

@@ -1,4 +1,4 @@
-import { a as SecretProvider } from '../types-CClP1lxq.cjs';
+import { a as SecretProvider } from '../types-CcsYDAdO.cjs';
 import { F as FetchFn } from '../shared-CucO_XsG.cjs';
 import '@standard-schema/spec';
 
@@ -6,6 +6,8 @@ import '@standard-schema/spec';
  * HashiCorp Vault provider (KVv1 + KVv2): reads one secret path into a flat map.
  * Token comes from `auth.token` or `VAULT_TOKEN`; KVv2 envelopes unwrap only
  * when a `metadata` sibling is present. Fail-closed on 403.
+ *
+ * @module
  */
 
 /** Options for {@link hashicorpProvider}. */

package/dist/vault/hashicorp.d.ts

@@ -1,4 +1,4 @@
-import { a as SecretProvider } from '../types-CClP1lxq.js';
+import { a as SecretProvider } from '../types-CcsYDAdO.js';
 import { F as FetchFn } from '../shared-CucO_XsG.js';
 import '@standard-schema/spec';
 
@@ -6,6 +6,8 @@ import '@standard-schema/spec';
  * HashiCorp Vault provider (KVv1 + KVv2): reads one secret path into a flat map.
  * Token comes from `auth.token` or `VAULT_TOKEN`; KVv2 envelopes unwrap only
  * when a `metadata` sibling is present. Fail-closed on 403.
+ *
+ * @module
  */
 
 /** Options for {@link hashicorpProvider}. */

package/dist/vault/hashicorp.js

@@ -1,77 +1,2 @@
-import { getFetch, fetchWithRedirectGuard, statusToCode, normalizeSecretMap } from '../chunk-RQC6OMVV.js';
-import { ConfigError, byteLengthUtf8 } from '../chunk-EE6LXNJV.js';
-
-// src/vault/hashicorp.ts
-function tokenFromEnv(explicit) {
-  if (explicit !== void 0) return explicit || void 0;
-  const g = globalThis;
-  return g.process?.env?.["VAULT_TOKEN"];
-}
-function hashicorpProvider(opts) {
-  const mount = (opts.mount ?? "secret").replace(/^\/+|\/+$/g, "");
-  const timeoutMs = opts.timeoutMs ?? 5e3;
-  const maxBytes = opts.maxBytes ?? 1024 * 1024;
-  const name = `hashicorp://${mount}/${opts.path}`;
-  let inflight = null;
-  async function doLoad() {
-    const token = tokenFromEnv(opts.auth?.token);
-    const fetchFn = getFetch(opts.fetchFn);
-    const base = opts.url.replace(/\/+$/g, "");
-    const p = opts.path.replace(/^\/+/, "");
-    const qs = opts.version !== void 0 ? `?version=${encodeURIComponent(String(opts.version))}` : "";
-    const url = `${base}/v1/${mount}/${p}${qs}`;
-    const headers = new Headers();
-    if (token) headers.set("X-Vault-Token", token);
-    headers.set("Accept", "application/json");
-    let res;
-    try {
-      res = await fetchWithRedirectGuard(
-        url,
-        { headers, signal: AbortSignal.timeout(timeoutMs) },
-        fetchFn
-      );
-    } catch (e) {
-      if (e instanceof ConfigError) throw e;
-      const err = e;
-      const isTimeout = /timeout|abort/i.test(err?.name + err?.message);
-      throw new ConfigError(
-        [{ path: p, from: name, message: `${isTimeout ? "E_TIMEOUT" : "E_CONN"}: ${err?.message ?? String(e)}` }],
-        isTimeout ? "E_TIMEOUT" : "E_CONN"
-      );
-    }
-    if (!res.ok) {
-      const code = statusToCode(res.status);
-      throw new ConfigError([{ path: p, from: name, message: `${code}: HTTP ${res.status}` }], code);
-    }
-    const text = await res.text();
-    if (byteLengthUtf8(text) > maxBytes) {
-      throw new ConfigError([{ path: p, from: name, message: "E_TOO_LARGE: secret >cap" }], "E_TOO_LARGE");
-    }
-    let json;
-    try {
-      json = JSON.parse(text);
-    } catch {
-      throw new ConfigError([{ path: p, from: name, message: "E_PARSE: invalid JSON" }], "E_PARSE");
-    }
-    const data = json.data;
-    const isKv2 = !!data && typeof data === "object" && "data" in data && "metadata" in data;
-    const inner = isKv2 ? data.data : data;
-    if (!inner || typeof inner !== "object" || Array.isArray(inner)) {
-      throw new ConfigError([{ path: p, from: name, message: "E_SHAPE: missing data" }], "E_SHAPE");
-    }
-    return normalizeSecretMap(inner, name);
-  }
-  return {
-    name,
-    load() {
-      if (!inflight) {
-        inflight = doLoad().finally(() => {
-          inflight = null;
-        });
-      }
-      return inflight;
-    }
-  };
-}
-
-export { hashicorpProvider };
+import {f,a,h,b,e,d as d$1,i,c}from'../chunk-5D2AQWDG.js';import {d}from'../chunk-NQDE3WLR.js';function R(e){return e!==void 0?e||void 0:globalThis.process?.env?.VAULT_TOKEN}function x(e$1){let d$2=(e$1.mount??"secret").replace(/^\/+|\/+$/g,""),i$1=e$1.timeoutMs??5e3,p=e$1.maxBytes??1024*1024;f(i$1,"timeoutMs","hashicorp"),f(p,"maxBytes","hashicorp");let t=`hashicorp://${d$2}/${e$1.path}`,c$1=null;async function P(){let g=R(e$1.auth?.token),S=a(e$1.fetchFn),k=e$1.url.replace(/\/+$/g,""),n=e$1.path.replace(/^\/+/,""),b$1=e$1.version!==void 0?`?version=${encodeURIComponent(String(e$1.version))}`:"",A=`${k}/v1/${d$2}/${n}${b$1}`,u=new Headers;g&&u.set("X-Vault-Token",g),u.has("Accept")||u.set("Accept","application/json");let a$1;try{a$1=await h(b(A,{headers:u,signal:e(i$1)},S),i$1,n,t);}catch(r){if(r instanceof d)throw r;let h=r,w=/timeout|abort/i.test(h?.name+h?.message);throw new d([{path:n,from:t,message:`${w?"E_TIMEOUT":"E_CONN"}: ${h?.message??String(r)}`}],w?"E_TIMEOUT":"E_CONN")}if(!a$1.ok){let r=d$1(a$1.status);throw new d([{path:n,from:t,message:`${r}: HTTP ${a$1.status}`}],r)}let _=await i(a$1,n,t,p,i$1),l;try{l=JSON.parse(_);}catch{throw new d([{path:n,from:t,message:"E_PARSE: invalid JSON"}],"E_PARSE")}let s=l.data,m=!!s&&typeof s=="object"&&Object.hasOwn(s,"data")&&Object.hasOwn(s,"metadata")?s.data:s;if(!m||typeof m!="object"||Array.isArray(m))throw new d([{path:n,from:t,message:"E_SHAPE: missing data"}],"E_SHAPE");return c(m,t)}return {name:t,load(){return c$1||(c$1=P().finally(()=>{c$1=null;})),c$1}}}
+export{x as hashicorpProvider};

package/dist/vault/http.cjs

@@ -1,185 +1,4 @@
-'use strict';
-
-// src/errors.ts
-function byteLengthUtf8(text) {
-  try {
-    const g = globalThis;
-    if (g.TextEncoder) return new g.TextEncoder().encode(text).length;
-    if (g.Buffer) return g.Buffer.byteLength(text, "utf8");
-  } catch {
-  }
-  return text.length;
-}
-var ConfigError = class extends Error {
-  code = "E_INVALID_CONFIG";
-  issues;
-  constructor(issues, code = "E_INVALID_CONFIG") {
-    const lines = issues.map(
-      (i) => `- ${i.path} (from ${i.from}): ${i.message}`
-    );
-    super(`Invalid config (${issues.length} issue${issues.length === 1 ? "" : "s"}):
-${lines.join("\n")}`);
-    this.name = "ConfigError";
-    this.code = code;
-    this.issues = issues;
-  }
-};
-
-// src/vault/shared.ts
-function getFetch(fetchFn) {
-  if (fetchFn) return fetchFn;
-  const g = globalThis;
-  if (g.fetch) return g.fetch.bind(globalThis);
-  throw new ConfigError(
-    [{ path: "<provider>", from: "vault", message: "E_NO_FETCH: global fetch unavailable" }],
-    "E_NO_FETCH"
-  );
-}
-function sameHost(a, b) {
-  return new URL(a).host === new URL(b).host;
-}
-var SENSITIVE_HEADER_RE = /authorization|token|secret|api[-_]?key|cookie|auth/i;
-function stripSensitiveForCrossHost(headers) {
-  const next = new Headers();
-  headers.forEach((value, key) => {
-    if (!SENSITIVE_HEADER_RE.test(key)) next.set(key, value);
-  });
-  return next;
-}
-async function fetchWithRedirectGuard(url, init, fetchFn, maxRedirects = 2) {
-  let current = url;
-  let headers = new Headers(init.headers);
-  for (let i = 0; i <= maxRedirects; i++) {
-    const res = await fetchFn(current, { ...init, headers, redirect: "manual" });
-    const status = res.status;
-    if (![301, 302, 303, 307, 308].includes(status)) return res;
-    const loc = res.headers.get("location");
-    if (!loc) return res;
-    let next;
-    try {
-      next = new URL(loc, current).toString();
-    } catch {
-      throw new ConfigError(
-        [{ path: current, from: "vault", message: "E_REDIRECT: invalid Location header" }],
-        "E_REDIRECT"
-      );
-    }
-    if (i === maxRedirects) {
-      throw new ConfigError(
-        [{ path: next, from: "vault", message: "E_REDIRECT: too many redirects" }],
-        "E_REDIRECT"
-      );
-    }
-    if (!sameHost(current, next)) headers = stripSensitiveForCrossHost(headers);
-    current = next;
-  }
-  throw new ConfigError([{ path: url, from: "vault", message: "E_REDIRECT" }], "E_REDIRECT");
-}
-function normalizeSecretMap(raw, providerName, opts) {
-  const clean = (v) => {
-    if (v === null || v === void 0) return void 0;
-    let s = typeof v === "string" ? v : String(v);
-    s = s.replace(/\r?\n$/, "");
-    return s;
-  };
-  const out = {};
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    throw new ConfigError(
-      [{ path: "<root>", from: providerName, message: "E_SHAPE: provider returned non-object" }],
-      "E_SHAPE"
-    );
-  }
-  for (const [k, v] of Object.entries(raw)) {
-    if (v !== null && typeof v === "object" && !Array.isArray(v)) {
-      out[k] = v;
-      continue;
-    }
-    const c = clean(v);
-    if (c !== void 0) out[k] = c;
-  }
-  return out;
-}
-function statusToCode(status) {
-  if (status === 403 || status === 401) return "E_DENIED";
-  if (status === 404) return "E_NOT_FOUND";
-  if (status === 429) return "E_THROTTLED";
-  if (status >= 500) return "E_UPSTREAM";
-  return "E_PROVIDER";
-}
-
-// src/vault/http.ts
-function getAtPath(obj, path) {
-  if (!path) return obj;
-  let cur = obj;
-  for (const seg of path.split(".")) {
-    if (cur && typeof cur === "object" && seg in cur) cur = cur[seg];
-    else return void 0;
-  }
-  return cur;
-}
-function httpProvider(opts) {
-  const timeoutMs = opts.timeoutMs ?? 5e3;
-  const maxBytes = opts.maxBytes ?? 1024 * 1024;
-  const jsonPath = opts.jsonPath ?? "data";
-  const name = `http://${opts.url}`;
-  let inflight = null;
-  async function doLoad() {
-    const fetchFn = getFetch(opts.fetchFn);
-    const headers = new Headers();
-    for (const [k, v] of Object.entries(opts.headers ?? {})) {
-      if (v !== void 0) headers.set(k, v);
-    }
-    headers.set("Accept", "application/json");
-    let res;
-    try {
-      res = await fetchWithRedirectGuard(
-        opts.url,
-        { headers, signal: AbortSignal.timeout(timeoutMs) },
-        fetchFn
-      );
-    } catch (e) {
-      if (e instanceof ConfigError) throw e;
-      const err = e;
-      const isTimeout = /timeout|abort/i.test(err?.name + err?.message);
-      throw new ConfigError(
-        [{ path: opts.url, from: name, message: `${isTimeout ? "E_TIMEOUT" : "E_CONN"}: ${err?.message ?? String(e)}` }],
-        isTimeout ? "E_TIMEOUT" : "E_CONN"
-      );
-    }
-    if (!res.ok) {
-      const code = statusToCode(res.status);
-      throw new ConfigError([{ path: opts.url, from: name, message: `${code}: HTTP ${res.status}` }], code);
-    }
-    const text = await res.text();
-    if (byteLengthUtf8(text) > maxBytes) {
-      throw new ConfigError([{ path: opts.url, from: name, message: "E_TOO_LARGE" }], "E_TOO_LARGE");
-    }
-    let json;
-    try {
-      json = JSON.parse(text);
-    } catch {
-      throw new ConfigError([{ path: opts.url, from: name, message: "E_PARSE: invalid JSON" }], "E_PARSE");
-    }
-    let inner = getAtPath(json, jsonPath);
-    if (inner && typeof inner === "object" && !Array.isArray(inner) && "data" in inner && "metadata" in inner) {
-      inner = inner.data;
-    }
-    if (!inner || typeof inner !== "object" || Array.isArray(inner)) {
-      throw new ConfigError([{ path: jsonPath, from: name, message: "E_SHAPE: missing data" }], "E_SHAPE");
-    }
-    return normalizeSecretMap(inner, name);
-  }
-  return {
-    name,
-    load() {
-      if (!inflight) {
-        inflight = doLoad().finally(() => {
-          inflight = null;
-        });
-      }
-      return inflight;
-    }
-  };
-}
-
-exports.httpProvider = httpProvider;
+'use strict';function E(t){try{let e=globalThis;if(e.TextEncoder)return new e.TextEncoder().encode(t).length;if(e.Buffer)return e.Buffer.byteLength(t,"utf8")}catch{}return t.length}var a=class extends Error{code="E_INVALID_CONFIG";issues;static[Symbol.hasInstance](e){return typeof e=="object"&&e!==null&&e.name==="ConfigError"&&typeof e.code=="string"&&Array.isArray(e.issues)}constructor(e=[],n="E_INVALID_CONFIG"){let c=e.map(r=>`- ${r.path} (from ${r.from}): ${r.message}`);super(e.length===0?"Invalid config: unknown error (no issues attached)":`Invalid config (${e.length} issue${e.length===1?"":"s"}):
+${c.join(`
+`)}`),this.name="ConfigError",this.code=n,this.issues=e;}};function y(t){return t.toLowerCase()==="__proto__"}function _(t){if(t)return t;let e=globalThis;if(e.fetch)return e.fetch.bind(globalThis);throw new a([{path:"<provider>",from:"vault",message:"E_NO_FETCH: global fetch unavailable"}],"E_NO_FETCH")}function I(t,e){try{return new URL(t).host===new URL(e).host}catch{return  false}}var S=/authorization|token|secret|api[-_]?key|cookie|auth/i;function C(t,e){try{return new URL(t).protocol==="https:"&&new URL(e).protocol!=="https:"}catch{return  false}}function j(t){let e=new Headers;return t.forEach((n,c)=>{S.test(c)||e.set(c,n);}),e}async function R(t,e,n,c=2){let r=t,o=new Headers(e.headers);for(let s=0;s<=c;s++){let i=await n(r,{...e,headers:o,redirect:"manual"}),f=i.status;if(![301,302,303,307,308].includes(f))return i;let d=i.headers.get("location");if(!d)return i;let u;try{u=new URL(d,r).toString();}catch{throw new a([{path:r,from:"vault",message:"E_REDIRECT: invalid Location header"}],"E_REDIRECT")}if(s===c)throw new a([{path:u,from:"vault",message:"E_REDIRECT: too many redirects"}],"E_REDIRECT");(!I(r,u)||C(r,u))&&(o=j(o)),r=u;}throw new a([{path:t,from:"vault",message:"E_REDIRECT"}],"E_REDIRECT")}function A(t,e,n){let r=s=>{if(s==null)return;let i=typeof s=="string"?s:String(s);return (i=i.replace(/\r?\n$/,"")),i},o={};if(!t||typeof t!="object"||Array.isArray(t))throw new a([{path:"<root>",from:e,message:"E_SHAPE: provider returned non-object"}],"E_SHAPE");for(let[s,i]of Object.entries(t)){if(y(s))throw new a([{path:s,from:e,message:"E_PROTO: forbidden key"}],"E_PROTO");if(i!==null&&typeof i=="object"&&!Array.isArray(i)){o[s]=i;continue}let f=r(i);f!==void 0&&(o[s]=f);}return o}function k(t){return t===403||t===401?"E_DENIED":t===404?"E_NOT_FOUND":t===429?"E_THROTTLED":t===408||t===504?"E_TIMEOUT":t>=500?"E_UPSTREAM":"E_PROVIDER"}function b(t,e){let n=AbortSignal;if(typeof n.timeout=="function")try{return n.timeout(t)}catch{return}}function h(t,e,n){if(!Number.isFinite(t)||t<=0)throw new a([{path:e,from:n,message:`E_USAGE: ${e} must be a positive finite number`}],"E_USAGE")}function O(t){try{let e=new URL(t);e.username="",e.password="";for(let n of [...e.searchParams.keys()])/token|secret|auth|password|credential|api[-_]?key|pwd|passphrase/i.test(n)&&e.searchParams.delete(n);return e.hash="",e.toString()}catch{return t}}async function T(t,e,n,c){let r,o=new Promise((s,i)=>{r=setTimeout(()=>i(new a([{path:n,from:c,message:"E_TIMEOUT: request timed out"}],"E_TIMEOUT")),e);});t.catch(()=>{});try{return await Promise.race([t,o])}finally{r&&clearTimeout(r);}}async function P(t,e,n,c,r){let o,s=new Promise((i,f)=>{o=setTimeout(()=>f(new a([{path:e,from:n,message:"E_TIMEOUT: response body timed out"}],"E_TIMEOUT")),r);});try{let i=t.text();i.catch(()=>{});let f=await Promise.race([i,s]);if(E(f)>c)throw new a([{path:e,from:n,message:"E_TOO_LARGE"}],"E_TOO_LARGE");return f}finally{o&&clearTimeout(o);}}function $(t,e){if(!e)return t;let n=t;for(let c of e.split("."))if(n&&typeof n=="object"&&Object.hasOwn(n,c))n=n[c];else return;return n}function v(t){let e=t.timeoutMs??5e3,n=t.maxBytes??1024*1024;h(e,"timeoutMs","http"),h(n,"maxBytes","http");let c=t.jsonPath??"data",r=O(t.url),o=`http://${r}`,s=null;async function i(){let f=_(t.fetchFn),d=new Headers;for(let[g,m]of Object.entries(t.headers??{}))m!==void 0&&d.set(g,m);d.has("Accept")||d.set("Accept","application/json");let u;try{u=await T(R(t.url,{headers:d,signal:b(e)},f),e,r,o);}catch(g){if(g instanceof a)throw g;let m=g,w=/timeout|abort/i.test(m?.name+m?.message);throw new a([{path:r,from:o,message:`${w?"E_TIMEOUT":"E_CONN"}: ${m?.message??String(g)}`}],w?"E_TIMEOUT":"E_CONN")}if(!u.ok){let g=k(u.status);throw new a([{path:r,from:o,message:`${g}: HTTP ${u.status}`}],g)}let x=await P(u,r,o,n,e),p;try{p=JSON.parse(x);}catch{throw new a([{path:r,from:o,message:"E_PARSE: invalid JSON"}],"E_PARSE")}let l=$(p,c);if(l&&typeof l=="object"&&!Array.isArray(l)&&Object.hasOwn(l,"data")&&Object.hasOwn(l,"metadata")&&(l=l.data),!l||typeof l!="object"||Array.isArray(l))throw new a([{path:c,from:o,message:"E_SHAPE: missing data"}],"E_SHAPE");return A(l,o)}return {name:o,load(){return s||(s=i().finally(()=>{s=null;})),s}}}
+exports.httpProvider=v;

package/dist/vault/http.d.cts

@@ -1,10 +1,12 @@
-import { F as Flat, a as SecretProvider } from '../types-CClP1lxq.cjs';
+import { F as Flat, a as SecretProvider } from '../types-CcsYDAdO.cjs';
 import { F as FetchFn } from '../shared-CucO_XsG.cjs';
 import '@standard-schema/spec';
 
 /**
  * Generic HTTP secret provider: GETs a JSON endpoint and reads a dot-path
  * (`jsonPath`, default `'data'`) into a flat map. Auth rides in `headers`.
+ *
+ * @module
  */
 
 /** Options for {@link httpProvider}. */

package/dist/vault/http.d.ts

@@ -1,10 +1,12 @@
-import { F as Flat, a as SecretProvider } from '../types-CClP1lxq.js';
+import { F as Flat, a as SecretProvider } from '../types-CcsYDAdO.js';
 import { F as FetchFn } from '../shared-CucO_XsG.js';
 import '@standard-schema/spec';
 
 /**
  * Generic HTTP secret provider: GETs a JSON endpoint and reads a dot-path
  * (`jsonPath`, default `'data'`) into a flat map. Auth rides in `headers`.
+ *
+ * @module
  */
 
 /** Options for {@link httpProvider}. */

package/dist/vault/http.js

@@ -1,79 +1,2 @@
-import { getFetch, fetchWithRedirectGuard, statusToCode, normalizeSecretMap } from '../chunk-RQC6OMVV.js';
-import { ConfigError, byteLengthUtf8 } from '../chunk-EE6LXNJV.js';
-
-// src/vault/http.ts
-function getAtPath(obj, path) {
-  if (!path) return obj;
-  let cur = obj;
-  for (const seg of path.split(".")) {
-    if (cur && typeof cur === "object" && seg in cur) cur = cur[seg];
-    else return void 0;
-  }
-  return cur;
-}
-function httpProvider(opts) {
-  const timeoutMs = opts.timeoutMs ?? 5e3;
-  const maxBytes = opts.maxBytes ?? 1024 * 1024;
-  const jsonPath = opts.jsonPath ?? "data";
-  const name = `http://${opts.url}`;
-  let inflight = null;
-  async function doLoad() {
-    const fetchFn = getFetch(opts.fetchFn);
-    const headers = new Headers();
-    for (const [k, v] of Object.entries(opts.headers ?? {})) {
-      if (v !== void 0) headers.set(k, v);
-    }
-    headers.set("Accept", "application/json");
-    let res;
-    try {
-      res = await fetchWithRedirectGuard(
-        opts.url,
-        { headers, signal: AbortSignal.timeout(timeoutMs) },
-        fetchFn
-      );
-    } catch (e) {
-      if (e instanceof ConfigError) throw e;
-      const err = e;
-      const isTimeout = /timeout|abort/i.test(err?.name + err?.message);
-      throw new ConfigError(
-        [{ path: opts.url, from: name, message: `${isTimeout ? "E_TIMEOUT" : "E_CONN"}: ${err?.message ?? String(e)}` }],
-        isTimeout ? "E_TIMEOUT" : "E_CONN"
-      );
-    }
-    if (!res.ok) {
-      const code = statusToCode(res.status);
-      throw new ConfigError([{ path: opts.url, from: name, message: `${code}: HTTP ${res.status}` }], code);
-    }
-    const text = await res.text();
-    if (byteLengthUtf8(text) > maxBytes) {
-      throw new ConfigError([{ path: opts.url, from: name, message: "E_TOO_LARGE" }], "E_TOO_LARGE");
-    }
-    let json;
-    try {
-      json = JSON.parse(text);
-    } catch {
-      throw new ConfigError([{ path: opts.url, from: name, message: "E_PARSE: invalid JSON" }], "E_PARSE");
-    }
-    let inner = getAtPath(json, jsonPath);
-    if (inner && typeof inner === "object" && !Array.isArray(inner) && "data" in inner && "metadata" in inner) {
-      inner = inner.data;
-    }
-    if (!inner || typeof inner !== "object" || Array.isArray(inner)) {
-      throw new ConfigError([{ path: jsonPath, from: name, message: "E_SHAPE: missing data" }], "E_SHAPE");
-    }
-    return normalizeSecretMap(inner, name);
-  }
-  return {
-    name,
-    load() {
-      if (!inflight) {
-        inflight = doLoad().finally(() => {
-          inflight = null;
-        });
-      }
-      return inflight;
-    }
-  };
-}
-
-export { httpProvider };
+import {f,g,a,h,b,e,d as d$1,i,c}from'../chunk-5D2AQWDG.js';import {d}from'../chunk-NQDE3WLR.js';function k(e,s){if(!s)return e;let n=e;for(let u of s.split("."))if(n&&typeof n=="object"&&Object.hasOwn(n,u))n=n[u];else return;return n}function _(e$1){let s=e$1.timeoutMs??5e3,n=e$1.maxBytes??1024*1024;f(s,"timeoutMs","http"),f(n,"maxBytes","http");let u=e$1.jsonPath??"data",a$1=g(e$1.url),o=`http://${a$1}`,m=null;async function b$1(){let A=a(e$1.fetchFn),h$1=new Headers;for(let[r,i]of Object.entries(e$1.headers??{}))i!==void 0&&h$1.set(r,i);h$1.has("Accept")||h$1.set("Accept","application/json");let f;try{f=await h(b(e$1.url,{headers:h$1,signal:e(s)},A),s,a$1,o);}catch(r){if(r instanceof d)throw r;let i=r,p=/timeout|abort/i.test(i?.name+i?.message);throw new d([{path:a$1,from:o,message:`${p?"E_TIMEOUT":"E_CONN"}: ${i?.message??String(r)}`}],p?"E_TIMEOUT":"E_CONN")}if(!f.ok){let r=d$1(f.status);throw new d([{path:a$1,from:o,message:`${r}: HTTP ${f.status}`}],r)}let S=await i(f,a$1,o,n,s),d$2;try{d$2=JSON.parse(S);}catch{throw new d([{path:a$1,from:o,message:"E_PARSE: invalid JSON"}],"E_PARSE")}let t=k(d$2,u);if(t&&typeof t=="object"&&!Array.isArray(t)&&Object.hasOwn(t,"data")&&Object.hasOwn(t,"metadata")&&(t=t.data),!t||typeof t!="object"||Array.isArray(t))throw new d([{path:u,from:o,message:"E_SHAPE: missing data"}],"E_SHAPE");return c(t,o)}return {name:o,load(){return m||(m=b$1().finally(()=>{m=null;})),m}}}
+export{_ as httpProvider};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "typed-settings",
-  "version": "0.1.1",
+  "version": "0.2.1",
   "description": "One-call typed config for TS: env + .env + yaml/toml/json + secrets-dir + vault -> frozen object. Standard Schema + legacy bridges.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -74,6 +74,7 @@
   },
   "scripts": {
     "build": "tsup",
+    "prepack": "npm run build",
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
@@ -89,6 +90,14 @@
     "standard-schema"
   ],
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/prosubodh/typed-settings"
+  },
+  "homepage": "https://github.com/prosubodh/typed-settings#readme",
+  "bugs": {
+    "url": "https://github.com/prosubodh/typed-settings/issues"
+  },
   "engines": {
     "node": ">=20"
   },
@@ -118,12 +127,10 @@
     "@types/node": "^26.6.4",
     "@vitest/coverage-v8": "^3.2.7",
     "arktype": "^2.1.0",
-    "smol-toml": "^1.3.1",
     "tsup": "^8.3.5",
     "typescript": "^5.6.3",
     "valibot": "^1.0.0",
     "vitest": "^3.0.0",
-    "yaml": "^2.6.1",
     "zod": "^3.24.0 || ^4.0.0"
   }
 }