typed-settings 0.1.4 → 0.2.1

package/dist/node.d.cts

@@ -1,21 +1,35 @@
-import { F as Flat, S as SettingsOptions } from './types-B_Dc2L4T.cjs';
+import { F as Flat, S as SettingsOptions } from './types-CcsYDAdO.cjs';
 import { StandardSchemaV1 } from '@standard-schema/spec';
-import { C as ConfigError } from './errors-itGaU4Q8.cjs';
+import { C as ConfigError } from './errors-JkkOM0u-.cjs';
 
 /**
  * Reads dotenv files and joins them with newlines for `{ text }` sources.
- * Missing files are skipped; anything else (e.g. `EACCES`) rethrows.
+ * Missing files are skipped; anything else (e.g. `EACCES`) rethrows. Total
+ * size is capped (default 2 MiB, same as `loadSecretsDir`) so a hostile or
+ * symlinked `.env` cannot balloon memory — exceed it and `E_FILE_TOO_LARGE`.
  */
-declare function loadEnvFiles(paths: string[]): {
+declare function loadEnvFiles(paths: string[], opts?: {
+    maxBytes?: number;
+}): {
     text: string;
 };
+/** Options for {@link loadSecretsDir}. */
+interface LoadSecretsDirOptions {
+    /** Keep empty files as `''` instead of skipping them. Default false (skip). */
+    preserveEmpty?: boolean;
+    /** Per-file read cap in UTF-8 bytes. Default 2 MiB (matches core `maxBytes`). */
+    maxBytes?: number;
+}
 /**
  * Reads a secrets dir (Docker/K8s `/run/secrets`) into a flat map keyed by
- * uppercased filenames. Skips subdirectories, `..*` entries, and empties; strips
- * one trailing newline but otherwise preserves whitespace verbatim. Missing dir
- * reads as `{}`; unreadable files throw (`EACCES` fails closed).
+ * uppercased filenames. Skips subdirectories, `..*` entries, and (by default)
+ * empties; strips one trailing newline but otherwise preserves whitespace
+ * verbatim. Missing dir reads as `{}`; unreadable files throw (`EACCES` fails
+ * closed). Symlinks are confined to the dir (K8s `..data` links resolve inside);
+ * links escaping it throw. Case collisions (`Token` vs `TOKEN`) throw instead
+ * of depending on readdir order.
  */
-declare function loadSecretsDir(dir: string): Flat;
+declare function loadSecretsDir(dir: string, opts?: LoadSecretsDirOptions): Flat;
 /**
  * Parses one dotenv file into a flat map. Missing file reads as `{}`;
  * anything else (including `EACCES` and syntax errors) rethrows.
@@ -51,4 +65,4 @@ interface WatchHandle<T = unknown> {
  */
 declare function watchSettings<S extends StandardSchemaV1>(opts: SettingsOptions<S>, cb?: WatchCallbacks): WatchHandle<StandardSchemaV1.InferOutput<S>>;
 
-export { type WatchCallbacks, type WatchHandle, loadEnvFiles, loadSecretsDir, parseEnvFile, watchSettings };
+export { type LoadSecretsDirOptions, type WatchCallbacks, type WatchHandle, loadEnvFiles, loadSecretsDir, parseEnvFile, watchSettings };

package/dist/node.d.ts

@@ -1,21 +1,35 @@
-import { F as Flat, S as SettingsOptions } from './types-B_Dc2L4T.js';
+import { F as Flat, S as SettingsOptions } from './types-CcsYDAdO.js';
 import { StandardSchemaV1 } from '@standard-schema/spec';
-import { C as ConfigError } from './errors-itGaU4Q8.js';
+import { C as ConfigError } from './errors-JkkOM0u-.js';
 
 /**
  * Reads dotenv files and joins them with newlines for `{ text }` sources.
- * Missing files are skipped; anything else (e.g. `EACCES`) rethrows.
+ * Missing files are skipped; anything else (e.g. `EACCES`) rethrows. Total
+ * size is capped (default 2 MiB, same as `loadSecretsDir`) so a hostile or
+ * symlinked `.env` cannot balloon memory — exceed it and `E_FILE_TOO_LARGE`.
  */
-declare function loadEnvFiles(paths: string[]): {
+declare function loadEnvFiles(paths: string[], opts?: {
+    maxBytes?: number;
+}): {
     text: string;
 };
+/** Options for {@link loadSecretsDir}. */
+interface LoadSecretsDirOptions {
+    /** Keep empty files as `''` instead of skipping them. Default false (skip). */
+    preserveEmpty?: boolean;
+    /** Per-file read cap in UTF-8 bytes. Default 2 MiB (matches core `maxBytes`). */
+    maxBytes?: number;
+}
 /**
  * Reads a secrets dir (Docker/K8s `/run/secrets`) into a flat map keyed by
- * uppercased filenames. Skips subdirectories, `..*` entries, and empties; strips
- * one trailing newline but otherwise preserves whitespace verbatim. Missing dir
- * reads as `{}`; unreadable files throw (`EACCES` fails closed).
+ * uppercased filenames. Skips subdirectories, `..*` entries, and (by default)
+ * empties; strips one trailing newline but otherwise preserves whitespace
+ * verbatim. Missing dir reads as `{}`; unreadable files throw (`EACCES` fails
+ * closed). Symlinks are confined to the dir (K8s `..data` links resolve inside);
+ * links escaping it throw. Case collisions (`Token` vs `TOKEN`) throw instead
+ * of depending on readdir order.
  */
-declare function loadSecretsDir(dir: string): Flat;
+declare function loadSecretsDir(dir: string, opts?: LoadSecretsDirOptions): Flat;
 /**
  * Parses one dotenv file into a flat map. Missing file reads as `{}`;
  * anything else (including `EACCES` and syntax errors) rethrows.
@@ -51,4 +65,4 @@ interface WatchHandle<T = unknown> {
  */
 declare function watchSettings<S extends StandardSchemaV1>(opts: SettingsOptions<S>, cb?: WatchCallbacks): WatchHandle<StandardSchemaV1.InferOutput<S>>;
 
-export { type WatchCallbacks, type WatchHandle, loadEnvFiles, loadSecretsDir, parseEnvFile, watchSettings };
+export { type LoadSecretsDirOptions, type WatchCallbacks, type WatchHandle, loadEnvFiles, loadSecretsDir, parseEnvFile, watchSettings };

package/dist/node.js

@@ -1,7 +1 @@
-export { loadEnvFiles, loadSecretsDir, parseEnvFile, watchSettings } from './chunk-DEP5SD4J.js';
-import './chunk-YVJEZPPZ.js';
-import './chunk-33M5GIKQ.js';
-import './chunk-OVFMKC2O.js';
-import './chunk-UFUHHR2J.js';
-import './chunk-EE6LXNJV.js';
-import './chunk-F6DX3HXZ.js';
+export{a as loadEnvFiles,b as loadSecretsDir,c as parseEnvFile,d as watchSettings}from'./chunk-C6CG2D4B.js';import'./chunk-4EAMKDNK.js';import'./chunk-NQDE3WLR.js';

package/dist/{types-B_Dc2L4T.d.cts → types-CcsYDAdO.d.cts}

@@ -40,7 +40,11 @@ interface SettingsOptions<S extends StandardSchemaV1 = StandardSchemaV1> {
     sources?: SourceInput[];
     /** Global prefix strip (case-insensitive, once). */
     prefix?: string;
-    /** Fixed to `'__'`; only double underscores split keys. */
+    /**
+     * Fixed to `'__'`; only double underscores split keys. Not configurable —
+     * the field exists so the constraint is visible (and greppable) at the type
+     * level rather than hidden in the key-expansion code.
+     */
     separator?: '__';
     /** Best-effort leaf coercion before validation. Default true. */
     coerce?: boolean;
@@ -64,6 +68,24 @@ interface SettingsOptions<S extends StandardSchemaV1 = StandardSchemaV1> {
     allowUnresolved?: boolean;
     /** Injectable env snapshot (tests, Edge). Defaults to process.env when available. */
     env?: Flat;
+    /**
+     * Extra secret matchers beyond the default (`key|secret|token|password|private`,
+     * case-insensitive substring). Strings match case-insensitively as substrings,
+     * RegExps test as given. Secret-looking error paths get value redaction.
+     */
+    secretKeys?: (string | RegExp)[];
+    /**
+     * Injectable filesystem for file sources (tests, bundlers, Edge shims).
+     * Takes precedence over the `typed-settings/node` global hook and the
+     * `require('node:fs')` fallback. `statSync` enables a pre-read size check
+     * against `maxBytes` so oversized files never fully materialize.
+     */
+    fs?: {
+        readFileSync(path: string, encoding: string): string;
+        statSync?(path: string): {
+            size: number;
+        };
+    };
 }
 
 export type { ArrayStrategy as A, Flat as F, SettingsOptions as S, UnknownKeys as U, SecretProvider as a, SourceInput as b };

package/dist/{types-B_Dc2L4T.d.ts → types-CcsYDAdO.d.ts}

@@ -40,7 +40,11 @@ interface SettingsOptions<S extends StandardSchemaV1 = StandardSchemaV1> {
     sources?: SourceInput[];
     /** Global prefix strip (case-insensitive, once). */
     prefix?: string;
-    /** Fixed to `'__'`; only double underscores split keys. */
+    /**
+     * Fixed to `'__'`; only double underscores split keys. Not configurable —
+     * the field exists so the constraint is visible (and greppable) at the type
+     * level rather than hidden in the key-expansion code.
+     */
     separator?: '__';
     /** Best-effort leaf coercion before validation. Default true. */
     coerce?: boolean;
@@ -64,6 +68,24 @@ interface SettingsOptions<S extends StandardSchemaV1 = StandardSchemaV1> {
     allowUnresolved?: boolean;
     /** Injectable env snapshot (tests, Edge). Defaults to process.env when available. */
     env?: Flat;
+    /**
+     * Extra secret matchers beyond the default (`key|secret|token|password|private`,
+     * case-insensitive substring). Strings match case-insensitively as substrings,
+     * RegExps test as given. Secret-looking error paths get value redaction.
+     */
+    secretKeys?: (string | RegExp)[];
+    /**
+     * Injectable filesystem for file sources (tests, bundlers, Edge shims).
+     * Takes precedence over the `typed-settings/node` global hook and the
+     * `require('node:fs')` fallback. `statSync` enables a pre-read size check
+     * against `maxBytes` so oversized files never fully materialize.
+     */
+    fs?: {
+        readFileSync(path: string, encoding: string): string;
+        statSync?(path: string): {
+            size: number;
+        };
+    };
 }
 
 export type { ArrayStrategy as A, Flat as F, SettingsOptions as S, UnknownKeys as U, SecretProvider as a, SourceInput as b };

package/dist/vault/aws.cjs

@@ -1,217 +1,4 @@
-'use strict';
-
-// src/errors.ts
-function byteLengthUtf8(text) {
-  try {
-    const g = globalThis;
-    if (g.TextEncoder) return new g.TextEncoder().encode(text).length;
-    if (g.Buffer) return g.Buffer.byteLength(text, "utf8");
-  } catch {
-  }
-  return text.length;
-}
-var ConfigError = class extends Error {
-  code = "E_INVALID_CONFIG";
-  issues;
-  constructor(issues, code = "E_INVALID_CONFIG") {
-    const lines = issues.map(
-      (i) => `- ${i.path} (from ${i.from}): ${i.message}`
-    );
-    super(`Invalid config (${issues.length} issue${issues.length === 1 ? "" : "s"}):
-${lines.join("\n")}`);
-    this.name = "ConfigError";
-    this.code = code;
-    this.issues = issues;
-  }
-};
-
-// src/vault/shared.ts
-function normalizeSecretMap(raw, providerName, opts) {
-  const clean = (v) => {
-    if (v === null || v === void 0) return void 0;
-    let s = typeof v === "string" ? v : String(v);
-    s = s.replace(/\r?\n$/, "");
-    return s;
-  };
-  const out = {};
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    throw new ConfigError(
-      [{ path: "<root>", from: providerName, message: "E_SHAPE: provider returned non-object" }],
-      "E_SHAPE"
-    );
-  }
-  for (const [k, v] of Object.entries(raw)) {
-    if (v !== null && typeof v === "object" && !Array.isArray(v)) {
-      out[k] = v;
-      continue;
-    }
-    const c = clean(v);
-    if (c !== void 0) out[k] = c;
-  }
-  return out;
-}
-
-// src/vault/aws.ts
-async function withTimeout(p, ms, name) {
-  let timer;
-  const timeout = new Promise((_, rej) => {
-    timer = setTimeout(
-      () => rej(new ConfigError([{ path: name, from: name, message: "E_TIMEOUT" }], "E_TIMEOUT")),
-      ms
-    );
-  });
-  try {
-    return await Promise.race([p, timeout]);
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function deferred(fn) {
-  return Promise.resolve().then(fn);
-}
-function wrapClientError(e, path, from) {
-  if (e instanceof ConfigError) throw e;
-  const err = e;
-  throw new ConfigError(
-    [{ path, from, message: `E_UPSTREAM: ${err?.message ?? String(e)}` }],
-    "E_UPSTREAM"
-  );
-}
-var BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
-function decodeBinary(b, path, from) {
-  if (typeof b === "string") {
-    const compact = b.replace(/\s/g, "");
-    if (!BASE64_RE.test(compact) || compact.length % 4 !== 0) {
-      throw new ConfigError([{ path, from, message: "E_SHAPE: SecretBinary is not valid base64" }], "E_SHAPE");
-    }
-    return Buffer.from(compact, "base64").toString("utf8");
-  }
-  return Buffer.from(b).toString("utf8");
-}
-function awsProvider(opts) {
-  const name = `aws://${(opts.secrets ?? []).join(",")}${(opts.params ?? []).join(",") || "ssm"}`;
-  const timeoutMs = opts.timeoutMs ?? 5e3;
-  const maxSecret = opts.maxBytesSecret ?? 64 * 1024;
-  const maxParam = opts.maxBytesParam ?? 8 * 1024;
-  let inflight = null;
-  async function loadSecrets() {
-    const out = {};
-    if (!opts.secrets?.length) return out;
-    if (!opts.secretsClient) {
-      throw new ConfigError(
-        [{ path: "<aws>", from: name, message: "E_NO_SDK: inject secretsClient (peer @aws-sdk/client-secrets-manager)" }],
-        "E_NO_SDK"
-      );
-    }
-    for (const id of opts.secrets) {
-      let raw;
-      try {
-        raw = await withTimeout(deferred(() => opts.secretsClient.getSecretValue(id)), timeoutMs, name);
-      } catch (e) {
-        wrapClientError(e, id, name);
-      }
-      if (typeof raw === "string") {
-        if (byteLengthUtf8(raw) > maxSecret) throw new ConfigError([{ path: id, from: name, message: "E_TOO_LARGE" }], "E_TOO_LARGE");
-        try {
-          const parsed = JSON.parse(raw);
-          if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-            Object.assign(out, normalizeSecretMap(parsed, `${name}/${id}`));
-            continue;
-          }
-        } catch {
-        }
-        out[lastSegment(id)] = raw.replace(/\r?\n$/, "");
-        continue;
-      }
-      const { SecretString, SecretBinary } = raw;
-      if (SecretString !== void 0 && SecretBinary !== void 0) {
-        throw new ConfigError([{ path: id, from: name, message: "E_SHAPE: SecretString XOR SecretBinary" }], "E_SHAPE");
-      }
-      if (SecretString === void 0 && SecretBinary === void 0) {
-        throw new ConfigError([{ path: id, from: name, message: "E_SHAPE: neither SecretString nor SecretBinary present" }], "E_SHAPE");
-      }
-      if (SecretString !== void 0) {
-        if (byteLengthUtf8(SecretString) > maxSecret) throw new ConfigError([{ path: id, from: name, message: "E_TOO_LARGE" }], "E_TOO_LARGE");
-        try {
-          const parsed = JSON.parse(SecretString);
-          if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-            Object.assign(out, normalizeSecretMap(parsed, `${name}/${id}`));
-            continue;
-          }
-        } catch {
-        }
-        out[lastSegment(id)] = SecretString.replace(/\r?\n$/, "");
-      } else if (SecretBinary !== void 0) {
-        const decoded = decodeBinary(SecretBinary, id, name);
-        if (byteLengthUtf8(decoded) > maxSecret) throw new ConfigError([{ path: id, from: name, message: "E_TOO_LARGE" }], "E_TOO_LARGE");
-        out[lastSegment(id)] = decoded.replace(/\r?\n$/, "");
-      }
-    }
-    return out;
-  }
-  function lastSegment(id) {
-    const segs = id.split("/").filter((s) => s.length > 0);
-    return (segs.length > 0 ? segs[segs.length - 1] : id).toUpperCase();
-  }
-  function stripParamPrefix(paramName, requested) {
-    if (!paramName) return "";
-    let best = "";
-    for (const r of requested) {
-      if (!r) continue;
-      if (paramName === r) {
-        if (r.endsWith("/")) return "";
-        return r.split("/").filter((s) => s.length > 0).pop();
-      }
-      const dirPrefix = r.endsWith("/") ? r : `${r}/`;
-      if (paramName.startsWith(dirPrefix) && dirPrefix.length > best.length) best = dirPrefix;
-    }
-    const rest = best ? paramName.slice(best.length) : paramName.split("/").filter((s) => s.length > 0).pop() ?? paramName;
-    return rest.replace(/\//g, "__");
-  }
-  async function loadParams() {
-    const out = {};
-    if (!opts.params?.length) return out;
-    if (!opts.ssmClient) {
-      throw new ConfigError(
-        [{ path: "<aws>", from: name, message: "E_NO_SDK: inject ssmClient (peer @aws-sdk/client-ssm)" }],
-        "E_NO_SDK"
-      );
-    }
-    let map;
-    try {
-      map = await withTimeout(
-        deferred(() => opts.ssmClient.getParameters(opts.params, true)),
-        timeoutMs,
-        name
-      );
-    } catch (e) {
-      wrapClientError(e, "<ssm>", name);
-    }
-    for (const [fullName, value] of Object.entries(map)) {
-      if (byteLengthUtf8(value) > maxParam) throw new ConfigError([{ path: fullName, from: name, message: "E_TOO_LARGE" }], "E_TOO_LARGE");
-      const key = stripParamPrefix(fullName, opts.params).toUpperCase();
-      if (!key) continue;
-      out[key] = value.replace(/\r?\n$/, "");
-    }
-    return out;
-  }
-  async function doLoad() {
-    const [s, p] = await Promise.all([loadSecrets(), loadParams()]);
-    return { ...s, ...p };
-  }
-  void opts.region;
-  void opts.versionId;
-  return {
-    name,
-    load() {
-      if (!inflight) {
-        inflight = doLoad().finally(() => {
-          inflight = null;
-        });
-      }
-      return inflight;
-    }
-  };
-}
-
-exports.awsProvider = awsProvider;
+'use strict';function h(t){try{let e=globalThis;if(e.TextEncoder)return new e.TextEncoder().encode(t).length;if(e.Buffer)return e.Buffer.byteLength(t,"utf8")}catch{}return t.length}var o=class extends Error{code="E_INVALID_CONFIG";issues;static[Symbol.hasInstance](e){return typeof e=="object"&&e!==null&&e.name==="ConfigError"&&typeof e.code=="string"&&Array.isArray(e.issues)}constructor(e=[],a="E_INVALID_CONFIG"){let f=e.map(u=>`- ${u.path} (from ${u.from}): ${u.message}`);super(e.length===0?"Invalid config: unknown error (no issues attached)":`Invalid config (${e.length} issue${e.length===1?"":"s"}):
+${f.join(`
+`)}`),this.name="ConfigError",this.code=a,this.issues=e;}};function R(t){return t.toLowerCase()==="__proto__"}function A(t,e,a){let u=l=>{if(l==null)return;let m=typeof l=="string"?l:String(l);return (m=m.replace(/\r?\n$/,"")),m},d={};if(!t||typeof t!="object"||Array.isArray(t))throw new o([{path:"<root>",from:e,message:"E_SHAPE: provider returned non-object"}],"E_SHAPE");for(let[l,m]of Object.entries(t)){if(R(l))throw new o([{path:l,from:e,message:"E_PROTO: forbidden key"}],"E_PROTO");if(m!==null&&typeof m=="object"&&!Array.isArray(m)){d[l]=m;continue}let w=u(m);w!==void 0&&(d[l]=w);}return d}function p(t,e,a){if(!Number.isFinite(t)||t<=0)throw new o([{path:e,from:a,message:`E_USAGE: ${e} must be a positive finite number`}],"E_USAGE")}async function S(t,e,a){let f,u=new Promise((d,l)=>{f=setTimeout(()=>l(new o([{path:a,from:a,message:"E_TIMEOUT"}],"E_TIMEOUT")),e);});t.catch(()=>{});try{return await Promise.race([t,u])}finally{clearTimeout(f);}}function O(t){return Promise.resolve().then(t)}function T(t,e,a){if(t instanceof o)throw t;let f=t;throw new o([{path:e,from:a,message:`E_UPSTREAM: ${f?.message??String(t)}`}],"E_UPSTREAM")}var C=/^[A-Za-z0-9+/]*={0,2}$/;function I(t,e,a){if(typeof t=="string"){let u=t.replace(/\s/g,"");if(!C.test(u)||u.length%4!==0)throw new o([{path:e,from:a,message:"E_SHAPE: SecretBinary is not valid base64"}],"E_SHAPE");return $(u)}let f=globalThis;if(f.Buffer)return f.Buffer.from(t,"binary").toString("utf8");try{return new TextDecoder("utf-8",{fatal:!0}).decode(t)}catch{throw new o([{path:e,from:a,message:"E_SHAPE: SecretBinary is not valid UTF-8"}],"E_SHAPE")}}function $(t){let e=globalThis;if(e.Buffer)return e.Buffer.from(t,"base64").toString("utf8");if(e.atob){let a=e.atob(t),f=new Uint8Array(a.length);for(let u=0;u<a.length;u++)f[u]=a.charCodeAt(u);return new TextDecoder().decode(f)}throw new o([{path:"<aws>",from:"aws",message:"E_NO_SDK: no base64 decoder (Buffer/atob) available"}],"E_NO_SDK")}function N(t){let e=`aws://${(t.secrets??[]).join(",")}${(t.params??[]).join(",")||"ssm"}`,a=t.timeoutMs??5e3,f=t.maxBytesSecret??64*1024,u=t.maxBytesParam??8*1024;p(a,"timeoutMs",e),p(f,"maxBytesSecret",e),p(u,"maxBytesParam",e);let d=null,l;async function m(){let r={};if(!t.secrets?.length)return r;if(!t.secretsClient)throw new o([{path:"<aws>",from:e,message:"E_NO_SDK: inject secretsClient (peer @aws-sdk/client-secrets-manager)"}],"E_NO_SDK");for(let n of t.secrets){let s;try{s=await S(O(()=>t.secretsClient.getSecretValue(n)),l(),e);}catch(i){T(i,n,e);}if(typeof s=="string"){if(h(s)>f)throw new o([{path:n,from:e,message:"E_TOO_LARGE"}],"E_TOO_LARGE");let i;try{i=JSON.parse(s);}catch{i=void 0;}if(i&&typeof i=="object"&&!Array.isArray(i)){y(r,A(i,`${e}/${n}`),`${e}/${n}`);continue}E(r,n,s);continue}let{SecretString:c,SecretBinary:g}=s;if(c!==void 0&&g!==void 0)throw new o([{path:n,from:e,message:"E_SHAPE: SecretString XOR SecretBinary"}],"E_SHAPE");if(c===void 0&&g===void 0)throw new o([{path:n,from:e,message:"E_SHAPE: neither SecretString nor SecretBinary present"}],"E_SHAPE");if(c!==void 0){if(h(c)>f)throw new o([{path:n,from:e,message:"E_TOO_LARGE"}],"E_TOO_LARGE");let i;try{i=JSON.parse(c);}catch{i=void 0;}if(i&&typeof i=="object"&&!Array.isArray(i)){y(r,A(i,`${e}/${n}`),`${e}/${n}`);continue}E(r,n,c);}else if(g!==void 0){let i=I(g,n,e);if(h(i)>f)throw new o([{path:n,from:e,message:"E_TOO_LARGE"}],"E_TOO_LARGE");E(r,n,i);}}return r}function w(r){let n=r.split("/").filter(s=>s.length>0);return (n.length>0?n[n.length-1]:r).toUpperCase()}function E(r,n,s){let c=w(n);c&&_(r,c,s.replace(/\r?\n$/,""),n);}function _(r,n,s,c){if(n in r)throw new o([{path:n,from:c,message:"E_COLLISION: two secrets/params map to the same key \u2014 rename one or narrow the params prefix"}],"E_COLLISION");r[n]=s;}function y(r,n,s){for(let[c,g]of Object.entries(n))_(r,c,g,s);}function P(r,n){if(!r)return "";let s="";for(let g of n){if(!g)continue;if(r===g)return g.endsWith("/")?"":g.split("/").filter(x=>x.length>0).pop();let i=g.endsWith("/")?g:`${g}/`;r.startsWith(i)&&i.length>s.length&&(s=i);}return (s?r.slice(s.length):r.split("/").filter(g=>g.length>0).pop()??r).replace(/\//g,"__")}async function b(){let r={};if(!t.params?.length)return r;if(!t.ssmClient)throw new o([{path:"<aws>",from:e,message:"E_NO_SDK: inject ssmClient (peer @aws-sdk/client-ssm)"}],"E_NO_SDK");let n;try{n=await S(O(()=>t.ssmClient.getParameters(t.params,!0)),l(),e);}catch(s){T(s,"<ssm>",e);}for(let[s,c]of Object.entries(n)){if(h(c)>u)throw new o([{path:s,from:e,message:"E_TOO_LARGE"}],"E_TOO_LARGE");let g=P(s,t.params).toUpperCase();g&&_(r,g,c.replace(/\r?\n$/,""),s);}return r}async function k(){let r=Date.now()+a;l=()=>Math.max(1,r-Date.now());let[n,s]=await Promise.all([m(),b()]),c={...n};return y(c,s,e),c}return t.region,t.versionId,{name:e,load(){return d||(d=k().finally(()=>{d=null;})),d}}}
+exports.awsProvider=N;

package/dist/vault/aws.d.cts

@@ -1,4 +1,4 @@
-import { a as SecretProvider } from '../types-B_Dc2L4T.cjs';
+import { a as SecretProvider } from '../types-CcsYDAdO.cjs';
 import '@standard-schema/spec';
 
 /**

package/dist/vault/aws.d.ts

@@ -1,4 +1,4 @@
-import { a as SecretProvider } from '../types-B_Dc2L4T.js';
+import { a as SecretProvider } from '../types-CcsYDAdO.js';
 import '@standard-schema/spec';
 
 /**

package/dist/vault/aws.js

@@ -1,167 +1,2 @@
-import { normalizeSecretMap } from '../chunk-RQC6OMVV.js';
-import { ConfigError, byteLengthUtf8 } from '../chunk-EE6LXNJV.js';
-
-// src/vault/aws.ts
-async function withTimeout(p, ms, name) {
-  let timer;
-  const timeout = new Promise((_, rej) => {
-    timer = setTimeout(
-      () => rej(new ConfigError([{ path: name, from: name, message: "E_TIMEOUT" }], "E_TIMEOUT")),
-      ms
-    );
-  });
-  try {
-    return await Promise.race([p, timeout]);
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function deferred(fn) {
-  return Promise.resolve().then(fn);
-}
-function wrapClientError(e, path, from) {
-  if (e instanceof ConfigError) throw e;
-  const err = e;
-  throw new ConfigError(
-    [{ path, from, message: `E_UPSTREAM: ${err?.message ?? String(e)}` }],
-    "E_UPSTREAM"
-  );
-}
-var BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
-function decodeBinary(b, path, from) {
-  if (typeof b === "string") {
-    const compact = b.replace(/\s/g, "");
-    if (!BASE64_RE.test(compact) || compact.length % 4 !== 0) {
-      throw new ConfigError([{ path, from, message: "E_SHAPE: SecretBinary is not valid base64" }], "E_SHAPE");
-    }
-    return Buffer.from(compact, "base64").toString("utf8");
-  }
-  return Buffer.from(b).toString("utf8");
-}
-function awsProvider(opts) {
-  const name = `aws://${(opts.secrets ?? []).join(",")}${(opts.params ?? []).join(",") || "ssm"}`;
-  const timeoutMs = opts.timeoutMs ?? 5e3;
-  const maxSecret = opts.maxBytesSecret ?? 64 * 1024;
-  const maxParam = opts.maxBytesParam ?? 8 * 1024;
-  let inflight = null;
-  async function loadSecrets() {
-    const out = {};
-    if (!opts.secrets?.length) return out;
-    if (!opts.secretsClient) {
-      throw new ConfigError(
-        [{ path: "<aws>", from: name, message: "E_NO_SDK: inject secretsClient (peer @aws-sdk/client-secrets-manager)" }],
-        "E_NO_SDK"
-      );
-    }
-    for (const id of opts.secrets) {
-      let raw;
-      try {
-        raw = await withTimeout(deferred(() => opts.secretsClient.getSecretValue(id)), timeoutMs, name);
-      } catch (e) {
-        wrapClientError(e, id, name);
-      }
-      if (typeof raw === "string") {
-        if (byteLengthUtf8(raw) > maxSecret) throw new ConfigError([{ path: id, from: name, message: "E_TOO_LARGE" }], "E_TOO_LARGE");
-        try {
-          const parsed = JSON.parse(raw);
-          if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-            Object.assign(out, normalizeSecretMap(parsed, `${name}/${id}`));
-            continue;
-          }
-        } catch {
-        }
-        out[lastSegment(id)] = raw.replace(/\r?\n$/, "");
-        continue;
-      }
-      const { SecretString, SecretBinary } = raw;
-      if (SecretString !== void 0 && SecretBinary !== void 0) {
-        throw new ConfigError([{ path: id, from: name, message: "E_SHAPE: SecretString XOR SecretBinary" }], "E_SHAPE");
-      }
-      if (SecretString === void 0 && SecretBinary === void 0) {
-        throw new ConfigError([{ path: id, from: name, message: "E_SHAPE: neither SecretString nor SecretBinary present" }], "E_SHAPE");
-      }
-      if (SecretString !== void 0) {
-        if (byteLengthUtf8(SecretString) > maxSecret) throw new ConfigError([{ path: id, from: name, message: "E_TOO_LARGE" }], "E_TOO_LARGE");
-        try {
-          const parsed = JSON.parse(SecretString);
-          if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-            Object.assign(out, normalizeSecretMap(parsed, `${name}/${id}`));
-            continue;
-          }
-        } catch {
-        }
-        out[lastSegment(id)] = SecretString.replace(/\r?\n$/, "");
-      } else if (SecretBinary !== void 0) {
-        const decoded = decodeBinary(SecretBinary, id, name);
-        if (byteLengthUtf8(decoded) > maxSecret) throw new ConfigError([{ path: id, from: name, message: "E_TOO_LARGE" }], "E_TOO_LARGE");
-        out[lastSegment(id)] = decoded.replace(/\r?\n$/, "");
-      }
-    }
-    return out;
-  }
-  function lastSegment(id) {
-    const segs = id.split("/").filter((s) => s.length > 0);
-    return (segs.length > 0 ? segs[segs.length - 1] : id).toUpperCase();
-  }
-  function stripParamPrefix(paramName, requested) {
-    if (!paramName) return "";
-    let best = "";
-    for (const r of requested) {
-      if (!r) continue;
-      if (paramName === r) {
-        if (r.endsWith("/")) return "";
-        return r.split("/").filter((s) => s.length > 0).pop();
-      }
-      const dirPrefix = r.endsWith("/") ? r : `${r}/`;
-      if (paramName.startsWith(dirPrefix) && dirPrefix.length > best.length) best = dirPrefix;
-    }
-    const rest = best ? paramName.slice(best.length) : paramName.split("/").filter((s) => s.length > 0).pop() ?? paramName;
-    return rest.replace(/\//g, "__");
-  }
-  async function loadParams() {
-    const out = {};
-    if (!opts.params?.length) return out;
-    if (!opts.ssmClient) {
-      throw new ConfigError(
-        [{ path: "<aws>", from: name, message: "E_NO_SDK: inject ssmClient (peer @aws-sdk/client-ssm)" }],
-        "E_NO_SDK"
-      );
-    }
-    let map;
-    try {
-      map = await withTimeout(
-        deferred(() => opts.ssmClient.getParameters(opts.params, true)),
-        timeoutMs,
-        name
-      );
-    } catch (e) {
-      wrapClientError(e, "<ssm>", name);
-    }
-    for (const [fullName, value] of Object.entries(map)) {
-      if (byteLengthUtf8(value) > maxParam) throw new ConfigError([{ path: fullName, from: name, message: "E_TOO_LARGE" }], "E_TOO_LARGE");
-      const key = stripParamPrefix(fullName, opts.params).toUpperCase();
-      if (!key) continue;
-      out[key] = value.replace(/\r?\n$/, "");
-    }
-    return out;
-  }
-  async function doLoad() {
-    const [s, p] = await Promise.all([loadSecrets(), loadParams()]);
-    return { ...s, ...p };
-  }
-  void opts.region;
-  void opts.versionId;
-  return {
-    name,
-    load() {
-      if (!inflight) {
-        inflight = doLoad().finally(() => {
-          inflight = null;
-        });
-      }
-      return inflight;
-    }
-  };
-}
-
-export { awsProvider };
+import {f,c as c$1}from'../chunk-5D2AQWDG.js';import {d,c}from'../chunk-NQDE3WLR.js';async function _(t,r,g){let f,m=new Promise((l,u)=>{f=setTimeout(()=>u(new d([{path:g,from:g,message:"E_TIMEOUT"}],"E_TIMEOUT")),r);});t.catch(()=>{});try{return await Promise.race([t,m])}finally{clearTimeout(f);}}function p(t){return Promise.resolve().then(t)}function P(t,r,g){if(t instanceof d)throw t;let f=t;throw new d([{path:r,from:g,message:`E_UPSTREAM: ${f?.message??String(t)}`}],"E_UPSTREAM")}var C=/^[A-Za-z0-9+/]*={0,2}$/;function x(t,r,g){if(typeof t=="string"){let m=t.replace(/\s/g,"");if(!C.test(m)||m.length%4!==0)throw new d([{path:r,from:g,message:"E_SHAPE: SecretBinary is not valid base64"}],"E_SHAPE");return F(m)}let f=globalThis;if(f.Buffer)return f.Buffer.from(t,"binary").toString("utf8");try{return new TextDecoder("utf-8",{fatal:!0}).decode(t)}catch{throw new d([{path:r,from:g,message:"E_SHAPE: SecretBinary is not valid UTF-8"}],"E_SHAPE")}}function F(t){let r=globalThis;if(r.Buffer)return r.Buffer.from(t,"base64").toString("utf8");if(r.atob){let g=r.atob(t),f=new Uint8Array(g.length);for(let m=0;m<g.length;m++)f[m]=g.charCodeAt(m);return new TextDecoder().decode(f)}throw new d([{path:"<aws>",from:"aws",message:"E_NO_SDK: no base64 decoder (Buffer/atob) available"}],"E_NO_SDK")}function L(t){let r=`aws://${(t.secrets??[]).join(",")}${(t.params??[]).join(",")||"ssm"}`,g=t.timeoutMs??5e3,f$1=t.maxBytesSecret??64*1024,m=t.maxBytesParam??8*1024;f(g,"timeoutMs",r),f(f$1,"maxBytesSecret",r),f(m,"maxBytesParam",r);let l=null,u;async function O(){let n={};if(!t.secrets?.length)return n;if(!t.secretsClient)throw new d([{path:"<aws>",from:r,message:"E_NO_SDK: inject secretsClient (peer @aws-sdk/client-secrets-manager)"}],"E_NO_SDK");for(let e of t.secrets){let s;try{s=await _(p(()=>t.secretsClient.getSecretValue(e)),u(),r);}catch(i){P(i,e,r);}if(typeof s=="string"){if(c(s)>f$1)throw new d([{path:e,from:r,message:"E_TOO_LARGE"}],"E_TOO_LARGE");let i;try{i=JSON.parse(s);}catch{i=void 0;}if(i&&typeof i=="object"&&!Array.isArray(i)){E(n,c$1(i,`${r}/${e}`),`${r}/${e}`);continue}h(n,e,s);continue}let{SecretString:o,SecretBinary:a}=s;if(o!==void 0&&a!==void 0)throw new d([{path:e,from:r,message:"E_SHAPE: SecretString XOR SecretBinary"}],"E_SHAPE");if(o===void 0&&a===void 0)throw new d([{path:e,from:r,message:"E_SHAPE: neither SecretString nor SecretBinary present"}],"E_SHAPE");if(o!==void 0){if(c(o)>f$1)throw new d([{path:e,from:r,message:"E_TOO_LARGE"}],"E_TOO_LARGE");let i;try{i=JSON.parse(o);}catch{i=void 0;}if(i&&typeof i=="object"&&!Array.isArray(i)){E(n,c$1(i,`${r}/${e}`),`${r}/${e}`);continue}h(n,e,o);}else if(a!==void 0){let i=x(a,e,r);if(c(i)>f$1)throw new d([{path:e,from:r,message:"E_TOO_LARGE"}],"E_TOO_LARGE");h(n,e,i);}}return n}function A(n){let e=n.split("/").filter(s=>s.length>0);return (e.length>0?e[e.length-1]:n).toUpperCase()}function h(n,e,s){let o=A(e);o&&S(n,o,s.replace(/\r?\n$/,""),e);}function S(n,e,s,o){if(e in n)throw new d([{path:e,from:o,message:"E_COLLISION: two secrets/params map to the same key \u2014 rename one or narrow the params prefix"}],"E_COLLISION");n[e]=s;}function E(n,e,s){for(let[o,a]of Object.entries(e))S(n,o,a,s);}function T(n,e){if(!n)return "";let s="";for(let a of e){if(!a)continue;if(n===a)return a.endsWith("/")?"":a.split("/").filter(v=>v.length>0).pop();let i=a.endsWith("/")?a:`${a}/`;n.startsWith(i)&&i.length>s.length&&(s=i);}return (s?n.slice(s.length):n.split("/").filter(a=>a.length>0).pop()??n).replace(/\//g,"__")}async function b(){let n={};if(!t.params?.length)return n;if(!t.ssmClient)throw new d([{path:"<aws>",from:r,message:"E_NO_SDK: inject ssmClient (peer @aws-sdk/client-ssm)"}],"E_NO_SDK");let e;try{e=await _(p(()=>t.ssmClient.getParameters(t.params,!0)),u(),r);}catch(s){P(s,"<ssm>",r);}for(let[s,o]of Object.entries(e)){if(c(o)>m)throw new d([{path:s,from:r,message:"E_TOO_LARGE"}],"E_TOO_LARGE");let a=T(s,t.params).toUpperCase();a&&S(n,a,o.replace(/\r?\n$/,""),s);}return n}async function B(){let n=Date.now()+g;u=()=>Math.max(1,n-Date.now());let[e,s]=await Promise.all([O(),b()]),o={...e};return E(o,s,r),o}return t.region,t.versionId,{name:r,load(){return l||(l=B().finally(()=>{l=null;})),l}}}
+export{L as awsProvider};