@astrale-os/adapter-cloudflare 0.5.0-beta.7 → 0.5.0-beta.71

package/dist/build/worker/execution.prepare.js

@@ -0,0 +1,109 @@
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { dirname, join, relative, resolve } from 'node:path';
+import { SIGNING_IDENTITY_BINDING } from '../../identity/binding.js';
+import { admitWorkerBundle } from '../bundle/admit.js';
+import { generateExecutionEntry, generateExecutionService } from '../codegen/execution.js';
+import { generateWranglerConfig } from '../codegen/wrangler.js';
+import { workerInvocationTimeout, workerRequestLimit } from '../configuration.js';
+import { qualifyWorkerBundle } from '../qualification.js';
+import { runWranglerBundle } from '../wrangler-cli.js';
+import { workerModuleSpecifier } from './specifier.js';
+export const RELEASE_ENTRY = 'bundle/index.mjs';
+export const RELEASE_SERVICE = 'bundle/service.mjs';
+export async function prepareExecution(input) {
+    const runtimePath = resolve(input.context.projectDir, input.context.runtime.reference.path);
+    const runtimeSpecifier = moduleSpecifier(relative(input.directory, runtimePath));
+    const workerSpecifier = workerModuleSpecifier();
+    const maximumRequestBytes = workerRequestLimit(input.params.maximumRequestBytes);
+    const invocationTimeoutMs = workerInvocationTimeout(input.params.invocationTimeoutMs);
+    const serviceSource = generateExecutionService({
+        origin: input.context.build.schema.compiled.root.origin,
+        runtimeSpecifier,
+        workerSpecifier,
+        build: input.context.build,
+        ...(maximumRequestBytes === undefined ? {} : { maximumRequestBytes }),
+        ...(invocationTimeoutMs === undefined ? {} : { invocationTimeoutMs }),
+        ...(input.configuredIssuer === undefined && input.direct
+            ? { providerAssignedWorker: input.name }
+            : {}),
+        ...(input.router === undefined
+            ? {}
+            : {
+                router: {
+                    binding: input.router.binding,
+                    hostSuffix: input.router.hostSuffix,
+                    minLabels: input.router.minLabels,
+                },
+            }),
+    });
+    const serviceSourcePath = join(input.directory, 'service.gen.ts');
+    await writeFile(serviceSourcePath, serviceSource);
+    const serviceConfigPath = join(input.directory, 'wrangler.service.prepare.jsonc');
+    await writeFile(serviceConfigPath, generateWranglerConfig({
+        workerName: input.name,
+        main: './service.gen.ts',
+        vars: runtimeVars(input.params, input.configuredIssuer),
+        secretBindings: [SIGNING_IDENTITY_BINDING],
+        ...(input.router === undefined
+            ? {}
+            : { router: { binding: input.router.binding, service: input.router.service } }),
+        ...(input.params.wrangler === undefined ? {} : { wrangler: input.params.wrangler }),
+        selfBinding: false,
+    }));
+    const serviceOutput = join(input.directory, 'dist-service');
+    await rm(serviceOutput, { recursive: true, force: true });
+    const emittedService = await runWranglerBundle({
+        projectDir: input.context.projectDir,
+        configPath: serviceConfigPath,
+        outDir: serviceOutput,
+    });
+    await qualifyWorkerBundle({
+        metafilePath: emittedService.metafilePath,
+        inputRoot: dirname(serviceConfigPath),
+    });
+    await admitWorkerBundle(emittedService.bundlePath);
+    const service = new Uint8Array(await readFile(emittedService.bundlePath));
+    await mkdir(dirname(join(input.directory, RELEASE_SERVICE)), { recursive: true });
+    await writeFile(join(input.directory, RELEASE_SERVICE), service);
+    const sourcePath = join(input.directory, 'worker.gen.ts');
+    await writeFile(sourcePath, generateExecutionEntry('./service.mjs', workerSpecifier));
+    const configPath = join(input.directory, 'wrangler.prepare.jsonc');
+    await writeFile(configPath, generateWranglerConfig({
+        workerName: input.name,
+        ...(input.params.route === undefined ? {} : { route: input.params.route }),
+        vars: runtimeVars(input.params, input.configuredIssuer),
+        secretBindings: [SIGNING_IDENTITY_BINDING],
+        modules: { baseDir: '.', rules: [{ type: 'ESModule', globs: [RELEASE_SERVICE] }] },
+        ...(input.router === undefined
+            ? {}
+            : { router: { binding: input.router.binding, service: input.router.service } }),
+        ...(input.params.wrangler === undefined ? {} : { wrangler: input.params.wrangler }),
+        selfBinding: false,
+    }));
+    const output = join(input.directory, 'dist-prepare');
+    await rm(output, { recursive: true, force: true });
+    const emitted = await runWranglerBundle({
+        projectDir: input.context.projectDir,
+        configPath,
+        outDir: output,
+    });
+    await qualifyWorkerBundle({
+        metafilePath: emitted.metafilePath,
+        inputRoot: dirname(configPath),
+    });
+    await admitWorkerBundle(emitted.bundlePath);
+    return Object.freeze({
+        entry: new Uint8Array(await readFile(emitted.bundlePath)),
+        service,
+    });
+}
+export function runtimeVars(params, configuredIssuer) {
+    return {
+        ...params.vars,
+        ...(configuredIssuer === undefined ? {} : { WORKER_URL: configuredIssuer }),
+    };
+}
+function moduleSpecifier(input) {
+    const normalized = input.split('\\').join('/');
+    return normalized.startsWith('.') ? normalized : `./${normalized}`;
+}

package/dist/build/worker/index.d.ts

@@ -0,0 +1,2 @@
+export { loadWorkerArtifact } from './artifact.load.js';
+export type { WorkerArtifact } from './artifact.js';

package/dist/build/worker/index.js

@@ -0,0 +1 @@
+export { loadWorkerArtifact } from './artifact.load.js';

package/dist/build/worker/modules.d.ts

@@ -0,0 +1,11 @@
+import type { WorkerArtifact } from './artifact.js';
+type WranglerModuleType = 'ESModule' | 'CompiledWasm' | 'Text' | 'Data';
+/** Project one admitted Worker module inventory into Wrangler's relative module discovery. */
+export declare function workerModules(worker: WorkerArtifact['release']): {
+    readonly baseDir: string;
+    readonly rules: readonly {
+        readonly type: WranglerModuleType;
+        readonly globs: readonly string[];
+    }[];
+};
+export {};

package/dist/build/worker/modules.js

@@ -0,0 +1,26 @@
+import { posix } from 'node:path';
+const TYPES = Object.freeze({
+    esm: 'ESModule',
+    wasm: 'CompiledWasm',
+    text: 'Text',
+    data: 'Data',
+});
+/** Project one admitted Worker module inventory into Wrangler's relative module discovery. */
+export function workerModules(worker) {
+    const directory = posix.dirname(worker.entrypoint);
+    const groups = new Map();
+    for (const module of worker.modules) {
+        if (module.path === worker.entrypoint)
+            continue;
+        const relative = posix.relative(directory, module.path);
+        if (relative === '' || relative === '..' || relative.startsWith('../')) {
+            throw new TypeError('Cloudflare Worker module escapes its entrypoint directory.');
+        }
+        const type = TYPES[module.kind];
+        const globs = groups.get(type) ?? [];
+        globs.push(relative);
+        groups.set(type, globs);
+    }
+    const rules = [...groups].map(([type, globs]) => Object.freeze({ type, globs: Object.freeze(globs) }));
+    return Object.freeze({ baseDir: `./${directory}`, rules: Object.freeze(rules) });
+}

package/dist/build/worker/runtime.d.ts

@@ -0,0 +1,10 @@
+export interface WorkerRuntimeConfiguration {
+    readonly compatibilityDate: string;
+    readonly compatibilityFlags: readonly string[];
+    readonly vars: Readonly<Record<string, string>>;
+    readonly services: readonly {
+        readonly name: string;
+        readonly service: string;
+    }[];
+}
+export declare function admitWorkerRuntimeConfiguration(input: string): WorkerRuntimeConfiguration;

package/dist/build/worker/runtime.js

@@ -0,0 +1,35 @@
+export function admitWorkerRuntimeConfiguration(input) {
+    const value = JSON.parse(input);
+    const compatibilityDate = value.compatibility_date;
+    const compatibilityFlags = value.compatibility_flags;
+    const vars = value.vars ?? {};
+    const services = value.services ?? [];
+    if (typeof compatibilityDate !== 'string' ||
+        !Array.isArray(compatibilityFlags) ||
+        compatibilityFlags.some((flag) => typeof flag !== 'string') ||
+        vars === null ||
+        typeof vars !== 'object' ||
+        Array.isArray(vars) ||
+        Object.values(vars).some((item) => typeof item !== 'string') ||
+        !Array.isArray(services)) {
+        invalidRuntime();
+    }
+    const admittedServices = services.map((input) => {
+        if (input === null || typeof input !== 'object' || Array.isArray(input))
+            invalidRuntime();
+        const binding = Reflect.get(input, 'binding');
+        const service = Reflect.get(input, 'service');
+        if (typeof binding !== 'string' || typeof service !== 'string')
+            invalidRuntime();
+        return Object.freeze({ name: binding, service });
+    });
+    return Object.freeze({
+        compatibilityDate,
+        compatibilityFlags: Object.freeze([...compatibilityFlags]),
+        vars: Object.freeze({ ...vars }),
+        services: Object.freeze(admittedServices),
+    });
+}
+function invalidRuntime() {
+    throw new TypeError('Generated Cloudflare runtime configuration is invalid.');
+}

package/dist/build/worker/specifier.d.ts

@@ -0,0 +1 @@
+export declare function workerModuleSpecifier(): string;

package/dist/build/worker/specifier.js

@@ -0,0 +1,5 @@
+import { fileURLToPath } from 'node:url';
+const workerModule = import.meta.resolve('@astrale-os/adapter-cloudflare/worker');
+export function workerModuleSpecifier() {
+    return fileURLToPath(workerModule);
+}

package/dist/build/wrangler/bundle.d.ts

@@ -0,0 +1,10 @@
+export declare function runWranglerBundle(args: {
+    projectDir: string;
+    configPath: string;
+    outDir: string;
+    onLog?: (line: string) => void;
+    signal?: AbortSignal;
+}): Promise<{
+    readonly bundlePath: string;
+    readonly metafilePath: string;
+}>;

package/dist/build/wrangler/bundle.js

@@ -0,0 +1,29 @@
+import { readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { runCapture, wranglerCommand } from './process.js';
+import { runWranglerTypes } from './type-generation.js';
+export async function runWranglerBundle(args) {
+    await runWranglerTypes(args);
+    const { cmd, prefix } = wranglerCommand(args.projectDir);
+    const { code, out } = await runCapture(cmd, [
+        ...prefix,
+        'deploy',
+        '--dry-run',
+        '--outdir',
+        args.outDir,
+        '--metafile',
+        '--config',
+        args.configPath,
+    ], args.projectDir, args.onLog, args.signal);
+    if (code !== 0)
+        throw new Error(`wrangler bundle failed (exit ${code}): ${out.slice(-400)}`);
+    const javascript = readdirSync(args.outDir).filter((file) => file.endsWith('.js'));
+    if (javascript.length === 0) {
+        throw new Error(`wrangler bundle produced no .js in ${args.outDir}`);
+    }
+    const preferred = javascript.find((file) => file.startsWith('worker')) ?? javascript[0];
+    return Object.freeze({
+        bundlePath: join(args.outDir, preferred),
+        metafilePath: join(args.outDir, 'bundle-meta.json'),
+    });
+}

package/dist/build/wrangler/deploy.d.ts

@@ -0,0 +1,24 @@
+export interface DeployArgs {
+    configPath: string;
+    secrets?: Readonly<Record<string, string>>;
+    route?: string;
+    onLog?: (line: string) => void;
+    signal?: AbortSignal;
+}
+export declare class WranglerDeployError extends Error {
+    readonly applied?: {
+        readonly url?: string;
+        readonly deploymentVersion?: string;
+    };
+    constructor(message: string, applied?: {
+        readonly url?: string;
+        readonly deploymentVersion?: string;
+    });
+}
+export declare function runWranglerDeploy(args: DeployArgs & {
+    projectDir: string;
+}): Promise<{
+    url?: string;
+    raw: string;
+    deploymentVersion: string;
+}>;

package/dist/build/wrangler/deploy.js

@@ -0,0 +1,44 @@
+import { parseDeployUrl, parseDeployVersionId } from '../parse-output.js';
+import { runCapture, wranglerCommand } from './process.js';
+import { secretRedactor, withSecretsFile } from './secrets.js';
+import { runWranglerTypes } from './type-generation.js';
+export class WranglerDeployError extends Error {
+    applied;
+    constructor(message, applied) {
+        super(message);
+        this.name = 'WranglerDeployError';
+        if (applied !== undefined)
+            this.applied = Object.freeze({ ...applied });
+    }
+}
+export async function runWranglerDeploy(args) {
+    await runWranglerTypes(args);
+    const { cmd, prefix } = wranglerCommand(args.projectDir);
+    const secrets = args.secrets ?? {};
+    const execute = (secretsFile) => runCapture(cmd, [
+        ...prefix,
+        'deploy',
+        '--config',
+        args.configPath,
+        ...(secretsFile === undefined ? [] : ['--secrets-file', secretsFile]),
+    ], args.projectDir, args.onLog, args.signal, secretRedactor(secrets));
+    const { code, out } = await withSecretsFile(secrets, execute);
+    const url = parseDeployUrl(out, args.route);
+    const deploymentVersion = parseDeployVersionId(out);
+    if (code !== 0) {
+        throw new WranglerDeployError(`wrangler deploy failed (code ${code}):\n${out.slice(-2000)}`, url === undefined && deploymentVersion === undefined
+            ? undefined
+            : {
+                ...(url === undefined ? {} : { url }),
+                ...(deploymentVersion === undefined ? {} : { deploymentVersion }),
+            });
+    }
+    if (deploymentVersion === undefined) {
+        throw new WranglerDeployError('wrangler deploy did not report its Version ID.', url === undefined ? undefined : { url });
+    }
+    return Object.freeze({
+        raw: out,
+        ...(url === undefined ? {} : { url }),
+        deploymentVersion,
+    });
+}

package/dist/build/wrangler/development.d.ts

@@ -0,0 +1,17 @@
+export interface DevHandle {
+    url: string;
+    stop(): Promise<void>;
+}
+export declare function runWranglerDev(args: {
+    projectDir: string;
+    configPath: string;
+    port: number;
+    remote: boolean;
+    readonly ip?: string;
+    readonly autoPickPort?: boolean;
+    /** Pin ordinary local requests to one stable issuer after the final port is selected. */
+    readonly pinLocalOrigin?: boolean;
+    readonly secrets: Readonly<Record<string, string>>;
+    readonly onReload: () => void;
+    readonly onLog?: (line: string) => void;
+}): Promise<DevHandle>;

package/dist/build/wrangler/development.js

@@ -0,0 +1,136 @@
+import { spawn } from 'node:child_process';
+import { createServer } from 'node:net';
+import { parseDevReadyUrl } from '../parse-output.js';
+import { stopChild, wranglerCommand, wranglerProcessEnv } from './process.js';
+import { createSecretEnvironment, secretRedactor } from './secrets.js';
+import { runWranglerTypes } from './type-generation.js';
+export async function runWranglerDev(args) {
+    await runWranglerTypes(args);
+    const { cmd, prefix } = wranglerCommand(args.projectDir);
+    const bindHost = args.ip ?? '127.0.0.1';
+    if (args.autoPickPort && !(await portFree(args.port, bindHost))) {
+        const picked = await ephemeralPort(bindHost);
+        args.onLog?.(`port ${args.port} is taken — using ${picked} instead (pass --port to pin one)`);
+        args = { ...args, port: picked };
+    }
+    const secretEnvironment = await createSecretEnvironment(args.secrets);
+    const redact = secretRedactor(args.secrets);
+    const fallbackUrl = `http://localhost:${args.port}`;
+    const wranglerArgs = [
+        ...prefix,
+        'dev',
+        '--config',
+        args.configPath,
+        '--port',
+        String(args.port),
+        '--local-protocol',
+        'http',
+        '--ip',
+        args.ip ?? '127.0.0.1',
+        ...(args.pinLocalOrigin ? ['--var', `WORKER_URL:${fallbackUrl}`] : []),
+        ...(secretEnvironment === undefined ? [] : ['--env-file', secretEnvironment.path]),
+        ...(args.remote ? ['--remote'] : []),
+    ];
+    let child;
+    try {
+        child = spawn(cmd, wranglerArgs, {
+            cwd: args.projectDir,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: wranglerProcessEnv(args.projectDir),
+        });
+    }
+    catch (cause) {
+        await secretEnvironment?.remove();
+        throw cause;
+    }
+    let resolved = false;
+    let buildErrorTail = '';
+    let outputTail = '';
+    let url;
+    try {
+        url = await new Promise((resolve, reject) => {
+            const onData = (buf) => {
+                const text = redact(buf.toString());
+                outputTail = (outputTail + text).slice(-3000);
+                for (const line of text.split('\n')) {
+                    if (line.trim())
+                        args.onLog?.(line);
+                }
+                if (/✘ \[ERROR\]|Build failed|Could not resolve "/.test(text)) {
+                    buildErrorTail = (buildErrorTail + text).slice(-2000);
+                }
+                if (!resolved) {
+                    const ready = parseDevReadyUrl(text, args.port);
+                    if (ready) {
+                        resolved = true;
+                        resolve(ready);
+                    }
+                }
+                else if (/Reloading|Detected changes|Updated/i.test(text)) {
+                    args.onReload();
+                }
+            };
+            child.stdout?.on('data', onData);
+            child.stderr?.on('data', onData);
+            child.on('exit', (code) => {
+                if (!resolved) {
+                    resolved = true;
+                    reject(new Error(`wrangler dev exited before becoming ready (code ${code ?? 'null'}).\n${outputTail}`));
+                }
+            });
+            child.on('error', (error) => {
+                if (!resolved) {
+                    resolved = true;
+                    reject(error);
+                }
+            });
+            setTimeout(() => {
+                if (!resolved && child.exitCode === null) {
+                    resolved = true;
+                    if (buildErrorTail) {
+                        void stopChild(child);
+                        reject(new Error(`worker build failed — the dev server would hang silently.\n${buildErrorTail}`));
+                    }
+                    else {
+                        resolve(fallbackUrl);
+                    }
+                }
+            }, 15_000).unref?.();
+        });
+    }
+    catch (cause) {
+        await stopChild(child);
+        await secretEnvironment?.remove();
+        throw cause;
+    }
+    return {
+        url: args.pinLocalOrigin ? fallbackUrl : url,
+        async stop() {
+            try {
+                await stopChild(child);
+            }
+            finally {
+                await secretEnvironment?.remove();
+            }
+        },
+    };
+}
+function portFree(port, host) {
+    return new Promise((resolve) => {
+        const server = createServer();
+        server.once('error', () => resolve(false));
+        server.once('listening', () => server.close(() => resolve(true)));
+        server.listen(port, host);
+    });
+}
+function ephemeralPort(host) {
+    return new Promise((resolve, reject) => {
+        const server = createServer();
+        server.once('error', reject);
+        server.listen(0, host, () => {
+            const address = server.address();
+            const port = typeof address === 'object' && address ? address.port : 0;
+            server.close(() => resolve(port));
+        });
+    });
+}

package/dist/build/wrangler/process.d.ts

@@ -0,0 +1,17 @@
+import type { ChildProcess } from 'node:child_process';
+export declare function wranglerCommand(projectDir: string, runtime?: {
+    readonly executable: string;
+    readonly bun: boolean;
+}): {
+    cmd: string;
+    prefix: string[];
+};
+/** Keep Wrangler CLI diagnostic logs inside the generated project state. */
+export declare function wranglerProcessEnv(projectDir: string): NodeJS.ProcessEnv;
+export declare function runCapture(cmd: string, args: string[], cwd: string, onLog?: (line: string) => void, signal?: AbortSignal, redact?: (input: string) => string): Promise<{
+    code: number;
+    out: string;
+    stdout: string;
+    stderr: string;
+}>;
+export declare function stopChild(child: ChildProcess): Promise<void>;

package/dist/build/wrangler/process.js

@@ -0,0 +1,115 @@
+import { spawn } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join, resolve } from 'node:path';
+export function wranglerCommand(projectDir, runtime = {
+    executable: process.execPath,
+    bun: process.versions.bun !== undefined,
+}) {
+    const local = join(projectDir, 'node_modules', '.bin', 'wrangler');
+    if (existsSync(local))
+        return { cmd: local, prefix: [] };
+    const require = createRequire(import.meta.url);
+    const packagePath = require.resolve('wrangler/package.json');
+    const manifest = JSON.parse(readFileSync(packagePath, 'utf8'));
+    const executable = typeof manifest.bin === 'string' ? manifest.bin : manifest.bin?.wrangler;
+    if (!executable)
+        throw new TypeError('Installed Wrangler package has no wrangler executable.');
+    return {
+        cmd: runtime.bun ? 'node' : runtime.executable,
+        prefix: [resolve(dirname(packagePath), executable)],
+    };
+}
+/** Keep Wrangler CLI diagnostic logs inside the generated project state. */
+export function wranglerProcessEnv(projectDir) {
+    return {
+        ...process.env,
+        WRANGLER_SEND_METRICS: 'false',
+        WRANGLER_LOG_PATH: process.env.WRANGLER_LOG_PATH || resolve(projectDir, '.astrale', 'logs', 'wrangler'),
+    };
+}
+export function runCapture(cmd, args, cwd, onLog, signal, redact = (input) => input) {
+    if (signal?.aborted)
+        return Promise.reject(new Error('Wrangler process cancelled.'));
+    return new Promise((resolve, reject) => {
+        const child = spawn(cmd, args, {
+            cwd,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: wranglerProcessEnv(cwd),
+        });
+        let out = '';
+        let stdout = '';
+        let stderr = '';
+        let outputBytes = 0;
+        let terminating;
+        const timeout = setTimeout(() => terminate(new Error('Wrangler process timed out.')), 300_000);
+        const abort = () => terminate(new Error('Wrangler process cancelled.'));
+        signal?.addEventListener('abort', abort, { once: true });
+        let escalation;
+        const cleanup = () => {
+            clearTimeout(timeout);
+            if (escalation !== undefined)
+                clearTimeout(escalation);
+            signal?.removeEventListener('abort', abort);
+        };
+        function terminate(cause) {
+            if (terminating !== undefined)
+                return;
+            terminating = cause;
+            child.kill('SIGTERM');
+            escalation = setTimeout(() => {
+                if (child.exitCode === null && child.signalCode === null)
+                    child.kill('SIGKILL');
+            }, 1_000);
+        }
+        const onData = (buffer, stream) => {
+            outputBytes += buffer.byteLength;
+            if (outputBytes > 1024 * 1024) {
+                terminate(new Error('Wrangler process exceeded its output limit.'));
+                return;
+            }
+            const chunk = buffer.toString();
+            out += chunk;
+            if (stream === 'stdout')
+                stdout += chunk;
+            else
+                stderr += chunk;
+        };
+        child.stdout?.on('data', (buffer) => onData(buffer, 'stdout'));
+        child.stderr?.on('data', (buffer) => onData(buffer, 'stderr'));
+        child.on('exit', (code) => {
+            cleanup();
+            if (terminating !== undefined)
+                reject(terminating);
+            else {
+                const safe = redact(out);
+                for (const line of safe.split('\n'))
+                    if (line.trim())
+                        onLog?.(line);
+                resolve({
+                    code: code ?? 1,
+                    out: safe,
+                    stdout: redact(stdout),
+                    stderr: redact(stderr),
+                });
+            }
+        });
+        child.on('error', (cause) => {
+            cleanup();
+            reject(terminating ?? cause);
+        });
+    });
+}
+export async function stopChild(child) {
+    if (child.exitCode !== null)
+        return;
+    await new Promise((resolve) => {
+        child.on('exit', () => resolve());
+        child.kill('SIGTERM');
+        setTimeout(() => {
+            if (child.exitCode === null)
+                child.kill('SIGKILL');
+            resolve();
+        }, 4000).unref?.();
+    });
+}

package/dist/build/wrangler/secrets.d.ts

@@ -0,0 +1,6 @@
+export declare function withSecretsFile<Result>(secrets: Readonly<Record<string, string>>, operation: (path?: string) => Promise<Result>): Promise<Result>;
+export declare function createSecretEnvironment(secrets: Readonly<Record<string, string>>): Promise<{
+    readonly path: string;
+    remove(): Promise<void>;
+} | undefined>;
+export declare function secretRedactor(secrets: Readonly<Record<string, string>>): (input: string) => string;