@rivi-software/workers-bundle-check 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 RIVI Software
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,258 @@
-# Temporary Holding Version
+# @rivi-software/workers-bundle-check
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![npm version](https://img.shields.io/npm/v/@rivi-software/workers-bundle-check?label=npm&color=0b6b3a)](https://www.npmjs.com/package/@rivi-software/workers-bundle-check) [![CI status](https://img.shields.io/github/actions/workflow/status/rivi-software/tools/ci.yml?branch=main&label=CI)](https://github.com/rivi-software/tools/actions/workflows/ci.yml) [![MIT License](https://img.shields.io/badge/license-MIT-0b6b3a)](LICENSE)
+
+Fails CI on what a Cloudflare Worker's build should not contain.
+
+`wrangler check startup` reports a Worker's size and its startup time, but nothing checks what is inside the build. These mistakes ship without anyone noticing:
+- **A module that does not belong in the Worker.** A dev-only mock, a browser-only library or a whole icon set gets pulled in through a chain of imports. The build stays under the size limit, so nothing fails.
+- **Source maps served publicly.** The build writes `.map` files into the static assets directory. Unless `.assetsignore` leaves them out, anyone can download the original source.
+- **A secret inlined at build time.** A `define` reads an API key or a private key from the environment and writes it into the code.
+
+This package checks a build for all three, from the command line or from a script.
+
+## Install
+
+```bash
+npm install --save-dev @rivi-software/workers-bundle-check
+```
+
+It needs Node 22 or later, and runs after the build, not in the Worker. A configuration file in TypeScript needs Node 22.18 or later. The package is ESM only.
+
+It reads the build's output, so it works with any bundler that writes source maps: the Cloudflare Vite plugin, `wrangler deploy --outdir`, or esbuild of your own. The tests build Workers with Vite 8 (Rolldown) and with Wrangler 4.156.2 (esbuild).
+
+## Usage
+
+Run it after the build, with a configuration file in the project's directory:
+
+```ts
+// workers-bundle-check.config.ts
+import type { WorkerBundleCheckOptions } from "@rivi-software/workers-bundle-check";
+
+export default {
+  serverDir: "dist/server",
+  assetsDir: "dist/client",
+  forbidden: [
+    { module: "msw", reason: "test-only" },
+    { module: "**/icons/all.js", reason: "import single icons" },
+    { marker: "__DEV_TOOLBAR__", reason: "dev-only code" },
+  ],
+} satisfies WorkerBundleCheckOptions;
+```
+
+```json
+{
+  "scripts": {
+    "build": "vite build && workers-bundle-check"
+  }
+}
+```
+
+The command looks for `workers-bundle-check.config.ts`, `.mts`, `.js`, `.mjs` or `.json` in the current directory, and takes the first it finds. `--config <file>` names another one. `--server <dir>` and `--assets <dir>` override `serverDir` and `assetsDir`, and are enough on their own for the source map and secret checks:
+
+```bash
+npx workers-bundle-check --server dist/server --assets dist/client
+```
+
+Or call the function from a build script:
+
+```ts
+import { checkWorkerBundle } from "@rivi-software/workers-bundle-check";
+
+await checkWorkerBundle({
+  serverDir: "dist/server",
+  assetsDir: "dist/client",
+  forbidden: [{ module: "msw", reason: "test-only" }],
+});
+```
+
+When it finds a problem, the command prints the problems and exits with `1`, and the function rejects with a `WorkerBundleCheckError`. Its message lists the problems, one per line:
+
+```text
+The Worker bundle check found 3 problems:
+  dist/server/index.js holds 14 modules (52.1 kB) that "msw" forbids: test-only. The largest is node_modules/.pnpm/msw@2.7.0/node_modules/msw/lib/core/index.mjs (12.0 kB).
+  dist/client/assets/index-4f2a.js.map is a source map Wrangler would serve: leave it out with dist/client/.assetsignore, or delete it before the deploy.
+  dist/client/assets/index-4f2a.js:1 holds a value shaped like a Stripe secret key (fingerprint 9c1e5b0a7d3f2e48).
+```
+
+When it finds none, the function resolves to a report of what it read, and the command prints it.
+
+### Options
+
+| Option | What | Default |
+| --- | --- | --- |
+| `serverDir` | The Worker's build output: the directory with its JavaScript and source maps | (required) |
+| `assetsDir` | The static assets directory, the one `assets.directory` names in the Wrangler config | none: no assets |
+| `forbidden` | The modules and markers the Worker must not carry | `[]` |
+| `allowedSecrets` | Findings of secrets that are known to be safe | `[]` |
+| `secretPatterns` | Kinds of secret to look for besides the built-in ones | `[]` |
+| `cwd` | The directory paths are relative to, and module paths are named from | `process.cwd()` |
+
+With the Cloudflare Vite plugin, `serverDir` is the directory that holds the build's `wrangler.json`, such as `dist/server` in a TanStack Start app, and `assetsDir` is the one its `assets.directory` names, such as `dist/client`. With `wrangler deploy --outdir dist`, `serverDir` is `dist`, and `assetsDir` is the directory the Wrangler config's `assets.directory` names.
+
+## Forbidden modules and markers
+
+A rule names a module, a marker or both, and says why. The Worker breaks it when it holds either.
+
+```ts
+forbidden: [
+  // A package, wherever it is installed: msw's every module.
+  { module: "msw", reason: "test-only" },
+  // A glob over module paths.
+  { module: "src/mocks/**", reason: "dev-only" },
+  { module: "**/icons/all.js", reason: "import single icons" },
+  // A regular expression over module paths.
+  { module: /\/browser\//, reason: "browser-only code" },
+  // A string the code must not contain, such as one only dev code has.
+  { marker: "__DEV_TOOLBAR__", reason: "dev-only code" },
+  // Both: the package, or its marker where no source map names it.
+  { module: "yjs", marker: "Yjs was already imported", reason: "the editor loads it lazily" },
+],
+```
+
+- **A package name**, such as `msw` or `@faker-js/faker`, names every module in that package, wherever it is installed. That covers npm's and pnpm's layouts, and a package nested in another.
+- **Any other string** is a glob, matched against the module's path. A module path is relative to `cwd`: `src/server.ts`, or `node_modules/.pnpm/msw@2.7.0/node_modules/msw/lib/core/index.mjs`. `**` matches dot directories such as `.pnpm` too. A module outside `cwd`, such as one in a monorepo's root `node_modules`, is named with its leading `../`, but matched without it. A leading `./` in a glob is left out, so `./src/mocks/**` and `src/mocks/**` are the same. To name a directory named like a package, such as `src`, write `src/**`.
+- **A regular expression** is matched against the same path.
+- **A marker** is a string or a regular expression that the Worker's code must not contain. It finds code that no source map names, such as a module the bundler inlined, or a bundle built without maps. Names are minified away, so pick a string literal.
+
+The report names each file that breaks a rule, how many of the rule's modules it holds, their size, and the largest one.
+
+### Rules that guard nothing
+
+A rule whose module or marker no longer exists guards nothing. When a library renames `icons/all.js`, the rule against it matches nothing, and the whole icon set could ship again without a failure. The check therefore fails on a rule that matches nothing the project has:
+- **A package name**, when the package is not installed where Node would find it from `cwd`. That includes a monorepo's root `node_modules`, and pnpm's store.
+- **A glob or a regular expression**, when no file matches it. It looks at the files under `cwd`, and at those in the `node_modules` of each directory above it, following symlinks.
+- **A marker with a module pattern**, when none of the files the pattern matches contains it.
+- **A marker on its own**, when no file of the project under `cwd`, outside `node_modules`, contains it. For a marker only a package has, name the package as the rule's module too.
+
+What the Worker holds is never stale. The check walks the files only for a rule the Worker does not match, and stops as soon as every rule has matched something.
+
+## Served source maps
+
+The check reads the assets directory's `.assetsignore` the way Wrangler does: in gitignore syntax, with the [`ignore`](https://www.npmjs.com/package/ignore) package Wrangler uses. It leaves out `.assetsignore`, `_headers` and `_redirects` as Wrangler does. It then fails on:
+- each `.map` file Wrangler would upload
+- each served script or style that carries its source map inline, as a `data:` URL
+
+Any `.assetsignore` that leaves the maps out passes, such as `*.map`, `**/*.map` or `assets/`. A script that names a map Wrangler leaves out is fine: the map is not there to load.
+
+## Values shaped like secrets
+
+The check looks for these key formats in two places:
+- the Worker's scripts, HTML, JSON, text, XML and SVG files
+- every file the assets would serve, a stray `.env` included, but source maps and binary files such as images and fonts
+
+| Name | Shape |
+| --- | --- |
+| private key | `-----BEGIN … PRIVATE KEY-----` and the key after it |
+| AWS access key ID | `AKIA…`, `ASIA…` (not AWS's `…EXAMPLE` IDs) |
+| GitHub token | `ghp_…`, `gho_…`, `ghu_…`, `ghs_…`, `ghr_…`, `github_pat_…` |
+| GitLab token | `glpat-…` |
+| npm token | `npm_…` |
+| Slack token | `xoxb-…`, `xoxp-…` and the other `xox` tokens |
+| Slack webhook URL | `hooks.slack.com/services/…` |
+| Stripe secret key | `sk_live_…`, `sk_test_…`, `rk_live_…`, `rk_test_…` |
+| webhook signing secret | `whsec_…` (Stripe, Svix, Clerk) |
+| OpenAI API key | `sk-…T3BlbkFJ…` |
+| Anthropic API key | `sk-ant-api03-…`, `sk-ant-admin01-…` |
+| PostHog personal API key | `phx_…` |
+| PostHog project secret key | `phs_…` |
+| Supabase secret key | `sb_secret_…` |
+| SendGrid API key | `SG.….…` |
+| Shopify access token | `shpat_…`, `shpca_…`, `shppa_…`, `shpss_…` |
+| Linear API key | `lin_api_…` |
+| Hugging Face token | `hf_…` |
+
+Keys that apps ship to browsers on purpose are not in the list: Stripe's publishable `pk_` keys, PostHog's `phc_` project tokens, Supabase's publishable keys, and Google's `AIza` API keys. Add other formats with `secretPatterns`:
+
+```ts
+secretPatterns: [{ name: "internal service token", pattern: /\bsvc_[A-Za-z0-9]{32}\b/ }],
+```
+
+The report never prints a value. It gives the file, the line, the module the value comes from when the file has a source map, and a fingerprint: the first 16 hexadecimal digits of the value's SHA-256. The fingerprint stays the same from build to build, while the names of hashed chunks change.
+
+### Allowed secrets
+
+Some findings are safe, such as an example key a library ships. Allow each one by its fingerprint, by the module it comes from, or by both, and say why:
+
+```ts
+allowedSecrets: [
+  { fingerprint: "9c1e5b0a7d3f2e48", reason: "Stripe's example key, in our docs page" },
+  { module: "node-forge", reason: "its test vectors" },
+],
+```
+
+`module` takes the same patterns as a forbidden rule. An allowed entry that matches no finding fails the check, so the list stays current.
+
+## How it works
+
+- **Which modules the Worker holds.** It reads every `.js`, `.mjs` and `.cjs` file in `serverDir` with its source map. It uses the map the file's `sourceMappingURL` names, inline or in a file, or else `<file>.map` beside it, which is where Vite's `hidden` maps are. A module counts when its mappings cover code in the file. A module the bundler tree-shook away is not in the map, or maps only to the call that initialized it (`init_x()`), which the check leaves out. The size it reports is the length of the module's code in the file.
+- **Module paths.** It resolves each source from the map's directory and `sourceRoot`, and names it by its real path, as bundlers do. A package that pnpm links into `node_modules` is named by its path in pnpm's store. Wrangler writes a `sourceRoot` that its own sources do not use. When no file is where `sourceRoot` points, the check looks for the source without it.
+- **Matching `.assetsignore`.** It builds the matcher Wrangler builds in `createAssetsIgnoreFunction` (workers-sdk, `packages/workers-shared/utils/helpers.ts`), and tests each file's path in the assets directory against it. The tests compare its result with what `wrangler deploy --dry-run` leaves out, for a dozen `.assetsignore` files.
+
+## Limits
+
+- **The modules need source maps.** When a rule names a module and a Worker file has no source map, the check fails, because it cannot see what the file holds. Markers need no maps. Index maps (with `sections`) are not read.
+- **It names the module, not the import that pulled it in.** Source maps do not record imports. To find the chain, use the bundler's own analysis, such as esbuild's metafile or a bundle visualizer.
+- **Rules check the Worker.** The browser's code in `assetsDir` is checked for source maps and secrets only.
+- **Installed is not imported.** In a monorepo, a package installed in the root counts for the stale check even when this app does not depend on it.
+- **Yarn Plug'n'Play.** Its packages sit in zip files, which the stale check cannot see into, so it calls a package rule stale unless the Worker holds the package.
+- **Secrets have to have a shape.** A key without a prefix, such as an AWS secret access key, a Cloudflare API token or a password, has no shape to find. Neither does a value that the build encodes or splits. The check complements a secret scanner on the source, and does not replace it.
+- **`assetsDir` is not read from the Wrangler config.** Pass it, or the assets are not checked at all.
+
+## Exports
+
+From `@rivi-software/workers-bundle-check`:
+
+| Export | What |
+| --- | --- |
+| `checkWorkerBundle(options)` | Checks the build: resolves to a `WorkerBundleReport`, or rejects with a `WorkerBundleCheckError` |
+| `WorkerBundleCheckError` | The problems: `report`, with `report.problems`; its message lists them |
+| `SECRET_PATTERNS` | The built-in secret patterns: `{ name, pattern }[]` |
+| Types | `WorkerBundleCheckOptions`, `WorkerBundleReport`, `WorkerBundleProblem`, `ForbiddenRule`, `ModulePattern`, `AllowedSecret`, `SecretPattern`, `BundledModule` |
+
+A `WorkerBundleReport` holds `serverDir`, `workerFiles`, `modules` (how many the maps name), `assetsDir`, `servedAssets`, `ignoredAssets`, `allowedSecrets` (how many findings the allow-list let through) and `problems`. Each problem has a `kind` and a one-line `message`:
+
+| `kind` | Fields |
+| --- | --- |
+| `forbidden-module` | `rule`, `file`, `modules` (`{ path, bytes }`, largest first) |
+| `forbidden-marker` | `rule`, `file` |
+| `stale-rule` | `rule`, `part` (`module` or `marker`) |
+| `missing-source-map` | `file` |
+| `served-source-map` | `file` |
+| `inline-source-map` | `file` |
+| `secret` | `file`, `line`, `name`, `fingerprint`, `module` when known |
+| `stale-allowed-secret` | `allowed` |
+
+The `workers-bundle-check` command exits with `0` when the build passes, with `1` when it finds a problem or cannot read the build, and with `2` on a usage error. `workers-bundle-check --help` prints its options.
+
+## Development
+
+The tests in `tests/` cover:
+- reading source maps: the mappings, a dropped module's residue, hidden and inline maps, and Wrangler's `sourceRoot`
+- matching package names, globs and regular expressions against npm's and pnpm's layouts
+- the walk over a monorepo's files, through symlinks
+- the agreement with `wrangler deploy --dry-run` on which assets `.assetsignore` leaves out
+- each secret pattern, and keys meant to be public
+- the whole check on Workers built with Vite (Rolldown) and with Wrangler (esbuild)
+- the command and its configuration files
+
+They build and run locally, and call no Cloudflare API. In this directory, run `pnpm run test`, `pnpm run check` and `pnpm run build`.
+
+## License
+
+Licensed under the [MIT License](LICENSE). Copyright © 2026 RIVI Software.
+
+<br>
+
+<p align="center">
+  <a href="https://rivi.software">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/rivi-software/tools/main/assets/rivi-mark-on-dark.svg">
+      <img src="https://raw.githubusercontent.com/rivi-software/tools/main/assets/rivi-mark.svg" alt="RIVI Software" width="36" height="36">
+    </picture>
+  </a>
+</p>
+
+<p align="center">
+  <sub>Part of <a href="https://github.com/rivi-software/tools#readme">RIVI tools</a>, the packages <a href="https://rivi.software">RIVI Software</a> builds its own apps with.</sub>
+</p>

package/dist/assets.d.ts

@@ -0,0 +1,35 @@
+/** A file in the assets directory. */
+export type AssetFile = {
+    /** Its path in the assets directory, with `/` between segments: the one `.assetsignore` matches. */
+    asset: string;
+    /** Its absolute path. */
+    file: string;
+};
+/** The assets directory's files, split into those Wrangler uploads and those it leaves out. */
+export type Assets = {
+    served: AssetFile[];
+    ignored: AssetFile[];
+};
+/**
+ * Whether Wrangler leaves an asset out of the upload, for the `.assetsignore` text (undefined
+ * when there is none). Wrangler matches each path in the directory with the `ignore` package
+ * (gitignore syntax), against the file's lines and its own patterns for `.assetsignore`,
+ * `_redirects` and `_headers` (workers-sdk, packages/workers-shared/utils/helpers.ts,
+ * `createAssetsIgnoreFunction`). This builds the same matcher.
+ */
+export declare function assetsIgnoreMatcher(assetsIgnore: string | undefined): (asset: string) => boolean;
+/** The files of the assets directory, as Wrangler's upload sees them. */
+export declare function readAssets(dir: string): Promise<Assets>;
+/** A source map the assets would serve. */
+export type ServedSourceMap = {
+    kind: "served-source-map" | "inline-source-map";
+    /** The asset's absolute path. */
+    file: string;
+};
+/** Whether a script or style ends with its source map inline. */
+export declare function hasInlineSourceMap(code: string): boolean;
+/**
+ * The source maps among the served assets: a `.map` file, or a script or style that carries its
+ * map inline. `text` reads a served script or style.
+ */
+export declare function findServedSourceMaps(served: readonly AssetFile[], text: (file: string) => Promise<string>): Promise<ServedSourceMap[]>;

package/dist/assets.js

@@ -0,0 +1,63 @@
+import { readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import ignore from "ignore";
+import { posixRelative } from "./source-map.js";
+/**
+ * Whether Wrangler leaves an asset out of the upload, for the `.assetsignore` text (undefined
+ * when there is none). Wrangler matches each path in the directory with the `ignore` package
+ * (gitignore syntax), against the file's lines and its own patterns for `.assetsignore`,
+ * `_redirects` and `_headers` (workers-sdk, packages/workers-shared/utils/helpers.ts,
+ * `createAssetsIgnoreFunction`). This builds the same matcher.
+ */
+export function assetsIgnoreMatcher(assetsIgnore) {
+    const patterns = ["/.assetsignore", "/_redirects", "/_headers"];
+    if (assetsIgnore !== undefined)
+        patterns.push(...assetsIgnore.split("\n"));
+    const matcher = ignore.default().add(patterns);
+    return (asset) => matcher.ignores(asset);
+}
+/** The files of the assets directory, as Wrangler's upload sees them. */
+export async function readAssets(dir) {
+    const entries = await readdir(dir, { recursive: true, withFileTypes: true });
+    const assetsIgnore = await readFile(path.join(dir, ".assetsignore"), "utf8").catch((error) => {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    });
+    const ignored = assetsIgnoreMatcher(assetsIgnore);
+    const assets = { served: [], ignored: [] };
+    for (const entry of entries) {
+        if (!entry.isFile())
+            continue;
+        const file = path.join(entry.parentPath, entry.name);
+        const asset = { asset: posixRelative(dir, file), file };
+        (ignored(asset.asset) ? assets.ignored : assets.served).push(asset);
+    }
+    const order = (a, b) => a.asset < b.asset ? -1 : a.asset > b.asset ? 1 : 0;
+    assets.served.sort(order);
+    assets.ignored.sort(order);
+    return assets;
+}
+/** Scripts and styles, which can carry a source map inline. */
+const SCRIPT_OR_STYLE = /\.(?:[cm]?js|css)$/i;
+/** The `sourceMappingURL` comment that ends a file and holds the map itself. */
+const INLINE_SOURCE_MAP = /^\/[/*][#@] sourceMappingURL=data:[^\s*]*[\s*/]*$/;
+/** Whether a script or style ends with its source map inline. */
+export function hasInlineSourceMap(code) {
+    const at = code.lastIndexOf("sourceMappingURL=data:");
+    return at >= 4 && INLINE_SOURCE_MAP.test(code.slice(at - 4));
+}
+/**
+ * The source maps among the served assets: a `.map` file, or a script or style that carries its
+ * map inline. `text` reads a served script or style.
+ */
+export async function findServedSourceMaps(served, text) {
+    const found = [];
+    for (const { asset, file } of served) {
+        if (/\.map$/i.test(asset))
+            found.push({ kind: "served-source-map", file });
+        else if (SCRIPT_OR_STYLE.test(asset) && hasInlineSourceMap(await text(file)))
+            found.push({ kind: "inline-source-map", file });
+    }
+    return found;
+}

package/dist/check.d.ts

@@ -0,0 +1,103 @@
+import { type BundledModule, type ForbiddenRule } from "./forbidden.js";
+import { type AllowedSecret, type SecretPattern } from "./secrets.js";
+export type WorkerBundleCheckOptions = {
+    /**
+     * The Worker's build output: the directory with its JavaScript modules and their source maps,
+     * such as `dist/server`. Relative to `cwd`.
+     */
+    serverDir: string;
+    /**
+     * The Worker's static assets directory, the one `assets.directory` names in the Wrangler
+     * config, such as `dist/client`. Relative to `cwd`. Leave it out for a Worker without assets.
+     */
+    assetsDir?: string;
+    /** The modules and markers the Worker must not carry. */
+    forbidden?: readonly ForbiddenRule[];
+    /** Findings of values shaped like secrets that are known to be safe. */
+    allowedSecrets?: readonly AllowedSecret[];
+    /** Kinds of secret to look for besides {@link SECRET_PATTERNS}. */
+    secretPatterns?: readonly SecretPattern[];
+    /**
+     * The directory paths are relative to, and module paths are named from: the project's, with
+     * its `node_modules`. Default `process.cwd()`.
+     */
+    cwd?: string;
+};
+/** A problem the check found. Paths are relative to `cwd`, with `/` between segments. */
+export type WorkerBundleProblem = ({
+    /** A Worker file holds modules a rule forbids, largest first. */
+    kind: "forbidden-module";
+    rule: ForbiddenRule;
+    file: string;
+    modules: BundledModule[];
+} | {
+    /** A Worker file contains a forbidden marker. */
+    kind: "forbidden-marker";
+    rule: ForbiddenRule;
+    file: string;
+} | {
+    /** A rule's module pattern or marker matches nothing the project has. */
+    kind: "stale-rule";
+    rule: ForbiddenRule;
+    part: "module" | "marker";
+} | {
+    /** A Worker file has no source map, so the rules cannot see its modules. */
+    kind: "missing-source-map";
+    file: string;
+} | {
+    /** A `.map` file the assets would serve. */
+    kind: "served-source-map";
+    file: string;
+} | {
+    /** A script or style the assets would serve with its source map inline. */
+    kind: "inline-source-map";
+    file: string;
+} | {
+    /** A value shaped like a secret, in a Worker file or a served asset. */
+    kind: "secret";
+    file: string;
+    /** The pattern's name. */
+    name: string;
+    /** The first 16 hexadecimal digits of the value's SHA-256; the value is never reported. */
+    fingerprint: string;
+    line: number;
+    /** The module the value comes from, when the file has a source map. */
+    module?: string;
+} | {
+    /** An allowed secret that matches no finding. */
+    kind: "stale-allowed-secret";
+    allowed: AllowedSecret;
+}) & {
+    /** The problem in one line, for a report. */
+    message: string;
+};
+/** What the check read, and what it found. */
+export type WorkerBundleReport = {
+    /** The Worker's build output, as given. */
+    serverDir: string;
+    /** The Worker's JavaScript files. */
+    workerFiles: string[];
+    /** How many modules the Worker's source maps name. */
+    modules: number;
+    /** The assets directory, when one was given. */
+    assetsDir?: string;
+    /** How many files Wrangler would upload from the assets directory. */
+    servedAssets: number;
+    /** How many files its `.assetsignore` leaves out. */
+    ignoredAssets: number;
+    /** How many findings of secrets the allow-list let through. */
+    allowedSecrets: number;
+    problems: WorkerBundleProblem[];
+};
+/** Thrown by {@link checkWorkerBundle} when it finds problems: they are in `report.problems`. */
+export declare class WorkerBundleCheckError extends Error {
+    readonly report: WorkerBundleReport;
+    constructor(report: WorkerBundleReport);
+}
+/**
+ * Checks a Worker's build: no forbidden module or marker in the Worker, no source map among the
+ * assets Wrangler would serve, and no value shaped like a secret in either. Resolves to the
+ * report when it finds nothing; rejects with a {@link WorkerBundleCheckError} that lists the
+ * problems otherwise. Run it after the build.
+ */
+export declare function checkWorkerBundle(options: WorkerBundleCheckOptions): Promise<WorkerBundleReport>;