@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.4

package/dist/config-loader.d.ts

@@ -1,4 +1,11 @@
-import type { AppDeployment } from '@vibesdotdev/infra-core/deployment';
+import { type RuntimePath } from '@vibesdotdev/paths';
+import type { FileSystemAdapterInterface } from '@vibesdotdev/filesystem/interfaces/adapter';
+import { type AppDeployment } from '@vibesdotdev/infra-core/deployment';
+import { CapabilityError, composeChildEnv, type RuntimeRef } from '@vibesdotdev/kernel';
+import type { RuntimeExecution } from '@vibesdotdev/kernel/execution';
+import { findConfigFile } from './deployment-settings.ts';
+/** What evaluating a deployment config reads from the runtime it is handed. */
+export type ConfigEvaluationRuntime = Parameters<typeof composeChildEnv>[0] & Pick<RuntimeRef, 'query' | 'hasKind'>;
 export interface LoadedDeployment {
     configPath: string;
     appDir: string;
@@ -6,19 +13,59 @@ export interface LoadedDeployment {
     provider: string;
     raw: unknown;
     /**
-     * Canonical wrangler.jsonc render output, when the default export is a
-     * managed Cloudflare web-app deployment (see
-     * `@vibesdotdev/infra-cloudflare/regen`). `null` when the export isn't
-     * a managed deployment — used by the regen orchestrator to gate writes
-     * and the CI drift check.
+     * The provider artifact the deployment module rendered, through the
+     * renderer its provider's descriptor names; `null` when the provider renders
+     * none or no plugin registers it.
      */
-    wranglerJsoncString: string | null;
-    /** Mirrors `webAppDeployment.managed`; `false` when not a managed export. */
+    rendered: string | null;
+    /** The artifact local development reads, when the module renders one. */
+    localRendered: string | null;
+    /** The module opts into a generated, committed provider artifact. */
     managed: boolean;
-    /** Cloudflare Workers script name, when emitted by the managed export. */
-    workerName: string | null;
+    /** Whether the module renders a provider artifact under an environment. */
+    renders: boolean;
+    /** The provider's name for the deployed unit, when the module declares one. */
+    unitName: string | null;
 }
-export declare function resolveAppDir(input: string): string;
-export declare function findConfigFile(appDir: string): string;
-export declare function loadDeploymentConfig(appDir: string): Promise<LoadedDeployment>;
+/** The host I/O one load resolves once: host-owned path probes plus path mechanics. */
+export interface ConfigLoadHost {
+    readonly files: FileSystemAdapterInterface;
+    readonly paths: RuntimePath;
+}
+export declare function resolveConfigLoadHost(runtime: RuntimeRef): Promise<ConfigLoadHost>;
+export declare class NonDeployableDeploymentConfigError extends CapabilityError {
+    readonly appId: string | undefined;
+    /** The marker's own human-readable reason, overriding the taxonomy code. */
+    readonly reason: string;
+    constructor(input: {
+        appId?: string;
+        reason: string;
+        configPath?: string;
+    });
+}
+/**
+ * The app directory a deployment config is loaded from. Callers resolve an
+ * operator's relative argument against the invocation cwd first
+ * (`requireRuntimeCwd(runtime)`); a relative path here is a caller
+ * error, never resolved against the process cwd or an environment variable.
+ */
+export declare function resolveAppDir(host: ConfigLoadHost, input: string): Promise<string>;
+export { findConfigFile };
+/**
+ * The keys a deployment module reads while rendering (metadata identifiers,
+ * never secret values): every registered deployment provider's declared
+ * `projectionKeys`, so the loader names no provider.
+ */
+export declare function deploymentProjectionKeys(runtime: Pick<RuntimeRef, 'hasKind' | 'query'>): string[];
+export declare function loadDeploymentConfig(appDir: string, options: {
+    /** The runtime a fallback or fresh-process evaluation runs a child of. */
+    runtime: RuntimeRef;
+    freshProcess?: boolean;
+    execution?: RuntimeExecution;
+    /**
+     * The resolved Cloudflare projection, as data, for a fresh-process
+     * evaluation. The child sees exactly these projection keys.
+     */
+    projectionEnvironment?: Readonly<Record<string, string>>;
+}): Promise<LoadedDeployment>;
 //# sourceMappingURL=config-loader.d.ts.map

package/dist/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../src/config-loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAExE,MAAM,WAAW,gBAAgB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,aAAa,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,OAAO,CAAC;IACb;;;;;;OAMG;IACH,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,6EAA6E;IAC7E,OAAO,EAAE,OAAO,CAAC;IACjB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAID,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUnD;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQrD;AAmHD,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgBpF"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../src/config-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAE7F,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAS/F,OAAO,EAAE,eAAe,EAAE,eAAe,EAAyC,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC/H,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGtE,OAAO,EAAE,cAAc,EAA4C,MAAM,0BAA0B,CAAC;AAOpG,+EAA+E;AAC/E,MAAM,MAAM,uBAAuB,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,SAAS,CAAC,CAAC;AAEpH,MAAM,WAAW,gBAAgB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,aAAa,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,OAAO,CAAC;IACb;;;;OAIG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,yEAAyE;IACzE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,qEAAqE;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;CAC5B;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAOxF;AAED,qBAAa,kCAAmC,SAAQ,eAAe;IACtE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,4EAA4E;IAC5E,SAAkB,MAAM,EAAE,MAAM,CAAC;gBAErB,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;CAY1E;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBxF;AAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAwN1B;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,MAAM,EAAE,CAOjG;AAqGD,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IACR,0EAA0E;IAC1E,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B;;;OAGG;IACH,qBAAqB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACzD,GACC,OAAO,CAAC,gBAAgB,CAAC,CAqF3B"}

package/dist/config-loader.js

@@ -1,135 +1,402 @@
-import { resolve, isAbsolute, join, dirname } from 'node:path';
-import { existsSync, statSync } from 'node:fs';
-import { spawn } from 'node:child_process';
-const CONFIG_FILENAMES = ['deployment.config.ts', 'deployment.config.js', 'deployment.config.mjs'];
-export function resolveAppDir(input) {
-    const absolute = isAbsolute(input) ? input : resolve(process.cwd(), input);
-    if (!existsSync(absolute)) {
-        throw new Error(`Path does not exist: ${absolute}`);
-    }
-    const stat = statSync(absolute);
-    if (!stat.isDirectory()) {
-        throw new Error(`Expected directory, got file: ${absolute}`);
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
     }
-    return absolute;
+    return path;
+};
+import { getRuntimePath } from '@vibesdotdev/paths';
+import { resolveFileSystemAdapter } from '@vibesdotdev/filesystem/client/resolve-adapter';
+import { projectWebApp } from '@vibesdotdev/infra-core';
+import { validateAppDeployment } from '@vibesdotdev/infra-core/deployment';
+import { DeploymentModuleExportSchema, DeploymentModuleRenderSchema, DeploymentProviderDescriptorSchema } from '@vibesdotdev/infra-core/kinds';
+import { CapabilityError, composeChildEnv, settle, settleNow } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { resolveRuntimeExecution } from "./runtime-execution.js";
+import { findConfigFile, readDeploymentSettings, UNIT_CONFIG_FILE } from "./deployment-settings.js";
+import { composeDeclaredDeploymentProvider } from "./declared-provider.js";
+function failureMessage(failure) {
+    return failure instanceof Error ? failure.message : failure.description;
+}
+export async function resolveConfigLoadHost(runtime) {
+    return {
+        // The app directory is named by the operator, not by the caller's
+        // workspace binding, so its probes go through the host-owned view.
+        files: await resolveFileSystemAdapter(runtime, { binding: false }),
+        paths: await getRuntimePath(runtime)
+    };
 }
-export function findConfigFile(appDir) {
-    for (const name of CONFIG_FILENAMES) {
-        const candidate = join(appDir, name);
-        if (existsSync(candidate))
-            return candidate;
+export class NonDeployableDeploymentConfigError extends CapabilityError {
+    appId;
+    /** The marker's own human-readable reason, overriding the taxonomy code. */
+    reason;
+    constructor(input) {
+        super(`deployment.config${input.configPath ? ` in ${input.configPath}` : ''} is intentionally not deployable: ${input.reason}`, 'INVALID_INPUT', {
+            reason: 'non-deployable-deployment-config',
+            details: { appId: input.appId ?? null, configPath: input.configPath ?? null }
+        });
+        this.appId = input.appId;
+        this.reason = input.reason;
     }
-    throw new Error(`No deployment config found in ${appDir}. Expected one of: ${CONFIG_FILENAMES.join(', ')}`);
+}
+/**
+ * The app directory a deployment config is loaded from. Callers resolve an
+ * operator's relative argument against the invocation cwd first
+ * (`requireRuntimeCwd(runtime)`); a relative path here is a caller
+ * error, never resolved against the process cwd or an environment variable.
+ */
+export async function resolveAppDir(host, input) {
+    if (!host.paths.isAbsolute(input)) {
+        throw new CapabilityError(`App directory must be absolute: ${input}`, 'INVALID_INPUT', {
+            reason: 'path-relative',
+            details: { path: input }
+        });
+    }
+    const absolute = host.paths.resolve(input);
+    const stat = await host.files.stat(absolute);
+    if (stat.kind !== 'directory') {
+        throw new CapabilityError(`Expected directory, got file: ${absolute}`, 'INVALID_INPUT', {
+            reason: 'not-a-directory',
+            details: { path: absolute }
+        });
+    }
+    return absolute;
+}
+export { findConfigFile };
+/** The shape of an export the evaluator accepts: a record of arbitrary values. */
+const ConfigExportRecordSchema = z.record(z.string(), z.unknown());
+/** A non-deployable marker: `deployable: false` plus a reason, optional appId. */
+const NonDeployableMarkerSchema = z.object({
+    deployable: z.boolean(),
+    reason: z.string(),
+    appId: z.string().optional()
+}).loose();
+/**
+ * The shape the load contract returns. SAFETY: appId presence and the provider
+ * string are checked by the caller; the full AppDeployment shape is validated
+ * by the owning infra-core schema when the provider projection is built
+ * (createAppDeployment), exactly as before structured admission here.
+ */
+function asAppDeployment(value) {
+    // SAFETY: the load contract checks appId presence and the provider string
+    // before this cast; the full AppDeployment shape is validated by the owning
+    // infra-core schema when the provider projection is built
+    // (createAppDeployment), exactly as before structured admission here.
+    return value;
 }
 function extractDeployment(raw) {
-    if (!raw || typeof raw !== 'object') {
+    const record = ConfigExportRecordSchema.safeParse(raw);
+    if (!record.success) {
         throw new Error('deployment.config default export must be an object');
     }
-    const record = raw;
-    const deployment = (record.deployment ?? record);
-    if (!deployment || typeof deployment !== 'object' || !('appId' in deployment)) {
+    const nonDeployable = extractNonDeployableMarker(record.data);
+    if (nonDeployable) {
+        throw new NonDeployableDeploymentConfigError(nonDeployable);
+    }
+    const rawCandidate = record.data.deployment ?? record.data;
+    const candidate = ConfigExportRecordSchema.safeParse(rawCandidate);
+    if (!candidate.success) {
         throw new Error('deployment.config must export an AppDeployment (or { deployment })');
     }
-    const provider = deployment.provider;
-    if (!provider || typeof provider !== 'string') {
+    if (!('appId' in candidate.data)) {
+        throw new Error('deployment.config must export an AppDeployment (or { deployment })');
+    }
+    const provider = z.string().safeParse(candidate.data.provider);
+    if (!provider.success || provider.data.length === 0) {
         throw new Error('deployment.provider is required');
     }
-    return { deployment: deployment, provider };
+    return { deployment: asAppDeployment(candidate.data), provider: provider.data };
+}
+function extractNonDeployableMarker(raw) {
+    const marker = NonDeployableMarkerSchema.safeParse(raw.deployList ?? raw.deploymentList);
+    if (!marker.success || marker.data.deployable !== false)
+        return null;
+    if (marker.data.reason.length === 0) {
+        throw new Error('non-deployable deployment.config marker requires a non-empty reason');
+    }
+    const appId = marker.data.appId;
+    return {
+        appId: appId !== undefined && appId.length > 0 ? appId : undefined,
+        reason: marker.data.reason
+    };
+}
+/** A module whose provider renders nothing (or is not composed here). */
+const NO_RENDER = { managed: false, renders: false, rendered: null, localRendered: null, unitName: null };
+/** Each registered provider's renderer, by provider id. */
+function deploymentRenderers(runtime) {
+    const renderers = new Map();
+    if (!runtime.hasKind('infra/deployment-provider'))
+        return renderers;
+    for (const descriptor of runtime.query('infra/deployment-provider').descriptors()) {
+        const { id, renderer } = DeploymentProviderDescriptorSchema.parse(descriptor);
+        if (renderer)
+            renderers.set(id, { module: resolvedRendererModule(renderer.module), export: renderer.export });
+    }
+    return renderers;
 }
 /**
- * Walk upward from `from` looking for the workspace root (the directory
- * with a `bun.lock` or `package.json` containing `workspaces`).
+ * The renderer module as this process resolves it. A fresh child evaluates
+ * from the app's directory, which need not see the provider's package, so it
+ * imports the URL resolved here; an unresolvable specifier stays bare and
+ * refuses at import with its own module-resolution error.
  */
-function findWorkspaceRoot(from) {
-    let dir = from;
-    while (dir !== dirname(dir)) {
-        if (existsSync(join(dir, 'bun.lock')))
-            return dir;
-        const pkgPath = join(dir, 'package.json');
-        if (existsSync(pkgPath)) {
-            try {
-                const pkg = JSON.parse(require('node:fs').readFileSync(pkgPath, 'utf8'));
-                if (pkg.workspaces)
-                    return dir;
-            }
-            catch {
-                // not a parseable package.json; keep walking
-            }
-        }
-        dir = dirname(dir);
+function resolvedRendererModule(specifier) {
+    const resolved = settleNow(() => import.meta.resolve(specifier));
+    return resolved.ok ? resolved.value : specifier;
+}
+/** The provider an export declares, read leniently: admission refuses a malformed one later. */
+const DeclaredProviderSchema = z.object({ provider: z.string().min(1) }).loose();
+function declaredProvider(raw) {
+    const parsed = DeclaredProviderSchema.safeParse(raw.deployment ?? raw);
+    return parsed.success ? parsed.data.provider : null;
+}
+/** A renderer module's named export: a function, admitted before it is called. */
+const RendererModuleSchema = z.record(z.string(), z.unknown());
+const RendererFunctionSchema = z.custom((value) => value instanceof Function);
+async function renderInProcess(renderers, raw, projectionEnvironment) {
+    const provider = declaredProvider(raw);
+    const renderer = provider ? renderers.get(provider) : undefined;
+    if (!renderer)
+        return NO_RENDER;
+    const exported = DeploymentModuleExportSchema.safeParse(raw);
+    if (!exported.success) {
+        throw new CapabilityError('The deployment module exports values its provider renderer cannot read.', 'INVALID_INPUT', {
+            reason: 'deployment-module-export-invalid',
+            retryable: false,
+            details: { provider, fields: [...new Set(exported.error.issues.map((issue) => String(issue.path[0] ?? '(export)')))] }
+        });
     }
-    return from;
+    const mod = RendererModuleSchema.parse(await import(__rewriteRelativeImportExtension(renderer.module)));
+    const render = RendererFunctionSchema.parse(mod[renderer.export]);
+    return DeploymentModuleRenderSchema.parse(render(exported.data, projectionEnvironment));
 }
 /**
- * Load a deployment.config.ts via a `bun` subprocess from the workspace
- * root. Direct `await import(configPath)` doesn't work when the compiled
- * `vibes` binary runs against a workspace symlink — its bundled module
- * resolver has no idea where `@vibesdotdev/infra-core` lives. Subprocess
- * inherits the workspace's bun (path + node_modules), so workspace
- * package imports resolve as if you ran `bun apps/<app>/deployment.config.ts`
- * directly.
+ * Load a deployment.config.ts and produce its raw export + the provider
+ * artifact its provider's renderer renders.
+ *
+ * Preferred path: evaluate in-process, on the same entrypoint that invoked
+ * deploy, so PATH/env/module-resolution match. This works whenever the host
+ * runtime can resolve the config's workspace imports — i.e. running from
+ * source, under `bun` in CI, or at build time.
  *
- * The subprocess also tries to import `@vibesdotdev/infra-cloudflare/web-app`
- * and call `renderWranglerJsoncFromDefaultExport(raw)` so the canonical
- * wrangler.jsonc string is returned alongside the raw config. This lets
- * the regen orchestrator stay agnostic of provider-specific rendering.
- * If the import fails (SDK consumer without infra-cloudflare in their
- * tree), the render block is reported as `{ managed: false, rendered: null }`.
+ * Fallback path: the published CLI ships as a `bun build --compile` standalone
+ * binary, which has no on-disk `node_modules` and cannot resolve the bare
+ * workspace specifiers a `deployment.config.ts` imports (`infra-core/deployment`,
+ * `infra-cloudflare/web-app`). In-process evaluation throws a module-resolution
+ * error there. When — and only when — that happens, delegate evaluation to a
+ * workspace-aware `bun` subprocess anchored at the config directory, which has
+ * real `node_modules` resolution. The deployment object and provider render are
+ * plain serializable data, so they round-trip through JSON cleanly.
  */
-async function loadConfigViaSubprocess(configPath, workspaceRoot) {
-    return new Promise((resolvePromise, reject) => {
-        const script = `
-			const mod = await import(${JSON.stringify(configPath)});
-			const raw = mod.default ?? mod;
-			let render = { managed: false, rendered: null, workerName: null };
-			try {
-				const cf = await import('@vibesdotdev/infra-cloudflare/web-app');
-				if (typeof cf.renderWranglerJsoncFromDefaultExport === 'function') {
-					render = cf.renderWranglerJsoncFromDefaultExport(raw);
-				}
-			} catch (_) {
-				// infra-cloudflare not resolvable; leave render as the default null block.
-			}
-			process.stdout.write(JSON.stringify({ raw, render }));
-		`;
-        const child = spawn('bun', ['--bun', '-e', script], {
-            cwd: workspaceRoot,
-            stdio: ['ignore', 'pipe', 'pipe']
-        });
-        let stdout = '';
-        let stderr = '';
-        child.stdout?.on('data', (chunk) => (stdout += String(chunk)));
-        child.stderr?.on('data', (chunk) => (stderr += String(chunk)));
-        child.on('error', reject);
-        child.on('close', (code) => {
-            if (code !== 0) {
-                reject(new Error(`bun subprocess exited with code ${code}\nstderr: ${stderr.trim()}\nstdout: ${stdout.trim()}`));
-                return;
-            }
-            try {
-                resolvePromise(JSON.parse(stdout));
-            }
-            catch (err) {
-                reject(new Error(`Failed to parse subprocess JSON output: ${err instanceof Error ? err.message : String(err)}\nstdout: ${stdout.slice(0, 500)}`));
-            }
-        });
+async function loadConfigInCurrentRuntime(runtime, configPath, projectionEnvironment) {
+    const primary = await settle(() => loadConfigInProcess(deploymentRenderers(runtime), configPath, projectionEnvironment));
+    if (primary.ok)
+        return primary.value;
+    if (!isModuleResolutionError(primary.cause))
+        throw primary.cause;
+    // The fallback evaluates in a child of the caller's runtime.
+    return loadConfigViaWorkspaceBun(runtime, configPath, primary.cause, await resolveRuntimeExecution(runtime), projectionEnvironment);
+}
+async function loadConfigInProcess(renderers, configPath, projectionEnvironment) {
+    // The query re-imports the file so repeated loads in one process see config
+    // edits; a query on a plain path specifier is a fresh module in Bun.
+    const mod = await import(__rewriteRelativeImportExtension(`${configPath}?v=${crypto.randomUUID()}`));
+    const exported = ConfigExportRecordSchema.safeParse(mod);
+    const raw = exported.success && 'default' in exported.data ? exported.data.default : mod;
+    const admitted = ConfigExportRecordSchema.safeParse(raw);
+    const render = await renderInProcess(renderers, admitted.success ? admitted.data : {}, projectionEnvironment);
+    return { raw, render };
+}
+/** The error facts a module-resolution failure carries. */
+const ModuleResolutionErrorFactsSchema = z.object({
+    name: z.string().optional(),
+    code: z.string().optional(),
+    message: z.string().optional()
+}).loose();
+/**
+ * True when an import failed because a module/package could not be resolved —
+ * the signature of evaluating a workspace-coupled config in a runtime without
+ * on-disk `node_modules` (the compiled standalone binary). Other failures
+ * (syntax errors, thrown config logic) are NOT resolution errors and must
+ * propagate unchanged rather than be silently re-routed through a subprocess.
+ */
+function isModuleResolutionError(error) {
+    const facts = ModuleResolutionErrorFactsSchema.safeParse(error);
+    if (!facts.success)
+        return false;
+    if (facts.data.name === 'ResolveMessage')
+        return true;
+    if (facts.data.code === 'ERR_MODULE_NOT_FOUND')
+        return true;
+    return facts.data.message !== undefined && /Cannot find (module|package)/i.test(facts.data.message);
+}
+/**
+ * The keys a deployment module reads while rendering (metadata identifiers,
+ * never secret values): every registered deployment provider's declared
+ * `projectionKeys`, so the loader names no provider.
+ */
+export function deploymentProjectionKeys(runtime) {
+    if (!runtime.hasKind('infra/deployment-provider'))
+        return [];
+    const keys = new Set();
+    for (const descriptor of runtime.query('infra/deployment-provider').descriptors()) {
+        for (const key of DeploymentProviderDescriptorSchema.parse(descriptor).projectionKeys)
+            keys.add(key);
+    }
+    return [...keys];
+}
+/**
+ * The child environment's projection declaration. A resolved projection is
+ * passed as data and is the child's whole projection: a key it omits is absent
+ * in the child (fail-closed). Without one, the child inherits the same keys
+ * from the caller runtime's captured environment, never the live process.
+ */
+function projectionChildDeclaration(keys, projectionEnvironment) {
+    if (!projectionEnvironment)
+        return { inheritEnv: [...keys] };
+    const env = {};
+    for (const key of keys) {
+        const value = projectionEnvironment[key];
+        if (value)
+            env[key] = value;
+    }
+    return { env };
+}
+/**
+ * Evaluate the config in a `bun` subprocess that has workspace `node_modules`
+ * resolution. The evaluator mirrors {@link loadConfigInProcess} exactly (raw
+ * default export + optional host renderer) and writes the result to stdout
+ * after a sentinel line, keeping any logging the config or infra packages
+ * emit on import out of the parsed document.
+ */
+async function loadConfigViaWorkspaceBun(runtime, configPath, originalError, execution, projectionEnvironment) {
+    const paths = await getRuntimePath(runtime);
+    // The child renders through the renderer the export's provider declares,
+    // named here as data: it imports the module, never this package's closures.
+    const evaluator = `
+		const mod = await import(${JSON.stringify(configPath)});
+		const raw = (mod && mod.default !== undefined) ? mod.default : mod;
+		const projectionEnv = ${projectionEnvironment ? JSON.stringify(projectionEnvironment) : 'undefined'};
+		const renderers = ${JSON.stringify(Object.fromEntries(deploymentRenderers(runtime)))};
+		const declared = raw && typeof raw === 'object' ? (raw.deployment ?? raw) : null;
+		const renderer = declared && typeof declared.provider === 'string' ? renderers[declared.provider] : undefined;
+		const render = renderer
+			? (await import(renderer.module))[renderer.export](raw, projectionEnv)
+			: ${JSON.stringify(NO_RENDER)};
+		process.stdout.write('VIBES_CONFIG_RESULT:' + JSON.stringify({ raw, render }) + '\\n');
+	`;
+    // The evaluator child gets the composed base set plus, as declared data, the
+    // Cloudflare Secrets Store identifier (metadata, never a secret value) it
+    // needs to render canonical `secrets_store_secrets` bindings. Without it,
+    // fallback evaluation silently renders `secrets.required` and the deploy gate
+    // cannot reproduce the configuration it just resolved. Nothing else from the
+    // host environment reaches the deployment config's code (C15).
+    const env = composeChildEnv(runtime, projectionChildDeclaration(deploymentProjectionKeys(runtime), projectionEnvironment));
+    const result = await execution.execute({
+        command: 'bun',
+        args: ['-e', evaluator],
+        cwd: paths.dirname(configPath),
+        env,
+        envMode: 'replace',
+        timeout: 60_000
     });
+    if (result.timedOut) {
+        throw new Error(`Timed out while evaluating ${configPath} via runtime/execution.`);
+    }
+    if (result.exitCode !== 0) {
+        throw new Error(`bun subprocess exited ${result.exitCode ?? 'unknown'} while evaluating ${configPath}:\n${result.stderr || result.stdout}`);
+    }
+    const SENTINEL = 'VIBES_CONFIG_RESULT:';
+    const line = (result.stdout ?? '')
+        .split('\n')
+        .find((candidate) => candidate.startsWith(SENTINEL));
+    if (line === undefined) {
+        throw new Error(`bun subprocess produced no config result while evaluating ${configPath}:\n${result.stderr || result.stdout}`);
+    }
+    const payload = settleNow(() => ConfigLoadOutputSchema.parse(JSON.parse(line.slice(SENTINEL.length))));
+    if (!payload.ok) {
+        // Surface the parse failure, but keep the original in-process resolution
+        // error visible so the true cause isn't lost.
+        throw new Error(`${failureMessage(payload.cause)}\n(in-process load first failed with: ${failureMessage(originalError)})`);
+    }
+    return payload.value;
 }
-export async function loadDeploymentConfig(appDir) {
-    const dir = resolveAppDir(appDir);
-    const configPath = findConfigFile(dir);
-    const workspaceRoot = findWorkspaceRoot(dir);
-    const output = await loadConfigViaSubprocess(configPath, workspaceRoot);
-    const { deployment, provider } = extractDeployment(output.raw);
+/** The document the fallback evaluator returns on its sentinel line. */
+const ConfigLoadOutputSchema = z.object({
+    raw: z.unknown(),
+    render: DeploymentModuleRenderSchema
+}).loose();
+export async function loadDeploymentConfig(appDir, options) {
+    const host = await resolveConfigLoadHost(options.runtime);
+    const dir = await resolveAppDir(host, appDir);
+    // The unit's `infra.deployment` settings come from the config owner: a declared deployment (data) or
+    // non-deployable marker is the answer; otherwise the declared module (default deployment.config.ts) is evaluated.
+    const settings = await readDeploymentSettings(options.runtime, dir);
+    if (settings.nonDeployable) {
+        throw new NonDeployableDeploymentConfigError({ ...settings.nonDeployable, configPath: dir });
+    }
+    if (settings.webAppId !== undefined) {
+        const runtime = options.runtime;
+        const input = { appRoot: dir, projectionEnvironment: { ...options.projectionEnvironment } };
+        const production = await projectWebApp(runtime, settings.webAppId, { ...input, target: 'production' });
+        const local = production.artifact === null ? production
+            : await projectWebApp(runtime, settings.webAppId, { ...input, target: 'local' });
+        const [descriptor] = runtime.query('infra/web-app').withId(settings.webAppId).descriptors();
+        if (!descriptor) {
+            throw new CapabilityError('The selected web app is no longer registered.', 'NOT_FOUND', {
+                reason: 'web-app-unavailable', details: { id: settings.webAppId }
+            });
+        }
+        return {
+            configPath: host.paths.join(dir, UNIT_CONFIG_FILE), appDir: dir,
+            deployment: production.deployment, provider: production.provider,
+            raw: { deployment: production.deployment, config: descriptor.config },
+            rendered: production.artifact?.content ?? null,
+            localRendered: local.artifact?.content ?? null,
+            managed: production.managed, renders: production.artifact !== null,
+            unitName: production.workerName
+        };
+    }
+    const declared = settings.deployment;
+    const configPath = declared ? host.paths.join(dir, UNIT_CONFIG_FILE) : await findConfigFile(host, dir, settings.module);
+    const execution = options.execution;
+    if (options.freshProcess && !execution) {
+        throw new CapabilityError("A fresh-process evaluation runs on the caller's runtime/execution; pass execution.", 'INVALID_INPUT', { reason: 'execution-required' });
+    }
+    const output = declared
+        ? { raw: declared, render: NO_RENDER }
+        : options.freshProcess && execution
+            ? await loadConfigViaWorkspaceBun(options.runtime, configPath, new Error('fresh deployment projection requested'), execution, options.projectionEnvironment)
+            : await loadConfigInCurrentRuntime(options.runtime, configPath, options.projectionEnvironment);
+    const extracted = settleNow(() => extractDeployment(output.raw));
+    if (!extracted.ok) {
+        const failure = extracted.cause;
+        if (failure instanceof NonDeployableDeploymentConfigError) {
+            throw new NonDeployableDeploymentConfigError({
+                appId: failure.appId,
+                reason: failure.reason,
+                configPath
+            });
+        }
+        throw failure;
+    }
+    const { deployment, provider } = extracted.value;
+    // The provider the deployment names is composed from its own declaration
+    // (`providerPlugin`) when this runtime has not composed it.
+    await composeDeclaredDeploymentProvider(options.runtime, deployment, dir);
+    validateAppDeployment(options.runtime, deployment);
     return {
         configPath,
         appDir: dir,
         deployment,
         provider,
         raw: output.raw,
-        wranglerJsoncString: output.render.rendered,
+        rendered: output.render.rendered,
+        localRendered: output.render.localRendered,
         managed: output.render.managed,
-        workerName: output.render.workerName
+        renders: output.render.renders,
+        unitName: output.render.unitName
     };
 }
 //# sourceMappingURL=config-loader.js.map