@zintrust/core 2.4.1 → 2.4.3

package/src/cli/cloudflare/CloudflareSecretSync.d.ts

@@ -0,0 +1,42 @@
+type CloudflareSecretLog = {
+    info: (message: string) => void;
+    warn: (message: string) => void;
+    success?: (message: string) => void;
+};
+export type CloudflareSecretSyncFailure = {
+    wranglerEnv: string;
+    key: string;
+    reason: string;
+};
+type CloudflareSecretSyncArgs = {
+    log: CloudflareSecretLog;
+    cwd: string;
+    wranglerEnvs: string[];
+    envPath: string;
+    dryRun?: boolean;
+    configGroups?: string[];
+    directKeys?: string[];
+    inlineValues?: Record<string, string>;
+    configPath?: string;
+    target?: string;
+    bulk?: boolean;
+    requireSelection?: boolean;
+    all?: boolean;
+};
+export type CloudflareSecretSyncResult = {
+    pushed: number;
+    pushedKeys: string[];
+    skippedEmptyKeys: string[];
+    failures: CloudflareSecretSyncFailure[];
+    selectedKeys: string[];
+};
+export declare const uniq: (items: string[]) => string[];
+export declare const resolveValue: (key: string, envMap: Record<string, string>, envPath: string, all?: boolean) => string;
+export declare const reportCloudflareSecretSync: (log: CloudflareSecretLog, result: Pick<CloudflareSecretSyncResult, "pushed" | "skippedEmptyKeys" | "failures">) => void;
+export declare const syncCloudflareSecrets: ({ log, cwd, wranglerEnvs, envPath, dryRun, configGroups, directKeys, inlineValues, configPath, target, bulk, requireSelection, all, }: CloudflareSecretSyncArgs) => Promise<CloudflareSecretSyncResult>;
+declare const _default: Readonly<{
+    syncCloudflareSecrets: ({ log, cwd, wranglerEnvs, envPath, dryRun, configGroups, directKeys, inlineValues, configPath, target, bulk, requireSelection, all, }: CloudflareSecretSyncArgs) => Promise<CloudflareSecretSyncResult>;
+    reportCloudflareSecretSync: (log: CloudflareSecretLog, result: Pick<CloudflareSecretSyncResult, "pushed" | "skippedEmptyKeys" | "failures">) => void;
+}>;
+export default _default;
+//# sourceMappingURL=CloudflareSecretSync.d.ts.map

package/src/cli/cloudflare/CloudflareSecretSync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudflareSecretSync.d.ts","sourceRoot":"","sources":["../../../../src/cli/cloudflare/CloudflareSecretSync.ts"],"names":[],"mappings":"AAaA,KAAK,mBAAmB,GAAG;IACzB,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAcF,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,mBAAmB,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,CAAC;AAcF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,2BAA2B,EAAE,CAAC;IACxC,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AASF,eAAO,MAAM,IAAI,GAAI,OAAO,MAAM,EAAE,KAAG,MAAM,EAY5C,CAAC;AA0BF,eAAO,MAAM,YAAY,GACvB,KAAK,MAAM,EACX,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,SAAS,MAAM,EACf,MAAK,OAAe,KACnB,MAYF,CAAC;AAoRF,eAAO,MAAM,0BAA0B,GACrC,KAAK,mBAAmB,EACxB,QAAQ,IAAI,CAAC,0BAA0B,EAAE,QAAQ,GAAG,kBAAkB,GAAG,UAAU,CAAC,KACnF,IAcF,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAAU,uIAczC,wBAAwB,KAAG,OAAO,CAAC,0BAA0B,CAqD/D,CAAC;;mKArDC,wBAAwB,KAAG,OAAO,CAAC,0BAA0B,CAAC;sCAhC1D,mBAAmB,UAChB,IAAI,CAAC,0BAA0B,EAAE,QAAQ,GAAG,kBAAkB,GAAG,UAAU,CAAC,KACnF,IAAI;;AAqFP,wBAGG"}

package/src/cli/cloudflare/CloudflareSecretSync.js

@@ -0,0 +1,285 @@
+import { readZintrustConfig, resolveCloudflareEnvKeys, } from '../cloudflare/CloudflareEnvTargetConfig.js';
+import { resolveNpmPath } from '../../common/index.js';
+import { appConfig } from '../../config/app.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { execFileSync } from '../../node-singletons/child-process.js';
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from '../../node-singletons/fs.js';
+import { tmpdir } from '../../node-singletons/os.js';
+import * as path from '../../node-singletons/path.js';
+import { EnvFile } from '../../toolkit/Secrets/EnvFile.js';
+export const uniq = (items) => {
+    const seen = new Set();
+    const out = [];
+    for (const item of items) {
+        const normalized = item.trim();
+        if (normalized === '' || seen.has(normalized))
+            continue;
+        seen.add(normalized);
+        out.push(normalized);
+    }
+    return out;
+};
+const createSyncProgress = () => {
+    return {
+        pushed: 0,
+        pushedKeys: [],
+        skippedEmptyKeys: [],
+        failures: [],
+    };
+};
+const forEachWranglerEnv = (wranglerEnvs, callback) => {
+    for (const wranglerEnv of wranglerEnvs) {
+        callback(wranglerEnv, describeWranglerEnv(wranglerEnv));
+    }
+};
+const getConfigArray = (config, key) => {
+    const raw = config[key];
+    if (!Array.isArray(raw))
+        return [];
+    return uniq(raw.filter((item) => typeof item === 'string'));
+};
+export const resolveValue = (key, envMap, envPath, all = false) => {
+    const fromFile = envMap[key];
+    const fromProcess = process.env[key];
+    const isCustomEnvFile = envPath !== '.env' && envPath.trim() !== '';
+    // If custom env file is provided and all is false, only use values from the custom file
+    if (isCustomEnvFile && !all) {
+        return fromFile ?? '';
+    }
+    // Default behavior: fallback to process.env
+    return fromFile ?? fromProcess ?? '';
+};
+const resolveValueWithOverrides = (key, envMap, inlineValues, envPath, all = false) => {
+    const inlineValue = inlineValues[key];
+    if (typeof inlineValue === 'string')
+        return inlineValue;
+    return resolveValue(key, envMap, envPath, all);
+};
+const getPutTimeoutMs = () => {
+    const raw = process.env['ZT_PUT_TIMEOUT_MS'];
+    if (typeof raw !== 'string')
+        return 120000;
+    const parsed = Number.parseInt(raw, 10);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return 120000;
+    return parsed;
+};
+const describeWranglerEnv = (wranglerEnv) => wranglerEnv.trim() === '' ? 'top-level worker' : wranglerEnv;
+const putSecret = (wranglerEnv, key, value, configPath) => {
+    const npmPath = resolveNpmPath();
+    const args = ['exec', '--yes', '--', 'wrangler'];
+    if (typeof configPath === 'string' && configPath.trim() !== '') {
+        args.push('--config', configPath.trim());
+    }
+    args.push('secret', 'put', key);
+    if (wranglerEnv.trim() === '') {
+        args.push('--env=');
+    }
+    else {
+        args.push('--env', wranglerEnv);
+    }
+    execFileSync(npmPath, args, {
+        stdio: ['pipe', 'inherit', 'inherit'],
+        input: value,
+        encoding: 'utf8',
+        timeout: getPutTimeoutMs(),
+        killSignal: 'SIGTERM',
+        env: appConfig.getSafeEnv(),
+    });
+};
+const putSecretBulk = (wranglerEnv, payloadPath, configPath) => {
+    const npmPath = resolveNpmPath();
+    const args = ['exec', '--yes', '--', 'wrangler'];
+    if (typeof configPath === 'string' && configPath.trim() !== '') {
+        args.push('--config', configPath.trim());
+    }
+    args.push('secret', 'bulk', payloadPath);
+    if (wranglerEnv.trim() === '') {
+        args.push('--env=');
+    }
+    else {
+        args.push('--env', wranglerEnv);
+    }
+    execFileSync(npmPath, args, {
+        stdio: ['ignore', 'inherit', 'inherit'],
+        encoding: 'utf8',
+        timeout: getPutTimeoutMs(),
+        killSignal: 'SIGTERM',
+        env: appConfig.getSafeEnv(),
+    });
+};
+const getFailureReason = (error) => error instanceof Error ? error.message : String(error);
+const resolveSelectedKeys = ({ log, config, cwd, wranglerEnvs, configGroups = [], directKeys = [], configPath, target, requireSelection, }) => {
+    const selectedDirectKeys = uniq(directKeys);
+    if (selectedDirectKeys.length > 0) {
+        return selectedDirectKeys;
+    }
+    const explicitKeys = uniq(configGroups.flatMap((groupKey) => {
+        const keys = getConfigArray(config, groupKey);
+        if (keys.length === 0) {
+            log.warn(`Group \`${groupKey}\` is missing or empty in .zintrust.json`);
+        }
+        return keys;
+    }));
+    const manifestKeys = uniq(wranglerEnvs.flatMap((wranglerEnv) => resolveCloudflareEnvKeys({
+        config,
+        projectRoot: cwd,
+        cwd,
+        ...(configPath === undefined ? {} : { configPath }),
+        wranglerEnv,
+        ...(typeof target === 'string' && target.trim() !== '' ? { target: target.trim() } : {}),
+    })));
+    const selectedKeys = uniq([...explicitKeys, ...manifestKeys]);
+    if (selectedKeys.length > 0 || !requireSelection) {
+        return selectedKeys;
+    }
+    throw ErrorFactory.createCliError(configGroups.length === 0
+        ? 'No secret keys resolved from explicit keys or .zintrust.json cloudflare.shared_env/cloudflare.targets/cloudflare.wrangler_envs. Use --key/--keys, --var <group>, or add a Cloudflare env manifest.'
+        : 'No secret keys resolved from selected groups.');
+};
+const resolveBulkPayload = (log, wranglerEnv, selectedKeys, envMap, inlineValues, envPath, all = false) => {
+    const payload = {};
+    const includedKeys = [];
+    const skippedEmptyKeys = [];
+    const wranglerEnvLabel = describeWranglerEnv(wranglerEnv);
+    for (const key of selectedKeys) {
+        const value = resolveValueWithOverrides(key, envMap, inlineValues, envPath, all);
+        if (value.trim() === '') {
+            log.warn(`skip ${key} -> ${wranglerEnvLabel}: empty value`);
+            skippedEmptyKeys.push(key);
+            continue;
+        }
+        payload[key] = value;
+        includedKeys.push(key);
+    }
+    return { payload, includedKeys, skippedEmptyKeys };
+};
+const processSecretSync = (args) => {
+    const { log, wranglerEnvs, selectedKeys, envMap, dryRun, configPath, inlineValues, envPath, all, } = args;
+    const progress = createSyncProgress();
+    forEachWranglerEnv(wranglerEnvs, (wranglerEnv, wranglerEnvLabel) => {
+        for (const key of selectedKeys) {
+            const value = resolveValueWithOverrides(key, envMap, inlineValues, envPath, all);
+            if (value.trim() === '') {
+                log.warn(`skip ${key} -> ${wranglerEnvLabel}: empty value`);
+                progress.skippedEmptyKeys.push(key);
+                continue;
+            }
+            try {
+                if (!dryRun) {
+                    log.info(`putting ${key} -> ${wranglerEnvLabel}...`);
+                    putSecret(wranglerEnv, key, value, configPath);
+                }
+                progress.pushed += 1;
+                progress.pushedKeys.push(key);
+                log.info(`${dryRun ? '[dry-run] ' : ''}put ${key} -> ${wranglerEnvLabel}`);
+            }
+            catch (error) {
+                progress.failures.push({ wranglerEnv, key, reason: getFailureReason(error) });
+            }
+        }
+    });
+    return progress;
+};
+const processSecretBulkSync = (args) => {
+    const { log, wranglerEnvs, selectedKeys, envMap, dryRun, configPath, inlineValues, envPath, all, } = args;
+    const progress = createSyncProgress();
+    forEachWranglerEnv(wranglerEnvs, (wranglerEnv, wranglerEnvLabel) => {
+        const { payload, includedKeys, skippedEmptyKeys: skippedForEnv, } = resolveBulkPayload(log, wranglerEnv, selectedKeys, envMap, inlineValues, envPath, all);
+        progress.skippedEmptyKeys.push(...skippedForEnv);
+        if (includedKeys.length === 0) {
+            log.info(`skip bulk upload -> ${wranglerEnvLabel}: no non-empty keys`);
+            return;
+        }
+        log.info(`${dryRun ? '[dry-run] ' : ''}bulk keys -> ${wranglerEnvLabel}: ${includedKeys.join(', ')}`);
+        if (dryRun) {
+            progress.pushed += includedKeys.length;
+            progress.pushedKeys.push(...includedKeys);
+            return;
+        }
+        const tempDir = mkdtempSync(path.join(tmpdir(), 'zintrust-cloudflare-secret-bulk-'));
+        const payloadPath = path.join(tempDir, 'secrets.json');
+        try {
+            writeFileSync(payloadPath, JSON.stringify(payload, null, 2), 'utf8');
+            log.info(`bulk uploading ${includedKeys.length} key(s) -> ${wranglerEnvLabel}...`);
+            putSecretBulk(wranglerEnv, payloadPath, configPath);
+            progress.pushed += includedKeys.length;
+            progress.pushedKeys.push(...includedKeys);
+            log.info(`bulk put ${includedKeys.length} key(s) -> ${wranglerEnvLabel}`);
+        }
+        catch (error) {
+            const reason = getFailureReason(error);
+            for (const key of includedKeys) {
+                progress.failures.push({ wranglerEnv, key, reason });
+            }
+        }
+        finally {
+            rmSync(tempDir, { recursive: true, force: true });
+        }
+    });
+    return progress;
+};
+export const reportCloudflareSecretSync = (log, result) => {
+    if (typeof log.success === 'function') {
+        log.success(`Cloudflare secrets report: pushed=${result.pushed}, skipped_empty=${result.skippedEmptyKeys.length}, failed=${result.failures.length}`);
+    }
+    else {
+        log.info(`Cloudflare secrets report: pushed=${result.pushed}, skipped_empty=${result.skippedEmptyKeys.length}, failed=${result.failures.length}`);
+    }
+    for (const item of result.failures) {
+        log.warn(`${item.key} -> ${describeWranglerEnv(item.wranglerEnv)}: ${item.reason}`);
+    }
+};
+export const syncCloudflareSecrets = async ({ log, cwd, wranglerEnvs, envPath, dryRun = false, configGroups = [], directKeys = [], inlineValues = {}, configPath, target, bulk = false, requireSelection = true, all = false, }) => {
+    const normalizedConfigPath = typeof configPath === 'string' && configPath.trim() !== '' ? configPath.trim() : undefined;
+    if (normalizedConfigPath !== undefined && !existsSync(path.join(cwd, normalizedConfigPath))) {
+        throw ErrorFactory.createCliError(`Wrangler config not found: ${normalizedConfigPath}`);
+    }
+    const config = readZintrustConfig(cwd);
+    const selectedKeys = resolveSelectedKeys({
+        log,
+        config,
+        cwd,
+        wranglerEnvs,
+        configGroups,
+        directKeys,
+        configPath: normalizedConfigPath,
+        target,
+        requireSelection,
+    });
+    if (selectedKeys.length === 0) {
+        return { pushed: 0, pushedKeys: [], skippedEmptyKeys: [], failures: [], selectedKeys: [] };
+    }
+    const envMap = await EnvFile.read({ cwd, path: envPath });
+    const syncResult = bulk
+        ? processSecretBulkSync({
+            log,
+            wranglerEnvs,
+            selectedKeys,
+            envMap,
+            dryRun,
+            configPath: normalizedConfigPath,
+            inlineValues,
+            envPath,
+            all,
+        })
+        : processSecretSync({
+            log,
+            wranglerEnvs,
+            selectedKeys,
+            envMap,
+            dryRun,
+            configPath: normalizedConfigPath,
+            inlineValues,
+            envPath,
+            all,
+        });
+    return {
+        ...syncResult,
+        selectedKeys,
+    };
+};
+export default Object.freeze({
+    syncCloudflareSecrets,
+    reportCloudflareSecretSync,
+});

package/src/cli/cloudflare/CloudflareWranglerDevEnv.d.ts

@@ -0,0 +1,24 @@
+type WranglerDevEnvArgs = {
+    cwd: string;
+    projectRoot: string;
+    envName?: string;
+    envPath?: string;
+    configPath?: string;
+    target?: string;
+    runtimeEnv?: NodeJS.ProcessEnv;
+    requireSelection?: boolean;
+};
+export type WranglerDevEnvMaterializationResult = {
+    filePath: string;
+    selectedKeys: string[];
+    missingKeys: string[];
+    values: Record<string, string>;
+};
+export declare const materializeWranglerDevVars: (args: WranglerDevEnvArgs) => Promise<WranglerDevEnvMaterializationResult>;
+export declare const withWranglerDevVarsSnapshot: <T>(args: WranglerDevEnvArgs, fn: () => Promise<T>) => Promise<T>;
+declare const _default: Readonly<{
+    materializeWranglerDevVars: (args: WranglerDevEnvArgs) => Promise<WranglerDevEnvMaterializationResult>;
+    withWranglerDevVarsSnapshot: <T>(args: WranglerDevEnvArgs, fn: () => Promise<T>) => Promise<T>;
+}>;
+export default _default;
+//# sourceMappingURL=CloudflareWranglerDevEnv.d.ts.map

package/src/cli/cloudflare/CloudflareWranglerDevEnv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudflareWranglerDevEnv.d.ts","sourceRoot":"","sources":["../../../../src/cli/cloudflare/CloudflareWranglerDevEnv.ts"],"names":[],"mappings":"AAUA,KAAK,kBAAkB,GAAG;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,mCAAmC,GAAG;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC,CAAC;AA+MF,eAAO,MAAM,0BAA0B,GACrC,MAAM,kBAAkB,KACvB,OAAO,CAAC,mCAAmC,CAmB7C,CAAC;AAEF,eAAO,MAAM,2BAA2B,GAAU,CAAC,EACjD,MAAM,kBAAkB,EACxB,IAAI,MAAM,OAAO,CAAC,CAAC,CAAC,KACnB,OAAO,CAAC,CAAC,CAkCX,CAAC;;uCA3DM,kBAAkB,KACvB,OAAO,CAAC,mCAAmC,CAAC;kCAqBG,CAAC,QAC3C,kBAAkB,MACpB,MAAM,OAAO,CAAC,CAAC,CAAC,KACnB,OAAO,CAAC,CAAC,CAAC;;AAoCb,wBAGG"}

package/src/cli/cloudflare/CloudflareWranglerDevEnv.js

@@ -0,0 +1,222 @@
+import { readZintrustConfig, resolveCloudflareEnvKeys, } from '../cloudflare/CloudflareEnvTargetConfig.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { isNonEmptyString } from '../../helper/index.js';
+import { existsSync, renameSync, unlinkSync } from '../../node-singletons/fs.js';
+import * as path from '../../node-singletons/path.js';
+import { EnvFile } from '../../toolkit/Secrets/EnvFile.js';
+const WRANGLER_RUNTIME_ENV_KEYS = Object.freeze([
+    'APP_PORT',
+    'CLOUDFLARE_WORKER',
+    'DOCKER_WORKER',
+    'ENVIRONMENT',
+    'HOST',
+    'NODE_ENV',
+    'PORT',
+    'RUNTIME',
+    'SERVICE_DOMAIN',
+    'SERVICE_NAME',
+    'SERVICE_PORT',
+    'WORKER_ENABLED',
+    'ZINTRUST_PROJECT_ROOT',
+]);
+const isAsciiUppercaseLetter = (value) => value >= 'A' && value <= 'Z';
+const isAsciiDigit = (value) => value >= '0' && value <= '9';
+const isWranglerWordCharacter = (value) => isAsciiUppercaseLetter(value) || isAsciiDigit(value) || value === '_';
+const isWranglerVarName = (value) => {
+    if (value.length === 0)
+        return false;
+    const first = value[0] ?? '';
+    if (!(isAsciiUppercaseLetter(first) || first === '_'))
+        return false;
+    for (let index = 1; index < value.length; index += 1) {
+        if (!isWranglerWordCharacter(value[index] ?? ''))
+            return false;
+    }
+    return true;
+};
+const uniq = (items) => {
+    const seen = new Set();
+    const output = [];
+    for (const item of items) {
+        const normalized = item.trim();
+        if (normalized === '' || seen.has(normalized))
+            continue;
+        seen.add(normalized);
+        output.push(normalized);
+    }
+    return output;
+};
+const getNormalizedEnvName = (envName) => {
+    return typeof envName === 'string' ? envName.trim() : '';
+};
+const getWranglerDevVarsFileName = (envName) => {
+    const normalizedEnv = getNormalizedEnvName(envName);
+    return normalizedEnv === '' ? '.dev.vars' : `.dev.vars.${normalizedEnv}`;
+};
+const getWranglerDevVarsBackupPath = (targetPath) => `${targetPath}.disabled-by-zin`;
+const reconcileWranglerEnvBackup = (targetPath, backupPath) => {
+    const hasTarget = existsSync(targetPath);
+    const hasBackup = existsSync(backupPath);
+    if (!hasBackup)
+        return;
+    if (!hasTarget) {
+        renameSync(backupPath, targetPath);
+        return;
+    }
+    unlinkSync(backupPath);
+};
+const resolveRuntimeEnvMap = (runtimeEnv) => {
+    return Object.fromEntries(Object.entries(runtimeEnv).filter((entry) => {
+        return typeof entry[1] === 'string';
+    }));
+};
+const readExistingWranglerDevVars = async (args) => {
+    const fileName = getWranglerDevVarsFileName(args.envName);
+    const targetPath = path.join(args.cwd, fileName);
+    const backupPath = getWranglerDevVarsBackupPath(targetPath);
+    let sourcePath;
+    if (existsSync(targetPath)) {
+        sourcePath = fileName;
+    }
+    else if (existsSync(backupPath)) {
+        sourcePath = path.basename(backupPath);
+    }
+    if (sourcePath === undefined)
+        return {};
+    return EnvFile.read({
+        cwd: args.cwd,
+        path: sourcePath,
+    });
+};
+const isTruthyEnvValue = (value) => {
+    if (!isNonEmptyString(value))
+        return false;
+    const normalized = value.trim().toLowerCase();
+    return normalized === '1' || normalized === 'true' || normalized === 'yes' || normalized === 'on';
+};
+const shouldUseEnvFileDirectly = async (args) => {
+    const runtimeEnv = resolveRuntimeEnvMap(args.runtimeEnv ?? process.env);
+    if (isTruthyEnvValue(runtimeEnv['USE_ENV'])) {
+        return true;
+    }
+    const envPath = isNonEmptyString(args.envPath) ? args.envPath.trim() : '.env';
+    const envFileValues = await EnvFile.read({
+        cwd: args.projectRoot,
+        path: envPath,
+    });
+    return isTruthyEnvValue(envFileValues['USE_ENV']);
+};
+const resolveSelectedKeys = (args) => {
+    const zintrustConfigPath = path.join(args.projectRoot, '.zintrust.json');
+    if (!existsSync(zintrustConfigPath)) {
+        if (args.requireSelection === true) {
+            throw ErrorFactory.createCliError('No .zintrust.json found. Add a Cloudflare env manifest before generating Wrangler dev vars.');
+        }
+        return [];
+    }
+    const selectedKeys = resolveCloudflareEnvKeys({
+        config: readZintrustConfig(args.projectRoot),
+        projectRoot: args.projectRoot,
+        cwd: args.cwd,
+        ...(isNonEmptyString(args.configPath) ? { configPath: args.configPath.trim() } : {}),
+        ...(isNonEmptyString(args.envName) ? { wranglerEnv: args.envName.trim() } : {}),
+        ...(isNonEmptyString(args.target) ? { target: args.target.trim() } : {}),
+    });
+    if (selectedKeys.length === 0 && args.requireSelection === true) {
+        throw ErrorFactory.createCliError('No Wrangler dev env keys resolved from .zintrust.json cloudflare.shared_env/cloudflare.targets/cloudflare.wrangler_envs.');
+    }
+    return selectedKeys;
+};
+const collectWranglerDevVarValues = async (args, selectedKeys) => {
+    const runtimeEnv = resolveRuntimeEnvMap(args.runtimeEnv ?? process.env);
+    const existingDevVarValues = await readExistingWranglerDevVars(args);
+    const envPath = isNonEmptyString(args.envPath) ? args.envPath.trim() : '.env';
+    const envFileValues = await EnvFile.read({
+        cwd: args.projectRoot,
+        path: envPath,
+    });
+    const allowedKeys = selectedKeys.length === 0
+        ? undefined
+        : new Set([
+            ...WRANGLER_RUNTIME_ENV_KEYS,
+            ...selectedKeys,
+            ...Object.keys(existingDevVarValues),
+        ]);
+    const candidateKeys = allowedKeys === undefined
+        ? uniq([
+            ...Object.keys(runtimeEnv),
+            ...Object.keys(envFileValues),
+            ...Object.keys(existingDevVarValues),
+        ]).filter(isWranglerVarName)
+        : [...allowedKeys].filter(isWranglerVarName);
+    const values = {};
+    const missingKeys = [];
+    for (const key of candidateKeys) {
+        const value = existingDevVarValues[key] ?? envFileValues[key] ?? runtimeEnv[key];
+        if (typeof value !== 'string') {
+            if (selectedKeys.includes(key))
+                missingKeys.push(key);
+            continue;
+        }
+        values[key] = value;
+    }
+    return { values, missingKeys };
+};
+export const materializeWranglerDevVars = async (args) => {
+    const selectedKeys = resolveSelectedKeys(args);
+    const { values, missingKeys } = await collectWranglerDevVarValues(args, selectedKeys);
+    const fileName = getWranglerDevVarsFileName(args.envName);
+    const filePath = path.join(args.cwd, fileName);
+    await EnvFile.write({
+        cwd: args.cwd,
+        path: fileName,
+        values,
+        mode: 'overwrite',
+    });
+    return {
+        filePath,
+        selectedKeys,
+        missingKeys,
+        values,
+    };
+};
+export const withWranglerDevVarsSnapshot = async (args, fn) => {
+    if (await shouldUseEnvFileDirectly(args)) {
+        return fn();
+    }
+    const targetPath = path.join(args.cwd, getWranglerDevVarsFileName(args.envName));
+    const backupPath = getWranglerDevVarsBackupPath(targetPath);
+    try {
+        reconcileWranglerEnvBackup(targetPath, backupPath);
+    }
+    catch {
+        // noop
+    }
+    if (existsSync(targetPath)) {
+        renameSync(targetPath, backupPath);
+    }
+    try {
+        await materializeWranglerDevVars(args);
+        return await fn();
+    }
+    finally {
+        try {
+            if (existsSync(targetPath))
+                unlinkSync(targetPath);
+        }
+        catch {
+            // noop
+        }
+        try {
+            if (existsSync(backupPath))
+                renameSync(backupPath, targetPath);
+        }
+        catch {
+            // noop
+        }
+    }
+};
+export default Object.freeze({
+    materializeWranglerDevVars,
+    withWranglerDevVarsSnapshot,
+});