hanzio 1.0.9 → 1.1.0

package/dist/src/secrets/index.js

@@ -1,156 +1,350 @@
-// src/api-wrapper/index.ts
+// src/api-wrapper/headers.ts
+var CANONICAL_HEADER_NAMES = {
+  "content-type": "Content-Type",
+  authorization: "Authorization",
+  accept: "Accept",
+  "user-agent": "User-Agent",
+  "x-request-id": "X-Request-Id",
+  "x-correlation-id": "X-Correlation-Id"
+};
+function normalizeHeaders(headers) {
+  const result = {};
+  const lowerToCanonical = new Map;
+  for (const [key, value] of Object.entries(headers)) {
+    const lower = key.toLowerCase();
+    const canonical = CANONICAL_HEADER_NAMES[lower] ?? key;
+    const existing = lowerToCanonical.get(lower);
+    if (existing && existing !== canonical)
+      delete result[existing];
+    lowerToCanonical.set(lower, canonical);
+    result[canonical] = value;
+  }
+  return result;
+}
+function getHeader(headers, name) {
+  const lower = name.toLowerCase();
+  const canonical = CANONICAL_HEADER_NAMES[lower];
+  if (canonical !== undefined) {
+    if (headers[canonical] !== undefined)
+      return headers[canonical];
+  }
+  for (const [k, v] of Object.entries(headers)) {
+    if (k.toLowerCase() === lower)
+      return v;
+  }
+  return;
+}
+function hasJsonContentType(headers) {
+  const ct = getHeader(headers, "content-type") ?? "";
+  return ct.includes("application/json");
+}
+function buildFetchBody(body, headers) {
+  if (body === undefined || body === null)
+    return;
+  if (body instanceof FormData || body instanceof Blob)
+    return body;
+  if (hasJsonContentType(headers))
+    return JSON.stringify(body);
+  return body;
+}
+function getHeadersAsObject(headers) {
+  const result = {};
+  headers.forEach((value, key) => {
+    result[key] = value;
+  });
+  return result;
+}
+
+// src/api-wrapper/zod-issues.ts
 import { ZodError } from "zod";
+function formatZodIssues(error, rawData) {
+  return error.issues.map((issue) => {
+    const pathArray = [...issue.path];
+    const path = formatIssuePath(pathArray);
+    const value = getValueAtPath(rawData, pathArray);
+    const valuePreview = value === undefined ? undefined : previewValue(value);
+    const raw = issue;
+    const expected = typeof raw.expected === "string" ? raw.expected : undefined;
+    const received = typeof raw.received === "string" ? raw.received : value !== undefined ? typeofVerbose(value) : undefined;
+    const known = new Set([
+      "code",
+      "path",
+      "message",
+      "expected",
+      "received",
+      "fatal"
+    ]);
+    const extra = {};
+    for (const [k, v] of Object.entries(raw)) {
+      if (!known.has(k) && v !== undefined)
+        extra[k] = v;
+    }
+    return {
+      path,
+      pathArray,
+      code: issue.code,
+      message: issue.message,
+      expected,
+      received,
+      value,
+      valuePreview,
+      extra: Object.keys(extra).length > 0 ? extra : undefined
+    };
+  });
+}
+function renderIssueSummary(issues) {
+  if (issues.length === 0)
+    return "(no issues reported)";
+  return issues.map((issue, idx) => {
+    const parts = [];
+    parts.push(`  [${idx + 1}] ${issue.path}: ${issue.message}`);
+    if (issue.expected || issue.received) {
+      const exp = issue.expected ? `expected ${issue.expected}` : "";
+      const rec = issue.received ? `received ${issue.received}` : "";
+      parts.push(`      (${[exp, rec].filter(Boolean).join(", ")})`);
+    }
+    if (issue.valuePreview !== undefined) {
+      parts.push(`      value: ${issue.valuePreview}`);
+    }
+    if (issue.extra) {
+      for (const [k, v] of Object.entries(issue.extra)) {
+        parts.push(`      ${k}: ${previewValue(v, 120)}`);
+      }
+    }
+    return parts.join(`
+`);
+  }).join(`
+`);
+}
+function formatIssuePath(pathArray) {
+  if (pathArray.length === 0)
+    return "<root>";
+  let out = "";
+  for (const segment of pathArray) {
+    if (typeof segment === "number") {
+      out += `[${segment}]`;
+    } else if (/^[A-Za-z_$][\w$]*$/.test(segment)) {
+      out += out === "" ? segment : `.${segment}`;
+    } else {
+      out += `[${JSON.stringify(segment)}]`;
+    }
+  }
+  return out;
+}
+function getValueAtPath(data, pathArray) {
+  let current = data;
+  for (const segment of pathArray) {
+    if (current === null || current === undefined)
+      return;
+    if (typeof current !== "object")
+      return;
+    current = current[segment];
+  }
+  return current;
+}
+function typeofVerbose(value) {
+  if (value === null)
+    return "null";
+  if (Array.isArray(value))
+    return "array";
+  return typeof value;
+}
+function previewValue(value, maxLen = 200) {
+  let str;
+  try {
+    if (value === undefined)
+      str = "undefined";
+    else if (typeof value === "string")
+      str = JSON.stringify(value);
+    else
+      str = JSON.stringify(value);
+  } catch {
+    str = String(value);
+  }
+  if (str === undefined)
+    str = String(value);
+  if (str.length > maxLen)
+    str = `${str.slice(0, maxLen)}…`;
+  return str;
+}
+function makeJsonParseZodError(error, text) {
+  const message = error instanceof Error ? `Response body was not valid JSON: ${error.message}` : "Response body was not valid JSON";
+  const preview = text.length > 200 ? `${text.slice(0, 200)}…` : text;
+  return new ZodError([
+    {
+      code: "custom",
+      path: [],
+      message: `${message} (body preview: ${JSON.stringify(preview)})`,
+      input: text
+    }
+  ]);
+}
+function tryParseJson(body) {
+  if (!body)
+    return;
+  try {
+    return JSON.parse(body);
+  } catch {
+    return;
+  }
+}
+
+// src/api-wrapper/errors.ts
+var MAX_BODY_PREVIEW = 500;
 
-class ResponseValidationError extends Error {
+class ApiError extends Error {
+  context;
+  cause;
+  constructor(message, context, options) {
+    super(message);
+    this.name = "ApiError";
+    this.context = context;
+    this.cause = options?.cause;
+  }
+  toJSON() {
+    return {
+      name: this.name,
+      message: this.message,
+      context: this.context
+    };
+  }
+}
+
+class HttpResponseError extends ApiError {
+  status;
+  body;
+  bodyJson;
+  responseHeaders;
+  requestId;
+  constructor(status, body, responseHeaders, context) {
+    const preview = body.length > MAX_BODY_PREVIEW ? `${body.slice(0, MAX_BODY_PREVIEW)}…` : body;
+    super(`HTTP ${status} ${context.method} ${context.url} - ${preview}`, context);
+    this.name = "HttpResponseError";
+    this.status = status;
+    this.body = body;
+    this.responseHeaders = responseHeaders;
+    this.requestId = getHeader(responseHeaders, "x-request-id") ?? getHeader(responseHeaders, "x-correlation-id");
+    this.bodyJson = tryParseJson(body);
+  }
+  toJSON() {
+    return {
+      ...super.toJSON(),
+      status: this.status,
+      body: this.body,
+      bodyJson: this.bodyJson,
+      requestId: this.requestId,
+      responseHeaders: this.responseHeaders
+    };
+  }
+}
+
+class ResponseValidationError extends ApiError {
   zodError;
   rawResponse;
+  issues;
   validationIssues;
-  constructor(zodError, rawResponse) {
-    const issues = zodError.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`).join("; ");
-    super(`Response validation failed: ${issues}`);
+  constructor(zodError, rawResponse, context) {
+    const issues = formatZodIssues(zodError, rawResponse);
+    const summary = renderIssueSummary(issues);
+    super(`Response validation failed (${context.method} ${context.url}):
+${summary}`, context, { cause: zodError });
     this.name = "ResponseValidationError";
     this.zodError = zodError;
     this.rawResponse = rawResponse;
-    this.validationIssues = issues;
+    this.issues = issues;
+    this.validationIssues = issues.map((i) => `${i.path}: ${i.message}`).join("; ");
+  }
+  toJSON() {
+    return {
+      ...super.toJSON(),
+      issues: this.issues,
+      validationIssues: this.validationIssues,
+      rawResponsePreview: previewValue(this.rawResponse, 1000)
+    };
   }
 }
 
-class HttpResponseError extends Error {
-  status;
-  body;
-  constructor(status, body) {
-    super(`HTTP error: ${status} - ${body}`);
-    this.name = "HttpResponseError";
-    this.status = status;
-    this.body = body;
+class RequestValidationError extends ApiError {
+  zodError;
+  target;
+  rawInput;
+  issues;
+  validationIssues;
+  constructor(zodError, target, rawInput, context) {
+    const issues = formatZodIssues(zodError, rawInput);
+    const summary = renderIssueSummary(issues);
+    super(`Request ${target} validation failed (${context.method} ${context.url}):
+${summary}`, context, { cause: zodError });
+    this.name = "RequestValidationError";
+    this.zodError = zodError;
+    this.target = target;
+    this.rawInput = rawInput;
+    this.issues = issues;
+    this.validationIssues = issues.map((i) => `${i.path}: ${i.message}`).join("; ");
+  }
+  toJSON() {
+    return {
+      ...super.toJSON(),
+      target: this.target,
+      issues: this.issues,
+      validationIssues: this.validationIssues
+    };
   }
 }
-function createApiClient(apiConfig) {
-  const request = async (endpointKey, input = {}) => {
-    const endpoint = apiConfig.endpoints[endpointKey];
-    if (!endpoint) {
-      throw new Error(`Unknown API endpoint: ${String(endpointKey)}`);
-    }
-    const { finalUrl, fullUrl } = buildUrl(endpoint, input.reqParams, input.reqQuery, apiConfig.baseApiUrls, apiConfig.defaultBaseApiUrl, input.url);
-    const endpointName = apiConfig.name ? `${apiConfig.name}.${String(endpointKey)}` : String(endpointKey);
-    const startedAt = Date.now();
-    let retryCount = 0;
-    let httpStatus = 0;
-    apiConfig.onRequestStart?.({ endpoint: endpointName, url: fullUrl });
-    try {
-      const config = {
-        method: endpoint.method,
-        url: finalUrl,
-        queryParams: buildQueryParams(endpoint, input.reqQuery),
-        body: buildRequestBody(endpoint, input.reqBody),
-        headers: buildHeaders(endpoint, input.reqHeaders, apiConfig.defaultHeaders ?? {}),
-        doNotEncodeQueryParams: endpoint.doNotEncodeQueryParams,
-        timeoutMs: apiConfig.timeoutMs,
-        fetchFn: apiConfig.fetch ?? fetch
-      };
-      const result = await makeRequestWithRetry(config, apiConfig.retries ?? 3, apiConfig.retryDelayMs ?? 300, (response) => validateAndTransformResponse(endpoint, response), apiConfig.shouldRetry ?? defaultShouldRetry, apiConfig.logger);
-      retryCount = result.retryCount;
-      httpStatus = result.httpStatus;
-      const responseTimeMs = Date.now() - startedAt;
-      const responseSizeMb = calculateSizeInMb(result.validatedData);
-      const requestSizeMb = calculateSizeInMb({
-        method: config.method,
-        url: fullUrl,
-        body: config.body,
-        headers: config.headers
-      });
-      apiConfig.onRequestEnd?.({
-        endpoint: endpointName,
-        url: fullUrl,
-        status: httpStatus,
-        retryCount,
-        responseTimeMs
-      });
-      return {
-        data: result.validatedData,
-        requestSizeMb,
-        responseSizeMb,
-        requestSizeTotalMb: requestSizeMb + responseSizeMb,
-        responseTimeMs,
-        httpStatus,
-        retryCount
-      };
-    } catch (error) {
-      apiConfig.logger?.error?.(error);
-      throw error;
-    }
-  };
-  return { request };
+
+class RequestTimeoutError extends ApiError {
+  timeoutMs;
+  constructor(timeoutMs, context) {
+    super(`Request timed out after ${timeoutMs}ms: ${context.method} ${context.url}`, context);
+    this.name = "RequestTimeoutError";
+    this.timeoutMs = timeoutMs;
+  }
 }
-var createApiWrapper = createApiClient;
-async function validateResponse(schema, data) {
-  try {
-    return await schema.parseAsync(data);
-  } catch (error) {
-    if (error instanceof ZodError) {
-      throw new ResponseValidationError(error, data);
-    }
-    throw error;
+
+class NetworkError extends ApiError {
+  constructor(message, context, cause) {
+    super(message, context, { cause });
+    this.name = "NetworkError";
   }
 }
-async function httpRequest(config) {
-  const queryString = config.doNotEncodeQueryParams ? Object.entries(config.queryParams).map(([key, value]) => `${key}=${value}`).join("&") : new URLSearchParams(config.queryParams).toString();
-  const fullUrl = queryString ? `${config.url}?${queryString}` : config.url;
-  const abortController = new AbortController;
-  const timeout = config.timeoutMs === undefined ? undefined : setTimeout(() => abortController.abort(), config.timeoutMs);
-  try {
-    return await config.fetchFn(fullUrl, {
-      method: config.method,
-      headers: config.headers,
-      body: buildFetchBody(config.body, config.headers),
-      signal: abortController.signal
+
+class RequestAbortedError extends ApiError {
+  constructor(context, cause) {
+    super(`Request aborted: ${context.method} ${context.url}`, context, {
+      cause
     });
-  } finally {
-    if (timeout)
-      clearTimeout(timeout);
+    this.name = "RequestAbortedError";
   }
 }
-async function makeRequestWithRetry(config, maxRetries, retryDelayMs, validateFn, shouldRetry, logger) {
-  let retryCount = 0;
-  while (true) {
-    try {
-      logger?.debug?.("API request", config);
-      const response = await httpRequest(config);
-      if (response.status >= 400) {
-        if (retryCount < maxRetries && shouldRetry({ response, retryCount, maxRetries })) {
-          retryCount++;
-          await delay(retryDelayMs);
-          continue;
-        }
-        throw new HttpResponseError(response.status, await response.text());
-      }
-      return {
-        validatedData: await validateFn(response),
-        retryCount,
-        httpStatus: response.status
-      };
-    } catch (error) {
-      if (error instanceof HttpResponseError)
-        throw error;
-      if (retryCount >= maxRetries || !shouldRetry({ error, retryCount, maxRetries })) {
-        throw error;
-      }
-      retryCount++;
-      await delay(retryDelayMs);
-    }
+
+class ConfigError extends ApiError {
+  constructor(message, context) {
+    super(message, context);
+    this.name = "ConfigError";
   }
 }
-async function validateAndTransformResponse(endpoint, response) {
-  const responseHeaders = getHeadersAsObject(response.headers);
-  const contentType = responseHeaders["content-type"] ?? "";
-  const responseData = contentType.includes("application/json") ? await response.json() : await response.text();
-  const transformedData = endpoint.resFormatter ? endpoint.resFormatter(responseData, responseHeaders) : responseData;
-  return validateResponse(endpoint.resSchema, transformedData);
+
+class ActionError extends ApiError {
+  constructor(message, context, cause) {
+    super(message, context, { cause });
+    this.name = "ActionError";
+  }
 }
-function buildUrl(endpoint, params, reqQuery, baseApiUrls, defaultBaseApiUrl, url) {
+var isApiError = (e) => e instanceof ApiError;
+var isHttpResponseError = (e) => e instanceof HttpResponseError;
+var isResponseValidationError = (e) => e instanceof ResponseValidationError;
+var isRequestValidationError = (e) => e instanceof RequestValidationError;
+var isRequestTimeoutError = (e) => e instanceof RequestTimeoutError;
+var isNetworkError = (e) => e instanceof NetworkError;
+var isRequestAbortedError = (e) => e instanceof RequestAbortedError;
+var isConfigError = (e) => e instanceof ConfigError;
+var isActionError = (e) => e instanceof ActionError;
+// src/api-wrapper/builders.ts
+import { ZodError as ZodError2 } from "zod";
+function buildUrl(endpoint, params, reqQuery, baseApiUrls, defaultBaseApiUrl, url, configError) {
   if (url) {
-    const finalUrl2 = replacePathParams(url, params);
-    const queryString2 = new URLSearchParams(buildQueryParams(endpoint, reqQuery)).toString();
+    const finalUrl2 = replacePathParams(url, params, configError);
+    const queryString2 = new URLSearchParams(buildQueryParamsRaw(endpoint, reqQuery)).toString();
     return {
       finalUrl: finalUrl2,
       fullUrl: queryString2 ? `${finalUrl2}?${queryString2}` : finalUrl2
@@ -158,32 +352,57 @@ function buildUrl(endpoint, params, reqQuery, baseApiUrls, defaultBaseApiUrl, ur
   }
   const defaultBaseUrl = defaultBaseApiUrl ?? Object.keys(baseApiUrls)[0];
   if (!defaultBaseUrl) {
-    throw new Error("At least one base API URL is required");
+    throw configError("At least one base API URL is required");
   }
   const baseUrlKey = endpoint.baseApiUrl ?? defaultBaseUrl;
   const configBaseUrl = baseApiUrls[baseUrlKey];
   if (!configBaseUrl) {
-    throw new Error(`Unknown base API URL: ${baseUrlKey}`);
+    throw configError(`Unknown base API URL: ${baseUrlKey}`);
   }
   const baseUrl = typeof configBaseUrl === "function" ? configBaseUrl() : configBaseUrl;
   const path = typeof endpoint.path === "function" ? endpoint.path(baseUrl) : endpoint.path;
-  const finalUrl = replacePathParams(`${baseUrl}${path}`, params);
-  const queryString = new URLSearchParams(buildQueryParams(endpoint, reqQuery)).toString();
+  const finalUrl = replacePathParams(`${baseUrl}${path}`, params, configError);
+  const queryString = new URLSearchParams(buildQueryParamsRaw(endpoint, reqQuery)).toString();
   return {
     finalUrl,
     fullUrl: queryString ? `${finalUrl}?${queryString}` : finalUrl
   };
 }
-function buildQueryParams(endpoint, query) {
+function buildQueryParamsRaw(endpoint, query) {
+  const defaultParams = endpoint.reqDefaultQueryParams ?? {};
+  const merged = { ...defaultParams, ...query ?? {} };
+  return Object.fromEntries(Object.entries(merged).filter(([, value]) => value !== undefined).map(([key, value]) => [key, String(value)]));
+}
+function buildQueryParams(endpoint, query, ctx) {
   const defaultParams = endpoint.reqDefaultQueryParams ?? {};
-  const parsedQuery = endpoint.reqQuerySchema ? endpoint.reqQuerySchema.parse(query) : query ?? {};
+  let parsedQuery;
+  if (endpoint.reqQuerySchema) {
+    try {
+      parsedQuery = endpoint.reqQuerySchema.parse(query);
+    } catch (error) {
+      if (error instanceof ZodError2) {
+        throw new RequestValidationError(error, "query", query, ctx());
+      }
+      throw error;
+    }
+  } else {
+    parsedQuery = query ?? {};
+  }
   const merged = { ...defaultParams, ...parsedQuery };
   return Object.fromEntries(Object.entries(merged).filter(([, value]) => value !== undefined).map(([key, value]) => [key, String(value)]));
 }
-function buildRequestBody(endpoint, body) {
+function buildRequestBody(endpoint, body, ctx) {
   if (!endpoint.reqBodySchema)
     return body;
-  const parsedBody = endpoint.reqBodySchema.parse(body);
+  let parsedBody;
+  try {
+    parsedBody = endpoint.reqBodySchema.parse(body);
+  } catch (error) {
+    if (error instanceof ZodError2) {
+      throw new RequestValidationError(error, "body", body, ctx());
+    }
+    throw error;
+  }
   if (endpoint.reqBodyFormat !== "form-data") {
     return parsedBody;
   }
@@ -195,56 +414,673 @@ function buildRequestBody(endpoint, body) {
   }
   return formData;
 }
-function buildHeaders(endpoint, headers, defaultHeaders) {
+function buildHeaders(endpoint, headers, defaultHeaders, ctx) {
   const contentType = endpoint.reqBodyFormat === "json" ? "application/json" : undefined;
-  const parsedHeaders = endpoint.reqHeadersSchema ? endpoint.reqHeadersSchema.parse(headers) : headers ?? {};
-  return {
+  let parsedHeaders;
+  if (endpoint.reqHeadersSchema) {
+    try {
+      parsedHeaders = endpoint.reqHeadersSchema.parse(headers);
+    } catch (error) {
+      if (error instanceof ZodError2) {
+        throw new RequestValidationError(error, "headers", headers, ctx());
+      }
+      throw error;
+    }
+  } else {
+    parsedHeaders = headers ?? {};
+  }
+  return normalizeHeaders({
     ...defaultHeaders,
     ...contentType && { "Content-Type": contentType },
     ...endpoint.defaultHeaders,
     ...parsedHeaders
-  };
-}
-function buildFetchBody(body, headers) {
-  if (body === undefined || body === null)
-    return;
-  if (body instanceof FormData || body instanceof Blob)
-    return body;
-  if (headers["Content-Type"] === "application/json")
-    return JSON.stringify(body);
-  return body;
+  });
 }
-function replacePathParams(path, params) {
+function replacePathParams(path, params, configError) {
   return path.replace(/:(\w+)/g, (_, key) => {
     const value = params?.[key];
     if (value === undefined) {
-      throw new Error(`Missing required path parameter: ${key}`);
+      throw configError(`Missing required path parameter: ${key}`);
     }
     return encodeURIComponent(String(value));
   });
 }
-function getHeadersAsObject(headers) {
-  const result = {};
-  headers.forEach((value, key) => {
-    result[key] = value;
-  });
-  return result;
+
+// src/api-wrapper/actions-impl.ts
+function createActionCache() {
+  const store = new Map;
+  const isExpired = (entry) => entry.expiresAt !== undefined && entry.expiresAt <= Date.now();
+  const cache = async (key, fn, options) => {
+    const existing = store.get(key);
+    if (existing && !isExpired(existing)) {
+      if (existing.inflight)
+        return existing.inflight;
+      if (existing.hasValue)
+        return existing.value;
+    }
+    const promise = (async () => fn())();
+    const entry = {
+      hasValue: false,
+      inflight: promise,
+      expiresAt: options?.ttlMs !== undefined ? Date.now() + options.ttlMs : undefined
+    };
+    store.set(key, entry);
+    try {
+      const value = await promise;
+      entry.value = value;
+      entry.hasValue = true;
+      entry.inflight = undefined;
+      return value;
+    } catch (error) {
+      store.delete(key);
+      throw error;
+    }
+  };
+  cache.get = (key) => {
+    const entry = store.get(key);
+    if (!entry || !entry.hasValue)
+      return;
+    if (isExpired(entry)) {
+      store.delete(key);
+      return;
+    }
+    return entry.value;
+  };
+  cache.set = (key, value, options) => {
+    store.set(key, {
+      value,
+      hasValue: true,
+      expiresAt: options?.ttlMs !== undefined ? Date.now() + options.ttlMs : undefined
+    });
+  };
+  cache.invalidate = (key) => {
+    store.delete(key);
+  };
+  cache.clear = () => {
+    store.clear();
+  };
+  return cache;
 }
+function makeDefineAction() {
+  function defineAction(...args) {
+    if (args.length === 0) {
+      return (def2) => ({
+        ...def2,
+        noRuntimeInput: false
+      });
+    }
+    const def = args[0];
+    return {
+      ...def,
+      noRuntimeInput: true
+    };
+  }
+  return defineAction;
+}
+var defineAction = makeDefineAction();
+
+// src/api-wrapper/redaction.ts
+var SENSITIVE_HEADER_KEYS = new Set([
+  "authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "x-auth-token"
+]);
+var SENSITIVE_BODY_KEYS = new Set([
+  "password",
+  "token",
+  "accesstoken",
+  "access_token",
+  "refreshtoken",
+  "refresh_token",
+  "secret",
+  "client_secret",
+  "apikey",
+  "api_key"
+]);
+function redactHeaders(headers) {
+  if (!headers)
+    return;
+  const out = {};
+  for (const [k, v] of Object.entries(headers)) {
+    if (SENSITIVE_HEADER_KEYS.has(k.toLowerCase())) {
+      out[k] = "[REDACTED]";
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+function redactBody(body) {
+  if (body === null || body === undefined)
+    return body;
+  if (typeof body !== "object" || Array.isArray(body)) {
+    return body;
+  }
+  const rec = body;
+  const out = { ...rec };
+  for (const key of Object.keys(out)) {
+    if (SENSITIVE_BODY_KEYS.has(key.toLowerCase())) {
+      out[key] = "[REDACTED]";
+    }
+  }
+  return out;
+}
+function defaultRedactContext(ctx) {
+  return {
+    ...ctx,
+    requestHeaders: redactHeaders(ctx.requestHeaders),
+    requestBody: redactBody(ctx.requestBody),
+    meta: ctx.meta
+  };
+}
+
+// src/api-wrapper/error-reporting.ts
+function applyErrorContextRedaction(ctx, config) {
+  const base = defaultRedactContext(ctx);
+  return config.redact ? config.redact(base) : base;
+}
+async function reportApiError(err, config) {
+  err.context = applyErrorContextRedaction(err.context, config);
+  try {
+    await config.onError?.(err);
+  } catch {}
+  config.logger?.error?.(err);
+  return err;
+}
+
+// src/api-wrapper/size.ts
 function calculateSizeInMb(data) {
-  const sizeInBytes = new TextEncoder().encode(JSON.stringify(data)).length;
-  return sizeInBytes / (1024 * 1024);
+  let bytes;
+  if (data === undefined || data === null) {
+    bytes = 0;
+  } else if (data instanceof Blob) {
+    bytes = data.size;
+  } else if (typeof FormData !== "undefined" && data instanceof FormData) {
+    bytes = 0;
+    data.forEach((value) => {
+      if (value instanceof Blob)
+        bytes += value.size;
+      else
+        bytes += new TextEncoder().encode(String(value)).length;
+    });
+  } else if (typeof data === "string") {
+    bytes = new TextEncoder().encode(data).length;
+  } else {
+    bytes = new TextEncoder().encode(JSON.stringify(data) ?? "").length;
+  }
+  return bytes / (1024 * 1024);
+}
+
+// src/api-wrapper/transport.ts
+import { ZodError as ZodError3 } from "zod";
+async function validateResponse(schema, data, ctx) {
+  try {
+    return await schema.parseAsync(data);
+  } catch (error) {
+    if (error instanceof ZodError3) {
+      throw new ResponseValidationError(error, data, ctx());
+    }
+    throw error;
+  }
+}
+async function httpRequest(config, ctx) {
+  const queryString = config.doNotEncodeQueryParams ? Object.entries(config.queryParams).map(([key, value]) => `${key}=${value}`).join("&") : new URLSearchParams(config.queryParams).toString();
+  const fullUrl = queryString ? `${config.url}?${queryString}` : config.url;
+  const timeoutController = new AbortController;
+  const timeout = config.timeoutMs === undefined ? undefined : setTimeout(() => timeoutController.abort(), config.timeoutMs);
+  const signal = mergeSignals(timeoutController.signal, config.userSignal);
+  try {
+    return await config.fetchFn(fullUrl, {
+      method: config.method,
+      headers: config.headers,
+      body: buildFetchBody(config.body, config.headers),
+      signal
+    });
+  } catch (error) {
+    if (isDomAbortError(error)) {
+      if (config.userSignal?.aborted) {
+        throw new RequestAbortedError(ctx(), error);
+      }
+      if (timeoutController.signal.aborted && config.timeoutMs !== undefined) {
+        throw new RequestTimeoutError(config.timeoutMs, ctx());
+      }
+      throw new RequestAbortedError(ctx(), error);
+    }
+    throw new NetworkError(error instanceof Error ? error.message : String(error), ctx(), error);
+  } finally {
+    if (timeout)
+      clearTimeout(timeout);
+  }
+}
+function isDomAbortError(error) {
+  return typeof error === "object" && error !== null && "name" in error && error.name === "AbortError";
+}
+function mergeSignals(a, b) {
+  if (!b)
+    return a;
+  const anyFn = AbortSignal.any;
+  if (typeof anyFn === "function")
+    return anyFn([a, b]);
+  const controller = new AbortController;
+  const onAbort = () => controller.abort();
+  if (a.aborted)
+    controller.abort();
+  else
+    a.addEventListener("abort", onAbort, { once: true });
+  if (b.aborted)
+    controller.abort();
+  else
+    b.addEventListener("abort", onAbort, { once: true });
+  return controller.signal;
+}
+async function readErrorResponse(response) {
+  const body = await response.text();
+  return {
+    body,
+    headers: getHeadersAsObject(response.headers),
+    status: response.status
+  };
 }
-function defaultShouldRetry({ error, response }) {
+function getRetryDelay(params) {
+  const { retryDelay, attempt, response } = params;
+  if (response && (response.status === 429 || response.status === 503)) {
+    const retryAfter = response.headers.get("retry-after");
+    if (retryAfter) {
+      const seconds = Number(retryAfter);
+      if (Number.isFinite(seconds))
+        return seconds * 1000;
+      const dateMs = Date.parse(retryAfter);
+      if (!Number.isNaN(dateMs)) {
+        return Math.max(0, dateMs - Date.now());
+      }
+    }
+  }
+  if (typeof retryDelay === "function")
+    return retryDelay(attempt);
+  return retryDelay;
+}
+function shouldAttemptRetryOnError(error) {
+  if (error instanceof HttpResponseError)
+    return false;
+  if (error instanceof ResponseValidationError)
+    return false;
+  if (error instanceof RequestValidationError)
+    return false;
+  if (error instanceof ConfigError)
+    return false;
+  if (error instanceof RequestAbortedError)
+    return false;
+  return true;
+}
+function shouldAttemptRetryOnHttp(retryCtx) {
+  const { error, response } = retryCtx;
   if (error)
-    return true;
-  return response ? response.status >= 500 : false;
+    return shouldAttemptRetryOnError(error);
+  return response ? response.status >= 500 || response.status === 429 : false;
+}
+async function makeRequestWithRetry(args) {
+  const {
+    config,
+    maxRetries,
+    retryDelay,
+    validateFn,
+    shouldRetry,
+    logger,
+    ctx,
+    endpointName,
+    method,
+    fullUrl,
+    meta,
+    onResponse,
+    onRetry
+  } = args;
+  let retryCount = 0;
+  while (true) {
+    let response;
+    try {
+      logger?.debug?.("API request", config);
+      response = await httpRequest(config, (over) => ctx({ attempt: retryCount, ...over }));
+      await onResponse?.({
+        endpoint: endpointName,
+        method,
+        url: fullUrl,
+        response: response.clone(),
+        attempt: retryCount,
+        meta
+      });
+      if (response.status >= 400) {
+        const retryCtx = {
+          response,
+          retryCount,
+          maxRetries,
+          endpoint: endpointName,
+          method,
+          url: fullUrl
+        };
+        if (retryCount < maxRetries && shouldRetry(retryCtx)) {
+          const delayMs = getRetryDelay({
+            retryDelay,
+            attempt: retryCount,
+            response
+          });
+          await onRetry?.({
+            ...retryCtx,
+            delayMs,
+            nextAttempt: retryCount + 1
+          });
+          retryCount++;
+          await delay(delayMs);
+          continue;
+        }
+        const { body, headers: responseHeaders } = await readErrorResponse(response);
+        throw new HttpResponseError(response.status, body, responseHeaders, ctx({ attempt: retryCount }));
+      }
+      return {
+        validatedData: await validateFn(response),
+        retryCount,
+        httpStatus: response.status
+      };
+    } catch (error) {
+      if (error instanceof HttpResponseError || error instanceof ResponseValidationError || error instanceof RequestValidationError || error instanceof ConfigError || error instanceof RequestAbortedError) {
+        throw error;
+      }
+      const retryCtx = {
+        error,
+        retryCount,
+        maxRetries,
+        endpoint: endpointName,
+        method,
+        url: fullUrl
+      };
+      if (retryCount >= maxRetries || !shouldRetry(retryCtx)) {
+        throw error;
+      }
+      const delayMs = getRetryDelay({
+        retryDelay,
+        attempt: retryCount,
+        response: undefined
+      });
+      await onRetry?.({
+        ...retryCtx,
+        delayMs,
+        nextAttempt: retryCount + 1
+      });
+      retryCount++;
+      await delay(delayMs);
+    }
+  }
+}
+async function validateAndTransformResponse(endpoint, response, ctx) {
+  const responseHeaders = getHeadersAsObject(response.headers);
+  let responseData;
+  if (hasJsonContentType(responseHeaders)) {
+    const text = await response.text();
+    try {
+      responseData = text === "" ? undefined : JSON.parse(text);
+    } catch (error) {
+      throw new ResponseValidationError(makeJsonParseZodError(error, text), text, ctx());
+    }
+  } else {
+    responseData = await response.text();
+  }
+  const transformedData = endpoint.resFormatter ? endpoint.resFormatter(responseData, responseHeaders) : responseData;
+  return validateResponse(endpoint.resSchema, transformedData, ctx);
+}
+function defaultShouldRetry(ctx) {
+  if (ctx.error)
+    return shouldAttemptRetryOnError(ctx.error);
+  return shouldAttemptRetryOnHttp(ctx);
 }
 function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+// src/api-wrapper/create-client.ts
+function isActionInvokeOptionsOnly(value) {
+  if (value === null || value === undefined)
+    return false;
+  if (typeof value !== "object" || Array.isArray(value))
+    return false;
+  return Object.keys(value).every((k) => k === "signal" || k === "meta");
+}
+function createApiClientImpl(apiConfig) {
+  let actions = {};
+  const cache = createActionCache();
+  const invokeEndpoint = async (endpointKey, input = {}) => {
+    const endpoint = apiConfig.endpoints[endpointKey];
+    const rawInput = input;
+    const endpointName = apiConfig.name ? `${apiConfig.name}.${String(endpointKey)}` : String(endpointKey);
+    const startedAt = Date.now();
+    const maxRetries = input.retries ?? apiConfig.retries ?? 3;
+    const baseContext = {
+      endpoint: endpointName,
+      method: endpoint?.method ?? "GET",
+      url: "",
+      attempt: 0,
+      maxRetries,
+      elapsedMs: 0,
+      meta: input.meta
+    };
+    const elapsed = () => Date.now() - startedAt;
+    const ctx = (over = {}) => ({
+      ...baseContext,
+      elapsedMs: elapsed(),
+      ...over
+    });
+    if (!endpoint) {
+      throw await reportApiError(new ConfigError(`Unknown API endpoint: ${String(endpointKey)}`, ctx()), apiConfig);
+    }
+    baseContext.method = endpoint.method;
+    let finalUrl;
+    let fullUrl;
+    try {
+      const built = buildUrl(endpoint, rawInput.reqParams, rawInput.reqQuery, apiConfig.baseApiUrls, apiConfig.defaultBaseApiUrl, input.url, (msg) => new ConfigError(msg, ctx()));
+      finalUrl = built.finalUrl;
+      fullUrl = built.fullUrl;
+    } catch (e) {
+      if (e instanceof ApiError)
+        throw await reportApiError(e, apiConfig);
+      throw e;
+    }
+    baseContext.url = fullUrl;
+    let queryParams;
+    let body;
+    let headers;
+    try {
+      queryParams = buildQueryParams(endpoint, rawInput.reqQuery, ctx);
+      body = buildRequestBody(endpoint, rawInput.reqBody, ctx);
+      headers = buildHeaders(endpoint, rawInput.reqHeaders, apiConfig.defaultHeaders ?? {}, ctx);
+    } catch (e) {
+      if (e instanceof ApiError)
+        throw await reportApiError(e, apiConfig);
+      throw e;
+    }
+    baseContext.requestHeaders = headers;
+    baseContext.requestBody = body;
+    if (apiConfig.onRequest) {
+      try {
+        const result = await apiConfig.onRequest({
+          endpoint: endpointName,
+          method: endpoint.method,
+          url: fullUrl,
+          headers,
+          body,
+          meta: input.meta
+        });
+        if (result?.headers)
+          headers = result.headers;
+        if (result && "body" in result)
+          body = result.body;
+      } catch (e) {
+        if (e instanceof ApiError)
+          throw await reportApiError(e, apiConfig);
+        throw e;
+      }
+    }
+    const config = {
+      method: endpoint.method,
+      url: finalUrl,
+      queryParams,
+      body,
+      headers,
+      doNotEncodeQueryParams: endpoint.doNotEncodeQueryParams,
+      timeoutMs: input.timeoutMs ?? apiConfig.timeoutMs,
+      fetchFn: input.fetch ?? apiConfig.fetch ?? fetch,
+      userSignal: input.signal
+    };
+    try {
+      const result = await makeRequestWithRetry({
+        config,
+        maxRetries,
+        retryDelay: apiConfig.retryDelayMs ?? 300,
+        validateFn: (response) => validateAndTransformResponse(endpoint, response, ctx),
+        shouldRetry: apiConfig.shouldRetry ?? defaultShouldRetry,
+        logger: apiConfig.logger,
+        ctx,
+        endpointName,
+        method: endpoint.method,
+        fullUrl,
+        meta: input.meta,
+        onResponse: apiConfig.onResponse,
+        onRetry: apiConfig.onRetry
+      });
+      const responseTimeMs = elapsed();
+      const responseSizeMb = calculateSizeInMb(result.validatedData);
+      const requestBodySizeMb = calculateSizeInMb(config.body);
+      return {
+        data: result.validatedData,
+        requestBodySizeMb,
+        responseSizeMb,
+        responseTimeMs,
+        httpStatus: result.httpStatus,
+        retryCount: result.retryCount
+      };
+    } catch (error) {
+      if (error instanceof ApiError)
+        throw await reportApiError(error, apiConfig);
+      throw error;
+    }
+  };
+  async function invokeAction(name, rawInput, options = {}) {
+    const action = actions[name];
+    const inputForHandler = action.noRuntimeInput ? undefined : rawInput;
+    const actionName = apiConfig.name ? `${apiConfig.name}.${name}` : name;
+    const startedAt = Date.now();
+    const baseContext = {
+      endpoint: actionName,
+      method: "GET",
+      url: "",
+      attempt: 0,
+      maxRetries: 0,
+      elapsedMs: 0,
+      meta: options.meta,
+      requestBody: action.noRuntimeInput ? undefined : rawInput
+    };
+    const ctx = (over = {}) => ({
+      ...baseContext,
+      elapsedMs: Date.now() - startedAt,
+      ...over
+    });
+    apiConfig.logger?.debug?.("Action start", { action: actionName });
+    try {
+      const result = await action.handler({
+        input: inputForHandler,
+        api: proxy,
+        signal: options.signal,
+        meta: options.meta,
+        logger: apiConfig.logger,
+        cache
+      });
+      apiConfig.logger?.debug?.("Action end", {
+        action: actionName,
+        elapsedMs: Date.now() - startedAt
+      });
+      return result;
+    } catch (error) {
+      if (error instanceof ApiError) {
+        throw await reportApiError(error, apiConfig);
+      }
+      const wrapped = new ActionError(`Action ${actionName} failed: ${error instanceof Error ? error.message : String(error)}`, ctx(), error);
+      throw await reportApiError(wrapped, apiConfig);
+    }
+  }
+  const request = async (key, input, options) => {
+    if (key in actions) {
+      const action = actions[key];
+      if (action.noRuntimeInput) {
+        if (input === undefined || input === null) {
+          return invokeAction(key, undefined, options ?? {});
+        }
+        if (options !== undefined) {
+          return invokeAction(key, undefined, options);
+        }
+        if (isActionInvokeOptionsOnly(input)) {
+          return invokeAction(key, undefined, input);
+        }
+        return invokeAction(key, undefined, {});
+      }
+      return invokeAction(key, input, options);
+    }
+    return invokeEndpoint(key, input ?? {});
+  };
+  const client = { request, cache };
+  const proxy = new Proxy(client, {
+    get(target, prop, receiver) {
+      if (prop in target || typeof prop !== "string") {
+        return Reflect.get(target, prop, receiver);
+      }
+      if (prop in apiConfig.endpoints) {
+        return (input) => invokeEndpoint(prop, input ?? {});
+      }
+      if (prop in actions) {
+        const action = actions[prop];
+        if (action.noRuntimeInput) {
+          return (first, second) => {
+            if (first === undefined || first === null) {
+              return invokeAction(prop, undefined, second ?? {});
+            }
+            if (second !== undefined) {
+              return invokeAction(prop, undefined, second);
+            }
+            if (isActionInvokeOptionsOnly(first)) {
+              return invokeAction(prop, undefined, first);
+            }
+            return invokeAction(prop, undefined, {});
+          };
+        }
+        return (input, opt) => invokeAction(prop, input, opt);
+      }
+      return;
+    }
+  });
+  const rawActions = apiConfig.actions;
+  if (typeof rawActions === "function") {
+    actions = rawActions({
+      api: proxy,
+      defineAction: makeDefineAction()
+    });
+  } else if (rawActions) {
+    actions = rawActions;
+  }
+  const collisions = Object.keys(actions).filter((key) => (key in apiConfig.endpoints));
+  if (collisions.length > 0) {
+    throw new ConfigError(`Action name(s) collide with endpoint name(s): ${collisions.join(", ")}`, {
+      endpoint: collisions[0],
+      method: "GET",
+      url: "",
+      attempt: 0,
+      maxRetries: 0,
+      elapsedMs: 0
+    });
+  }
+  return proxy;
+}
+var createApiClient = (apiConfig) => createApiClientImpl(apiConfig);
 // src/secrets/infisical.ts
 import { z } from "zod";
+var DEFAULT_INFISICAL_SITE_URL = "https://eu.infisical.com";
 var defaultFetch = globalThis.fetch;
 var infisicalAuthResponseSchema = z.object({
   accessToken: z.string()
@@ -256,19 +1092,14 @@ var infisicalSecretSchema = z.object({
 var infisicalSecretsResponseSchema = z.object({
   secrets: z.array(infisicalSecretSchema)
 });
-async function loadInfisicalSecrets({
+async function fetchInfisicalSecrets({
   keys,
   projectId,
   environment,
   siteUrl,
-  clientIdEnvKey,
-  clientSecretEnvKey
+  clientId,
+  clientSecret
 }) {
-  const clientId = process.env[clientIdEnvKey];
-  const clientSecret = process.env[clientSecretEnvKey];
-  if (!clientId || !clientSecret) {
-    throw new Error("Missing Infisical credentials");
-  }
   const infisical = createInfisicalApiClient(siteUrl);
   const { data: auth } = await infisical.request("login", {
     reqBody: {
@@ -292,6 +1123,28 @@ async function loadInfisicalSecrets({
   const wantedKeys = new Set(keys);
   return Object.fromEntries(data.secrets.filter((secret) => wantedKeys.has(secret.secretKey)).map((secret) => [secret.secretKey, secret.secretValue]));
 }
+async function loadInfisicalSecrets({
+  keys,
+  projectId,
+  environment,
+  siteUrl,
+  clientIdEnvKey,
+  clientSecretEnvKey
+}) {
+  const clientId = process.env[clientIdEnvKey];
+  const clientSecret = process.env[clientSecretEnvKey];
+  if (!clientId || !clientSecret) {
+    throw new Error("Missing Infisical credentials");
+  }
+  return fetchInfisicalSecrets({
+    keys,
+    projectId,
+    environment,
+    siteUrl,
+    clientId,
+    clientSecret
+  });
+}
 function createInfisicalApiClient(siteUrl) {
   return createApiClient({
     name: "infisical",
@@ -335,6 +1188,48 @@ function getFetch() {
   return globalThis.fetch ?? defaultFetch;
 }
 
+// src/secrets/loaders.ts
+function cloudflareWorkerEnvLoader(workerEnv) {
+  return async (ctx) => {
+    const out = {};
+    for (const key of ctx.keys) {
+      const str = workerBindingToString(workerEnv[key]);
+      if (str !== undefined) {
+        out[key] = str;
+      }
+    }
+    return out;
+  };
+}
+function workerBindingToString(value) {
+  if (value === undefined || value === null) {
+    return;
+  }
+  if (typeof value === "string") {
+    return value === "" ? undefined : value;
+  }
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  if (typeof value === "object") {
+    return JSON.stringify(value);
+  }
+  return String(value);
+}
+function infisicalLoader(config) {
+  return async (ctx) => fetchInfisicalSecrets({
+    keys: ctx.keys,
+    projectId: config.projectId,
+    environment: ctx.environment,
+    siteUrl: config.siteUrl ?? DEFAULT_INFISICAL_SITE_URL,
+    clientId: config.clientId,
+    clientSecret: config.clientSecret
+  });
+}
+async function processEnvLoader(_ctx) {
+  return {};
+}
+
 // src/secrets/vite.ts
 function getViteDefine(secretSet) {
   return Object.fromEntries(Object.entries(secretSet.secrets()).map(([key, value]) => [
@@ -351,9 +1246,6 @@ function viteSecretSetPlugin(secretSet) {
   };
 }
 
-// src/secrets/index.ts
-import { networkInterfaces } from "node:os";
-
 // src/cool-console-log/index.ts
 var terminalColors = {
   reset: "\x1B[0m",
@@ -460,9 +1352,6 @@ function logBanner(text, color = "cyan", options = {}) {
 }
 
 // src/secrets/index.ts
-var DEFAULT_INFISICAL_SITE_URL = "https://eu.infisical.com";
-var LOCAL_IP_VALUE = "LOCAL_IP";
-var VPN_INTERFACE_RE = /^(utun|tun|tailscale|wg|ipsec|ppp)/i;
 var logger = createCoolLogger();
 function getSecretEnvironment() {
   const env = process.env.SECRETS_ENV || "development";
@@ -474,61 +1363,91 @@ function getSecretEnvironment() {
 }
 async function defineSecretSet(keys, options) {
   const keySet = [...new Set(keys)];
-  const loader = options.loader ?? loadInfisicalSecrets;
-  const getLocalIp = options.getLocalIp ?? getLocalIpAddress;
+  const resolvedOptions = resolveSecretSetOptions(options);
   let cachedSecrets = null;
-  const resolveValue = (value) => {
-    if (value === LOCAL_IP_VALUE)
-      return getLocalIp();
-    return value;
-  };
   const loadSecrets = async (force = false) => {
-    const envSecrets = readEnvSecrets(keySet, force ? cachedSecrets : null);
-    const keysMissingFromEnv = keySet.filter((key) => !envSecrets[key]);
-    const environment = resolveEnvironment(options.environment);
-    logSecretEnvironment(environment, keySet.length);
-    const loadedSecrets = keysMissingFromEnv.length === 0 && !force ? {} : await loader({
-      keys: keySet,
-      projectId: options.projectId,
-      environment,
-      siteUrl: options.siteUrl ?? DEFAULT_INFISICAL_SITE_URL,
-      clientIdEnvKey: options.clientIdEnvKey ?? "INFISICAL_CLIENT_ID",
-      clientSecretEnvKey: options.clientSecretEnvKey ?? "INFISICAL_CLIENT_SECRET"
+    const nextSecrets = await loadAndMergeSecrets({
+      keySet,
+      cachedSecrets,
+      force,
+      ...resolvedOptions
     });
-    const missingKeys = keySet.filter((key) => !(envSecrets[key] ?? loadedSecrets[key]));
-    if (missingKeys.length > 0) {
-      throw new Error(`Missing secrets: ${missingKeys.join(", ")}`);
-    }
-    const nextSecrets = Object.fromEntries(keySet.map((key) => [
-      key,
-      resolveValue(envSecrets[key] ?? loadedSecrets[key])
-    ]));
-    for (const [key, value] of Object.entries(nextSecrets)) {
-      process.env[key] = value;
-    }
     cachedSecrets = nextSecrets;
     return nextSecrets;
   };
+  const secretSet = createSecretSet({
+    getCachedSecrets: () => cachedSecrets,
+    reload: loadSecrets
+  });
+  await loadSecrets();
+  return secretSet;
+}
+function resolveSecretSetOptions(options) {
+  const environment = resolveEnvironment(options.environment);
+  const loader = options.loader ? options.loader : (context) => loadInfisicalSecrets({
+    ...context,
+    projectId: options.projectId,
+    siteUrl: options.siteUrl ?? DEFAULT_INFISICAL_SITE_URL,
+    clientIdEnvKey: options.clientIdEnvKey ?? "INFISICAL_CLIENT_ID",
+    clientSecretEnvKey: options.clientSecretEnvKey ?? "INFISICAL_CLIENT_SECRET"
+  });
+  return {
+    loader,
+    environment
+  };
+}
+async function loadAndMergeSecrets({
+  keySet,
+  cachedSecrets,
+  loader,
+  environment,
+  force
+}) {
+  const processEnvSecrets = readProcessEnvSecrets(keySet, force ? cachedSecrets : null);
+  const keysMissingFromEnv = keySet.filter((key) => !processEnvSecrets[key]);
+  logSecretEnvironment(environment, keySet.length);
+  const loaderKeys = force ? keySet : keysMissingFromEnv;
+  const loadedSecrets = loaderKeys.length === 0 ? {} : await loader({
+    keys: loaderKeys,
+    environment
+  });
+  const missingKeys = keySet.filter((key) => !(processEnvSecrets[key] ?? loadedSecrets[key]));
+  if (missingKeys.length > 0) {
+    throw new Error(`Missing secrets: ${missingKeys.join(", ")}`);
+  }
+  const nextSecrets = Object.fromEntries(keySet.map((key) => [
+    key,
+    processEnvSecrets[key] ?? loadedSecrets[key]
+  ]));
+  for (const [key, value] of Object.entries(nextSecrets)) {
+    process.env[key] = value;
+  }
+  return nextSecrets;
+}
+function createSecretSet({
+  getCachedSecrets,
+  reload
+}) {
   const secretSet = {
     secret(key) {
-      const value = cachedSecrets?.[key] ?? process.env[key];
+      const value = getCachedSecrets()?.[key] ?? process.env[key];
       if (!value) {
         throw new Error(`Secret ${key} not found`);
       }
-      return resolveValue(value);
+      return value;
     },
     secrets() {
+      const cachedSecrets = getCachedSecrets();
       if (!cachedSecrets) {
         throw new Error("Secrets not initialized.");
       }
-      return cachedSecrets;
+      return { ...cachedSecrets };
     },
     async reload() {
-      await loadSecrets(true);
+      await reload(true);
       return secretSet;
     }
   };
-  await loadSecrets();
   return secretSet;
 }
 function resolveEnvironment(environment) {
@@ -542,32 +1461,21 @@ function logSecretEnvironment(environment, secretCount) {
     count: secretCount
   });
 }
-function readEnvSecrets(keys, previousSecrets = null) {
+function readProcessEnvSecrets(keys, previousSecrets = null) {
   return Object.fromEntries(keys.filter((key) => {
     const value = process.env[key];
     return value && value !== previousSecrets?.[key];
   }).map((key) => [key, process.env[key]]));
 }
-function getLocalIpAddress() {
-  const interfaces = networkInterfaces();
-  for (const name of Object.keys(interfaces)) {
-    if (VPN_INTERFACE_RE.test(name))
-      continue;
-    const nets = interfaces[name];
-    if (!nets)
-      continue;
-    for (const net of nets) {
-      if (net.family === "IPv4" && !net.internal) {
-        return net.address;
-      }
-    }
-  }
-  return "127.0.0.1";
-}
 export {
   viteSecretSetPlugin,
+  processEnvLoader,
   loadInfisicalSecrets,
+  infisicalLoader,
   getViteDefine,
   getSecretEnvironment,
-  defineSecretSet
+  fetchInfisicalSecrets,
+  defineSecretSet,
+  cloudflareWorkerEnvLoader,
+  DEFAULT_INFISICAL_SITE_URL
 };