hanzio 1.1.0 → 1.2.0

package/README.md

@@ -218,26 +218,51 @@ await promiseTimeout(250)
 `defineSecretSet` loads a typed set of required secrets from `process.env` or
 Infisical before the rest of the program starts.
 
+When both `INFISICAL_CLIENT_ID` and `INFISICAL_CLIENT_SECRET` are set, it uses
+Infisical's HTTP API. If either is missing, it uses your signed-in Infisical CLI
+session. For local development, install the CLI and run
+`infisical login --domain=https://eu.infisical.com` (or your configured
+`siteUrl`). See the [secrets documentation](src/secrets/README.md) for details.
+
 ```ts
 import { defineSecretSet } from 'hanzio/secrets'
 
 export const backendSecrets = await defineSecretSet(
 	['DATABASE_URL', 'APP_SECRET'] as const,
-	{ projectId: 'infisical-project-id' }
+	{
+		organizationId: 'infisical-organization-id',
+		projectId: 'infisical-project-id'
+	}
 )
 
 const databaseUrl = backendSecrets.secret('DATABASE_URL')
 ```
 
+The required `organizationId` scopes the CLI session per secret set, allowing projects
+in different organizations to run together without switching the active CLI
+organization. This flow reads the CLI user token and fetches secrets over HTTP;
+tokens remain in memory. Use `writeToProcessEnv: false` for multiple sets in one
+process. Both `organizationId` and `projectId` are required for Infisical loading.
+
 For Vite config, `viteSecretSetPlugin(secretSet)` exposes the loaded values as
 `import.meta.env.*` replacements. Use `getViteDefine(secretSet)` if you need the
-raw `define` object. Import Vite helpers from `hanzio/secrets/vite` so browser
-bundles do not pull in the Infisical SDK.
+raw `define` object. Vite helpers accept only `VITE_` keys by default; use an
+explicit `publicKeys` list to select public values from a mixed set. Import
+these helpers from `hanzio/secrets/vite`.
+
+The helper supports `auth: 'auto' | 'http' | 'cli'`, `secretPath`, deadlines,
+cancellation, optional schema validation, per-key source metadata, and
+`writeToProcessEnv: false` for isolated sets. Use `hanzio/secrets/worker` for
+Cloudflare bindings without Node compatibility. See the
+[migration notes](src/secrets/README.md#migration-notes) for stricter environment
+validation and browser exposure rules.
 
 ### Cache
 
 `cacheFunction` wraps sync or async functions with TTL caching and request
-deduplication.
+deduplication. With `refreshInBackground: true`, stale entries are served
+immediately while a background refresh updates the cache
+(stale-while-revalidate).
 
 ```ts
 import { cacheFunction } from 'hanzio'
@@ -252,6 +277,47 @@ const user = await getUser('user_1')
 getUser.clearCache()
 ```
 
+#### External stores (e.g. Redis)
+
+By default entries live in an in-memory `Map`. Pass a `store` to keep entries
+in an external cache instead. A store implements `get`, `set`, and `delete`
+(plus an optional `clear`, used by `clearCache`); hanzio never imports the
+underlying client, so any backend works. Serialization is the adapter's
+responsibility, and the `ttlMs` passed to `set` maps to the store's native
+expiry. External stores are only supported for async functions.
+
+```ts
+import { cacheFunction, type CacheStore, type CacheStoreEntry } from 'hanzio'
+import Redis from 'ioredis'
+
+const redis = new Redis()
+
+const redisStore: CacheStore = {
+	get: async (key) => {
+		const raw = await redis.get(key)
+		return raw ? (JSON.parse(raw) as CacheStoreEntry) : undefined
+	},
+	set: async (key, entry, ttlMs) => {
+		await redis.set(key, JSON.stringify(entry), 'PX', ttlMs)
+	},
+	delete: async (key) => {
+		await redis.del(key)
+	}
+}
+
+const getUser = cacheFunction({
+	name: 'getUser',
+	fn: async (id: string) => ({ id, name: 'Ada' }),
+	cacheTimeMs: 60_000,
+	store: redisStore,
+	onStoreError: (error) => console.error('cache store failed', error)
+})
+```
+
+Store failures never break the cached function: on a failed `get` or `set`
+the wrapped function falls back to calling `fn` directly, and the optional
+`onStoreError` callback is invoked.
+
 ### State Machine
 
 `SimpleStateMachine` models typed states, actions, validation, and action

package/dist/api-wrapper/builders.d.ts

@@ -1,11 +1,22 @@
 import { type ConfigError } from './errors';
 import type { ApiErrorContext, BaseApiUrl, PathParams, QueryParams } from './shared';
 import type { ApiEndpoint } from './types';
-export declare function buildUrl(endpoint: ApiEndpoint, params: PathParams | undefined, reqQuery: QueryParams | undefined, baseApiUrls: Record<string, BaseApiUrl>, defaultBaseApiUrl: string | undefined, url: string | undefined, configError: (msg: string) => ConfigError): {
+export type BuildUrlOptions = {
+    endpoint: ApiEndpoint;
+    params: PathParams | undefined;
+    queryParams: Record<string, string>;
+    baseApiUrls: Record<string, BaseApiUrl>;
+    defaultBaseApiUrl: string | undefined;
+    url: string | undefined;
+    doNotEncodeQueryParams?: boolean;
+    configError: (msg: string) => ConfigError;
+};
+export declare function formatQueryString(queryParams: Record<string, string>, doNotEncode?: boolean): string;
+export declare function buildUrl(options: BuildUrlOptions): {
     finalUrl: string;
     fullUrl: string;
 };
-export declare function buildQueryParamsRaw(endpoint: ApiEndpoint, query: QueryParams | undefined): Record<string, string>;
+export declare function buildPathParams(endpoint: ApiEndpoint, params: PathParams | undefined, ctx: (over?: Partial<ApiErrorContext>) => ApiErrorContext): PathParams | undefined;
 export declare function buildQueryParams(endpoint: ApiEndpoint, query: QueryParams | undefined, ctx: (over?: Partial<ApiErrorContext>) => ApiErrorContext): Record<string, string>;
 export declare function buildRequestBody(endpoint: ApiEndpoint, body: unknown, ctx: (over?: Partial<ApiErrorContext>) => ApiErrorContext): unknown;
 export declare function buildHeaders(endpoint: ApiEndpoint, headers: Record<string, string> | undefined, defaultHeaders: Record<string, string>, ctx: (over?: Partial<ApiErrorContext>) => ApiErrorContext): Record<string, string>;

package/dist/api-wrapper/errors.d.ts

@@ -61,3 +61,4 @@ export declare const isNetworkError: (e: unknown) => e is NetworkError;
 export declare const isRequestAbortedError: (e: unknown) => e is RequestAbortedError;
 export declare const isConfigError: (e: unknown) => e is ConfigError;
 export declare const isActionError: (e: unknown) => e is ActionError;
+export declare function isNonRetryableApiError(error: unknown): boolean;

package/dist/api-wrapper/headers.d.ts

@@ -1,3 +1,4 @@
+import type { ConfigError } from './errors';
 /**
  * Normalize headers to canonical case so lookups are deterministic. Later
  * occurrences of the same header (case-insensitive) win.
@@ -5,5 +6,5 @@
 export declare function normalizeHeaders(headers: Record<string, string>): Record<string, string>;
 export declare function getHeader(headers: Record<string, string>, name: string): string | undefined;
 export declare function hasJsonContentType(headers: Record<string, string>): boolean;
-export declare function buildFetchBody(body: unknown, headers: Record<string, string>): RequestInit['body'];
+export declare function buildFetchBody(body: unknown, headers: Record<string, string>, configError?: (msg: string) => ConfigError): RequestInit['body'];
 export declare function getHeadersAsObject(headers: Headers): Record<string, string>;

package/dist/api-wrapper/transport.d.ts

@@ -3,11 +3,9 @@ import type { ApiEndpoint, OnResponseContext, OnRetryContext, RetryContext } fro
 import type { ApiErrorContext, HttpMethod } from './shared';
 export type RequestConfig = {
     method: HttpMethod;
-    url: string;
-    queryParams: Record<string, string>;
+    fullUrl: string;
     body: unknown;
     headers: Record<string, string>;
-    doNotEncodeQueryParams?: boolean;
     timeoutMs?: number;
     fetchFn: typeof fetch;
     userSignal?: AbortSignal;
@@ -24,6 +22,7 @@ export declare function getRetryDelay(params: {
     retryDelay: number | ((attempt: number) => number);
     attempt: number;
     response?: Response;
+    maxRetryDelayMs?: number;
 }): number;
 export declare function shouldAttemptRetryOnError(error: unknown): boolean;
 export declare function shouldAttemptRetryOnHttp(retryCtx: RetryContext): boolean;
@@ -31,7 +30,8 @@ type MakeRequestArgs<TValidated> = {
     config: RequestConfig;
     maxRetries: number;
     retryDelay: number | ((attempt: number) => number);
-    validateFn: (response: Response) => Promise<TValidated>;
+    maxRetryDelayMs?: number;
+    validateFn: (response: Response, attempt: number) => Promise<TValidated>;
     shouldRetry: (context: RetryContext) => boolean;
     logger?: Pick<Console, 'debug'>;
     ctx: (over?: Partial<ApiErrorContext>) => ApiErrorContext;
@@ -47,6 +47,9 @@ export declare function makeRequestWithRetry<TValidated>(args: MakeRequestArgs<T
     retryCount: number;
     httpStatus: number;
 }>;
-export declare function validateAndTransformResponse<T extends z.ZodType>(endpoint: ApiEndpoint<z.ZodType | undefined, z.ZodType | undefined, z.ZodType | undefined, z.ZodType | undefined, T>, response: Response, ctx: (over?: Partial<ApiErrorContext>) => ApiErrorContext): Promise<z.infer<T>>;
+export declare function validateAndTransformResponse<T extends z.ZodType>(endpoint: ApiEndpoint<z.ZodType | undefined, z.ZodType | undefined, z.ZodType | undefined, z.ZodType | undefined, T>, response: Response, ctx: (over?: Partial<ApiErrorContext>) => ApiErrorContext): Promise<{
+    data: z.infer<T>;
+    responseSizeBytes: number;
+}>;
 export declare function defaultShouldRetry(ctx: RetryContext): boolean;
 export {};

package/dist/api-wrapper/types.d.ts

@@ -136,6 +136,7 @@ export interface ApiClientConfig<T extends Record<string, ApiEndpoint>, A extend
     timeoutMs?: number;
     retries?: number;
     retryDelayMs?: number | ((attempt: number) => number);
+    maxRetryDelayMs?: number;
     shouldRetry?: (context: RetryContext) => boolean;
     logger?: Pick<Console, 'debug' | 'error'>;
     fetch?: typeof fetch;

package/dist/cache/index.d.ts

@@ -3,6 +3,23 @@ type CachedFunction<T extends AnyFunction> = {
     (...args: Parameters<T>): ReturnType<T>;
     clearCache: () => void;
 };
+export type CacheStoreEntry = {
+    value: unknown;
+    timestamp: number;
+};
+/**
+ * Contract for external cache stores (e.g. a Redis adapter).
+ * Serialization is the adapter's responsibility; this library never imports
+ * the underlying client.
+ */
+export type CacheStore = {
+    get: (key: string) => Promise<CacheStoreEntry | undefined>;
+    /** `ttlMs` maps to the store's native expiry (e.g. Redis `PX`). */
+    set: (key: string, entry: CacheStoreEntry, ttlMs: number) => Promise<void>;
+    delete: (key: string) => Promise<void>;
+    /** Optional; called by clearCache when defined. */
+    clear?: () => Promise<void>;
+};
 export type CacheFunctionOptions<T extends AnyFunction> = {
     name: string;
     fn: T;
@@ -14,6 +31,15 @@ export type CacheFunctionOptions<T extends AnyFunction> = {
     onBackgroundRefreshError?: (error: unknown, context: {
         name: string;
     }) => void;
+    /**
+     * External cache store (e.g. a Redis adapter). Only supported for async
+     * functions; when omitted the built-in in-memory cache is used.
+     */
+    store?: ReturnType<T> extends Promise<unknown> ? CacheStore : never;
+    /** Called when a store get/set/delete/clear fails (default: silent). */
+    onStoreError?: (error: unknown, context: {
+        name: string;
+    }) => void;
 };
 export declare function cacheFunction<T extends AnyFunction>(options: CacheFunctionOptions<T>): CachedFunction<T>;
 export {};

package/dist/secrets/core.d.ts

@@ -0,0 +1,47 @@
+import { type SecretRequestOptions } from './deadline';
+import { type EnvironmentVariables, type SecretEnvironmentOption } from './environment';
+export type { SecretEnvironment, SecretEnvironmentOption } from './environment';
+export { SecretLoadError } from './errors';
+export type SecretLogAttributes = {
+    readonly environment: string;
+    readonly count: number;
+    readonly durationMs: number;
+    readonly source?: string;
+    readonly sources?: Readonly<Record<string, number>>;
+    readonly code?: string;
+};
+export type SecretLogger = {
+    info: (message: string, attributes: SecretLogAttributes) => void;
+    error: (message: string, attributes: SecretLogAttributes) => void;
+};
+export type SecretSchema<K extends string, Parsed> = {
+    parseAsync: (values: Record<K, string>) => Promise<Parsed>;
+};
+export type CommonSecretSetOptions<K extends string, Parsed = Record<K, string>> = SecretRequestOptions & {
+    readonly environment?: SecretEnvironmentOption;
+    readonly writeToProcessEnv?: boolean;
+    readonly logger?: SecretLogger | false;
+    readonly schema?: SecretSchema<K, Parsed>;
+};
+export type CustomLoaderDefineSecretSetOptions<K extends string, Parsed = Record<K, string>> = CommonSecretSetOptions<K, Parsed> & {
+    readonly loader: SecretSetLoader<K>;
+};
+export type SecretSetLoaderContext<K extends string> = {
+    readonly keys: readonly K[];
+    readonly environment: string;
+    readonly signal?: AbortSignal;
+    readonly timeoutMs?: number;
+    /** Report the source actually selected by a dynamic loader. */
+    readonly reportSource?: (source: string) => void;
+};
+export type SecretSetLoader<K extends string> = ((context: SecretSetLoaderContext<K>) => Promise<Partial<Record<K, string>>>) & {
+    readonly source?: string;
+};
+export type SecretSet<K extends string, Parsed = Record<K, string>> = {
+    secret: (key: K) => string;
+    secrets: () => Record<K, string>;
+    parsed: () => Parsed;
+    sources: () => Record<K, string>;
+    reload: (options?: SecretRequestOptions) => Promise<SecretSet<K, Parsed>>;
+};
+export declare function defineSecretSet<const Keys extends readonly string[], Parsed = Record<Keys[number], string>>(keys: Keys, options: CustomLoaderDefineSecretSetOptions<Keys[number], Parsed>, environmentVariables?: EnvironmentVariables): Promise<SecretSet<Keys[number], Parsed>>;

package/dist/secrets/deadline.d.ts

@@ -0,0 +1,6 @@
+export type SecretRequestOptions = {
+    readonly timeoutMs?: number;
+    readonly signal?: AbortSignal;
+};
+/** One deadline includes authentication, retries, body reads, and validation. */
+export declare function withSecretDeadline<T>(options: SecretRequestOptions, operation: (signal: AbortSignal) => Promise<T>): Promise<T>;

package/dist/secrets/environment.d.ts

@@ -0,0 +1,9 @@
+export type SecretEnvironment = 'dev' | 'staging' | 'prod';
+export type SecretEnvironmentOption = SecretEnvironment | {
+    readonly slug: string;
+} | (() => SecretEnvironment | {
+    readonly slug: string;
+});
+export type EnvironmentVariables = Record<string, string | undefined>;
+export declare function getProcessEnvironment(): EnvironmentVariables | undefined;
+export declare function resolveSecretEnvironment(option?: SecretEnvironmentOption, env?: EnvironmentVariables): string;

package/dist/secrets/errors.d.ts

@@ -0,0 +1,11 @@
+export type SecretErrorCode = 'CONFIGURATION' | 'AUTHENTICATION' | 'HTTP' | 'CLI' | 'VALIDATION' | 'MISSING_SECRETS' | 'TIMEOUT' | 'ABORTED' | 'LOADER';
+/** Contains only safe diagnostic metadata; never attach underlying errors. */
+export declare class SecretLoadError extends Error {
+    readonly code: SecretErrorCode;
+    readonly operation?: string;
+    readonly status?: number;
+    constructor(code: SecretErrorCode, message: string, details?: {
+        operation?: string;
+        status?: number;
+    });
+}

package/dist/secrets/index.d.ts

@@ -1,30 +1,18 @@
-export type SecretEnvironment = 'dev' | 'staging' | 'prod';
-export type SecretEnvironmentOption = SecretEnvironment | (() => SecretEnvironment);
-export type InfisicalDefineSecretSetOptions = {
-    readonly projectId: string;
-    readonly siteUrl?: string;
-    readonly environment?: SecretEnvironmentOption;
+import { type CommonSecretSetOptions, type CustomLoaderDefineSecretSetOptions, type SecretSet } from './core';
+import { type SecretEnvironment } from './environment';
+import { type InfisicalAuthMode } from './infisical';
+import { type InfisicalProjectOptions } from './infisical-config';
+export * from './core';
+export * from './infisical';
+export * from './loaders';
+export * from './vite';
+export type { SecretRequestOptions } from './deadline';
+export type InfisicalDefineSecretSetOptions<K extends string = string, Parsed = Record<K, string>> = CommonSecretSetOptions<K, Parsed> & InfisicalProjectOptions & {
+    readonly auth?: InfisicalAuthMode;
     readonly clientIdEnvKey?: string;
     readonly clientSecretEnvKey?: string;
     readonly loader?: undefined;
 };
-export type CustomLoaderDefineSecretSetOptions<SecretKey extends string> = {
-    readonly loader: SecretSetLoader<SecretKey>;
-    readonly environment?: SecretEnvironmentOption;
-};
-export type DefineSecretSetOptions<SecretKey extends string> = InfisicalDefineSecretSetOptions | CustomLoaderDefineSecretSetOptions<SecretKey>;
-export type SecretSetLoaderContext<SecretKey extends string> = {
-    readonly keys: readonly SecretKey[];
-    readonly environment: SecretEnvironment;
-};
-export type SecretSetLoader<SecretKey extends string> = (context: SecretSetLoaderContext<SecretKey>) => Promise<Partial<Record<SecretKey, string>>>;
-export type SecretSet<SecretKey extends string> = {
-    secret: (key: SecretKey) => string;
-    secrets: () => Record<SecretKey, string>;
-    reload: () => Promise<SecretSet<SecretKey>>;
-};
-export * from './infisical';
-export * from './loaders';
-export * from './vite';
+export type DefineSecretSetOptions<K extends string, Parsed = Record<K, string>> = InfisicalDefineSecretSetOptions<K, Parsed> | CustomLoaderDefineSecretSetOptions<K, Parsed>;
 export declare function getSecretEnvironment(): SecretEnvironment;
-export declare function defineSecretSet<const SecretKeys extends readonly string[]>(keys: SecretKeys, options: DefineSecretSetOptions<SecretKeys[number]>): Promise<SecretSet<SecretKeys[number]>>;
+export declare function defineSecretSet<const Keys extends readonly string[], Parsed = Record<Keys[number], string>>(keys: Keys, options: DefineSecretSetOptions<Keys[number], Parsed>): Promise<SecretSet<Keys[number], Parsed>>;

package/dist/secrets/infisical-cli.d.ts

@@ -0,0 +1,6 @@
+import type { SecretRequestOptions } from './deadline';
+/** Read the active CLI session without a shell or credential-bearing errors. */
+export declare function readInfisicalCliToken(options: SecretRequestOptions & {
+    siteUrl: string;
+    signal: AbortSignal;
+}): Promise<string>;

package/dist/secrets/infisical-config.d.ts

@@ -0,0 +1,17 @@
+import type { SecretRequestOptions } from './deadline';
+/** Project scope shared by the public Infisical loaders. */
+export type InfisicalProjectOptions = {
+    readonly projectId: string;
+    /** Scope CLI user authentication; machine identities already have an organization. */
+    readonly organizationId: string;
+    readonly siteUrl?: string;
+    readonly secretPath?: string;
+};
+export type InfisicalScope<K extends string> = InfisicalProjectOptions & SecretRequestOptions & {
+    readonly keys: readonly K[];
+    readonly environment: string;
+    readonly siteUrl: string;
+};
+export declare function validateInfisicalScope(options: InfisicalScope<string>): void;
+/** Validate at configuration time, including for JavaScript callers and local-only loads. */
+export declare function validateInfisicalOrganizationId(organizationId: unknown): void;

package/dist/secrets/infisical-session.d.ts

@@ -0,0 +1,4 @@
+/** Read routing metadata only. JWT signature and permissions are verified by Infisical. */
+export declare function parseInfisicalSessionToken(token: string): {
+    organizationId?: string;
+};

package/dist/secrets/infisical.d.ts

@@ -1,19 +1,14 @@
-import type { SecretEnvironment } from '.';
+import { type InfisicalScope } from './infisical-config';
 export declare const DEFAULT_INFISICAL_SITE_URL = "https://eu.infisical.com";
-export declare function fetchInfisicalSecrets<SecretKey extends string>({ keys, projectId, environment, siteUrl, clientId, clientSecret }: {
-    readonly keys: readonly SecretKey[];
-    readonly projectId: string;
-    readonly environment: SecretEnvironment;
-    readonly siteUrl: string;
+export type InfisicalAuthMode = 'auto' | 'http' | 'cli';
+export declare function fetchInfisicalSecrets<K extends string>(options: InfisicalScope<K> & {
     readonly clientId: string;
     readonly clientSecret: string;
-}): Promise<Partial<Record<SecretKey, string>>>;
-export type LoadInfisicalSecretsFromEnvOptions<SecretKey extends string> = {
-    readonly keys: readonly SecretKey[];
-    readonly projectId: string;
-    readonly environment: SecretEnvironment;
-    readonly siteUrl: string;
+}): Promise<Partial<Record<K, string>>>;
+export type LoadInfisicalSecretsFromEnvOptions<K extends string> = InfisicalScope<K> & {
     readonly clientIdEnvKey: string;
     readonly clientSecretEnvKey: string;
+    readonly auth?: InfisicalAuthMode;
+    readonly reportSource?: (source: string) => void;
 };
-export declare function loadInfisicalSecrets<SecretKey extends string>({ keys, projectId, environment, siteUrl, clientIdEnvKey, clientSecretEnvKey }: LoadInfisicalSecretsFromEnvOptions<SecretKey>): Promise<Partial<Record<SecretKey, string>>>;
+export declare function loadInfisicalSecrets<K extends string>(options: LoadInfisicalSecretsFromEnvOptions<K>): Promise<Partial<Record<K, string>>>;

package/dist/secrets/loaders.d.ts

@@ -1,16 +1,9 @@
-import type { SecretSetLoader, SecretSetLoaderContext } from './index';
-/**
- * Reads secrets from a Cloudflare Worker `env` bindings object (or any similar
- * `Record`), for Workers where `process.env` is not populated. Pass the same
- * object you get as `env` in your fetch handler, or values you’d read from
- * `import { env } from "cloudflare:workers"` in your Worker bundle — this
- * package does not import that module.
- */
-export declare function cloudflareWorkerEnvLoader<SecretKey extends string>(workerEnv: Record<string, unknown>): SecretSetLoader<SecretKey>;
-export declare function infisicalLoader<SecretKey extends string>(config: {
-    readonly projectId: string;
+import { type InfisicalProjectOptions } from './infisical-config';
+import type { SecretSetLoader, SecretSetLoaderContext } from './core';
+export { cloudflareWorkerEnvLoader } from './worker-loader';
+export declare function infisicalLoader<SecretKey extends string>(config: InfisicalProjectOptions & {
     readonly clientId: string;
     readonly clientSecret: string;
-    readonly siteUrl?: string;
+    readonly timeoutMs?: number;
 }): SecretSetLoader<SecretKey>;
 export declare function processEnvLoader<SecretKey extends string>(_ctx: SecretSetLoaderContext<SecretKey>): Promise<Partial<Record<SecretKey, string>>>;

package/dist/secrets/vite.d.ts

@@ -1,9 +1,13 @@
-import type { SecretSet } from '.';
+import type { SecretSet } from './core';
 export type ViteSecretSetPlugin = {
     name: string;
     config: () => {
         define: Record<string, string>;
     };
 };
-export declare function getViteDefine<SecretKey extends string>(secretSet: SecretSet<SecretKey>): Record<string, string>;
-export declare function viteSecretSetPlugin<SecretKey extends string>(secretSet: SecretSet<SecretKey>): ViteSecretSetPlugin;
+export type ViteSecretSetOptions<K extends string> = {
+    /** Explicit acknowledgement that these values may be shipped to browsers. */
+    readonly publicKeys?: readonly K[];
+};
+export declare function getViteDefine<K extends string>(secretSet: Pick<SecretSet<K, unknown>, 'secrets'>, options?: ViteSecretSetOptions<K>): Record<string, string>;
+export declare function viteSecretSetPlugin<K extends string>(secretSet: Pick<SecretSet<K, unknown>, 'secrets'>, options?: ViteSecretSetOptions<K>): ViteSecretSetPlugin;

package/dist/secrets/worker-loader.d.ts

@@ -0,0 +1,9 @@
+import type { SecretSetLoader } from './core';
+/**
+ * Reads secrets from a Cloudflare Worker `env` bindings object (or any similar
+ * `Record`), for Workers where `process.env` is not populated. Pass the same
+ * object you get as `env` in your fetch handler, or values you’d read from
+ * `import { env } from "cloudflare:workers"` in your Worker bundle — this
+ * package does not import that module.
+ */
+export declare function cloudflareWorkerEnvLoader<SecretKey extends string>(workerEnv: Record<string, unknown>): SecretSetLoader<SecretKey>;

package/dist/secrets/worker.d.ts

@@ -0,0 +1,3 @@
+export * from './core';
+export { cloudflareWorkerEnvLoader } from './worker-loader';
+export type { SecretRequestOptions } from './deadline';