hanzio 1.1.0 → 1.2.0

package/dist/src/secrets/loaders.js

@@ -1,3 +1,5 @@
+// src/secrets/infisical.ts
+import { z as z2 } from "zod";
 // src/api-wrapper/headers.ts
 var CANONICAL_HEADER_NAMES = {
   "content-type": "Content-Type",
@@ -38,13 +40,16 @@ function hasJsonContentType(headers) {
   const ct = getHeader(headers, "content-type") ?? "";
   return ct.includes("application/json");
 }
-function buildFetchBody(body, headers) {
+function buildFetchBody(body, headers, configError) {
   if (body === undefined || body === null)
     return;
   if (body instanceof FormData || body instanceof Blob)
     return body;
   if (hasJsonContentType(headers))
     return JSON.stringify(body);
+  if (typeof body === "object" && (Object.getPrototypeOf(body) === Object.prototype || Object.getPrototypeOf(body) === null) && configError) {
+    throw configError("Request body is a plain object but Content-Type is not application/json");
+  }
   return body;
 }
 function getHeadersAsObject(headers) {
@@ -339,39 +344,61 @@ var isNetworkError = (e) => e instanceof NetworkError;
 var isRequestAbortedError = (e) => e instanceof RequestAbortedError;
 var isConfigError = (e) => e instanceof ConfigError;
 var isActionError = (e) => e instanceof ActionError;
+function isNonRetryableApiError(error) {
+  return error instanceof HttpResponseError || error instanceof ResponseValidationError || error instanceof RequestValidationError || error instanceof ConfigError || error instanceof RequestAbortedError;
+}
 // src/api-wrapper/builders.ts
 import { ZodError as ZodError2 } from "zod";
-function buildUrl(endpoint, params, reqQuery, baseApiUrls, defaultBaseApiUrl, url, configError) {
+function formatQueryString(queryParams, doNotEncode) {
+  if (Object.keys(queryParams).length === 0)
+    return "";
+  return doNotEncode ? Object.entries(queryParams).map(([key, value]) => `${key}=${value}`).join("&") : new URLSearchParams(queryParams).toString();
+}
+function buildUrl(options) {
+  const {
+    endpoint,
+    params,
+    queryParams,
+    baseApiUrls,
+    defaultBaseApiUrl,
+    url,
+    doNotEncodeQueryParams,
+    configError
+  } = options;
+  let finalUrl;
   if (url) {
-    const finalUrl2 = replacePathParams(url, params, configError);
-    const queryString2 = new URLSearchParams(buildQueryParamsRaw(endpoint, reqQuery)).toString();
-    return {
-      finalUrl: finalUrl2,
-      fullUrl: queryString2 ? `${finalUrl2}?${queryString2}` : finalUrl2
-    };
-  }
-  const defaultBaseUrl = defaultBaseApiUrl ?? Object.keys(baseApiUrls)[0];
-  if (!defaultBaseUrl) {
-    throw configError("At least one base API URL is required");
-  }
-  const baseUrlKey = endpoint.baseApiUrl ?? defaultBaseUrl;
-  const configBaseUrl = baseApiUrls[baseUrlKey];
-  if (!configBaseUrl) {
-    throw configError(`Unknown base API URL: ${baseUrlKey}`);
+    finalUrl = replacePathParams(url, params, configError);
+  } else {
+    const defaultBaseUrl = defaultBaseApiUrl ?? Object.keys(baseApiUrls)[0];
+    if (!defaultBaseUrl) {
+      throw configError("At least one base API URL is required");
+    }
+    const baseUrlKey = endpoint.baseApiUrl ?? defaultBaseUrl;
+    const configBaseUrl = baseApiUrls[baseUrlKey];
+    if (!configBaseUrl) {
+      throw configError(`Unknown base API URL: ${baseUrlKey}`);
+    }
+    const baseUrl = typeof configBaseUrl === "function" ? configBaseUrl() : configBaseUrl;
+    const path = typeof endpoint.path === "function" ? endpoint.path(baseUrl) : endpoint.path;
+    finalUrl = `${baseUrl}${replacePathParams(path, params, configError)}`;
   }
-  const baseUrl = typeof configBaseUrl === "function" ? configBaseUrl() : configBaseUrl;
-  const path = typeof endpoint.path === "function" ? endpoint.path(baseUrl) : endpoint.path;
-  const finalUrl = replacePathParams(`${baseUrl}${path}`, params, configError);
-  const queryString = new URLSearchParams(buildQueryParamsRaw(endpoint, reqQuery)).toString();
+  const queryString = formatQueryString(queryParams, doNotEncodeQueryParams);
   return {
     finalUrl,
     fullUrl: queryString ? `${finalUrl}?${queryString}` : finalUrl
   };
 }
-function buildQueryParamsRaw(endpoint, query) {
-  const defaultParams = endpoint.reqDefaultQueryParams ?? {};
-  const merged = { ...defaultParams, ...query ?? {} };
-  return Object.fromEntries(Object.entries(merged).filter(([, value]) => value !== undefined).map(([key, value]) => [key, String(value)]));
+function buildPathParams(endpoint, params, ctx) {
+  if (!endpoint.reqParamsSchema)
+    return params;
+  try {
+    return endpoint.reqParamsSchema.parse(params);
+  } catch (error) {
+    if (error instanceof ZodError2) {
+      throw new RequestValidationError(error, "params", params, ctx());
+    }
+    throw error;
+  }
 }
 function buildQueryParams(endpoint, query, ctx) {
   const defaultParams = endpoint.reqDefaultQueryParams ?? {};
@@ -504,8 +531,8 @@ function createActionCache() {
 function makeDefineAction() {
   function defineAction(...args) {
     if (args.length === 0) {
-      return (def2) => ({
-        ...def2,
+      return (def) => ({
+        ...def,
         noRuntimeInput: false
       });
     }
@@ -536,6 +563,7 @@ var SENSITIVE_BODY_KEYS = new Set([
   "refresh_token",
   "secret",
   "client_secret",
+  "clientsecret",
   "apikey",
   "api_key"
 ]);
@@ -626,16 +654,14 @@ async function validateResponse(schema, data, ctx) {
   }
 }
 async function httpRequest(config, ctx) {
-  const queryString = config.doNotEncodeQueryParams ? Object.entries(config.queryParams).map(([key, value]) => `${key}=${value}`).join("&") : new URLSearchParams(config.queryParams).toString();
-  const fullUrl = queryString ? `${config.url}?${queryString}` : config.url;
   const timeoutController = new AbortController;
   const timeout = config.timeoutMs === undefined ? undefined : setTimeout(() => timeoutController.abort(), config.timeoutMs);
   const signal = mergeSignals(timeoutController.signal, config.userSignal);
   try {
-    return await config.fetchFn(fullUrl, {
+    return await config.fetchFn(config.fullUrl, {
       method: config.method,
       headers: config.headers,
-      body: buildFetchBody(config.body, config.headers),
+      body: buildFetchBody(config.body, config.headers, (msg) => new ConfigError(msg, ctx())),
       signal
     });
   } catch (error) {
@@ -648,6 +674,8 @@ async function httpRequest(config, ctx) {
       }
       throw new RequestAbortedError(ctx(), error);
     }
+    if (error instanceof ConfigError)
+      throw error;
     throw new NetworkError(error instanceof Error ? error.message : String(error), ctx(), error);
   } finally {
     if (timeout)
@@ -684,35 +712,26 @@ async function readErrorResponse(response) {
   };
 }
 function getRetryDelay(params) {
+  const maxDelay = params.maxRetryDelayMs ?? 30000;
   const { retryDelay, attempt, response } = params;
   if (response && (response.status === 429 || response.status === 503)) {
     const retryAfter = response.headers.get("retry-after");
     if (retryAfter) {
       const seconds = Number(retryAfter);
-      if (Number.isFinite(seconds))
-        return seconds * 1000;
+      if (Number.isFinite(seconds)) {
+        return Math.min(Math.max(0, seconds * 1000), maxDelay);
+      }
       const dateMs = Date.parse(retryAfter);
       if (!Number.isNaN(dateMs)) {
-        return Math.max(0, dateMs - Date.now());
+        return Math.min(Math.max(0, dateMs - Date.now()), maxDelay);
       }
     }
   }
-  if (typeof retryDelay === "function")
-    return retryDelay(attempt);
-  return retryDelay;
+  const delayMs = typeof retryDelay === "function" ? retryDelay(attempt) : retryDelay;
+  return Math.min(delayMs, maxDelay);
 }
 function shouldAttemptRetryOnError(error) {
-  if (error instanceof HttpResponseError)
-    return false;
-  if (error instanceof ResponseValidationError)
-    return false;
-  if (error instanceof RequestValidationError)
-    return false;
-  if (error instanceof ConfigError)
-    return false;
-  if (error instanceof RequestAbortedError)
-    return false;
-  return true;
+  return !isNonRetryableApiError(error);
 }
 function shouldAttemptRetryOnHttp(retryCtx) {
   const { error, response } = retryCtx;
@@ -725,6 +744,7 @@ async function makeRequestWithRetry(args) {
     config,
     maxRetries,
     retryDelay,
+    maxRetryDelayMs,
     validateFn,
     shouldRetry,
     logger,
@@ -763,7 +783,8 @@ async function makeRequestWithRetry(args) {
           const delayMs = getRetryDelay({
             retryDelay,
             attempt: retryCount,
-            response
+            response,
+            maxRetryDelayMs
           });
           await onRetry?.({
             ...retryCtx,
@@ -778,12 +799,12 @@ async function makeRequestWithRetry(args) {
         throw new HttpResponseError(response.status, body, responseHeaders, ctx({ attempt: retryCount }));
       }
       return {
-        validatedData: await validateFn(response),
+        validatedData: await validateFn(response, retryCount),
         retryCount,
         httpStatus: response.status
       };
     } catch (error) {
-      if (error instanceof HttpResponseError || error instanceof ResponseValidationError || error instanceof RequestValidationError || error instanceof ConfigError || error instanceof RequestAbortedError) {
+      if (isNonRetryableApiError(error)) {
         throw error;
       }
       const retryCtx = {
@@ -800,7 +821,8 @@ async function makeRequestWithRetry(args) {
       const delayMs = getRetryDelay({
         retryDelay,
         attempt: retryCount,
-        response: undefined
+        response: undefined,
+        maxRetryDelayMs
       });
       await onRetry?.({
         ...retryCtx,
@@ -814,19 +836,21 @@ async function makeRequestWithRetry(args) {
 }
 async function validateAndTransformResponse(endpoint, response, ctx) {
   const responseHeaders = getHeadersAsObject(response.headers);
+  const text = await response.text();
+  const responseSizeBytes = new TextEncoder().encode(text).length;
   let responseData;
   if (hasJsonContentType(responseHeaders)) {
-    const text = await response.text();
     try {
       responseData = text === "" ? undefined : JSON.parse(text);
     } catch (error) {
       throw new ResponseValidationError(makeJsonParseZodError(error, text), text, ctx());
     }
   } else {
-    responseData = await response.text();
+    responseData = text;
   }
   const transformedData = endpoint.resFormatter ? endpoint.resFormatter(responseData, responseHeaders) : responseData;
-  return validateResponse(endpoint.resSchema, transformedData, ctx);
+  const data = await validateResponse(endpoint.resSchema, transformedData, ctx);
+  return { data, responseSizeBytes };
 }
 function defaultShouldRetry(ctx) {
   if (ctx.error)
@@ -845,6 +869,28 @@ function isActionInvokeOptionsOnly(value) {
     return false;
   return Object.keys(value).every((k) => k === "signal" || k === "meta");
 }
+function resolveActionInvocation(action, actionName, first, second) {
+  if (!action.noRuntimeInput) {
+    return { input: first, options: second ?? {} };
+  }
+  if (first === undefined || first === null) {
+    return { input: undefined, options: second ?? {} };
+  }
+  if (second !== undefined) {
+    return { input: undefined, options: second };
+  }
+  if (isActionInvokeOptionsOnly(first)) {
+    return { input: undefined, options: first };
+  }
+  throw new ConfigError(`Action "${actionName}" does not accept input; pass only optional { signal, meta }`, {
+    endpoint: actionName,
+    method: "GET",
+    url: "",
+    attempt: 0,
+    maxRetries: 0,
+    elapsedMs: 0
+  });
+}
 function createApiClientImpl(apiConfig) {
   let actions = {};
   const cache = createActionCache();
@@ -873,22 +919,12 @@ function createApiClientImpl(apiConfig) {
       throw await reportApiError(new ConfigError(`Unknown API endpoint: ${String(endpointKey)}`, ctx()), apiConfig);
     }
     baseContext.method = endpoint.method;
-    let finalUrl;
-    let fullUrl;
-    try {
-      const built = buildUrl(endpoint, rawInput.reqParams, rawInput.reqQuery, apiConfig.baseApiUrls, apiConfig.defaultBaseApiUrl, input.url, (msg) => new ConfigError(msg, ctx()));
-      finalUrl = built.finalUrl;
-      fullUrl = built.fullUrl;
-    } catch (e) {
-      if (e instanceof ApiError)
-        throw await reportApiError(e, apiConfig);
-      throw e;
-    }
-    baseContext.url = fullUrl;
+    let pathParams;
     let queryParams;
     let body;
     let headers;
     try {
+      pathParams = buildPathParams(endpoint, rawInput.reqParams, ctx);
       queryParams = buildQueryParams(endpoint, rawInput.reqQuery, ctx);
       body = buildRequestBody(endpoint, rawInput.reqBody, ctx);
       headers = buildHeaders(endpoint, rawInput.reqHeaders, apiConfig.defaultHeaders ?? {}, ctx);
@@ -897,6 +933,25 @@ function createApiClientImpl(apiConfig) {
         throw await reportApiError(e, apiConfig);
       throw e;
     }
+    let fullUrl;
+    try {
+      const built = buildUrl({
+        endpoint,
+        params: pathParams,
+        queryParams,
+        baseApiUrls: apiConfig.baseApiUrls,
+        defaultBaseApiUrl: apiConfig.defaultBaseApiUrl,
+        url: input.url,
+        doNotEncodeQueryParams: endpoint.doNotEncodeQueryParams,
+        configError: (msg) => new ConfigError(msg, ctx())
+      });
+      fullUrl = built.fullUrl;
+    } catch (e) {
+      if (e instanceof ApiError)
+        throw await reportApiError(e, apiConfig);
+      throw e;
+    }
+    baseContext.url = fullUrl;
     baseContext.requestHeaders = headers;
     baseContext.requestBody = body;
     if (apiConfig.onRequest) {
@@ -921,11 +976,9 @@ function createApiClientImpl(apiConfig) {
     }
     const config = {
       method: endpoint.method,
-      url: finalUrl,
-      queryParams,
+      fullUrl,
       body,
       headers,
-      doNotEncodeQueryParams: endpoint.doNotEncodeQueryParams,
       timeoutMs: input.timeoutMs ?? apiConfig.timeoutMs,
       fetchFn: input.fetch ?? apiConfig.fetch ?? fetch,
       userSignal: input.signal
@@ -935,7 +988,8 @@ function createApiClientImpl(apiConfig) {
         config,
         maxRetries,
         retryDelay: apiConfig.retryDelayMs ?? 300,
-        validateFn: (response) => validateAndTransformResponse(endpoint, response, ctx),
+        maxRetryDelayMs: apiConfig.maxRetryDelayMs,
+        validateFn: (response, attempt) => validateAndTransformResponse(endpoint, response, (over) => ctx({ attempt, ...over })),
         shouldRetry: apiConfig.shouldRetry ?? defaultShouldRetry,
         logger: apiConfig.logger,
         ctx,
@@ -947,10 +1001,10 @@ function createApiClientImpl(apiConfig) {
         onRetry: apiConfig.onRetry
       });
       const responseTimeMs = elapsed();
-      const responseSizeMb = calculateSizeInMb(result.validatedData);
+      const responseSizeMb = result.validatedData.responseSizeBytes / (1024 * 1024);
       const requestBodySizeMb = calculateSizeInMb(config.body);
       return {
-        data: result.validatedData,
+        data: result.validatedData.data,
         requestBodySizeMb,
         responseSizeMb,
         responseTimeMs,
@@ -1006,22 +1060,14 @@ function createApiClientImpl(apiConfig) {
       throw await reportApiError(wrapped, apiConfig);
     }
   }
+  async function dispatchAction(name, first, second) {
+    const action = actions[name];
+    const { input, options } = resolveActionInvocation(action, name, first, second);
+    return invokeAction(name, input, options);
+  }
   const request = async (key, input, options) => {
     if (key in actions) {
-      const action = actions[key];
-      if (action.noRuntimeInput) {
-        if (input === undefined || input === null) {
-          return invokeAction(key, undefined, options ?? {});
-        }
-        if (options !== undefined) {
-          return invokeAction(key, undefined, options);
-        }
-        if (isActionInvokeOptionsOnly(input)) {
-          return invokeAction(key, undefined, input);
-        }
-        return invokeAction(key, undefined, {});
-      }
-      return invokeAction(key, input, options);
+      return dispatchAction(key, input, options);
     }
     return invokeEndpoint(key, input ?? {});
   };
@@ -1035,22 +1081,7 @@ function createApiClientImpl(apiConfig) {
         return (input) => invokeEndpoint(prop, input ?? {});
       }
       if (prop in actions) {
-        const action = actions[prop];
-        if (action.noRuntimeInput) {
-          return (first, second) => {
-            if (first === undefined || first === null) {
-              return invokeAction(prop, undefined, second ?? {});
-            }
-            if (second !== undefined) {
-              return invokeAction(prop, undefined, second);
-            }
-            if (isActionInvokeOptionsOnly(first)) {
-              return invokeAction(prop, undefined, first);
-            }
-            return invokeAction(prop, undefined, {});
-          };
-        }
-        return (input, opt) => invokeAction(prop, input, opt);
+        return (first, second) => dispatchAction(prop, first, second);
       }
       return;
     }
@@ -1078,72 +1109,306 @@ function createApiClientImpl(apiConfig) {
   return proxy;
 }
 var createApiClient = (apiConfig) => createApiClientImpl(apiConfig);
-// src/secrets/infisical.ts
+// src/secrets/errors.ts
+class SecretLoadError extends Error {
+  code;
+  operation;
+  status;
+  constructor(code, message, details = {}) {
+    super(message);
+    this.name = "SecretLoadError";
+    this.code = code;
+    this.operation = details.operation;
+    this.status = details.status;
+  }
+}
+
+// src/secrets/deadline.ts
+async function withSecretDeadline(options, operation) {
+  const timeoutMs = options.timeoutMs ?? 30000;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2147483647) {
+    throw new SecretLoadError("CONFIGURATION", "Secret timeoutMs must be a positive finite timer duration.");
+  }
+  const controller = new AbortController;
+  const cancel = () => controller.abort(new SecretLoadError("ABORTED", "Secret loading was cancelled."));
+  if (options.signal?.aborted) {
+    cancel();
+  } else {
+    options.signal?.addEventListener("abort", cancel, { once: true });
+  }
+  const timer = setTimeout(() => controller.abort(new SecretLoadError("TIMEOUT", `Secret loading timed out after ${timeoutMs}ms.`)), timeoutMs);
+  let rejectOnAbort = () => {};
+  try {
+    const aborted = new Promise((_, reject) => {
+      rejectOnAbort = () => reject(controller.signal.reason);
+      controller.signal.addEventListener("abort", rejectOnAbort, { once: true });
+    });
+    if (controller.signal.aborted) {
+      throw controller.signal.reason;
+    }
+    return await Promise.race([operation(controller.signal), aborted]);
+  } finally {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", cancel);
+    controller.signal.removeEventListener("abort", rejectOnAbort);
+  }
+}
+
+// src/secrets/environment.ts
+function getProcessEnvironment() {
+  return typeof process === "undefined" ? undefined : process.env;
+}
+function resolveSecretEnvironment(option, env) {
+  const explicit = typeof option === "function" ? option() : option;
+  if (typeof explicit === "object" && explicit !== null) {
+    if (typeof explicit.slug !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(explicit.slug)) {
+      throw new SecretLoadError("CONFIGURATION", "Custom secret environment requires a valid slug.");
+    }
+    return explicit.slug;
+  }
+  const selected = explicit ?? env?.SECRETS_ENV;
+  if (selected !== undefined) {
+    if (selected === "production" || selected === "prod") {
+      return "prod";
+    }
+    if (selected === "development" || selected === "dev") {
+      return "dev";
+    }
+    if (selected === "staging") {
+      return "staging";
+    }
+    throw new SecretLoadError("CONFIGURATION", "Invalid secret environment. Use dev, staging, prod, or an explicit { slug } option.");
+  }
+  if (env?.NODE_ENV === "production" || env?.NODE_ENV === "prod") {
+    return "prod";
+  }
+  if (env?.NODE_ENV === "staging") {
+    return "staging";
+  }
+  return "dev";
+}
+
+// src/secrets/infisical-cli.ts
+async function readInfisicalCliToken(options) {
+  const { execFile } = await import("node:child_process").catch(() => {
+    throw new SecretLoadError("CLI", "Infisical CLI fallback requires a runtime with subprocess support. Provide Infisical client credentials or a custom secret loader.");
+  });
+  options.signal.throwIfAborted();
+  const env = {
+    ...getProcessEnvironment(),
+    INFISICAL_DISABLE_UPDATE_CHECK: "true"
+  };
+  delete env.INFISICAL_TOKEN;
+  delete env.INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN;
+  delete env.TOKEN;
+  try {
+    const stdout = await new Promise((resolve, reject) => {
+      const child = execFile("infisical", [
+        "user",
+        "get",
+        "token",
+        "--plain",
+        `--domain=${options.siteUrl}`,
+        "--silent"
+      ], {
+        env,
+        encoding: "utf8",
+        shell: false,
+        timeout: options.timeoutMs ?? 30000,
+        signal: options.signal,
+        killSignal: "SIGKILL",
+        maxBuffer: 10485760,
+        windowsHide: true
+      }, (error, output) => {
+        if (error) {
+          reject(error);
+        } else {
+          resolve(output);
+        }
+      });
+      child.stdin?.end();
+    });
+    return stdout.trim();
+  } catch (error) {
+    if (options.signal.aborted) {
+      throw options.signal.reason;
+    }
+    const failure = error;
+    if (failure?.code === "ENOENT") {
+      throw new SecretLoadError("CLI", "Infisical CLI not found. Install infisical and ensure it is on PATH, or provide Infisical client credentials.");
+    }
+    if (failure?.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") {
+      throw new SecretLoadError("CLI", "Infisical CLI output exceeded the 10 MiB limit.");
+    }
+    if (failure?.killed) {
+      throw new SecretLoadError("TIMEOUT", `Infisical CLI timed out after ${(options.timeoutMs ?? 30000) / 1000} seconds or was terminated.`);
+    }
+    throw new SecretLoadError("CLI", `Infisical CLI session token failed. Run infisical login --domain=${options.siteUrl} and verify access to the configured organization, project, and environment.`);
+  }
+}
+
+// src/secrets/infisical-config.ts
+function validateInfisicalScope(options) {
+  validateInfisicalOrganizationId(options.organizationId);
+  let url;
+  try {
+    url = new URL(options.siteUrl);
+  } catch {
+    throw new SecretLoadError("CONFIGURATION", "Invalid Infisical siteUrl.");
+  }
+  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+    throw new SecretLoadError("CONFIGURATION", "Infisical siteUrl must be an HTTP(S) URL without credentials, query, or fragment.");
+  }
+  if (!options.projectId.trim() || !options.environment.trim() || !(options.secretPath ?? "/").startsWith("/")) {
+    throw new SecretLoadError("CONFIGURATION", "Infisical requires a projectId, environment, and absolute secretPath.");
+  }
+}
+function validateInfisicalOrganizationId(organizationId) {
+  if (typeof organizationId !== "string" || !organizationId.trim() || /\s/.test(organizationId)) {
+    throw new SecretLoadError("CONFIGURATION", "Infisical organizationId is required and must be a nonempty ID without whitespace.");
+  }
+}
+
+// src/secrets/infisical-session.ts
 import { z } from "zod";
+var sessionClaimsSchema = z.object({
+  organizationId: z.string().optional(),
+  subOrganizationId: z.string().optional(),
+  exp: z.number().finite().optional()
+});
+function parseInfisicalSessionToken(token) {
+  let claims;
+  try {
+    if (!/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token)) {
+      throw new Error("Invalid token format");
+    }
+    const payload = token.split(".")[1];
+    const json = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
+    claims = sessionClaimsSchema.parse(JSON.parse(json));
+  } catch {
+    throw new SecretLoadError("AUTHENTICATION", "Infisical returned an invalid user session token. Run infisical login for the configured domain.");
+  }
+  if (claims.exp !== undefined && claims.exp <= Date.now() / 1000) {
+    throw new SecretLoadError("AUTHENTICATION", "Infisical user session has expired. Run infisical login for the configured domain.");
+  }
+  return { organizationId: claims.subOrganizationId ?? claims.organizationId };
+}
+
+// src/secrets/infisical.ts
 var DEFAULT_INFISICAL_SITE_URL = "https://eu.infisical.com";
 var defaultFetch = globalThis.fetch;
-var infisicalAuthResponseSchema = z.object({
-  accessToken: z.string()
+var infisicalAuthResponseSchema = z2.object({ accessToken: z2.string() });
+var infisicalSecretSchema = z2.object({
+  secretKey: z2.string(),
+  secretValue: z2.string()
 });
-var infisicalSecretSchema = z.object({
-  secretKey: z.string(),
-  secretValue: z.string()
+var infisicalSecretsResponseSchema = z2.object({
+  secrets: z2.array(infisicalSecretSchema)
 });
-var infisicalSecretsResponseSchema = z.object({
-  secrets: z.array(infisicalSecretSchema)
-});
-async function fetchInfisicalSecrets({
-  keys,
-  projectId,
-  environment,
-  siteUrl,
-  clientId,
-  clientSecret
-}) {
-  const infisical = createInfisicalApiClient(siteUrl);
-  const { data: auth } = await infisical.request("login", {
-    reqBody: {
-      clientId,
-      clientSecret
+async function fetchInfisicalSecrets(options) {
+  validateInfisicalScope(options);
+  return withSecretDeadline(options, async (signal) => {
+    let operation = "login";
+    try {
+      const infisical = createInfisicalApiClient(options.siteUrl);
+      const { data: auth } = await infisical.request("login", {
+        signal,
+        reqBody: {
+          clientId: options.clientId,
+          clientSecret: options.clientSecret
+        }
+      });
+      signal.throwIfAborted();
+      operation = "listSecrets";
+      return await listInfisicalSecrets(infisical, auth.accessToken, {
+        ...options,
+        signal
+      });
+    } catch (error) {
+      throwInfisicalHttpError(error, operation, signal);
     }
   });
+}
+async function loadInfisicalSecrets(options) {
+  validateInfisicalScope(options);
+  const env = getProcessEnvironment();
+  const clientId = env?.[options.clientIdEnvKey];
+  const clientSecret = env?.[options.clientSecretEnvKey];
+  const mode = options.auth ?? "auto";
+  if (!["auto", "http", "cli"].includes(mode)) {
+    throw new SecretLoadError("CONFIGURATION", "Invalid Infisical auth mode.");
+  }
+  const useHttp = mode === "http" || mode === "auto" && Boolean(clientId && clientSecret);
+  if (useHttp) {
+    if (!clientId || !clientSecret) {
+      throw new SecretLoadError("AUTHENTICATION", "Infisical HTTP authentication requires both client credentials.");
+    }
+    options.reportSource?.("Infisical HTTP");
+    return fetchInfisicalSecrets({ ...options, clientId, clientSecret });
+  }
+  options.reportSource?.(`Infisical CLI session (organization=${options.organizationId} project=${options.projectId} environment=${options.environment})`);
+  return withSecretDeadline(options, (signal) => fetchInfisicalSessionSecrets({ ...options, signal }));
+}
+async function fetchInfisicalSessionSecrets(options) {
+  const { signal } = options;
+  let token = await readInfisicalCliToken(options);
+  signal.throwIfAborted();
+  const session = parseInfisicalSessionToken(token);
+  const infisical = createInfisicalApiClient(options.siteUrl);
+  let operation = "selectOrganization";
+  try {
+    if (session.organizationId !== options.organizationId) {
+      const { data } = await infisical.request("selectOrganization", {
+        signal,
+        reqHeaders: {
+          Authorization: `Bearer ${token}`,
+          "User-Agent": "hanzio/secrets"
+        },
+        reqBody: { organizationId: options.organizationId }
+      });
+      signal.throwIfAborted();
+      if (data.isMfaEnabled) {
+        throw new SecretLoadError("AUTHENTICATION", "Infisical requires MFA for this organization. Complete infisical login for the target organization and configured domain before loading secrets.", { operation });
+      }
+      const scopedSession = parseInfisicalSessionToken(data.token);
+      if (scopedSession.organizationId !== options.organizationId) {
+        throw new SecretLoadError("AUTHENTICATION", "Infisical returned a session for a different organization.", { operation });
+      }
+      token = data.token;
+    }
+    signal.throwIfAborted();
+    operation = "listSecrets";
+    return await listInfisicalSecrets(infisical, token, options);
+  } catch (error) {
+    throwInfisicalHttpError(error, operation, signal);
+  }
+}
+async function listInfisicalSecrets(infisical, token, options) {
   const { data } = await infisical.request("listSecrets", {
-    reqHeaders: {
-      Authorization: `Bearer ${auth.accessToken}`
-    },
+    signal: options.signal,
+    reqHeaders: { Authorization: `Bearer ${token}` },
     reqQuery: {
-      environment,
-      projectId,
-      secretPath: "/",
+      environment: options.environment,
+      projectId: options.projectId,
+      secretPath: options.secretPath ?? "/",
       viewSecretValue: true,
       expandSecretReferences: true,
       includeImports: true
     }
   });
-  const wantedKeys = new Set(keys);
+  const wantedKeys = new Set(options.keys);
   return Object.fromEntries(data.secrets.filter((secret) => wantedKeys.has(secret.secretKey)).map((secret) => [secret.secretKey, secret.secretValue]));
 }
-async function loadInfisicalSecrets({
-  keys,
-  projectId,
-  environment,
-  siteUrl,
-  clientIdEnvKey,
-  clientSecretEnvKey
-}) {
-  const clientId = process.env[clientIdEnvKey];
-  const clientSecret = process.env[clientSecretEnvKey];
-  if (!clientId || !clientSecret) {
-    throw new Error("Missing Infisical credentials");
-  }
-  return fetchInfisicalSecrets({
-    keys,
-    projectId,
-    environment,
-    siteUrl,
-    clientId,
-    clientSecret
-  });
+function throwInfisicalHttpError(error, operation, signal) {
+  if (signal.aborted) {
+    throw signal.reason;
+  }
+  if (error instanceof SecretLoadError) {
+    throw error;
+  }
+  const status = error instanceof HttpResponseError ? error.status : undefined;
+  const guidance = operation === "selectOrganization" && (status === 401 || status === 403) ? " Run infisical login for the target organization and configured domain, then verify your access." : "";
+  throw new SecretLoadError("HTTP", `Infisical HTTP ${operation} failed${status ? ` (status ${status})` : ""}.${guidance}`, { operation, status });
 }
 function createInfisicalApiClient(siteUrl) {
   return createApiClient({
@@ -1155,12 +1420,26 @@ function createInfisicalApiClient(siteUrl) {
     fetch: getFetch(),
     retries: 1,
     endpoints: {
+      selectOrganization: {
+        method: "POST",
+        path: "/api/v3/auth/select-organization",
+        reqHeadersSchema: z2.object({
+          Authorization: z2.string(),
+          "User-Agent": z2.string()
+        }),
+        reqBodySchema: z2.object({ organizationId: z2.string() }),
+        resSchema: z2.object({
+          token: z2.string().min(1),
+          isMfaEnabled: z2.boolean().optional()
+        }),
+        reqBodyFormat: "json"
+      },
       login: {
         method: "POST",
         path: "/api/v1/auth/universal-auth/login",
-        reqBodySchema: z.object({
-          clientId: z.string(),
-          clientSecret: z.string()
+        reqBodySchema: z2.object({
+          clientId: z2.string(),
+          clientSecret: z2.string()
         }),
         resSchema: infisicalAuthResponseSchema,
         reqBodyFormat: "json"
@@ -1168,16 +1447,16 @@ function createInfisicalApiClient(siteUrl) {
       listSecrets: {
         method: "GET",
         path: "/api/v4/secrets",
-        reqHeadersSchema: z.object({
-          Authorization: z.string()
+        reqHeadersSchema: z2.object({
+          Authorization: z2.string()
         }),
-        reqQuerySchema: z.object({
-          projectId: z.string(),
-          environment: z.string(),
-          secretPath: z.string(),
-          viewSecretValue: z.boolean(),
-          expandSecretReferences: z.boolean(),
-          includeImports: z.boolean()
+        reqQuerySchema: z2.object({
+          projectId: z2.string(),
+          environment: z2.string(),
+          secretPath: z2.string(),
+          viewSecretValue: z2.boolean(),
+          expandSecretReferences: z2.boolean(),
+          includeImports: z2.boolean()
         }),
         resSchema: infisicalSecretsResponseSchema
       }
@@ -1185,21 +1464,26 @@ function createInfisicalApiClient(siteUrl) {
   });
 }
 function getFetch() {
-  return globalThis.fetch ?? defaultFetch;
+  const fetchFn = globalThis.fetch ?? defaultFetch;
+  return (input, init) => {
+    init?.signal?.throwIfAborted();
+    return fetchFn(input, init);
+  };
 }
 
-// src/secrets/loaders.ts
+// src/secrets/worker-loader.ts
 function cloudflareWorkerEnvLoader(workerEnv) {
-  return async (ctx) => {
-    const out = {};
+  const loader = async (ctx) => {
+    const out = Object.create(null);
     for (const key of ctx.keys) {
-      const str = workerBindingToString(workerEnv[key]);
+      const str = workerBindingToString(Object.hasOwn(workerEnv, key) ? workerEnv[key] : undefined);
       if (str !== undefined) {
         out[key] = str;
       }
     }
     return out;
   };
+  return Object.assign(loader, { source: "Cloudflare Worker bindings" });
 }
 function workerBindingToString(value) {
   if (value === undefined || value === null) {
@@ -1216,21 +1500,30 @@ function workerBindingToString(value) {
   }
   return String(value);
 }
+
+// src/secrets/loaders.ts
 function infisicalLoader(config) {
-  return async (ctx) => fetchInfisicalSecrets({
+  validateInfisicalOrganizationId(config.organizationId);
+  const loader = async (ctx) => fetchInfisicalSecrets({
     keys: ctx.keys,
     projectId: config.projectId,
+    organizationId: config.organizationId,
     environment: ctx.environment,
     siteUrl: config.siteUrl ?? DEFAULT_INFISICAL_SITE_URL,
     clientId: config.clientId,
-    clientSecret: config.clientSecret
+    clientSecret: config.clientSecret,
+    secretPath: config.secretPath,
+    timeoutMs: config.timeoutMs ?? ctx.timeoutMs,
+    signal: ctx.signal
   });
+  return Object.assign(loader, { source: "Infisical HTTP" });
 }
 async function processEnvLoader(_ctx) {
   return {};
 }
+Object.assign(processEnvLoader, { source: "process.env" });
 export {
-  processEnvLoader,
+  cloudflareWorkerEnvLoader,
   infisicalLoader,
-  cloudflareWorkerEnvLoader
+  processEnvLoader
 };