hanzio 1.2.0 → 2.1.0

package/dist/src/secrets/index.js

@@ -1,1360 +1,30 @@
-// src/secrets/errors.ts
-class SecretLoadError extends Error {
-  code;
-  operation;
-  status;
-  constructor(code, message, details = {}) {
-    super(message);
-    this.name = "SecretLoadError";
-    this.code = code;
-    this.operation = details.operation;
-    this.status = details.status;
-  }
-}
-
-// src/secrets/deadline.ts
-async function withSecretDeadline(options, operation) {
-  const timeoutMs = options.timeoutMs ?? 30000;
-  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2147483647) {
-    throw new SecretLoadError("CONFIGURATION", "Secret timeoutMs must be a positive finite timer duration.");
-  }
-  const controller = new AbortController;
-  const cancel = () => controller.abort(new SecretLoadError("ABORTED", "Secret loading was cancelled."));
-  if (options.signal?.aborted) {
-    cancel();
-  } else {
-    options.signal?.addEventListener("abort", cancel, { once: true });
-  }
-  const timer = setTimeout(() => controller.abort(new SecretLoadError("TIMEOUT", `Secret loading timed out after ${timeoutMs}ms.`)), timeoutMs);
-  let rejectOnAbort = () => {};
-  try {
-    const aborted = new Promise((_, reject) => {
-      rejectOnAbort = () => reject(controller.signal.reason);
-      controller.signal.addEventListener("abort", rejectOnAbort, { once: true });
-    });
-    if (controller.signal.aborted) {
-      throw controller.signal.reason;
-    }
-    return await Promise.race([operation(controller.signal), aborted]);
-  } finally {
-    clearTimeout(timer);
-    options.signal?.removeEventListener("abort", cancel);
-    controller.signal.removeEventListener("abort", rejectOnAbort);
-  }
-}
-
-// src/secrets/environment.ts
-function getProcessEnvironment() {
-  return typeof process === "undefined" ? undefined : process.env;
-}
-function resolveSecretEnvironment(option, env) {
-  const explicit = typeof option === "function" ? option() : option;
-  if (typeof explicit === "object" && explicit !== null) {
-    if (typeof explicit.slug !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(explicit.slug)) {
-      throw new SecretLoadError("CONFIGURATION", "Custom secret environment requires a valid slug.");
-    }
-    return explicit.slug;
-  }
-  const selected = explicit ?? env?.SECRETS_ENV;
-  if (selected !== undefined) {
-    if (selected === "production" || selected === "prod") {
-      return "prod";
-    }
-    if (selected === "development" || selected === "dev") {
-      return "dev";
-    }
-    if (selected === "staging") {
-      return "staging";
-    }
-    throw new SecretLoadError("CONFIGURATION", "Invalid secret environment. Use dev, staging, prod, or an explicit { slug } option.");
-  }
-  if (env?.NODE_ENV === "production" || env?.NODE_ENV === "prod") {
-    return "prod";
-  }
-  if (env?.NODE_ENV === "staging") {
-    return "staging";
-  }
-  return "dev";
-}
-
-// src/secrets/core.ts
-var registryKey = Symbol.for("hanzio.secrets.environmentWrites.v1");
-var shared = globalThis;
-var environmentWrites = shared[registryKey] ?? new WeakMap;
-shared[registryKey] = environmentWrites;
-var defaultLogger = {
-  info: (message, attrs) => console.log(`${message} environment=${attrs.environment} count=${attrs.count} source=${attrs.source} durationMs=${attrs.durationMs}`, { sources: attrs.sources }),
-  error: (message, attrs) => console.error(message, attrs)
-};
-function readOverrides(keys, env) {
-  if (!env) {
-    return {};
-  }
-  const writes = environmentWrites.get(env);
-  return Object.fromEntries(keys.flatMap((key) => {
-    const value = Object.hasOwn(env, key) ? env[key] : undefined;
-    if (writes?.has(key)) {
-      if (writes.get(key) === value) {
-        return [];
-      }
-      writes.delete(key);
-    }
-    return value ? [[key, value]] : [];
-  }));
-}
-async function defineSecretSet(keys, options, environmentVariables) {
-  const keySet = [...new Set(keys)];
-  const environment = resolveSecretEnvironment(options.environment, environmentVariables);
-  const logger = options.logger === false ? undefined : options.logger ?? defaultLogger;
-  let cached;
-  let parsed;
-  let sources;
-  let inFlight;
-  const log = (level, message, attributes) => {
-    try {
-      logger?.[level](message, attributes);
-    } catch {}
-  };
-  const loadSnapshot = async (request, signal) => {
-    const local = readOverrides(keySet, environmentVariables);
-    const missing = keySet.filter((key) => !Object.hasOwn(local, key));
-    let loaderSource = options.loader.source ?? "custom loader";
-    let loaded = {};
-    if (missing.length) {
-      try {
-        loaded = await options.loader({
-          keys: missing,
-          environment,
-          signal,
-          timeoutMs: request.timeoutMs ?? options.timeoutMs ?? 30000,
-          reportSource: (source) => {
-            loaderSource = source;
-          }
-        });
-      } catch (error) {
-        if (error instanceof SecretLoadError) {
-          throw error;
-        }
-        throw new SecretLoadError("LOADER", "Secret loader failed.");
-      }
-    }
-    const overrides = readOverrides(keySet, environmentVariables);
-    const next = Object.fromEntries(keySet.map((key) => {
-      if (Object.hasOwn(overrides, key)) {
-        return [key, overrides[key]];
-      }
-      if (Object.hasOwn(loaded, key)) {
-        return [key, loaded[key]];
-      }
-      return [key, undefined];
-    }));
-    const missingKeys = keySet.filter((key) => typeof next[key] !== "string" || !next[key]);
-    if (missingKeys.length) {
-      throw new SecretLoadError("MISSING_SECRETS", `Missing secrets: ${missingKeys.join(", ")}`);
-    }
-    let nextParsed;
-    try {
-      nextParsed = options.schema ? await options.schema.parseAsync({ ...next }) : { ...next };
-      nextParsed = structuredClone(nextParsed);
-    } catch {
-      throw new SecretLoadError("VALIDATION", "Secret schema validation failed. Check the configured schema; values are omitted.");
-    }
-    signal.throwIfAborted();
-    const nextSources = Object.fromEntries(keySet.map((key) => [
-      key,
-      Object.hasOwn(overrides, key) ? "process.env" : loaderSource
-    ]));
-    if (options.writeToProcessEnv !== false && environmentVariables) {
-      let writes = environmentWrites.get(environmentVariables);
-      if (!writes) {
-        writes = new Map;
-        environmentWrites.set(environmentVariables, writes);
-      }
-      for (const key of keySet) {
-        if (Object.hasOwn(overrides, key)) {
-          continue;
-        }
-        environmentVariables[key] = next[key];
-        writes.set(key, next[key]);
-      }
-    }
-    cached = next;
-    parsed = nextParsed;
-    sources = nextSources;
-  };
-  const load = (request = {}) => {
-    if (inFlight) {
-      return inFlight;
-    }
-    inFlight = (async () => {
-      const start = Date.now();
-      try {
-        await withSecretDeadline({
-          timeoutMs: request.timeoutMs ?? options.timeoutMs,
-          signal: request.signal ?? options.signal
-        }, (signal) => loadSnapshot(request, signal));
-        const sourceCounts = new Map;
-        for (const key of keySet) {
-          const source = sources[key];
-          sourceCounts.set(source, (sourceCounts.get(source) ?? 0) + 1);
-        }
-        const counts = Object.fromEntries(sourceCounts);
-        log("info", "Loaded secrets", {
-          environment,
-          count: keySet.length,
-          durationMs: Date.now() - start,
-          source: Object.keys(counts).join(" + ") || "none",
-          sources: counts
-        });
-      } catch (error) {
-        const safe = error instanceof SecretLoadError ? error : new SecretLoadError("LOADER", "Secret loading failed.");
-        log("error", "Secret loading failed", {
-          environment,
-          count: keySet.length,
-          durationMs: Date.now() - start,
-          code: safe.code
-        });
-        throw safe;
-      }
-    })().finally(() => {
-      inFlight = undefined;
-    });
-    return inFlight;
-  };
-  const secretSet = {
-    secret(key) {
-      if (!Object.hasOwn(cached, key)) {
-        throw new SecretLoadError("MISSING_SECRETS", `Secret ${key} not found`);
-      }
-      return cached[key];
-    },
-    secrets: () => ({ ...cached }),
-    parsed: () => structuredClone(parsed),
-    sources: () => ({ ...sources }),
-    async reload(request) {
-      await load(request);
-      return secretSet;
-    }
-  };
-  await load();
-  return secretSet;
-}
+import {
+  HttpResponseError2,
+  createApiClient2
+} from "../../index-j1ybktbr.js";
+import {
+  getViteDefine2,
+  viteSecretSetPlugin2
+} from "../../index-w882zry3.js";
+import {
+  withSecretDeadline,
+  getProcessEnvironment,
+  resolveSecretEnvironment,
+  createSecretSet2,
+  cloudflareWorkerEnvLoader2
+} from "../../index-hyt6c56h.js";
+import {
+  SecretLoadError2,
+  readPublicConfig2
+} from "../../index-ktynw3vs.js";
 
 // src/secrets/infisical.ts
 import { z as z2 } from "zod";
-// src/api-wrapper/headers.ts
-var CANONICAL_HEADER_NAMES = {
-  "content-type": "Content-Type",
-  authorization: "Authorization",
-  accept: "Accept",
-  "user-agent": "User-Agent",
-  "x-request-id": "X-Request-Id",
-  "x-correlation-id": "X-Correlation-Id"
-};
-function normalizeHeaders(headers) {
-  const result = {};
-  const lowerToCanonical = new Map;
-  for (const [key, value] of Object.entries(headers)) {
-    const lower = key.toLowerCase();
-    const canonical = CANONICAL_HEADER_NAMES[lower] ?? key;
-    const existing = lowerToCanonical.get(lower);
-    if (existing && existing !== canonical)
-      delete result[existing];
-    lowerToCanonical.set(lower, canonical);
-    result[canonical] = value;
-  }
-  return result;
-}
-function getHeader(headers, name) {
-  const lower = name.toLowerCase();
-  const canonical = CANONICAL_HEADER_NAMES[lower];
-  if (canonical !== undefined) {
-    if (headers[canonical] !== undefined)
-      return headers[canonical];
-  }
-  for (const [k, v] of Object.entries(headers)) {
-    if (k.toLowerCase() === lower)
-      return v;
-  }
-  return;
-}
-function hasJsonContentType(headers) {
-  const ct = getHeader(headers, "content-type") ?? "";
-  return ct.includes("application/json");
-}
-function buildFetchBody(body, headers, configError) {
-  if (body === undefined || body === null)
-    return;
-  if (body instanceof FormData || body instanceof Blob)
-    return body;
-  if (hasJsonContentType(headers))
-    return JSON.stringify(body);
-  if (typeof body === "object" && (Object.getPrototypeOf(body) === Object.prototype || Object.getPrototypeOf(body) === null) && configError) {
-    throw configError("Request body is a plain object but Content-Type is not application/json");
-  }
-  return body;
-}
-function getHeadersAsObject(headers) {
-  const result = {};
-  headers.forEach((value, key) => {
-    result[key] = value;
-  });
-  return result;
-}
-
-// src/api-wrapper/zod-issues.ts
-import { ZodError } from "zod";
-function formatZodIssues(error, rawData) {
-  return error.issues.map((issue) => {
-    const pathArray = [...issue.path];
-    const path = formatIssuePath(pathArray);
-    const value = getValueAtPath(rawData, pathArray);
-    const valuePreview = value === undefined ? undefined : previewValue(value);
-    const raw = issue;
-    const expected = typeof raw.expected === "string" ? raw.expected : undefined;
-    const received = typeof raw.received === "string" ? raw.received : value !== undefined ? typeofVerbose(value) : undefined;
-    const known = new Set([
-      "code",
-      "path",
-      "message",
-      "expected",
-      "received",
-      "fatal"
-    ]);
-    const extra = {};
-    for (const [k, v] of Object.entries(raw)) {
-      if (!known.has(k) && v !== undefined)
-        extra[k] = v;
-    }
-    return {
-      path,
-      pathArray,
-      code: issue.code,
-      message: issue.message,
-      expected,
-      received,
-      value,
-      valuePreview,
-      extra: Object.keys(extra).length > 0 ? extra : undefined
-    };
-  });
-}
-function renderIssueSummary(issues) {
-  if (issues.length === 0)
-    return "(no issues reported)";
-  return issues.map((issue, idx) => {
-    const parts = [];
-    parts.push(`  [${idx + 1}] ${issue.path}: ${issue.message}`);
-    if (issue.expected || issue.received) {
-      const exp = issue.expected ? `expected ${issue.expected}` : "";
-      const rec = issue.received ? `received ${issue.received}` : "";
-      parts.push(`      (${[exp, rec].filter(Boolean).join(", ")})`);
-    }
-    if (issue.valuePreview !== undefined) {
-      parts.push(`      value: ${issue.valuePreview}`);
-    }
-    if (issue.extra) {
-      for (const [k, v] of Object.entries(issue.extra)) {
-        parts.push(`      ${k}: ${previewValue(v, 120)}`);
-      }
-    }
-    return parts.join(`
-`);
-  }).join(`
-`);
-}
-function formatIssuePath(pathArray) {
-  if (pathArray.length === 0)
-    return "<root>";
-  let out = "";
-  for (const segment of pathArray) {
-    if (typeof segment === "number") {
-      out += `[${segment}]`;
-    } else if (/^[A-Za-z_$][\w$]*$/.test(segment)) {
-      out += out === "" ? segment : `.${segment}`;
-    } else {
-      out += `[${JSON.stringify(segment)}]`;
-    }
-  }
-  return out;
-}
-function getValueAtPath(data, pathArray) {
-  let current = data;
-  for (const segment of pathArray) {
-    if (current === null || current === undefined)
-      return;
-    if (typeof current !== "object")
-      return;
-    current = current[segment];
-  }
-  return current;
-}
-function typeofVerbose(value) {
-  if (value === null)
-    return "null";
-  if (Array.isArray(value))
-    return "array";
-  return typeof value;
-}
-function previewValue(value, maxLen = 200) {
-  let str;
-  try {
-    if (value === undefined)
-      str = "undefined";
-    else if (typeof value === "string")
-      str = JSON.stringify(value);
-    else
-      str = JSON.stringify(value);
-  } catch {
-    str = String(value);
-  }
-  if (str === undefined)
-    str = String(value);
-  if (str.length > maxLen)
-    str = `${str.slice(0, maxLen)}…`;
-  return str;
-}
-function makeJsonParseZodError(error, text) {
-  const message = error instanceof Error ? `Response body was not valid JSON: ${error.message}` : "Response body was not valid JSON";
-  const preview = text.length > 200 ? `${text.slice(0, 200)}…` : text;
-  return new ZodError([
-    {
-      code: "custom",
-      path: [],
-      message: `${message} (body preview: ${JSON.stringify(preview)})`,
-      input: text
-    }
-  ]);
-}
-function tryParseJson(body) {
-  if (!body)
-    return;
-  try {
-    return JSON.parse(body);
-  } catch {
-    return;
-  }
-}
-
-// src/api-wrapper/errors.ts
-var MAX_BODY_PREVIEW = 500;
-
-class ApiError extends Error {
-  context;
-  cause;
-  constructor(message, context, options) {
-    super(message);
-    this.name = "ApiError";
-    this.context = context;
-    this.cause = options?.cause;
-  }
-  toJSON() {
-    return {
-      name: this.name,
-      message: this.message,
-      context: this.context
-    };
-  }
-}
-
-class HttpResponseError extends ApiError {
-  status;
-  body;
-  bodyJson;
-  responseHeaders;
-  requestId;
-  constructor(status, body, responseHeaders, context) {
-    const preview = body.length > MAX_BODY_PREVIEW ? `${body.slice(0, MAX_BODY_PREVIEW)}…` : body;
-    super(`HTTP ${status} ${context.method} ${context.url} - ${preview}`, context);
-    this.name = "HttpResponseError";
-    this.status = status;
-    this.body = body;
-    this.responseHeaders = responseHeaders;
-    this.requestId = getHeader(responseHeaders, "x-request-id") ?? getHeader(responseHeaders, "x-correlation-id");
-    this.bodyJson = tryParseJson(body);
-  }
-  toJSON() {
-    return {
-      ...super.toJSON(),
-      status: this.status,
-      body: this.body,
-      bodyJson: this.bodyJson,
-      requestId: this.requestId,
-      responseHeaders: this.responseHeaders
-    };
-  }
-}
-
-class ResponseValidationError extends ApiError {
-  zodError;
-  rawResponse;
-  issues;
-  validationIssues;
-  constructor(zodError, rawResponse, context) {
-    const issues = formatZodIssues(zodError, rawResponse);
-    const summary = renderIssueSummary(issues);
-    super(`Response validation failed (${context.method} ${context.url}):
-${summary}`, context, { cause: zodError });
-    this.name = "ResponseValidationError";
-    this.zodError = zodError;
-    this.rawResponse = rawResponse;
-    this.issues = issues;
-    this.validationIssues = issues.map((i) => `${i.path}: ${i.message}`).join("; ");
-  }
-  toJSON() {
-    return {
-      ...super.toJSON(),
-      issues: this.issues,
-      validationIssues: this.validationIssues,
-      rawResponsePreview: previewValue(this.rawResponse, 1000)
-    };
-  }
-}
-
-class RequestValidationError extends ApiError {
-  zodError;
-  target;
-  rawInput;
-  issues;
-  validationIssues;
-  constructor(zodError, target, rawInput, context) {
-    const issues = formatZodIssues(zodError, rawInput);
-    const summary = renderIssueSummary(issues);
-    super(`Request ${target} validation failed (${context.method} ${context.url}):
-${summary}`, context, { cause: zodError });
-    this.name = "RequestValidationError";
-    this.zodError = zodError;
-    this.target = target;
-    this.rawInput = rawInput;
-    this.issues = issues;
-    this.validationIssues = issues.map((i) => `${i.path}: ${i.message}`).join("; ");
-  }
-  toJSON() {
-    return {
-      ...super.toJSON(),
-      target: this.target,
-      issues: this.issues,
-      validationIssues: this.validationIssues
-    };
-  }
-}
-
-class RequestTimeoutError extends ApiError {
-  timeoutMs;
-  constructor(timeoutMs, context) {
-    super(`Request timed out after ${timeoutMs}ms: ${context.method} ${context.url}`, context);
-    this.name = "RequestTimeoutError";
-    this.timeoutMs = timeoutMs;
-  }
-}
-
-class NetworkError extends ApiError {
-  constructor(message, context, cause) {
-    super(message, context, { cause });
-    this.name = "NetworkError";
-  }
-}
-
-class RequestAbortedError extends ApiError {
-  constructor(context, cause) {
-    super(`Request aborted: ${context.method} ${context.url}`, context, {
-      cause
-    });
-    this.name = "RequestAbortedError";
-  }
-}
-
-class ConfigError extends ApiError {
-  constructor(message, context) {
-    super(message, context);
-    this.name = "ConfigError";
-  }
-}
-
-class ActionError extends ApiError {
-  constructor(message, context, cause) {
-    super(message, context, { cause });
-    this.name = "ActionError";
-  }
-}
-var isApiError = (e) => e instanceof ApiError;
-var isHttpResponseError = (e) => e instanceof HttpResponseError;
-var isResponseValidationError = (e) => e instanceof ResponseValidationError;
-var isRequestValidationError = (e) => e instanceof RequestValidationError;
-var isRequestTimeoutError = (e) => e instanceof RequestTimeoutError;
-var isNetworkError = (e) => e instanceof NetworkError;
-var isRequestAbortedError = (e) => e instanceof RequestAbortedError;
-var isConfigError = (e) => e instanceof ConfigError;
-var isActionError = (e) => e instanceof ActionError;
-function isNonRetryableApiError(error) {
-  return error instanceof HttpResponseError || error instanceof ResponseValidationError || error instanceof RequestValidationError || error instanceof ConfigError || error instanceof RequestAbortedError;
-}
-// src/api-wrapper/builders.ts
-import { ZodError as ZodError2 } from "zod";
-function formatQueryString(queryParams, doNotEncode) {
-  if (Object.keys(queryParams).length === 0)
-    return "";
-  return doNotEncode ? Object.entries(queryParams).map(([key, value]) => `${key}=${value}`).join("&") : new URLSearchParams(queryParams).toString();
-}
-function buildUrl(options) {
-  const {
-    endpoint,
-    params,
-    queryParams,
-    baseApiUrls,
-    defaultBaseApiUrl,
-    url,
-    doNotEncodeQueryParams,
-    configError
-  } = options;
-  let finalUrl;
-  if (url) {
-    finalUrl = replacePathParams(url, params, configError);
-  } else {
-    const defaultBaseUrl = defaultBaseApiUrl ?? Object.keys(baseApiUrls)[0];
-    if (!defaultBaseUrl) {
-      throw configError("At least one base API URL is required");
-    }
-    const baseUrlKey = endpoint.baseApiUrl ?? defaultBaseUrl;
-    const configBaseUrl = baseApiUrls[baseUrlKey];
-    if (!configBaseUrl) {
-      throw configError(`Unknown base API URL: ${baseUrlKey}`);
-    }
-    const baseUrl = typeof configBaseUrl === "function" ? configBaseUrl() : configBaseUrl;
-    const path = typeof endpoint.path === "function" ? endpoint.path(baseUrl) : endpoint.path;
-    finalUrl = `${baseUrl}${replacePathParams(path, params, configError)}`;
-  }
-  const queryString = formatQueryString(queryParams, doNotEncodeQueryParams);
-  return {
-    finalUrl,
-    fullUrl: queryString ? `${finalUrl}?${queryString}` : finalUrl
-  };
-}
-function buildPathParams(endpoint, params, ctx) {
-  if (!endpoint.reqParamsSchema)
-    return params;
-  try {
-    return endpoint.reqParamsSchema.parse(params);
-  } catch (error) {
-    if (error instanceof ZodError2) {
-      throw new RequestValidationError(error, "params", params, ctx());
-    }
-    throw error;
-  }
-}
-function buildQueryParams(endpoint, query, ctx) {
-  const defaultParams = endpoint.reqDefaultQueryParams ?? {};
-  let parsedQuery;
-  if (endpoint.reqQuerySchema) {
-    try {
-      parsedQuery = endpoint.reqQuerySchema.parse(query);
-    } catch (error) {
-      if (error instanceof ZodError2) {
-        throw new RequestValidationError(error, "query", query, ctx());
-      }
-      throw error;
-    }
-  } else {
-    parsedQuery = query ?? {};
-  }
-  const merged = { ...defaultParams, ...parsedQuery };
-  return Object.fromEntries(Object.entries(merged).filter(([, value]) => value !== undefined).map(([key, value]) => [key, String(value)]));
-}
-function buildRequestBody(endpoint, body, ctx) {
-  if (!endpoint.reqBodySchema)
-    return body;
-  let parsedBody;
-  try {
-    parsedBody = endpoint.reqBodySchema.parse(body);
-  } catch (error) {
-    if (error instanceof ZodError2) {
-      throw new RequestValidationError(error, "body", body, ctx());
-    }
-    throw error;
-  }
-  if (endpoint.reqBodyFormat !== "form-data") {
-    return parsedBody;
-  }
-  const formData = new FormData;
-  for (const [key, value] of Object.entries(parsedBody)) {
-    if (value == null)
-      continue;
-    formData.set(key, value instanceof Blob ? value : String(value));
-  }
-  return formData;
-}
-function buildHeaders(endpoint, headers, defaultHeaders, ctx) {
-  const contentType = endpoint.reqBodyFormat === "json" ? "application/json" : undefined;
-  let parsedHeaders;
-  if (endpoint.reqHeadersSchema) {
-    try {
-      parsedHeaders = endpoint.reqHeadersSchema.parse(headers);
-    } catch (error) {
-      if (error instanceof ZodError2) {
-        throw new RequestValidationError(error, "headers", headers, ctx());
-      }
-      throw error;
-    }
-  } else {
-    parsedHeaders = headers ?? {};
-  }
-  return normalizeHeaders({
-    ...defaultHeaders,
-    ...contentType && { "Content-Type": contentType },
-    ...endpoint.defaultHeaders,
-    ...parsedHeaders
-  });
-}
-function replacePathParams(path, params, configError) {
-  return path.replace(/:(\w+)/g, (_, key) => {
-    const value = params?.[key];
-    if (value === undefined) {
-      throw configError(`Missing required path parameter: ${key}`);
-    }
-    return encodeURIComponent(String(value));
-  });
-}
 
-// src/api-wrapper/actions-impl.ts
-function createActionCache() {
-  const store = new Map;
-  const isExpired = (entry) => entry.expiresAt !== undefined && entry.expiresAt <= Date.now();
-  const cache = async (key, fn, options) => {
-    const existing = store.get(key);
-    if (existing && !isExpired(existing)) {
-      if (existing.inflight)
-        return existing.inflight;
-      if (existing.hasValue)
-        return existing.value;
-    }
-    const promise = (async () => fn())();
-    const entry = {
-      hasValue: false,
-      inflight: promise,
-      expiresAt: options?.ttlMs !== undefined ? Date.now() + options.ttlMs : undefined
-    };
-    store.set(key, entry);
-    try {
-      const value = await promise;
-      entry.value = value;
-      entry.hasValue = true;
-      entry.inflight = undefined;
-      return value;
-    } catch (error) {
-      store.delete(key);
-      throw error;
-    }
-  };
-  cache.get = (key) => {
-    const entry = store.get(key);
-    if (!entry || !entry.hasValue)
-      return;
-    if (isExpired(entry)) {
-      store.delete(key);
-      return;
-    }
-    return entry.value;
-  };
-  cache.set = (key, value, options) => {
-    store.set(key, {
-      value,
-      hasValue: true,
-      expiresAt: options?.ttlMs !== undefined ? Date.now() + options.ttlMs : undefined
-    });
-  };
-  cache.invalidate = (key) => {
-    store.delete(key);
-  };
-  cache.clear = () => {
-    store.clear();
-  };
-  return cache;
-}
-function makeDefineAction() {
-  function defineAction(...args) {
-    if (args.length === 0) {
-      return (def) => ({
-        ...def,
-        noRuntimeInput: false
-      });
-    }
-    const def = args[0];
-    return {
-      ...def,
-      noRuntimeInput: true
-    };
-  }
-  return defineAction;
-}
-var defineAction = makeDefineAction();
-
-// src/api-wrapper/redaction.ts
-var SENSITIVE_HEADER_KEYS = new Set([
-  "authorization",
-  "cookie",
-  "set-cookie",
-  "x-api-key",
-  "x-auth-token"
-]);
-var SENSITIVE_BODY_KEYS = new Set([
-  "password",
-  "token",
-  "accesstoken",
-  "access_token",
-  "refreshtoken",
-  "refresh_token",
-  "secret",
-  "client_secret",
-  "clientsecret",
-  "apikey",
-  "api_key"
-]);
-function redactHeaders(headers) {
-  if (!headers)
-    return;
-  const out = {};
-  for (const [k, v] of Object.entries(headers)) {
-    if (SENSITIVE_HEADER_KEYS.has(k.toLowerCase())) {
-      out[k] = "[REDACTED]";
-    } else {
-      out[k] = v;
-    }
-  }
-  return out;
-}
-function redactBody(body) {
-  if (body === null || body === undefined)
-    return body;
-  if (typeof body !== "object" || Array.isArray(body)) {
-    return body;
-  }
-  const rec = body;
-  const out = { ...rec };
-  for (const key of Object.keys(out)) {
-    if (SENSITIVE_BODY_KEYS.has(key.toLowerCase())) {
-      out[key] = "[REDACTED]";
-    }
-  }
-  return out;
-}
-function defaultRedactContext(ctx) {
-  return {
-    ...ctx,
-    requestHeaders: redactHeaders(ctx.requestHeaders),
-    requestBody: redactBody(ctx.requestBody),
-    meta: ctx.meta
-  };
-}
-
-// src/api-wrapper/error-reporting.ts
-function applyErrorContextRedaction(ctx, config) {
-  const base = defaultRedactContext(ctx);
-  return config.redact ? config.redact(base) : base;
-}
-async function reportApiError(err, config) {
-  err.context = applyErrorContextRedaction(err.context, config);
-  try {
-    await config.onError?.(err);
-  } catch {}
-  config.logger?.error?.(err);
-  return err;
-}
-
-// src/api-wrapper/size.ts
-function calculateSizeInMb(data) {
-  let bytes;
-  if (data === undefined || data === null) {
-    bytes = 0;
-  } else if (data instanceof Blob) {
-    bytes = data.size;
-  } else if (typeof FormData !== "undefined" && data instanceof FormData) {
-    bytes = 0;
-    data.forEach((value) => {
-      if (value instanceof Blob)
-        bytes += value.size;
-      else
-        bytes += new TextEncoder().encode(String(value)).length;
-    });
-  } else if (typeof data === "string") {
-    bytes = new TextEncoder().encode(data).length;
-  } else {
-    bytes = new TextEncoder().encode(JSON.stringify(data) ?? "").length;
-  }
-  return bytes / (1024 * 1024);
-}
-
-// src/api-wrapper/transport.ts
-import { ZodError as ZodError3 } from "zod";
-async function validateResponse(schema, data, ctx) {
-  try {
-    return await schema.parseAsync(data);
-  } catch (error) {
-    if (error instanceof ZodError3) {
-      throw new ResponseValidationError(error, data, ctx());
-    }
-    throw error;
-  }
-}
-async function httpRequest(config, ctx) {
-  const timeoutController = new AbortController;
-  const timeout = config.timeoutMs === undefined ? undefined : setTimeout(() => timeoutController.abort(), config.timeoutMs);
-  const signal = mergeSignals(timeoutController.signal, config.userSignal);
-  try {
-    return await config.fetchFn(config.fullUrl, {
-      method: config.method,
-      headers: config.headers,
-      body: buildFetchBody(config.body, config.headers, (msg) => new ConfigError(msg, ctx())),
-      signal
-    });
-  } catch (error) {
-    if (isDomAbortError(error)) {
-      if (config.userSignal?.aborted) {
-        throw new RequestAbortedError(ctx(), error);
-      }
-      if (timeoutController.signal.aborted && config.timeoutMs !== undefined) {
-        throw new RequestTimeoutError(config.timeoutMs, ctx());
-      }
-      throw new RequestAbortedError(ctx(), error);
-    }
-    if (error instanceof ConfigError)
-      throw error;
-    throw new NetworkError(error instanceof Error ? error.message : String(error), ctx(), error);
-  } finally {
-    if (timeout)
-      clearTimeout(timeout);
-  }
-}
-function isDomAbortError(error) {
-  return typeof error === "object" && error !== null && "name" in error && error.name === "AbortError";
-}
-function mergeSignals(a, b) {
-  if (!b)
-    return a;
-  const anyFn = AbortSignal.any;
-  if (typeof anyFn === "function")
-    return anyFn([a, b]);
-  const controller = new AbortController;
-  const onAbort = () => controller.abort();
-  if (a.aborted)
-    controller.abort();
-  else
-    a.addEventListener("abort", onAbort, { once: true });
-  if (b.aborted)
-    controller.abort();
-  else
-    b.addEventListener("abort", onAbort, { once: true });
-  return controller.signal;
-}
-async function readErrorResponse(response) {
-  const body = await response.text();
-  return {
-    body,
-    headers: getHeadersAsObject(response.headers),
-    status: response.status
-  };
-}
-function getRetryDelay(params) {
-  const maxDelay = params.maxRetryDelayMs ?? 30000;
-  const { retryDelay, attempt, response } = params;
-  if (response && (response.status === 429 || response.status === 503)) {
-    const retryAfter = response.headers.get("retry-after");
-    if (retryAfter) {
-      const seconds = Number(retryAfter);
-      if (Number.isFinite(seconds)) {
-        return Math.min(Math.max(0, seconds * 1000), maxDelay);
-      }
-      const dateMs = Date.parse(retryAfter);
-      if (!Number.isNaN(dateMs)) {
-        return Math.min(Math.max(0, dateMs - Date.now()), maxDelay);
-      }
-    }
-  }
-  const delayMs = typeof retryDelay === "function" ? retryDelay(attempt) : retryDelay;
-  return Math.min(delayMs, maxDelay);
-}
-function shouldAttemptRetryOnError(error) {
-  return !isNonRetryableApiError(error);
-}
-function shouldAttemptRetryOnHttp(retryCtx) {
-  const { error, response } = retryCtx;
-  if (error)
-    return shouldAttemptRetryOnError(error);
-  return response ? response.status >= 500 || response.status === 429 : false;
-}
-async function makeRequestWithRetry(args) {
-  const {
-    config,
-    maxRetries,
-    retryDelay,
-    maxRetryDelayMs,
-    validateFn,
-    shouldRetry,
-    logger,
-    ctx,
-    endpointName,
-    method,
-    fullUrl,
-    meta,
-    onResponse,
-    onRetry
-  } = args;
-  let retryCount = 0;
-  while (true) {
-    let response;
-    try {
-      logger?.debug?.("API request", config);
-      response = await httpRequest(config, (over) => ctx({ attempt: retryCount, ...over }));
-      await onResponse?.({
-        endpoint: endpointName,
-        method,
-        url: fullUrl,
-        response: response.clone(),
-        attempt: retryCount,
-        meta
-      });
-      if (response.status >= 400) {
-        const retryCtx = {
-          response,
-          retryCount,
-          maxRetries,
-          endpoint: endpointName,
-          method,
-          url: fullUrl
-        };
-        if (retryCount < maxRetries && shouldRetry(retryCtx)) {
-          const delayMs = getRetryDelay({
-            retryDelay,
-            attempt: retryCount,
-            response,
-            maxRetryDelayMs
-          });
-          await onRetry?.({
-            ...retryCtx,
-            delayMs,
-            nextAttempt: retryCount + 1
-          });
-          retryCount++;
-          await delay(delayMs);
-          continue;
-        }
-        const { body, headers: responseHeaders } = await readErrorResponse(response);
-        throw new HttpResponseError(response.status, body, responseHeaders, ctx({ attempt: retryCount }));
-      }
-      return {
-        validatedData: await validateFn(response, retryCount),
-        retryCount,
-        httpStatus: response.status
-      };
-    } catch (error) {
-      if (isNonRetryableApiError(error)) {
-        throw error;
-      }
-      const retryCtx = {
-        error,
-        retryCount,
-        maxRetries,
-        endpoint: endpointName,
-        method,
-        url: fullUrl
-      };
-      if (retryCount >= maxRetries || !shouldRetry(retryCtx)) {
-        throw error;
-      }
-      const delayMs = getRetryDelay({
-        retryDelay,
-        attempt: retryCount,
-        response: undefined,
-        maxRetryDelayMs
-      });
-      await onRetry?.({
-        ...retryCtx,
-        delayMs,
-        nextAttempt: retryCount + 1
-      });
-      retryCount++;
-      await delay(delayMs);
-    }
-  }
-}
-async function validateAndTransformResponse(endpoint, response, ctx) {
-  const responseHeaders = getHeadersAsObject(response.headers);
-  const text = await response.text();
-  const responseSizeBytes = new TextEncoder().encode(text).length;
-  let responseData;
-  if (hasJsonContentType(responseHeaders)) {
-    try {
-      responseData = text === "" ? undefined : JSON.parse(text);
-    } catch (error) {
-      throw new ResponseValidationError(makeJsonParseZodError(error, text), text, ctx());
-    }
-  } else {
-    responseData = text;
-  }
-  const transformedData = endpoint.resFormatter ? endpoint.resFormatter(responseData, responseHeaders) : responseData;
-  const data = await validateResponse(endpoint.resSchema, transformedData, ctx);
-  return { data, responseSizeBytes };
-}
-function defaultShouldRetry(ctx) {
-  if (ctx.error)
-    return shouldAttemptRetryOnError(ctx.error);
-  return shouldAttemptRetryOnHttp(ctx);
-}
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-// src/api-wrapper/create-client.ts
-function isActionInvokeOptionsOnly(value) {
-  if (value === null || value === undefined)
-    return false;
-  if (typeof value !== "object" || Array.isArray(value))
-    return false;
-  return Object.keys(value).every((k) => k === "signal" || k === "meta");
-}
-function resolveActionInvocation(action, actionName, first, second) {
-  if (!action.noRuntimeInput) {
-    return { input: first, options: second ?? {} };
-  }
-  if (first === undefined || first === null) {
-    return { input: undefined, options: second ?? {} };
-  }
-  if (second !== undefined) {
-    return { input: undefined, options: second };
-  }
-  if (isActionInvokeOptionsOnly(first)) {
-    return { input: undefined, options: first };
-  }
-  throw new ConfigError(`Action "${actionName}" does not accept input; pass only optional { signal, meta }`, {
-    endpoint: actionName,
-    method: "GET",
-    url: "",
-    attempt: 0,
-    maxRetries: 0,
-    elapsedMs: 0
-  });
-}
-function createApiClientImpl(apiConfig) {
-  let actions = {};
-  const cache = createActionCache();
-  const invokeEndpoint = async (endpointKey, input = {}) => {
-    const endpoint = apiConfig.endpoints[endpointKey];
-    const rawInput = input;
-    const endpointName = apiConfig.name ? `${apiConfig.name}.${String(endpointKey)}` : String(endpointKey);
-    const startedAt = Date.now();
-    const maxRetries = input.retries ?? apiConfig.retries ?? 3;
-    const baseContext = {
-      endpoint: endpointName,
-      method: endpoint?.method ?? "GET",
-      url: "",
-      attempt: 0,
-      maxRetries,
-      elapsedMs: 0,
-      meta: input.meta
-    };
-    const elapsed = () => Date.now() - startedAt;
-    const ctx = (over = {}) => ({
-      ...baseContext,
-      elapsedMs: elapsed(),
-      ...over
-    });
-    if (!endpoint) {
-      throw await reportApiError(new ConfigError(`Unknown API endpoint: ${String(endpointKey)}`, ctx()), apiConfig);
-    }
-    baseContext.method = endpoint.method;
-    let pathParams;
-    let queryParams;
-    let body;
-    let headers;
-    try {
-      pathParams = buildPathParams(endpoint, rawInput.reqParams, ctx);
-      queryParams = buildQueryParams(endpoint, rawInput.reqQuery, ctx);
-      body = buildRequestBody(endpoint, rawInput.reqBody, ctx);
-      headers = buildHeaders(endpoint, rawInput.reqHeaders, apiConfig.defaultHeaders ?? {}, ctx);
-    } catch (e) {
-      if (e instanceof ApiError)
-        throw await reportApiError(e, apiConfig);
-      throw e;
-    }
-    let fullUrl;
-    try {
-      const built = buildUrl({
-        endpoint,
-        params: pathParams,
-        queryParams,
-        baseApiUrls: apiConfig.baseApiUrls,
-        defaultBaseApiUrl: apiConfig.defaultBaseApiUrl,
-        url: input.url,
-        doNotEncodeQueryParams: endpoint.doNotEncodeQueryParams,
-        configError: (msg) => new ConfigError(msg, ctx())
-      });
-      fullUrl = built.fullUrl;
-    } catch (e) {
-      if (e instanceof ApiError)
-        throw await reportApiError(e, apiConfig);
-      throw e;
-    }
-    baseContext.url = fullUrl;
-    baseContext.requestHeaders = headers;
-    baseContext.requestBody = body;
-    if (apiConfig.onRequest) {
-      try {
-        const result = await apiConfig.onRequest({
-          endpoint: endpointName,
-          method: endpoint.method,
-          url: fullUrl,
-          headers,
-          body,
-          meta: input.meta
-        });
-        if (result?.headers)
-          headers = result.headers;
-        if (result && "body" in result)
-          body = result.body;
-      } catch (e) {
-        if (e instanceof ApiError)
-          throw await reportApiError(e, apiConfig);
-        throw e;
-      }
-    }
-    const config = {
-      method: endpoint.method,
-      fullUrl,
-      body,
-      headers,
-      timeoutMs: input.timeoutMs ?? apiConfig.timeoutMs,
-      fetchFn: input.fetch ?? apiConfig.fetch ?? fetch,
-      userSignal: input.signal
-    };
-    try {
-      const result = await makeRequestWithRetry({
-        config,
-        maxRetries,
-        retryDelay: apiConfig.retryDelayMs ?? 300,
-        maxRetryDelayMs: apiConfig.maxRetryDelayMs,
-        validateFn: (response, attempt) => validateAndTransformResponse(endpoint, response, (over) => ctx({ attempt, ...over })),
-        shouldRetry: apiConfig.shouldRetry ?? defaultShouldRetry,
-        logger: apiConfig.logger,
-        ctx,
-        endpointName,
-        method: endpoint.method,
-        fullUrl,
-        meta: input.meta,
-        onResponse: apiConfig.onResponse,
-        onRetry: apiConfig.onRetry
-      });
-      const responseTimeMs = elapsed();
-      const responseSizeMb = result.validatedData.responseSizeBytes / (1024 * 1024);
-      const requestBodySizeMb = calculateSizeInMb(config.body);
-      return {
-        data: result.validatedData.data,
-        requestBodySizeMb,
-        responseSizeMb,
-        responseTimeMs,
-        httpStatus: result.httpStatus,
-        retryCount: result.retryCount
-      };
-    } catch (error) {
-      if (error instanceof ApiError)
-        throw await reportApiError(error, apiConfig);
-      throw error;
-    }
-  };
-  async function invokeAction(name, rawInput, options = {}) {
-    const action = actions[name];
-    const inputForHandler = action.noRuntimeInput ? undefined : rawInput;
-    const actionName = apiConfig.name ? `${apiConfig.name}.${name}` : name;
-    const startedAt = Date.now();
-    const baseContext = {
-      endpoint: actionName,
-      method: "GET",
-      url: "",
-      attempt: 0,
-      maxRetries: 0,
-      elapsedMs: 0,
-      meta: options.meta,
-      requestBody: action.noRuntimeInput ? undefined : rawInput
-    };
-    const ctx = (over = {}) => ({
-      ...baseContext,
-      elapsedMs: Date.now() - startedAt,
-      ...over
-    });
-    apiConfig.logger?.debug?.("Action start", { action: actionName });
-    try {
-      const result = await action.handler({
-        input: inputForHandler,
-        api: proxy,
-        signal: options.signal,
-        meta: options.meta,
-        logger: apiConfig.logger,
-        cache
-      });
-      apiConfig.logger?.debug?.("Action end", {
-        action: actionName,
-        elapsedMs: Date.now() - startedAt
-      });
-      return result;
-    } catch (error) {
-      if (error instanceof ApiError) {
-        throw await reportApiError(error, apiConfig);
-      }
-      const wrapped = new ActionError(`Action ${actionName} failed: ${error instanceof Error ? error.message : String(error)}`, ctx(), error);
-      throw await reportApiError(wrapped, apiConfig);
-    }
-  }
-  async function dispatchAction(name, first, second) {
-    const action = actions[name];
-    const { input, options } = resolveActionInvocation(action, name, first, second);
-    return invokeAction(name, input, options);
-  }
-  const request = async (key, input, options) => {
-    if (key in actions) {
-      return dispatchAction(key, input, options);
-    }
-    return invokeEndpoint(key, input ?? {});
-  };
-  const client = { request, cache };
-  const proxy = new Proxy(client, {
-    get(target, prop, receiver) {
-      if (prop in target || typeof prop !== "string") {
-        return Reflect.get(target, prop, receiver);
-      }
-      if (prop in apiConfig.endpoints) {
-        return (input) => invokeEndpoint(prop, input ?? {});
-      }
-      if (prop in actions) {
-        return (first, second) => dispatchAction(prop, first, second);
-      }
-      return;
-    }
-  });
-  const rawActions = apiConfig.actions;
-  if (typeof rawActions === "function") {
-    actions = rawActions({
-      api: proxy,
-      defineAction: makeDefineAction()
-    });
-  } else if (rawActions) {
-    actions = rawActions;
-  }
-  const collisions = Object.keys(actions).filter((key) => (key in apiConfig.endpoints));
-  if (collisions.length > 0) {
-    throw new ConfigError(`Action name(s) collide with endpoint name(s): ${collisions.join(", ")}`, {
-      endpoint: collisions[0],
-      method: "GET",
-      url: "",
-      attempt: 0,
-      maxRetries: 0,
-      elapsedMs: 0
-    });
-  }
-  return proxy;
-}
-var createApiClient = (apiConfig) => createApiClientImpl(apiConfig);
 // src/secrets/infisical-cli.ts
 async function readInfisicalCliToken(options) {
   const { execFile } = await import("node:child_process").catch(() => {
-    throw new SecretLoadError("CLI", "Infisical CLI fallback requires a runtime with subprocess support. Provide Infisical client credentials or a custom secret loader.");
+    throw new SecretLoadError2("CLI", "Infisical CLI fallback requires a runtime with subprocess support. Provide Infisical client credentials or a custom secret loader.");
   });
   options.signal.throwIfAborted();
   const env = {
@@ -1398,15 +68,15 @@ async function readInfisicalCliToken(options) {
     }
     const failure = error;
     if (failure?.code === "ENOENT") {
-      throw new SecretLoadError("CLI", "Infisical CLI not found. Install infisical and ensure it is on PATH, or provide Infisical client credentials.");
+      throw new SecretLoadError2("CLI", "Infisical CLI not found. Install infisical and ensure it is on PATH, or provide Infisical client credentials.");
     }
     if (failure?.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") {
-      throw new SecretLoadError("CLI", "Infisical CLI output exceeded the 10 MiB limit.");
+      throw new SecretLoadError2("CLI", "Infisical CLI output exceeded the 10 MiB limit.");
     }
     if (failure?.killed) {
-      throw new SecretLoadError("TIMEOUT", `Infisical CLI timed out after ${(options.timeoutMs ?? 30000) / 1000} seconds or was terminated.`);
+      throw new SecretLoadError2("TIMEOUT", `Infisical CLI timed out after ${(options.timeoutMs ?? 30000) / 1000} seconds or was terminated.`);
     }
-    throw new SecretLoadError("CLI", `Infisical CLI session token failed. Run infisical login --domain=${options.siteUrl} and verify access to the configured organization, project, and environment.`);
+    throw new SecretLoadError2("CLI", `Infisical CLI session token failed. Run infisical login --domain=${options.siteUrl} and verify access to the configured organization, project, and environment.`);
   }
 }
 
@@ -1417,18 +87,18 @@ function validateInfisicalScope(options) {
   try {
     url = new URL(options.siteUrl);
   } catch {
-    throw new SecretLoadError("CONFIGURATION", "Invalid Infisical siteUrl.");
+    throw new SecretLoadError2("CONFIGURATION", "Invalid Infisical siteUrl.");
   }
   if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
-    throw new SecretLoadError("CONFIGURATION", "Infisical siteUrl must be an HTTP(S) URL without credentials, query, or fragment.");
+    throw new SecretLoadError2("CONFIGURATION", "Infisical siteUrl must be an HTTP(S) URL without credentials, query, or fragment.");
   }
   if (!options.projectId.trim() || !options.environment.trim() || !(options.secretPath ?? "/").startsWith("/")) {
-    throw new SecretLoadError("CONFIGURATION", "Infisical requires a projectId, environment, and absolute secretPath.");
+    throw new SecretLoadError2("CONFIGURATION", "Infisical requires a projectId, environment, and absolute secretPath.");
   }
 }
 function validateInfisicalOrganizationId(organizationId) {
   if (typeof organizationId !== "string" || !organizationId.trim() || /\s/.test(organizationId)) {
-    throw new SecretLoadError("CONFIGURATION", "Infisical organizationId is required and must be a nonempty ID without whitespace.");
+    throw new SecretLoadError2("CONFIGURATION", "Infisical organizationId is required and must be a nonempty ID without whitespace.");
   }
 }
 
@@ -1449,10 +119,10 @@ function parseInfisicalSessionToken(token) {
     const json = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
     claims = sessionClaimsSchema.parse(JSON.parse(json));
   } catch {
-    throw new SecretLoadError("AUTHENTICATION", "Infisical returned an invalid user session token. Run infisical login for the configured domain.");
+    throw new SecretLoadError2("AUTHENTICATION", "Infisical returned an invalid user session token. Run infisical login for the configured domain.");
   }
   if (claims.exp !== undefined && claims.exp <= Date.now() / 1000) {
-    throw new SecretLoadError("AUTHENTICATION", "Infisical user session has expired. Run infisical login for the configured domain.");
+    throw new SecretLoadError2("AUTHENTICATION", "Infisical user session has expired. Run infisical login for the configured domain.");
   }
   return { organizationId: claims.subOrganizationId ?? claims.organizationId };
 }
@@ -1499,12 +169,12 @@ async function loadInfisicalSecrets(options) {
   const clientSecret = env?.[options.clientSecretEnvKey];
   const mode = options.auth ?? "auto";
   if (!["auto", "http", "cli"].includes(mode)) {
-    throw new SecretLoadError("CONFIGURATION", "Invalid Infisical auth mode.");
+    throw new SecretLoadError2("CONFIGURATION", "Invalid Infisical auth mode.");
   }
   const useHttp = mode === "http" || mode === "auto" && Boolean(clientId && clientSecret);
   if (useHttp) {
     if (!clientId || !clientSecret) {
-      throw new SecretLoadError("AUTHENTICATION", "Infisical HTTP authentication requires both client credentials.");
+      throw new SecretLoadError2("AUTHENTICATION", "Infisical HTTP authentication requires both client credentials.");
     }
     options.reportSource?.("Infisical HTTP");
     return fetchInfisicalSecrets({ ...options, clientId, clientSecret });
@@ -1531,11 +201,11 @@ async function fetchInfisicalSessionSecrets(options) {
       });
       signal.throwIfAborted();
       if (data.isMfaEnabled) {
-        throw new SecretLoadError("AUTHENTICATION", "Infisical requires MFA for this organization. Complete infisical login for the target organization and configured domain before loading secrets.", { operation });
+        throw new SecretLoadError2("AUTHENTICATION", "Infisical requires MFA for this organization. Complete infisical login for the target organization and configured domain before loading secrets.", { operation });
       }
       const scopedSession = parseInfisicalSessionToken(data.token);
       if (scopedSession.organizationId !== options.organizationId) {
-        throw new SecretLoadError("AUTHENTICATION", "Infisical returned a session for a different organization.", { operation });
+        throw new SecretLoadError2("AUTHENTICATION", "Infisical returned a session for a different organization.", { operation });
       }
       token = data.token;
     }
@@ -1566,15 +236,15 @@ function throwInfisicalHttpError(error, operation, signal) {
   if (signal.aborted) {
     throw signal.reason;
   }
-  if (error instanceof SecretLoadError) {
+  if (error instanceof SecretLoadError2) {
     throw error;
   }
-  const status = error instanceof HttpResponseError ? error.status : undefined;
+  const status = error instanceof HttpResponseError2 ? error.status : undefined;
   const guidance = operation === "selectOrganization" && (status === 401 || status === 403) ? " Run infisical login for the target organization and configured domain, then verify your access." : "";
-  throw new SecretLoadError("HTTP", `Infisical HTTP ${operation} failed${status ? ` (status ${status})` : ""}.${guidance}`, { operation, status });
+  throw new SecretLoadError2("HTTP", `Infisical HTTP ${operation} failed${status ? ` (status ${status})` : ""}.${guidance}`, { operation, status });
 }
 function createInfisicalApiClient(siteUrl) {
-  return createApiClient({
+  return createApiClient2({
     name: "infisical",
     baseApiUrls: {
       infisical: siteUrl
@@ -1633,36 +303,6 @@ function getFetch() {
     return fetchFn(input, init);
   };
 }
-// src/secrets/worker-loader.ts
-function cloudflareWorkerEnvLoader(workerEnv) {
-  const loader = async (ctx) => {
-    const out = Object.create(null);
-    for (const key of ctx.keys) {
-      const str = workerBindingToString(Object.hasOwn(workerEnv, key) ? workerEnv[key] : undefined);
-      if (str !== undefined) {
-        out[key] = str;
-      }
-    }
-    return out;
-  };
-  return Object.assign(loader, { source: "Cloudflare Worker bindings" });
-}
-function workerBindingToString(value) {
-  if (value === undefined || value === null) {
-    return;
-  }
-  if (typeof value === "string") {
-    return value === "" ? undefined : value;
-  }
-  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-    return String(value);
-  }
-  if (typeof value === "object") {
-    return JSON.stringify(value);
-  }
-  return String(value);
-}
-
 // src/secrets/loaders.ts
 function infisicalLoader(config) {
   validateInfisicalOrganizationId(config.organizationId);
@@ -1684,35 +324,12 @@ async function processEnvLoader(_ctx) {
   return {};
 }
 Object.assign(processEnvLoader, { source: "process.env" });
-// src/secrets/vite.ts
-function getViteDefine(secretSet, options = {}) {
-  const values = secretSet.secrets();
-  const keys = options.publicKeys ?? Object.keys(values);
-  if (!options.publicKeys && keys.some((key) => !key.startsWith("VITE_"))) {
-    throw new SecretLoadError("CONFIGURATION", "Vite secret sets must contain only VITE_ keys, or provide an explicit publicKeys list.");
-  }
-  for (const key of keys) {
-    if (!Object.hasOwn(values, key) || !/^[A-Za-z_$][\w$]*$/.test(key)) {
-      throw new SecretLoadError("CONFIGURATION", "Vite publicKeys must reference configured keys with valid JavaScript identifiers.");
-    }
-    if (["MODE", "BASE_URL", "PROD", "DEV", "SSR"].includes(key)) {
-      throw new SecretLoadError("CONFIGURATION", "Vite built-in environment constants cannot be overridden by secrets.");
-    }
-  }
-  return Object.fromEntries(keys.map((key) => [`import.meta.env.${key}`, JSON.stringify(values[key])]));
-}
-function viteSecretSetPlugin(secretSet, options = {}) {
-  return {
-    name: "hanzio-secret-set",
-    config: () => ({ define: getViteDefine(secretSet, options) })
-  };
-}
 
 // src/secrets/index.ts
 function getSecretEnvironment() {
   return resolveSecretEnvironment(undefined, getProcessEnvironment());
 }
-async function defineSecretSet2(keys, options) {
+function createSecretSet(keys, options) {
   let loader;
   if (!options.loader) {
     validateInfisicalOrganizationId(options.organizationId);
@@ -1720,7 +337,7 @@ async function defineSecretSet2(keys, options) {
   } else {
     loader = options.loader;
   }
-  return defineSecretSet(keys, { ...options, loader }, getProcessEnvironment());
+  return createSecretSet2(keys, { ...options, loader }, getProcessEnvironment());
 }
 function createDefaultInfisicalLoader(options) {
   return (context) => loadInfisicalSecrets({
@@ -1734,16 +351,21 @@ function createDefaultInfisicalLoader(options) {
     clientSecretEnvKey: options.clientSecretEnvKey ?? "INFISICAL_CLIENT_SECRET"
   });
 }
+async function defineSecretSet(keys, options) {
+  return createSecretSet(keys, options).load();
+}
 export {
   DEFAULT_INFISICAL_SITE_URL,
-  SecretLoadError,
-  cloudflareWorkerEnvLoader,
-  defineSecretSet2 as defineSecretSet,
+  SecretLoadError2 as SecretLoadError,
+  cloudflareWorkerEnvLoader2 as cloudflareWorkerEnvLoader,
+  createSecretSet,
+  defineSecretSet,
   fetchInfisicalSecrets,
   getSecretEnvironment,
-  getViteDefine,
+  getViteDefine2 as getViteDefine,
   infisicalLoader,
   loadInfisicalSecrets,
   processEnvLoader,
-  viteSecretSetPlugin
+  readPublicConfig2 as readPublicConfig,
+  viteSecretSetPlugin2 as viteSecretSetPlugin
 };