void 0.10.8 → 0.10.11

package/dist/env-validation-BdDlGhbN.mjs

@@ -0,0 +1,1069 @@
+import { n as __exportAll } from "./rolldown-runtime-DJK8HYOj.mjs";
+import { a as join, c as resolve, n as dirname } from "./dist-DaKKDf8D.mjs";
+import { i as voidWarn } from "./log-ChfPKsVd.mjs";
+import { c as mergeAndExpand, l as parseDotenvFile, o as resolveWranglerArgv } from "./preset-BGrvB4Bl.mjs";
+import { t as findEnvFile } from "./env-types-QBj-ndax.mjs";
+import { getSecretOverride } from "./runtime/env-helpers.mjs";
+import { t as isLikelySecretKey } from "./env-mask-Dd47NbR6.mjs";
+import { existsSync, readFileSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+import { spawn } from "node:child_process";
+import { parse } from "jsonc-parser";
+//#region src/host/load-user-env.ts
+/**
+* Loader for the user's `env.ts`.
+*
+* Uses Node's native `import()` (type-stripping is on by default in the
+* supported Node version), so only relative imports and bare package
+* specifiers resolve. tsconfig path aliases (`@/foo`, `~/foo`) are NOT
+* supported — if the user writes one, we detect the resulting resolution
+* error and re-throw with guidance pointing at the offending specifier.
+*
+* Used by:
+*   - `plugin-env-schema.ts` (dev plugin, HMR re-imports)
+*   - `cli/env-validation.ts` (deploy + `void env check`)
+*
+* Side-effect contract: loading the file evaluates the user's `defineEnv`
+* call, which registers the schema in the singleton state in
+* `runtime/env-public.ts`. Callers read the result from there.
+*
+* Node-only (lives under `host/`). Must not be imported from anything
+* that ships in worker bundles.
+*/
+let loadCounter = 0;
+/**
+* Returns the specifier from a Node resolution error if the error looks
+* like one — otherwise `null`. Both `ERR_MODULE_NOT_FOUND` and
+* `ERR_UNSUPPORTED_DIR_IMPORT` have the specifier embedded in the message.
+*/
+function extractFailedSpecifier(err) {
+	if (!(err instanceof Error)) return null;
+	const code = err.code;
+	if (code !== "ERR_MODULE_NOT_FOUND" && code !== "ERR_PACKAGE_PATH_NOT_EXPORTED") return null;
+	const match = /Cannot find (?:package|module) '([^']+)'/.exec(err.message);
+	return match ? match[1] ?? null : null;
+}
+/** A specifier is alias-shaped if it isn't relative, absolute, a node: URL, or a valid bare package name. */
+function looksLikeAlias(specifier) {
+	if (specifier.startsWith("./") || specifier.startsWith("../") || specifier.startsWith("/") || specifier.startsWith("node:") || specifier.startsWith("file:")) return false;
+	if (specifier.startsWith("@")) return !/^@[^/]+\/[^/]+/.test(specifier);
+	return specifier.startsWith("~") || specifier.startsWith("#");
+}
+/**
+* Load the user's env.ts via native `import()`. The URL gets a cache-busting
+* query param so HMR re-imports re-evaluate the file.
+*
+* On resolution failures, wraps the error with the source file path, and if
+* the failed specifier looks like a tsconfig path alias, appends guidance
+* explaining that env.ts doesn't resolve aliases.
+*/
+async function loadUserEnvFile(envFile) {
+	const url = pathToFileURL(envFile).href + `?t=${Date.now()}-${++loadCounter}`;
+	try {
+		await import(
+			/* @vite-ignore */
+			url
+);
+	} catch (err) {
+		const specifier = extractFailedSpecifier(err);
+		const base = `env: Failed to load '${envFile}': '${err.message}'.`;
+		if (specifier && looksLikeAlias(specifier)) throw new Error(`${base}\n\nHint: '${specifier}' looks like a tsconfig path alias. env.ts is loaded directly by Node and does not resolve tsconfig "paths" — use a relative import (e.g. "./shared/...") instead.`);
+		throw new Error(base);
+	}
+}
+//#endregion
+//#region src/cli/env-validation.ts
+/**
+* Shared env-schema validation for CLI commands.
+*
+* Loads the user's `env.ts` (which calls `defineEnv` as a side effect),
+* collects sources of env values (`.env*` files, remote secrets), and
+* validates each declared key against the registered schema.
+*
+* Used by both `void deploy` (hard error on missing prod env) and
+* `void env check` (CI/pre-push validation).
+*/
+var env_validation_exports = /* @__PURE__ */ __exportAll({
+	SelfHostEnvValidationError: () => SelfHostEnvValidationError,
+	SelfHostFirstDeployError: () => SelfHostFirstDeployError,
+	SelfHostSchemaError: () => SelfHostSchemaError,
+	SelfHostSecretListError: () => SelfHostSecretListError,
+	collectPlaintextVarWarningsFromVars: () => collectPlaintextVarWarningsFromVars,
+	computeInvalidEmittedKeys: () => computeInvalidEmittedKeys,
+	createDefaultSecretListRunner: () => createDefaultSecretListRunner,
+	deriveSelfHostEnvContextFromVars: () => deriveSelfHostEnvContextFromVars,
+	deriveSelfHostSchemaFacts: () => deriveSelfHostSchemaFacts,
+	dischargeSelfHostEnvContext: () => dischargeSelfHostEnvContext,
+	fetchRemoteSecretNames: () => fetchRemoteSecretNames,
+	formatEnvReport: () => formatEnvReport,
+	getDeployEnvDefaults: () => getDeployEnvDefaults,
+	readEmittedWorkerVars: () => readEmittedWorkerVars,
+	secretListEnv: () => secretListEnv,
+	selfHostSchemaFailureMessage: () => selfHostSchemaFailureMessage,
+	validateProdEnv: () => validateProdEnv
+});
+/**
+* After the user's env.ts has been imported (via `validateProdEnv` or
+* `loadSchema`), read the registered schema's `.default(value)` entries.
+* Returns `{}` if no schema was registered.
+*/
+async function getDeployEnvDefaults(root) {
+	const envFile = findEnvFile(root);
+	if (!envFile) return {};
+	const mod = await loadSchema(envFile);
+	if (!mod) return {};
+	return mod._getSchemaDefaults();
+}
+/** Load the registered schema by importing the user's env.ts. */
+async function loadSchema(envFile) {
+	await loadUserEnvFile(envFile);
+	const mod = await import("./runtime/env-public.mjs");
+	if (!mod._hasRegisteredSchema()) return null;
+	return mod;
+}
+function emptyReport() {
+	return {
+		valid: true,
+		missing: [],
+		invalid: [],
+		values: /* @__PURE__ */ new Map()
+	};
+}
+/**
+* Validate the user's env schema against the union of .env files and
+* remote secret names. Remote secrets are treated as "present" (we can't
+* fetch their values), which is sufficient for the missing-key check.
+*/
+async function validateProdEnv(root, options) {
+	const envFile = findEnvFile(root);
+	if (!envFile) return {
+		hasSchema: false,
+		report: emptyReport()
+	};
+	const mod = await loadSchema(envFile);
+	if (!mod) return {
+		hasSchema: false,
+		report: emptyReport()
+	};
+	const merged = mergeAndExpand((options.productionOnly ? [".env", ".env.production"] : [
+		".env",
+		".env.local",
+		".env.production",
+		".env.production.local"
+	]).map((file) => parseDotenvFile(join(root, file), { expand: false })), { onWarn: (msg) => voidWarn(msg) });
+	const report = await mod.validateAllEnv(merged);
+	const remoteSet = new Set(options.remoteSecrets ?? []);
+	if (remoteSet.size > 0 && report.missing.length > 0) {
+		report.missing = report.missing.filter((key) => !remoteSet.has(key));
+		if (report.missing.length === 0 && report.invalid.length === 0) report.valid = true;
+	}
+	return {
+		hasSchema: true,
+		report
+	};
+}
+/** Format an EnvValidationReport into a human-readable multi-line string. */
+function formatEnvReport(report) {
+	const lines = [];
+	if (report.missing.length > 0) {
+		lines.push("Missing required env vars:");
+		for (const key of report.missing) lines.push(`  • ${key}`);
+	}
+	if (report.invalid.length > 0) {
+		if (lines.length > 0) lines.push("");
+		lines.push("Invalid env vars:");
+		for (const { key, messages } of report.invalid) lines.push(`  • ${key}: ${messages.join("; ")}`);
+	}
+	return lines.join("\n");
+}
+/** Convenience: fetch remote secret names from the platform. */
+async function fetchRemoteSecretNames(client, projectId) {
+	try {
+		return (await client.listSecrets(projectId)).map((s) => s.name);
+	} catch {
+		return [];
+	}
+}
+/**
+* A `scheme://user:password@host…` connection URL — the shape that carries a
+* live credential in a key nothing in the NAME heuristic would catch. The
+* motivating case is `DATABASE_URL`: `SECRET_KEY_RE` has no `URL`/`DATABASE`
+* branch, and the shared `isLikelySecretValue` cannot help either — its
+* `HIGH_ENTROPY_RE` character class excludes `@`, so a connection URL never
+* matches it. Both halves of the userinfo must be non-empty, so a bare
+* `postgres://host/db` or a password-less `https://user@host` is NOT flagged.
+*
+* Deliberately local to the DEPLOY-side warning rather than added to
+* `shared/env-mask.ts`: that module is also the runtime/managed redaction
+* heuristic, and widening it would change masking behaviour well outside this
+* warning.
+*/
+const CREDENTIAL_URL_VALUE_RE = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^/\s:@]+:[^/\s@]+@/;
+/**
+* `true` when a var's VALUE is a connection URL carrying inline credentials.
+* Inspecting the value is safe here: only the KEY name ever leaves
+* {@link collectPlaintextVarWarningsFromVars}.
+*/
+function isCredentialBearingUrlValue(value) {
+	return typeof value === "string" && CREDENTIAL_URL_VALUE_RE.test(value);
+}
+/**
+* The required-key set, derived independently of how any validator treats
+* the empty string. A key is required iff its validator REJECTS the ABSENT
+* value (probe with `undefined`) — the SAME notion of "required" the managed
+* gate uses (a key lands in `validateAllEnv().missing` when its absent value
+* yields issues; `_getSchemaDefaults` probes `undefined` the exact same way).
+* Requiredness is NEVER inferred from whether `""` validates, so a schema that
+* ACCEPTS `""` (e.g. a bare Zod `z.string()`) is still correctly required.
+*
+* Runs the user's validators (arbitrary code), so callers MUST invoke this
+* inside {@link withSchemaBoundary}: a validator that THROWS synchronously or
+* REJECTS (async) on the probe surfaces as a values-free structural error, and
+* the awaited async probe can never float as an unhandled rejection carrying a
+* value. A NORMAL rejection (an `{ issues }` Result, not a thrown/rejected
+* error) simply marks the key required.
+*/
+async function requiredSchemaKeys(schema) {
+	const required = /* @__PURE__ */ new Set();
+	for (const [key, validator] of Object.entries(schema)) {
+		const resultMaybe = validator["~standard"].validate(void 0);
+		if ((resultMaybe instanceof Promise ? await resultMaybe : resultMaybe).issues) required.add(key);
+	}
+	return required;
+}
+/**
+* Hard failure fetching the remote secret list (spawn error, signal, nonzero
+* exit, timeout, or malformed output). DISTINCT from
+* {@link SelfHostEnvValidationError}: this means "we could not learn what
+* secrets exist" (fail closed), never "a required secret is missing".
+*
+* The message and attached fields are values-free by construction: only
+* the structural {@link SecretListFailureReason} code and safe scalars
+* ({@link SecretListFailureDetail}) are exposed. Raw wrangler output (stderr,
+* stdout, rejection/spawn-error text) is NEVER stored here, so no env value the
+* child may have echoed can reach `Error.message`, the `reason`/`detail`
+* fields, or their JSON serialization — even under `VOID_ENV_UNMASK`.
+*/
+var SelfHostSecretListError = class extends Error {
+	name = "SelfHostSecretListError";
+	/** Stable, values-free failure classification. */
+	reason;
+	/** Safe scalars (exit code / signal name) — never contain wrangler output. */
+	detail;
+	constructor(message, reason, detail = {}) {
+		super(message);
+		this.reason = reason;
+		this.detail = detail;
+	}
+};
+/**
+* FIRST-DEPLOY specialization of {@link SelfHostSecretListError}: the remote
+* secret list could not be fetched because the worker has NOT been deployed
+* yet. wrangler 4.107's `secret list` catches the API worker-not-found error
+* (codes 10007 / 10090 — `WORKER_NOT_FOUND` / `WORKER_LEGACY_ENVIRONMENT_NOT_FOUND`,
+* per `isWorkerNotFoundError` in wrangler-dist/cli.js) and rethrows a `UserError`
+* ("… not found. If this is a new Worker, run `wrangler deploy` first to create
+* it."), exiting nonzero. Rather than surface that circular "deploy first" dead
+* end, this carries the still-unsatisfied required key NAMES plus a
+* worker-not-found flag so the deploy orchestrator can render actionable
+* `wrangler secret put <NAME>` bootstrap guidance (wrangler can `secret put` to
+* a draft worker). Still a HARD, fail-closed error — subclassing keeps existing
+* `instanceof SelfHostSecretListError` fail-closed handling intact.
+*/
+var SelfHostFirstDeployError = class extends SelfHostSecretListError {
+	name = "SelfHostFirstDeployError";
+	/** Always true — distinguishes this from a generic list failure structurally. */
+	workerNotFound = true;
+	/** Required schema key NAMES still unsatisfied locally (values-free). */
+	missingKeys;
+	constructor(message, missingKeys, exitCode) {
+		super(message, "nonzero-exit", { exitCode });
+		this.missingKeys = missingKeys;
+	}
+};
+/**
+* The env schema is not satisfied for a self-host production deploy: required
+* keys are missing (not in `.env`/`.env.production` and not present as remote
+* worker secrets), local values are invalid, or an EMPTY local assignment would
+* shadow a remote secret. The message and the attached `report` carry the
+* offending key NAMES plus stable, values-free reason codes only — never raw
+* input, never resolved values — so nothing on this path can echo a secret
+* (see {@link selfHostEnvError}), even under `VOID_ENV_UNMASK`.
+*/
+var SelfHostEnvValidationError = class extends Error {
+	name = "SelfHostEnvValidationError";
+	report;
+	constructor(message, report) {
+		super(message);
+		this.report = report;
+	}
+};
+/**
+* A self-host schema evaluation/validation step threw. DISTINCT from
+* {@link SelfHostEnvValidationError} (which means "a required value is missing
+* or invalid", carrying key names): this means the schema machinery itself
+* raised — env.ts failed to evaluate, or a validator threw/rejected rather than
+* returning issues. Values-free by construction: the original error's
+* message/stack/cause are DROPPED at the boundary and only the structural
+* {@link SelfHostSchemaFailureReason} code + fixed guidance survive, so no env
+* value the user's code may have embedded can reach the thrown error, even
+* under `VOID_ENV_UNMASK`.
+*/
+var SelfHostSchemaError = class extends Error {
+	name = "SelfHostSchemaError";
+	/** Stable, values-free failure classification. */
+	reason;
+	constructor(message, reason) {
+		super(message);
+		this.reason = reason;
+	}
+};
+/** The fixed, values-free message for each schema-failure reason. */
+function selfHostSchemaFailureMessage(reason) {
+	switch (reason) {
+		case "schema-load-failed": return "env: the project env schema could not be loaded (reason: schema-load-failed). Check that env.ts evaluates without error, then run the deploy again.";
+		case "schema-validation-error": return "env: an env schema validator raised an error while checking production values (reason: schema-validation-error). Re-run the validator locally to see its own diagnostics.";
+	}
+}
+/**
+* Values-free boundary around EVERY self-host schema evaluation +
+* validation step. `loadSchema` evaluates the user's env.ts and each
+* `validateProdEnv` / `validateAllEnv` pass runs the registered validators —
+* all arbitrary code that can throw/reject an error EMBEDDING an env value in
+* its message, stack, or cause (and `VOID_ENV_UNMASK` disables redaction). Any
+* throw/reject from `fn` is caught, its original message/stack/cause DROPPED,
+* and a fixed structural {@link SelfHostSchemaError} rethrown in its place. The
+* managed `validateProdEnv` itself is NEVER wrapped — only the self-host CALL
+* SITES pass through here, so the managed path is byte-identical.
+*/
+async function withSchemaBoundary(reason, fn) {
+	try {
+		return await fn();
+	} catch {
+		throw new SelfHostSchemaError(selfHostSchemaFailureMessage(reason), reason);
+	}
+}
+/** A no-schema {@link SelfHostEnvContext} — nothing to gate. */
+function emptyEnvContext() {
+	return {
+		hasSchema: false,
+		presentEmptyRequired: [],
+		presentEmptySources: {},
+		absentRequired: [],
+		invalidKeys: []
+	};
+}
+/**
+* Derive the {@link SelfHostSchemaFacts} by importing the user's env.ts. Runs
+* ARBITRARY project code (env.ts evaluation) + the registered validators' probes,
+* so the caller MUST run this in an ISOLATED SUBPROCESS ({@link
+* ../cli/env-schema-probe.ts}) under a scrubbed env. Throws only a values-free
+* {@link SelfHostSchemaError} (via {@link withSchemaBoundary}) when the schema
+* machinery itself fails; the derived names/flags are returned as values-free data.
+*/
+async function deriveSelfHostSchemaFacts(root) {
+	const envFile = findEnvFile(root);
+	if (envFile == null) return {
+		hasSchema: false,
+		requiredKeys: [],
+		secretKeys: []
+	};
+	const mod = await withSchemaBoundary("schema-load-failed", () => loadSchema(envFile));
+	if (!mod) return {
+		hasSchema: false,
+		requiredKeys: [],
+		secretKeys: []
+	};
+	const schema = mod._getRegisteredSchema() ?? {};
+	const requiredKeys = await withSchemaBoundary("schema-validation-error", () => requiredSchemaKeys(schema));
+	const secretKeys = Object.keys(schema).filter((key) => getSecretOverride(schema[key]) === "secret");
+	return {
+		hasSchema: true,
+		requiredKeys: [...requiredKeys],
+		secretKeys
+	};
+}
+/**
+* Build the values-free {@link SelfHostEnvContext} from the REAL worker `vars` the
+* build emitted into `dist/ssr/wrangler.json` (ground truth — never a facsimile)
+* plus the env-insensitive {@link SelfHostSchemaFacts}. PURE (no project code, no
+* I/O): the parent runs this AFTER the build with the real emitted map, so the
+* gate reads exactly what the worker ships.
+*   - a required key present with an EMPTY value (`K=""` or `K=null`) → SHADOWS a
+*     same-named remote secret with an unusable value → fail closed ALWAYS
+*     (`presentEmptyRequired`). Both spellings are treated the same because the
+*     schema validators classify `null` and `""` as "missing" (not "invalid"), so
+*     they would otherwise slip past both the invalid-value probe and the absent
+*     fence while still shadowing the remote secret.
+*   - a required key ABSENT from the emitted vars → the only state a remote secret
+*     can discharge (`absentRequired`).
+* `invalidKeys` is populated separately from the value-validation probe (the parent
+* folds it in); a PRESENT, NON-EMPTY value that fails the schema validator lands there.
+*/
+function deriveSelfHostEnvContextFromVars(emittedVars, facts) {
+	if (!facts.hasSchema) return emptyEnvContext();
+	const isEmptyShadow = (value) => value === "" || value === null;
+	const presentEmptyRequired = facts.requiredKeys.filter((key) => Object.hasOwn(emittedVars, key) && isEmptyShadow(emittedVars[key]));
+	const absentRequired = facts.requiredKeys.filter((key) => !Object.hasOwn(emittedVars, key));
+	const presentEmptySources = {};
+	for (const key of presentEmptyRequired) presentEmptySources[key] = { kind: "emitted" };
+	return {
+		hasSchema: true,
+		presentEmptyRequired,
+		presentEmptySources,
+		absentRequired,
+		invalidKeys: []
+	};
+}
+/**
+* Follow the CF plugin's deploy pointer (`.wrangler/deploy/config.json` →
+* `configPath`) to the generated wrangler config the build emitted, and return it
+* parsed. Shared by the parent's ground-truth reads and the isolated
+* `validate-emitted` probe child, so both resolve the SAME artifact. Returns a
+* fail-closed reason (never throws) when the pointer/config is missing or malformed.
+*/
+function readGeneratedWranglerConfig(root) {
+	const deployConfigPath = join(root, ".wrangler", "deploy", "config.json");
+	if (!existsSync(deployConfigPath)) return {
+		ok: false,
+		reason: `the CF plugin's deploy pointer at ${deployConfigPath} was not written by the build.`
+	};
+	let redirectedPath;
+	try {
+		const parsed = JSON.parse(readFileSync(deployConfigPath, "utf-8"));
+		if (typeof parsed.configPath !== "string" || parsed.configPath.length === 0) return {
+			ok: false,
+			reason: `${deployConfigPath} has no "configPath" pointer.`
+		};
+		redirectedPath = resolve(dirname(deployConfigPath), parsed.configPath);
+	} catch {
+		return {
+			ok: false,
+			reason: `${deployConfigPath} is not valid JSON.`
+		};
+	}
+	if (!existsSync(redirectedPath)) return {
+		ok: false,
+		reason: `generated wrangler config ${redirectedPath} does not exist.`
+	};
+	try {
+		return {
+			ok: true,
+			config: JSON.parse(readFileSync(redirectedPath, "utf-8"))
+		};
+	} catch {
+		return {
+			ok: false,
+			reason: `generated wrangler config ${redirectedPath} is not valid JSON.`
+		};
+	}
+}
+/**
+* Read the REAL `vars` map the build baked into `dist/ssr/wrangler.json` (ground
+* truth — the exact plaintext the worker ships). A missing `vars` field is an empty
+* map (a worker with no vars), not a failure; a missing/malformed artifact fails
+* closed. The self-host orchestrator reads this in the parent; the `validate-emitted`
+* probe reads it in the child to run the schema validators against those exact
+* values in isolation.
+*/
+function readEmittedWorkerVars(root) {
+	const resolved = readGeneratedWranglerConfig(root);
+	if (!resolved.ok) return resolved;
+	const vars = resolved.config.vars;
+	if (vars === void 0) return {
+		ok: true,
+		vars: {}
+	};
+	if (vars === null || typeof vars !== "object" || Array.isArray(vars)) return {
+		ok: false,
+		reason: "the generated wrangler config has a malformed \"vars\" field (expected an object)."
+	};
+	return {
+		ok: true,
+		vars
+	};
+}
+/**
+* Validate the REAL emitted worker `vars` against the registered schema's
+* validators and return the FAILING key NAMES only (values-free). A key FAILS iff
+* the validator REJECTS the value it was SHIPPED WITH — the UNION of:
+*   - `report.invalid` (a PRESENT, NON-EMPTY value the validator rejected), plus
+*   - the `report.missing` keys that are STILL PRESENT in `emittedVars` (the key
+*     exists in the emitted map with value `null`/`""`). `validateAllEnv` buckets a
+*     REJECTED `undefined`/`null`/`""` as "missing", not "invalid" (see
+*     `runtime/env-public.ts` — `isMissing = raw === undefined || raw === null || raw
+*     === ''`), so an OPTIONAL-with-validator key shipped as `""`/`null` (e.g.
+*     `z.url().optional()`, which rejects those but the required-empty fence in
+*     `deriveSelfHostEnvContextFromVars` — `requiredKeys` only — never covers) would
+*     otherwise slip EVERY gate and boot-reject the deployed worker.
+* A `report.missing` key ABSENT from `emittedVars` is NEVER counted: it is a
+* genuinely-unset REQUIRED secret that a same-named remote `wrangler secret list`
+* secret can still discharge, so it stays with the context's absent fence rather than
+* becoming a hard invalid. Runs the user's validators (arbitrary code), so the caller
+* MUST run this in the isolated {@link ../cli/env-schema-probe.ts} subprocess; a
+* validator that THROWS/REJECTS surfaces as a values-free {@link SelfHostSchemaError}
+* via {@link withSchemaBoundary}. NEVER reads `report.invalid[].messages` (which can
+* embed the offending value) — only the key names leave here.
+*/
+async function computeInvalidEmittedKeys(root, emittedVars) {
+	const envFile = findEnvFile(root);
+	if (envFile == null) return [];
+	const mod = await withSchemaBoundary("schema-load-failed", () => loadSchema(envFile));
+	if (!mod) return [];
+	const report = await withSchemaBoundary("schema-validation-error", () => mod.validateAllEnv(emittedVars));
+	const invalid = new Set(report.invalid.map((entry) => entry.key));
+	for (const key of report.missing) if (Object.hasOwn(emittedVars, key)) invalid.add(key);
+	return Array.from(invalid).sort((a, b) => a.localeCompare(b));
+}
+/**
+* Classify the secret-looking keys among the REAL worker `vars` the build baked
+* into `dist/ssr/wrangler.json` (ground truth). PURE: for each emitted var key, a
+* `.secret()`-flagged key ({@link SelfHostSchemaFacts.secretKeys}) is
+* `schema-secret`; otherwise the shared {@link isLikelySecretKey} name heuristic
+* applies (so a secret-looking key ships plaintext regardless of any schema, and
+* heuristic classification still works with no env.ts at all); failing both, a
+* VALUE shaped like a credential-bearing connection URL
+* ({@link isCredentialBearingUrlValue}) flags the key as `value-shape`, catching
+* the `DATABASE_URL`-class leak no name heuristic sees.
+*
+* KEYS ONLY leave here — a value may be INSPECTED to classify it, but is never
+* copied into the result, so no caller can format a value into a log.
+*/
+function collectPlaintextVarWarningsFromVars(emittedVars, secretFlaggedKeys) {
+	const flagged = new Set(secretFlaggedKeys);
+	const keys = Object.keys(emittedVars);
+	const secretKeys = [];
+	for (const key of keys) {
+		if (flagged.has(key)) {
+			secretKeys.push({
+				key,
+				reason: "schema-secret"
+			});
+			continue;
+		}
+		if (isLikelySecretKey(key)) {
+			secretKeys.push({
+				key,
+				reason: "heuristic"
+			});
+			continue;
+		}
+		if (isCredentialBearingUrlValue(emittedVars[key])) secretKeys.push({
+			key,
+			reason: "value-shape"
+		});
+	}
+	secretKeys.sort((a, b) => a.key.localeCompare(b.key));
+	return {
+		secretKeys,
+		totalVarKeys: keys.length
+	};
+}
+/** Build a values-free invalid {@link EnvValidationReport} from key names only. */
+function invalidEnvReport(missing, invalidKeys) {
+	return {
+		valid: false,
+		missing,
+		invalid: invalidKeys.map((key) => ({
+			key,
+			messages: [SELF_HOST_INVALID_REASON]
+		})),
+		values: /* @__PURE__ */ new Map()
+	};
+}
+/**
+* DISCHARGE half of the self-host gate — PURE parent work over the values-free
+* {@link SelfHostEnvContext} the subprocess derived, plus at most one `wrangler
+* secret list`. Runs NO project code, NO `loadEnv`, and imports NO env.ts, so the
+* parent never evaluates arbitrary code with live credentials in scope. Applies
+* the three fences unchanged:
+*   - a PRESENT-EMPTY required key fails closed ALWAYS, before any wrangler spawn;
+*   - the pinned worker `name` is reconciled against the config's `name`, and the
+*     target account against the config's `account_id`, BOTH BEFORE `secret list`
+*     is spawned;
+*   - an ABSENT required key is discharged only by a same-named remote secret,
+*     else fails closed ({@link SelfHostFirstDeployError} on a not-yet-deployed
+*     worker, carrying the missing names + `wrangler secret put` guidance).
+*/
+async function dischargeSelfHostEnvContext(context, options) {
+	if (!context.hasSchema) return {
+		hasSchema: false,
+		remoteSecretNames: null
+	};
+	if (context.presentEmptyRequired.length > 0) throw emptyAssignmentError(context.presentEmptyRequired, context.presentEmptySources);
+	const invalidKeys = context.invalidKeys;
+	if (context.absentRequired.length === 0) {
+		if (invalidKeys.length > 0) throw selfHostEnvError(invalidEnvReport([], invalidKeys));
+		return {
+			hasSchema: true,
+			remoteSecretNames: null
+		};
+	}
+	reconcileSelfHostWorkerName(options.configPath, options.workerName);
+	const effectiveAccountId = reconcileSelfHostAccount(options.configPath, options.accountId);
+	const remoteSecretNames = await fetchSelfHostSecretNames(options.runWrangler ?? createDefaultSecretListRunner(options.root, {
+		accountId: effectiveAccountId,
+		timeoutMs: options.timeoutMs
+	}), options.configPath, context.absentRequired);
+	const remoteSet = new Set(remoteSecretNames);
+	const stillMissing = context.absentRequired.filter((key) => !remoteSet.has(key));
+	if (stillMissing.length > 0 || invalidKeys.length > 0) throw selfHostEnvError(invalidEnvReport(stillMissing, invalidKeys));
+	return {
+		hasSchema: true,
+		remoteSecretNames
+	};
+}
+/**
+* Read the pinned config's top-level `account_id` and reconcile it with
+* the caller's requested account, mirroring the provisioner's account gate
+* (provision.ts `provisionCloudflareResourcesLocked`). wrangler 4.107 gives the
+* config's `account_id` PRECEDENCE over `CLOUDFLARE_ACCOUNT_ID`, so a real
+* config-vs-requested mismatch is a fail-closed error (thrown BEFORE any spawn).
+* Returns the ONE effective account to pin (config wins, else requested), or
+* undefined when neither is set (wrangler then resolves it as it normally would).
+*/
+function reconcileSelfHostAccount(configPath, requestedAccountId) {
+	const configAccountId = readConfigAccountId(configPath);
+	if (configAccountId && requestedAccountId && configAccountId !== requestedAccountId) throw new SelfHostSecretListError(`env: Cloudflare account mismatch — "${configPath}" pins account_id ${JSON.stringify(configAccountId)} but the deploy targets ${JSON.stringify(requestedAccountId)}. wrangler resolves the config's account_id before CLOUDFLARE_ACCOUNT_ID, so \`wrangler secret list\` would consult ${JSON.stringify(configAccountId)} while the deploy expects ${JSON.stringify(requestedAccountId)} — a same-named secret there could falsely pass this preflight. Reconcile them (correct or remove the config's account_id, or deploy to the pinned account) and retry.`, "account-mismatch");
+	return configAccountId ?? requestedAccountId;
+}
+/**
+* Reconcile the config's top-level worker `name` against the name the deploy PINNED
+* (deploy.ts step 5 writes `name: workerName` into the root config before the build).
+* `wrangler secret list` resolves the worker from the config's `name`
+* (`getLegacyScriptName`: `args.name ?? config.name` — we pass no `--name`), so a
+* config whose `name` was CHANGED after it was pinned would make the gate list secrets
+* for a DIFFERENT worker than the deploy ships — and a same-named secret there could
+* falsely pass this preflight while the pinned worker deploys WITHOUT it.
+*
+* Fires ONLY when the config actually declares a `name` that DIFFERS from a passed
+* pinned name (the same "both set and differ" guard as {@link reconcileSelfHostAccount})
+* — post-pin the config's `name` IS `workerName`, so a later divergence is exactly the
+* laundering signal, while an undefined pinned name or an undeclared config `name` never
+* trips a legitimate deploy. Thrown BEFORE any spawn (its message names worker names,
+* which are caller/config identifiers, never wrangler output).
+*/
+function reconcileSelfHostWorkerName(configPath, pinnedWorkerName) {
+	const configName = readConfigName(configPath);
+	if (configName && pinnedWorkerName && configName !== pinnedWorkerName) throw new SelfHostSecretListError(`env: Cloudflare worker name mismatch — "${configPath}" declares name ${JSON.stringify(configName)} but the deploy pinned ${JSON.stringify(pinnedWorkerName)}. wrangler resolves the worker name from the config's \`name\`, so \`wrangler secret list\` would consult ${JSON.stringify(configName)} while the deploy ships ${JSON.stringify(pinnedWorkerName)} — a same-named secret there could falsely pass this preflight. The config's name was changed after it was pinned; rebuild from a clean checkout, then rerun.`, "name-mismatch");
+}
+/** UTF-8 BOM, stripped before JSONC parsing (matches provision.ts readRootConfig). */
+const UTF8_BOM = "";
+/** True when `value` is a non-array object (JSONC-parsed config record). */
+function isConfigRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Parse the resolved root wrangler config (`-c` target) into a top-level record,
+* mirroring the provisioner's `readRootConfig` (jsonc-parser, BOM-stripped,
+* trailing commas allowed). We read the SAME file the deploy pins via `-c` and
+* force top-level via `--env=`, so its top-level fields are exactly what
+* wrangler's `secret list` and the build both resolve. An unreadable/malformed
+* config yields undefined — callers then fall back safely (no account gate / no
+* root-wrangler var layer), and wrangler itself later fails on a truly broken
+* config with a distinct fail-closed {@link SelfHostSecretListError}.
+*/
+function parseRootConfig(configPath) {
+	if (!existsSync(configPath)) return;
+	let raw;
+	try {
+		raw = readFileSync(configPath, "utf-8");
+	} catch {
+		return;
+	}
+	const content = raw.startsWith(UTF8_BOM) ? raw.slice(1) : raw;
+	const errors = [];
+	const parsed = parse(content, errors, { allowTrailingComma: true });
+	if (errors.length > 0 || !isConfigRecord(parsed)) return;
+	return parsed;
+}
+/**
+* Read the top-level `account_id` string from the resolved wrangler config
+* (`-c` target). Same file/parse as {@link parseRootConfig}; this is exactly the
+* account wrangler's `secret list` will resolve. An unreadable/malformed config
+* yields undefined (no reconciliation gate).
+*/
+function readConfigAccountId(configPath) {
+	const parsed = parseRootConfig(configPath);
+	if (!parsed) return;
+	const accountId = parsed.account_id;
+	return typeof accountId === "string" && accountId.length > 0 ? accountId : void 0;
+}
+/**
+* Read the top-level `name` string from the resolved wrangler config (`-c` target).
+* Same file/parse as {@link parseRootConfig}; this is exactly the worker name
+* wrangler's `secret list` will resolve. An unreadable/malformed config or an
+* absent/empty `name` yields undefined (no reconciliation gate).
+*/
+function readConfigName(configPath) {
+	const parsed = parseRootConfig(configPath);
+	if (!parsed) return;
+	const name = parsed.name;
+	return typeof name === "string" && name.length > 0 ? name : void 0;
+}
+/**
+* Stable, values-free reason code stamped on every invalid key on the
+* self-host path. The raw validator message (e.g. `Expected a number, got
+* "not-a-number"`) can EMBED the offending input, and redaction preserves
+* benign values / can be disabled via `VOID_ENV_UNMASK`, so the message text is
+* never surfaced here — only the key name and this fixed code.
+*/
+const SELF_HOST_INVALID_REASON = "failed schema validation";
+/**
+* Build the hard error for an unsatisfied schema from KEY NAMES + the
+* stable {@link SELF_HOST_INVALID_REASON} code ONLY. It never reads
+* `report.invalid[].messages` (which can embed raw input) and never resolved
+* `report.values`, and it attaches a freshly-sanitized report of the same
+* shape — so neither the thrown message, the attached report, nor its JSON
+* serialization can echo a value, even with `VOID_ENV_UNMASK` set.
+*/
+function selfHostEnvError(report) {
+	const sortNames = (names) => [...names].sort((a, b) => a.localeCompare(b));
+	const missing = sortNames(report.missing);
+	const invalidKeys = sortNames(report.invalid.map((i) => i.key));
+	const lines = [];
+	if (missing.length > 0) {
+		lines.push("Missing required env vars:");
+		for (const key of missing) lines.push(`  • ${key}`);
+	}
+	if (invalidKeys.length > 0) {
+		if (lines.length > 0) lines.push("");
+		lines.push("Invalid env vars:");
+		for (const key of invalidKeys) lines.push(`  • ${key} (${SELF_HOST_INVALID_REASON})`);
+	}
+	if (missing.length > 0) lines.push("", "Set each missing production secret with `wrangler secret put <NAME>`, or add a value to .env / .env.production.");
+	const safeReport = {
+		valid: report.valid,
+		missing: report.missing,
+		invalid: report.invalid.map((i) => ({
+			key: i.key,
+			messages: [SELF_HOST_INVALID_REASON]
+		})),
+		values: /* @__PURE__ */ new Map()
+	};
+	return new SelfHostEnvValidationError(lines.join("\n"), safeReport);
+}
+/**
+* The values-free description of a var's WINNING source, used to name the
+* ACTUAL origin of a configured-empty key in the remediation. Only the source
+* KIND is ever surfaced — never a value. The self-host gate reads ground truth
+* (`dist/ssr/wrangler.json` `vars`), so every present key's source is `emitted`.
+*/
+function describeVarSource(source) {
+	switch (source?.kind) {
+		case "emitted": return "the built worker config (`dist/ssr/wrangler.json` `vars`)";
+		default: return "your build env configuration";
+	}
+}
+/**
+* The hard error for a REQUIRED key set to an EMPTY value (`FOO=""`) in
+* the effective build map. Values-free (key names + source KIND/filename only),
+* thrown ALWAYS — independent of whether the key exists as a remote secret. The
+* build bakes the empty string into plaintext `vars`, and wrangler 4.107 gives a
+* config var precedence over a same-named remote secret (`checkRemoteSecretsOverride`
+* in wrangler-dist/cli.js warns "… will replace these remote secrets with the
+* configuration values"), so shipping this would ship an empty value for a
+* required secret (overwriting a remote one if it exists). The fix is to REMOVE
+* the empty assignment, not `secret put`.
+*
+* The empty value can come from ANY of the four build layers, so the
+* remediation names each key's ACTUAL source (its {@link VarSource} provenance)
+* — a dotenv file / `void.json` `worker.vars` / root `wrangler.jsonc` `vars` —
+* instead of misdirecting the user to `.env` files.
+*/
+function emptyAssignmentError(keys, sources) {
+	const sorted = [...keys].sort((a, b) => a.localeCompare(b));
+	const lines = [
+		"Empty value for a required env var:",
+		...sorted.map((key) => `  • ${key} (from ${describeVarSource(sources[key])})`),
+		"",
+		"These keys are REQUIRED by your env schema but assigned an EMPTY value in the source noted above. The build bakes the empty value into the worker config as a plaintext var, and Cloudflare gives a config var precedence over any same-named remote secret — so the deploy would ship an empty value for a required secret (overwriting a remote secret if one exists).",
+		"",
+		"Remove the empty assignment (so a remote secret can take effect), or set a real value:",
+		...sorted.map((key) => `  • ${key} — from ${describeVarSource(sources[key])}`)
+	];
+	const safeReport = {
+		valid: false,
+		missing: sorted,
+		invalid: [],
+		values: /* @__PURE__ */ new Map()
+	};
+	return new SelfHostEnvValidationError(lines.join("\n"), safeReport);
+}
+/**
+* Actionable, values-free bootstrap guidance for the FIRST-DEPLOY case:
+* the worker does not exist yet, so its remote secrets can't be listed. Lists
+* the still-unsatisfied required key NAMES and the `wrangler secret put <NAME>`
+* command that bootstraps each on the draft worker (wrangler can `secret put`
+* before a worker's first deploy). Key names only — no values.
+*/
+function firstDeployMessage(missingKeys) {
+	const sorted = [...missingKeys].sort((a, b) => a.localeCompare(b));
+	const names = sorted.length > 0 ? sorted : ["<NAME>"];
+	return [
+		"This Worker has not been deployed yet, so its remote secrets could not be listed.",
+		"",
+		"Required production secrets still unset locally:",
+		...sorted.map((key) => `  • ${key}`),
+		"",
+		"Bootstrap them on the draft Worker before deploying:",
+		...names.map((key) => `  wrangler secret put ${key}`),
+		"",
+		"or add a value to .env / .env.production, then run the deploy again."
+	].join("\n");
+}
+/**
+* The exact `wrangler secret list` argv. Verified against the wrangler 4.107.0
+* bundle (`wrangler-dist/cli.js`, `secretListCommand`):
+*   - `secret list` accepts `--format` with choices `json`/`pretty`; `json` is
+*     the default AND suppresses the banner (`printBanner` is format==='pretty'),
+*     printing `JSON.stringify(secrets, null, '  ')` — an array of secret
+*     objects (each with a string `name`, per `fetchSecrets` →
+*     `GET /accounts/{id}/workers/scripts/{name}/secrets`). Pinned explicitly
+*     so a future default change can't silently switch us to `pretty`.
+*   - the worker name resolves from the config's `name` (`getLegacyScriptName`:
+*     `args.name ?? config.name` — we pass no `--name`, the pinned config is
+*     the single source of truth).
+*   - `-c <configPath>` (global `--config` alias) pins the ONE resolved config;
+*     `--env=` (explicit EMPTY environment) forces the top-level config env so
+*     a project dotenv exporting `CLOUDFLARE_ENV` can never reselect a named
+*     `env.*` block — same rationale as the provisioner's wranglerConfigArgs.
+*/
+function secretListArgs(configPath) {
+	return [
+		"secret",
+		"list",
+		"--format=json",
+		"-c",
+		configPath,
+		"--env="
+	];
+}
+/**
+* wrangler 4.107's `secret list` worker-not-found signal. When the worker has
+* never been deployed, `fetchSecrets` throws the API worker-not-found error and
+* `secretListCommand.handler` — ONLY when `isWorkerNotFoundError(e)` is true
+* (`e.code === 10007` WORKER_NOT_FOUND or `10090`
+* WORKER_LEGACY_ENVIRONMENT_NOT_FOUND, per wrangler-dist/cli.js) — rethrows a
+* `UserError` with this exact fixed diagnostic block:
+*
+*   Worker "<name>"[ (env: <env>)] not found.
+*
+*   If this is a new Worker, run `wrangler deploy` first to create it.
+*   Otherwise, check that the Worker name is correct and you're logged into the right account.
+*
+* The API code itself is caught and never printed, so the child's stderr
+* carries this MESSAGE, not `10007`/`10090`. Matching only the bare lead-in
+* `If this is a new Worker` misclassifies any unrelated status-1
+* diagnostic that merely contains that fragment. So we require the COMPLETE
+* structured block — the `… not found.` lead AND both fixed sentences of the
+* guidance — after normalizing whitespace (wrangler may wrap/indent the
+* multi-line UserError when it prints). The block carries no secret content, so
+* it survives `WRANGLER_LOG_SANITIZE=true`; the combined output is inspected
+* INTERNALLY only and never copied into any thrown error.
+*/
+function isWorkerNotFoundOutput(output) {
+	const normalized = output.replace(/\s+/g, " ");
+	return /Worker ".*?"(?: \(env: [^)]*\))? not found\./.test(normalized) && normalized.includes("If this is a new Worker, run `wrangler deploy` first to create it.") && normalized.includes("Otherwise, check that the Worker name is correct and you're logged into the right account.");
+}
+/**
+* Build the THROWN message for a wrangler-run failure from the structural
+* reason code + safe scalars ONLY. It NEVER interpolates `result.stderr`,
+* `result.stdout`, a spawn-error string, or a rejection message — those are
+* unconstrained (the child inherits `process.env`) and could embed an env
+* value. Where wrangler's own diagnostics would help, the message tells the
+* user to re-run wrangler themselves rather than echoing its output here.
+*/
+function secretListFailureMessage(reason, detail) {
+	const base = "env: `wrangler secret list` could not confirm the remote secrets";
+	switch (reason) {
+		case "spawn-error": return `${base} (reason: spawn-error) — the wrangler process could not be started. Check that wrangler is installed and the pinned config path is valid.`;
+		case "signal": return `${base} (reason: signal) — the process was terminated by ${detail.signal ?? "a signal"} before completing.`;
+		case "nonzero-exit": return `${base} (reason: nonzero-exit, status ${detail.exitCode ?? "unknown"}). Re-run \`wrangler secret list -c <config>\` to see wrangler’s own diagnostics.`;
+		case "malformed-output": return `${base} (reason: malformed-output) — \`wrangler secret list --format=json\` did not return the expected JSON array of secret objects.`;
+	}
+}
+/** Construct a values-free {@link SelfHostSecretListError} for a run failure. */
+function secretListError(reason, detail = {}) {
+	return new SelfHostSecretListError(secretListFailureMessage(reason, detail), reason, detail);
+}
+/**
+* Run `wrangler secret list` through the seam and parse STRICTLY, failing
+* CLOSED: any signal, spawn error, nonzero exit, unparseable stdout, or
+* malformed list member throws {@link SelfHostSecretListError}. A failure here
+* is never interpreted as "no secrets exist" — that would let a deploy proceed
+* with required secrets actually missing on the worker.
+*
+* A nonzero exit whose output carries wrangler's worker-not-found signal is a
+* DISTINCT, structured {@link SelfHostFirstDeployError} carrying the still
+* unsatisfied required `missingKeys` + `wrangler secret put` bootstrap guidance,
+* instead of the generic "list exited nonzero" dead end.
+*
+* Raw child output (stderr/stdout, spawn-error text, rejection messages)
+* is used ONLY internally: for worker-not-found classification the combined
+* output is matched to a boolean that never leaves this function. Every THROWN
+* error carries only a structural {@link SecretListFailureReason} code and safe
+* scalars (exit code / signal name), so no env value the child may have echoed
+* can reach the error's message, fields, or JSON — even under `VOID_ENV_UNMASK`.
+*/
+async function fetchSelfHostSecretNames(run, configPath, missingKeys) {
+	let result;
+	try {
+		result = await Promise.resolve(run(secretListArgs(configPath)));
+	} catch {
+		throw secretListError("spawn-error");
+	}
+	if (result.error != null && result.error !== "") throw secretListError("spawn-error");
+	if (result.signal != null) throw secretListError("signal", { signal: String(result.signal) });
+	if (typeof result.status !== "number" || result.status !== 0) {
+		const exitCode = typeof result.status === "number" ? result.status : void 0;
+		if (isWorkerNotFoundOutput(`${result.stdout}\n${result.stderr}`)) throw new SelfHostFirstDeployError(firstDeployMessage(missingKeys), missingKeys, exitCode);
+		throw secretListError("nonzero-exit", { exitCode });
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(result.stdout);
+	} catch {
+		throw secretListError("malformed-output");
+	}
+	if (!Array.isArray(parsed)) throw secretListError("malformed-output");
+	const names = [];
+	for (const member of parsed) {
+		const name = member !== null && typeof member === "object" && !Array.isArray(member) ? member.name : void 0;
+		if (typeof name !== "string" || name.length === 0) throw secretListError("malformed-output");
+		names.push(name);
+	}
+	return names;
+}
+/**
+* Hard timeout for one `wrangler secret list` invocation — same bound as the
+* provisioner's per-command timeout. A hung wrangler must never hang the
+* whole deploy preflight.
+*/
+const SECRET_LIST_TIMEOUT_MS = 12e4;
+/**
+* Default {@link RunSecretList}: resolves wrangler's REAL CLI entry
+* (`wrangler-dist/cli.js`, not the signal-swallowing `bin` wrapper) via
+* {@link resolveWranglerArgv} and spawns it ASYNC with `shell: false`, so every
+* argv element is passed literally (no shell → no metacharacter injection) and
+* the event loop stays free. A hard timeout SIGKILLs a hung child; the result
+* carries `{status, signal, error}` provenance so the caller fails closed on
+* anything but a clean exit 0.
+*
+* Deliberately simpler than the provisioner's runner: this is a ONE-SHOT
+* READ-ONLY query outside the provision lock — no lock heartbeat to protect,
+* nothing a lingering child could mutate — so the group-kill/quarantine
+* machinery is unnecessary. If the SIGKILL cannot be confirmed (close never
+* fires), a bounded fallback settles the call as a HARD failure anyway.
+*/
+function createDefaultSecretListRunner(root, options) {
+	const launcher = options?.launcher ?? resolveWranglerArgv(root);
+	const timeoutMs = options?.timeoutMs ?? SECRET_LIST_TIMEOUT_MS;
+	const [command, ...prefix] = launcher;
+	return (args) => new Promise((resolvePromise) => {
+		const child = spawn(command, [...prefix, ...args], {
+			cwd: root,
+			shell: false,
+			env: secretListEnv(options?.accountId),
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true
+		});
+		let stdout = "";
+		let stderr = "";
+		let settled = false;
+		let timedOut = false;
+		let killFallbackTimer;
+		child.stdout?.setEncoding("utf-8");
+		child.stderr?.setEncoding("utf-8");
+		child.stdout?.on("data", (chunk) => {
+			stdout += chunk;
+		});
+		child.stderr?.on("data", (chunk) => {
+			stderr += chunk;
+		});
+		const settle = (result) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(commandTimer);
+			clearTimeout(killFallbackTimer);
+			resolvePromise(result);
+		};
+		const timeoutNote = `env: wrangler secret list exceeded the ${timeoutMs}ms timeout`;
+		const commandTimer = setTimeout(() => {
+			timedOut = true;
+			try {
+				child.kill("SIGKILL");
+			} catch {}
+			killFallbackTimer = setTimeout(() => {
+				settle({
+					stdout,
+					stderr: [stderr, timeoutNote].filter(Boolean).join("\n"),
+					status: -1,
+					signal: "SIGKILL",
+					error: "timed out and termination could not be confirmed"
+				});
+			}, 5e3);
+		}, timeoutMs);
+		child.on("error", (error) => {
+			settle({
+				stdout,
+				stderr,
+				status: -1,
+				signal: null,
+				error: error.message
+			});
+		});
+		child.on("close", (code, signal) => {
+			settle({
+				stdout,
+				stderr: timedOut ? [stderr, timeoutNote].filter(Boolean).join("\n") : stderr,
+				status: typeof code === "number" ? code : -1,
+				signal: signal ?? (timedOut ? "SIGKILL" : null)
+			});
+		});
+	});
+}
+/**
+* Child env for the spawned `wrangler secret list`. Mirrors deploy.ts's
+* `buildEnv` (not imported — deploy.ts imports this module): the CF Access
+* service-token pair is for the Void platform API client only and must never
+* leak into a spawned wrangler. Pins `WRANGLER_LOG_SANITIZE=true` (same as the
+* provisioner) and the caller's account id when provided. Unlike the
+* provisioner's `provisionEnv`, ambient transport env (`CLOUDFLARE_API_BASE_URL`
+* etc.) is left untouched: this preflight has no second transport to keep in
+* lockstep, and scrubbing would silently redirect a staging/FedRAMP user's
+* `secret list` at the production endpoint.
+*
+* Windows environment keys are CASE-INSENSITIVE (same hazard `provisionEnv`
+* guards): an ambient mixed-case spelling (`Cloudflare_Account_Id`) could
+* shadow an exact-case pin, so on win32 every case-variant of a scrubbed or
+* pinned key is removed first. Exported (with a platform seam) for direct
+* unit testing of that case rule; production callers pass no platform.
+*/
+function secretListEnv(accountId, platform) {
+	const env = { ...process.env };
+	const caseInsensitive = (platform ?? process.platform) === "win32";
+	const scrub = (name) => {
+		if (!caseInsensitive) {
+			delete env[name];
+			return;
+		}
+		const lower = name.toLowerCase();
+		for (const key of Object.keys(env)) if (key.toLowerCase() === lower) delete env[key];
+	};
+	scrub("CF_ACCESS_CLIENT_ID");
+	scrub("CF_ACCESS_CLIENT_SECRET");
+	scrub("WRANGLER_LOG_SANITIZE");
+	env.WRANGLER_LOG_SANITIZE = "true";
+	if (accountId) {
+		scrub("CLOUDFLARE_ACCOUNT_ID");
+		env.CLOUDFLARE_ACCOUNT_ID = accountId;
+	}
+	return env;
+}
+//#endregion
+export { collectPlaintextVarWarningsFromVars as a, env_validation_exports as c, getDeployEnvDefaults as d, readEmittedWorkerVars as f, loadUserEnvFile as h, SelfHostSecretListError as i, fetchRemoteSecretNames as l, validateProdEnv as m, SelfHostFirstDeployError as n, deriveSelfHostEnvContextFromVars as o, selfHostSchemaFailureMessage as p, SelfHostSchemaError as r, dischargeSelfHostEnvContext as s, SelfHostEnvValidationError as t, formatEnvReport as u };