void 0.26.1 → 0.28.0

package/dist/env-validation-cE0zcmzO.mjs

@@ -0,0 +1,486 @@
+import { a as join, c as resolve, n as dirname } from "./dist-ipQi0Q8y.mjs";
+import { i as voidWarn } from "./log-vqY3pqwI.mjs";
+import { n as readGeneratedWranglerConfigFile } from "./generated-wrangler-config-DeWj5F9Y.mjs";
+import { n as scanWranglerDotenvKeys } from "./dotenv-CNazY3-w.mjs";
+import { a as isClientEnvKey, i as findReservedEnvKeys, n as LOCAL_ENV_FILE, o as loadLocalEnv, r as findLegacyEnvFiles, s as reservedEnvKeysMessage } from "./env-BJjULvL0.mjs";
+import { t as findEnvFile } from "./env-types-DS2_y4X8.mjs";
+import { t as loadUserEnvFile } from "./load-user-env-DD5qveNU.mjs";
+import { l as resolveCloudflareOperationArgv, n as decodeCloudflareOperationResult, r as encodeCloudflareOperation } from "./cloudflare-process-CeDWJRhj.mjs";
+import { existsSync, readFileSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { parseRootWranglerConfig, readWranglerTopLevelString } from "@void/deploy-cloudflare";
+//#region src/cli/env-validation.ts
+/** Env-schema validation for `void env check`, `void secret`, and both deploy paths. */
+/**
+* Validate plaintext while it is still available to `void secret put/sync`.
+* Existing remote values remain unreadable and are validated again at worker boot.
+*/
+async function validateSecretValues(root, entries) {
+	const envFile = findEnvFile(root);
+	if (!envFile) throw new Error("secret: env.ts is required before setting production values.");
+	const schema = (await loadSchema(envFile))?._getRegisteredSchema();
+	if (!schema) throw new Error("secret: env.ts did not register a schema with defineEnv().");
+	for (const { name, value } of entries) {
+		if (isClientEnvKey(name)) throw new Error(`secret: ${name} is client-exposed. Set it in the build shell or give it a schema default.`);
+		const validator = schema[name];
+		if (!validator) throw new Error(`secret: ${name} is not declared in env.ts.`);
+		const result = validator["~standard"].validate(value);
+		if ((result instanceof Promise ? await result : result).issues) throw new Error(`secret: ${name} failed env.ts validation.`);
+	}
+}
+/** Load the registered schema by importing the user's env.ts. */
+async function loadSchema(envFile) {
+	await loadUserEnvFile(envFile);
+	const mod = await import("./runtime/env-public.mjs");
+	if (!mod._hasRegisteredSchema()) return null;
+	return mod;
+}
+function emptyReport() {
+	return {
+		valid: true,
+		missing: [],
+		invalid: [],
+		values: /* @__PURE__ */ new Map()
+	};
+}
+/**
+* Validate local development against `.env` + the shell, or production
+* against the build shell + remote secret names. `.env` is never a
+* production source.
+*/
+async function validateProdEnv(root, options) {
+	const legacyFiles = findLegacyEnvFiles(root);
+	if (legacyFiles.length > 0) throw new Error(`env: only .env is supported for local development. Remove ${legacyFiles.join(", ")} and follow the env migration guide.`);
+	const reservedInDotenv = options.productionOnly ? [] : findReservedEnvKeys(scanWranglerDotenvKeys(join(root, LOCAL_ENV_FILE)));
+	if (reservedInDotenv.length > 0) throw new Error(`env: ${reservedEnvKeysMessage(".env", reservedInDotenv)}`);
+	const envFile = findEnvFile(root);
+	if (!envFile) return {
+		hasSchema: false,
+		report: emptyReport()
+	};
+	const mod = await loadSchema(envFile);
+	if (!mod) return {
+		hasSchema: false,
+		report: emptyReport()
+	};
+	const reservedInSchema = findReservedEnvKeys(Object.keys(mod._getRegisteredSchema() ?? {}));
+	if (reservedInSchema.length > 0) throw new Error(`env: ${reservedEnvKeysMessage("env.ts", reservedInSchema)}`);
+	const local = options.productionOnly ? {} : loadLocalEnv(root, { onWarn: (message) => voidWarn(message) });
+	const shell = options.productionOnly ? Object.fromEntries(Object.entries(process.env).filter(([key]) => isClientEnvKey(key))) : process.env;
+	const merged = {
+		...local,
+		...shell
+	};
+	const report = await mod.validateAllEnv(merged);
+	const remoteSet = new Set(options.remoteSecrets ?? []);
+	if (remoteSet.size > 0 && report.missing.length > 0) {
+		report.missing = report.missing.filter((key) => isClientEnvKey(key) || !remoteSet.has(key));
+		if (report.missing.length === 0 && report.invalid.length === 0) report.valid = true;
+	}
+	return {
+		hasSchema: true,
+		report
+	};
+}
+function formatEnvReport(report) {
+	const lines = [];
+	if (report.missing.length > 0) {
+		lines.push("Missing required env vars:");
+		for (const key of report.missing) lines.push(`  • ${key}`);
+	}
+	if (report.invalid.length > 0) {
+		if (lines.length > 0) lines.push("");
+		lines.push("Invalid env vars:");
+		for (const { key, messages } of report.invalid) lines.push(`  • ${key}: ${messages.join("; ")}`);
+	}
+	return lines.join("\n");
+}
+/** Convenience: fetch remote secret names from the platform. */
+async function fetchRemoteSecretNames(client, projectId) {
+	try {
+		return (await client.listSecrets(projectId)).map((s) => s.name);
+	} catch {
+		return [];
+	}
+}
+/**
+* A key is required when its validator rejects `undefined`. Do not judge by `""`:
+* a bare `z.string()` accepts it but is still required. Validators are user code,
+* so call this inside {@link withSchemaBoundary}.
+*/
+async function requiredSchemaKeys(schema) {
+	const required = /* @__PURE__ */ new Set();
+	for (const [key, validator] of Object.entries(schema)) {
+		const resultMaybe = validator["~standard"].validate(void 0);
+		if ((resultMaybe instanceof Promise ? await resultMaybe : resultMaybe).issues) required.add(key);
+	}
+	return required;
+}
+/**
+* The remote secret names could not be read, so the gate fails closed. Messages never
+* include provider output: the child inherits `process.env` and can echo a value.
+*/
+var SelfHostSecretListError = class extends Error {
+	name = "SelfHostSecretListError";
+};
+/** The Worker has not been deployed yet, so its secrets cannot be listed. */
+var SelfHostFirstDeployError = class extends SelfHostSecretListError {
+	name = "SelfHostFirstDeployError";
+};
+/** Required keys are missing or shipped values are invalid. */
+var SelfHostEnvValidationError = class extends Error {
+	name = "SelfHostEnvValidationError";
+};
+/** env.ts or a validator threw. The original error is dropped: it can embed a value. */
+var SelfHostSchemaError = class extends Error {
+	name = "SelfHostSchemaError";
+	reason;
+	constructor(message, reason) {
+		super(message);
+		this.reason = reason;
+	}
+};
+function selfHostSchemaFailureMessage(reason) {
+	switch (reason) {
+		case "schema-load-failed": return "env: the project env schema could not be loaded (reason: schema-load-failed). Check that env.ts evaluates without error, then run the deploy again.";
+		case "schema-validation-error": return "env: an env schema validator raised an error while checking production values (reason: schema-validation-error). Re-run the validator locally to see its own diagnostics.";
+	}
+}
+/** Replace any error from user code with a values-free {@link SelfHostSchemaError}. */
+async function withSchemaBoundary(reason, fn) {
+	try {
+		return await fn();
+	} catch {
+		throw new SelfHostSchemaError(selfHostSchemaFailureMessage(reason), reason);
+	}
+}
+/** Imports the user's env.ts, so callers run it in the env-schema probe child. */
+async function deriveSelfHostSchemaFacts(root) {
+	const envFile = findEnvFile(root);
+	if (envFile == null) return {
+		hasSchema: false,
+		serverKeys: [],
+		requiredKeys: []
+	};
+	const mod = await withSchemaBoundary("schema-load-failed", () => loadSchema(envFile));
+	if (!mod) return {
+		hasSchema: false,
+		serverKeys: [],
+		requiredKeys: []
+	};
+	const schema = mod._getRegisteredSchema() ?? {};
+	return {
+		hasSchema: true,
+		serverKeys: Object.keys(schema).filter((key) => !isClientEnvKey(key)),
+		requiredKeys: [...await withSchemaBoundary("schema-validation-error", () => requiredSchemaKeys(schema))].filter((key) => !isClientEnvKey(key))
+	};
+}
+/**
+* Build the gate context from the emitted vars. The caller has already rejected
+* server keys emitted as plaintext vars, so a required key here is only absent or not.
+*/
+function deriveSelfHostEnvContextFromVars(emittedVars, facts) {
+	if (!facts.hasSchema) return {
+		hasSchema: false,
+		absentRequired: [],
+		invalidKeys: []
+	};
+	return {
+		hasSchema: true,
+		absentRequired: facts.requiredKeys.filter((key) => !Object.hasOwn(emittedVars, key)),
+		invalidKeys: []
+	};
+}
+/**
+* Follow the CF plugin's deploy pointer (`.wrangler/deploy/config.json`) to the
+* generated config. Returns a fail-closed reason instead of throwing.
+*/
+function readGeneratedWranglerConfig(root) {
+	const deployConfigPath = join(root, ".wrangler", "deploy", "config.json");
+	if (!existsSync(deployConfigPath)) return {
+		ok: false,
+		reason: `the CF plugin's deploy pointer at ${deployConfigPath} was not written by the build.`
+	};
+	let redirectedPath;
+	try {
+		const parsed = JSON.parse(readFileSync(deployConfigPath, "utf-8"));
+		if (typeof parsed.configPath !== "string" || parsed.configPath.length === 0) return {
+			ok: false,
+			reason: `${deployConfigPath} has no "configPath" pointer.`
+		};
+		redirectedPath = resolve(dirname(deployConfigPath), parsed.configPath);
+	} catch {
+		return {
+			ok: false,
+			reason: `${deployConfigPath} is not valid JSON.`
+		};
+	}
+	if (!existsSync(redirectedPath)) return {
+		ok: false,
+		reason: `generated wrangler config ${redirectedPath} does not exist.`
+	};
+	try {
+		return {
+			ok: true,
+			config: readGeneratedWranglerConfigFile(redirectedPath)
+		};
+	} catch {
+		return {
+			ok: false,
+			reason: `generated wrangler config ${redirectedPath} is not valid JSON/JSONC.`
+		};
+	}
+}
+/** Read the `vars` the build emitted into the generated Worker config. */
+function readEmittedWorkerVars(root) {
+	const resolved = readGeneratedWranglerConfig(root);
+	if (!resolved.ok) return resolved;
+	const vars = resolved.config.vars;
+	if (vars === void 0) return {
+		ok: true,
+		vars: {}
+	};
+	if (vars === null || typeof vars !== "object" || Array.isArray(vars)) return {
+		ok: false,
+		reason: "the generated wrangler config has a malformed \"vars\" field (expected an object)."
+	};
+	return {
+		ok: true,
+		vars
+	};
+}
+/**
+* Validate the emitted vars and return the failing key names. `validateAllEnv` reports
+* a rejected `""` or `null` as missing, so a missing key that was shipped counts as
+* invalid; a key that was not shipped is left for the remote-secret check. Runs user
+* validators, so callers run it in the env-schema probe child.
+*/
+async function computeInvalidEmittedKeys(root, emittedVars) {
+	const envFile = findEnvFile(root);
+	if (envFile == null) return [];
+	const mod = await withSchemaBoundary("schema-load-failed", () => loadSchema(envFile));
+	if (!mod) return [];
+	const report = await withSchemaBoundary("schema-validation-error", () => mod.validateAllEnv(emittedVars));
+	const invalid = new Set(report.invalid.map((entry) => entry.key));
+	for (const key of report.missing) if (Object.hasOwn(emittedVars, key)) invalid.add(key);
+	return Array.from(invalid).sort((a, b) => a.localeCompare(b));
+}
+/**
+* Fail unless every required key is shipped or set as a remote secret, and no shipped
+* value is invalid. Lists remote secrets only when a required key is absent.
+*/
+async function dischargeSelfHostEnvContext(context, options) {
+	if (!context.hasSchema) return;
+	const remote = context.absentRequired.length > 0 ? new Set(await listSelfHostSecretNames(options, context.absentRequired)) : /* @__PURE__ */ new Set();
+	const missing = context.absentRequired.filter((key) => !remote.has(key));
+	if (missing.length > 0 || context.invalidKeys.length > 0) throw selfHostEnvError(missing, context.invalidKeys);
+}
+/**
+* Fail closed when the config pins a different account than the deploy, since the
+* list could then read another account's secrets. Returns the account to pin.
+*/
+function reconcileSelfHostAccount(configPath, requestedAccountId) {
+	const configAccountId = readWranglerTopLevelString(parseRootWranglerConfig(configPath), "account_id");
+	if (configAccountId && requestedAccountId && configAccountId !== requestedAccountId) throw new SelfHostSecretListError(`env: Cloudflare account mismatch — "${configPath}" pins account_id ${JSON.stringify(configAccountId)} but the deploy targets ${JSON.stringify(requestedAccountId)}. wrangler resolves the config's account_id before CLOUDFLARE_ACCOUNT_ID, so \`wrangler secret list\` would consult ${JSON.stringify(configAccountId)} while the deploy expects ${JSON.stringify(requestedAccountId)} — a same-named secret there could falsely pass this preflight. Reconcile them (correct or remove the config's account_id, or deploy to the pinned account) and retry.`);
+	return configAccountId ?? requestedAccountId;
+}
+/**
+* The list resolves the Worker from the config's `name`. If project code changed it
+* after the deploy pinned it, the list would read another Worker's secrets.
+*/
+function reconcileSelfHostWorkerName(configPath, pinnedWorkerName) {
+	const configName = readWranglerTopLevelString(parseRootWranglerConfig(configPath), "name");
+	if (configName && pinnedWorkerName && configName !== pinnedWorkerName) throw new SelfHostSecretListError(`env: Cloudflare worker name mismatch — "${configPath}" declares name ${JSON.stringify(configName)} but the deploy pinned ${JSON.stringify(pinnedWorkerName)}. wrangler resolves the worker name from the config's \`name\`, so \`wrangler secret list\` would consult ${JSON.stringify(configName)} while the deploy ships ${JSON.stringify(pinnedWorkerName)} — a same-named secret there could falsely pass this preflight. The config's name was changed after it was pinned; rebuild from a clean checkout, then rerun.`);
+}
+/** Shown instead of validator messages, which can embed the rejected value. */
+const SELF_HOST_INVALID_REASON = "failed schema validation";
+function selfHostEnvError(missingKeys, invalidKeys) {
+	const sortNames = (names) => [...names].sort((a, b) => a.localeCompare(b));
+	const missing = sortNames(missingKeys);
+	const invalid = sortNames(invalidKeys);
+	const lines = [];
+	if (missing.length > 0) {
+		lines.push("Missing required env vars:");
+		for (const key of missing) lines.push(`  • ${key}`);
+	}
+	if (invalid.length > 0) {
+		if (lines.length > 0) lines.push("");
+		lines.push("Invalid env vars:");
+		for (const key of invalid) lines.push(`  • ${key} (${SELF_HOST_INVALID_REASON})`);
+	}
+	if (missing.length > 0) lines.push("", "Set each missing production secret with `void secret put <NAME>`.");
+	return new SelfHostEnvValidationError(lines.join("\n"));
+}
+function firstDeployMessage(missingKeys) {
+	const sorted = [...missingKeys].sort((a, b) => a.localeCompare(b));
+	const names = sorted.length > 0 ? sorted : ["<NAME>"];
+	return [
+		"This Worker has not been deployed yet, so its remote secrets could not be listed.",
+		"",
+		"Required production secrets still unset locally:",
+		...sorted.map((key) => `  • ${key}`),
+		"",
+		"Bootstrap them on the draft Worker before deploying:",
+		...names.map((key) => `  void secret put ${key}`)
+	].join("\n");
+}
+function secretListOperation(configPath) {
+	return {
+		type: "secret.list",
+		configPath
+	};
+}
+function secretListFailureMessage(reason, detail) {
+	const base = "env: `wrangler secret list` could not confirm the remote secrets";
+	switch (reason) {
+		case "spawn-error": return `${base} (reason: spawn-error) — the wrangler process could not be started. Check that wrangler is installed and the pinned config path is valid.`;
+		case "signal": return `${base} (reason: signal) — the process was terminated by ${detail.signal ?? "a signal"} before completing.`;
+		case "nonzero-exit": return `${base} (reason: nonzero-exit, status ${detail.exitCode ?? "unknown"}). Run \`void secret list\` to retry through Void and see the Cloudflare diagnostics.`;
+		case "malformed-output": return `${base} (reason: malformed-output) — \`wrangler secret list --format=json\` did not return the expected JSON array of secret objects.`;
+	}
+}
+function secretListError(reason, detail = {}) {
+	return new SelfHostSecretListError(secretListFailureMessage(reason, detail));
+}
+/**
+* Run the list and parse it strictly: any failure throws rather than reading as
+* "no secrets". Runner and provider text is never surfaced, since it can embed values.
+*/
+async function fetchSelfHostSecretNames(run, configPath, missingKeys) {
+	let result;
+	try {
+		result = await Promise.resolve(run(secretListOperation(configPath)));
+	} catch {
+		throw secretListError("spawn-error");
+	}
+	if (result.error != null && result.error !== "") throw secretListError("spawn-error");
+	if (result.signal != null) throw secretListError("signal", { signal: String(result.signal) });
+	if (typeof result.status !== "number" || result.status !== 0) {
+		const exitCode = typeof result.status === "number" ? result.status : void 0;
+		if (Number.isSafeInteger(result.status) && result.status > 0 && ([10007, 10090].includes(result.errorCode ?? 0) || result.failure === "not-found")) throw new SelfHostFirstDeployError(firstDeployMessage(missingKeys));
+		throw secretListError("nonzero-exit", { exitCode });
+	}
+	const parsed = result.data;
+	if (!Array.isArray(parsed)) throw secretListError("malformed-output");
+	const names = [];
+	for (const member of parsed) {
+		const name = member !== null && typeof member === "object" && !Array.isArray(member) ? member.name : void 0;
+		if (typeof name !== "string" || name.length === 0) throw secretListError("malformed-output");
+		names.push(name);
+	}
+	return names;
+}
+/** List the pinned Worker's remote secret names after checking the config's identity. */
+async function listSelfHostSecretNames(options, missingKeys = []) {
+	reconcileSelfHostWorkerName(options.configPath, options.workerName);
+	const effectiveAccountId = reconcileSelfHostAccount(options.configPath, options.accountId);
+	return fetchSelfHostSecretNames(options.runWrangler ?? createDefaultSecretListRunner(options.root, { accountId: effectiveAccountId }), options.configPath, missingKeys);
+}
+/** A hung list must not hang the deploy. */
+const SECRET_LIST_TIMEOUT_MS = 12e4;
+/**
+* Default {@link RunSecretList}: spawn the Cloudflare operation process without a
+* shell. A timeout SIGKILLs a hung child; anything but a clean exit 0 fails closed.
+*/
+function createDefaultSecretListRunner(root, options) {
+	const launcher = options?.launcher ?? resolveCloudflareOperationArgv();
+	const timeoutMs = options?.timeoutMs ?? SECRET_LIST_TIMEOUT_MS;
+	const [command, ...prefix] = launcher;
+	return (args) => new Promise((resolvePromise) => {
+		const child = spawn(command, [...prefix, ...encodeCloudflareOperation(args)], {
+			cwd: root,
+			shell: false,
+			env: secretListEnv(options?.accountId),
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true
+		});
+		let stdout = "";
+		let stderr = "";
+		let settled = false;
+		let timedOut = false;
+		let killFallbackTimer;
+		child.stdout?.setEncoding("utf-8");
+		child.stderr?.setEncoding("utf-8");
+		child.stdout?.on("data", (chunk) => {
+			stdout += chunk;
+		});
+		child.stderr?.on("data", (chunk) => {
+			stderr += chunk;
+		});
+		const settle = (result) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(commandTimer);
+			clearTimeout(killFallbackTimer);
+			resolvePromise(decodeCloudflareOperationResult(result));
+		};
+		const timeoutNote = `env: wrangler secret list exceeded the ${timeoutMs}ms timeout`;
+		const commandTimer = setTimeout(() => {
+			timedOut = true;
+			try {
+				child.kill("SIGKILL");
+			} catch {}
+			killFallbackTimer = setTimeout(() => {
+				settle({
+					stdout,
+					stderr: [stderr, timeoutNote].filter(Boolean).join("\n"),
+					status: -1,
+					signal: "SIGKILL",
+					error: "timed out and termination could not be confirmed"
+				});
+			}, 5e3);
+		}, timeoutMs);
+		child.on("error", (error) => {
+			settle({
+				stdout,
+				stderr,
+				status: -1,
+				signal: null,
+				error: error.message
+			});
+		});
+		child.on("close", (code, signal) => {
+			settle({
+				stdout,
+				stderr: timedOut ? [stderr, timeoutNote].filter(Boolean).join("\n") : stderr,
+				status: typeof code === "number" ? code : -1,
+				signal: signal ?? (timedOut ? "SIGKILL" : null)
+			});
+		});
+	});
+}
+/**
+* Child env for the default runner: drops the CF Access credentials (Void API only),
+* forces sanitized logs, and pins the account. Ambient transport env such as
+* `CLOUDFLARE_API_BASE_URL` is kept so a staging or FedRAMP endpoint still applies.
+* Windows env keys are case-insensitive, so there every case variant is removed.
+*/
+function secretListEnv(accountId, platform) {
+	const env = { ...process.env };
+	const caseInsensitive = (platform ?? process.platform) === "win32";
+	const scrub = (name) => {
+		if (!caseInsensitive) {
+			delete env[name];
+			return;
+		}
+		const lower = name.toLowerCase();
+		for (const key of Object.keys(env)) if (key.toLowerCase() === lower) delete env[key];
+	};
+	scrub("CF_ACCESS_CLIENT_ID");
+	scrub("CF_ACCESS_CLIENT_SECRET");
+	scrub("VOID_ACCESS_CREDENTIALS");
+	scrub("VOID_ACCESS_ORIGIN");
+	scrub("WRANGLER_LOG_SANITIZE");
+	env.WRANGLER_LOG_SANITIZE = "true";
+	if (accountId) {
+		scrub("CLOUDFLARE_ACCOUNT_ID");
+		env.CLOUDFLARE_ACCOUNT_ID = accountId;
+	}
+	return env;
+}
+//#endregion
+export { validateSecretValues as _, computeInvalidEmittedKeys as a, deriveSelfHostSchemaFacts as c, formatEnvReport as d, listSelfHostSecretNames as f, validateProdEnv as g, selfHostSchemaFailureMessage as h, SelfHostSecretListError as i, dischargeSelfHostEnvContext as l, secretListEnv as m, SelfHostFirstDeployError as n, createDefaultSecretListRunner as o, readEmittedWorkerVars as p, SelfHostSchemaError as r, deriveSelfHostEnvContextFromVars as s, SelfHostEnvValidationError as t, fetchRemoteSecretNames as u };