void 0.27.0 → 0.28.0

package/dist/env-validation-Dxdx_5wo.mjs

@@ -1,951 +0,0 @@
-import { a as join, n as dirname, u as resolve } from "./dist-BVqXeR_h.mjs";
-import { i as voidWarn } from "./log-vqY3pqwI.mjs";
-import { n as scanWranglerDotenvKeys } from "./dotenv-BfU6eqFt.mjs";
-import { a as isClientEnvKey, i as findReservedEnvKeys, n as LOCAL_ENV_FILE, o as loadLocalEnv, r as findLegacyEnvFiles, s as reservedEnvKeysMessage } from "./env-BxocywBB.mjs";
-import { t as findEnvFile } from "./env-types-CwXgeMgL.mjs";
-import { l as resolveCloudflareOperationArgv, n as decodeCloudflareOperationResult, r as encodeCloudflareOperation } from "./cloudflare-process-2-TfIEzB.mjs";
-import { existsSync, readFileSync } from "node:fs";
-import { pathToFileURL } from "node:url";
-import { parse } from "jsonc-parser";
-import { spawn } from "node:child_process";
-//#region src/host/load-user-env.ts
-/**
-* Loader for the user's `env.ts`.
-*
-* Uses Node's native `import()` (type-stripping is on by default in the
-* supported Node version), so only relative imports and bare package
-* specifiers resolve. tsconfig path aliases (`@/foo`, `~/foo`) are NOT
-* supported — if the user writes one, we detect the resulting resolution
-* error and re-throw with guidance pointing at the offending specifier.
-*
-* Used by:
-*   - `plugin-env-schema.ts` (dev plugin, HMR re-imports)
-*   - `cli/env-validation.ts` (deploy + `void env check`)
-*
-* Side-effect contract: loading the file evaluates the user's `defineEnv`
-* call, which registers the schema in the singleton state in
-* `runtime/env-public.ts`. Callers read the result from there.
-*
-* Node-only (lives under `host/`). Must not be imported from anything
-* that ships in worker bundles.
-*/
-let loadCounter = 0;
-/** Returns the failed specifier from a Node module-resolution error, or `null`. */
-function extractFailedSpecifier(err) {
-	if (!(err instanceof Error)) return null;
-	const code = err.code;
-	if (code !== "ERR_MODULE_NOT_FOUND" && code !== "ERR_PACKAGE_PATH_NOT_EXPORTED") return null;
-	const match = /Cannot find (?:package|module) '([^']+)'/.exec(err.message);
-	return match ? match[1] ?? null : null;
-}
-/** A specifier is alias-shaped if it isn't relative, absolute, a node: URL, or a valid bare package name. */
-function looksLikeAlias(specifier) {
-	if (specifier.startsWith("./") || specifier.startsWith("../") || specifier.startsWith("/") || specifier.startsWith("node:") || specifier.startsWith("file:")) return false;
-	if (specifier.startsWith("@")) return !/^@[^/]+\/[^/]+/.test(specifier);
-	return specifier.startsWith("~") || specifier.startsWith("#");
-}
-/**
-* Load the user's env.ts via native `import()`. The URL gets a cache-busting
-* query param so HMR re-imports re-evaluate the file.
-*
-* On resolution failures, wraps the error with the source file path, and if
-* the failed specifier looks like a tsconfig path alias, appends guidance
-* explaining that env.ts doesn't resolve aliases.
-*/
-async function loadUserEnvFile(envFile) {
-	const url = pathToFileURL(envFile).href + `?t=${Date.now()}-${++loadCounter}`;
-	try {
-		await import(
-			/* @vite-ignore */
-			url
-);
-	} catch (err) {
-		const specifier = extractFailedSpecifier(err);
-		const base = `env: Failed to load '${envFile}': '${err.message}'.`;
-		if (specifier && looksLikeAlias(specifier)) throw new Error(`${base}\n\nHint: '${specifier}' looks like a tsconfig path alias. env.ts is loaded directly by Node and does not resolve tsconfig "paths" — use a relative import (e.g. "./shared/...") instead.`);
-		throw new Error(base);
-	}
-}
-//#endregion
-//#region src/cli/generated-wrangler-config.ts
-/** Parse a generated Wrangler JSON/JSONC config without accepting a partial parse. */
-function readGeneratedWranglerConfigFile(path) {
-	const raw = readFileSync(path, "utf8");
-	const content = raw.startsWith("") ? raw.slice(1) : raw;
-	const errors = [];
-	const parsed = parse(content, errors, { allowTrailingComma: true });
-	if (errors.length > 0 || parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Invalid Wrangler JSON/JSONC config.");
-	return parsed;
-}
-//#endregion
-//#region src/cli/env-validation.ts
-/**
-* Shared env-schema validation for CLI commands.
-*
-* Loads the user's `env.ts` (which calls `defineEnv` as a side effect),
-* validates the local `.env` or remote production-secret state, and
-* validates each declared key against the registered schema.
-*
-* Used by both `void deploy` (hard error on missing prod env) and
-* `void env check` (CI/pre-push validation).
-*/
-/**
-* Validate plaintext while it is still available to `void secret put/sync`.
-* Existing remote values remain unreadable and are validated again at worker boot.
-*/
-async function validateSecretValues(root, entries) {
-	const envFile = findEnvFile(root);
-	if (!envFile) throw new Error("secret: env.ts is required before setting production values.");
-	const schema = (await loadSchema(envFile))?._getRegisteredSchema();
-	if (!schema) throw new Error("secret: env.ts did not register a schema with defineEnv().");
-	for (const { name, value } of entries) {
-		if (isClientEnvKey(name)) throw new Error(`secret: ${name} is client-exposed. Set it in the build shell or give it a schema default.`);
-		const validator = schema[name];
-		if (!validator) throw new Error(`secret: ${name} is not declared in env.ts.`);
-		const result = validator["~standard"].validate(value);
-		if ((result instanceof Promise ? await result : result).issues) throw new Error(`secret: ${name} failed env.ts validation.`);
-	}
-}
-/** Load the registered schema by importing the user's env.ts. */
-async function loadSchema(envFile) {
-	await loadUserEnvFile(envFile);
-	const mod = await import("./runtime/env-public.mjs");
-	if (!mod._hasRegisteredSchema()) return null;
-	return mod;
-}
-function emptyReport() {
-	return {
-		valid: true,
-		missing: [],
-		invalid: [],
-		values: /* @__PURE__ */ new Map()
-	};
-}
-/**
-* Validate local development against `.env` + the shell, or production
-* against the build shell + remote secret names. `.env` is never a
-* production source.
-*/
-async function validateProdEnv(root, options) {
-	const legacyFiles = findLegacyEnvFiles(root);
-	if (legacyFiles.length > 0) throw new Error(`env: only .env is supported for local development. Remove ${legacyFiles.join(", ")} and follow the env migration guide.`);
-	const reservedInDotenv = options.productionOnly ? [] : findReservedEnvKeys(scanWranglerDotenvKeys(join(root, LOCAL_ENV_FILE)));
-	if (reservedInDotenv.length > 0) throw new Error(`env: ${reservedEnvKeysMessage(".env", reservedInDotenv)}`);
-	const envFile = findEnvFile(root);
-	if (!envFile) return {
-		hasSchema: false,
-		report: emptyReport()
-	};
-	const mod = await loadSchema(envFile);
-	if (!mod) return {
-		hasSchema: false,
-		report: emptyReport()
-	};
-	const reservedInSchema = findReservedEnvKeys(Object.keys(mod._getRegisteredSchema() ?? {}));
-	if (reservedInSchema.length > 0) throw new Error(`env: ${reservedEnvKeysMessage("env.ts", reservedInSchema)}`);
-	const local = options.productionOnly ? {} : loadLocalEnv(root, { onWarn: (message) => voidWarn(message) });
-	const shell = options.productionOnly ? Object.fromEntries(Object.entries(process.env).filter(([key]) => isClientEnvKey(key))) : process.env;
-	const merged = {
-		...local,
-		...shell
-	};
-	const report = await mod.validateAllEnv(merged);
-	const remoteSet = new Set(options.remoteSecrets ?? []);
-	if (remoteSet.size > 0 && report.missing.length > 0) {
-		report.missing = report.missing.filter((key) => isClientEnvKey(key) || !remoteSet.has(key));
-		if (report.missing.length === 0 && report.invalid.length === 0) report.valid = true;
-	}
-	return {
-		hasSchema: true,
-		report
-	};
-}
-/** Format an EnvValidationReport into a human-readable multi-line string. */
-function formatEnvReport(report) {
-	const lines = [];
-	if (report.missing.length > 0) {
-		lines.push("Missing required env vars:");
-		for (const key of report.missing) lines.push(`  • ${key}`);
-	}
-	if (report.invalid.length > 0) {
-		if (lines.length > 0) lines.push("");
-		lines.push("Invalid env vars:");
-		for (const { key, messages } of report.invalid) lines.push(`  • ${key}: ${messages.join("; ")}`);
-	}
-	return lines.join("\n");
-}
-/** Convenience: fetch remote secret names from the platform. */
-async function fetchRemoteSecretNames(client, projectId) {
-	try {
-		return (await client.listSecrets(projectId)).map((s) => s.name);
-	} catch {
-		return [];
-	}
-}
-/**
-* The required-key set, derived independently of how any validator treats
-* the empty string. A key is required iff its validator REJECTS the ABSENT
-* value (probe with `undefined`) — the SAME notion of "required" the managed
-* gate uses (a key lands in `validateAllEnv().missing` when its absent value
-* yields issues; `_getSchemaDefaults` probes `undefined` the exact same way).
-* Requiredness is NEVER inferred from whether `""` validates, so a schema that
-* ACCEPTS `""` (e.g. a bare Zod `z.string()`) is still correctly required.
-*
-* Runs the user's validators (arbitrary code), so callers MUST invoke this
-* inside {@link withSchemaBoundary}: a validator that THROWS synchronously or
-* REJECTS (async) on the probe surfaces as a values-free structural error, and
-* the awaited async probe can never float as an unhandled rejection carrying a
-* value. A NORMAL rejection (an `{ issues }` Result, not a thrown/rejected
-* error) simply marks the key required.
-*/
-async function requiredSchemaKeys(schema) {
-	const required = /* @__PURE__ */ new Set();
-	for (const [key, validator] of Object.entries(schema)) {
-		const resultMaybe = validator["~standard"].validate(void 0);
-		if ((resultMaybe instanceof Promise ? await resultMaybe : resultMaybe).issues) required.add(key);
-	}
-	return required;
-}
-/**
-* Hard failure fetching the remote secret list (spawn error, signal, nonzero
-* exit, timeout, or malformed output). DISTINCT from
-* {@link SelfHostEnvValidationError}: this means "we could not learn what
-* secrets exist" (fail closed), never "a required secret is missing".
-*
-* The message and attached fields are values-free by construction: only
-* the structural {@link SecretListFailureReason} code and safe scalars
-* ({@link SecretListFailureDetail}) are exposed. Raw wrangler output (stderr,
-* stdout, rejection/spawn-error text) is NEVER stored here, so no env value the
-* child may have echoed can reach `Error.message`, the `reason`/`detail`
-* fields, or their JSON serialization — even under `VOID_ENV_UNMASK`.
-*/
-var SelfHostSecretListError = class extends Error {
-	name = "SelfHostSecretListError";
-	/** Stable, values-free failure classification. */
-	reason;
-	/** Safe scalars (exit code / signal name) — never contain wrangler output. */
-	detail;
-	constructor(message, reason, detail = {}) {
-		super(message);
-		this.reason = reason;
-		this.detail = detail;
-	}
-};
-/**
-* FIRST-DEPLOY specialization of {@link SelfHostSecretListError}: the remote
-* secret list could not be fetched because the worker has NOT been deployed
-* yet. wrangler 4.131's `secret list` catches the API worker-not-found error
-* (codes 10007 / 10090 — `WORKER_NOT_FOUND` / `WORKER_LEGACY_ENVIRONMENT_NOT_FOUND`,
-* per `isWorkerNotFoundError` in wrangler-dist/cli.js) and rethrows a `UserError`
-* ("… not found. If this is a new Worker, run `wrangler deploy` first to create
-* it."), exiting nonzero. Rather than surface that circular "deploy first" dead
-* end, this carries the still-unsatisfied required key NAMES plus a
-* worker-not-found flag so the deploy orchestrator can render actionable
-* `wrangler secret put <NAME>` bootstrap guidance (wrangler can `secret put` to
-* a draft worker). Still a HARD, fail-closed error — subclassing keeps existing
-* `instanceof SelfHostSecretListError` fail-closed handling intact.
-*/
-var SelfHostFirstDeployError = class extends SelfHostSecretListError {
-	name = "SelfHostFirstDeployError";
-	/** Always true — distinguishes this from a generic list failure structurally. */
-	workerNotFound = true;
-	/** Required schema key NAMES still unsatisfied locally (values-free). */
-	missingKeys;
-	constructor(message, missingKeys, exitCode) {
-		super(message, "nonzero-exit", { exitCode });
-		this.missingKeys = missingKeys;
-	}
-};
-/**
-* The env schema is not satisfied for a self-host production deploy: required
-* keys are missing from remote worker secrets, values are invalid, or an EMPTY
-* plaintext assignment would
-* shadow a remote secret. The message and the attached `report` carry the
-* offending key NAMES plus stable, values-free reason codes only — never raw
-* input, never resolved values — so nothing on this path can echo a secret
-* (see {@link selfHostEnvError}), even under `VOID_ENV_UNMASK`.
-*/
-var SelfHostEnvValidationError = class extends Error {
-	name = "SelfHostEnvValidationError";
-	report;
-	constructor(message, report) {
-		super(message);
-		this.report = report;
-	}
-};
-/**
-* A self-host schema evaluation/validation step threw. DISTINCT from
-* {@link SelfHostEnvValidationError} (which means "a required value is missing
-* or invalid", carrying key names): this means the schema machinery itself
-* raised — env.ts failed to evaluate, or a validator threw/rejected rather than
-* returning issues. Values-free by construction: the original error's
-* message/stack/cause are DROPPED at the boundary and only the structural
-* {@link SelfHostSchemaFailureReason} code + fixed guidance survive, so no env
-* value the user's code may have embedded can reach the thrown error, even
-* under `VOID_ENV_UNMASK`.
-*/
-var SelfHostSchemaError = class extends Error {
-	name = "SelfHostSchemaError";
-	/** Stable, values-free failure classification. */
-	reason;
-	constructor(message, reason) {
-		super(message);
-		this.reason = reason;
-	}
-};
-/** The fixed, values-free message for each schema-failure reason. */
-function selfHostSchemaFailureMessage(reason) {
-	switch (reason) {
-		case "schema-load-failed": return "env: the project env schema could not be loaded (reason: schema-load-failed). Check that env.ts evaluates without error, then run the deploy again.";
-		case "schema-validation-error": return "env: an env schema validator raised an error while checking production values (reason: schema-validation-error). Re-run the validator locally to see its own diagnostics.";
-	}
-}
-/**
-* Values-free boundary around EVERY self-host schema evaluation +
-* validation step. `loadSchema` evaluates the user's env.ts and each
-* `validateProdEnv` / `validateAllEnv` pass runs the registered validators —
-* all arbitrary code that can throw/reject an error EMBEDDING an env value in
-* its message, stack, or cause (and `VOID_ENV_UNMASK` disables redaction). Any
-* throw/reject from `fn` is caught, its original message/stack/cause DROPPED,
-* and a fixed structural {@link SelfHostSchemaError} rethrown in its place. The
-* managed `validateProdEnv` itself is NEVER wrapped — only the self-host call
-* sites pass through here.
-*/
-async function withSchemaBoundary(reason, fn) {
-	try {
-		return await fn();
-	} catch {
-		throw new SelfHostSchemaError(selfHostSchemaFailureMessage(reason), reason);
-	}
-}
-/** A no-schema {@link SelfHostEnvContext} — nothing to gate. */
-function emptyEnvContext() {
-	return {
-		hasSchema: false,
-		presentEmptyRequired: [],
-		presentEmptySources: {},
-		absentRequired: [],
-		invalidKeys: []
-	};
-}
-/**
-* Derive the {@link SelfHostSchemaFacts} by importing the user's env.ts. Runs
-* ARBITRARY project code (env.ts evaluation) + the registered validators' probes,
-* so the caller MUST run this in an ISOLATED SUBPROCESS ({@link
-* ../cli/env-schema-probe.ts}) under a scrubbed env. Throws only a values-free
-* {@link SelfHostSchemaError} (via {@link withSchemaBoundary}) when the schema
-* machinery itself fails; the derived names/flags are returned as values-free data.
-*/
-async function deriveSelfHostSchemaFacts(root) {
-	const envFile = findEnvFile(root);
-	if (envFile == null) return {
-		hasSchema: false,
-		serverKeys: [],
-		requiredKeys: []
-	};
-	const mod = await withSchemaBoundary("schema-load-failed", () => loadSchema(envFile));
-	if (!mod) return {
-		hasSchema: false,
-		serverKeys: [],
-		requiredKeys: []
-	};
-	const schema = mod._getRegisteredSchema() ?? {};
-	return {
-		hasSchema: true,
-		serverKeys: Object.keys(schema).filter((key) => !isClientEnvKey(key)),
-		requiredKeys: [...await withSchemaBoundary("schema-validation-error", () => requiredSchemaKeys(schema))].filter((key) => !isClientEnvKey(key))
-	};
-}
-/**
-* Build the values-free {@link SelfHostEnvContext} from the REAL worker `vars` the
-* build emitted into `dist/ssr/wrangler.json` (ground truth — never a facsimile)
-* plus the env-insensitive {@link SelfHostSchemaFacts}. PURE (no project code, no
-* I/O): the parent runs this AFTER the build with the real emitted map, so the
-* gate reads exactly what the worker ships.
-*   - a required key present with an EMPTY value (`K=""` or `K=null`) → SHADOWS a
-*     same-named remote secret with an unusable value → fail closed ALWAYS
-*     (`presentEmptyRequired`). Both spellings are treated the same because the
-*     schema validators classify `null` and `""` as "missing" (not "invalid"), so
-*     they would otherwise slip past both the invalid-value probe and the absent
-*     fence while still shadowing the remote secret.
-*   - a required key ABSENT from the emitted vars → the only state a remote secret
-*     can discharge (`absentRequired`).
-* `invalidKeys` is populated separately from the value-validation probe (the parent
-* folds it in); a PRESENT, NON-EMPTY value that fails the schema validator lands there.
-*/
-function deriveSelfHostEnvContextFromVars(emittedVars, facts) {
-	if (!facts.hasSchema) return emptyEnvContext();
-	const isEmptyShadow = (value) => value === "" || value === null;
-	const presentEmptyRequired = facts.requiredKeys.filter((key) => Object.hasOwn(emittedVars, key) && isEmptyShadow(emittedVars[key]));
-	const absentRequired = facts.requiredKeys.filter((key) => !Object.hasOwn(emittedVars, key));
-	const presentEmptySources = {};
-	for (const key of presentEmptyRequired) presentEmptySources[key] = { kind: "emitted" };
-	return {
-		hasSchema: true,
-		presentEmptyRequired,
-		presentEmptySources,
-		absentRequired,
-		invalidKeys: []
-	};
-}
-/**
-* Follow the CF plugin's deploy pointer (`.wrangler/deploy/config.json` →
-* `configPath`) to the generated wrangler config the build emitted, and return it
-* parsed. Shared by the parent's ground-truth reads and the isolated
-* `validate-emitted` probe child, so both resolve the SAME artifact. Returns a
-* fail-closed reason (never throws) when the pointer/config is missing or malformed.
-*/
-function readGeneratedWranglerConfig(root) {
-	const deployConfigPath = join(root, ".wrangler", "deploy", "config.json");
-	if (!existsSync(deployConfigPath)) return {
-		ok: false,
-		reason: `the CF plugin's deploy pointer at ${deployConfigPath} was not written by the build.`
-	};
-	let redirectedPath;
-	try {
-		const parsed = JSON.parse(readFileSync(deployConfigPath, "utf-8"));
-		if (typeof parsed.configPath !== "string" || parsed.configPath.length === 0) return {
-			ok: false,
-			reason: `${deployConfigPath} has no "configPath" pointer.`
-		};
-		redirectedPath = resolve(dirname(deployConfigPath), parsed.configPath);
-	} catch {
-		return {
-			ok: false,
-			reason: `${deployConfigPath} is not valid JSON.`
-		};
-	}
-	if (!existsSync(redirectedPath)) return {
-		ok: false,
-		reason: `generated wrangler config ${redirectedPath} does not exist.`
-	};
-	try {
-		return {
-			ok: true,
-			config: readGeneratedWranglerConfigFile(redirectedPath)
-		};
-	} catch {
-		return {
-			ok: false,
-			reason: `generated wrangler config ${redirectedPath} is not valid JSON/JSONC.`
-		};
-	}
-}
-/**
-* Read the REAL `vars` map the build baked into `dist/ssr/wrangler.json` (ground
-* truth — the exact plaintext the worker ships). A missing `vars` field is an empty
-* map (a worker with no vars), not a failure; a missing/malformed artifact fails
-* closed. The self-host orchestrator reads this in the parent; the `validate-emitted`
-* probe reads it in the child to run the schema validators against those exact
-* values in isolation.
-*/
-function readEmittedWorkerVars(root) {
-	const resolved = readGeneratedWranglerConfig(root);
-	if (!resolved.ok) return resolved;
-	const vars = resolved.config.vars;
-	if (vars === void 0) return {
-		ok: true,
-		vars: {}
-	};
-	if (vars === null || typeof vars !== "object" || Array.isArray(vars)) return {
-		ok: false,
-		reason: "the generated wrangler config has a malformed \"vars\" field (expected an object)."
-	};
-	return {
-		ok: true,
-		vars
-	};
-}
-/**
-* Validate the REAL emitted worker `vars` against the registered schema's
-* validators and return the FAILING key NAMES only (values-free). A key FAILS iff
-* the validator REJECTS the value it was SHIPPED WITH — the UNION of:
-*   - `report.invalid` (a PRESENT, NON-EMPTY value the validator rejected), plus
-*   - the `report.missing` keys that are STILL PRESENT in `emittedVars` (the key
-*     exists in the emitted map with value `null`/`""`). `validateAllEnv` buckets a
-*     REJECTED `undefined`/`null`/`""` as "missing", not "invalid" (see
-*     `runtime/env-public.ts` — `isMissing = raw === undefined || raw === null || raw
-*     === ''`), so an OPTIONAL-with-validator key shipped as `""`/`null` (e.g.
-*     `z.url().optional()`, which rejects those but the required-empty fence in
-*     `deriveSelfHostEnvContextFromVars` — `requiredKeys` only — never covers) would
-*     otherwise slip EVERY gate and boot-reject the deployed worker.
-* A `report.missing` key ABSENT from `emittedVars` is NEVER counted: it is a
-* genuinely-unset REQUIRED secret that a same-named remote `wrangler secret list`
-* secret can still discharge, so it stays with the context's absent fence rather than
-* becoming a hard invalid. Runs the user's validators (arbitrary code), so the caller
-* MUST run this in the isolated {@link ../cli/env-schema-probe.ts} subprocess; a
-* validator that THROWS/REJECTS surfaces as a values-free {@link SelfHostSchemaError}
-* via {@link withSchemaBoundary}. NEVER reads `report.invalid[].messages` (which can
-* embed the offending value) — only the key names leave here.
-*/
-async function computeInvalidEmittedKeys(root, emittedVars) {
-	const envFile = findEnvFile(root);
-	if (envFile == null) return [];
-	const mod = await withSchemaBoundary("schema-load-failed", () => loadSchema(envFile));
-	if (!mod) return [];
-	const report = await withSchemaBoundary("schema-validation-error", () => mod.validateAllEnv(emittedVars));
-	const invalid = new Set(report.invalid.map((entry) => entry.key));
-	for (const key of report.missing) if (Object.hasOwn(emittedVars, key)) invalid.add(key);
-	return Array.from(invalid).sort((a, b) => a.localeCompare(b));
-}
-/** Build a values-free invalid {@link EnvValidationReport} from key names only. */
-function invalidEnvReport(missing, invalidKeys) {
-	return {
-		valid: false,
-		missing,
-		invalid: invalidKeys.map((key) => ({
-			key,
-			messages: [SELF_HOST_INVALID_REASON]
-		})),
-		values: /* @__PURE__ */ new Map()
-	};
-}
-/**
-* DISCHARGE half of the self-host gate — PURE parent work over the values-free
-* {@link SelfHostEnvContext}, plus at most one `wrangler secret list`. Runs NO
-* project code, NO `loadEnv`, and imports NO env.ts, so the parent never
-* evaluates arbitrary code with live credentials in scope. Applies three fences:
-*   - a PRESENT-EMPTY required key fails closed ALWAYS, before any wrangler spawn;
-*   - the pinned worker `name` is reconciled against the config's `name`, and the
-*     target account against the config's `account_id`, BOTH BEFORE `secret list`
-*     is spawned;
-*   - an ABSENT required key is discharged only by a same-named remote secret,
-*     else fails closed ({@link SelfHostFirstDeployError} on a not-yet-deployed
-*     worker, carrying the missing names + `wrangler secret put` guidance).
-*/
-async function dischargeSelfHostEnvContext(context, options) {
-	if (!context.hasSchema) return {
-		hasSchema: false,
-		remoteSecretNames: null
-	};
-	if (context.presentEmptyRequired.length > 0) throw emptyAssignmentError(context.presentEmptyRequired, context.presentEmptySources);
-	const invalidKeys = context.invalidKeys;
-	if (context.absentRequired.length === 0) {
-		if (invalidKeys.length > 0) throw selfHostEnvError(invalidEnvReport([], invalidKeys));
-		return {
-			hasSchema: true,
-			remoteSecretNames: null
-		};
-	}
-	const remoteSecretNames = await listSelfHostSecretNames(options, context.absentRequired);
-	const remoteSet = new Set(remoteSecretNames);
-	const stillMissing = context.absentRequired.filter((key) => !remoteSet.has(key));
-	if (stillMissing.length > 0 || invalidKeys.length > 0) throw selfHostEnvError(invalidEnvReport(stillMissing, invalidKeys));
-	return {
-		hasSchema: true,
-		remoteSecretNames
-	};
-}
-/**
-* Read the pinned config's top-level `account_id` and reconcile it with
-* the caller's requested account, mirroring the provisioner's account gate
-* (provision.ts `provisionCloudflareResourcesLocked`). wrangler 4.131 gives the
-* config's `account_id` PRECEDENCE over `CLOUDFLARE_ACCOUNT_ID`, so a real
-* config-vs-requested mismatch is a fail-closed error (thrown BEFORE any spawn).
-* Returns the ONE effective account to pin (config wins, else requested), or
-* undefined when neither is set (wrangler then resolves it as it normally would).
-*/
-function reconcileSelfHostAccount(configPath, requestedAccountId) {
-	const configAccountId = readConfigAccountId(configPath);
-	if (configAccountId && requestedAccountId && configAccountId !== requestedAccountId) throw new SelfHostSecretListError(`env: Cloudflare account mismatch — "${configPath}" pins account_id ${JSON.stringify(configAccountId)} but the deploy targets ${JSON.stringify(requestedAccountId)}. wrangler resolves the config's account_id before CLOUDFLARE_ACCOUNT_ID, so \`wrangler secret list\` would consult ${JSON.stringify(configAccountId)} while the deploy expects ${JSON.stringify(requestedAccountId)} — a same-named secret there could falsely pass this preflight. Reconcile them (correct or remove the config's account_id, or deploy to the pinned account) and retry.`, "account-mismatch");
-	return configAccountId ?? requestedAccountId;
-}
-/**
-* Reconcile the config's top-level worker `name` against the name the deploy PINNED
-* (deploy.ts step 5 writes `name: workerName` into the root config before the build).
-* `wrangler secret list` resolves the worker from the config's `name`
-* (`getLegacyScriptName`: `args.name ?? config.name` — we pass no `--name`), so a
-* config whose `name` was CHANGED after it was pinned would make the gate list secrets
-* for a DIFFERENT worker than the deploy ships — and a same-named secret there could
-* falsely pass this preflight while the pinned worker deploys WITHOUT it.
-*
-* Fires ONLY when the config actually declares a `name` that DIFFERS from a passed
-* pinned name (the same "both set and differ" guard as {@link reconcileSelfHostAccount})
-* — post-pin the config's `name` IS `workerName`, so a later divergence is exactly the
-* laundering signal, while an undefined pinned name or an undeclared config `name` never
-* trips a legitimate deploy. Thrown BEFORE any spawn (its message names worker names,
-* which are caller/config identifiers, never wrangler output).
-*/
-function reconcileSelfHostWorkerName(configPath, pinnedWorkerName) {
-	const configName = readConfigName(configPath);
-	if (configName && pinnedWorkerName && configName !== pinnedWorkerName) throw new SelfHostSecretListError(`env: Cloudflare worker name mismatch — "${configPath}" declares name ${JSON.stringify(configName)} but the deploy pinned ${JSON.stringify(pinnedWorkerName)}. wrangler resolves the worker name from the config's \`name\`, so \`wrangler secret list\` would consult ${JSON.stringify(configName)} while the deploy ships ${JSON.stringify(pinnedWorkerName)} — a same-named secret there could falsely pass this preflight. The config's name was changed after it was pinned; rebuild from a clean checkout, then rerun.`, "name-mismatch");
-}
-/** UTF-8 BOM, stripped before JSONC parsing (matches provision.ts readRootConfig). */
-const UTF8_BOM = "";
-/** True when `value` is a non-array object (JSONC-parsed config record). */
-function isConfigRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/**
-* Parse the resolved root wrangler config (`-c` target) into a top-level record,
-* mirroring the provisioner's `readRootConfig` (jsonc-parser, BOM-stripped,
-* trailing commas allowed). We read the SAME file the deploy pins via `-c` and
-* force top-level via `--env=`, so its top-level fields are exactly what
-* wrangler's `secret list` and the build both resolve. An unreadable/malformed
-* config yields undefined — callers then fall back safely (no account gate / no
-* root-wrangler var layer), and wrangler itself later fails on a truly broken
-* config with a distinct fail-closed {@link SelfHostSecretListError}.
-*/
-function parseRootConfig(configPath) {
-	if (!existsSync(configPath)) return;
-	let raw;
-	try {
-		raw = readFileSync(configPath, "utf-8");
-	} catch {
-		return;
-	}
-	const content = raw.startsWith(UTF8_BOM) ? raw.slice(1) : raw;
-	const errors = [];
-	const parsed = parse(content, errors, { allowTrailingComma: true });
-	if (errors.length > 0 || !isConfigRecord(parsed)) return;
-	return parsed;
-}
-/**
-* Read the top-level `account_id` string from the resolved wrangler config
-* (`-c` target). Same file/parse as {@link parseRootConfig}; this is exactly the
-* account wrangler's `secret list` will resolve. An unreadable/malformed config
-* yields undefined (no reconciliation gate).
-*/
-function readConfigAccountId(configPath) {
-	const parsed = parseRootConfig(configPath);
-	if (!parsed) return;
-	const accountId = parsed.account_id;
-	return typeof accountId === "string" && accountId.length > 0 ? accountId : void 0;
-}
-/**
-* Read the top-level `name` string from the resolved wrangler config (`-c` target).
-* Same file/parse as {@link parseRootConfig}; this is exactly the worker name
-* wrangler's `secret list` will resolve. An unreadable/malformed config or an
-* absent/empty `name` yields undefined (no reconciliation gate).
-*/
-function readConfigName(configPath) {
-	const parsed = parseRootConfig(configPath);
-	if (!parsed) return;
-	const name = parsed.name;
-	return typeof name === "string" && name.length > 0 ? name : void 0;
-}
-/**
-* Stable, values-free reason code stamped on every invalid key on the
-* self-host path. The raw validator message (e.g. `Expected a number, got
-* "not-a-number"`) can EMBED the offending input, and redaction preserves
-* benign values / can be disabled via `VOID_ENV_UNMASK`, so the message text is
-* never surfaced here — only the key name and this fixed code.
-*/
-const SELF_HOST_INVALID_REASON = "failed schema validation";
-/**
-* Build the hard error for an unsatisfied schema from KEY NAMES + the
-* stable {@link SELF_HOST_INVALID_REASON} code ONLY. It never reads
-* `report.invalid[].messages` (which can embed raw input) and never resolved
-* `report.values`, and it attaches a freshly-sanitized report of the same
-* shape — so neither the thrown message, the attached report, nor its JSON
-* serialization can echo a value, even with `VOID_ENV_UNMASK` set.
-*/
-function selfHostEnvError(report) {
-	const sortNames = (names) => [...names].sort((a, b) => a.localeCompare(b));
-	const missing = sortNames(report.missing);
-	const invalidKeys = sortNames(report.invalid.map((i) => i.key));
-	const lines = [];
-	if (missing.length > 0) {
-		lines.push("Missing required env vars:");
-		for (const key of missing) lines.push(`  • ${key}`);
-	}
-	if (invalidKeys.length > 0) {
-		if (lines.length > 0) lines.push("");
-		lines.push("Invalid env vars:");
-		for (const key of invalidKeys) lines.push(`  • ${key} (${SELF_HOST_INVALID_REASON})`);
-	}
-	if (missing.length > 0) lines.push("", "Set each missing production secret with `void secret put <NAME>`.");
-	const safeReport = {
-		valid: report.valid,
-		missing: report.missing,
-		invalid: report.invalid.map((i) => ({
-			key: i.key,
-			messages: [SELF_HOST_INVALID_REASON]
-		})),
-		values: /* @__PURE__ */ new Map()
-	};
-	return new SelfHostEnvValidationError(lines.join("\n"), safeReport);
-}
-/**
-* The values-free description of a var's WINNING source, used to name the
-* ACTUAL origin of a configured-empty key in the remediation. Only the source
-* KIND is ever surfaced — never a value. The self-host gate reads ground truth
-* (`dist/ssr/wrangler.json` `vars`), so every present key's source is `emitted`.
-*/
-function describeVarSource(source) {
-	switch (source?.kind) {
-		case "emitted": return "the built worker config (`dist/ssr/wrangler.json` `vars`)";
-		default: return "your build env configuration";
-	}
-}
-/**
-* The hard error for a REQUIRED key set to an EMPTY value (`FOO=""`) in
-* the effective build map. Values-free (key names + source KIND/filename only),
-* thrown ALWAYS — independent of whether the key exists as a remote secret. The
-* build bakes the empty string into plaintext `vars`, and wrangler 4.131 gives a
-* config var precedence over a same-named remote secret (`checkRemoteSecretsOverride`
-* in wrangler-dist/cli.js warns "… will replace these remote secrets with the
-* configuration values"), so shipping this would ship an empty value for a
-* required secret (overwriting a remote one if it exists). The remedy is to
-* REMOVE the empty assignment, not `secret put`. The remediation names each
-* key's source (its {@link VarSource} provenance).
-*/
-function emptyAssignmentError(keys, sources) {
-	const sorted = [...keys].sort((a, b) => a.localeCompare(b));
-	const lines = [
-		"Empty value for a required env var:",
-		...sorted.map((key) => `  • ${key} (from ${describeVarSource(sources[key])})`),
-		"",
-		"These keys are REQUIRED by your env schema but assigned an EMPTY value in the source noted above. The build bakes the empty value into the worker config as a plaintext var, and Cloudflare gives a config var precedence over any same-named remote secret — so the deploy would ship an empty value for a required secret (overwriting a remote secret if one exists).",
-		"",
-		"Remove the empty assignment (so a remote secret can take effect), or set a real value:",
-		...sorted.map((key) => `  • ${key} — from ${describeVarSource(sources[key])}`)
-	];
-	const safeReport = {
-		valid: false,
-		missing: sorted,
-		invalid: [],
-		values: /* @__PURE__ */ new Map()
-	};
-	return new SelfHostEnvValidationError(lines.join("\n"), safeReport);
-}
-/**
-* Actionable, values-free bootstrap guidance for the FIRST-DEPLOY case:
-* the worker does not exist yet, so its remote secrets can't be listed. Lists
-* the still-unsatisfied required key NAMES and the `wrangler secret put <NAME>`
-* command that bootstraps each on the draft worker (wrangler can `secret put`
-* before a worker's first deploy). Key names only — no values.
-*/
-function firstDeployMessage(missingKeys) {
-	const sorted = [...missingKeys].sort((a, b) => a.localeCompare(b));
-	const names = sorted.length > 0 ? sorted : ["<NAME>"];
-	return [
-		"This Worker has not been deployed yet, so its remote secrets could not be listed.",
-		"",
-		"Required production secrets still unset locally:",
-		...sorted.map((key) => `  • ${key}`),
-		"",
-		"Bootstrap them on the draft Worker before deploying:",
-		...names.map((key) => `  void secret put ${key}`)
-	].join("\n");
-}
-/** Select the generated top-level Worker config for structured secret discovery. */
-function secretListOperation(configPath) {
-	return {
-		type: "secret.list",
-		configPath
-	};
-}
-/**
-* Build the THROWN message for a wrangler-run failure from the structural
-* reason code + safe scalars ONLY. It NEVER interpolates `result.stderr`,
-* `result.stdout`, a spawn-error string, or a rejection message — those are
-* unconstrained (the child inherits `process.env`) and could embed an env
-* value. Where wrangler's own diagnostics would help, the message tells the
-* user to retry through Void rather than echoing its output here.
-*/
-function secretListFailureMessage(reason, detail) {
-	const base = "env: `wrangler secret list` could not confirm the remote secrets";
-	switch (reason) {
-		case "spawn-error": return `${base} (reason: spawn-error) — the wrangler process could not be started. Check that wrangler is installed and the pinned config path is valid.`;
-		case "signal": return `${base} (reason: signal) — the process was terminated by ${detail.signal ?? "a signal"} before completing.`;
-		case "nonzero-exit": return `${base} (reason: nonzero-exit, status ${detail.exitCode ?? "unknown"}). Run \`void secret list\` to retry through Void and see the Cloudflare diagnostics.`;
-		case "malformed-output": return `${base} (reason: malformed-output) — \`wrangler secret list --format=json\` did not return the expected JSON array of secret objects.`;
-	}
-}
-/** Construct a values-free {@link SelfHostSecretListError} for a run failure. */
-function secretListError(reason, detail = {}) {
-	return new SelfHostSecretListError(secretListFailureMessage(reason, detail), reason, detail);
-}
-/**
-* Run `wrangler secret list` through the seam and parse STRICTLY, failing
-* CLOSED: any signal, spawn error, nonzero exit, unparseable stdout, or
-* malformed list member throws {@link SelfHostSecretListError}. A failure here
-* is never interpreted as "no secrets exist" — that would let a deploy proceed
-* with required secrets actually missing on the worker.
-*
-* A completed failure with a typed missing-Worker code is a
-* DISTINCT, structured {@link SelfHostFirstDeployError} carrying the still
-* unsatisfied required `missingKeys` + `void secret put` bootstrap guidance,
-* instead of the generic "list exited nonzero" dead end.
-*
-* Raw child output (stderr/stdout, spawn-error text, rejection messages)
-* does not participate in missing-Worker classification. Every THROWN
-* error carries only a structural {@link SecretListFailureReason} code and safe
-* scalars (exit code / signal name), so no env value the child may have echoed
-* can reach the error's message, fields, or JSON — even under `VOID_ENV_UNMASK`.
-*/
-async function fetchSelfHostSecretNames(run, configPath, missingKeys) {
-	let result;
-	try {
-		result = await Promise.resolve(run(secretListOperation(configPath)));
-	} catch {
-		throw secretListError("spawn-error");
-	}
-	if (result.error != null && result.error !== "") throw secretListError("spawn-error");
-	if (result.signal != null) throw secretListError("signal", { signal: String(result.signal) });
-	if (typeof result.status !== "number" || result.status !== 0) {
-		const exitCode = typeof result.status === "number" ? result.status : void 0;
-		if (Number.isSafeInteger(result.status) && result.status > 0 && ([10007, 10090].includes(result.errorCode ?? 0) || result.failure === "not-found")) throw new SelfHostFirstDeployError(firstDeployMessage(missingKeys), missingKeys, exitCode);
-		throw secretListError("nonzero-exit", { exitCode });
-	}
-	const parsed = result.data;
-	if (!Array.isArray(parsed)) throw secretListError("malformed-output");
-	const names = [];
-	for (const member of parsed) {
-		const name = member !== null && typeof member === "object" && !Array.isArray(member) ? member.name : void 0;
-		if (typeof name !== "string" || name.length === 0) throw secretListError("malformed-output");
-		names.push(name);
-	}
-	return names;
-}
-/**
-* List one pinned self-host Worker's remote secret names. Reconciles the root
-* config's worker/account identity before spawning wrangler, then delegates to
-* the same strict, values-free parser used by the production env gate.
-*
-* Exported so deploy-owned secret provisioning can share the exact same
-* first-deploy and malformed-output classification without duplicating it.
-*/
-async function listSelfHostSecretNames(options, missingKeys = []) {
-	reconcileSelfHostWorkerName(options.configPath, options.workerName);
-	const effectiveAccountId = reconcileSelfHostAccount(options.configPath, options.accountId);
-	return fetchSelfHostSecretNames(options.runWrangler ?? createDefaultSecretListRunner(options.root, {
-		accountId: effectiveAccountId,
-		timeoutMs: options.timeoutMs
-	}), options.configPath, missingKeys);
-}
-/**
-* Hard timeout for one `wrangler secret list` invocation — same bound as the
-* provisioner's per-command timeout. A hung wrangler must never hang the
-* whole deploy preflight.
-*/
-const SECRET_LIST_TIMEOUT_MS = 12e4;
-/**
-* Default {@link RunSecretList}: resolves wrangler's REAL CLI entry
-* (`wrangler-dist/cli.js`, not the signal-swallowing `bin` wrapper) via
-* {@link resolveCloudflareOperationArgv} and spawns it ASYNC with `shell: false`, so every
-* argv element is passed literally (no shell → no metacharacter injection) and
-* the event loop stays free. A hard timeout SIGKILLs a hung child; the result
-* carries `{status, signal, error}` provenance so the caller fails closed on
-* anything but a clean exit 0.
-*
-* Deliberately simpler than the provisioner's runner: this is a ONE-SHOT
-* READ-ONLY query outside the provision lock — no lock heartbeat to protect,
-* nothing a lingering child could mutate — so the group-kill/quarantine
-* machinery is unnecessary. If the SIGKILL cannot be confirmed (close never
-* fires), a bounded fallback settles the call as a HARD failure anyway.
-*/
-function createDefaultSecretListRunner(root, options) {
-	const launcher = options?.launcher ?? resolveCloudflareOperationArgv(root);
-	const timeoutMs = options?.timeoutMs ?? SECRET_LIST_TIMEOUT_MS;
-	const [command, ...prefix] = launcher;
-	return (args) => new Promise((resolvePromise) => {
-		const child = spawn(command, [...prefix, ...encodeCloudflareOperation(args)], {
-			cwd: root,
-			shell: false,
-			env: secretListEnv(options?.accountId),
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			],
-			windowsHide: true
-		});
-		let stdout = "";
-		let stderr = "";
-		let settled = false;
-		let timedOut = false;
-		let killFallbackTimer;
-		child.stdout?.setEncoding("utf-8");
-		child.stderr?.setEncoding("utf-8");
-		child.stdout?.on("data", (chunk) => {
-			stdout += chunk;
-		});
-		child.stderr?.on("data", (chunk) => {
-			stderr += chunk;
-		});
-		const settle = (result) => {
-			if (settled) return;
-			settled = true;
-			clearTimeout(commandTimer);
-			clearTimeout(killFallbackTimer);
-			resolvePromise(decodeCloudflareOperationResult(result));
-		};
-		const timeoutNote = `env: wrangler secret list exceeded the ${timeoutMs}ms timeout`;
-		const commandTimer = setTimeout(() => {
-			timedOut = true;
-			try {
-				child.kill("SIGKILL");
-			} catch {}
-			killFallbackTimer = setTimeout(() => {
-				settle({
-					stdout,
-					stderr: [stderr, timeoutNote].filter(Boolean).join("\n"),
-					status: -1,
-					signal: "SIGKILL",
-					error: "timed out and termination could not be confirmed"
-				});
-			}, 5e3);
-		}, timeoutMs);
-		child.on("error", (error) => {
-			settle({
-				stdout,
-				stderr,
-				status: -1,
-				signal: null,
-				error: error.message
-			});
-		});
-		child.on("close", (code, signal) => {
-			settle({
-				stdout,
-				stderr: timedOut ? [stderr, timeoutNote].filter(Boolean).join("\n") : stderr,
-				status: typeof code === "number" ? code : -1,
-				signal: signal ?? (timedOut ? "SIGKILL" : null)
-			});
-		});
-	});
-}
-/**
-* Child env for the spawned `wrangler secret list`. Mirrors deploy.ts's
-* `buildEnv` (not imported — deploy.ts imports this module): the CF Access
-* service-token pair is for the Void platform API client only and must never
-* leak into a spawned wrangler. Pins `WRANGLER_LOG_SANITIZE=true` (same as the
-* provisioner) and the caller's account id when provided. Unlike the
-* provisioner's `provisionEnv`, ambient transport env (`CLOUDFLARE_API_BASE_URL`
-* etc.) is left untouched: this preflight has no second transport to keep in
-* lockstep, and scrubbing would silently redirect a staging/FedRAMP user's
-* `secret list` at the production endpoint.
-*
-* Windows environment keys are CASE-INSENSITIVE (same hazard `provisionEnv`
-* guards): an ambient mixed-case spelling (`Cloudflare_Account_Id`) could
-* shadow an exact-case pin, so on win32 every case-variant of a scrubbed or
-* pinned key is removed first. Exported (with a platform seam) for direct
-* unit testing of that case rule; production callers pass no platform.
-*/
-function secretListEnv(accountId, platform) {
-	const env = { ...process.env };
-	const caseInsensitive = (platform ?? process.platform) === "win32";
-	const scrub = (name) => {
-		if (!caseInsensitive) {
-			delete env[name];
-			return;
-		}
-		const lower = name.toLowerCase();
-		for (const key of Object.keys(env)) if (key.toLowerCase() === lower) delete env[key];
-	};
-	scrub("CF_ACCESS_CLIENT_ID");
-	scrub("CF_ACCESS_CLIENT_SECRET");
-	scrub("VOID_ACCESS_CREDENTIALS");
-	scrub("VOID_ACCESS_ORIGIN");
-	scrub("WRANGLER_LOG_SANITIZE");
-	env.WRANGLER_LOG_SANITIZE = "true";
-	if (accountId) {
-		scrub("CLOUDFLARE_ACCOUNT_ID");
-		env.CLOUDFLARE_ACCOUNT_ID = accountId;
-	}
-	return env;
-}
-//#endregion
-export { validateSecretValues as _, computeInvalidEmittedKeys as a, deriveSelfHostSchemaFacts as c, formatEnvReport as d, listSelfHostSecretNames as f, validateProdEnv as g, selfHostSchemaFailureMessage as h, SelfHostSecretListError as i, dischargeSelfHostEnvContext as l, secretListEnv as m, SelfHostFirstDeployError as n, createDefaultSecretListRunner as o, readEmittedWorkerVars as p, SelfHostSchemaError as r, deriveSelfHostEnvContextFromVars as s, SelfHostEnvValidationError as t, fetchRemoteSecretNames as u, readGeneratedWranglerConfigFile as v, loadUserEnvFile as y };