@vite-env/core 0.6.0 → 0.6.1

package/dist/leak.cjs

@@ -1,12 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 //#region src/leak.ts
 /**
-* Scans all client-destined chunks for literal values of server-only vars.
-* Fires in generateBundle() — Rolldown sequential hook, safe.
-*
-* Strategy: for each server-only key, check if its actual runtime value
-* appears as a literal string in any output chunk's source code.
-* Short/common values (< 8 chars) are skipped to avoid false positives.
+* Scans client-destined chunks for server-only var values appearing as quoted
+* string literals. Bare substring matches are ignored — only quoted literals
+* indicate a real bundler-inlined leak. Values < 8 chars are skipped.
 */
 function detectServerLeak(def, data, bundle, onSkipped) {
 	const serverKeys = new Set(Object.keys(def.server ?? {}));
@@ -15,10 +12,14 @@ function detectServerLeak(def, data, bundle, onSkipped) {
 	const serverSecrets = Object.entries(data).filter((entry) => serverKeys.has(entry[0]) && typeof entry[1] === "string" && entry[1].length >= 8);
 	const chunks = Object.entries(bundle).filter(([, chunk]) => chunk.type === "chunk" && !!chunk.code);
 	const leaks = [];
-	for (const [key, value] of serverSecrets) for (const [chunkName, chunk] of chunks) if (chunk.code.includes(value)) leaks.push({
-		key,
-		chunk: chunkName
-	});
+	for (const [key, value] of serverSecrets) {
+		const escaped = value.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
+		const pattern = new RegExp(`(["'\`])${escaped}\\1`);
+		for (const [chunkName, chunk] of chunks) if (pattern.test(chunk.code)) leaks.push({
+			key,
+			chunk: chunkName
+		});
+	}
 	return leaks;
 }
 //#endregion

package/dist/leak.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"leak.cjs","names":[],"sources":["../src/leak.ts"],"sourcesContent":["import type { AnyEnvDefinition } from \"./types\";\n\ntype LeakReport = {\n  key: string;\n  chunk: string;\n};\n\n/**\n * Scans all client-destined chunks for literal values of server-only vars.\n * Fires in generateBundle() — Rolldown sequential hook, safe.\n *\n * Strategy: for each server-only key, check if its actual runtime value\n * appears as a literal string in any output chunk's source code.\n * Short/common values (< 8 chars) are skipped to avoid false positives.\n */\nexport function detectServerLeak(\n  def: AnyEnvDefinition,\n  data: Record<string, unknown>,\n  bundle: Record<string, { type: string; code?: string }>,\n  onSkipped?: (keys: string[]) => void,\n): LeakReport[] {\n  const serverKeys = new Set(Object.keys(def.server ?? {}));\n\n  const shortSecrets = Object.entries(data).filter(\n    (entry): entry is [string, string] =>\n      serverKeys.has(entry[0]) && typeof entry[1] === \"string\" && entry[1].length < 8,\n  );\n\n  if (shortSecrets.length > 0 && onSkipped) {\n    onSkipped(shortSecrets.map(([k]) => k));\n  }\n\n  const serverSecrets = Object.entries(data).filter(\n    (entry): entry is [string, string] =>\n      serverKeys.has(entry[0]) && typeof entry[1] === \"string\" && entry[1].length >= 8,\n  );\n\n  const chunks = Object.entries(bundle).filter(\n    ([, chunk]) => chunk.type === \"chunk\" && !!chunk.code,\n  );\n\n  const leaks: LeakReport[] = [];\n  for (const [key, value] of serverSecrets) {\n    for (const [chunkName, chunk] of chunks) {\n      if (chunk.code!.includes(value)) {\n        leaks.push({ key, chunk: chunkName });\n      }\n    }\n  }\n\n  return leaks;\n}\n"],"mappings":";;;;;;;;;;AAeA,SAAgB,iBACd,KACA,MACA,QACA,WACc;CACd,MAAM,aAAa,IAAI,IAAI,OAAO,KAAK,IAAI,UAAU,EAAE,CAAC,CAAC;CAEzD,MAAM,eAAe,OAAO,QAAQ,KAAK,CAAC,QACvC,UACC,WAAW,IAAI,MAAM,GAAG,IAAI,OAAO,MAAM,OAAO,YAAY,MAAM,GAAG,SAAS,EACjF;AAED,KAAI,aAAa,SAAS,KAAK,UAC7B,WAAU,aAAa,KAAK,CAAC,OAAO,EAAE,CAAC;CAGzC,MAAM,gBAAgB,OAAO,QAAQ,KAAK,CAAC,QACxC,UACC,WAAW,IAAI,MAAM,GAAG,IAAI,OAAO,MAAM,OAAO,YAAY,MAAM,GAAG,UAAU,EAClF;CAED,MAAM,SAAS,OAAO,QAAQ,OAAO,CAAC,QACnC,GAAG,WAAW,MAAM,SAAS,WAAW,CAAC,CAAC,MAAM,KAClD;CAED,MAAM,QAAsB,EAAE;AAC9B,MAAK,MAAM,CAAC,KAAK,UAAU,cACzB,MAAK,MAAM,CAAC,WAAW,UAAU,OAC/B,KAAI,MAAM,KAAM,SAAS,MAAM,CAC7B,OAAM,KAAK;EAAE;EAAK,OAAO;EAAW,CAAC;AAK3C,QAAO"}
+{"version":3,"file":"leak.cjs","names":[],"sources":["../src/leak.ts"],"sourcesContent":["import type { AnyEnvDefinition } from \"./types\";\n\ntype LeakReport = {\n  key: string;\n  chunk: string;\n};\n\n/**\n * Scans client-destined chunks for server-only var values appearing as quoted\n * string literals. Bare substring matches are ignored — only quoted literals\n * indicate a real bundler-inlined leak. Values < 8 chars are skipped.\n */\nexport function detectServerLeak(\n  def: AnyEnvDefinition,\n  data: Record<string, unknown>,\n  bundle: Record<string, { type: string; code?: string }>,\n  onSkipped?: (keys: string[]) => void,\n): LeakReport[] {\n  const serverKeys = new Set(Object.keys(def.server ?? {}));\n\n  const shortSecrets = Object.entries(data).filter(\n    (entry): entry is [string, string] =>\n      serverKeys.has(entry[0]) && typeof entry[1] === \"string\" && entry[1].length < 8,\n  );\n\n  if (shortSecrets.length > 0 && onSkipped) {\n    onSkipped(shortSecrets.map(([k]) => k));\n  }\n\n  const serverSecrets = Object.entries(data).filter(\n    (entry): entry is [string, string] =>\n      serverKeys.has(entry[0]) && typeof entry[1] === \"string\" && entry[1].length >= 8,\n  );\n\n  const chunks = Object.entries(bundle).filter(\n    ([, chunk]) => chunk.type === \"chunk\" && !!chunk.code,\n  );\n\n  const leaks: LeakReport[] = [];\n  for (const [key, value] of serverSecrets) {\n    const escaped = value.replace(/[.*+?^${}()|[\\]\\\\]/g, String.raw`\\$&`);\n    const pattern = new RegExp(`([\"'\\`])${escaped}\\\\1`);\n    for (const [chunkName, chunk] of chunks) {\n      if (pattern.test(chunk.code!)) {\n        leaks.push({ key, chunk: chunkName });\n      }\n    }\n  }\n\n  return leaks;\n}\n"],"mappings":";;;;;;;AAYA,SAAgB,iBACd,KACA,MACA,QACA,WACc;CACd,MAAM,aAAa,IAAI,IAAI,OAAO,KAAK,IAAI,UAAU,EAAE,CAAC,CAAC;CAEzD,MAAM,eAAe,OAAO,QAAQ,KAAK,CAAC,QACvC,UACC,WAAW,IAAI,MAAM,GAAG,IAAI,OAAO,MAAM,OAAO,YAAY,MAAM,GAAG,SAAS,EACjF;AAED,KAAI,aAAa,SAAS,KAAK,UAC7B,WAAU,aAAa,KAAK,CAAC,OAAO,EAAE,CAAC;CAGzC,MAAM,gBAAgB,OAAO,QAAQ,KAAK,CAAC,QACxC,UACC,WAAW,IAAI,MAAM,GAAG,IAAI,OAAO,MAAM,OAAO,YAAY,MAAM,GAAG,UAAU,EAClF;CAED,MAAM,SAAS,OAAO,QAAQ,OAAO,CAAC,QACnC,GAAG,WAAW,MAAM,SAAS,WAAW,CAAC,CAAC,MAAM,KAClD;CAED,MAAM,QAAsB,EAAE;AAC9B,MAAK,MAAM,CAAC,KAAK,UAAU,eAAe;EACxC,MAAM,UAAU,MAAM,QAAQ,uBAAuB,OAAO,GAAG,MAAM;EACrE,MAAM,UAAU,IAAI,OAAO,WAAW,QAAQ,KAAK;AACnD,OAAK,MAAM,CAAC,WAAW,UAAU,OAC/B,KAAI,QAAQ,KAAK,MAAM,KAAM,CAC3B,OAAM,KAAK;GAAE;GAAK,OAAO;GAAW,CAAC;;AAK3C,QAAO"}

package/dist/leak.d.cts

@@ -6,12 +6,9 @@ type LeakReport = {
   chunk: string;
 };
 /**
- * Scans all client-destined chunks for literal values of server-only vars.
- * Fires in generateBundle() — Rolldown sequential hook, safe.
- *
- * Strategy: for each server-only key, check if its actual runtime value
- * appears as a literal string in any output chunk's source code.
- * Short/common values (< 8 chars) are skipped to avoid false positives.
+ * Scans client-destined chunks for server-only var values appearing as quoted
+ * string literals. Bare substring matches are ignored — only quoted literals
+ * indicate a real bundler-inlined leak. Values < 8 chars are skipped.
  */
 declare function detectServerLeak(def: AnyEnvDefinition, data: Record<string, unknown>, bundle: Record<string, {
   type: string;

package/dist/leak.d.mts

@@ -6,12 +6,9 @@ type LeakReport = {
   chunk: string;
 };
 /**
- * Scans all client-destined chunks for literal values of server-only vars.
- * Fires in generateBundle() — Rolldown sequential hook, safe.
- *
- * Strategy: for each server-only key, check if its actual runtime value
- * appears as a literal string in any output chunk's source code.
- * Short/common values (< 8 chars) are skipped to avoid false positives.
+ * Scans client-destined chunks for server-only var values appearing as quoted
+ * string literals. Bare substring matches are ignored — only quoted literals
+ * indicate a real bundler-inlined leak. Values < 8 chars are skipped.
  */
 declare function detectServerLeak(def: AnyEnvDefinition, data: Record<string, unknown>, bundle: Record<string, {
   type: string;

package/dist/leak.mjs

@@ -1,11 +1,8 @@
 //#region src/leak.ts
 /**
-* Scans all client-destined chunks for literal values of server-only vars.
-* Fires in generateBundle() — Rolldown sequential hook, safe.
-*
-* Strategy: for each server-only key, check if its actual runtime value
-* appears as a literal string in any output chunk's source code.
-* Short/common values (< 8 chars) are skipped to avoid false positives.
+* Scans client-destined chunks for server-only var values appearing as quoted
+* string literals. Bare substring matches are ignored — only quoted literals
+* indicate a real bundler-inlined leak. Values < 8 chars are skipped.
 */
 function detectServerLeak(def, data, bundle, onSkipped) {
 	const serverKeys = new Set(Object.keys(def.server ?? {}));
@@ -14,10 +11,14 @@ function detectServerLeak(def, data, bundle, onSkipped) {
 	const serverSecrets = Object.entries(data).filter((entry) => serverKeys.has(entry[0]) && typeof entry[1] === "string" && entry[1].length >= 8);
 	const chunks = Object.entries(bundle).filter(([, chunk]) => chunk.type === "chunk" && !!chunk.code);
 	const leaks = [];
-	for (const [key, value] of serverSecrets) for (const [chunkName, chunk] of chunks) if (chunk.code.includes(value)) leaks.push({
-		key,
-		chunk: chunkName
-	});
+	for (const [key, value] of serverSecrets) {
+		const escaped = value.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
+		const pattern = new RegExp(`(["'\`])${escaped}\\1`);
+		for (const [chunkName, chunk] of chunks) if (pattern.test(chunk.code)) leaks.push({
+			key,
+			chunk: chunkName
+		});
+	}
 	return leaks;
 }
 //#endregion

package/dist/leak.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"leak.mjs","names":[],"sources":["../src/leak.ts"],"sourcesContent":["import type { AnyEnvDefinition } from \"./types\";\n\ntype LeakReport = {\n  key: string;\n  chunk: string;\n};\n\n/**\n * Scans all client-destined chunks for literal values of server-only vars.\n * Fires in generateBundle() — Rolldown sequential hook, safe.\n *\n * Strategy: for each server-only key, check if its actual runtime value\n * appears as a literal string in any output chunk's source code.\n * Short/common values (< 8 chars) are skipped to avoid false positives.\n */\nexport function detectServerLeak(\n  def: AnyEnvDefinition,\n  data: Record<string, unknown>,\n  bundle: Record<string, { type: string; code?: string }>,\n  onSkipped?: (keys: string[]) => void,\n): LeakReport[] {\n  const serverKeys = new Set(Object.keys(def.server ?? {}));\n\n  const shortSecrets = Object.entries(data).filter(\n    (entry): entry is [string, string] =>\n      serverKeys.has(entry[0]) && typeof entry[1] === \"string\" && entry[1].length < 8,\n  );\n\n  if (shortSecrets.length > 0 && onSkipped) {\n    onSkipped(shortSecrets.map(([k]) => k));\n  }\n\n  const serverSecrets = Object.entries(data).filter(\n    (entry): entry is [string, string] =>\n      serverKeys.has(entry[0]) && typeof entry[1] === \"string\" && entry[1].length >= 8,\n  );\n\n  const chunks = Object.entries(bundle).filter(\n    ([, chunk]) => chunk.type === \"chunk\" && !!chunk.code,\n  );\n\n  const leaks: LeakReport[] = [];\n  for (const [key, value] of serverSecrets) {\n    for (const [chunkName, chunk] of chunks) {\n      if (chunk.code!.includes(value)) {\n        leaks.push({ key, chunk: chunkName });\n      }\n    }\n  }\n\n  return leaks;\n}\n"],"mappings":";;;;;;;;;AAeA,SAAgB,iBACd,KACA,MACA,QACA,WACc;CACd,MAAM,aAAa,IAAI,IAAI,OAAO,KAAK,IAAI,UAAU,EAAE,CAAC,CAAC;CAEzD,MAAM,eAAe,OAAO,QAAQ,KAAK,CAAC,QACvC,UACC,WAAW,IAAI,MAAM,GAAG,IAAI,OAAO,MAAM,OAAO,YAAY,MAAM,GAAG,SAAS,EACjF;AAED,KAAI,aAAa,SAAS,KAAK,UAC7B,WAAU,aAAa,KAAK,CAAC,OAAO,EAAE,CAAC;CAGzC,MAAM,gBAAgB,OAAO,QAAQ,KAAK,CAAC,QACxC,UACC,WAAW,IAAI,MAAM,GAAG,IAAI,OAAO,MAAM,OAAO,YAAY,MAAM,GAAG,UAAU,EAClF;CAED,MAAM,SAAS,OAAO,QAAQ,OAAO,CAAC,QACnC,GAAG,WAAW,MAAM,SAAS,WAAW,CAAC,CAAC,MAAM,KAClD;CAED,MAAM,QAAsB,EAAE;AAC9B,MAAK,MAAM,CAAC,KAAK,UAAU,cACzB,MAAK,MAAM,CAAC,WAAW,UAAU,OAC/B,KAAI,MAAM,KAAM,SAAS,MAAM,CAC7B,OAAM,KAAK;EAAE;EAAK,OAAO;EAAW,CAAC;AAK3C,QAAO"}
+{"version":3,"file":"leak.mjs","names":[],"sources":["../src/leak.ts"],"sourcesContent":["import type { AnyEnvDefinition } from \"./types\";\n\ntype LeakReport = {\n  key: string;\n  chunk: string;\n};\n\n/**\n * Scans client-destined chunks for server-only var values appearing as quoted\n * string literals. Bare substring matches are ignored — only quoted literals\n * indicate a real bundler-inlined leak. Values < 8 chars are skipped.\n */\nexport function detectServerLeak(\n  def: AnyEnvDefinition,\n  data: Record<string, unknown>,\n  bundle: Record<string, { type: string; code?: string }>,\n  onSkipped?: (keys: string[]) => void,\n): LeakReport[] {\n  const serverKeys = new Set(Object.keys(def.server ?? {}));\n\n  const shortSecrets = Object.entries(data).filter(\n    (entry): entry is [string, string] =>\n      serverKeys.has(entry[0]) && typeof entry[1] === \"string\" && entry[1].length < 8,\n  );\n\n  if (shortSecrets.length > 0 && onSkipped) {\n    onSkipped(shortSecrets.map(([k]) => k));\n  }\n\n  const serverSecrets = Object.entries(data).filter(\n    (entry): entry is [string, string] =>\n      serverKeys.has(entry[0]) && typeof entry[1] === \"string\" && entry[1].length >= 8,\n  );\n\n  const chunks = Object.entries(bundle).filter(\n    ([, chunk]) => chunk.type === \"chunk\" && !!chunk.code,\n  );\n\n  const leaks: LeakReport[] = [];\n  for (const [key, value] of serverSecrets) {\n    const escaped = value.replace(/[.*+?^${}()|[\\]\\\\]/g, String.raw`\\$&`);\n    const pattern = new RegExp(`([\"'\\`])${escaped}\\\\1`);\n    for (const [chunkName, chunk] of chunks) {\n      if (pattern.test(chunk.code!)) {\n        leaks.push({ key, chunk: chunkName });\n      }\n    }\n  }\n\n  return leaks;\n}\n"],"mappings":";;;;;;AAYA,SAAgB,iBACd,KACA,MACA,QACA,WACc;CACd,MAAM,aAAa,IAAI,IAAI,OAAO,KAAK,IAAI,UAAU,EAAE,CAAC,CAAC;CAEzD,MAAM,eAAe,OAAO,QAAQ,KAAK,CAAC,QACvC,UACC,WAAW,IAAI,MAAM,GAAG,IAAI,OAAO,MAAM,OAAO,YAAY,MAAM,GAAG,SAAS,EACjF;AAED,KAAI,aAAa,SAAS,KAAK,UAC7B,WAAU,aAAa,KAAK,CAAC,OAAO,EAAE,CAAC;CAGzC,MAAM,gBAAgB,OAAO,QAAQ,KAAK,CAAC,QACxC,UACC,WAAW,IAAI,MAAM,GAAG,IAAI,OAAO,MAAM,OAAO,YAAY,MAAM,GAAG,UAAU,EAClF;CAED,MAAM,SAAS,OAAO,QAAQ,OAAO,CAAC,QACnC,GAAG,WAAW,MAAM,SAAS,WAAW,CAAC,CAAC,MAAM,KAClD;CAED,MAAM,QAAsB,EAAE;AAC9B,MAAK,MAAM,CAAC,KAAK,UAAU,eAAe;EACxC,MAAM,UAAU,MAAM,QAAQ,uBAAuB,OAAO,GAAG,MAAM;EACrE,MAAM,UAAU,IAAI,OAAO,WAAW,QAAQ,KAAK;AACnD,OAAK,MAAM,CAAC,WAAW,UAAU,OAC/B,KAAI,QAAQ,KAAK,MAAM,KAAM,CAC3B,OAAM,KAAK;GAAE;GAAK,OAAO;GAAW,CAAC;;AAK3C,QAAO"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/vitejs/vite-plugin-registry/refs/heads/main/data/schema/extended-package-json.schema.json",
   "name": "@vite-env/core",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "The env.ts layer for Vite — define once, validate everywhere, import with types",
   "keywords": [
     "dotenv",
@@ -136,13 +136,14 @@
   "scripts": {
     "build": "tsdown",
     "dev": "tsdown --watch",
-    "prepack": "bun run build",
+    "postpack": "bun ../../scripts/rewrite-deps.ts restore",
+    "prepack": "bun run build && bun ../../scripts/rewrite-deps.ts rewrite",
     "test": "vitest run",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@standard-schema/spec": "catalog:",
-    "jiti": "catalog:"
+    "@standard-schema/spec": "^1.1.0",
+    "jiti": "^2.6.1"
   },
   "devDependencies": {
     "@types/node": "catalog:dev",