one 1.10.6 → 1.11.0

package/dist/cjs/cli/buildPageWorker.native.js.map

@@ -1 +1 @@
-{"version":3,"names":["import_worker_threads","require","import_workerImport","import_meta","_instanceof","left","right","Symbol","hasInstance","parentPort","console","error","process","exit","env","VXRN_REACT_19","VITE_ENVIRONMENT","NODE_ENV","buildPageFn","runWithAsyncLocalContextFn","loadUserOneOptionsFn","initialized","ensureImports","mod","workerImport","url","buildPage","mod1","runWithAsyncLocalContext","mod2","loadUserOneOptions","initializeWorker","oneOptions","globalThis","__vxrnPluginConfig__","on","msg","type","postMessage","id","result","args","serverEntry","path","relativeId","params","foundRoute","clientManifestEntry","staticDir","clientDir","builtMiddlewares","serverJsPath","preloads","allCSS","routePreloads","allCSSContents","criticalPreloads","deferredPreloads","useAfterLCP","useAfterLCPAggressive","err","Error","message","String","stack"],"sources":["../../../src/cli/buildPageWorker.ts"],"sourcesContent":[null],"mappings":"AAGA;;AAHA,IAAAA,qBAAA,GAAAC,OAAA;EAAAC,mBAAA,GAAAD,OAAA;AAMK,MAAAE,WAAA;AAML,SAAQC,WAAIA,CAAAC,IAAA,EAAAC,KAAgB;EAC5B,OAAQA,KAAI,mBAAmBC,MAAA,UAAAD,KAAA,CAAAC,MAAA,CAAAC,WAAA,MAAAF,KAAA,CAAAC,MAAA,CAAAC,WAAA,EAAAH,IAAA,IAAAA,IAAA,YAAAC,KAAA;AAE1B;AAKLN,qBAAiE,CAAAS,UAC7D,KAAAC,OAAA,CAAAC,KAAA,iCAIF,GAAAC,OACE,CAAAC,IAAA,IAAc;AAElBD,OAAA,CAAAE,GAAA,CAAAC,aAAe,MAAgB;AAC7BH,OAAA,CAAAE,GAAK,CAAAE,gBAKH;AAJkBJ,OAChB,CAAAE,GAAA,CAAAG,QAAA,KAAAL,OAAA,CAAAE,GAAA,CAAAG,QAAA;AAAA,IACAC,WAAA,GAAY;EAAAC,0BAAA;EAAAC,oBAAA;EAAAC,WAAA;AAAA,eAEIC,aAEfA,CAAA;EACe,IAChB,CAAAJ,WAAA;IACA,IAAAK,GAAA,SAAY,IAAArB,mBAAA,CAAAsB,YAAA,iBAAArB,WAAA,CAAAsB,GAAA;IACdP,WACiC,GAAAK,GAAA,CAAAG,SAAA;EAGf;EAChB,IACA,CAAAP,0BAAY;IACd,IAC2BQ,IAAA,aAAAzB,mBAEtB,CAAAsB,YAAA,6BAAArB,WAAA,CAAAsB,GAAA;IACLN,0BAAW,GAAAQ,IAAA,CAAAC,wBAAA;EAAA;EACe,IAC1B,CAAAR,oBAAoB;IACtB,IAAAS,IAAA,aAAA3B,mBAAA,CAAAsB,YAAA,wBAAArB,WAAA,CAAAsB,GAAA;IACFL,oBAAA,GAAAS,IAAA,CAAAC,kBAAA;EAEA;EACE,OAAI;IAGJJ,SAAQ,EAAAR,WAAA;IAGRU,wBAAW,EAAAT,0BACX;IACFW,kBAAA,EAAAV;EAEA;AACE;AAEE,eAAMW,gBACNA,CAAA;EACA,KAAAV,WAAA;IACF;QAAAS;MAAA,UAAAR,aAAA;MAAA;QAAAU;MAAA,UAAAF,kBAAA;IAEAG,UAAQ,CAAAC,oBAAS,GAAAF,UAAA,EAAAX,WAAA;EACf;AACE;AAGerB,qBACF,CAAAS,UAAA,CAAA0B,EAAA,4BAAAC,GAAA;EAAA,IAAAA,GACT,CAAAC,IAAI,KAAK;IAAA,MACTN,gBAAS,IAAA/B,qBAAA,CAAAS,UAAA,CAAA6B,WAAA;MAAAD,IACT,EAAI,WAAK;MAAAE,EACT,EAAAH,GAAI,CAAAG;IAAK;IACA;EACA;EACA,IAAAH,GACT,CAAAC,IAAI,KAAK,aACT;IAAS,IACT;QAAIX,SAAK;QAAAE;MAAA,UAAAN,aAAA;MAAAkB,MAAA,SAAAZ,wBAAA;QACT,OAAI,MAAKF,SAAA,CAAAU,GAAA,CAAAK,IAAA,CAAAC,WAAA,EAAAN,GAAA,CAAAK,IAAA,CAAAE,IAAA,EAAAP,GAAA,CAAAK,IAAA,CAAAG,UAAA,EAAAR,GAAA,CAAAK,IAAA,CAAAI,MAAA,EAAAT,GAAA,CAAAK,IAAA,CAAAK,UAAA,EAAAV,GAAA,CAAAK,IAAA,CAAAM,mBAAA,EAAAX,GAAA,CAAAK,IAAA,CAAAO,SAAA,EAAAZ,GAAA,CAAAK,IAAA,CAAAQ,SAAA,EAAAb,GAAA,CAAAK,IAAA,CAAAS,gBAAA,EAAAd,GAAA,CAAAK,IAAA,CAAAU,YAAA,EAAAf,GAAA,CAAAK,IAAA,CAAAW,QAAA,EAAAhB,GAAA,CAAAK,IAAA,CAAAY,MAAA,EAAAjB,GAAA,CAAAK,IAAA,CAAAa,aAAA,EAAAlB,GAAA,CAAAK,IAAA,CAAAc,cAAA,EAAAnB,GAAA,CAAAK,IAAA,CAAAe,gBAAA,EAAApB,GAAA,CAAAK,IAAA,CAAAgB,gBAAA,EAAArB,GAAA,CAAAK,IAAA,CAAAiB,WAAA,EAAAtB,GAAA,CAAAK,IAAA,CAAAkB,qBAAA;MAAA,EACT;IAAS3D,qBACA,CAAAS,UAAA,CAAA6B,WAAA;MACTD,IAAI,QAAK;MACTE,EAAA,EAAIH,GAAA,CAAAG,EAAK;MACTC;IAAS,EACT;EAAS,EACX,OACDoB,GAAA;IACD5D,qBAAA,CAAAS,UAAA,CAAA6B,WAAY;MACdD,IAAA,EAAS,OAAK;MACZE,EAAA,EAAAH,GAAA,CAAAG,EAAA;MACE5B,KAAA,EAAMP,WAAA,CAAAwD,GAAA,EAAAC,KAAA,IAAAD,GAAA,CAAAE,OAAA,GAAAC,MAAA,CAAAH,GAAA;MACNI,KAAI,EAAA5D,WAAI,CAAAwD,GAAA,EAAAC,KAAA,IAAAD,GAAA,CAAAI,KAAA;IAAA,EACR;EAAsD;AACZ;AAC3ChE,qBACH,CAAAS,UAAA,CAAA6B,WAAA;EAEHD,IAAA;AAGD","ignoreList":[]}
+{"version":3,"names":["import_worker_threads","require","import_workerImport","import_meta","_instanceof","left","right","Symbol","hasInstance","parentPort","console","error","process","exit","env","VXRN_REACT_19","VITE_ENVIRONMENT","NODE_ENV","buildPageFn","runWithAsyncLocalContextFn","initialized","ensureImports","mod","workerImport","url","buildPage","mod1","runWithAsyncLocalContext","initializeWorker","oneOptions","Error","globalThis","__vxrnPluginConfig__","on","msg","type","postMessage","id","result","args","serverEntry","path","relativeId","params","foundRoute","clientManifestEntry","staticDir","clientDir","builtMiddlewares","serverJsPath","preloads","allCSS","layoutCSS","routePreloads","allCSSContents","criticalPreloads","deferredPreloads","useAfterLCP","useAfterLCPAggressive","err","message","String","stack"],"sources":["../../../src/cli/buildPageWorker.ts"],"sourcesContent":[null],"mappings":"AAGA;;AAHA,IAAAA,qBAAA,GAAAC,OAAA;EAAAC,mBAAA,GAAAD,OAAA;AAMK,MAAAE,WAAA;AAML,SAAQC,WAAIA,CAAAC,IAAA,EAAAC,KAAgB;EAC5B,OAAQA,KAAI,mBAAmBC,MAAA,UAAAD,KAAA,CAAAC,MAAA,CAAAC,WAAA,MAAAF,KAAA,CAAAC,MAAA,CAAAC,WAAA,EAAAH,IAAA,IAAAA,IAAA,YAAAC,KAAA;AAE1B;AAKLN,qBAAiE,CAAAS,UAC7D,KAAAC,OAAA,CAAAC,KAAA,iCAGc,GAAAC,OAAA,CAAAC,IAAA;AAElBD,OAAA,CAAAE,GAAA,CAAAC,aAAe,MAAgB;AAC7BH,OAAA,CAAAE,GAAK,CAAAE,gBAKH;AAJkBJ,OAChB,CAAAE,GAAA,CAAAG,QAAA,KAAAL,OAAA,CAAAE,GAAA,CAAAG,QAAA;AAAA,IACAC,WAAA,GAAY;EAAAC,0BAAA;EAAAC,WAAA;AAAA,eAEIC,aAEfA,CAAA;EACe,IAChB,CAAAH,WAAA;IACA,IAAAI,GAAA,SAAY,IAAApB,mBAAA,CAAAqB,YAAA,iBAAApB,WAAA,CAAAqB,GAAA;IACdN,WACiC,GAAAI,GAAA,CAAAG,SAAA;EAE5B;EACM,IACX,CAAAN,0BAA0B;IAC5B,IAAAO,IAAA,aAAAxB,mBAAA,CAAAqB,YAAA,6BAAApB,WAAA,CAAAqB,GAAA;IACFL,0BAAA,GAAAO,IAAA,CAAAC,wBAAA;EAEA;EACE,OAAI;IACJF,SAAK,EAAAP,WAAA;IACHS,wBAAgB,EAAAR;EAElB;AACc;AAChB,eAAAS,iBAAAC,UAAA;EAEA,KAAAT,WAAA;IACE,IAAI,CAAAS,UAAa,EACf,MAAM,IAAAC,KAAA,kDACN;IACAC,UAAA,CAAAC,oBAAA,GAAAH,UAAA,EAAAT,WAAA;EACF;AAEA;AACEpB,qBAAI,CAAAS,UAAA,CAAAwB,EAAA,4BAAAC,GAAA;EACF,IAAAA,GAAA,CAAAC,IAAQ,WAAW;IAGJ,MACXP,gBAAS,CAAAM,GAAA,CAAAL,UAAA,GAAA7B,qBAAA,CAAAS,UAAA,CAAA2B,WAAA;MAAAD,IACT,EAAI,WAAK;MAAAE,EACT,EAAAH,GAAI,CAAAG;IAAK;IACA;EACA;EACA,IAAAH,GACT,CAAAC,IAAI,KAAK,aACT;IAAS,IACT;QAAIV,SAAK;QAAAE;MAAA,UAAAN,aAAA;MAAAiB,MAAA,SAAAX,wBAAA;QACT,OAAI,MAAKF,SAAA,CAAAS,GAAA,CAAAK,IAAA,CAAAC,WAAA,EAAAN,GAAA,CAAAK,IAAA,CAAAE,IAAA,EAAAP,GAAA,CAAAK,IAAA,CAAAG,UAAA,EAAAR,GAAA,CAAAK,IAAA,CAAAI,MAAA,EAAAT,GAAA,CAAAK,IAAA,CAAAK,UAAA,EAAAV,GAAA,CAAAK,IAAA,CAAAM,mBAAA,EAAAX,GAAA,CAAAK,IAAA,CAAAO,SAAA,EAAAZ,GAAA,CAAAK,IAAA,CAAAQ,SAAA,EAAAb,GAAA,CAAAK,IAAA,CAAAS,gBAAA,EAAAd,GAAA,CAAAK,IAAA,CAAAU,YAAA,EAAAf,GAAA,CAAAK,IAAA,CAAAW,QAAA,EAAAhB,GAAA,CAAAK,IAAA,CAAAY,MAAA,EAAAjB,GAAA,CAAAK,IAAA,CAAAa,SAAA,EAAAlB,GAAA,CAAAK,IAAA,CAAAc,aAAA,EAAAnB,GAAA,CAAAK,IAAA,CAAAe,cAAA,EAAApB,GAAA,CAAAK,IAAA,CAAAgB,gBAAA,EAAArB,GAAA,CAAAK,IAAA,CAAAiB,gBAAA,EAAAtB,GAAA,CAAAK,IAAA,CAAAkB,WAAA,EAAAvB,GAAA,CAAAK,IAAA,CAAAmB,qBAAA;MAAA,EACT;IAAS1D,qBACA,CAAAS,UAAA,CAAA2B,WAAA;MACTD,IAAI,QAAK;MACTE,EAAA,EAAIH,GAAA,CAAAG,EAAK;MACTC;IAAS,EACT;EAAS,SACLqB,GAAA,EAAK;IAAA3D,qBACA,CAAAS,UAAA,CAAA2B,WAAA;MACTD,IAAI,SAAK;MAEZE,EAAA,EAAAH,GAAA,CAAAG,EAAA;MACD1B,KAAA,EAAAP,WAAA,CAAAuD,GAAA,EAAA7B,KAAA,IAAA6B,GAAY,CAAAC,OAAA,GAAAC,MAAc,CAAAF,GAAM;MAClCG,KAAS,EAAA1D,WAAK,CAAAuD,GAAA,EAAA7B,KAAA,IAAA6B,GAAA,CAAAG,KAAA;IACZ;EAAwB;AAChB;AACE9D,qBACD,CAAAS,UAAe,CAAA2B,WAAY;EAAoBD,IAAA,EACtD;AAA0C","ignoreList":[]}

package/dist/cjs/cli/patch.cjs

@@ -40,10 +40,10 @@ async function run(args) {
   const {
       patch
     } = await import("vxrn"),
-    deps = (await (0, import_loadConfig.loadUserOneOptions)("build")).oneOptions.deps;
-  process.env.DEBUG && console.info("User deps:", Object.keys(deps || {})), await patch({
+    patches = (await (0, import_loadConfig.loadUserOneOptions)("build")).oneOptions.patches;
+  process.env.DEBUG && console.info("User patches:", Object.keys(patches || {})), await patch({
     root: process.cwd(),
-    deps,
+    deps: patches,
     force: args.force
   });
 }

package/dist/cjs/cli/patch.js

@@ -28,10 +28,10 @@ module.exports = __toCommonJS(patch_exports);
 var import_loadConfig = require("../vite/loadConfig");
 async function run(args) {
   process.env.IS_VXRN_CLI = "true";
-  const { patch } = await import("vxrn"), deps = (await (0, import_loadConfig.loadUserOneOptions)("build")).oneOptions.deps;
-  process.env.DEBUG && console.info("User deps:", Object.keys(deps || {})), await patch({
+  const { patch } = await import("vxrn"), patches = (await (0, import_loadConfig.loadUserOneOptions)("build")).oneOptions.patches;
+  process.env.DEBUG && console.info("User patches:", Object.keys(patches || {})), await patch({
     root: process.cwd(),
-    deps,
+    deps: patches,
     force: args.force
   });
 }

package/dist/cjs/cli/patch.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../src/cli/patch.ts"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,wBAAmC;AAEnC,eAAsB,IAAI,MAA2B;AACnD,UAAQ,IAAI,cAAc;AAC1B,QAAM,EAAE,MAAM,IAAI,MAAM,OAAO,MAAM,GAG/B,QADU,UAAM,sCAAmB,OAAO,GAC3B,WAAW;AAEhC,EAAI,QAAQ,IAAI,SACd,QAAQ,KAAK,cAAc,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAGpD,MAAM,MAAM;AAAA,IACV,MAAM,QAAQ,IAAI;AAAA,IAClB;AAAA,IACA,OAAO,KAAK;AAAA,EACd,CAAwB;AAC1B;",
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,wBAAmC;AAEnC,eAAsB,IAAI,MAA2B;AACnD,UAAQ,IAAI,cAAc;AAC1B,QAAM,EAAE,MAAM,IAAI,MAAM,OAAO,MAAM,GAG/B,WADU,UAAM,sCAAmB,OAAO,GACxB,WAAW;AAEnC,EAAI,QAAQ,IAAI,SACd,QAAQ,KAAK,iBAAiB,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,GAG1D,MAAM,MAAM;AAAA,IACV,MAAM,QAAQ,IAAI;AAAA,IAClB,MAAM;AAAA,IACN,OAAO,KAAK;AAAA,EACd,CAAwB;AAC1B;",
   "names": []
 }

package/dist/cjs/cli/patch.native.js

@@ -43,10 +43,10 @@ async function run(args) {
       patch
     } = await import("vxrn"),
     options = await (0, import_loadConfig.loadUserOneOptions)("build"),
-    deps = options.oneOptions.deps;
-  process.env.DEBUG && console.info("User deps:", Object.keys(deps || {})), await patch({
+    patches = options.oneOptions.patches;
+  process.env.DEBUG && console.info("User patches:", Object.keys(patches || {})), await patch({
     root: process.cwd(),
-    deps,
+    deps: patches,
     force: args.force
   });
 }

package/dist/cjs/cli/patch.native.js.map

@@ -1 +1 @@
-{"version":3,"names":["__toCommonJS","mod","__copyProps","__defProp","value","patch_exports","__export","run","module","exports","import_loadConfig","require","args","process","env","IS_VXRN_CLI","patch","options","loadUserOneOptions","deps","oneOptions","DEBUG","console","info","Object","keys","root","cwd","force"],"sources":["../../../src/cli/patch.ts"],"sourcesContent":[null],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAA;EAAAA,YAAA,GAAAC,GAAA,IAAAC,WAAA,CAAAC,SAAA;IAAAC,KAAA;EAAA,IAAAH,GAAA;AAAA,IAAAI,aAAA;AAAAC,QAAA,CAAAD,aAAA;EAAAE,GAAA,EAAAA,CAAA,KAAAA;AAAA;AACAC,MAAA,CAAAC,OAAA,GAAAT,YAAmC,CAAAK,aAAA;AAEnC,IAAAK,iBAA0B,GAAAC,OAA2B;AACnD,eAAYJ,IAAAK,IAAA;EACZC,OAAM,CAAEC,GAAA,CAAAC,WAAU,GAAM,MAAO;EAK3B;MAAAC;IAAY,UACd,OAAQ,MAAK;IAAAC,OAAA,GAAc,OAAO,GAAAP,iBAGpC,CAAAQ,kBAAY;IAAAC,IAAA,GAAAF,OAAA,CAAAG,UAAA,CAAAD,IAAA;EAAAN,OACV,CAAMC,GAAA,CAAAO,KAAQ,IAAIC,OAAA,CAAAC,IAAA,eAAAC,MAAA,CAAAC,IAAA,CAAAN,IAAA,gBAAAH,KAAA;IAClBU,IAAA,EAAAb,OAAA,CAAAc,GAAA;IACAR,IAAA;IACsBS,KAAA,EAAAhB,IAAA,CAAAgB;EAC1B","ignoreList":[]}
+{"version":3,"names":["__toCommonJS","mod","__copyProps","__defProp","value","patch_exports","__export","run","module","exports","import_loadConfig","require","args","process","env","IS_VXRN_CLI","patch","options","loadUserOneOptions","patches","oneOptions","DEBUG","console","info","Object","keys","root","cwd","deps","force"],"sources":["../../../src/cli/patch.ts"],"sourcesContent":[null],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAA;EAAAA,YAAA,GAAAC,GAAA,IAAAC,WAAA,CAAAC,SAAA;IAAAC,KAAA;EAAA,IAAAH,GAAA;AAAA,IAAAI,aAAA;AAAAC,QAAA,CAAAD,aAAA;EAAAE,GAAA,EAAAA,CAAA,KAAAA;AAAA;AACAC,MAAA,CAAAC,OAAA,GAAAT,YAAmC,CAAAK,aAAA;AAEnC,IAAAK,iBAA0B,GAAAC,OAA2B;AACnD,eAAYJ,IAAAK,IAAA;EACZC,OAAM,CAAEC,GAAA,CAAAC,WAAU,GAAM,MAAO;EAK3B;MAAAC;IAAY,UACd,OAAQ,MAAK;IAAAC,OAAA,SAAiB,IAAOP,iBAAiB,CAACQ,kBAG7C;IAAAC,OAAA,GAAAF,OAAA,CAAAG,UAAA,CAAAD,OAAA;EAAAN,OACV,CAAMC,GAAA,CAAAO,KAAQ,IAAIC,OAAA,CAAAC,IAAA,kBAAAC,MAAA,CAAAC,IAAA,CAAAN,OAAA,gBAAAH,KAAA;IAClBU,IAAA,EAAMb,OAAA,CAAAc,GAAA;IACNC,IAAA,EAAAT,OAAY;IACUU,KAAA,EAAAjB,IAAA,CAAAiB;EAC1B","ignoreList":[]}

package/dist/cjs/cli/securityScan.cjs

@@ -0,0 +1,123 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+    for (var name in all) __defProp(target, name, {
+      get: all[name],
+      enumerable: !0
+    });
+  },
+  __copyProps = (to, from, except, desc) => {
+    if (from && typeof from == "object" || typeof from == "function") for (let key of __getOwnPropNames(from)) !__hasOwnProp.call(to, key) && key !== except && __defProp(to, key, {
+      get: () => from[key],
+      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+    });
+    return to;
+  };
+var __toCommonJS = mod => __copyProps(__defProp({}, "__esModule", {
+  value: !0
+}), mod);
+var securityScan_exports = {};
+__export(securityScan_exports, {
+  runSecurityScan: () => runSecurityScan,
+  scanBundleForSecrets: () => scanBundleForSecrets
+});
+module.exports = __toCommonJS(securityScan_exports);
+var import_promises = require("node:fs/promises"),
+  import_node_path = require("node:path");
+const SECRET_PATTERNS = [
+  // api tokens / keys with known prefixes
+  ["Anthropic API key", /sk-ant-[A-Za-z0-9_-]{20,}/g], ["OpenAI API key", /sk-proj-[A-Za-z0-9_-]{20,}/g], ["Stripe secret key", /sk_live_[A-Za-z0-9]{20,}/g], ["Stripe webhook secret", /whsec_[A-Za-z0-9]{20,}/g], ["GitHub token", /gh[ps]_[A-Za-z0-9]{36,}/g], ["GitHub PAT", /github_pat_[A-Za-z0-9_]{20,}/g], ["AWS access key", /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g], ["Postmark server token", /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/g], ["Bearer token assignment", /["']Bearer\s+[A-Za-z0-9_.-]{20,}["']/g], ["Generic secret assignment", /(?:secret|password|api_key|apikey)\s*[:=]\s*["'][A-Za-z0-9_-]{16,}["']/gi],
+  // known env var names that should never be inlined
+  ["BETTER_AUTH_SECRET value", /BETTER_AUTH_SECRET["']\s*[:=]\s*["'][^"']+["']/g], ["POSTMARK_SERVER_TOKEN value", /POSTMARK_SERVER_TOKEN["']\s*[:=]\s*["'][^"']+["']/g], ["ANTHROPIC_API_KEY value", /ANTHROPIC_API_KEY["']\s*[:=]\s*["'][^"']+["']/g]],
+  SAFE_UUIDS = /* @__PURE__ */new Set(["00000000-0000-0000-0000-000000000000", "09259e3b-7be8-46f6-9801-106bf1866e1c",
+  // WebRTC SDP
+  "4ad15a19-80e2-4105-bf43-48039fd2963e"
+  // WebRTC SDP
+  ]),
+  BUILTIN_SAFE_PATTERNS = [/sk_live_your_/, /sk_live_your_key/, /rk_\w+_\w+/,
+  // tamagui theme tokens
+  /sk_all_element/,
+  // DOM property names
+  /sk_personal_data/
+  // analytics property names
+  ];
+function createSafeMatcher(userPatterns) {
+  const safeStrings = new Set(SAFE_UUIDS),
+    safeRegexes = [...BUILTIN_SAFE_PATTERNS];
+  if (userPatterns) for (const p of userPatterns) typeof p == "string" ? safeStrings.add(p) : safeRegexes.push(p);
+  return match => safeStrings.has(match) ? !0 : safeRegexes.some(p => p.test(match));
+}
+async function collectJSFiles(dir) {
+  const files = [];
+  async function walk(currentDir) {
+    let entries;
+    try {
+      entries = await (0, import_promises.readdir)(currentDir, {
+        withFileTypes: !0
+      });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const fullPath = (0, import_node_path.join)(currentDir, entry.name);
+      entry.isDirectory() ? await walk(fullPath) : entry.name.endsWith(".js") && files.push(fullPath);
+    }
+  }
+  return await walk(dir), files;
+}
+async function scanBundleForSecrets(distDir, userSafePatterns) {
+  const isSafe = createSafeMatcher(userSafePatterns),
+    files = await collectJSFiles(distDir),
+    findings = [];
+  for (const fullPath of files) {
+    const relativePath = fullPath.slice(distDir.length + 1);
+    let content;
+    try {
+      content = await (0, import_promises.readFile)(fullPath, "utf-8");
+    } catch {
+      continue;
+    }
+    for (const [label, pattern] of SECRET_PATTERNS) {
+      pattern.lastIndex = 0;
+      let match;
+      for (; (match = pattern.exec(content)) !== null;) {
+        const matched = match[0];
+        if (isSafe(matched)) continue;
+        const line = (content.slice(0, match.index).match(/\n/g)?.length ?? 0) + 1;
+        findings.push({
+          file: relativePath,
+          label,
+          match: matched.length > 40 ? `${matched.slice(0, 20)}...${matched.slice(-10)}` : matched,
+          line
+        });
+      }
+    }
+  }
+  return {
+    clean: findings.length === 0,
+    findings
+  };
+}
+async function runSecurityScan(clientDir, level, safePatterns) {
+  console.info(`
+ \u{1F512} scanning client bundles for leaked secrets...
+`);
+  const {
+    clean,
+    findings
+  } = await scanBundleForSecrets(clientDir, safePatterns);
+  if (clean) return console.info(` \u{1F512} security scan passed \u2014 no secrets found
+`), !0;
+  const icon = level === "error" ? "\u{1F6A8}" : "\u26A0\uFE0F",
+    header = level === "error" ? `${icon} ${findings.length} secret(s) leaked into client bundle:` : `${icon} ${findings.length} potential secret(s) found in client bundle:`;
+  console.error(`
+ ${header}
+`);
+  for (const f of findings) console.error(`   ${f.label}`), console.error(`     file: ${f.file}:${f.line}`), console.error(`     match: ${f.match}
+`);
+  return level === "error" ? (console.error(` Set build.securityScan to 'warn' to continue building despite findings.
+`), !1) : (console.warn(` Set build.securityScan to 'error' to fail builds when secrets are detected.
+`), !0);
+}

package/dist/cjs/cli/securityScan.js

@@ -0,0 +1,134 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: !0 });
+}, __copyProps = (to, from, except, desc) => {
+  if (from && typeof from == "object" || typeof from == "function")
+    for (let key of __getOwnPropNames(from))
+      !__hasOwnProp.call(to, key) && key !== except && __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: !0 }), mod);
+var securityScan_exports = {};
+__export(securityScan_exports, {
+  runSecurityScan: () => runSecurityScan,
+  scanBundleForSecrets: () => scanBundleForSecrets
+});
+module.exports = __toCommonJS(securityScan_exports);
+var import_promises = require("node:fs/promises"), import_node_path = require("node:path");
+const SECRET_PATTERNS = [
+  // api tokens / keys with known prefixes
+  ["Anthropic API key", /sk-ant-[A-Za-z0-9_-]{20,}/g],
+  ["OpenAI API key", /sk-proj-[A-Za-z0-9_-]{20,}/g],
+  ["Stripe secret key", /sk_live_[A-Za-z0-9]{20,}/g],
+  ["Stripe webhook secret", /whsec_[A-Za-z0-9]{20,}/g],
+  ["GitHub token", /gh[ps]_[A-Za-z0-9]{36,}/g],
+  ["GitHub PAT", /github_pat_[A-Za-z0-9_]{20,}/g],
+  ["AWS access key", /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g],
+  [
+    "Postmark server token",
+    /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/g
+  ],
+  ["Bearer token assignment", /["']Bearer\s+[A-Za-z0-9_.-]{20,}["']/g],
+  [
+    "Generic secret assignment",
+    /(?:secret|password|api_key|apikey)\s*[:=]\s*["'][A-Za-z0-9_-]{16,}["']/gi
+  ],
+  // known env var names that should never be inlined
+  ["BETTER_AUTH_SECRET value", /BETTER_AUTH_SECRET["']\s*[:=]\s*["'][^"']+["']/g],
+  ["POSTMARK_SERVER_TOKEN value", /POSTMARK_SERVER_TOKEN["']\s*[:=]\s*["'][^"']+["']/g],
+  ["ANTHROPIC_API_KEY value", /ANTHROPIC_API_KEY["']\s*[:=]\s*["'][^"']+["']/g]
+], SAFE_UUIDS = /* @__PURE__ */ new Set([
+  "00000000-0000-0000-0000-000000000000",
+  "09259e3b-7be8-46f6-9801-106bf1866e1c",
+  // WebRTC SDP
+  "4ad15a19-80e2-4105-bf43-48039fd2963e"
+  // WebRTC SDP
+]), BUILTIN_SAFE_PATTERNS = [
+  /sk_live_your_/,
+  /sk_live_your_key/,
+  /rk_\w+_\w+/,
+  // tamagui theme tokens
+  /sk_all_element/,
+  // DOM property names
+  /sk_personal_data/
+  // analytics property names
+];
+function createSafeMatcher(userPatterns) {
+  const safeStrings = new Set(SAFE_UUIDS), safeRegexes = [...BUILTIN_SAFE_PATTERNS];
+  if (userPatterns)
+    for (const p of userPatterns)
+      typeof p == "string" ? safeStrings.add(p) : safeRegexes.push(p);
+  return (match) => safeStrings.has(match) ? !0 : safeRegexes.some((p) => p.test(match));
+}
+async function collectJSFiles(dir) {
+  const files = [];
+  async function walk(currentDir) {
+    let entries;
+    try {
+      entries = await (0, import_promises.readdir)(currentDir, { withFileTypes: !0 });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const fullPath = (0, import_node_path.join)(currentDir, entry.name);
+      entry.isDirectory() ? await walk(fullPath) : entry.name.endsWith(".js") && files.push(fullPath);
+    }
+  }
+  return await walk(dir), files;
+}
+async function scanBundleForSecrets(distDir, userSafePatterns) {
+  const isSafe = createSafeMatcher(userSafePatterns), files = await collectJSFiles(distDir), findings = [];
+  for (const fullPath of files) {
+    const relativePath = fullPath.slice(distDir.length + 1);
+    let content;
+    try {
+      content = await (0, import_promises.readFile)(fullPath, "utf-8");
+    } catch {
+      continue;
+    }
+    for (const [label, pattern] of SECRET_PATTERNS) {
+      pattern.lastIndex = 0;
+      let match;
+      for (; (match = pattern.exec(content)) !== null; ) {
+        const matched = match[0];
+        if (isSafe(matched)) continue;
+        const line = (content.slice(0, match.index).match(/\n/g)?.length ?? 0) + 1;
+        findings.push({
+          file: relativePath,
+          label,
+          match: matched.length > 40 ? `${matched.slice(0, 20)}...${matched.slice(-10)}` : matched,
+          line
+        });
+      }
+    }
+  }
+  return { clean: findings.length === 0, findings };
+}
+async function runSecurityScan(clientDir, level, safePatterns) {
+  console.info(`
+ \u{1F512} scanning client bundles for leaked secrets...
+`);
+  const { clean, findings } = await scanBundleForSecrets(clientDir, safePatterns);
+  if (clean)
+    return console.info(` \u{1F512} security scan passed \u2014 no secrets found
+`), !0;
+  const icon = level === "error" ? "\u{1F6A8}" : "\u26A0\uFE0F", header = level === "error" ? `${icon} ${findings.length} secret(s) leaked into client bundle:` : `${icon} ${findings.length} potential secret(s) found in client bundle:`;
+  console.error(`
+ ${header}
+`);
+  for (const f of findings)
+    console.error(`   ${f.label}`), console.error(`     file: ${f.file}:${f.line}`), console.error(`     match: ${f.match}
+`);
+  return level === "error" ? (console.error(
+    ` Set build.securityScan to 'warn' to continue building despite findings.
+`
+  ), !1) : (console.warn(
+    ` Set build.securityScan to 'error' to fail builds when secrets are detected.
+`
+  ), !0);
+}
+//# sourceMappingURL=securityScan.js.map

package/dist/cjs/cli/securityScan.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/cli/securityScan.ts"],
+  "mappings": ";;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sBAAkC,6BAClC,mBAAqB;AAGrB,MAAM,kBAA2C;AAAA;AAAA,EAE/C,CAAC,qBAAqB,4BAA4B;AAAA,EAClD,CAAC,kBAAkB,6BAA6B;AAAA,EAChD,CAAC,qBAAqB,2BAA2B;AAAA,EACjD,CAAC,yBAAyB,yBAAyB;AAAA,EACnD,CAAC,gBAAgB,0BAA0B;AAAA,EAC3C,CAAC,cAAc,+BAA+B;AAAA,EAC9C,CAAC,kBAAkB,kDAAkD;AAAA,EACrE;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA,EACA,CAAC,2BAA2B,uCAAuC;AAAA,EACnE;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA;AAAA,EAEA,CAAC,4BAA4B,iDAAiD;AAAA,EAC9E,CAAC,+BAA+B,oDAAoD;AAAA,EACpF,CAAC,2BAA2B,gDAAgD;AAC9E,GAGM,aAAa,oBAAI,IAAI;AAAA,EACzB;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF,CAAC,GAGK,wBAAkC;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF;AAEA,SAAS,kBAAkB,cAAoC;AAC7D,QAAM,cAAc,IAAI,IAAI,UAAU,GAChC,cAAc,CAAC,GAAG,qBAAqB;AAE7C,MAAI;AACF,eAAW,KAAK;AACd,MAAI,OAAO,KAAM,WACf,YAAY,IAAI,CAAC,IAEjB,YAAY,KAAK,CAAC;AAKxB,SAAO,CAAC,UACF,YAAY,IAAI,KAAK,IAAU,KAC5B,YAAY,KAAK,CAAC,MAAM,EAAE,KAAK,KAAK,CAAC;AAEhD;AAUA,eAAe,eAAe,KAAgC;AAC5D,QAAM,QAAkB,CAAC;AAEzB,iBAAe,KAAK,YAAoB;AACtC,QAAI;AACJ,QAAI;AACF,gBAAU,UAAM,yBAAQ,YAAY,EAAE,eAAe,GAAK,CAAC;AAAA,IAC7D,QAAQ;AACN;AAAA,IACF;AACA,eAAW,SAAS,SAAS;AAC3B,YAAM,eAAW,uBAAK,YAAY,MAAM,IAAI;AAC5C,MAAI,MAAM,YAAY,IACpB,MAAM,KAAK,QAAQ,IACV,MAAM,KAAK,SAAS,KAAK,KAClC,MAAM,KAAK,QAAQ;AAAA,IAEvB;AAAA,EACF;AAEA,eAAM,KAAK,GAAG,GACP;AACT;AAEA,eAAsB,qBACpB,SACA,kBAIC;AACD,QAAM,SAAS,kBAAkB,gBAAgB,GAC3C,QAAQ,MAAM,eAAe,OAAO,GACpC,WAA8B,CAAC;AAErC,aAAW,YAAY,OAAO;AAC5B,UAAM,eAAe,SAAS,MAAM,QAAQ,SAAS,CAAC;AACtD,QAAI;AACJ,QAAI;AACF,gBAAU,UAAM,0BAAS,UAAU,OAAO;AAAA,IAC5C,QAAQ;AACN;AAAA,IACF;AAEA,eAAW,CAAC,OAAO,OAAO,KAAK,iBAAiB;AAE9C,cAAQ,YAAY;AACpB,UAAI;AAEJ,cAAQ,QAAQ,QAAQ,KAAK,OAAO,OAAO,QAAM;AAC/C,cAAM,UAAU,MAAM,CAAC;AACvB,YAAI,OAAO,OAAO,EAAG;AAIrB,cAAM,QADc,QAAQ,MAAM,GAAG,MAAM,KAAK,EACtB,MAAM,KAAK,GAAG,UAAU,KAAK;AAEvD,iBAAS,KAAK;AAAA,UACZ,MAAM;AAAA,UACN;AAAA,UACA,OACE,QAAQ,SAAS,KACb,GAAG,QAAQ,MAAM,GAAG,EAAE,CAAC,MAAM,QAAQ,MAAM,GAAG,CAAC,KAC/C;AAAA,UACN;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,OAAO,SAAS,WAAW,GAAG,SAAS;AAClD;AAMA,eAAsB,gBACpB,WACA,OACA,cACkB;AAClB,UAAQ,KAAK;AAAA;AAAA,CAAuD;AAEpE,QAAM,EAAE,OAAO,SAAS,IAAI,MAAM,qBAAqB,WAAW,YAAY;AAE9E,MAAI;AACF,mBAAQ,KAAK;AAAA,CAA+C,GACrD;AAGT,QAAM,OAAO,UAAU,UAAU,cAAO,gBAClC,SACJ,UAAU,UACN,GAAG,IAAI,IAAI,SAAS,MAAM,0CAC1B,GAAG,IAAI,IAAI,SAAS,MAAM;AAEhC,UAAQ,MAAM;AAAA,GAAM,MAAM;AAAA,CAAI;AAE9B,aAAW,KAAK;AACd,YAAQ,MAAM,MAAM,EAAE,KAAK,EAAE,GAC7B,QAAQ,MAAM,cAAc,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,GAC9C,QAAQ,MAAM,eAAe,EAAE,KAAK;AAAA,CAAI;AAG1C,SAAI,UAAU,WACZ,QAAQ;AAAA,IACN;AAAA;AAAA,EACF,GACO,OAGT,QAAQ;AAAA,IACN;AAAA;AAAA,EACF,GACO;AACT;",
+  "names": []
+}

package/dist/cjs/cli/securityScan.native.js

@@ -0,0 +1,205 @@
+"use strict";
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+    for (var name in all) __defProp(target, name, {
+      get: all[name],
+      enumerable: !0
+    });
+  },
+  __copyProps = (to, from, except, desc) => {
+    if (from && typeof from == "object" || typeof from == "function") for (let key of __getOwnPropNames(from)) !__hasOwnProp.call(to, key) && key !== except && __defProp(to, key, {
+      get: () => from[key],
+      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+    });
+    return to;
+  };
+var __toCommonJS = mod => __copyProps(__defProp({}, "__esModule", {
+  value: !0
+}), mod);
+var securityScan_exports = {};
+__export(securityScan_exports, {
+  runSecurityScan: () => runSecurityScan,
+  scanBundleForSecrets: () => scanBundleForSecrets
+});
+module.exports = __toCommonJS(securityScan_exports);
+var import_promises = require("fs/promises"),
+  import_path = require("path"),
+  SECRET_PATTERNS = [
+  // api tokens / keys with known prefixes
+  ["Anthropic API key", /sk-ant-[A-Za-z0-9_-]{20,}/g], ["OpenAI API key", /sk-proj-[A-Za-z0-9_-]{20,}/g], ["Stripe secret key", /sk_live_[A-Za-z0-9]{20,}/g], ["Stripe webhook secret", /whsec_[A-Za-z0-9]{20,}/g], ["GitHub token", /gh[ps]_[A-Za-z0-9]{36,}/g], ["GitHub PAT", /github_pat_[A-Za-z0-9_]{20,}/g], ["AWS access key", RegExp("(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])", "g")], ["Postmark server token", /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/g], ["Bearer token assignment", /["']Bearer\s+[A-Za-z0-9_.-]{20,}["']/g], ["Generic secret assignment", /(?:secret|password|api_key|apikey)\s*[:=]\s*["'][A-Za-z0-9_-]{16,}["']/gi],
+  // known env var names that should never be inlined
+  ["BETTER_AUTH_SECRET value", /BETTER_AUTH_SECRET["']\s*[:=]\s*["'][^"']+["']/g], ["POSTMARK_SERVER_TOKEN value", /POSTMARK_SERVER_TOKEN["']\s*[:=]\s*["'][^"']+["']/g], ["ANTHROPIC_API_KEY value", /ANTHROPIC_API_KEY["']\s*[:=]\s*["'][^"']+["']/g]],
+  SAFE_UUIDS = /* @__PURE__ */new Set(["00000000-0000-0000-0000-000000000000", "09259e3b-7be8-46f6-9801-106bf1866e1c",
+  // WebRTC SDP
+  "4ad15a19-80e2-4105-bf43-48039fd2963e"]),
+  BUILTIN_SAFE_PATTERNS = [/sk_live_your_/, /sk_live_your_key/, /rk_\w+_\w+/,
+  // tamagui theme tokens
+  /sk_all_element/,
+  // DOM property names
+  /sk_personal_data/];
+function createSafeMatcher(userPatterns) {
+  var safeStrings = new Set(SAFE_UUIDS),
+    safeRegexes = [...BUILTIN_SAFE_PATTERNS];
+  if (userPatterns) {
+    var _iteratorNormalCompletion = !0,
+      _didIteratorError = !1,
+      _iteratorError = void 0;
+    try {
+      for (var _iterator = userPatterns[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = !0) {
+        var p = _step.value;
+        typeof p == "string" ? safeStrings.add(p) : safeRegexes.push(p);
+      }
+    } catch (err) {
+      _didIteratorError = !0, _iteratorError = err;
+    } finally {
+      try {
+        !_iteratorNormalCompletion && _iterator.return != null && _iterator.return();
+      } finally {
+        if (_didIteratorError) throw _iteratorError;
+      }
+    }
+  }
+  return function (match) {
+    return safeStrings.has(match) ? !0 : safeRegexes.some(function (p2) {
+      return p2.test(match);
+    });
+  };
+}
+async function collectJSFiles(dir) {
+  var files = [];
+  async function walk(currentDir) {
+    var entries;
+    try {
+      entries = await (0, import_promises.readdir)(currentDir, {
+        withFileTypes: !0
+      });
+    } catch {
+      return;
+    }
+    var _iteratorNormalCompletion = !0,
+      _didIteratorError = !1,
+      _iteratorError = void 0;
+    try {
+      for (var _iterator = entries[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = !0) {
+        var entry = _step.value,
+          fullPath = (0, import_path.join)(currentDir, entry.name);
+        entry.isDirectory() ? await walk(fullPath) : entry.name.endsWith(".js") && files.push(fullPath);
+      }
+    } catch (err) {
+      _didIteratorError = !0, _iteratorError = err;
+    } finally {
+      try {
+        !_iteratorNormalCompletion && _iterator.return != null && _iterator.return();
+      } finally {
+        if (_didIteratorError) throw _iteratorError;
+      }
+    }
+  }
+  return await walk(dir), files;
+}
+async function scanBundleForSecrets(distDir, userSafePatterns) {
+  var isSafe = createSafeMatcher(userSafePatterns),
+    files = await collectJSFiles(distDir),
+    findings = [],
+    _iteratorNormalCompletion = !0,
+    _didIteratorError = !1,
+    _iteratorError = void 0;
+  try {
+    for (var _iterator = files[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = !0) {
+      var fullPath = _step.value,
+        relativePath = fullPath.slice(distDir.length + 1),
+        content = void 0;
+      try {
+        content = await (0, import_promises.readFile)(fullPath, "utf-8");
+      } catch {
+        continue;
+      }
+      var _iteratorNormalCompletion1 = !0,
+        _didIteratorError1 = !1,
+        _iteratorError1 = void 0;
+      try {
+        for (var _iterator1 = SECRET_PATTERNS[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = !0) {
+          var [label, pattern] = _step1.value;
+          pattern.lastIndex = 0;
+          for (var match = void 0; (match = pattern.exec(content)) !== null;) {
+            var _ref,
+              _beforeMatch_match,
+              matched = match[0];
+            if (!isSafe(matched)) {
+              var beforeMatch = content.slice(0, match.index),
+                line = ((_ref = (_beforeMatch_match = beforeMatch.match(/\n/g)) === null || _beforeMatch_match === void 0 ? void 0 : _beforeMatch_match.length) !== null && _ref !== void 0 ? _ref : 0) + 1;
+              findings.push({
+                file: relativePath,
+                label,
+                match: matched.length > 40 ? `${matched.slice(0, 20)}...${matched.slice(-10)}` : matched,
+                line
+              });
+            }
+          }
+        }
+      } catch (err) {
+        _didIteratorError1 = !0, _iteratorError1 = err;
+      } finally {
+        try {
+          !_iteratorNormalCompletion1 && _iterator1.return != null && _iterator1.return();
+        } finally {
+          if (_didIteratorError1) throw _iteratorError1;
+        }
+      }
+    }
+  } catch (err) {
+    _didIteratorError = !0, _iteratorError = err;
+  } finally {
+    try {
+      !_iteratorNormalCompletion && _iterator.return != null && _iterator.return();
+    } finally {
+      if (_didIteratorError) throw _iteratorError;
+    }
+  }
+  return {
+    clean: findings.length === 0,
+    findings
+  };
+}
+async function runSecurityScan(clientDir, level, safePatterns) {
+  console.info(`
+ \u{1F512} scanning client bundles for leaked secrets...
+`);
+  var {
+    clean,
+    findings
+  } = await scanBundleForSecrets(clientDir, safePatterns);
+  if (clean) return console.info(` \u{1F512} security scan passed \u2014 no secrets found
+`), !0;
+  var icon = level === "error" ? "\u{1F6A8}" : "\u26A0\uFE0F",
+    header = level === "error" ? `${icon} ${findings.length} secret(s) leaked into client bundle:` : `${icon} ${findings.length} potential secret(s) found in client bundle:`;
+  console.error(`
+ ${header}
+`);
+  var _iteratorNormalCompletion = !0,
+    _didIteratorError = !1,
+    _iteratorError = void 0;
+  try {
+    for (var _iterator = findings[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = !0) {
+      var f = _step.value;
+      console.error(`   ${f.label}`), console.error(`     file: ${f.file}:${f.line}`), console.error(`     match: ${f.match}
+`);
+    }
+  } catch (err) {
+    _didIteratorError = !0, _iteratorError = err;
+  } finally {
+    try {
+      !_iteratorNormalCompletion && _iterator.return != null && _iterator.return();
+    } finally {
+      if (_didIteratorError) throw _iteratorError;
+    }
+  }
+  return level === "error" ? (console.error(` Set build.securityScan to 'warn' to continue building despite findings.
+`), !1) : (console.warn(` Set build.securityScan to 'error' to fail builds when secrets are detected.
+`), !0);
+}
+//# sourceMappingURL=securityScan.native.js.map

package/dist/cjs/cli/securityScan.native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["__toCommonJS","mod","__copyProps","__defProp","value","securityScan_exports","__export","runSecurityScan","scanBundleForSecrets","module","exports","import_promises","require","import_path","SECRET_PATTERNS","RegExp","SAFE_UUIDS","Set","BUILTIN_SAFE_PATTERNS","createSafeMatcher","userPatterns","safeStrings","safeRegexes","_iteratorNormalCompletion","_didIteratorError","_iteratorError","_iterator","Symbol","iterator","_step","next","done","p","add","push","err","return","match","has","some","p2","test","collectJSFiles","dir","files","walk","currentDir","entries","readdir","withFileTypes","entry","fullPath","join","name"],"sources":["../../../src/cli/securityScan.ts"],"sourcesContent":[null],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,IAAAA,YAAA,GAAAC,GAAA,IAAAC,WAAA,CAAAC,SAAA;EAAAC,KAAA;AAAA,IAAAH,GAAA;AAAA,IAAAI,oBAAA;AAAAC,QAAA,CAAAD,oBAAA;EAAAE,eAAA,EAAAA,CAAA,KAAAA,eAAA;EAAAC,oBAAA,EAAAA,CAAA,KAAAA;AAAA;AAAAC,MAAA,CAAAC,OAAA,GAAAV,YAAkC,CAAAK,oBAAA,CAClC;AAGA,IAAAM,eAAM,GAAAC,OAA2C;EAAAC,WAAA,GAAAD,OAAA;EAAAE,eAAA;EAAA;EAE/C,CACC,mBAAkB,EAClB,4BAAqB,CACrB,EACD,CACC,gBAAc,EACd,6BAAkB,CACnB,GAEE,qBACF,4BACC,EACD,CACE,yBACA,0BACF,GAEC,gBACA,2BACA,EACH,CAIE,cACA,kCACA,mBAIIC,MAAA,kDAAkC,OACtC,EACA,CACA,yFACA,GACA,mEACF,EAEA,CACE,2BAA4B,EAG5B,0EAAI,CACF;EACE;EAQJ,CAIF,4BAUA,iDAA8D,CAC5D,EAEA,CACE,6BAAI,EACJ,oDAAI,CACF,EAA2D,CAE3D,2BACF,iDACA,CACE;EAAAC,UAAM,kBAAW,IAAAC,GAAA,EACjB,sCACa,EAEQ,sCAEvB;EACF;EAEA,sCACO,CACT;EAAAC,qBAAA,IAEA,eAAsB,EAOpB,kBAAe,EAIf,YAAW;EACT;EACA,gBAAI;EACJ;EACE,kBAAU,CAAgC;AAE1C,SAAAC,kBAAAC,YAAA;EAAA,IACFC,WAAA,OAAAJ,GAAA,CAAAD,UAAA;IAAAM,WAAA,IAEA,GAAAJ,qBAAmB,CAEjB;EACA,IAAAE,YAAI;IAEJ,IAAAG,yBAAwB,GAAK;MAAAC,iBAAoB;MAAAC,cAAA;IAC/C;MACA,SAAIC,SAAO,GAAON,YAAG,CAAAO,MAAA,CAAAC,QAAA,KAAAC,KAAA,IAAAN,yBAAA,IAAAM,KAAA,GAAAH,SAAA,CAAAI,IAAA,IAAAC,IAAA,GAAAR,yBAAA;QAIrB,IAAAS,CAAA,GAAMH,KAAA,CADczB,KAAA;QAGpB,OAAA4B,CAAA,IAAS,QAAK,GAAAX,WAAA,CAAAY,GAAA,CAAAD,CAAA,IAAAV,WAAA,CAAAY,IAAA,CAAAF,CAAA;MAAA;IACN,SACNG,GAAA;MAAAX,iBAEE,GAAQ,IAAAC,cACD,GAAAU,GAAQ;IACX,UACN;MAAA,IACD;QACH,CAAAZ,yBAAA,IAAAG,SAAA,CAAAU,MAAA,YAAAV,SAAA,CAAAU,MAAA;MACF;QACF,IAAAZ,iBAAA,EAEO,MAAEC,cAAgB;MAC3B;IAMA;EAKE;EAAa,iBAAAY,KAAA;IAAuD,OAAAhB,WAAA,CAAAiB,GAAA,CAAAD,KAAA,SAAAf,WAAA,CAAAiB,IAAA,WAAAC,EAAA;MAEpE,OAAQA,EAAA,CAAAC,IAAO,CAAAJ,KAAS;IAExB,EAAI;EACF;AAAa;AAIf,eAAaK,cAAUA,CAAAC,GAAA,EAAU;EAMjC,IAAAC,KAAQ,KAAM;EAAA,eAAYC,KAAAC,UAAA;IAAI,IAAAC,OAAA;IAE9B;MACEA,OAAQ,SAAM,EAAM,EAAEpC,eACtB,CAAAqC,OAAQ,EAAMF,UAAA;QAC0BG,aAAA;MAG1C;IAEI;MAAA;IACF;IAKA,IAAA1B,yBAAA;MAAAC,iBAAA;MAAAC,cAAA;IAAA;MAEK,SAAAC,SAAA,GAAAqB,OAAA,CAAApB,MAAA,CAAAC,QAAA,KAAAC,KAAA,IAAAN,yBAAA,IAAAM,KAAA,GAAAH,SAAA,CAAAI,IAAA,IAAAC,IAAA,GAAAR,yBAAA;QACT,IAAA2B,KAAA,GAAArB,KAAA,CAAAzB,KAAA;UAAA+C,QAAA,OAAAtC,WAAA,CAAAuC,IAAA,EAAAN,UAAA,EAAAI,KAAA,CAAAG,IAAA","ignoreList":[]}

package/dist/cjs/cli/workerPool.cjs

@@ -67,12 +67,13 @@ class BuildWorkerPool {
   get size() {
     return this.workers.length;
   }
-  // initialize all workers - they load config themselves from vite.config
-  async initialize() {
+  // initialize all workers with pre-loaded config from main thread
+  async initialize(oneOptions) {
     await this._ready;
     for (const worker of this.workers) worker.postMessage({
       type: "init",
-      id: this.nextId++
+      id: this.nextId++,
+      oneOptions
     });
     await this._initialized;
   }

package/dist/cjs/cli/workerPool.js

@@ -60,11 +60,11 @@ class BuildWorkerPool {
   get size() {
     return this.workers.length;
   }
-  // initialize all workers - they load config themselves from vite.config
-  async initialize() {
+  // initialize all workers with pre-loaded config from main thread
+  async initialize(oneOptions) {
     await this._ready;
     for (const worker of this.workers)
-      worker.postMessage({ type: "init", id: this.nextId++ });
+      worker.postMessage({ type: "init", id: this.nextId++, oneOptions });
     await this._initialized;
   }
   dispatch() {

package/dist/cjs/cli/workerPool.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../src/cli/workerPool.ts"],
-  "mappings": ";;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAGA,iCAAuB,gCACvB,iBAAqB,oBACrB,kBAA8B,qBAC9B,mBAA8B;AAN9B,wBAQM,iBAAa,+BAAc,YAAY,GAAG,GAC1C,gBAAY,0BAAQ,UAAU;AAQ7B,MAAM,gBAAgB;AAAA,EACnB,UAAoB,CAAC;AAAA,EACrB,YAAsB,CAAC;AAAA,EACvB,YAAuD,CAAC;AAAA,EACxD,cAAc,oBAAI,IAAyB;AAAA,EAC3C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,YAAY;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAc;AAAA,EAEtB,YAAY,OAAO,KAAK,IAAI,OAAG,qBAAK,EAAE,SAAS,CAAC,GAAG;AACjD,SAAK,SAAS,IAAI,QAAQ,CAAC,YAAY;AACrC,WAAK,gBAAgB;AAAA,IACvB,CAAC,GACD,KAAK,eAAe,IAAI,QAAQ,CAAC,YAAY;AAC3C,WAAK,sBAAsB;AAAA,IAC7B,CAAC;AAGD,UAAM,iBAAa,uBAAK,WAAW,qBAAqB;AAExD,aAAS,IAAI,GAAG,IAAI,MAAM,KAAK;AAC7B,YAAM,SAAS,IAAI,kCAAO,UAAU;AAEpC,aAAO,GAAG,WAAW,CAAC,QAAa;AACjC,YAAI,IAAI,SAAS;AACf,eAAK,cACL,KAAK,UAAU,KAAK,MAAM,GACtB,KAAK,eAAe,QACtB,KAAK,cAAc;AAAA,iBAEZ,IAAI,SAAS;AACtB,eAAK,aACD,KAAK,cAAc,QACrB,KAAK,oBAAoB,GAE3B,KAAK,SAAS;AAAA,iBACL,IAAI,SAAS,UAAU,IAAI,SAAS,SAAS;AACtD,gBAAM,UAAU,KAAK,YAAY,IAAI,IAAI,EAAE;AAC3C,UAAI,YACF,KAAK,YAAY,OAAO,IAAI,EAAE,GAC1B,IAAI,SAAS,SACf,QAAQ,QAAQ,IAAI,MAAM,IAE1B,QAAQ,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC,IAGvC,KAAK,UAAU,KAAK,MAAM,GAC1B,KAAK,SAAS;AAAA,QAChB;AAAA,MACF,CAAC,GAED,OAAO,GAAG,SAAS,CAAC,QAAQ;AAC1B,gBAAQ,MAAM,mCAAmC,GAAG;AAAA,MACtD,CAAC,GAED,KAAK,QAAQ,KAAK,MAAM;AAAA,IAC1B;AAAA,EACF;AAAA,EAEA,IAAI,OAAO;AACT,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA;AAAA,EAGA,MAAM,aAAa;AACjB,UAAM,KAAK;AAGX,eAAW,UAAU,KAAK;AACxB,aAAO,YAAY,EAAE,MAAM,QAAQ,IAAI,KAAK,SAAS,CAAC;AAGxD,UAAM,KAAK;AAAA,EACb;AAAA,EAEQ,WAAW;AACjB,WAAO,KAAK,UAAU,SAAS,KAAK,KAAK,UAAU,SAAS,KAAG;AAC7D,YAAM,SAAS,KAAK,UAAU,MAAM,GAC9B,EAAE,KAAK,QAAQ,IAAI,KAAK,UAAU,MAAM;AAC9C,WAAK,YAAY,IAAI,QAAQ,IAAI,OAAO,GACxC,OAAO,YAAY,GAAG;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,UAAU,MAmBC;AACf,QAAI,KAAK;AACP,YAAM,IAAI,MAAM,iCAAiC;AAKnD,UAAM,kBAAkB;AAAA,MACtB,MAAM,KAAK,WAAW;AAAA,MACtB,MAAM,KAAK,WAAW;AAAA;AAAA,MAEtB,SAAS,KAAK,WAAW,SAAS,IAAI,CAAC,YAAiB;AAAA,QACtD,YAAY,OAAO;AAAA,QACnB,kBAAkB,OAAO;AAAA,QACzB,kBAAkB,OAAO;AAAA,MAC3B,EAAE;AAAA;AAAA,MAEF,aAAa,KAAK,WAAW,aAAa,IAAI,CAAC,QAAa;AAAA,QAC1D,YAAY,GAAG;AAAA,MACjB,EAAE;AAAA,IACJ,GAEM,KAAK,KAAK,UACV,MAAM;AAAA,MACV,MAAM;AAAA,MACN;AAAA,MACA,MAAM;AAAA,QACJ,GAAG;AAAA,QACH,YAAY;AAAA,MACd;AAAA,IACF;AAEA,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAM,UAAuB,EAAE,IAAI,SAAS,OAAO;AACnD,WAAK,UAAU,KAAK,EAAE,KAAK,QAAQ,CAAC,GACpC,KAAK,SAAS;AAAA,IAChB,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY;AAChB,SAAK,cAAc,IACnB,MAAM,QAAQ,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,GACxD,KAAK,UAAU,CAAC,GAChB,KAAK,YAAY,CAAC;AAAA,EACpB;AACF;AAGA,IAAI,OAA+B;AAE5B,SAAS,cAAc,MAAgC;AAC5D,SAAK,SACH,OAAO,IAAI,gBAAgB,IAAI,IAE1B;AACT;AAEA,eAAsB,sBAAsB;AAC1C,EAAI,SACF,MAAM,KAAK,UAAU,GACrB,OAAO;AAEX;",
+  "mappings": ";;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAGA,iCAAuB,gCACvB,iBAAqB,oBACrB,kBAA8B,qBAC9B,mBAA8B;AAN9B,wBAQM,iBAAa,+BAAc,YAAY,GAAG,GAC1C,gBAAY,0BAAQ,UAAU;AAQ7B,MAAM,gBAAgB;AAAA,EACnB,UAAoB,CAAC;AAAA,EACrB,YAAsB,CAAC;AAAA,EACvB,YAAuD,CAAC;AAAA,EACxD,cAAc,oBAAI,IAAyB;AAAA,EAC3C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,YAAY;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAc;AAAA,EAEtB,YAAY,OAAO,KAAK,IAAI,OAAG,qBAAK,EAAE,SAAS,CAAC,GAAG;AACjD,SAAK,SAAS,IAAI,QAAQ,CAAC,YAAY;AACrC,WAAK,gBAAgB;AAAA,IACvB,CAAC,GACD,KAAK,eAAe,IAAI,QAAQ,CAAC,YAAY;AAC3C,WAAK,sBAAsB;AAAA,IAC7B,CAAC;AAGD,UAAM,iBAAa,uBAAK,WAAW,qBAAqB;AAExD,aAAS,IAAI,GAAG,IAAI,MAAM,KAAK;AAC7B,YAAM,SAAS,IAAI,kCAAO,UAAU;AAEpC,aAAO,GAAG,WAAW,CAAC,QAAa;AACjC,YAAI,IAAI,SAAS;AACf,eAAK,cACL,KAAK,UAAU,KAAK,MAAM,GACtB,KAAK,eAAe,QACtB,KAAK,cAAc;AAAA,iBAEZ,IAAI,SAAS;AACtB,eAAK,aACD,KAAK,cAAc,QACrB,KAAK,oBAAoB,GAE3B,KAAK,SAAS;AAAA,iBACL,IAAI,SAAS,UAAU,IAAI,SAAS,SAAS;AACtD,gBAAM,UAAU,KAAK,YAAY,IAAI,IAAI,EAAE;AAC3C,UAAI,YACF,KAAK,YAAY,OAAO,IAAI,EAAE,GAC1B,IAAI,SAAS,SACf,QAAQ,QAAQ,IAAI,MAAM,IAE1B,QAAQ,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC,IAGvC,KAAK,UAAU,KAAK,MAAM,GAC1B,KAAK,SAAS;AAAA,QAChB;AAAA,MACF,CAAC,GAED,OAAO,GAAG,SAAS,CAAC,QAAQ;AAC1B,gBAAQ,MAAM,mCAAmC,GAAG;AAAA,MACtD,CAAC,GAED,KAAK,QAAQ,KAAK,MAAM;AAAA,IAC1B;AAAA,EACF;AAAA,EAEA,IAAI,OAAO;AACT,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA;AAAA,EAGA,MAAM,WAAW,YAAkB;AACjC,UAAM,KAAK;AAEX,eAAW,UAAU,KAAK;AACxB,aAAO,YAAY,EAAE,MAAM,QAAQ,IAAI,KAAK,UAAU,WAAW,CAAC;AAGpE,UAAM,KAAK;AAAA,EACb;AAAA,EAEQ,WAAW;AACjB,WAAO,KAAK,UAAU,SAAS,KAAK,KAAK,UAAU,SAAS,KAAG;AAC7D,YAAM,SAAS,KAAK,UAAU,MAAM,GAC9B,EAAE,KAAK,QAAQ,IAAI,KAAK,UAAU,MAAM;AAC9C,WAAK,YAAY,IAAI,QAAQ,IAAI,OAAO,GACxC,OAAO,YAAY,GAAG;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,UAAU,MAoBC;AACf,QAAI,KAAK;AACP,YAAM,IAAI,MAAM,iCAAiC;AAKnD,UAAM,kBAAkB;AAAA,MACtB,MAAM,KAAK,WAAW;AAAA,MACtB,MAAM,KAAK,WAAW;AAAA;AAAA,MAEtB,SAAS,KAAK,WAAW,SAAS,IAAI,CAAC,YAAiB;AAAA,QACtD,YAAY,OAAO;AAAA,QACnB,kBAAkB,OAAO;AAAA,QACzB,kBAAkB,OAAO;AAAA,MAC3B,EAAE;AAAA;AAAA,MAEF,aAAa,KAAK,WAAW,aAAa,IAAI,CAAC,QAAa;AAAA,QAC1D,YAAY,GAAG;AAAA,MACjB,EAAE;AAAA,IACJ,GAEM,KAAK,KAAK,UACV,MAAM;AAAA,MACV,MAAM;AAAA,MACN;AAAA,MACA,MAAM;AAAA,QACJ,GAAG;AAAA,QACH,YAAY;AAAA,MACd;AAAA,IACF;AAEA,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAM,UAAuB,EAAE,IAAI,SAAS,OAAO;AACnD,WAAK,UAAU,KAAK,EAAE,KAAK,QAAQ,CAAC,GACpC,KAAK,SAAS;AAAA,IAChB,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY;AAChB,SAAK,cAAc,IACnB,MAAM,QAAQ,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,GACxD,KAAK,UAAU,CAAC,GAChB,KAAK,YAAY,CAAC;AAAA,EACpB;AACF;AAGA,IAAI,OAA+B;AAE5B,SAAS,cAAc,MAAgC;AAC5D,SAAK,SACH,OAAO,IAAI,gBAAgB,IAAI,IAE1B;AACT;AAEA,eAAsB,sBAAsB;AAC1C,EAAI,SACF,MAAM,KAAK,UAAU,GACrB,OAAO;AAEX;",
   "names": []
 }

package/dist/cjs/cli/workerPool.native.js

@@ -87,8 +87,8 @@ var __filename = (0, import_url.fileURLToPath)(import_meta.url),
     }, {
       key: "initialize",
       value:
-      // initialize all workers - they load config themselves from vite.config
-      async function () {
+      // initialize all workers with pre-loaded config from main thread
+      async function (oneOptions) {
         await this._ready;
         var _iteratorNormalCompletion = !0,
           _didIteratorError = !1,
@@ -98,7 +98,8 @@ var __filename = (0, import_url.fileURLToPath)(import_meta.url),
             var worker = _step.value;
             worker.postMessage({
               type: "init",
-              id: this.nextId++
+              id: this.nextId++,
+              oneOptions
             });
           }
         } catch (err) {