void 0.10.12 → 0.20.0

package/dist/runtime/email.mjs

@@ -0,0 +1,573 @@
+import { i as normalizeEmail, n as MimeError, r as buildMime } from "../mime-BJD7d_qL.mjs";
+import { a as DEV_INBOX_ENV_VAR, b as serializeCapturedMessage, c as DEV_INBOX_TOKEN_ENV_VAR, d as captureMessage, h as hasActiveSink, i as DEV_INBOX_CAPTURE_URL, p as dispatchToSinks } from "../dev-inbox-DkgRWLkW.mjs";
+import { a as getRawRuntimeEnv } from "../env-raw-Cx8ElDdj.mjs";
+import { a as defineEmail, c as parseEmail, i as createMessageProxy, l as replyEmail, o as enactEmailActions, r as ParseEmailError, s as isForwardableEmailMessage } from "../inbound-CNKxb3FY.mjs";
+//#region src/runtime/email.ts
+const VALID_SLUG = /^[a-z0-9](?:[a-z0-9-]{0,54}[a-z0-9])?$/;
+function makeError(code, message, cause) {
+	return cause === void 0 ? {
+		code,
+		message
+	} : {
+		code,
+		message,
+		cause
+	};
+}
+function tryGetRawRuntimeEnv() {
+	try {
+		return getRawRuntimeEnv();
+	} catch {
+		return;
+	}
+}
+function readProjectSlug() {
+	const raw = tryGetRawRuntimeEnv()?.__VOID_PROJECT_SLUG;
+	if (typeof raw !== "string" || raw.length === 0) return;
+	return VALID_SLUG.test(raw) ? raw : void 0;
+}
+function readEmailDomain() {
+	const raw = tryGetRawRuntimeEnv()?.__VOID_EMAIL_DOMAIN;
+	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
+}
+function readEmailFrom() {
+	const raw = tryGetRawRuntimeEnv()?.__VOID_EMAIL_FROM;
+	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
+}
+const SEND_EMAIL_BINDING_NAME = "SEND_EMAIL";
+function resolveSendEmailBinding(env) {
+	const binding = env?.[SEND_EMAIL_BINDING_NAME];
+	if (typeof binding !== "object" || binding === null) return;
+	return typeof binding.send === "function" ? binding : void 0;
+}
+/**
+* Map an error thrown by the `send_email` binding to a framework code.
+*
+* Email Service throws `Error`s carrying a `code` (the `E_*` table in
+* Cloudflare's Workers API reference); the older Email Routing sender
+* throws message-only errors, so the destination-verification phrasing the
+* platform proxy already keys on is kept as a fallback. Anything else is
+* `UPSTREAM_ERROR` with the original error as `cause` — the framework has
+* no way to act on a delivery failure or a service outage beyond
+* reporting it.
+*
+* The platform proxy's `classifyUpstream` mirrors this table for its own
+* binding, except the two sender codes: there `from` is pinned to the
+* project sender, so a sender failure is the platform's to fix and stays
+* `UPSTREAM_ERROR`. Keep the recipient and limit rows in lockstep.
+*/
+function classifyBindingError(e) {
+	const message = e instanceof Error ? e.message : String(e);
+	switch (typeof e?.code === "string" ? e.code : "") {
+		case "E_RECIPIENT_NOT_ALLOWED": return makeError("UNVERIFIED_DESTINATION", message, e);
+		case "E_SENDER_NOT_VERIFIED":
+		case "E_SENDER_DOMAIN_NOT_AVAILABLE": return makeError("INVALID_FROM", message, e);
+		case "E_RATE_LIMIT_EXCEEDED":
+		case "E_DAILY_LIMIT_EXCEEDED": return makeError("QUOTA_EXCEEDED", message, e);
+	}
+	if (UNVERIFIED_DESTINATION_RE.test(message)) return makeError("UNVERIFIED_DESTINATION", message, e);
+	return makeError("UPSTREAM_ERROR", message, e);
+}
+const UNVERIFIED_DESTINATION_RE = /^[^\n]{0,200}destination address[^\n]{0,200}not (?:yet )?verified/i;
+function bytesToReadableStream(bytes) {
+	return new ReadableStream({ start(controller) {
+		controller.enqueue(bytes);
+		controller.close();
+	} });
+}
+/**
+* Deliver through the worker's own `SEND_EMAIL` binding. One `EmailMessage`
+* per recipient, every recipient attempted, and the same `deliveries` shape
+* the proxy returns so a caller retries the failed ones the same way in both
+* modes. The stream is rebuilt per send because a `ReadableStream` is
+* one-shot.
+*/
+async function sendViaBinding(binding, from, recipients, raw, fallbackId) {
+	let EmailMessage;
+	try {
+		({EmailMessage} = await import("cloudflare:email"));
+	} catch (e) {
+		return err("UPSTREAM_ERROR", `email: SEND_EMAIL is bound but cloudflare:email could not be loaded: ${e instanceof Error ? e.message : String(e)}`, e);
+	}
+	const deliveries = [];
+	for (const recipient of recipients) try {
+		const result = await binding.send(new EmailMessage(from, recipient, bytesToReadableStream(raw)));
+		const mid = typeof result?.messageId === "string" ? result.messageId : "";
+		deliveries.push({
+			recipient,
+			ok: true,
+			messageId: mid || fallbackId
+		});
+	} catch (e) {
+		deliveries.push({
+			recipient,
+			ok: false,
+			error: classifyBindingError(e)
+		});
+	}
+	if (deliveries.some((d) => !d.ok)) return {
+		ok: false,
+		deliveries
+	};
+	return {
+		ok: true,
+		ids: deliveries.map((d) => ({
+			recipient: d.recipient,
+			messageId: d.messageId
+		}))
+	};
+}
+/**
+* Dedup recipients by lowercased email (CF won't collapse duplicate
+* envelopes for us, and double-billing the quota for the same recipient
+* is worse than the rare case where a user actually wanted Cc + Bcc to
+* the same address — which doesn't change delivery semantics anyway).
+*/
+function uniqueRecipients(normalized) {
+	const seen = /* @__PURE__ */ new Set();
+	const recipients = [];
+	for (const r of [
+		...normalized.to,
+		...normalized.cc,
+		...normalized.bcc
+	]) {
+		const lower = r.email.toLowerCase();
+		if (seen.has(lower)) continue;
+		seen.add(lower);
+		recipients.push(lower);
+	}
+	return recipients;
+}
+function newRequestId() {
+	const bytes = /* @__PURE__ */ new Uint8Array(8);
+	crypto.getRandomValues(bytes);
+	let hex = "";
+	for (const b of bytes) hex += b.toString(16).padStart(2, "0");
+	return `req_${Date.now().toString(36)}${hex}`;
+}
+function resolveDefaultFrom(opts) {
+	const supplied = opts.from;
+	if (!(supplied === void 0 || supplied === null || typeof supplied === "string" && supplied.trim() === "" || typeof supplied === "object" && supplied !== null && !("email" in supplied))) return opts;
+	const configured = readEmailFrom();
+	if (configured) return {
+		...opts,
+		from: configured
+	};
+	const slug = readProjectSlug();
+	const domain = readEmailDomain();
+	if (!slug || !domain) {
+		if (supplied === null) {
+			const next = { ...opts };
+			delete next.from;
+			return next;
+		}
+		return opts;
+	}
+	return {
+		...opts,
+		from: `${slug}+noreply@${domain}`
+	};
+}
+function err(code, message, cause) {
+	return {
+		ok: false,
+		error: makeError(code, message, cause)
+	};
+}
+function bytesToBase64(bytes) {
+	const CHUNK = 8192;
+	let binary = "";
+	for (let i = 0; i < bytes.byteLength; i += CHUNK) {
+		const slice = bytes.subarray(i, Math.min(i + CHUNK, bytes.byteLength));
+		binary += String.fromCharCode(...slice);
+	}
+	return btoa(binary);
+}
+function coerceErrorCode(code) {
+	return [
+		"BINDING_MISSING",
+		"INVALID_FROM",
+		"INVALID_TO",
+		"UNVERIFIED_DESTINATION",
+		"MIME_ERROR",
+		"QUOTA_EXCEEDED",
+		"UPSTREAM_ERROR"
+	].includes(code) ? code : "UPSTREAM_ERROR";
+}
+/**
+* The text of a refusal the proxy's middleware sent instead of a send
+* response: `{ error: string, message?: string }`. `message` is the
+* sentence written for a person (the capability gate's "This Void platform
+* does not enable email."); `error` is the short code every such refusal
+* carries. `null` when the body is not that shape.
+*/
+function readProxyRefusal(body) {
+	if (typeof body !== "object" || body === null || Array.isArray(body)) return null;
+	const { error, message } = body;
+	if (typeof error !== "string" || error === "") return null;
+	return typeof message === "string" && message !== "" ? message : error;
+}
+function isValidProxyResponse(b) {
+	if (typeof b !== "object" || b === null) return false;
+	const r = b;
+	if (r.ok === true && Array.isArray(r.ids)) return true;
+	if (r.ok === false && typeof r.error === "object" && r.error !== null) return true;
+	if (r.ok === false && Array.isArray(r.deliveries)) return true;
+	return false;
+}
+/**
+* Validate a per-recipient list from the proxy against the recipients this
+* send asked for. Both list-bearing responses go through here — `ids` on
+* `ok: true` and `deliveries` on a mid-batch `ok: false` — so the two cannot
+* drift: the proxy builds both from the same per-recipient list, one entry
+* per requested address, and a caller following the documented retry
+* pattern (retry only `ok: false` entries) can act on an outcome only if
+* every recipient has one.
+*
+* The rules shared by both shapes: the count equals the recipients sent;
+* every entry is an object naming a requested recipient exactly once. The
+* list is compared as a set against the unique, lowercased recipients the
+* request carried and returned in the order the proxy gave it — order is
+* not part of the contract (the proxy lists allowlist rejections before the
+* sends it attempted). `readEntry` decides the rest of the entry's shape and
+* returns `undefined` when it does not hold; `shape` names that shape in the
+* reason.
+*
+* Anything else is a schema-skewed or corrupt proxy and is refused as a
+* whole rather than trimmed to the entries that parse: a dropped entry is a
+* recipient whose outcome the caller can neither trust nor retry. Entries
+* are named by index only — the body is attached as `cause`, and a recipient
+* string from a corrupt response is not a value to interpolate into an
+* error message.
+*/
+function readRecipientList(raw, recipients, shape, readEntry) {
+	if (raw.length !== recipients.length) return {
+		ok: false,
+		reason: `expected ${recipients.length} deliveries, got ${raw.length}`
+	};
+	const requested = new Set(recipients);
+	const seen = /* @__PURE__ */ new Set();
+	const entries = [];
+	for (const [i, d] of raw.entries()) {
+		const entry = typeof d === "object" && d !== null ? d : null;
+		const recipient = entry?.recipient;
+		if (entry === null || typeof recipient !== "string") return {
+			ok: false,
+			reason: `entry ${i} is not ${shape}`
+		};
+		const value = readEntry(entry, recipient);
+		if (value === void 0) return {
+			ok: false,
+			reason: `entry ${i} is not ${shape}`
+		};
+		if (!requested.has(recipient)) return {
+			ok: false,
+			reason: `entry ${i} names a recipient that was not requested`
+		};
+		if (seen.has(recipient)) return {
+			ok: false,
+			reason: `entry ${i} repeats a recipient`
+		};
+		seen.add(recipient);
+		entries.push(value);
+	}
+	return {
+		ok: true,
+		entries
+	};
+}
+/**
+* The `ids` list of an `ok: true` response. The proxy answers `ok: true`
+* only once every requested recipient passed its allowlist and
+* `SEND_EMAIL.send()` confirmed each one, so every entry is
+* `{ recipient, messageId }` with `messageId` always a string (`''` when
+* Cloudflare returned none; that is the proxy's explicit convention, and the
+* framework's own Message-ID stands in for it). An `ok: true` with a
+* delivery missing would tell the caller a send was confirmed when it never
+* was, and a success carries no per-recipient failure to retry from.
+*/
+function readDeliveryList(raw, recipients, fallbackId) {
+	return readRecipientList(raw, recipients, "{ recipient: string, messageId: string }", (entry, recipient) => typeof entry.messageId === "string" ? {
+		recipient,
+		messageId: entry.messageId || fallbackId
+	} : void 0);
+}
+/**
+* The `deliveries` list of a mid-batch `ok: false` response. Each entry is
+* either a confirmed send (`ok: true`, `messageId` a string with the same
+* `''` convention as above) or a failure (`ok: false`, `error` with a string
+* `message`; the code is coerced, unknown values become `UPSTREAM_ERROR`).
+* Both are the proxy's own outcome for that recipient; `ok` is what the
+* caller retries on, so an entry that does not state it is not an outcome
+* at all — treating it as failed would retry a recipient that may have been
+* delivered, and treating it as delivered would silently lose one.
+*/
+function readFailureDeliveries(raw, recipients, fallbackId) {
+	return readRecipientList(raw, recipients, "{ recipient: string, ok: true, messageId: string } | { recipient: string, ok: false, error: { message: string } }", (entry, recipient) => {
+		if (entry.ok === true) return typeof entry.messageId === "string" ? {
+			recipient,
+			ok: true,
+			messageId: entry.messageId || fallbackId
+		} : void 0;
+		if (entry.ok === false) {
+			const error = entry.error;
+			return typeof error === "object" && error !== null && typeof error.message === "string" ? {
+				recipient,
+				ok: false,
+				error: makeError(coerceErrorCode(error.code), error.message)
+			} : void 0;
+		}
+	});
+}
+async function readResponseAsResult(res, recipients, fallbackId) {
+	try {
+		let body;
+		try {
+			body = await res.json();
+		} catch {
+			return err("UPSTREAM_ERROR", `email: proxy returned ${res.status} with non-JSON body`);
+		}
+		if (!isValidProxyResponse(body)) {
+			const refusal = readProxyRefusal(body);
+			if (!res.ok && refusal !== null) return err("UPSTREAM_ERROR", `email: proxy returned ${res.status}: ${refusal}`, body);
+			return err("UPSTREAM_ERROR", `email: proxy returned malformed response (status ${res.status})`, body);
+		}
+		const malformedList = (reason) => err("UPSTREAM_ERROR", `email: proxy returned a malformed delivery list (${reason})`, body);
+		if (body.ok === true) {
+			const list = readDeliveryList(body.ids, recipients, fallbackId);
+			return list.ok ? {
+				ok: true,
+				ids: list.entries
+			} : malformedList(list.reason);
+		}
+		const failure = body;
+		if ("error" in failure && failure.error) {
+			const e = failure.error;
+			return err(coerceErrorCode(e.code), typeof e.message === "string" ? e.message : "email: upstream send failed");
+		}
+		const list = readFailureDeliveries(failure.deliveries, recipients, fallbackId);
+		return list.ok ? {
+			ok: false,
+			deliveries: list.entries
+		} : malformedList(list.reason);
+	} catch (e) {
+		return err("UPSTREAM_ERROR", `email: failed to parse proxy response (status ${res.status}): ${e instanceof Error ? e.message : String(e)}`, e);
+	}
+}
+/**
+* Resolve the loopback into the `void dev` inbox, or `undefined` outside dev.
+*
+* `DEV_INBOX_ENV_VAR` is injected only when `viteCommand === 'serve'` and it
+* names the worker's assets binding. In dev, `@cloudflare/vite-plugin` binds
+* that name to a miniflare service whose implementation is the Vite dev
+* server's Node middleware stack, so a fetch through it lands on the inbox
+* middleware in the dev-server process — the only place the buffer exists.
+* In a production build neither the var nor that wiring is present.
+*/
+function resolveDevInbox(env) {
+	const bindingName = env?.[DEV_INBOX_ENV_VAR];
+	if (typeof bindingName !== "string" || bindingName.length === 0) return;
+	const binding = env?.[bindingName];
+	if (typeof binding !== "object" || binding === null) return;
+	if (typeof binding.fetch !== "function") return;
+	const token = env?.[DEV_INBOX_TOKEN_ENV_VAR];
+	return {
+		fetcher: binding,
+		token: typeof token === "string" && token.length > 0 ? token : void 0
+	};
+}
+const DEV_INBOX_TIMEOUT_MS = 5e3;
+/** Bound on the error text a failed capture echoes from the dev server. */
+const DEV_INBOX_ERROR_EXCERPT_CHARS = 200;
+const DEV_INBOX_ERROR_EXCERPT_TIMEOUT_MS = 1e3;
+/**
+* First line of a refusal, so a 401 names the header it wanted. Reads ONE
+* chunk under its own deadline: the main 5s race has already settled by the
+* time the status is known, and a body that never arrives must not turn a
+* clean error into a hung `sendEmail`.
+*/
+async function readErrorExcerpt(res) {
+	let timer;
+	try {
+		const reader = res.body?.getReader();
+		if (!reader) return "";
+		const first = await Promise.race([reader.read().then(({ value }) => value), new Promise((resolve) => {
+			timer = setTimeout(() => resolve(void 0), DEV_INBOX_ERROR_EXCERPT_TIMEOUT_MS);
+		})]);
+		reader.cancel().catch(() => {});
+		if (!first) return "";
+		return new TextDecoder().decode(first).trim().split("\n")[0].slice(0, DEV_INBOX_ERROR_EXCERPT_CHARS);
+	} catch {
+		return "";
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+	}
+}
+async function postToDevInbox(inbox, captured) {
+	let timer;
+	try {
+		const attempt = Promise.resolve(inbox.fetcher.fetch(`http://localhost${DEV_INBOX_CAPTURE_URL}`, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				...inbox.token !== void 0 && { ["x-void-dev-trigger"]: inbox.token }
+			},
+			body: serializeCapturedMessage(captured)
+		})).then((res) => ({
+			kind: "response",
+			res
+		}), (cause) => ({
+			kind: "error",
+			cause
+		}));
+		const settled = await Promise.race([attempt, new Promise((resolve) => {
+			timer = setTimeout(() => resolve({ kind: "timeout" }), DEV_INBOX_TIMEOUT_MS);
+		})]);
+		if (settled.kind === "timeout") return {
+			ok: false,
+			reason: `no response within ${DEV_INBOX_TIMEOUT_MS}ms`
+		};
+		if (settled.kind === "error") {
+			const cause = settled.cause;
+			return {
+				ok: false,
+				reason: cause instanceof Error ? cause.message : String(cause)
+			};
+		}
+		const { res } = settled;
+		if (!res.ok) {
+			const excerpt = await readErrorExcerpt(res);
+			return {
+				ok: false,
+				reason: `dev server responded ${res.status}${excerpt ? `: ${excerpt}` : ""}`
+			};
+		}
+		if (res.headers.get("x-void-email-inbox") !== "captured") return {
+			ok: false,
+			reason: "response did not come from the dev inbox"
+		};
+		return { ok: true };
+	} catch (e) {
+		return {
+			ok: false,
+			reason: e instanceof Error ? e.message : String(e)
+		};
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+	}
+}
+/**
+* Shared result shape for both capture paths (in-process sink and dev inbox).
+*
+* `ids` is built from the same deduplicated, lowercased list the two
+* production transports send to, so code written against a captured result
+* sees exactly what a deploy returns: one entry per unique address, keyed the
+* way `sendViaBinding` and the proxy report it. Mapping every `to`/`cc`/`bcc`
+* occurrence instead handed a test or `void dev` handler one success per
+* occurrence in its original case — deliveries that never happen once
+* deployed. The captured message itself keeps the original fields; the
+* inbox displays what was asked for, the result reports what would be sent.
+*/
+function capturedResult(normalized, captureId) {
+	const recipients = uniqueRecipients(normalized);
+	if (recipients.length === 0) return err("INVALID_TO", "email: 'to' must include at least one recipient.");
+	return {
+		ok: true,
+		ids: recipients.map((recipient) => ({
+			recipient,
+			messageId: captureId
+		}))
+	};
+}
+/**
+* Send an email via the Void platform proxy.
+*
+* During `void dev` the message is captured by the local inbox
+* (`/__void/inbox`) and never reaches the proxy; an in-process sink
+* (`void/email/testing`) takes precedence over it. Pass `sendInDev: true` to
+* override for a single call.
+*/
+async function sendEmail(opts) {
+	const resolvedOpts = resolveDefaultFrom(opts);
+	if (resolvedOpts.from === void 0) return err("INVALID_FROM", "email: 'from' is required. Set it explicitly or deploy via Void so the platform-injected __VOID_PROJECT_SLUG and __VOID_EMAIL_DOMAIN can default it to <slug>+noreply@<domain>.");
+	const optsWithFrom = resolvedOpts;
+	let normalized;
+	try {
+		normalized = await normalizeEmail(optsWithFrom);
+	} catch (e) {
+		if (e instanceof MimeError) return err(e.code, e.message, e);
+		return err("MIME_ERROR", e instanceof Error ? e.message : String(e), e);
+	}
+	let raw;
+	let messageId;
+	try {
+		const built = buildMime(normalized);
+		raw = built.raw;
+		messageId = built.messageId;
+	} catch (e) {
+		if (e instanceof MimeError) return err(e.code, e.message, e);
+		return err("MIME_ERROR", e instanceof Error ? e.message : String(e), e);
+	}
+	const rawEnv = tryGetRawRuntimeEnv();
+	if (!opts.sendInDev && hasActiveSink()) {
+		const captured = captureMessage(normalized, raw, messageId);
+		dispatchToSinks(captured);
+		return capturedResult(normalized, captured.id);
+	}
+	const devInbox = opts.sendInDev ? void 0 : resolveDevInbox(rawEnv);
+	if (devInbox) {
+		const captured = captureMessage(normalized, raw, messageId);
+		const delivered = await postToDevInbox(devInbox, captured);
+		if (delivered.ok) return capturedResult(normalized, captured.id);
+		const message = `email: the void dev inbox at ${DEV_INBOX_CAPTURE_URL} is unreachable (${delivered.reason}), so nothing was captured and nothing was sent.`;
+		console.warn(`[void/email] ${message}`);
+		return err("UPSTREAM_ERROR", message);
+	}
+	const recipients = uniqueRecipients(normalized);
+	if (recipients.length === 0) return err("INVALID_TO", "email: 'to' must include at least one recipient.");
+	const sendBinding = resolveSendEmailBinding(rawEnv);
+	if (sendBinding) return sendViaBinding(sendBinding, normalized.from.email, recipients, raw, messageId);
+	const env = rawEnv;
+	const proxy = env?.__VOID_PROXY;
+	const projectId = env?.__PROJECT_ID;
+	const proxyToken = env?.__VOID_PROXY_TOKEN;
+	if (!proxy || !projectId || !proxyToken) return err("BINDING_MISSING", "email: neither SEND_EMAIL nor __VOID_PROXY is available, so nothing was sent. Deploy via Void to bind the platform proxy, or set `email.from` in void.json so `void deploy --platform cloudflare` provisions the SEND_EMAIL binding. Under `void dev` messages are captured by the local inbox at /__void/inbox instead — reaching this error there means that path was bypassed (`sendInDev: true`, which does not deliver: `void dev` binds no send transport at all, so there is nothing to fall through to) or unavailable (the worker has no assets binding to reach the dev server through).");
+	const requestId = newRequestId();
+	const fromDomain = normalized.from.email.split("@")[1] ?? "";
+	const body = {
+		projectId,
+		aiToken: proxyToken,
+		proxyToken,
+		from: normalized.from.email,
+		recipients,
+		mimeBase64: bytesToBase64(raw),
+		byteSize: raw.byteLength,
+		requestId,
+		fromDomain
+	};
+	let res;
+	try {
+		res = await proxy.fetch("https://email-proxy/email/send", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(body)
+		});
+	} catch (e) {
+		return err("UPSTREAM_ERROR", `email: proxy unreachable: ${e instanceof Error ? e.message : String(e)}`, e);
+	}
+	return readResponseAsResult(res, recipients, messageId);
+}
+/**
+* Build a normalized email + raw MIME for advanced callers who want to feed
+* the message into a custom transport. Throws on invalid input.
+*/
+async function createEmail(opts) {
+	if (opts.from === void 0) throw new MimeError("INVALID_FROM", "createEmail: 'from' is required (this entrypoint does not apply __VOID_PROJECT_SLUG defaulting).");
+	const email = await normalizeEmail(opts);
+	return {
+		email,
+		...buildMime(email)
+	};
+}
+//#endregion
+export { MimeError, ParseEmailError, createEmail, createMessageProxy, defineEmail, enactEmailActions, isForwardableEmailMessage, parseEmail, replyEmail, sendEmail };

package/dist/runtime/env-helpers.d.mts

@@ -1,2 +1,2 @@
-import { a as getSecretOverride, c as oneOf, i as email, l as string, n as SECRET_OVERRIDE_SYMBOL, o as json, r as boolean, s as number, t as EnvSchema, u as url } from "../env-helpers-z4stu8uc.mjs";
-export { EnvSchema, SECRET_OVERRIDE_SYMBOL, boolean, email, getSecretOverride, json, number, oneOf, string, url };
+import { a as number, c as url, i as json, n as boolean, o as oneOf, r as email, s as string, t as EnvSchema } from "../env-helpers-CyKtOBpj.mjs";
+export { EnvSchema, boolean, email, json, number, oneOf, string, url };

package/dist/runtime/env-helpers.mjs

@@ -1,22 +1,6 @@
 //#region src/runtime/env-helpers.ts
-/**
-* Marker property read by the mask helpers. Present only on built-in
-* schema builders; third-party Standard Schema validators fall back to the
-* name/value heuristic (documented in `docs/guide/env-vars.md`).
-*/
-const SECRET_OVERRIDE_SYMBOL = Symbol.for("void.env.secretOverride");
-/**
-* Pull the explicit `.secret()` / `.public()` flag off a Standard Schema
-* validator, if it was authored through our built-in helpers. Returns
-* `undefined` for third-party validators (valibot, zod, arktype, …) —
-* they are redacted purely via the heuristic.
-*/
-function getSecretOverride(validator) {
-	if (!validator || typeof validator !== "object") return;
-	return validator[SECRET_OVERRIDE_SYMBOL];
-}
 function build(parse, state) {
-	const schema = {
+	return {
 		"~standard": {
 			version: 1,
 			vendor: "void",
@@ -34,41 +18,20 @@ function build(parse, state) {
 		optional() {
 			return build(parse, {
 				optional: true,
-				defaultValue: state.defaultValue,
-				secretOverride: state.secretOverride
+				defaultValue: state.defaultValue
 			});
 		},
 		default(value) {
 			return build(parse, {
 				optional: false,
-				defaultValue: value,
-				secretOverride: state.secretOverride
-			});
-		},
-		secret() {
-			return build(parse, {
-				...state,
-				secretOverride: "secret"
-			});
-		},
-		public() {
-			return build(parse, {
-				...state,
-				secretOverride: "public"
+				defaultValue: value
 			});
 		}
 	};
-	Object.defineProperty(schema, SECRET_OVERRIDE_SYMBOL, {
-		value: state.secretOverride,
-		enumerable: false,
-		configurable: true
-	});
-	return schema;
 }
 const empty = () => ({
 	optional: false,
-	defaultValue: void 0,
-	secretOverride: void 0
+	defaultValue: void 0
 });
 /** Required string env value. */
 function string() {
@@ -170,4 +133,4 @@ function json() {
 	}, empty());
 }
 //#endregion
-export { SECRET_OVERRIDE_SYMBOL, boolean, email, getSecretOverride, json, number, oneOf, string, url };
+export { boolean, email, json, number, oneOf, string, url };

package/dist/runtime/env-public-client.d.mts

@@ -1,15 +1,14 @@
-import { c as oneOf, i as email, l as string, o as json, r as boolean, s as number, t as EnvSchema, u as url } from "../env-helpers-z4stu8uc.mjs";
-
+import { a as number, c as url, i as json, n as boolean, o as oneOf, r as email, s as string, t as EnvSchema } from "../env-helpers-CyKtOBpj.mjs";
 //#region src/runtime/env-public-client.d.ts
-declare const env: Record<string, unknown>;
+export declare const env: Record<string, unknown>;
 /**
-* In client builds `defineEnv` is a no-op identity function — schema
-* registration only happens server-side. We still return the `env` proxy so
-* t3-style `export const env = defineEnv({...})` keeps working in shared
-* modules.
-*/
-declare function defineEnv<S>(_schema: S): typeof env;
-declare class EnvValidationError extends Error {
+ * In client builds `defineEnv` is a no-op identity function — schema
+ * registration only happens server-side. We still return the `env` proxy so
+ * t3-style `export const env = defineEnv({...})` keeps working in shared
+ * modules.
+ */
+export declare function defineEnv<S>(_schema: S): typeof env;
+export declare class EnvValidationError extends Error {
   readonly key: string;
   readonly issues: Array<{
     message: string;
@@ -19,4 +18,4 @@ declare class EnvValidationError extends Error {
   }>);
 }
 //#endregion
-export { type EnvSchema, EnvValidationError, boolean, defineEnv, email, env, json, number, oneOf, string, url };
+export { type EnvSchema, boolean, email, json, number, oneOf, string, url };

package/dist/runtime/env-public-client.mjs

@@ -6,7 +6,7 @@ function getClientEnv() {
 function readClientKey(key) {
 	const meta = getClientEnv();
 	if (meta && key in meta) return meta[key];
-	throw new Error(`env: Key '${key}' is not exposed to the client. Vite only injects keys matching the configured envPrefix (default: VITE_*). Either rename the key in env.ts to match envPrefix, or move this access to a server module.`);
+	throw new Error(`env: Key '${key}' is not exposed to the client. Void only exposes VITE_* schema keys to browser code. Either rename the key in env.ts with that prefix, or move this access to a server module.`);
 }
 const env = new Proxy({}, {
 	get(_target, key) {