void 0.10.12 → 0.20.0

package/dist/env-helpers-z4stu8uc.d.mts

@@ -1,52 +0,0 @@
-import { t as StandardSchemaV1 } from "./standard-schema-DJ0HW7QP.mjs";
-
-//#region src/shared/env-mask.d.ts
-/** Per-key override set by `.secret()` / `.public()` on built-in helpers. */
-type SecretOverride = "secret" | "public" | undefined;
-//#endregion
-//#region src/runtime/env-helpers.d.ts
-/**
-* Marker property read by the mask helpers. Present only on built-in
-* schema builders; third-party Standard Schema validators fall back to the
-* name/value heuristic (documented in `docs/guide/env-vars.md`).
-*/
-declare const SECRET_OVERRIDE_SYMBOL: unique symbol;
-/**
-* Pull the explicit `.secret()` / `.public()` flag off a Standard Schema
-* validator, if it was authored through our built-in helpers. Returns
-* `undefined` for third-party validators (valibot, zod, arktype, …) —
-* they are redacted purely via the heuristic.
-*/
-declare function getSecretOverride(validator: {
-  [SECRET_OVERRIDE_SYMBOL]?: SecretOverride;
-} | unknown): SecretOverride;
-type EnvSchema<T> = StandardSchemaV1<unknown, T> & {
-  optional(): EnvSchema<T | undefined>;
-  default(value: NonNullable<T>): EnvSchema<NonNullable<T>>;
-  /**
-  * Force redaction of this key's value in every validation/error surface,
-  * regardless of the key-name / value-content heuristics.
-  */
-  secret(): EnvSchema<T>;
-  /**
-  * Opt this key out of redaction — useful for public config (URLs, app
-  * titles) that happens to match the heuristic (`PUBLIC_KEY`, `…_TOKEN_URL`).
-  */
-  public(): EnvSchema<T>;
-};
-/** Required string env value. */
-declare function string(): EnvSchema<string>;
-/** Numeric env value. Parses with `Number(raw)`; rejects NaN. */
-declare function number(): EnvSchema<number>;
-/** Boolean env value. Accepts "true"/"false"/"1"/"0" (case-insensitive). */
-declare function boolean(): EnvSchema<boolean>;
-/** URL string — validated via `new URL(raw)`. */
-declare function url(): EnvSchema<string>;
-/** Email string — basic shape validation. */
-declare function email(): EnvSchema<string>;
-/** One of a fixed set of literal string values. */
-declare function oneOf<const Values extends Array<string>>(values: Values): EnvSchema<Values[number]>;
-/** JSON-parsed env value. Specify `T` to type the parsed result. */
-declare function json<T = unknown>(): EnvSchema<T>;
-//#endregion
-export { getSecretOverride as a, oneOf as c, email as i, string as l, SECRET_OVERRIDE_SYMBOL as n, json as o, boolean as r, number as s, EnvSchema as t, url as u };

package/dist/env-mask-Dd47NbR6.mjs

@@ -1,90 +0,0 @@
-//#region src/shared/env-mask.ts
-/**
-* Secret redaction helpers for env-validation output.
-*
-* Values are redacted (replaced with `<redacted>`) whenever they flow into
-* a user-visible string — `EnvValidationError` messages, CLI reports, the
-* dev-server warning block. The key name is never masked (the user needs
-* it to locate the offending entry).
-*
-* Redaction is belt-and-braces:
-*   1. An explicit `.secret()` / `.public()` flag on a schema entry wins.
-*   2. Otherwise, a key-name regex (`KEY|TOKEN|SECRET|…`) redacts anything
-*      that looks like credentials.
-*   3. Even on non-secret keys, a value that itself looks high-entropy
-*      (`sk_…`, `ghp_…`, ≥24 characters of mixed alphanumerics) is redacted
-*      — catches wrong-file typos like `PORT=sk_live_abc123`.
-*
-* Users can opt out of the guard for local debugging via
-* `VOID_ENV_UNMASK=1` in the environment; that path prints a one-shot
-* notice on stderr so the loosened output is visibly attributed.
-*
-* This module is a leaf — no imports from non-leaf modules, safe to reach
-* from both the runtime (worker bundle) and the CLI host.
-*/
-/** Sentinel emitted in place of a redacted value. */
-const REDACTED = "<redacted>";
-/** Environment variable that disables redaction when set to `1`. */
-const UNMASK_ENV_VAR = "VOID_ENV_UNMASK";
-/**
-* Regex matching env key names that almost always carry secrets.
-* Case-insensitive; matched as a substring anywhere in the key.
-*/
-const SECRET_KEY_RE = /KEY|TOKEN|SECRET|PASSWORD|PASS(WD)?|CREDENTIAL|PRIVATE|AUTH|BEARER|APIKEY|DSN/i;
-/** Common secret value prefixes (Stripe, GitHub, Slack, AWS, …). */
-const SECRET_VALUE_PREFIX_RE = /^(sk|pk|ghp|xoxb|AKIA)/i;
-/** High-entropy alphanumeric string of ≥24 chars. */
-const HIGH_ENTROPY_RE = /^[A-Za-z0-9_\-+/=.:]{24,}$/;
-/** `true` when the key name heuristically denotes a secret. */
-function isLikelySecretKey(name) {
-	return SECRET_KEY_RE.test(name);
-}
-/**
-* `true` when the value looks like a credential regardless of key name.
-* Err on the side of redacting — a false positive hides one non-secret
-* debugging hint, a false negative pastes a token into a GitHub issue.
-*/
-function isLikelySecretValue(value) {
-	if (typeof value !== "string" || value.length === 0) return false;
-	return SECRET_VALUE_PREFIX_RE.test(value) || HIGH_ENTROPY_RE.test(value);
-}
-/**
-* Redact every occurrence of `raw` inside a validator-produced `message`
-* when the key should be masked. Built-in helpers embed the raw value in
-* their error strings (e.g. `Expected a number, got "not-a-number"`); we
-* scrub those after the fact so third-party Standard Schema libraries —
-* which have their own message format — also get reasonable redaction as
-* long as the offending value was a secret-looking literal.
-*/
-function redactMessage(key, rawValue, message, options = {}) {
-	if (options.unmask) return message;
-	if (!(options.override === "secret" || options.override !== "public" && (isLikelySecretKey(key) || isLikelySecretValue(rawValue)))) return message;
-	if (typeof rawValue !== "string" || rawValue.length === 0) return message;
-	return message.split(rawValue).join(REDACTED);
-}
-let unmaskResolved = null;
-let unmaskNoticeShown = false;
-/**
-* Resolve the effective unmask flag, consulting `process.env` exactly once
-* per process. On the first affirmative read, we print a one-shot notice to
-* stderr so CI logs clearly show the guard is off.
-*/
-function isUnmaskActive() {
-	if (unmaskResolved !== null) return unmaskResolved;
-	let active = false;
-	try {
-		active = globalThis.process?.env?.[UNMASK_ENV_VAR] === "1";
-	} catch {
-		active = false;
-	}
-	unmaskResolved = active;
-	if (active && !unmaskNoticeShown) {
-		unmaskNoticeShown = true;
-		try {
-			console.error(`[void/env] ${UNMASK_ENV_VAR}=1 is set — env validation errors will include raw values. Unset it before sharing logs.`);
-		} catch {}
-	}
-	return active;
-}
-//#endregion
-export { isUnmaskActive as n, redactMessage as r, isLikelySecretKey as t };

package/dist/env-public-BfiLcMBk.d.mts

@@ -1,140 +0,0 @@
-import { t as StandardSchemaV1 } from "./standard-schema-DJ0HW7QP.mjs";
-
-//#region src/runtime/env-public.d.ts
-type AnyValidator = StandardSchemaV1<unknown, unknown>;
-type AnySchema = Record<string, AnyValidator>;
-/**
-* Type-only stub for the validated env shape. Augmented by the generated
-* `.void/env.d.ts` so `env.X` is typed per the user's schema. Includes an
-* index signature so untyped property access returns `unknown` (rather than
-* a hard error) for bindings and keys not declared in the schema.
-*/
-interface ValidatedEnv {
-  readonly [key: string]: unknown;
-}
-type InferEnv<S extends AnySchema> = { readonly [K in keyof S]: StandardSchemaV1.InferOutput<S[K]> };
-/**
-* Register an env schema and return the typed `env` proxy.
-*
-* Calling `defineEnv` is the only required step — Void auto-discovers
-* `env.ts` at project root, imports it, and uses the schema for runtime
-* validation, type generation, and deploy-time secret checks.
-*
-* The return value is identical to the `env` export from `void/env`.
-* Re-export it from your `env.ts` if you prefer the explicit
-* `import { env } from "~/env"` pattern.
-*/
-declare function defineEnv<S extends AnySchema>(schema: S): InferEnv<S>;
-/**
-* Internal: validate the entire schema against the worker's actual env on
-* the first request per isolate. Catches bad remote-secret values and
-* post-deploy drift that the deploy CLI can't see (it only knows secret
-* names, not their values).
-*
-* Spliced into the generated worker entry by `compileWorkerEntry`. Cached
-* after the first call so subsequent requests pay no cost.
-*
-* Async lifecycle: this function awaits any async Standard Schema
-* validators (zod `refine`, arktype async narrows, etc.) and seeds the
-* per-key cache with the resolved values. Subsequent reads via `env.X`
-* hit the sync cache — async work only happens here, at boot. If a user
-* accesses `env.X` for a key with an async validator *before* this
-* function has run (e.g. during module-top-level code), the proxy will
-* throw with guidance pointing back to this boot-time pre-validation.
-*/
-declare function _validateEnvOnce(envValues: unknown): Promise<void>;
-/** Internal: framework-only access to the registered schema (for plugin/CLI). */
-declare function _getRegisteredSchema(): AnySchema | null;
-/**
-* Internal: returns `true` once `defineEnv()` has been called at least once,
-* regardless of whether the caller passed an empty schema. Gives tooling a
-* reliable signal — `_getRegisteredSchema()` alone can't distinguish
-* `defineEnv({})` (an intentional empty schema) from "never called".
-*/
-declare function _hasRegisteredSchema(): boolean;
-/**
-* Internal: extract `.default(value)` values from the registered schema as
-* stringified env values. Used by the plugin and deploy CLI to seed worker
-* `vars` so `c.env.X` and `process.env.X` see the same fallback that the
-* typed `env.X` proxy returns.
-*
-* Detection is schema-agnostic: probe each validator with `undefined` and,
-* if it succeeds with a non-undefined value, that value is the default.
-* Works for our built-in `.default(...)` helpers and for any Standard
-* Schema validator with intrinsic default behaviour. Async validators are
-* skipped (we can't get a sync default).
-*
-* Keys with no default — required keys, plain `.optional()` — are omitted
-* from the result so they don't shadow user `.env*` entries with empty
-* strings.
-*/
-declare function _getSchemaDefaults(): Record<string, string>;
-declare class EnvValidationError extends Error {
-  readonly key: string;
-  readonly issues: Array<StandardSchemaV1.Issue>;
-  constructor(key: string, issues: Array<StandardSchemaV1.Issue>);
-}
-/**
-* Typed env proxy. Reads from the runtime env, validating declared keys
-* on first access and passing through bindings / unknown keys unchanged.
-*
-* Sync-only: the `get` trap must be synchronous, so validators that return
-* a `Promise` cannot be awaited here. For async Standard Schema validators,
-* `_validateEnvOnce()` pre-resolves them at worker boot and seeds the
-* per-env cache; property reads then serve the cached value synchronously.
-* If an async validator is encountered here without a prior pre-validation,
-* the trap throws with guidance on how to resolve it.
-*/
-declare const env: ValidatedEnv;
-/** Aggregate report from validating an entire env object against the schema. */
-type EnvValidationReport = {
-  valid: boolean;
-  missing: Array<string>;
-  invalid: Array<{
-    key: string;
-    messages: Array<string>;
-  }>;
-  /**
-  * Resolved values for keys that validated successfully. Used to seed the
-  * per-env cache after async pre-validation so sync `env.X` reads hit the
-  * cache.
-  */
-  values: Map<string, unknown>;
-};
-/**
-* Validate an env record (e.g. merged `.env*` + remote secret list) against
-* the registered schema. Used by the dev plugin (warnings), the deploy CLI
-* (hard error), and `_validateEnvOnce` at worker boot.
-*
-* Async: awaits any validators that return a `Promise` (zod async refines,
-* arktype narrows, etc.). Callers already run in async contexts.
-*/
-declare function validateAllEnv(envValues: Record<string, unknown>): Promise<EnvValidationReport>;
-declare global {
-  namespace Cloudflare {
-    interface Env {
-      DB: D1Database;
-      KV: KVNamespace;
-      STORAGE: R2Bucket;
-      AI: Ai;
-      SANDBOX: DurableObjectNamespace<import("@cloudflare/sandbox").Sandbox>;
-      /** @internal Service binding to proxy worker (AI, revalidation, future features) */
-      __VOID_PROXY?: Fetcher;
-      /** @internal Custom proxy URL override */
-      __VOID_PROXY_URL?: string;
-      /** @internal Auth token for HTTP proxy (local dev) */
-      __VOID_TOKEN?: string;
-      /** @internal Project ID for HTTP proxy (local dev) */
-      __VOID_PROJECT_ID?: string;
-      /** @internal Staging environment flag */
-      __VOID_STAGING?: string;
-      /** @internal Project ID (service binding path) */
-      __PROJECT_ID?: string;
-      /** @internal Proxy token (service binding path) */
-      __VOID_PROXY_TOKEN?: string;
-      [key: `QUEUE_${string}`]: Queue<unknown> | undefined;
-    }
-  }
-}
-//#endregion
-export { _getSchemaDefaults as a, defineEnv as c, _getRegisteredSchema as i, env as l, EnvValidationReport as n, _hasRegisteredSchema as o, ValidatedEnv as r, _validateEnvOnce as s, EnvValidationError as t, validateAllEnv as u };

package/dist/link-CdGHSIy-.mjs

@@ -1,45 +0,0 @@
-import { D as outro, T as log, a as cliTitle, u as import_picocolors, w as intro, x as cancel } from "./agents-CtgBYqld.mjs";
-import { S as writeProjectConfig, b as readProjectConfig, d as getSiteDomain, f as getToken, n as PlatformClient } from "./client-Gb71-XkG.mjs";
-import { n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-DsYvl3TB.mjs";
-import { r as resolveProjectBySlug } from "./resolve-project-BBMtLLV9.mjs";
-//#region src/cli/link.ts
-async function runLink(root, slug) {
-	console.log();
-	intro(cliTitle("project link"));
-	const existing = readProjectConfig(root);
-	if (existing) {
-		log.warn(`Already linked to ${import_picocolors.default.blue(existing.slug)}.${getSiteDomain(root)}`);
-		outro("To re-link, delete .void/project.json and run again.");
-		return;
-	}
-	const token = getToken(root);
-	if (!token) {
-		cancel("No auth token found. Run `void auth login` first.");
-		process.exit(1);
-	}
-	const client = new PlatformClient(token, { root });
-	const projects = await client.listProjects();
-	if (slug) {
-		const config = resolveProjectBySlug(projects, slug);
-		if (!config) {
-			cancel(`project: No project found with slug '${slug}'.`);
-			process.exit(1);
-		}
-		writeProjectConfig(root, config);
-		outro(`Linked to ${import_picocolors.default.blue(config.slug)}.${getSiteDomain(root)}`);
-		return;
-	}
-	const result = await promptProjectSelection(projects, "Select a project:", root, { confirmExisting: true });
-	if (result.action === "create") {
-		const config = await promptAndCreateProject(root, client);
-		outro(`Created and linked to ${import_picocolors.default.blue(config.slug)}.${getSiteDomain(root)}`);
-		return;
-	}
-	writeProjectConfig(root, {
-		projectId: result.project.id,
-		slug: result.project.slug
-	});
-	outro(`Linked to ${import_picocolors.default.blue(result.project.slug)}.${getSiteDomain(root)}`);
-}
-//#endregion
-export { runLink };