void 0.26.1 → 0.28.0

package/dist/email-protocol-D9nTvhCp.mjs

@@ -0,0 +1,82 @@
+import { EMAIL_PROTOCOL_VERSION, encodeEmailActions, readEmailEnvelope } from "@void/platform/email-protocol";
+//#region src/runtime/email-protocol.ts
+const RECEIPT_VERIFICATION_DEADLINE_MS = 5e3;
+const MAX_RECEIPT_VERIFICATION_BYTES = 2048;
+const decoder = new TextDecoder("utf-8", {
+	fatal: true,
+	ignoreBOM: false
+});
+/**
+* Settle `run()` within `ms`, or reject with `onTimeout()`. `run` is not
+* called when `ms` has already elapsed.
+*/
+async function withTimeout(ms, run, onTimeout) {
+	if (ms <= 0) throw onTimeout();
+	let timer;
+	try {
+		return await Promise.race([run(), new Promise((_, reject) => {
+			timer = setTimeout(() => reject(onTimeout()), ms);
+		})]);
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+	}
+}
+/**
+* Read a JSON body of at most `maxBytes`, each read bounded by `race`. A
+* declared length must be exact.
+*/
+async function readBoundedJson(response, maxBytes, race, { rejectEncoding = false } = {}) {
+	const declared = response.headers.get("content-length");
+	if (rejectEncoding && response.headers.has("content-encoding") || declared !== null && (!/^\d+$/.test(declared) || Number(declared) > maxBytes)) {
+		response.body?.cancel().catch(() => {});
+		throw new Error("email response refused before reading");
+	}
+	const reader = response.body?.getReader();
+	if (!reader) throw new Error("email response is empty");
+	const bytes = new Uint8Array(maxBytes);
+	let size = 0;
+	try {
+		for (;;) {
+			const chunk = await race(() => reader.read());
+			if (chunk.done) break;
+			if (size + chunk.value.byteLength > maxBytes) throw new Error("email response too large");
+			bytes.set(chunk.value, size);
+			size += chunk.value.byteLength;
+		}
+	} finally {
+		reader.cancel().catch(() => {});
+		try {
+			reader.releaseLock();
+		} catch {}
+	}
+	if (declared !== null && size !== Number(declared)) throw new Error("email response length mismatch");
+	return JSON.parse(decoder.decode(bytes.subarray(0, size)));
+}
+/** Validate a gateway receipt without exposing the signing secret to the tenant worker. */
+async function verifyEmailReceiptThroughProxy(proxy, projectToken, input) {
+	const deadline = Date.now() + RECEIPT_VERIFICATION_DEADLINE_MS;
+	const beforeDeadline = (run) => withTimeout(deadline - Date.now(), run, () => /* @__PURE__ */ new Error("email receipt verification timeout"));
+	const controller = new AbortController();
+	let response;
+	try {
+		response = await beforeDeadline(() => proxy.fetch("https://proxy/email/verify-receipt", {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				"x-void-internal": projectToken
+			},
+			body: JSON.stringify(input),
+			signal: controller.signal
+		}));
+		if (!response.ok) return false;
+		const body = await readBoundedJson(response, MAX_RECEIPT_VERIFICATION_BYTES, beforeDeadline, { rejectEncoding: true });
+		return !!body && typeof body === "object" && !Array.isArray(body) && body.valid === true;
+	} catch {
+		return false;
+	} finally {
+		controller.abort();
+		response?.body?.cancel().catch(() => {});
+	}
+}
+//#endregion
+export { verifyEmailReceiptThroughProxy as a, readEmailEnvelope as i, encodeEmailActions as n, withTimeout as o, readBoundedJson as r, EMAIL_PROTOCOL_VERSION as t };

package/dist/{entry-CMAkqBmU.mjs → entry-ehmBvs5w.mjs}

@@ -1,5 +1,5 @@
-import { a as join, l as relative } from "./dist-BVqXeR_h.mjs";
-import { n as readProjectPaths } from "./project-paths-GgcMozYz.mjs";
+import { a as join, s as relative } from "./dist-ipQi0Q8y.mjs";
+import { n as readProjectPaths } from "./project-paths-DMvEeSau.mjs";
 import { n as isIdentifier } from "./ast-CPGPjb0V.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { parseSync } from "vite";

package/dist/{env-BxocywBB.mjs → env-BJjULvL0.mjs}

@@ -1,5 +1,5 @@
-import { a as join } from "./dist-BVqXeR_h.mjs";
-import { t as parseDotenvFile } from "./dotenv-BfU6eqFt.mjs";
+import { a as join } from "./dist-ipQi0Q8y.mjs";
+import { t as parseDotenvFile } from "./dotenv-CNazY3-w.mjs";
 import { readdirSync } from "node:fs";
 //#region src/shared/env.ts
 /** Void's single local dotenv file. It is never a production configuration source. */

package/dist/{env-DMA3cXZt.mjs → env-BhdWMrNy.mjs}

@@ -1,4 +1,4 @@
-import { a as getRawRuntimeEnv, i as envContext, n as INTERNAL_BINDING_PREFIXES, o as isIsrActive, r as asEnv, t as INTERNAL_BINDING_EXACT_NAMES } from "./env-raw-jZpP5n47.mjs";
+import { a as getRawRuntimeEnv, i as envContext, n as INTERNAL_BINDING_PREFIXES, o as isIsrActive, r as asEnv, t as INTERNAL_BINDING_EXACT_NAMES } from "./env-raw-Cklzcde3.mjs";
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/runtime/env.ts
 /**
@@ -28,18 +28,7 @@ function withRuntimeEnv(env, fn) {
 	const scope = { resources: /* @__PURE__ */ new Map() };
 	return envContext.run(resolved, () => runtimeRequestContext.run(scope, fn));
 }
-/**
-* Shared internal-binding predicate. A binding is framework-internal — and must
-* never be exposed to user code — when it carries an internal prefix
-* (`__VOID_`, `__PROJECT_`; always hidden) or is an exact-name internal (e.g.
-* `ISR_CACHE`; hidden ONLY while ISR is active for the isolate). `rawEnv` is the
-* unfiltered runtime env, consulted via {@link isIsrActive} to gate the
-* exact-name check so a non-ISR app's own `ISR_CACHE` binding stays visible —
-* matching the build-time `isr` gate on the generated `c.env` filter.
-*
-* Single source of truth for the runtime `env` filter here and the public
-* `void/env` proxy (`env-public.ts`).
-*/
+/** Whether `name` is a framework binding hidden from user code; `rawEnv` is the unfiltered env. */
 function isInternalBinding(name, rawEnv) {
 	if (INTERNAL_BINDING_PREFIXES.some((p) => name.startsWith(p))) return true;
 	return isIsrActive(rawEnv) && INTERNAL_BINDING_EXACT_NAMES.includes(name);

package/dist/{env-w9jOyGZn.mjs → env-C6ipBLp3.mjs}

@@ -1,11 +1,11 @@
-import { a as join } from "./dist-BVqXeR_h.mjs";
-import { n as readDeploymentPlatform, r as readProjectConfig } from "./project-DQstYTxO.mjs";
-import { c as getToken } from "./auth-B5_tZLxT.mjs";
+import { a as join } from "./dist-ipQi0Q8y.mjs";
+import { n as readDeploymentPlatform, r as readProjectConfig } from "./project-rqDnVsJN.mjs";
+import { c as getToken } from "./auth-B6iOCjKI.mjs";
 import { H as outro, L as log } from "./dist-D3m88sjf.mjs";
-import { d as printSuccess, u as note } from "./output-C50ag2r3.mjs";
-import { r as generateEnvTypes, t as findEnvFile } from "./env-types-CwXgeMgL.mjs";
-import { d as formatEnvReport, g as validateProdEnv, u as fetchRemoteSecretNames } from "./env-validation-Dxdx_5wo.mjs";
-import { r as PlatformClient } from "./client-C2Prx_Bi.mjs";
+import { m as printSuccess, p as note } from "./output-FNHKw5Ac.mjs";
+import { r as generateEnvTypes, t as findEnvFile } from "./env-types-DS2_y4X8.mjs";
+import { r as PlatformClient } from "./client-DM9Kcf4e.mjs";
+import { d as formatEnvReport, g as validateProdEnv, u as fetchRemoteSecretNames } from "./env-validation-cE0zcmzO.mjs";
 import { mkdirSync, writeFileSync } from "node:fs";
 //#region src/cli/env.ts
 async function runEnvCommand(root, args) {
@@ -25,7 +25,7 @@ async function runCheck(root, useRemoteSecrets) {
 		const platform = readDeploymentPlatform(root);
 		if (platform === "none") throw new Error("env: Deployment is disabled. Run `void init` to choose a platform.");
 		if (platform === "cloudflare") {
-			const { listCloudflareSecrets, resolveCloudflareOperationContext } = await import("./cloudflare-operations-BlYLlowZ.mjs");
+			const { listCloudflareSecrets, resolveCloudflareOperationContext } = await import("./cloudflare-operations-Ds-lX3Ts.mjs");
 			remoteSecrets = await listCloudflareSecrets(resolveCloudflareOperationContext(root));
 		} else {
 			const token = getToken(root);

package/dist/{env-public-DR7ZM6d-.d.mts → env-public-CCdykygU.d.mts}

@@ -1,4 +1,4 @@
-import { l as VoidPlatformSandbox } from "./sandbox-C5LFoJMf.mjs";
+import { l as VoidPlatformSandbox } from "./sandbox-q3waMc2T.mjs";
 import { t as StandardSchemaV1 } from "./standard-schema-Fo_vCAZh.mjs";
 //#region src/runtime/env-public.d.ts
 type AnyValidator = StandardSchemaV1<unknown, unknown>;
@@ -26,21 +26,10 @@ type InferEnv<S extends AnySchema> = { readonly [K in keyof S]: StandardSchemaV1
  */
 declare function defineEnv<S extends AnySchema>(schema: S): InferEnv<S>;
 /**
- * Internal: validate the entire schema against the worker's actual env on
- * the first request per isolate. Catches bad remote-secret values and
- * post-deploy drift that the deploy CLI can't see (it only knows secret
- * names, not their values).
- *
- * Spliced into the generated worker entry by `compileWorkerEntry`. Cached
- * after the first call so subsequent requests pay no cost.
- *
- * Async lifecycle: this function awaits any async Standard Schema
- * validators (zod `refine`, arktype async narrows, etc.) and seeds the
- * per-key cache with the resolved values. Subsequent reads via `env.X`
- * hit the sync cache — async work only happens here, at boot. If a user
- * accesses `env.X` for a key with an async validator *before* this
- * function has run (e.g. during module-top-level code), the proxy will
- * throw with guidance pointing back to this boot-time pre-validation.
+ * Internal: validate the whole schema against the worker env once per isolate,
+ * from the generated worker entry. Catches remote-secret values the deploy CLI
+ * cannot see. Async validators are awaited here and their values cached, so
+ * later synchronous `env.X` reads can serve them.
  */
 declare function _validateEnvOnce(envValues: unknown): Promise<void>;
 /** Internal: framework-only access to the registered schema (for plugin/CLI). */
@@ -73,13 +62,7 @@ declare class EnvValidationError extends Error {
 /**
  * Typed env proxy. Reads from the runtime env, validating declared keys
  * on first access and passing through bindings / unknown keys unchanged.
- *
- * Sync-only: the `get` trap must be synchronous, so validators that return
- * a `Promise` cannot be awaited here. For async Standard Schema validators,
- * `_validateEnvOnce()` pre-resolves them at worker boot and seeds the
- * per-env cache; property reads then serve the cached value synchronously.
- * If an async validator is encountered here without a prior pre-validation,
- * the trap throws with guidance on how to resolve it.
+ * Async validators must be resolved first by `_validateEnvOnce()`.
  */
 declare const env: ValidatedEnv;
 /** Aggregate report from validating an entire env object against the schema. */

package/dist/{env-raw-jZpP5n47.mjs → env-raw-Cklzcde3.mjs}

@@ -9,28 +9,11 @@ import { AsyncLocalStorage } from "node:async_hooks";
 /** Prefixes for platform-internal bindings that must be hidden from user code. */
 const INTERNAL_BINDING_PREFIXES = ["__VOID_", "__PROJECT_"];
 /**
-* Exact binding names that must be hidden from user code even though they carry
-* no internal prefix. `ISR_CACHE` (the self-host ISR KV namespace) is a plain
-* binding name, but it is a framework internal — route handlers read the ISR
-* cache through `handleIsr`/`revalidate()` on the raw env, never via `c.env` or
-* the public `void/env` API. Single source of truth shared by the generated
-* `c.env` filter (`router/compile.ts`) and the runtime `env` filter (`env.ts`).
-*
-* Unlike the prefix internals, these are hidden ONLY when ISR is active for the
-* isolate (see {@link isIsrActive}). In a non-ISR app, `ISR_CACHE` is an
-* ordinary user binding and stays visible everywhere — matching the build-time
-* `isr` gate on the generated `c.env` filter.
+* Framework bindings hidden from user code only while ISR is active, so a non-ISR
+* app keeps its own `ISR_CACHE`. Shared with the generated `c.env` filter.
 */
 const INTERNAL_BINDING_EXACT_NAMES = ["ISR_CACHE"];
-/**
-* ISR is active for this isolate iff the framework has stamped the compile-time
-* deployment id onto the raw env (`__VOID_ISR_DEPLOYMENT_ID`). The generated
-* worker entry stamps it at the top of `fetch()` (and in cron/queue handlers)
-* only for ISR-emitting builds, so its presence is a reliable runtime signal
-* that `ISR_CACHE` should be treated as a framework internal. The id itself is a
-* `__VOID_`-prefixed binding that is always hidden and framework-controlled, so
-* a user cannot forge it.
-*/
+/** Only ISR builds stamp the `__VOID_ISR_DEPLOYMENT_ID` binding onto the raw env. */
 function isIsrActive(rawEnv) {
 	return rawEnv.__VOID_ISR_DEPLOYMENT_ID != null;
 }

package/dist/{env-types-CwXgeMgL.mjs → env-types-DS2_y4X8.mjs}

@@ -1,5 +1,5 @@
-import { l as relative } from "./dist-BVqXeR_h.mjs";
-import { n as readProjectPaths } from "./project-paths-GgcMozYz.mjs";
+import { s as relative } from "./dist-ipQi0Q8y.mjs";
+import { n as readProjectPaths } from "./project-paths-DMvEeSau.mjs";
 import { i as voidWarn } from "./log-vqY3pqwI.mjs";
 import { existsSync } from "node:fs";
 //#region src/codegen/env-types.ts

package/dist/{env-validation-CrVNjsPm.mjs → env-validation-CTn-HhG1.mjs}

@@ -1,2 +1,2 @@
-import { a as computeInvalidEmittedKeys, c as deriveSelfHostSchemaFacts, p as readEmittedWorkerVars, r as SelfHostSchemaError } from "./env-validation-Dxdx_5wo.mjs";
+import { a as computeInvalidEmittedKeys, c as deriveSelfHostSchemaFacts, p as readEmittedWorkerVars, r as SelfHostSchemaError } from "./env-validation-cE0zcmzO.mjs";
 export { SelfHostSchemaError, computeInvalidEmittedKeys, deriveSelfHostSchemaFacts, readEmittedWorkerVars };