void 0.27.0 → 1.0.3

package/dist/runtime/email.mjs

@@ -1,10 +1,10 @@
-import { i as normalizeEmail, n as MimeError, r as buildMime } from "../mime-DxCznlJq.mjs";
-import { a as DEV_INBOX_ENV_VAR, c as DEV_INBOX_TOKEN_ENV_VAR, d as bytesToBase64, f as captureMessage, g as hasActiveSink, i as DEV_INBOX_CAPTURE_URL, m as dispatchToSinks, x as serializeCapturedMessage } from "../dev-inbox-CK-UuPob.mjs";
-import { a as getRawRuntimeEnv } from "../env-raw-jZpP5n47.mjs";
-import { a as createMessageProxy, c as isForwardableEmailMessage, i as bytesToReadableStream, l as parseEmail, o as defineEmail, r as ParseEmailError, s as enactEmailActions, u as replyEmail } from "../inbound-PfQDLXc5.mjs";
+import { n as bytesToBase64 } from "../base64-DVrOndmI.mjs";
+import { a as newId, n as MimeError, o as normalizeEmail, r as buildMime } from "../mime-srOklVVv.mjs";
+import { a as DEV_INBOX_ENV_VAR, b as serializeCapturedMessage, c as DEV_INBOX_TOKEN_ENV_VAR, d as captureMessage, h as hasActiveSink, i as DEV_INBOX_CAPTURE_URL, p as dispatchToSinks } from "../dev-inbox-Rd6j_8vM.mjs";
+import { o as withTimeout, r as readBoundedJson } from "../email-protocol-D9nTvhCp.mjs";
+import { a as createMessageProxy, c as isForwardableEmailMessage, d as readProjectSlug, f as replyEmail, i as bytesToReadableStream, l as parseEmail, o as defineEmail, p as tryGetRawRuntimeEnv, r as ParseEmailError, s as enactEmailActions, u as readEnvString } from "../inbound-BuTfm11U.mjs";
 import { isRecord } from "@void/deploy-core";
 //#region src/runtime/email.ts
-const VALID_SLUG = /^[a-z0-9](?:[a-z0-9-]{0,54}[a-z0-9])?$/;
 function makeError(code, message, cause) {
 	return cause === void 0 ? {
 		code,
@@ -15,26 +15,6 @@ function makeError(code, message, cause) {
 		cause
 	};
 }
-function tryGetRawRuntimeEnv() {
-	try {
-		return getRawRuntimeEnv();
-	} catch {
-		return;
-	}
-}
-function readProjectSlug() {
-	const raw = tryGetRawRuntimeEnv()?.__VOID_PROJECT_SLUG;
-	if (typeof raw !== "string" || raw.length === 0) return;
-	return VALID_SLUG.test(raw) ? raw : void 0;
-}
-function readEmailDomain() {
-	const raw = tryGetRawRuntimeEnv()?.__VOID_EMAIL_DOMAIN;
-	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
-}
-function readEmailFrom() {
-	const raw = tryGetRawRuntimeEnv()?.__VOID_EMAIL_FROM;
-	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
-}
 const SEND_EMAIL_BINDING_NAME = "SEND_EMAIL";
 const EMAIL_PROVIDER_DEADLINE_MS = 3e4;
 const PLATFORM_SEND_DEADLINE_MS = 6e4;
@@ -44,40 +24,16 @@ var EmailBindingTimeoutError = class extends Error {
 		this.name = "EmailBindingTimeoutError";
 	}
 };
-function createBindingSendDeadline() {
-	const deadline = Date.now() + PLATFORM_SEND_DEADLINE_MS;
-	return {
-		expired: () => Date.now() >= deadline,
-		async run(submit) {
-			const remaining = Math.min(EMAIL_PROVIDER_DEADLINE_MS, deadline - Date.now());
-			if (remaining <= 0) throw new EmailBindingTimeoutError();
-			const work = submit();
-			let timer;
-			try {
-				return await Promise.race([work, new Promise((_, reject) => {
-					timer = setTimeout(() => reject(new EmailBindingTimeoutError()), remaining);
-				})]);
-			} finally {
-				if (timer !== void 0) clearTimeout(timer);
-			}
-		}
-	};
-}
 function resolveSendEmailBinding(env) {
 	const binding = env?.[SEND_EMAIL_BINDING_NAME];
 	if (typeof binding !== "object" || binding === null) return;
 	return typeof binding.send === "function" ? binding : void 0;
 }
 /**
-* Map an error thrown by the `send_email` binding to a framework code.
-*
-* Email Service throws `Error`s carrying a `code` (the `E_*` table in
-* Cloudflare's Workers API reference); the older Email Routing sender
-* throws message-only errors, so the destination-verification phrasing the
-* platform proxy already keys on is kept as a fallback. Anything else is
-* `OUTCOME_UNKNOWN` with the original error as `cause`: once `send()` has
-* started, an undocumented rejection does not prove the provider declined
-* the message before accepting it.
+* Map a `send_email` binding error to a framework code: Email Service `E_*`
+* codes, then the older Email Routing message. Anything else is
+* `OUTCOME_UNKNOWN`: once `send()` started, a rejection does not prove the
+* provider declined the message.
 */
 function classifyBindingError(e) {
 	const message = e instanceof Error ? e.message : String(e);
@@ -93,11 +49,9 @@ function classifyBindingError(e) {
 }
 const UNVERIFIED_DESTINATION_RE = /^[^\n]{0,200}destination address[^\n]{0,200}not (?:yet )?verified/i;
 /**
-* Deliver through the worker's own `SEND_EMAIL` binding. One `EmailMessage`
-* per recipient, within one bounded batch, and the same `deliveries` shape
-* the proxy returns so a caller can inspect each attempted or cancelled
-* outcome in either mode. The stream is rebuilt per send because a
-* `ReadableStream` is one-shot.
+* Send one `EmailMessage` per recipient through the worker's own binding,
+* within one bounded batch, reporting `deliveries` as the proxy does. The
+* stream is rebuilt per send: a `ReadableStream` is one-shot.
 */
 async function sendViaBinding(binding, from, recipients, raw, fallbackId) {
 	let EmailMessage;
@@ -107,10 +61,11 @@ async function sendViaBinding(binding, from, recipients, raw, fallbackId) {
 		return err("UPSTREAM_ERROR", `email: SEND_EMAIL is bound but cloudflare:email could not be loaded: ${e instanceof Error ? e.message : String(e)}`, e);
 	}
 	const deliveries = [];
-	const deadline = createBindingSendDeadline();
+	const deadline = Date.now() + PLATFORM_SEND_DEADLINE_MS;
+	const remaining = () => Math.min(EMAIL_PROVIDER_DEADLINE_MS, deadline - Date.now());
 	for (let index = 0; index < recipients.length; index++) {
 		const recipient = recipients[index];
-		if (deadline.expired()) {
+		if (remaining() <= 0) {
 			for (const unstarted of recipients.slice(index)) deliveries.push({
 				recipient: unstarted,
 				ok: false,
@@ -120,7 +75,7 @@ async function sendViaBinding(binding, from, recipients, raw, fallbackId) {
 			break;
 		}
 		try {
-			const result = await deadline.run(() => binding.send(new EmailMessage(from, recipient, bytesToReadableStream(raw))));
+			const result = await withTimeout(remaining(), () => binding.send(new EmailMessage(from, recipient, bytesToReadableStream(raw))), () => new EmailBindingTimeoutError());
 			const mid = typeof result?.messageId === "string" ? result.messageId : "";
 			deliveries.push({
 				recipient,
@@ -150,10 +105,8 @@ async function sendViaBinding(binding, from, recipients, raw, fallbackId) {
 	};
 }
 /**
-* Dedup recipients by lowercased email (CF won't collapse duplicate
-* envelopes for us, and double-billing the quota for the same recipient
-* is worse than the rare case where a user actually wanted Cc + Bcc to
-* the same address — which doesn't change delivery semantics anyway).
+* Recipients deduplicated by lowercased address: Cloudflare does not
+* collapse duplicate envelopes, and each one costs quota.
 */
 function uniqueRecipients(normalized) {
 	const seen = /* @__PURE__ */ new Set();
@@ -170,23 +123,16 @@ function uniqueRecipients(normalized) {
 	}
 	return recipients;
 }
-function newRequestId() {
-	const bytes = /* @__PURE__ */ new Uint8Array(8);
-	crypto.getRandomValues(bytes);
-	let hex = "";
-	for (const b of bytes) hex += b.toString(16).padStart(2, "0");
-	return `req_${Date.now().toString(36)}${hex}`;
-}
 function resolveDefaultFrom(opts) {
 	const supplied = opts.from;
 	if (!(supplied === void 0 || supplied === null || typeof supplied === "string" && supplied.trim() === "" || typeof supplied === "object" && supplied !== null && !("email" in supplied))) return opts;
-	const configured = readEmailFrom();
+	const configured = readEnvString("__VOID_EMAIL_FROM");
 	if (configured) return {
 		...opts,
 		from: configured
 	};
 	const slug = readProjectSlug();
-	const domain = readEmailDomain();
+	const domain = readEnvString("__VOID_EMAIL_DOMAIN");
 	if (!slug || !domain) {
 		if (supplied === null) {
 			const next = { ...opts };
@@ -220,11 +166,9 @@ function coerceErrorCode(code) {
 	].find((knownCode) => knownCode === code) ?? "UPSTREAM_ERROR";
 }
 /**
-* The text of a refusal the proxy's middleware sent instead of a send
-* response: `{ error: string, message?: string }`. `message` is the
-* sentence written for a person (the capability gate's "This Void platform
-* does not enable email."); `error` is the short code every such refusal
-* carries. `null` when the body is not that shape.
+* Text of the `{ error, message? }` refusal the proxy's middleware sends
+* ahead of the email handler, preferring the human `message`; `null` for any
+* other shape.
 */
 function readProxyRefusal(body) {
 	if (typeof body !== "object" || body === null || Array.isArray(body)) return null;
@@ -258,10 +202,9 @@ function readProxyResponse(value) {
 	return null;
 }
 /**
-* Require exactly one valid outcome per requested recipient in either list
-* shape. A missing, duplicate, or foreign entry makes the whole result unknown;
-* trimming it could hide a submission. Order is not part of the contract.
-* Diagnostics identify entries by index rather than echoing corrupt addresses.
+* Require exactly one valid outcome per requested recipient, in any order. A
+* missing, duplicate or foreign entry makes the whole result unknown, since
+* trimming it could hide a submission. Diagnostics name entries by index.
 */
 function readRecipientList(raw, recipients, shape, readEntry) {
 	if (raw.length !== recipients.length) return {
@@ -300,11 +243,8 @@ function readRecipientList(raw, recipients, shape, readEntry) {
 	};
 }
 /**
-* The `ids` list of an `ok: true` response. The proxy answers `ok: true` only
-* after every requested recipient has an accepted provider outcome. Each entry
-* is `{ recipient, messageId }`; the framework's own Message-ID stands in for
-* an empty provider reference. A missing delivery would leave no safe retry
-* decision, so the whole response is rejected as malformed.
+* The `ids` of an `ok: true` response, one accepted outcome per recipient.
+* The framework's Message-ID stands in for an empty provider reference.
 */
 function readDeliveryList(raw, recipients, fallbackId) {
 	return readRecipientList(raw, recipients, "{ recipient: string, messageId: string }", (entry, recipient) => typeof entry.messageId === "string" ? {
@@ -349,112 +289,47 @@ function readDeliveryState(value) {
 	].find((state) => state === value);
 }
 const MAX_PROXY_RESPONSE_BYTES = 65536;
-function createPlatformSendDeadline() {
-	const controller = new AbortController();
-	const deadline = Date.now() + PLATFORM_SEND_DEADLINE_MS;
-	return {
-		signal: controller.signal,
-		async beforeDeadline(run) {
-			const remaining = deadline - Date.now();
-			if (remaining <= 0) {
-				controller.abort();
-				throw new Error("email platform send timed out");
-			}
-			const promise = run();
-			let timer;
-			try {
-				return await Promise.race([promise, new Promise((_, reject) => {
-					timer = setTimeout(() => {
-						controller.abort();
-						reject(/* @__PURE__ */ new Error("email platform send timed out"));
-					}, remaining);
-				})]);
-			} finally {
-				if (timer !== void 0) clearTimeout(timer);
-			}
-		}
-	};
-}
-async function readBoundedProxyJson(response, beforeDeadline) {
-	const declared = response.headers.get("content-length");
-	if (declared !== null && (!/^\d+$/.test(declared) || Number(declared) > MAX_PROXY_RESPONSE_BYTES)) {
-		response.body?.cancel().catch(() => {});
-		throw new Error("email proxy response too large");
-	}
-	const reader = response.body?.getReader();
-	if (!reader) throw new Error("email proxy response is empty");
-	const bytes = new Uint8Array(MAX_PROXY_RESPONSE_BYTES);
-	let size = 0;
-	try {
-		for (;;) {
-			const chunk = await beforeDeadline(() => reader.read());
-			if (chunk.done) break;
-			if (size + chunk.value.byteLength > bytes.byteLength) throw new Error("email proxy response too large");
-			bytes.set(chunk.value, size);
-			size += chunk.value.byteLength;
-		}
-		if (declared !== null && size !== Number(declared)) throw new Error("email proxy response length mismatch");
-		return JSON.parse(new TextDecoder("utf-8", {
-			fatal: true,
-			ignoreBOM: false
-		}).decode(bytes.subarray(0, size)));
-	} finally {
-		reader.cancel().catch(() => {});
-		try {
-			reader.releaseLock();
-		} catch {}
-	}
-}
 async function readResponseAsResult(res, recipients, fallbackId, beforeDeadline) {
+	let body;
 	try {
-		let body;
-		try {
-			body = await readBoundedProxyJson(res, beforeDeadline);
-		} catch {
-			return err("OUTCOME_UNKNOWN", `email: could not establish the send outcome (status ${res.status}); check email logs or repeat the same idempotency key`);
-		}
-		const response = readProxyResponse(body);
-		if (response === null) {
-			const refusal = readProxyRefusal(body);
-			if (!res.ok && refusal !== null) return err("UPSTREAM_ERROR", `email: proxy returned ${res.status}: ${refusal}`, body);
-			return err("OUTCOME_UNKNOWN", `email: proxy returned malformed response (status ${res.status})`, body);
-		}
-		const malformedList = (reason) => err("OUTCOME_UNKNOWN", `email: proxy returned a malformed delivery list (${reason}); do not retry with a new idempotency key`, body);
-		const operation = typeof response.operationId === "string" && response.operationId.length <= 128 ? { operationId: response.operationId } : {};
-		if (response.ok === true) {
-			const list = readDeliveryList(response.ids, recipients, fallbackId);
-			return list.ok ? {
-				ok: true,
-				ids: list.entries,
-				...operation
-			} : malformedList(list.reason);
-		}
-		if ("deliveries" in response) {
-			const list = readFailureDeliveries(response.deliveries, recipients, fallbackId);
-			return list.ok ? {
-				ok: false,
-				deliveries: list.entries,
-				...operation
-			} : malformedList(list.reason);
-		}
-		const e = response.error;
-		return {
-			...err(coerceErrorCode(e.code), typeof e.message === "string" ? e.message : "email: upstream send failed"),
+		body = await readBoundedJson(res, MAX_PROXY_RESPONSE_BYTES, beforeDeadline);
+	} catch {
+		return err("OUTCOME_UNKNOWN", `email: could not establish the send outcome (status ${res.status}); check email logs or repeat the same idempotency key`);
+	}
+	const response = readProxyResponse(body);
+	if (response === null) {
+		const refusal = readProxyRefusal(body);
+		if (!res.ok && refusal !== null) return err("UPSTREAM_ERROR", `email: proxy returned ${res.status}: ${refusal}`, body);
+		return err("OUTCOME_UNKNOWN", `email: proxy returned malformed response (status ${res.status})`, body);
+	}
+	const malformedList = (reason) => err("OUTCOME_UNKNOWN", `email: proxy returned a malformed delivery list (${reason}); do not retry with a new idempotency key`, body);
+	const operation = typeof response.operationId === "string" && response.operationId.length <= 128 ? { operationId: response.operationId } : {};
+	if (response.ok === true) {
+		const list = readDeliveryList(response.ids, recipients, fallbackId);
+		return list.ok ? {
+			ok: true,
+			ids: list.entries,
 			...operation
-		};
-	} catch (e) {
-		return err("OUTCOME_UNKNOWN", `email: failed to parse proxy response (status ${res.status}): ${e instanceof Error ? e.message : String(e)}`, e);
+		} : malformedList(list.reason);
+	}
+	if ("deliveries" in response) {
+		const list = readFailureDeliveries(response.deliveries, recipients, fallbackId);
+		return list.ok ? {
+			ok: false,
+			deliveries: list.entries,
+			...operation
+		} : malformedList(list.reason);
 	}
+	const e = response.error;
+	return {
+		...err(coerceErrorCode(e.code), typeof e.message === "string" ? e.message : "email: upstream send failed"),
+		...operation
+	};
 }
 /**
-* Resolve the loopback into the `void dev` inbox, or `undefined` outside dev.
-*
-* `DEV_INBOX_ENV_VAR` is injected only when `viteCommand === 'serve'` and it
-* names the worker's assets binding. In dev, `@cloudflare/vite-plugin` binds
-* that name to a miniflare service whose implementation is the Vite dev
-* server's Node middleware stack, so a fetch through it lands on the inbox
-* middleware in the dev-server process — the only place the buffer exists.
-* In a production build neither the var nor that wiring is present.
+* The loopback into the `void dev` inbox: `DEV_INBOX_ENV_VAR` names the
+* assets binding, which in dev reaches the Vite dev server. Undefined
+* outside dev.
 */
 function resolveDevInbox(env) {
 	const bindingName = env?.[DEV_INBOX_ENV_VAR];
@@ -473,10 +348,8 @@ const DEV_INBOX_TIMEOUT_MS = 5e3;
 const DEV_INBOX_ERROR_EXCERPT_CHARS = 200;
 const DEV_INBOX_ERROR_EXCERPT_TIMEOUT_MS = 1e3;
 /**
-* First line of a refusal, so a 401 names the header it wanted. Reads ONE
-* chunk under its own deadline: the main 5s race has already settled by the
-* time the status is known, and a body that never arrives must not turn a
-* clean error into a hung `sendEmail`.
+* First line of a refusal, so a 401 names the header it wanted. One chunk
+* under its own deadline: a stalled body must not hang `sendEmail`.
 */
 async function readErrorExcerpt(res) {
 	let timer;
@@ -548,22 +421,11 @@ async function postToDevInbox(inbox, captured) {
 		if (timer !== void 0) clearTimeout(timer);
 	}
 }
-/**
-* Shared result shape for both capture paths (in-process sink and dev inbox).
-*
-* `ids` is built from the same deduplicated, lowercased list the two
-* production transports send to, so code written against a captured result
-* sees exactly what a deploy returns: one entry per unique address, keyed the
-* way `sendViaBinding` and the proxy report it. The captured message itself
-* keeps the original fields; the inbox displays what was asked for, the
-* result reports what would be sent.
-*/
+/** A captured send's result: one id per unique recipient, as a deployed send reports. */
 function capturedResult(normalized, captureId) {
-	const recipients = uniqueRecipients(normalized);
-	if (recipients.length === 0) return err("INVALID_TO", "email: 'to' must include at least one recipient.");
 	return {
 		ok: true,
-		ids: recipients.map((recipient) => ({
+		ids: uniqueRecipients(normalized).map((recipient) => ({
 			recipient,
 			messageId: captureId
 		}))
@@ -584,18 +446,11 @@ async function sendEmail(opts) {
 	if (resolvedOpts.from === void 0) return err("INVALID_FROM", "email: 'from' is required. Set it explicitly or deploy via Void so the platform-injected __VOID_PROJECT_SLUG and __VOID_EMAIL_DOMAIN can default it to <slug>+noreply@<domain>.");
 	const optsWithFrom = resolvedOpts;
 	let normalized;
-	try {
-		normalized = await normalizeEmail(optsWithFrom);
-	} catch (e) {
-		if (e instanceof MimeError) return err(e.code, e.message, e);
-		return err("MIME_ERROR", e instanceof Error ? e.message : String(e), e);
-	}
 	let raw;
 	let messageId;
 	try {
-		const built = buildMime(normalized);
-		raw = built.raw;
-		messageId = built.messageId;
+		normalized = await normalizeEmail(optsWithFrom);
+		({raw, messageId} = buildMime(normalized));
 	} catch (e) {
 		if (e instanceof MimeError) return err(e.code, e.message, e);
 		return err("MIME_ERROR", e instanceof Error ? e.message : String(e), e);
@@ -616,7 +471,6 @@ async function sendEmail(opts) {
 		return err("UPSTREAM_ERROR", message);
 	}
 	const recipients = uniqueRecipients(normalized);
-	if (recipients.length === 0) return err("INVALID_TO", "email: 'to' must include at least one recipient.");
 	const sendBinding = resolveSendEmailBinding(rawEnv);
 	if (sendBinding) {
 		if (opts.idempotencyKey !== void 0) return err("MIME_ERROR", "email: idempotencyKey requires a Void platform; the native Cloudflare binding cannot deduplicate sends.");
@@ -627,30 +481,34 @@ async function sendEmail(opts) {
 	const projectId = env?.__PROJECT_ID;
 	const proxyToken = env?.__VOID_PROXY_TOKEN;
 	if (!proxy || !projectId || !proxyToken) return err("BINDING_MISSING", "email: neither SEND_EMAIL nor __VOID_PROXY is available, so nothing was sent. Deploy via Void to bind the platform proxy, or set `email.from` in void.json so `void deploy --platform cloudflare` provisions the SEND_EMAIL binding. Under `void dev` messages are captured by the local inbox at /__void/inbox instead — reaching this error there means that path was bypassed (`sendInDev: true`, which does not deliver: `void dev` binds no send transport at all, so there is nothing to fall through to) or unavailable (the worker has no assets binding to reach the dev server through).");
-	const requestId = newRequestId();
 	const body = {
 		projectId,
 		aiToken: proxyToken,
 		from: normalized.from.email,
 		recipients,
 		mimeBase64: bytesToBase64(raw),
-		requestId,
+		requestId: newId("req"),
 		...opts.idempotencyKey === void 0 ? {} : { idempotencyKey: opts.idempotencyKey }
 	};
 	const requestBody = JSON.stringify(body);
-	const deadline = createPlatformSendDeadline();
+	const controller = new AbortController();
+	const deadline = Date.now() + PLATFORM_SEND_DEADLINE_MS;
+	const beforeDeadline = (run) => withTimeout(deadline - Date.now(), run, () => {
+		controller.abort();
+		return /* @__PURE__ */ new Error("email platform send timed out");
+	});
 	let res;
 	try {
-		res = await deadline.beforeDeadline(() => proxy.fetch("https://email-proxy/email/send", {
+		res = await beforeDeadline(() => proxy.fetch("https://email-proxy/email/send", {
 			method: "POST",
 			headers: { "content-type": "application/json" },
 			body: requestBody,
-			signal: deadline.signal
+			signal: controller.signal
 		}));
 	} catch (e) {
 		return err("OUTCOME_UNKNOWN", `email: send outcome is unknown: ${e instanceof Error ? e.message : String(e)}. Check email logs or repeat the same idempotency key; do not create a new send.`, e);
 	}
-	return readResponseAsResult(res, recipients, messageId, deadline.beforeDeadline);
+	return readResponseAsResult(res, recipients, messageId, beforeDeadline);
 }
 /**
 * Build a normalized email + raw MIME for advanced callers who want to feed

package/dist/runtime/env-public.d.mts

@@ -1,4 +1,4 @@
 /// <reference types="@cloudflare/workers-types" />
 import { a as number, c as url, i as json, n as boolean, o as oneOf, r as email, s as string, t as EnvSchema } from "../env-helpers-CyKtOBpj.mjs";
-import { a as _getSchemaDefaults, c as defineEnv, i as _getRegisteredSchema, l as env, n as EnvValidationReport, o as _hasRegisteredSchema, r as ValidatedEnv, s as _validateEnvOnce, t as EnvValidationError, u as validateAllEnv } from "../env-public-DR7ZM6d-.mjs";
+import { a as _getSchemaDefaults, c as defineEnv, i as _getRegisteredSchema, l as env, n as EnvValidationReport, o as _hasRegisteredSchema, r as ValidatedEnv, s as _validateEnvOnce, t as EnvValidationError, u as validateAllEnv } from "../env-public-CCdykygU.mjs";
 export { type EnvSchema, EnvValidationError, EnvValidationReport, ValidatedEnv, _getRegisteredSchema, _getSchemaDefaults, _hasRegisteredSchema, _validateEnvOnce, boolean, defineEnv, email, env, json, number, oneOf, string, url, validateAllEnv };

package/dist/runtime/env-public.mjs

@@ -1,5 +1,5 @@
-import { a as getRawRuntimeEnv } from "../env-raw-jZpP5n47.mjs";
-import { i as isInternalBinding, n as getRuntimeEnv } from "../env-DMA3cXZt.mjs";
+import { a as getRawRuntimeEnv } from "../env-raw-D74P4ebM.mjs";
+import { i as isInternalBinding, n as getRuntimeEnv } from "../env-0jrMQJI_.mjs";
 import { a as oneOf, i as number, n as email, o as string, r as json, s as url, t as boolean } from "../env-helpers--wFmQ_5Q.mjs";
 //#region src/shared/env-mask.ts
 /**
@@ -11,8 +11,7 @@ import { a as oneOf, i as number, n as email, o as string, r as json, s as url,
 * it to locate the offending entry).
 *
 * Server env values are production secrets by definition, so validator
-* messages redact the raw input unconditionally. The old `.secret()` /
-* `.public()` masking axis was removed because it did not control storage.
+* messages redact the raw input unconditionally.
 *
 * Users can opt out of the guard for local debugging via
 * `VOID_ENV_UNMASK=1` in the environment; that path prints a one-shot
@@ -32,7 +31,6 @@ function redactMessage(rawValue, message, options = {}) {
 	return message.split(rawValue).join(REDACTED);
 }
 let unmaskResolved = null;
-let unmaskNoticeShown = false;
 /**
 * Resolve the effective unmask flag, consulting `process.env` exactly once
 * per process. On the first affirmative read, we print a one-shot notice to
@@ -40,20 +38,13 @@ let unmaskNoticeShown = false;
 */
 function isUnmaskActive() {
 	if (unmaskResolved !== null) return unmaskResolved;
-	let active = false;
 	try {
-		active = globalThis.process?.env?.[UNMASK_ENV_VAR] === "1";
+		unmaskResolved = globalThis.process?.env?.[UNMASK_ENV_VAR] === "1";
 	} catch {
-		active = false;
+		unmaskResolved = false;
 	}
-	unmaskResolved = active;
-	if (active && !unmaskNoticeShown) {
-		unmaskNoticeShown = true;
-		try {
-			console.error(`[void/env] ${UNMASK_ENV_VAR}=1 is set — env validation errors will include raw values. Unset it before sharing logs.`);
-		} catch {}
-	}
-	return active;
+	if (unmaskResolved) console.error(`[void/env] ${UNMASK_ENV_VAR}=1 is set — env validation errors will include raw values. Unset it before sharing logs.`);
+	return unmaskResolved;
 }
 //#endregion
 //#region src/runtime/env-public.ts
@@ -127,21 +118,10 @@ function defineEnv(schema) {
 	return env;
 }
 /**
-* Internal: validate the entire schema against the worker's actual env on
-* the first request per isolate. Catches bad remote-secret values and
-* post-deploy drift that the deploy CLI can't see (it only knows secret
-* names, not their values).
-*
-* Spliced into the generated worker entry by `compileWorkerEntry`. Cached
-* after the first call so subsequent requests pay no cost.
-*
-* Async lifecycle: this function awaits any async Standard Schema
-* validators (zod `refine`, arktype async narrows, etc.) and seeds the
-* per-key cache with the resolved values. Subsequent reads via `env.X`
-* hit the sync cache — async work only happens here, at boot. If a user
-* accesses `env.X` for a key with an async validator *before* this
-* function has run (e.g. during module-top-level code), the proxy will
-* throw with guidance pointing back to this boot-time pre-validation.
+* Internal: validate the whole schema against the worker env once per isolate,
+* from the generated worker entry. Catches remote-secret values the deploy CLI
+* cannot see. Async validators are awaited here and their values cached, so
+* later synchronous `env.X` reads can serve them.
 */
 async function _validateEnvOnce(envValues) {
 	if (registry.bootValidation) {
@@ -258,13 +238,7 @@ function readKey(key) {
 /**
 * Typed env proxy. Reads from the runtime env, validating declared keys
 * on first access and passing through bindings / unknown keys unchanged.
-*
-* Sync-only: the `get` trap must be synchronous, so validators that return
-* a `Promise` cannot be awaited here. For async Standard Schema validators,
-* `_validateEnvOnce()` pre-resolves them at worker boot and seeds the
-* per-env cache; property reads then serve the cached value synchronously.
-* If an async validator is encountered here without a prior pre-validation,
-* the trap throws with guidance on how to resolve it.
+* Async validators must be resolved first by `_validateEnvOnce()`.
 */
 const env = new Proxy({}, {
 	get(_target, key) {

package/dist/runtime/env.d.mts

@@ -6,18 +6,7 @@ type RuntimeEnv = Record<string, unknown>;
 /** @internal Reuse a resource only within the current runtime request. */
 export declare function getRuntimeRequestResource<T>(key: object, initialize: () => T, outsideScope?: () => T): T;
 export declare function withRuntimeEnv<T>(env: unknown, fn: () => T): T;
-/**
- * Shared internal-binding predicate. A binding is framework-internal — and must
- * never be exposed to user code — when it carries an internal prefix
- * (`__VOID_`, `__PROJECT_`; always hidden) or is an exact-name internal (e.g.
- * `ISR_CACHE`; hidden ONLY while ISR is active for the isolate). `rawEnv` is the
- * unfiltered runtime env, consulted via {@link isIsrActive} to gate the
- * exact-name check so a non-ISR app's own `ISR_CACHE` binding stays visible —
- * matching the build-time `isr` gate on the generated `c.env` filter.
- *
- * Single source of truth for the runtime `env` filter here and the public
- * `void/env` proxy (`env-public.ts`).
- */
+/** Whether `name` is a framework binding hidden from user code; `rawEnv` is the unfiltered env. */
 export declare function isInternalBinding(name: string, rawEnv: RuntimeEnv): boolean;
 /** Returns the runtime env with internal platform bindings hidden. */
 export declare function getRuntimeEnv(): RuntimeEnv;

package/dist/runtime/env.mjs

@@ -1,2 +1 @@
-import { a as requireRuntimeBinding, i as isInternalBinding, n as getRuntimeEnv, o as withRuntimeEnv, r as getRuntimeRequestResource, t as getRuntimeBinding } from "../env-DMA3cXZt.mjs";
-export { getRuntimeBinding, getRuntimeEnv, getRuntimeRequestResource, isInternalBinding, requireRuntimeBinding, withRuntimeEnv };
+export { t as getRuntimeBinding, n as getRuntimeEnv, r as getRuntimeRequestResource, i as isInternalBinding, a as requireRuntimeBinding, o as withRuntimeEnv } from "../env-0jrMQJI_.mjs";

package/dist/runtime/handler.d.mts

@@ -1,3 +1,3 @@
 /// <reference types="@cloudflare/workers-types" />
-import { C as defer, E as ValidatorSlots, S as InferProps, T as HandlerInput, _ as defineQueue, a as CloudEnv, b as Deferred, c as QueueRetryOptions, d as TypedQueueHandler, f as VoidAssetRewriteError, g as defineMiddleware, h as defineHead, i as CloudContextVariables, l as RenderAssetTags, m as defineHandler, n as CloudBindings, o as QueueBatch, p as basicAuth, r as CloudContext, s as QueueMessage, t as BasicAuthOptions, u as TypedHandler, v as defineRender, w as ValidationError, y as defineScheduled } from "../handler-CNAwjRcW.mjs";
+import { C as defer, E as ValidatorSlots, S as InferProps, T as HandlerInput, _ as defineQueue, a as CloudEnv, b as Deferred, c as QueueRetryOptions, d as TypedQueueHandler, f as VoidAssetRewriteError, g as defineMiddleware, h as defineHead, i as CloudContextVariables, l as RenderAssetTags, m as defineHandler, n as CloudBindings, o as QueueBatch, p as basicAuth, r as CloudContext, s as QueueMessage, t as BasicAuthOptions, u as TypedHandler, v as defineRender, w as ValidationError, y as defineScheduled } from "../handler-_PqY82xe.mjs";
 export { BasicAuthOptions, CloudBindings, CloudContext, CloudContextVariables, CloudEnv, type Deferred, type HandlerInput, type InferProps, QueueBatch, QueueMessage, QueueRetryOptions, RenderAssetTags, TypedHandler, TypedQueueHandler, ValidationError, type ValidatorSlots, VoidAssetRewriteError, basicAuth, defer, defineHandler, defineHead, defineMiddleware, defineQueue, defineRender, defineScheduled };

package/dist/runtime/handler.mjs

@@ -1,3 +1,3 @@
 import { r as defer, t as ValidationError } from "../validation-error-Dg9Recn1.mjs";
-import { a as defineMiddleware, c as defineScheduled, i as defineHead, n as basicAuth, o as defineQueue, r as defineHandler, s as defineRender, t as VoidAssetRewriteError } from "../handler-BHAn2fZJ.mjs";
+import { a as defineMiddleware, c as defineScheduled, i as defineHead, n as basicAuth, o as defineQueue, r as defineHandler, s as defineRender, t as VoidAssetRewriteError } from "../handler-BZ1t7-Rv.mjs";
 export { ValidationError, VoidAssetRewriteError, basicAuth, defer, defineHandler, defineHead, defineMiddleware, defineQueue, defineRender, defineScheduled };

package/dist/runtime/isr.mjs

@@ -1,4 +1,4 @@
-import { a as getRawRuntimeEnv } from "../env-raw-jZpP5n47.mjs";
+import { a as getRawRuntimeEnv } from "../env-raw-D74P4ebM.mjs";
 import { isrEdgeCacheUrlForToken, splitIsrCacheKey } from "@void/isr";
 import { denormalizeIsrPath, isrKey, isrPrefix, isrVariantPrefix, listIsrHosts } from "@void/isr/runtime";
 //#region src/runtime/isr.ts

package/dist/runtime/kv.mjs

@@ -1,4 +1,4 @@
-import { a as requireRuntimeBinding } from "../env-DMA3cXZt.mjs";
+import { a as requireRuntimeBinding } from "../env-0jrMQJI_.mjs";
 //#region src/runtime/kv.ts
 function parseValue(raw) {
 	if (raw === null) return null;

package/dist/runtime/limits.mjs

@@ -1,2 +1 @@
-import { i as readUsageLimit, n as asUsageLimit, r as limitFromResponse, t as UsageLimit } from "../limits-D0vD1M9A.mjs";
-export { UsageLimit, asUsageLimit, limitFromResponse, readUsageLimit };
+export { t as UsageLimit, n as asUsageLimit, r as limitFromResponse, i as readUsageLimit } from "../limits-D0vD1M9A.mjs";

package/dist/runtime/live-client.d.mts

@@ -1,4 +1,4 @@
-import { t as LiveClientEvent } from "../live-Du8jXwOW.mjs";
+import { t as LiveClientEvent } from "../live-DJONVlQK.mjs";
 //#region src/runtime/live-client.d.ts
 export type LiveSubscribeOptions<Data = unknown> = {
   id: string;
@@ -29,4 +29,5 @@ type EventSourceConstructor = new (url: string, options?: {
   withCredentials?: boolean;
 }) => EventSourceLike;
 export declare function connectLiveStream(url: string | URL, options?: ConnectLiveStreamOptions): LiveClient;
-//#endregion
+//#endregion
+export {};

package/dist/runtime/live-server.d.mts

@@ -9,4 +9,5 @@ export type LiveDurableObjectClass = {
   new (state: DurableObjectState, env: LiveDurableObjectEnv): LiveDurableObjectInstance;
 };
 export declare function createLiveDurableObject(): LiveDurableObjectClass;
-//#endregion
+//#endregion
+export {};