[morinokami]

In a SvelteKit app on D1 with void installed from npm, void deploy --platform cloudflare puts the VITE_* values from the local .env into the uploaded Worker:

# .env
VITE_API_ORIGIN=http://localhost:8787
VITE_LOCAL_NOTE=only-on-my-laptop

// uploaded Worker (minified)
function m() {
  return Object.fromEntries(Object.entries({
    BASE_URL: "/", DEV: !1, MODE: "production", PROD: !0, SSR: !1,
    VITE_API_ORIGIN: "http://localhost:8787",
    VITE_LOCAL_NOTE: "only-on-my-laptop"
  }).filter(([e]) => e.startsWith("VITE_")));
}

With VITE_API_ORIGIN: url().default('https://api.example.com') in env.ts and no value in the build shell, the deployed Worker answers env.VITE_API_ORIGIN with http://localhost:8787, while the browser bundle has https://api.example.com. VITE_LOCAL_NOTE is not declared in env.ts and is readable too. The docs say builds ignore client values from .env.

Void's env plugin removes .env client values during Kit's build, but Kit's server build leaves an installed void/env as an import, so that module is not compiled there. Before the upload, prepareBundledBuildOutput bundles the adapter's Worker once more with Vite, with the project root as root and no envDir. Vite reads .env there and replaces import.meta.env in void/env with its values. Managed deploys bundle the same entry from .void/bundle, which has no .env.

Fix

The bundle sets envDir: false. Vite reads no env files there; values from the build shell still reach import.meta.env.

Tests

packages/void/test/unit/cf-build-output.test.ts bundles a framework Worker that imports a package reading import.meta.env as a whole, with VITE_ORIGIN in .env and VITE_SHELL_ORIGIN in the environment. The bundle contains the shell value and not the .env value. Without this fix, it contains both.

The SvelteKit playground does not show the problem: it links void from the workspace, so Kit bundles it in its own build and the second bundle finds no import.meta.env to replace.

Verification

• vp test run: 781 files pass, 1 skipped (16,159 tests pass, 29 skipped).
• vp run check: 33/33 pass.
• By hand on a copy of the SvelteKit playground, with void copied into node_modules as a real directory: build, then prepareCfFrameworkBuildOutput and bundleEntry, each run in Miniflare. Without this fix, the native Worker returns the .env values from an API route and renders http://localhost:8787 in a page. With it, the native and managed Workers return the same values: none without a build-shell value, and the build-shell value when VITE_API_ORIGIN is set.
• Not run: void deploy against Cloudflare, and Nuxt, Analog and Astro, which go through the same bundle.

Related: #729 keeps local values out of Astro's Worker through a different path (Astro's env plugin). The two changes touch different files and don't depend on each other.

🤖 Generated with Claude Code