cloudflare-next-intl 0.9.14 → 0.9.17

package/README.md

@@ -258,9 +258,9 @@ export default defineConfig({
 ##### What `cloudflareNextIntl()` Does
 1. **Auto Dynamic Pages for SSG (`autoDynamicPages`)**: Automatically scans your Next.js/Vinext App Router pages during Vite configuration (`configResolved`) and inserts `export const dynamic = "force-static"` for all static pages that do not access dynamic APIs, or `export const dynamic = "force-dynamic"` for pages that do. This ensures Vinext builds all public marketing and static pages into SSG HTML automatically without extra build scripts or manually writing `export const dynamic`.
 
-   The scan (`checkDynamicPages`, also usable standalone from `cloudflare-next-intl/checkDynamicPages`) is a text heuristic, not a real parser, so it's deliberately conservative and follows a page's own local (relative/`@/`-alias) imports transitively — cycle-safe, capped at 300 files — so a signal several files away (a component's repository calling `cookies()`) still marks the page dynamic, not just literal text in the page file itself. Recognized signals: `cookies()`, `headers()`, `searchParams`, `unstable_noStore()`, `connection()`, `cache: "no-store"`, `next: { revalidate: 0 }`, and this package's own `getAuthUser()`/`useAuthUser()`/`withUserDb()` (each of which reads `cookies()` internally). Set `resolveImports: false` on `checkDynamicPages` to restore the original single-file-only scan, or pass `aliases` to override the default `@/` → `<appDir>/..` mapping.
+   The scan (`checkDynamicPages`, also usable standalone from `cloudflare-next-intl/checkDynamicPages`) is a text heuristic, not a real parser, so it's deliberately conservative and follows a page's own local (relative/`@/`-alias) imports transitively — cycle-safe, capped at 300 files — so a signal several files away (a component's repository calling `cookies()`) still marks the page dynamic, not just literal text in the page file itself. A locally-imported file that opens with a `"use server"` directive is never opened by the scan (its exports are Server Actions, invoked only on explicit call — never merely by being imported), the same treatment a bare npm-package import already gets. Recognized signals: `cookies()`, `headers()`, `searchParams`, `unstable_noStore()`, `connection()`, `cache: "no-store"`, `next: { revalidate: 0 }`, and this package's own `getAuthUser()`/`useAuthUser()`/`withUserDb()` (each of which reads `cookies()` internally) — except a `useAuthUser()` call in a file that opens with `"use client"`, which is this package's client-side hook (a different export under the same name) and contributes no signal. Set `resolveImports: false` on `checkDynamicPages` to restore the original single-file-only scan, or pass `aliases` to override the default `@/` → `<appDir>/..` mapping.
 
-   Being text-only and transitive, it can over-flag: any local file the page reaches — however many imports away — that merely *calls* a recognized signal counts, even along a branch that never runs in production (a `Config.isDev`-gated `fetch(..., { cache: "no-store" })`) or one that's optional/best-effort (a `try`/`catch`-wrapped `getAuthUser()` used only to tag a log line). It cannot see that a call is conditional or swallowed. For a page whose only reason for being flagged is that kind of optional read — attaching "whoever's signed in, if anyone" to an error report, analytics event, or log line — switch that read to `resolveOptionalAuthUser()` (`cloudflare-next-intl/resolveOptionalAuthUser`, see Firebase Auth below): it wraps `getAuthUser()` the same way but, being an npm-package import, is a boundary the scan doesn't open, so it contributes no signal.
+   Being text-only and transitive, it can over-flag: any local file the page reaches — however many imports away — that merely *calls* a recognized signal counts, even along a branch that never runs in production (a `Config.isDev`-gated `fetch(..., { cache: "no-store" })`) or one that's optional/best-effort (a `try`/`catch`-wrapped `getAuthUser()` used only to tag a log line). It cannot see that a call is conditional or swallowed. For a page whose only reason for being flagged is that kind of optional read — attaching "whoever's signed in, if anyone" to an error report, analytics event, or log line — switch that read to `resolveOptionalAuthUser()` (`cloudflare-next-intl/resolveOptionalAuthUser`, see Firebase Auth below): it wraps `getAuthUser()` the same way but, being an npm-package import, is a boundary the scan doesn't open, so it contributes no signal. If that read lives in a shared `onError` sink used by many pages at once, `resolveErrorReportingUser(useAuthUser?)` (same subpath) is the more precise fix: it's off (`{ user: null }`, no `getAuthUser()` call) by default, and only a `reportError({ ..., useAuthUser: true })` call site that actually wants the user on that report opts in per-call — instead of every page reaching that sink getting flagged.
 2. **Build-Time & Dev Image Optimizer (`imageOptimizer`)**: Automatically scans your image directories (`public/images`, `public/icons`), downscales oversized assets, produces sibling formats (`webp` by default; also supports `avif`, `png`, `jpeg`, `gif`, `tiff`, `heif`, `jp2`, `jxl`), generates 8px `.blur.webp` thumbnails with Next.js-matching SVG Gaussian blur placeholders, and provides transparent `<Image placeholder="blur" />` shimming via virtual modules. When more than one format is generated for an image, the shim renders a `<picture>` with one `<source>` per format — ordered exactly as configured — so the browser picks the best format it supports, with the original untouched file as an `onError` fallback if a generated asset fails to load. When the same image is used at different widths across the codebase, each size gets its own generated variant, and each `<Image>` usage automatically resolves to the closest matching size.
 3. **Locale File Bundling & Resolution (`localeFiles`)**: Resolves `@locale-file/*` to your `./messages` directory and transforms dynamic imports into `import.meta.glob('/messages/*.json', { eager: true })` for lightning-fast locale loading on Cloudflare Workers.
 4. **User-Agent Stub (`userAgentStub`)**: Prevents Next.js `user-agent` from importing `node:fs` during workerd runtime execution (which otherwise causes runtime 404 / 500 crashes in Workers proxy/middleware).
@@ -480,6 +480,23 @@ Features include:
 - `followSameOriginContinueUrl`: Automatically forwards emailed action links with `continueUrl` to the specified path (or external URL) directly from `intlMiddleware` (default `true`; set `false` on `firebaseAuth` config to disable). If `continueUrl` points to home root (`/`), it resolves to `actionLinkPath` (if set) or the mode target path (e.g. `/reset-password`).
 - `appCheck`: Firebase App Check integration supporting reCAPTCHA Enterprise (`recaptchaEnterpriseSiteKey`) and reCAPTCHA v3 (`recaptchaV3SiteKey`). For reCAPTCHA v3, defaults to a `CustomProvider` using `IntlHelperScript`'s explicit script tag to avoid iframe/webworker CDN integrity issues in private windows (`useExplicitRecaptchaScript: false` to opt out). Supports server-side token minting via service accounts.
 - `resolveOptionalAuthUser()` (`cloudflare-next-intl/resolveOptionalAuthUser`): best-effort variant of `getAuthUser()` for callers that want to *attach* the current user when one happens to be known — error/telemetry reporting, analytics, logging — without failing or changing behavior when no request/session context is available. Swallows every failure and resolves `{ user: null }` instead of throwing. Use `getAuthUser()` (not this) whenever your own output actually depends on who's signed in — `checkDynamicPages` (below) treats `getAuthUser()`/`useAuthUser()`/`withUserDb()` as page-blocking dynamic-API signals but does not follow into this helper, so it's also the way to read "whoever's signed in, if anyone" from a page or a module it imports without forcing that page dynamic.
+- `resolveErrorReportingUser(useAuthUser?)` (same subpath): gated form of `resolveOptionalAuthUser()` for an `onError` sink — pass `ErrorHandlingParams.useAuthUser` straight through. Defaults to `false`: when not `true`, resolves `{ user: null }` immediately without calling `getAuthUser()` at all, so a page reached only through your `onError` sink's default path stays static-eligible. A specific `reportError({ ..., useAuthUser: true })` call site opts in per-call when it actually wants the user on that report.
+
+  ```ts
+  // your onError sink
+  import { resolveErrorReportingUser } from "cloudflare-next-intl/resolveOptionalAuthUser";
+
+  export default async function onError(params: ErrorHandlingParams) {
+      const { user } = await resolveErrorReportingUser(params.useAuthUser);
+      // ...write params + user?.email to your error store
+  }
+  ```
+
+  A specific call site rarely needs to set `useAuthUser: true` by hand: `syncErrorReportingAuthUser` (`cloudflare-next-intl/checkDynamicPages`, also `checkDynamicPages`'s and the Vite plugin's `syncErrorReportingAuthUser` option, default `false`) does it for you — it finds every `reportError()` call reached *only* from pages already confirmed `force-dynamic` and inserts `useAuthUser: true` there automatically, leaving alone any call reachable from even one static/unknown-status page. Opt in explicitly (it mutates call-site arguments across your app, a bigger change than the top-of-file `export const dynamic` insertion `checkDynamicPages` does by default):
+
+  ```ts
+  await checkDynamicPages({ appDir, mode: "fix", syncErrorReportingAuthUser: true });
+  ```
 
 ```tsx
 import ThemeSwitcher from "cloudflare-next-intl/ThemeSwitcher";

package/dist/src/db/resolve_hyperdrive_connection_string.d.ts

@@ -2,4 +2,4 @@ import type { GenerateRoutingConfig } from '../types/types.js';
 export interface HyperdriveBindingLike {
     connectionString: string;
 }
-export declare function resolveHyperdriveConnectionString(generate?: GenerateRoutingConfig): Promise<string | undefined>;
+export declare function resolveHyperdriveConnectionString(generate?: GenerateRoutingConfig, skipUrls?: readonly string[]): Promise<string | undefined>;

package/dist/src/db/resolve_hyperdrive_connection_string.js

@@ -1,10 +1,11 @@
 import { resolveEnv } from '../server/functions/geo.js';
 const WRANGLER_DEV_PLACEHOLDER = 'postgresql://user:pass@localhost:5432/db';
-export async function resolveHyperdriveConnectionString(generate) {
+const DEFAULT_SKIP_URLS = [WRANGLER_DEV_PLACEHOLDER];
+export async function resolveHyperdriveConnectionString(generate, skipUrls = DEFAULT_SKIP_URLS) {
     const env = await resolveEnv(generate);
     const binding = env?.HYPERDRIVE;
     const connectionString = binding?.connectionString;
-    if (!connectionString || connectionString === WRANGLER_DEV_PLACEHOLDER)
+    if (!connectionString || skipUrls.includes(connectionString))
         return undefined;
     return connectionString;
 }

package/dist/src/db/resolve_mode.js

@@ -5,7 +5,7 @@ export default async function resolveDbMode(db, generate) {
     if (connectionString)
         return { mode: 'postgres', connectionString };
     if (db.autoHyperdrive !== false) {
-        const hyperdriveConnectionString = await resolveHyperdriveConnectionString(generate);
+        const hyperdriveConnectionString = await resolveHyperdriveConnectionString(generate, db.autoHyperdriveSkipUrls);
         if (hyperdriveConnectionString)
             return { mode: 'postgres', connectionString: hyperdriveConnectionString };
     }

package/dist/src/dynamic_pages_check/check_dynamic_pages.d.ts

@@ -1,3 +1,4 @@
+import { type SyncErrorReportingAuthUserReport } from './sync_error_reporting_auth_user.js';
 import type { AliasConfig } from './resolve_local_imports.js';
 export type DynamicPagesCheckMode = 'off' | 'report' | 'fix';
 export interface CheckDynamicPagesOptions {
@@ -7,6 +8,7 @@ export interface CheckDynamicPagesOptions {
     skip?: readonly string[];
     resolveImports?: boolean;
     aliases?: readonly AliasConfig[];
+    syncErrorReportingAuthUser?: boolean;
 }
 export interface CheckDynamicPagesReport {
     file: string;
@@ -18,4 +20,4 @@ export interface CheckDynamicPagesIo {
     writeFile?: (file: string, contents: string) => void;
     isFile?: (file: string) => boolean;
 }
-export declare function checkDynamicPages(options: CheckDynamicPagesOptions, io?: CheckDynamicPagesIo): Promise<CheckDynamicPagesReport[]>;
+export declare function checkDynamicPages(options: CheckDynamicPagesOptions, io?: CheckDynamicPagesIo): Promise<(CheckDynamicPagesReport | SyncErrorReportingAuthUserReport)[]>;

package/dist/src/dynamic_pages_check/check_dynamic_pages.js

@@ -4,6 +4,7 @@ import { findPageFiles as findPageFilesImpl } from './find_page_files.js';
 import { detectDynamicUsage } from './detect_dynamic_usage.js';
 import { traceDynamicUsage } from './trace_dynamic_usage.js';
 import { insertDynamicExport } from './insert_dynamic_export.js';
+import { syncErrorReportingAuthUser } from './sync_error_reporting_auth_user.js';
 function defaultIsFile(path) {
     try {
         return statSync(path).isFile();
@@ -62,5 +63,9 @@ export async function checkDynamicPages(options, io = {}) {
             reports.push({ file, action: 'would-add-force-dynamic' });
         }
     }
+    if (options.syncErrorReportingAuthUser === true) {
+        const syncReports = await syncErrorReportingAuthUser({ appDir: options.appDir, mode: options.mode, target: options.target, skip: options.skip, aliases: options.aliases }, { findPageFiles, readFile, writeFile, isFile });
+        reports.push(...syncReports);
+    }
     return reports;
 }

package/dist/src/dynamic_pages_check/collect_reachable_files.d.ts

@@ -0,0 +1,7 @@
+import { type AliasConfig } from './resolve_local_imports.js';
+export interface CollectReachableFilesIo {
+    readFile: (file: string) => string;
+    isFile?: (file: string) => boolean;
+}
+export declare const MAX_FILES_VISITED = 300;
+export declare function collectReachableFiles(entryFile: string, entrySource: string, aliases: readonly AliasConfig[], io: CollectReachableFilesIo): Map<string, string>;

package/dist/src/dynamic_pages_check/collect_reachable_files.js

@@ -0,0 +1,36 @@
+import { extractImportSpecifiers, resolveLocalImport } from './resolve_local_imports.js';
+export const MAX_FILES_VISITED = 300;
+const USE_SERVER_DIRECTIVE = /^(?:\s*['"]use \w[\w-]*['"]\s*;?\s*)*['"]use server['"]\s*;?/;
+function hasLeadingUseServerDirective(source) {
+    return USE_SERVER_DIRECTIVE.test(source);
+}
+export function collectReachableFiles(entryFile, entrySource, aliases, io) {
+    const isFile = io.isFile ?? (() => false);
+    const files = new Map([[entryFile, entrySource]]);
+    const queue = [entryFile];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (files.size >= MAX_FILES_VISITED)
+            continue;
+        const source = files.get(current);
+        for (const specifier of extractImportSpecifiers(source)) {
+            if (files.size >= MAX_FILES_VISITED)
+                break;
+            const resolved = resolveLocalImport(specifier, current, aliases, isFile);
+            if (resolved === null || files.has(resolved))
+                continue;
+            let importedSource;
+            try {
+                importedSource = io.readFile(resolved);
+            }
+            catch {
+                continue;
+            }
+            if (hasLeadingUseServerDirective(importedSource))
+                continue;
+            files.set(resolved, importedSource);
+            queue.push(resolved);
+        }
+    }
+    return files;
+}

package/dist/src/dynamic_pages_check/detect_dynamic_usage.d.ts

@@ -3,3 +3,4 @@ export interface DynamicDetectionResult {
     detectedDynamicApis: string[];
 }
 export declare function detectDynamicUsage(sourceText: string): DynamicDetectionResult;
+export declare function readExplicitDynamicValue(sourceText: string): 'force-static' | 'force-dynamic' | 'auto' | 'error' | null;

package/dist/src/dynamic_pages_check/detect_dynamic_usage.js

@@ -7,13 +7,28 @@ const DYNAMIC_API_CHECKS = [
     { name: 'cache: "no-store"', pattern: /cache:\s*['"]no-store['"]/ },
     { name: 'next: { revalidate: 0 }', pattern: /next:\s*\{\s*revalidate:\s*0\s*[,}]/ },
     { name: 'getAuthUser()', pattern: /\bgetAuthUser\s*\(/ },
-    { name: 'useAuthUser()', pattern: /\buseAuthUser\s*\(/ },
     { name: 'withUserDb()', pattern: /\bwithUserDb\s*\(/ },
 ];
+const USE_AUTH_USER_CALL = /\buseAuthUser\s*\(/;
+const USE_CLIENT_DIRECTIVE = /^(?:\s*['"]use \w[\w-]*['"]\s*;?\s*)*['"]use client['"]\s*;?/;
 const EXPLICIT_DYNAMIC_EXPORT = /export\s+const\s+dynamic\s*=/;
 export function detectDynamicUsage(sourceText) {
+    const detectedDynamicApis = DYNAMIC_API_CHECKS.filter(({ pattern }) => pattern.test(sourceText)).map(({ name }) => name);
+    if (USE_AUTH_USER_CALL.test(sourceText) && !USE_CLIENT_DIRECTIVE.test(sourceText)) {
+        detectedDynamicApis.push('useAuthUser()');
+    }
     return {
         hasExplicitDynamicExport: EXPLICIT_DYNAMIC_EXPORT.test(sourceText),
-        detectedDynamicApis: DYNAMIC_API_CHECKS.filter(({ pattern }) => pattern.test(sourceText)).map(({ name }) => name),
+        detectedDynamicApis,
     };
 }
+const EXPLICIT_DYNAMIC_EXPORT_VALUE = /export\s+const\s+dynamic\s*=\s*['"]([^'"]+)['"]/;
+export function readExplicitDynamicValue(sourceText) {
+    const match = EXPLICIT_DYNAMIC_EXPORT_VALUE.exec(sourceText);
+    if (match === null)
+        return null;
+    const value = match[1];
+    if (value === 'force-static' || value === 'force-dynamic' || value === 'auto' || value === 'error')
+        return value;
+    return null;
+}

package/dist/src/dynamic_pages_check/find_report_error_calls.d.ts

@@ -0,0 +1,5 @@
+export interface ReportErrorCall {
+    insertPos: number | null;
+    hasExplicitUseAuthUser: boolean;
+}
+export declare function findReportErrorCalls(sourceText: string): ReportErrorCall[];

package/dist/src/dynamic_pages_check/find_report_error_calls.js

@@ -0,0 +1,71 @@
+const REPORT_ERROR_CALL = /\breportError\s*\(/g;
+export function findReportErrorCalls(sourceText) {
+    const calls = [];
+    REPORT_ERROR_CALL.lastIndex = 0;
+    let match;
+    while ((match = REPORT_ERROR_CALL.exec(sourceText)) !== null) {
+        calls.push(parseCallArgs(sourceText, match.index + match[0].length));
+    }
+    return calls;
+}
+function parseCallArgs(sourceText, start) {
+    let depth = 1;
+    let i = start;
+    let firstArgEnd = -1;
+    let callEnd = -1;
+    while (i < sourceText.length && callEnd === -1) {
+        const ch = sourceText[i];
+        if (ch === '"' || ch === "'" || ch === '`') {
+            i = skipStringLiteral(sourceText, i, ch);
+            continue;
+        }
+        if (ch === '/' && sourceText[i + 1] === '/') {
+            const nextNewline = sourceText.indexOf('\n', i);
+            i = nextNewline === -1 ? sourceText.length : nextNewline;
+            continue;
+        }
+        if (ch === '/' && sourceText[i + 1] === '*') {
+            const end = sourceText.indexOf('*/', i + 2);
+            i = end === -1 ? sourceText.length : end + 2;
+            continue;
+        }
+        if (ch === '(' || ch === '{' || ch === '[') {
+            depth += 1;
+        }
+        else if (ch === ')' || ch === '}' || ch === ']') {
+            depth -= 1;
+            if (depth === 0) {
+                callEnd = i;
+                break;
+            }
+        }
+        else if (ch === ',' && depth === 1 && firstArgEnd === -1) {
+            firstArgEnd = i;
+        }
+        i += 1;
+    }
+    if (firstArgEnd === -1 || callEnd === -1) {
+        return { insertPos: null, hasExplicitUseAuthUser: false };
+    }
+    const paramsText = sourceText.slice(firstArgEnd + 1, callEnd);
+    const hasExplicitUseAuthUser = /\buseAuthUser\b/.test(paramsText);
+    const leadingWhitespace = paramsText.length - paramsText.trimStart().length;
+    const paramsStart = firstArgEnd + 1 + leadingWhitespace;
+    if (sourceText[paramsStart] !== '{') {
+        return { insertPos: null, hasExplicitUseAuthUser };
+    }
+    return { insertPos: paramsStart + 1, hasExplicitUseAuthUser };
+}
+function skipStringLiteral(sourceText, start, quote) {
+    let i = start + 1;
+    while (i < sourceText.length) {
+        if (sourceText[i] === '\\') {
+            i += 2;
+            continue;
+        }
+        if (sourceText[i] === quote)
+            return i + 1;
+        i += 1;
+    }
+    return sourceText.length;
+}

package/dist/src/dynamic_pages_check/sync_error_reporting_auth_user.d.ts

@@ -0,0 +1,21 @@
+import type { AliasConfig } from './resolve_local_imports.js';
+import type { DynamicPagesCheckMode } from './check_dynamic_pages.js';
+export interface SyncErrorReportingAuthUserOptions {
+    appDir: string;
+    mode?: DynamicPagesCheckMode;
+    target?: 'next' | 'vinext';
+    skip?: readonly string[];
+    aliases?: readonly AliasConfig[];
+}
+export interface SyncErrorReportingAuthUserReport {
+    file: string;
+    action: 'added-use-auth-user' | 'would-add-use-auth-user';
+    callCount: number;
+}
+export interface SyncErrorReportingAuthUserIo {
+    findPageFiles?: (appDir: string) => string[];
+    readFile?: (file: string) => string;
+    writeFile?: (file: string, contents: string) => void;
+    isFile?: (file: string) => boolean;
+}
+export declare function syncErrorReportingAuthUser(options: SyncErrorReportingAuthUserOptions, io?: SyncErrorReportingAuthUserIo): Promise<SyncErrorReportingAuthUserReport[]>;

package/dist/src/dynamic_pages_check/sync_error_reporting_auth_user.js

@@ -0,0 +1,73 @@
+import { readFileSync, statSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { findPageFiles as findPageFilesImpl } from './find_page_files.js';
+import { detectDynamicUsage, readExplicitDynamicValue } from './detect_dynamic_usage.js';
+import { collectReachableFiles } from './collect_reachable_files.js';
+import { findReportErrorCalls } from './find_report_error_calls.js';
+function defaultIsFile(path) {
+    try {
+        return statSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function isConfirmedDynamic(source, reachableApis, target) {
+    const explicit = readExplicitDynamicValue(source);
+    if (explicit !== null)
+        return explicit === 'force-dynamic';
+    if (target === 'vinext')
+        return reachableApis.length > 0;
+    return false;
+}
+export async function syncErrorReportingAuthUser(options, io = {}) {
+    const mode = options.mode ?? 'report';
+    if (mode === 'off')
+        return [];
+    const target = options.target ?? 'next';
+    const findPageFiles = io.findPageFiles ?? findPageFilesImpl;
+    const readFile = io.readFile ?? ((file) => readFileSync(file, 'utf8'));
+    const writeFile = io.writeFile ?? ((file, contents) => writeFileSync(file, contents, 'utf8'));
+    const isFile = io.isFile ?? defaultIsFile;
+    const skipSet = new Set(options.skip ?? []);
+    const aliases = options.aliases ?? [
+        { prefix: '@/', replacement: resolve(options.appDir, '..') },
+    ];
+    const dynamicReachable = new Set();
+    const notConfirmedReachable = new Set();
+    const fileSources = new Map();
+    for (const page of findPageFiles(options.appDir)) {
+        if (skipSet.has(page))
+            continue;
+        const source = readFile(page);
+        const files = collectReachableFiles(page, source, aliases, { readFile, isFile });
+        const apis = new Set();
+        for (const [file, fileSource] of files) {
+            fileSources.set(file, fileSource);
+            detectDynamicUsage(fileSource).detectedDynamicApis.forEach((api) => apis.add(api));
+        }
+        const bucket = isConfirmedDynamic(source, [...apis], target) ? dynamicReachable : notConfirmedReachable;
+        for (const file of files.keys())
+            bucket.add(file);
+    }
+    const safeFiles = [...dynamicReachable].filter((file) => !notConfirmedReachable.has(file));
+    const reports = [];
+    for (const file of safeFiles) {
+        const source = fileSources.get(file);
+        const calls = findReportErrorCalls(source).filter((call) => call.insertPos !== null && !call.hasExplicitUseAuthUser);
+        if (calls.length === 0)
+            continue;
+        if (mode === 'fix') {
+            let rewritten = source;
+            for (const call of [...calls].sort((a, b) => b.insertPos - a.insertPos)) {
+                rewritten = `${rewritten.slice(0, call.insertPos)}useAuthUser: true, ${rewritten.slice(call.insertPos)}`;
+            }
+            writeFile(file, rewritten);
+            reports.push({ file, action: 'added-use-auth-user', callCount: calls.length });
+        }
+        else {
+            reports.push({ file, action: 'would-add-use-auth-user', callCount: calls.length });
+        }
+    }
+    return reports;
+}

package/dist/src/dynamic_pages_check/trace_dynamic_usage.d.ts

@@ -1,7 +1,5 @@
 import { type DynamicDetectionResult } from './detect_dynamic_usage.js';
-import { type AliasConfig } from './resolve_local_imports.js';
-export interface TraceDynamicUsageIo {
-    readFile: (file: string) => string;
-    isFile?: (file: string) => boolean;
-}
+import { type CollectReachableFilesIo } from './collect_reachable_files.js';
+import type { AliasConfig } from './resolve_local_imports.js';
+export type TraceDynamicUsageIo = CollectReachableFilesIo;
 export declare function traceDynamicUsage(entryFile: string, entrySource: string, aliases: readonly AliasConfig[], io: TraceDynamicUsageIo): DynamicDetectionResult;

package/dist/src/dynamic_pages_check/trace_dynamic_usage.js

@@ -1,39 +1,17 @@
 import { detectDynamicUsage } from './detect_dynamic_usage.js';
-import { extractImportSpecifiers, resolveLocalImport } from './resolve_local_imports.js';
-const MAX_FILES_VISITED = 300;
+import { collectReachableFiles } from './collect_reachable_files.js';
 export function traceDynamicUsage(entryFile, entrySource, aliases, io) {
-    const isFile = io.isFile ?? (() => false);
-    const visited = new Set([entryFile]);
-    const queue = [{ file: entryFile, source: entrySource }];
+    const files = collectReachableFiles(entryFile, entrySource, aliases, io);
     let hasExplicitDynamicExport = false;
     const detectedApis = new Set();
     let first = true;
-    while (queue.length > 0) {
-        const current = queue.shift();
-        const detection = detectDynamicUsage(current.source);
+    for (const source of files.values()) {
+        const detection = detectDynamicUsage(source);
         if (first) {
             hasExplicitDynamicExport = detection.hasExplicitDynamicExport;
             first = false;
         }
         detection.detectedDynamicApis.forEach((api) => detectedApis.add(api));
-        if (visited.size >= MAX_FILES_VISITED)
-            continue;
-        for (const specifier of extractImportSpecifiers(current.source)) {
-            if (visited.size >= MAX_FILES_VISITED)
-                break;
-            const resolved = resolveLocalImport(specifier, current.file, aliases, isFile);
-            if (resolved === null || visited.has(resolved))
-                continue;
-            visited.add(resolved);
-            let importedSource;
-            try {
-                importedSource = io.readFile(resolved);
-            }
-            catch {
-                continue;
-            }
-            queue.push({ file: resolved, source: importedSource });
-        }
     }
     return { hasExplicitDynamicExport, detectedDynamicApis: [...detectedApis] };
 }

package/dist/src/firebase_auth/server/resolve_optional_auth_user.d.ts

@@ -2,3 +2,6 @@ import type { User } from '@firebase/auth';
 export default function resolveOptionalAuthUser(): Promise<{
     user: User | null;
 }>;
+export declare function resolveErrorReportingUser(useAuthUser?: boolean): Promise<{
+    user: User | null;
+}>;

package/dist/src/firebase_auth/server/resolve_optional_auth_user.js

@@ -8,3 +8,8 @@ export default async function resolveOptionalAuthUser() {
         return { user: null };
     }
 }
+export async function resolveErrorReportingUser(useAuthUser) {
+    if (useAuthUser !== true)
+        return { user: null };
+    return resolveOptionalAuthUser();
+}

package/dist/src/types/types.d.ts

@@ -54,6 +54,7 @@ export interface ErrorHandlingParams {
     consent?: ConsentValue;
     formattedMessage?: string;
     dedupKey?: string;
+    useAuthUser?: boolean;
 }
 export interface ErrorHandlingRoutingConfig {
     enable?: boolean;
@@ -209,6 +210,7 @@ export interface SupabaseDbConfig {
 export interface DbRoutingConfig {
     connectionString?: FallibleConfigValue<string>;
     autoHyperdrive?: boolean;
+    autoHyperdriveSkipUrls?: string[];
     disconnectAfterRequest?: boolean;
     authenticatedRole?: string | (() => string | Promise<string>);
     authenticatedRoleClaim?: string | false;

package/dist/src/vite/auto_dynamic_pages_plugin.d.ts

@@ -4,5 +4,6 @@ export interface AutoDynamicPagesPluginOptions {
     appDir?: string;
     mode?: DynamicPagesCheckMode;
     target?: 'next' | 'vinext';
+    syncErrorReportingAuthUser?: boolean;
 }
 export declare function autoDynamicPagesPlugin(options?: AutoDynamicPagesPluginOptions): Plugin;

package/dist/src/vite/auto_dynamic_pages_plugin.js

@@ -28,6 +28,7 @@ export function autoDynamicPagesPlugin(options = {}) {
                     appDir,
                     mode: options.mode ?? "fix",
                     target: options.target ?? "vinext",
+                    syncErrorReportingAuthUser: options.syncErrorReportingAuthUser ?? false,
                 });
             }
             catch (err) {

package/llms.txt

@@ -68,6 +68,8 @@ state then isn't shared. Peer resolution guarantees one shared copy instead.
 Two transports, picked by which `db` fields are set — `pg`/`drizzle-orm`/`@supabase/supabase-js` ship as dependencies and load via dynamic `import()`, so nothing bundles unless a `db` export is called.
 
 - Direct Postgres (wins if configured): `db.connectionString` — Postgres connection string, or a sync/async function returning one (resolved on each connect). The function form is the way to read a value unavailable at module scope, e.g. a Cloudflare Hyperdrive binding: `connectionString: async () => (await getCloudflareContext({ async: true })).env.HYPERDRIVE.connectionString`. There is no separate `hyperdriveBinding` option.
+- `db.autoHyperdrive` — when `true` (default) and `db.connectionString` is unset, `env.HYPERDRIVE.connectionString` is read automatically before falling through to `db.supabase`. Set `false` to skip this and go straight to `supabase` (or the "no connection string" error).
+- `db.autoHyperdriveSkipUrls` — connection strings from `env.HYPERDRIVE.connectionString` treated as "no connection" by auto-Hyperdrive (e.g. `wrangler dev`'s unconfigured placeholder). Defaults to `['postgresql://user:pass@localhost:5432/db']`.
 - Supabase Data API (used only when neither of the above is set): `db.supabase` — `{ url?, anonKey?, execFunction?, rawSql? }` where `url`/`anonKey` each accept a string or a sync/async function returning one, defaulting `url`/`anonKey` to `NEXT_PUBLIC_SUPABASE_URL`/`NEXT_PUBLIC_SUPABASE_ANON_KEY`. Statements are translated to PostgREST REST calls first; unsupported statements fall back to `supabase/cfni_exec.sql` (a `security invoker` SQL-exec function) in your database — `cfni-db-codegen`/`cfni-db-install-exec` can install it for you (see below). No multi-statement transactions — each statement in a `withUserDb` callback is its own round-trip; `.transaction()` throws instead of running non-atomically. `rawSql: false` disables `cfni_exec` fallback, throwing an informative error when a query cannot be served over REST.
 - `db.disconnectAfterRequest` — deprecated, ignored since 0.8.23. Each `withPublicDb`/`withUserDb` call opens and closes its own client; Hyperdrive pools the server-side connection.
 - `db.authenticatedRole` — direct-Postgres mode only: Postgres role assumed inside `withUserDb`'s transaction. Accepts a string or a sync/async function returning one. Defaults to `'authenticated'` (Supabase RLS convention).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.9.14",
+  "version": "0.9.17",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",