void 0.21.9 → 0.23.0

package/dist/{plugin-inference-BMfKRSqE.mjs → plugin-inference-CXWnn79A.mjs}

@@ -2,11 +2,148 @@ import { a as join, d as toSlash, l as relative } from "./dist-BVqXeR_h.mjs";
 import { n as readProjectPaths } from "./project-paths-GgcMozYz.mjs";
 import { n as globSync, t as glob } from "./dist-Bn8Kodjp.mjs";
 import { a as isObjectExpression, i as isMemberExpression, n as isIdentifier, r as isLiteral, t as isCallExpression } from "./ast-CPGPjb0V.mjs";
-import { n as parseRouteFilename, r as parseWebSocketFilename, t as isRouteEnabledForEnvironment } from "./parse-filename-DioPHiR9.mjs";
+import { a as staticLiteral, n as parseRouteFilename, o as unwrapStaticExpression, r as parseWebSocketFilename, t as isRouteEnabledForEnvironment } from "./parse-filename-CUbj-1MP.mjs";
+import { n as resourceNameWords, t as isResourceName } from "./resource-name-C7LVpcRm.mjs";
 import { r as getSsrServerEntryPath } from "./entry-CF5wvH4w.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { parseSync } from "vite";
 import { parse } from "es-module-lexer/js";
+//#region src/application-features.ts
+/** Apply explicitly named overrides while preserving unrelated source features. */
+function applyBindingOverrides(inferred, overrides) {
+	const bindings = { ...inferred };
+	if (overrides) for (const [key, inferredKey] of Object.entries({
+		db: "needsD1",
+		kv: "needsKV",
+		storage: "needsR2",
+		ai: "needsAI",
+		email: "needsEmail"
+	})) {
+		const value = overrides[key];
+		if (value !== void 0) bindings[inferredKey] = Boolean(value);
+	}
+	return bindings;
+}
+/** Shared database requirement for development and both deployment targets. */
+function needsApplicationDatabase(bindings, migrationCount) {
+	return bindings.needsD1 || bindings.needsAuth || migrationCount > 0;
+}
+//#endregion
+//#region src/shared/resource-definition.ts
+/** Inspect default helper definitions without running application code. */
+function readResourceDefinition(filename, source, helpers) {
+	let program;
+	try {
+		program = parseSync(filename, source).program;
+	} catch {
+		return null;
+	}
+	const constants = /* @__PURE__ */ new Map();
+	const definitions = /* @__PURE__ */ new Map();
+	const importedHelpers = /* @__PURE__ */ new Map();
+	const namespaces = /* @__PURE__ */ new Map();
+	const bindings = /* @__PURE__ */ new Set();
+	function recordBindings(node) {
+		if (isIdentifier(node)) bindings.add(node.name);
+		else if (node?.type === "ObjectPattern") for (const property of node.properties ?? []) recordBindings(property.type === "RestElement" ? property.argument : property.value);
+		else if (node?.type === "ArrayPattern") for (const element of node.elements ?? []) recordBindings(element);
+		else if (node?.type === "AssignmentPattern" || node?.type === "RestElement") recordBindings(node.left ?? node.argument);
+	}
+	for (const statement of program.body ?? []) {
+		if (statement.type === "ImportDeclaration") {
+			const declaration = statement;
+			const source = declaration.source.value;
+			const supported = source === "void/ws" ? /* @__PURE__ */ new Set(["defineRoom", "defineWebSocket"]) : source === "void/durable" ? /* @__PURE__ */ new Set(["defineDurableState"]) : /* @__PURE__ */ new Set();
+			for (const specifier of declaration.specifiers ?? []) {
+				const local = specifier.local;
+				recordBindings(local);
+				if (specifier.type === "ImportNamespaceSpecifier") namespaces.set(specifier.local.name, supported);
+				else if (specifier.type === "ImportSpecifier") {
+					const named = specifier;
+					const imported = isIdentifier(named.imported) ? named.imported.name : staticLiteral(named.imported);
+					if (typeof imported === "string" && supported.has(imported) && helpers.has(imported)) importedHelpers.set(named.local.name, imported);
+				}
+			}
+			continue;
+		}
+		const declaration = statement.type === "ExportNamedDeclaration" ? statement.declaration : statement;
+		recordBindings(declaration?.id);
+		if (declaration?.type !== "VariableDeclaration") continue;
+		for (const variable of declaration.declarations ?? []) {
+			recordBindings(variable.id);
+			if (isIdentifier(variable.id) && variable.init) {
+				definitions.set(variable.id.name, variable.init);
+				if (declaration.kind === "const") constants.set(variable.id.name, variable.init);
+			}
+		}
+	}
+	function resolve(node, seen = /* @__PURE__ */ new Set()) {
+		node = unwrapStaticExpression(node);
+		if (!isIdentifier(node) || !constants.has(node.name) || seen.has(node.name)) return node;
+		seen.add(node.name);
+		return resolve(constants.get(node.name), seen);
+	}
+	function isStaticUndefined(node) {
+		node = resolve(node);
+		return isIdentifier(node) && node.name === "undefined" && !bindings.has(node.name);
+	}
+	function readName(options, seen = /* @__PURE__ */ new Set()) {
+		options = resolve(options);
+		if (!isObjectExpression(options) || seen.has(options)) return { present: false };
+		seen.add(options);
+		let name = { present: false };
+		for (const property of options.properties ?? []) {
+			if (property.type === "SpreadElement") {
+				const spread = resolve(property.argument);
+				if (isObjectExpression(spread)) {
+					const spreadName = readName(spread, seen);
+					if (spreadName.present) name = spreadName;
+				} else if (name.value !== void 0) throw new Error(`${filename}: resource name cannot be overridden by a dynamic spread.`);
+				continue;
+			}
+			if (property.type !== "Property") continue;
+			const key = property.key;
+			const keyName = !property.computed && isIdentifier(key) ? key.name : staticLiteral(key);
+			if (keyName !== "name") {
+				if (property.computed && keyName === void 0 && name.value !== void 0) throw new Error(`${filename}: resource name cannot be overridden by a dynamic key.`);
+				continue;
+			}
+			const valueNode = property.value;
+			if (isStaticUndefined(valueNode)) {
+				name = { present: true };
+				continue;
+			}
+			const value = staticLiteral(resolve(valueNode));
+			if (!isResourceName(value)) throw new Error(`${filename}: resource name must be a static string containing a word starting with a letter.`);
+			name = {
+				present: true,
+				value
+			};
+		}
+		seen.delete(options);
+		return name;
+	}
+	const statement = program.body?.find((node) => node.type === "ExportDefaultDeclaration");
+	const declaration = unwrapStaticExpression(statement?.declaration);
+	const call = resolve(isIdentifier(declaration) ? definitions.get(declaration.name) : declaration);
+	if (!isCallExpression(call)) return null;
+	const callee = resolve(call.callee);
+	let helper;
+	if (isIdentifier(callee)) helper = importedHelpers.get(callee.name) ?? (helpers.has(callee.name) ? callee.name : void 0);
+	else if (isMemberExpression(callee) && isIdentifier(callee.object)) {
+		const property = !callee.computed && isIdentifier(callee.property) ? callee.property.name : staticLiteral(callee.property);
+		if (typeof property === "string" && helpers.has(property) && namespaces.get(callee.object.name)?.has(property)) helper = property;
+	}
+	if (!helper) return null;
+	const options = resolve(call.arguments?.[0]);
+	const name = readName(options).value;
+	return {
+		helper,
+		options,
+		...name === void 0 ? {} : { name }
+	};
+}
+//#endregion
 //#region ../../node_modules/.pnpm/estree-walker@3.0.3/node_modules/estree-walker/src/walker.js
 /**
 * @typedef { import('estree').Node} Node
@@ -348,12 +485,18 @@ const WEBSOCKET_ROUTE_RE = /(?:\.(?:dev|prod))?\.ws\.(?:ts|mts|js|mjs)$/;
 function isWebSocketRouteFile(filePath) {
 	return WEBSOCKET_ROUTE_RE.test(filePath.replace(/\\/g, "/"));
 }
-function toIdentifierPart(segment) {
-	return segment.replace(/^\(\s*|\s*\)$/g, "").replace(/^\[\.\.\.(.+)\]$/, "$1").replace(/^\[(.+)\]$/, "$1").replace(/\.ws$/, "").replace(/\.(dev|prod)$/, "").replace(/[^a-zA-Z0-9]+/g, " ").split(" ").filter(Boolean).map((part) => part[0].toUpperCase() + part.slice(1)).join("");
+function identifierWords(segment) {
+	return segment.replace(/^\(\s*|\s*\)$/g, "").replace(/^\[\.\.\.(.+)\]$/, "$1").replace(/^\[(.+)\]$/, "$1").replace(/\.ws$/, "").replace(/\.(dev|prod)$/, "").replace(/[^a-zA-Z0-9]+/g, " ").split(" ").filter(Boolean);
+}
+function deriveWebSocketClassNameFromName(name) {
+	return resourceNameWords(name).map((part) => part[0].toUpperCase() + part.slice(1)).join("") + "Ws";
+}
+function inferWebSocketResourceName(filePath) {
+	const parts = filePath.replace(/\\/g, "/").replace(/\.(ts|mts|js|mjs)$/, "").split("/").filter((segment) => segment.length > 0 && !(segment.startsWith("(") && segment.endsWith(")"))).flatMap(identifierWords);
+	return parts.length > 0 ? parts.join("-") : "WebSocket";
 }
 function deriveWebSocketClassName(filePath) {
-	const parts = filePath.replace(/\\/g, "/").replace(/\.(ts|mts|js|mjs)$/, "").split("/").filter((segment) => segment.length > 0 && !(segment.startsWith("(") && segment.endsWith(")"))).map(toIdentifierPart).filter(Boolean);
-	return (parts.length > 0 ? parts.join("") : "WebSocket") + "Ws";
+	return deriveWebSocketClassNameFromName(inferWebSocketResourceName(filePath));
 }
 function getPropertyName(node) {
 	if (!node) return null;
@@ -361,64 +504,43 @@ function getPropertyName(node) {
 	if (isLiteral(node) && typeof node.value === "string") return node.value;
 	return null;
 }
-function extractDefinition(call) {
-	if (!isCallExpression(call)) return null;
-	if (!isIdentifier(call.callee)) return null;
-	const calleeName = call.callee.name;
-	if (calleeName !== "defineRoom" && calleeName !== "defineWebSocket") return null;
-	let hasAuthGate = false;
-	const options = call.arguments?.[0];
-	if (isObjectExpression(options)) for (const property of options.properties ?? []) {
-		if (property.type !== "Property") continue;
-		if (getPropertyName(property.key) === "onBeforeConnect") {
-			hasAuthGate = true;
-			break;
-		}
-	}
+const WEBSOCKET_HELPERS = /* @__PURE__ */ new Set(["defineRoom", "defineWebSocket"]);
+function detectWebSocketDefinition(absPath) {
+	const definition = readResourceDefinition(absPath, readFileSync(absPath, "utf-8"), WEBSOCKET_HELPERS);
+	if (!definition) return null;
+	const hasAuthGate = isObjectExpression(definition.options) && (definition.options.properties ?? []).some((property) => property.type === "Property" && getPropertyName(property.key) === "onBeforeConnect");
 	return {
-		mode: calleeName === "defineRoom" ? "room" : "socket",
-		hasAuthGate
+		mode: definition.helper === "defineRoom" ? "room" : "socket",
+		hasAuthGate,
+		...definition.name === void 0 ? {} : { name: definition.name }
 	};
 }
-function detectWebSocketDefinition(absPath) {
-	const code = readFileSync(absPath, "utf-8");
-	const filename = absPath.split("/").pop() ?? absPath;
-	let parsed;
-	try {
-		parsed = parseSync(filename, code);
-	} catch {
-		return null;
-	}
-	const program = parsed.program;
-	const variableInitializers = /* @__PURE__ */ new Map();
-	for (const node of program.body ?? []) if (node.type === "VariableDeclaration") {
-		for (const declarator of node.declarations ?? []) if (isIdentifier(declarator.id) && declarator.init) variableInitializers.set(declarator.id.name, declarator.init);
-	}
-	for (const node of program.body ?? []) {
-		if (node.type !== "ExportDefaultDeclaration") continue;
-		const declaration = node.declaration;
-		if (isIdentifier(declaration)) return extractDefinition(variableInitializers.get(declaration.name));
-		return extractDefinition(declaration);
-	}
-	return null;
-}
 function buildWebSocketRoute(root, filePath, paths = readProjectPaths(root)) {
 	const parsed = parseWebSocketFilename(filePath);
 	const info = detectWebSocketDefinition(join(paths.routesDir, filePath));
-	const className = deriveWebSocketClassName(filePath);
+	const className = info?.name === void 0 ? deriveWebSocketClassName(filePath) : deriveWebSocketClassNameFromName(info.name);
 	return {
 		...parsed,
 		className,
 		bindingName: className,
 		mode: info?.mode ?? "socket",
-		hasAuthGate: info?.hasAuthGate ?? false
+		hasAuthGate: info?.hasAuthGate ?? false,
+		...info?.name === void 0 ? {} : { name: info.name }
 	};
 }
 function parseWebSocketFiles(root, files, paths = readProjectPaths(root), environment) {
-	return files.filter((f) => isWebSocketRouteFile(f)).filter((f) => !f.split("/").some((segment) => segment.startsWith("_"))).filter((filePath) => isRouteEnabledForEnvironment(parseWebSocketFilename(filePath), environment)).map((filePath) => buildWebSocketRoute(root, filePath, paths)).sort((a, b) => {
+	const routes = files.filter((f) => isWebSocketRouteFile(f)).filter((f) => !f.split("/").some((segment) => segment.startsWith("_"))).filter((filePath) => isRouteEnabledForEnvironment(parseWebSocketFilename(filePath), environment)).map((filePath) => buildWebSocketRoute(root, filePath, paths)).sort((a, b) => {
 		if (a.catchAll !== b.catchAll) return a.catchAll ? 1 : -1;
 		return a.pattern.localeCompare(b.pattern);
 	});
+	const byClass = /* @__PURE__ */ new Map();
+	for (const route of routes) {
+		const previous = byClass.get(route.className) ?? [];
+		if (previous.some((other) => other.env === null || route.env === null || other.env === route.env)) throw new Error(`websocket: duplicate generated name '${route.className}' for '${route.filePath}'. Choose a different resource name or rename one of the WebSocket route files.`);
+		previous.push(route);
+		byClass.set(route.className, previous);
+	}
+	return routes;
 }
 async function scanWebSocketRoutes(root, paths = readProjectPaths(root), environment) {
 	const pattern = `**/*.{${HANDLER_EXTENSIONS.join(",")}}`;
@@ -549,23 +671,15 @@ function inferBindingsFromFile(file, code) {
 * @param scanDirs - Override the default scan directories (e.g., for framework mode)
 */
 function inferProjectBindings(root, options, scanDirs) {
-	if (options?.bindings) return {
-		needsD1: Boolean(options.bindings.db),
-		needsKV: Boolean(options.bindings.kv),
-		needsR2: Boolean(options.bindings.storage),
-		needsAuth: false,
-		needsQueues: false,
-		needsAI: Boolean(options.bindings.ai),
-		needsSandbox: false,
-		needsLive: false,
-		needsEmail: Boolean(options.bindings.email)
-	};
 	const paths = options?.paths ?? readProjectPaths(root);
 	const dirs = scanDirs ?? (paths.sourceDir ? [paths.sourceDir] : DEFAULT_SCAN_DIRS);
 	const allBindings = [];
+	const scannedFiles = /* @__PURE__ */ new Set();
 	const routesPrefix = `${toSlash(paths.routesDir).replace(/\/$/, "")}/`;
 	const addFile = (file) => {
 		const normalizedFile = toSlash(file);
+		if (scannedFiles.has(normalizedFile)) return;
+		scannedFiles.add(normalizedFile);
 		if (options?.environment && normalizedFile.startsWith(routesPrefix) && /\.(?:ts|mts|js|mjs)$/.test(normalizedFile)) {
 			const routePath = relative(paths.routesDir, normalizedFile);
 			const route = isWebSocketPatternFile(routePath) ? parseWebSocketFilename(routePath) : parseRouteFilename(routePath);
@@ -588,11 +702,7 @@ function inferProjectBindings(root, options, scanDirs) {
 		for (const file of files) addFile(file);
 	}
 	const ssrEntry = getSsrServerEntryPath(root, paths);
-	if (ssrEntry) {
-		const code = readFileSync(ssrEntry, "utf-8");
-		const filename = ssrEntry.split("/").pop() ?? "main.ssr.ts";
-		allBindings.push(inferBindingsFromSource(code, filename));
-	}
+	if (ssrEntry) addFile(ssrEntry);
 	const dirsSet = new Set(dirs);
 	const srcRel = paths.sourceDir ? paths.sourceDir : "src";
 	if (!dirsSet.has(srcRel)) {
@@ -608,7 +718,7 @@ function inferProjectBindings(root, options, scanDirs) {
 		}
 		for (const file of srcFiles) addFile(file);
 	}
-	return mergeBindings(allBindings);
+	return applyBindingOverrides(mergeBindings(allBindings), options?.bindings);
 }
 //#endregion
-export { isWebSocketPatternFile as a, inferBindingsFromSource as c, inferProjectBindings as i, walk as l, FRAMEWORK_SCAN_DIRS as n, scanWebSocketRoutes as o, detectFramework as r, scanWebSocketRoutesSync as s, DEFAULT_SCAN_DIRS as t };
+export { deriveWebSocketClassNameFromName as a, scanWebSocketRoutes as c, walk as d, readResourceDefinition as f, inferProjectBindings as i, scanWebSocketRoutesSync as l, needsApplicationDatabase as m, FRAMEWORK_SCAN_DIRS as n, inferWebSocketResourceName as o, applyBindingOverrides as p, detectFramework as r, isWebSocketPatternFile as s, DEFAULT_SCAN_DIRS as t, inferBindingsFromSource as u };

package/dist/{prepare-DyZ-Yok5.mjs → prepare-B5Mkic5u.mjs}

@@ -1,6 +1,6 @@
-import { r as cliTitle } from "./output-CCH48AMM.mjs";
-import { N as note, O as intro, P as outro, j as log } from "./dist-Dn6nn2IU.mjs";
-import { t as prepareProject } from "./prepare-C3kt3Rst.mjs";
+import { N as note, O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
+import { r as cliTitle } from "./output-Dm_A4Tbv.mjs";
+import { t as prepareProject } from "./prepare-DOsL0CC9.mjs";
 //#region src/cli/prepare.ts
 async function runPrepareCommand(root, _args) {
 	console.log();

package/dist/{prepare-C3kt3Rst.mjs → prepare-DOsL0CC9.mjs}

@@ -1,14 +1,12 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
-import { i as resolveProjectPaths } from "./project-paths-GgcMozYz.mjs";
-import { n as loadVoidAuthConfig, t as findVoidAuthConfig } from "./config-DPByhVck.mjs";
-import { m as readConfig, u as getDatabaseDialect } from "./config-CafTW6Cz.mjs";
+import { n as loadVoidAuthConfig } from "./config-DPByhVck.mjs";
+import { m as readConfig } from "./config-Br_JZD6u.mjs";
 import { n as ensureProjectTsconfig, r as writeFileIfChanged } from "./project-tsconfig-B8GeM0RM.mjs";
-import { r as scanRoutes } from "./scan-ClYmX3sa.mjs";
-import { i as inferProjectBindings, n as FRAMEWORK_SCAN_DIRS, r as detectFramework } from "./plugin-inference-BMfKRSqE.mjs";
 import { i as generateDbDts, n as generateQueueTypes, t as generateRouteTypes } from "./route-types-Clm4WD0B.mjs";
 import { t as discoverSchema } from "./discover-BcPPiF1o.mjs";
 import { r as generateEnvTypes, t as findEnvFile } from "./env-types-C2_bIk_b.mjs";
 import { a as loadLocalEnv } from "./env-_v349JBd.mjs";
+import { t as analyzeApplication } from "./application-routing-B7QEjqSR.mjs";
 import { n as generateVoidAuthDrizzleSchema, t as generateVoidAuthDatabaseModule } from "./drizzle-Beb2Am5S.mjs";
 import { existsSync, mkdirSync, rmSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -25,30 +23,16 @@ function removeGeneratedFile(outDir, fileName, removed) {
 }
 async function prepareProject(root) {
 	const config = readConfig(root);
-	const paths = resolveProjectPaths(root, config);
+	const { paths, authConfigPath, authEnabled, dialect, scan } = await analyzeApplication(root, { config });
 	const outDir = join(root, ".void");
 	const written = [];
 	const removed = [];
 	mkdirSync(outDir, { recursive: true });
-	const detectedFramework = detectFramework(root);
-	const inferenceOptions = config.inference?.bindings ? { bindings: config.inference.bindings } : void 0;
-	const scanDirs = config.inference?.scanDirs ?? (detectedFramework ? FRAMEWORK_SCAN_DIRS : void 0);
-	const bindings = inferProjectBindings(root, {
-		...inferenceOptions,
-		paths
-	}, scanDirs);
-	const authConfigPath = findVoidAuthConfig(root, paths);
-	const authEnabled = bindings.needsAuth || authConfigPath !== null || config.auth !== void 0;
-	const dialect = getDatabaseDialect(config);
 	const envFile = findEnvFile(root);
 	if (envFile) {
 		const { dts } = generateEnvTypes(envFile, outDir);
 		writeGeneratedFile(outDir, "env.d.ts", dts, written);
 	} else removeGeneratedFile(outDir, "env.d.ts", removed);
-	const scan = await scanRoutes(root, {
-		output: config.output,
-		paths
-	});
 	const hasRouteTypes = scan.routes.length > 0 || (scan.websockets?.length ?? 0) > 0 || scan.pages.pages.length > 0;
 	if (hasRouteTypes) {
 		const { dts } = generateRouteTypes(scan, paths.routesDir, outDir, paths.pagesDir);

package/dist/prepare-cgvDMtSb.mjs

@@ -0,0 +1,2 @@
+import { t as prepareProject } from "./prepare-DOsL0CC9.mjs";
+export { prepareProject };

package/dist/{project-cmd-B44I8J_W.mjs → project-cmd-CNzrqvBv.mjs}

@@ -1,8 +1,8 @@
-import { a as dim, c as import_picocolors, r as cliTitle, u as tablePrefix } from "./output-CCH48AMM.mjs";
-import { c as getToken, s as getSiteDomain } from "./auth-DLNN0D3Z.mjs";
+import { c as getToken, s as getSiteDomain } from "./auth-CSkdO2Bb.mjs";
 import { i as readDeploymentPlatform } from "./project-C0Fqu05O.mjs";
-import { O as intro, P as outro, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
+import { O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
+import { a as dim, c as import_picocolors, d as tablePrefix, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 //#region src/cli/projects.ts
 async function runProjectsCommand(root) {
 	console.log();
@@ -39,63 +39,77 @@ async function runProjectsCommand(root) {
 async function runProjectCommand(root, args) {
 	const cloudflare = readDeploymentPlatform(root) === "cloudflare";
 	if (args.subcommand === "status") {
-		const { runListCommand } = await import("./list-CDb-4bZ1.mjs");
+		const { runListCommand } = await import("./list-CZj0dzKY.mjs");
 		return runListCommand(root, args.name || void 0);
 	}
 	if (args.subcommand === "link") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare apps are identified by cloudflare.name in void.config.ts and do not need linking.");
-		const { runLink } = await import("./link-CsHOinF7.mjs");
+		const { runLink } = await import("./link-CDqqCjFl.mjs");
 		return runLink(root, args.name || void 0);
 	}
 	if (args.subcommand === "list") {
 		if (cloudflare) {
-			const { runListCommand } = await import("./list-CDb-4bZ1.mjs");
+			const { runListCommand } = await import("./list-CZj0dzKY.mjs");
 			return runListCommand(root);
 		}
 		return runProjectsCommand(root);
 	}
 	if (args.subcommand === "token") {
 		if (cloudflare) throw new Error("project: CI deploy credentials are available only for Void platform projects.");
-		const { runProjectTokenCommand } = await import("./project-token-C8xEEQnB.mjs");
+		const { runProjectTokenCommand } = await import("./project-token-CTDYU0Cc.mjs");
 		return runProjectTokenCommand(root, args);
 	}
 	if (args.subcommand === "team") {
 		if (args.action === "") {
-			const { printHelpPage } = await import("./help-DQMfeKMz.mjs");
+			const { printHelpPage } = await import("./help-DofyZuY7.mjs");
 			printHelpPage(["project", "team"]);
 			return;
 		}
 		const accountInvitationAction = args.action === "pending" || args.action === "accept" || args.action === "decline";
 		if (cloudflare && !accountInvitationAction) throw new Error("project: Teams are available only for projects hosted on a Void platform, not direct Cloudflare deployments.");
-		const { runProjectTeamCommand } = await import("./project-team-BkbYIsXN.mjs");
+		const { runProjectTeamCommand } = await import("./project-team-DQOWPfQT.mjs");
 		return runProjectTeamCommand(root, args);
 	}
+	if (args.subcommand === "zero-trust") {
+		if (cloudflare) throw new Error("project: Zero Trust overrides are available only for projects hosted on a Void platform.");
+		if (args.action === "") {
+			const { printHelpPage } = await import("./help-DofyZuY7.mjs");
+			printHelpPage(["project", "zero-trust"]);
+			return;
+		}
+		const action = args.action;
+		const { runProjectZeroTrustCommand } = await import("./project-zero-trust-BNAkW-_0.mjs");
+		return runProjectZeroTrustCommand(root, {
+			...args,
+			action
+		});
+	}
 	if (args.subcommand === "logs") {
-		const { runLogsCommand } = await import("./logs-BdfiOezj.mjs");
+		const { runLogsCommand } = await import("./logs-CUZ6t9t3.mjs");
 		return runLogsCommand(root, args.filter, args.range, args.deployment || void 0, args.level || void 0);
 	}
 	if (args.subcommand === "requests") {
 		if (cloudflare) throw new Error("project: Historical request analytics require the Void platform. Use `void project logs` for a live Cloudflare tail.");
-		const { runRequestsCommand } = await import("./requests-DFyhBMaf.mjs");
+		const { runRequestsCommand } = await import("./requests-MhxYnau8.mjs");
 		return runRequestsCommand(root, args.range, args.status || void 0);
 	}
 	if (args.subcommand === "rollback") {
-		const { runRollbackCommand } = await import("./rollback-DHHxXZiS.mjs");
+		const { runRollbackCommand } = await import("./rollback-CJ6iSDoU.mjs");
 		return runRollbackCommand(root, args.deployId || void 0);
 	}
 	if (args.subcommand === "cancel") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare deploys activate only after readiness succeeds, so there is no remote build to cancel.");
-		const { runCancelDeployCommand } = await import("./cancel-deploy-D23R1RXT.mjs");
+		const { runCancelDeployCommand } = await import("./cancel-deploy-abUxpP2n.mjs");
 		return runCancelDeployCommand(root, args.deployId || void 0);
 	}
 	if (args.subcommand === "delete") {
 		if (cloudflare) throw new Error("project: Refusing to delete Cloudflare resources through this command. Direct deployments are additive and existing resources may be shared.");
-		const { runDeleteCommand } = await import("./delete-D6dZ9B6B.mjs");
+		const { runDeleteCommand } = await import("./delete-NvbiyeJf.mjs");
 		return runDeleteCommand(root, args.name || void 0, { force: args.force });
 	}
 	if (args.subcommand === "purge-cache") {
 		if (cloudflare) throw new Error("project: Direct Cloudflare ISR cache purge is not available yet; redeploy or purge the configured KV namespace explicitly.");
-		const { runPurgeCacheCommand } = await import("./cache-7_UeZdTk.mjs");
+		const { runPurgeCacheCommand } = await import("./cache-C4MvnrMH.mjs");
 		return runPurgeCacheCommand(root, args.projectSlug || void 0);
 	}
 }

package/dist/{project-team-BkbYIsXN.mjs → project-team-DQOWPfQT.mjs}

@@ -1,8 +1,8 @@
-import { r as cliTitle } from "./output-CCH48AMM.mjs";
-import { c as getToken, i as getAccountCredential } from "./auth-DLNN0D3Z.mjs";
+import { c as getToken, i as getAccountCredential } from "./auth-CSkdO2Bb.mjs";
 import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { N as note, O as intro, P as outro, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient, o as parsePlatformErrorBody, s as platformErrorMessage, t as PlatformApiError } from "./client-QTl6ko_D.mjs";
+import { N as note, O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient, o as parsePlatformErrorBody, s as platformErrorMessage, t as PlatformApiError } from "./client-RV8NVeB8.mjs";
+import { r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
 //#region src/cli/project-team.ts
 function clean(value) {

package/dist/{project-token-C8xEEQnB.mjs → project-token-CTDYU0Cc.mjs}

@@ -1,8 +1,8 @@
-import { a as dim, r as cliTitle, u as tablePrefix } from "./output-CCH48AMM.mjs";
-import { c as getToken } from "./auth-DLNN0D3Z.mjs";
+import { c as getToken } from "./auth-CSkdO2Bb.mjs";
 import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
-import { O as intro, P as outro, j as log } from "./dist-Dn6nn2IU.mjs";
-import { n as PlatformClient } from "./client-QTl6ko_D.mjs";
+import { O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
+import { a as dim, d as tablePrefix, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
 import { r as resolveProjectBySlug } from "./resolve-project-BG5ORGID.mjs";
 //#region src/cli/project-token.ts
 async function resolveTarget(root, args) {

package/dist/project-zero-trust-BNAkW-_0.mjs

@@ -0,0 +1,63 @@
+import { c as getToken } from "./auth-CSkdO2Bb.mjs";
+import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";
+import { N as note, O as intro, P as outro, j as log } from "./dist-CTBk70IR.mjs";
+import { n as PlatformClient } from "./client-RV8NVeB8.mjs";
+import { l as sanitizeTerminalText, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
+import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
+//#region src/cli/project-zero-trust.ts
+async function resolveTarget(root, args) {
+	const token = getToken(root);
+	if (!token) throw new Error("project: Not logged in. Run `void account login` first.");
+	const client = new PlatformClient(token, { root });
+	const requestedSlug = getRequestedProjectSlug({ projectSlug: args.projectSlug });
+	if (requestedSlug) {
+		const project = resolveProjectBySlug(await client.listProjects(), requestedSlug);
+		if (!project) throw new Error(`project: No project found with slug '${requestedSlug}'.`);
+		return {
+			client,
+			projectId: project.projectId,
+			slug: project.slug
+		};
+	}
+	const linked = readProjectConfig(root);
+	if (!linked) throw new Error("project: No linked project. Pass --project <name> or set VOID_PROJECT.");
+	return {
+		client,
+		projectId: linked.projectId,
+		slug: linked.slug
+	};
+}
+function statusLines(result) {
+	const project = result.project;
+	const platformStatus = sanitizeTerminalText(result.platformStatus);
+	const unavailableMessage = result.platformStatus === "invalid_configuration" ? "The platform Zero Trust configuration is invalid. Ask a platform administrator to review it." : result.platformStatus === "configuring" ? "The platform is still applying Zero Trust configuration. A platform administrator can resume it with `void platform zero-trust reconcile`." : result.platformStatus === "disabling" ? "The platform is disabling project Zero Trust. A platform administrator can resume it with `void platform zero-trust reconcile`." : result.platformStatus === "error" ? "The platform Zero Trust configuration needs administrator attention. A platform administrator can inspect its status and reconcile it." : result.platformStatus === "ready" ? "The platform administrator has disabled project Zero Trust." : "The platform administrator has not configured project Zero Trust.";
+	return [
+		`Available: ${result.available ? "yes" : "no"}`,
+		`Platform: ${platformStatus}`,
+		...result.platformStatus === "not_configured" || result.platformStatus === "invalid_configuration" ? [] : [`Default for new projects: ${result.protectNewProjects ? "protected" : "public"}`],
+		`Desired: ${project ? project.desired_protected ? "protected" : "public" : "not initialized"}`,
+		`Effective: ${project ? project.effective_protected ? "protected" : "public" : "not initialized"}`,
+		`State: ${project?.state ?? "not initialized"}`,
+		...project?.last_error ? [`Last error: ${sanitizeTerminalText(project.last_error)}`] : [],
+		...!result.available ? [unavailableMessage] : []
+	].join("\n");
+}
+async function runProjectZeroTrustCommand(root, args) {
+	console.log();
+	intro(cliTitle(`project zero-trust ${args.action}`));
+	const { client, projectId, slug } = await resolveTarget(root, args);
+	if (args.action === "status") {
+		note(statusLines(await client.getProjectZeroTrust(projectId)), slug);
+		outro(`${slug} Zero Trust status`);
+		return;
+	}
+	const result = args.action === "reconcile" ? await client.reconcileProjectZeroTrust(projectId) : await client.setProjectZeroTrust(projectId, args.action === "protect");
+	if (result.project.last_error) log.warn(sanitizeTerminalText(result.project.last_error));
+	if (result.project.state === "reconciling") {
+		outro(`${slug} Zero Trust update is still in progress. Run \`void project zero-trust reconcile\` to continue, or wait for scheduled maintenance.`);
+		return;
+	}
+	outro(args.action === "protect" ? `${slug} is protected by Zero Trust.` : args.action === "public" ? `${slug} is public.` : `${slug} Zero Trust reconciled (${result.project.state}).`);
+}
+//#endregion
+export { runProjectZeroTrustCommand };

package/dist/{protocol-ZH3jP4a7.d.mts → protocol-CjF_iI9X.d.mts}

@@ -1,5 +1,5 @@
 import { n as HeadDescriptor, t as HeadConfig } from "./head-Do8P4puT.mjs";
-import { n as CloudBindings, r as CloudContext } from "./handler-BXJTXd02.mjs";
+import { n as CloudBindings, r as CloudContext } from "./handler-CZ4nAylQ.mjs";
 import { a as PageRenderMode, t as DevCssAsset } from "./types-BAp5AEBU.mjs";
 //#region src/pages/protocol.d.ts
 /** Escape characters that are unsafe inside inline <script> tags to prevent XSS. */
@@ -34,7 +34,7 @@ type GetAssetTags = (req: Request, env: CloudBindings, componentId: string) => P
 declare function flattenValidationErrors(body: unknown): Record<string, string>;
 /** Handle GET page request — run handler, return page object or SSR HTML */
 declare function handlePageGet(handler: PageHandler, headFn: PageHeadHandler, c: CloudContext, componentId: string, renderFn: RenderPage, getAssetTags: GetAssetTags, configHead?: HeadConfig, options?: PageRenderOptions): Promise<Response>;
-/** Handle POST/PUT/DELETE page request — run mutation, then re-run GET or redirect */
+/** Handle POST/PUT/PATCH/DELETE page request — run mutation, then re-run GET or redirect */
 declare function handlePageMutation(mutationHandler: PageHandler, getHandler: PageHandler, headFn: PageHeadHandler, c: CloudContext, componentId: string, renderFn: RenderPage, getAssetTags: GetAssetTags, configHead?: HeadConfig, options?: PageRenderOptions): Promise<Response>;
 //#endregion
 export { handlePageMutation as a, handlePageGet as i, PageRenderResult as n, safeJsonStringify as o, flattenValidationErrors as r, PageObject as t };