void 0.7.13 → 0.8.0

package/dist/runtime/sandbox.mjs

@@ -1,19 +1,255 @@
+import { i as getRawRuntimeEnv } from "../env-raw-zk5JQKZe.mjs";
 import { requireRuntimeBinding } from "./env.mjs";
 import { Sandbox, getSandbox as getSandbox$1 } from "@cloudflare/sandbox";
 //#region src/runtime/sandbox.ts
 const DEFAULT_SANDBOX_ID = "default";
 const DEFAULT_SANDBOX_BINDING = "SANDBOX";
+const SANDBOX_USAGE_QUEUE_BINDING = "USAGE_EVENTS_QUEUE";
+const SANDBOX_GATE_BINDING = "__VOID_PROXY";
+const HEARTBEAT_MS = 5 * 6e4;
+/**
+* Thrown by `getSandbox()` when the platform gate denies a new acquire because
+* the user has hit a concurrency or runtime budget cap. Surface this to the
+* caller so they can render a friendly error; do not retry transparently.
+*/
+var SandboxLimitError = class extends Error {
+	name = "SandboxLimitError";
+	reason;
+	constructor(reason, message) {
+		super(message ?? `Sandbox limit reached: ${reason}`);
+		this.reason = reason;
+	}
+};
 let sandboxBindingName = DEFAULT_SANDBOX_BINDING;
 function __setSandboxBindingName(bindingName) {
 	sandboxBindingName = bindingName;
 }
-function getSandbox(id = DEFAULT_SANDBOX_ID, options) {
+const STORAGE_KEY_START_TS = "__voidStartTs";
+const STORAGE_KEY_LAST_FLUSH_TS = "__voidLastFlushTs";
+function getUsageContext() {
+	const runtimeEnv = getRawRuntimeEnv();
+	return {
+		userId: runtimeEnv.__VOID_USER_ID,
+		projectId: runtimeEnv.__PROJECT_ID,
+		slug: runtimeEnv.__VOID_PROJECT_SLUG
+	};
+}
+function getSandboxInstanceId(ctx) {
+	return ctx.id.name ?? ctx.id.toString();
+}
+/**
+* Flush the accumulated runtime delta to the usage queue. No-op when the
+* usage-queue binding is not bound (e.g. local dev without the platform
+* proxy). Errors are swallowed and logged — usage emission must never crash
+* the sandbox lifecycle.
+*/
+async function emitRuntimeSeconds(ctx, sandboxRuntimeSeconds) {
+	if (sandboxRuntimeSeconds <= 0) return;
+	const queue = getRawRuntimeEnv()[SANDBOX_USAGE_QUEUE_BINDING];
+	if (!queue) return;
+	const event = {
+		requests: 0,
+		responseBytes: 0,
+		sandboxRuntimeSeconds,
+		sandboxInstanceId: getSandboxInstanceId(ctx),
+		...getUsageContext()
+	};
+	try {
+		await queue.send(event);
+	} catch (error) {
+		console.error("[void/sandbox] failed to emit usage event:", error);
+	}
+}
+/**
+* Resolve the `{ gate, projectId, aiToken }` triple needed to call a gate
+* route. Returns `null` when any piece is missing — local dev (no proxy
+* binding) and partial deploys (binding present but identity vars absent)
+* both fall through to the no-op path so a missing platform setup never
+* blocks sandbox acquisition.
+*
+* Wire field is named `aiToken` because the shared proxy auth middleware
+* (packages/proxy/src/index.ts) verifies HMAC against `body.aiToken` for
+* every route. Naming it `proxyToken` here would diverge from the existing
+* AI/ISR convention without changing the on-the-wire contract.
+*/
+function resolveGateIdentity() {
+	const runtimeEnv = getRawRuntimeEnv();
+	const gate = runtimeEnv[SANDBOX_GATE_BINDING];
+	if (!gate) return null;
+	const projectId = runtimeEnv.__PROJECT_ID;
+	const aiToken = runtimeEnv.__VOID_PROXY_TOKEN;
+	if (!projectId || !aiToken) return null;
+	return {
+		gate,
+		projectId,
+		aiToken
+	};
+}
+/**
+* Release notification to the gate so it can drop the active lease counter.
+* Returns the in-flight fetch as a Promise (errors swallowed) so callers can
+* route it through `ctx.waitUntil()` and keep it alive past lifecycle
+* teardown. Failure is silent — the gate maintains its own TTL fallback.
+*/
+function notifyGateRelease(ctx) {
+	const identity = resolveGateIdentity();
+	if (!identity) return Promise.resolve();
+	const sandboxId = getSandboxInstanceId(ctx);
+	return identity.gate.fetch("https://gate/sandbox/release", {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			projectId: identity.projectId,
+			aiToken: identity.aiToken,
+			sandboxId
+		})
+	}).then(() => void 0).catch(() => {});
+}
+/**
+* Heartbeat-driven keepalive ping for the gate's concurrency slot. The DO's
+* `STALE_MS` (1h) sweep would otherwise reap slots for long-running sandbox
+* sessions whose `acquiredAt` ages past the threshold between acquire and
+* release, letting new acquires exceed `sandboxMaxConcurrentInstances`. The
+* 5 min heartbeat sits well inside the sweep window, so each successful
+* refresh resets the stale clock. Returns the in-flight fetch as a Promise
+* (errors swallowed) so callers can route it through `ctx.waitUntil()` and
+* keep the alarm path itself off the critical path — a failed refresh just
+* means the slot ages out naturally, which matches the pre-existing failure
+* mode if the gate goes down entirely.
+*/
+function notifyGateRefresh(ctx) {
+	const identity = resolveGateIdentity();
+	if (!identity) return Promise.resolve();
+	const sandboxId = getSandboxInstanceId(ctx);
+	return identity.gate.fetch("https://gate/sandbox/refresh", {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			projectId: identity.projectId,
+			aiToken: identity.aiToken,
+			sandboxId
+		})
+	}).then(() => void 0).catch(() => {});
+}
+/**
+* Sandbox variant that participates in Void platform metering: it records
+* container runtime seconds into DO storage, emits periodic heartbeats to
+* the usage queue, and notifies the gate when the container stops.
+*
+* Generated code from `void inference` wires user `Sandbox` subclasses to
+* extend this class on platform deploys so per-tenant accounting works
+* without user opt-in. On local dev (no usage-queue / gate bindings), all
+* overrides degrade to no-ops and the sandbox behaves like the upstream
+* `Sandbox` class.
+*/
+var VoidPlatformSandbox = class extends Sandbox {
+	async onStart() {
+		const now = Date.now();
+		const stored = await this.ctx.storage.get([STORAGE_KEY_START_TS, STORAGE_KEY_LAST_FLUSH_TS]);
+		const orphanedAnchor = stored.get(STORAGE_KEY_LAST_FLUSH_TS) ?? stored.get(STORAGE_KEY_START_TS);
+		if (orphanedAnchor !== void 0 && orphanedAnchor < now) {
+			const sandboxRuntimeSeconds = (now - orphanedAnchor) / 1e3;
+			await emitRuntimeSeconds(this.ctx, sandboxRuntimeSeconds);
+			await this.ctx.storage.delete([STORAGE_KEY_START_TS, STORAGE_KEY_LAST_FLUSH_TS]);
+		}
+		try {
+			await super.onStart();
+		} catch (err) {
+			this.ctx.waitUntil(notifyGateRelease(this.ctx));
+			throw err;
+		}
+		const startedAt = Date.now();
+		await this.ctx.storage.put({
+			[STORAGE_KEY_START_TS]: startedAt,
+			[STORAGE_KEY_LAST_FLUSH_TS]: startedAt
+		});
+		await this.ctx.storage.setAlarm(startedAt + HEARTBEAT_MS);
+	}
+	async alarm(alarmProps) {
+		await super.alarm(alarmProps);
+		const lastFlush = await this.ctx.storage.get(STORAGE_KEY_LAST_FLUSH_TS);
+		if (typeof lastFlush !== "number") return;
+		const now = Date.now();
+		const sandboxRuntimeSeconds = Math.max(0, (now - lastFlush) / 1e3);
+		await emitRuntimeSeconds(this.ctx, sandboxRuntimeSeconds);
+		this.ctx.waitUntil(notifyGateRefresh(this.ctx));
+		await Promise.all([this.ctx.storage.put(STORAGE_KEY_LAST_FLUSH_TS, now), this.ctx.storage.setAlarm(now + HEARTBEAT_MS)]);
+	}
+	async onStop() {
+		await this.flushFinal();
+		this.ctx.waitUntil(notifyGateRelease(this.ctx));
+		await super.onStop();
+	}
+	async onActivityExpired() {
+		await this.flushFinal();
+		this.ctx.waitUntil(notifyGateRelease(this.ctx));
+		await super.onActivityExpired();
+	}
+	async flushFinal() {
+		const lastFlush = await this.ctx.storage.get(STORAGE_KEY_LAST_FLUSH_TS);
+		if (typeof lastFlush === "number") {
+			const sandboxRuntimeSeconds = Math.max(0, (Date.now() - lastFlush) / 1e3);
+			await emitRuntimeSeconds(this.ctx, sandboxRuntimeSeconds);
+		}
+		await this.ctx.storage.delete(STORAGE_KEY_START_TS);
+		await this.ctx.storage.delete(STORAGE_KEY_LAST_FLUSH_TS);
+	}
+};
+/**
+* Resolve the platform-provided sandbox stub for the given id, optionally
+* coordinating with the platform gate to enforce per-user concurrency and
+* runtime budgets.
+*
+* When the gate binding (`__VOID_PROXY` by default) is present AND the
+* platform's `__PROJECT_ID` + `__VOID_PROXY_TOKEN` identity vars are
+* available, we POST to `https://gate/sandbox/acquire` with the HMAC-signed
+* body the shared proxy auth middleware expects. A `409` response means the
+* user has exceeded a budget — we throw `SandboxLimitError` so the caller
+* can render a clear message. Any other non-OK status (or a thrown transport
+* error from the service binding) is treated as "gate unavailable" and we
+* fall through to returning the stub so a broken gate doesn't break sandbox
+* access entirely.
+*
+* When the gate binding is absent (local dev) or the identity vars are
+* missing (partial deploy), the gate check is skipped entirely and we
+* return the stub directly.
+*
+* The stub is constructed BEFORE calling the gate so we can derive the
+* normalized DO name (`stub.id.name`) and pass it to the gate as the
+* `sandboxId`. This keeps acquire and release using the same key — without
+* it, mixed-case caller ids (e.g. `MyProject-123`) would acquire a lease
+* under the raw id but release it under the normalized lowercase form that
+* `ctx.id.name` reports inside the DO, leaking the lease until TTL.
+* Constructing the stub does NOT start a container — that only happens on
+* the first method call against the stub.
+*/
+async function getSandbox(id = DEFAULT_SANDBOX_ID, options) {
 	const { binding = sandboxBindingName, ...sandboxOptions } = options ?? {};
-	return getSandbox$1(requireRuntimeBinding(binding), id, {
+	const stub = getSandbox$1(requireRuntimeBinding(binding), id, {
 		normalizeId: true,
 		...sandboxOptions
 	});
+	const sandboxId = stub.id.name ?? id;
+	const identity = resolveGateIdentity();
+	if (identity) try {
+		const res = await identity.gate.fetch("https://gate/sandbox/acquire", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				projectId: identity.projectId,
+				aiToken: identity.aiToken,
+				sandboxId
+			})
+		});
+		if (res.status === 409) {
+			const body = await res.json().catch(() => ({}));
+			throw new SandboxLimitError(body.reason === "concurrency" || body.reason === "runtime_budget" ? body.reason : "concurrency");
+		}
+	} catch (error) {
+		if (error instanceof SandboxLimitError) throw error;
+	}
+	return stub;
 }
 const sandbox = { get: getSandbox };
 //#endregion
-export { DEFAULT_SANDBOX_BINDING, DEFAULT_SANDBOX_ID, Sandbox, __setSandboxBindingName, getSandbox, sandbox };
+export { DEFAULT_SANDBOX_BINDING, DEFAULT_SANDBOX_ID, HEARTBEAT_MS, SANDBOX_GATE_BINDING, SANDBOX_USAGE_QUEUE_BINDING, Sandbox, SandboxLimitError, VoidPlatformSandbox, __setSandboxBindingName, getSandbox, sandbox };

package/dist/runtime/validator.d.mts

@@ -1,2 +1,2 @@
-import { C as HandlerInput, T as runValidation, w as ValidatorSlots } from "../handler-DJTuxB10.mjs";
+import { C as HandlerInput, T as runValidation, w as ValidatorSlots } from "../handler-BPhL8AmU.mjs";
 export { HandlerInput, ValidatorSlots, runValidation };

package/dist/runtime/ws-server.d.mts

@@ -1,5 +1,5 @@
-import { n as AuthState } from "../auth-DmuALf16.mjs";
-import { i as VoidAuthRuntimeOptions, n as VoidAuthEnv } from "../better-auth-shared-HXlHRw02.mjs";
+import { n as AuthState } from "../auth-SfRBhXan.mjs";
+import { i as VoidAuthRuntimeOptions, n as VoidAuthEnv } from "../better-auth-shared-Fzyk5yS1.mjs";
 import { AnyWebSocketDefinition } from "./ws.mjs";
 
 //#region src/runtime/ws-server.d.ts

package/dist/runtime/ws.d.mts

@@ -1,6 +1,6 @@
-import { r as AuthUser } from "../auth-DmuALf16.mjs";
-import { t as StandardSchemaV1 } from "../standard-schema-D2qvCEYV.mjs";
-import { i as CloudEnv } from "../handler-DJTuxB10.mjs";
+import { r as AuthUser } from "../auth-SfRBhXan.mjs";
+import { t as StandardSchemaV1 } from "../standard-schema-WhHcCaqJ.mjs";
+import { i as CloudEnv } from "../handler-BPhL8AmU.mjs";
 import { WebSocketRouteMap } from "void/routes";
 
 //#region src/runtime/ws.d.ts

package/dist/{scan-CKpylFj9.mjs → scan-2YmJkYAf.mjs}

@@ -1,5 +1,6 @@
-import { a as join, n as dirname, r as extname, t as basename } from "./pathe.M-eThtNZ-D-kmWkCS.mjs";
-import { t as glob } from "./dist-q8b2Mjgb.mjs";
+import { a as join, n as dirname, r as extname, t as basename } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
+import { n as readProjectPaths } from "./project-paths-CCMrHYQm.mjs";
+import { t as glob } from "./dist-DR9sIMbM.mjs";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/router/parse-filename.ts
 const EXTENSIONS = [
@@ -167,7 +168,7 @@ const LAYOUT_STRING_RE = /export\s+const\s+layout\s*=\s*["']([^"']+)["']\s*;?/;
 const LAYOUT_FALSE_RE = /export\s+const\s+layout\s*=\s*false\s*;?/;
 const MAX_REVALIDATE = 31536e3;
 async function scanPages(root, options) {
-	const pagesDir = join(root, "pages");
+	const pagesDir = options?.pagesDir ?? options?.paths?.pagesDir ?? readProjectPaths(root).pagesDir;
 	if (!existsSync(pagesDir)) return {
 		pages: [],
 		layouts: [],

package/dist/{scan-CkK1Hzpa.mjs → scan-DzzHqtiT.mjs}

@@ -1,7 +1,8 @@
-import { a as join, t as basename } from "./pathe.M-eThtNZ-D-kmWkCS.mjs";
-import { n as globSync, t as glob } from "./dist-q8b2Mjgb.mjs";
-import { d as isCallExpression, f as isIdentifier, h as isObjectExpression, p as isLiteral } from "./plugin-inference-BexV6LL3.mjs";
-import { o as parseRouteFilename, s as parseWebSocketFilename, t as scanPages } from "./scan-CKpylFj9.mjs";
+import { a as join, i as isAbsolute, t as basename } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
+import { n as readProjectPaths } from "./project-paths-CCMrHYQm.mjs";
+import { n as globSync, t as glob } from "./dist-DR9sIMbM.mjs";
+import { d as isCallExpression, f as isIdentifier, h as isObjectExpression, p as isLiteral } from "./plugin-inference-Ba1uGdIy.mjs";
+import { o as parseRouteFilename, s as parseWebSocketFilename, t as scanPages } from "./scan-2YmJkYAf.mjs";
 import { readFileSync } from "node:fs";
 import { parseSync } from "vite";
 //#region src/crons/scan.ts
@@ -31,9 +32,13 @@ function extractCronExpressions(source, filePath) {
 	}
 	throw new Error(`cron: Invalid job file '${filePath}'. Add \`export const cron = "<schedule>"\`.`);
 }
+function resolveDir(root, dir) {
+	return isAbsolute(dir) ? dir : join(root, dir);
+}
 function parseJobFiles(root, jobsDir, files) {
+	const jobsDirPath = resolveDir(root, jobsDir);
 	return files.filter((filePath) => !filePath.split("/").some((segment) => segment.startsWith("_"))).sort((leftFilePath, rightFilePath) => leftFilePath.localeCompare(rightFilePath)).map((filePath) => {
-		const source = readFileSync(join(root, jobsDir, filePath), "utf-8");
+		const source = readFileSync(join(jobsDirPath, filePath), "utf-8");
 		return {
 			filePath,
 			name: extractJobName(filePath),
@@ -43,7 +48,7 @@ function parseJobFiles(root, jobsDir, files) {
 }
 async function scanJobs(root, jobsDir = "crons") {
 	return parseJobFiles(root, jobsDir, await glob(`**/*.{${JOB_EXTENSIONS.join(",")}}`, {
-		cwd: `${root}/${jobsDir}`,
+		cwd: resolveDir(root, jobsDir),
 		absolute: false
 	}).catch(() => []));
 }
@@ -52,7 +57,7 @@ function scanJobsSync(root, jobsDir = "crons") {
 	let files;
 	try {
 		files = globSync(pattern, {
-			cwd: `${root}/${jobsDir}`,
+			cwd: resolveDir(root, jobsDir),
 			absolute: false
 		});
 	} catch {
@@ -80,8 +85,9 @@ function extractConsumerOption(source, name) {
 	return match ? Number(match[1]) : void 0;
 }
 function parseQueueFiles(root, queuesDir, files) {
+	const queuesDirPath = isAbsolute(queuesDir) ? queuesDir : join(root, queuesDir);
 	return files.filter((filePath) => !filePath.split("/").some((segment) => segment.startsWith("_"))).sort((leftFilePath, rightFilePath) => leftFilePath.localeCompare(rightFilePath)).map((filePath) => {
-		const source = readFileSync(join(root, queuesDir, filePath), "utf-8");
+		const source = readFileSync(join(queuesDirPath, filePath), "utf-8");
 		const name = extractName(filePath);
 		return {
 			filePath,
@@ -96,7 +102,7 @@ function parseQueueFiles(root, queuesDir, files) {
 }
 async function scanQueues(root, queuesDir = "queues") {
 	return parseQueueFiles(root, queuesDir, await glob(`**/*.{${QUEUE_EXTENSIONS.join(",")}}`, {
-		cwd: `${root}/${queuesDir}`,
+		cwd: isAbsolute(queuesDir) ? queuesDir : join(root, queuesDir),
 		absolute: false
 	}).catch(() => []));
 }
@@ -105,7 +111,7 @@ function scanQueuesSync(root, queuesDir = "queues") {
 	let files;
 	try {
 		files = globSync(pattern, {
-			cwd: `${root}/${queuesDir}`,
+			cwd: isAbsolute(queuesDir) ? queuesDir : join(root, queuesDir),
 			absolute: false
 		});
 	} catch {
@@ -159,7 +165,7 @@ function detectHttpExports(absPath) {
 }
 //#endregion
 //#region src/router/websocket.ts
-const HANDLER_EXTENSIONS$1 = [
+const HANDLER_EXTENSIONS = [
 	"ts",
 	"mts",
 	"js",
@@ -223,9 +229,9 @@ function detectWebSocketDefinition(absPath) {
 	}
 	return null;
 }
-function buildWebSocketRoute(root, filePath) {
+function buildWebSocketRoute(root, filePath, paths = readProjectPaths(root)) {
 	const parsed = parseWebSocketFilename(filePath);
-	const info = detectWebSocketDefinition(join(root, "routes", filePath));
+	const info = detectWebSocketDefinition(join(paths.routesDir, filePath));
 	const className = deriveWebSocketClassName(filePath);
 	return {
 		...parsed,
@@ -235,63 +241,75 @@ function buildWebSocketRoute(root, filePath) {
 		hasAuthGate: info?.hasAuthGate ?? false
 	};
 }
-function parseWebSocketFiles(root, files) {
-	return files.filter((f) => isWebSocketRouteFile(f)).filter((f) => !f.split("/").some((segment) => segment.startsWith("_"))).map((filePath) => buildWebSocketRoute(root, filePath)).sort((a, b) => {
+function parseWebSocketFiles(root, files, paths = readProjectPaths(root)) {
+	return files.filter((f) => isWebSocketRouteFile(f)).filter((f) => !f.split("/").some((segment) => segment.startsWith("_"))).map((filePath) => buildWebSocketRoute(root, filePath, paths)).sort((a, b) => {
 		if (a.catchAll !== b.catchAll) return a.catchAll ? 1 : -1;
 		return a.pattern.localeCompare(b.pattern);
 	});
 }
-async function scanWebSocketRoutes(root) {
-	return parseWebSocketFiles(root, await glob(`**/*.{${HANDLER_EXTENSIONS$1.join(",")}}`, {
-		cwd: `${root}/routes`,
+async function scanWebSocketRoutes(root, paths = readProjectPaths(root)) {
+	return parseWebSocketFiles(root, await glob(`**/*.{${HANDLER_EXTENSIONS.join(",")}}`, {
+		cwd: paths.routesDir,
 		absolute: false
-	}).catch(() => []));
+	}).catch(() => []), paths);
 }
-function scanWebSocketRoutesSync(root) {
-	const pattern = `**/*.{${HANDLER_EXTENSIONS$1.join(",")}}`;
+function scanWebSocketRoutesSync(root, paths = readProjectPaths(root)) {
+	const pattern = `**/*.{${HANDLER_EXTENSIONS.join(",")}}`;
 	let files;
 	try {
 		files = globSync(pattern, {
-			cwd: `${root}/routes`,
+			cwd: paths.routesDir,
 			absolute: false
 		});
 	} catch {
 		files = [];
 	}
-	return parseWebSocketFiles(root, files);
+	return parseWebSocketFiles(root, files, paths);
 }
 function isWebSocketPatternFile(filePath) {
 	return isWebSocketRouteFile(filePath);
 }
 //#endregion
 //#region src/router/scan.ts
-const HANDLER_EXTENSIONS = [
+const ROUTE_PATTERN = `**/*.{${[
 	"ts",
 	"mts",
 	"js",
 	"mjs"
-];
+].join(",")}}`;
+function parseMiddlewareDefinitions(files) {
+	return files.filter((f) => !f.startsWith("_")).map((f) => {
+		const match = f.split("/").pop().match(/^(\d+)\./);
+		return {
+			order: match ? parseInt(match[1], 10) : Infinity,
+			filePath: f
+		};
+	}).sort((a, b) => a.order - b.order);
+}
 /**
 * Scan routes/ and middleware/ directories and return a structured manifest.
 * Files starting with _ are ignored.
 */
 async function scanRoutes(root, options) {
-	const pattern = `**/*.{${HANDLER_EXTENSIONS.join(",")}}`;
+	const paths = options?.paths ?? readProjectPaths(root);
 	const [routeFiles, websockets, middlewareFiles, jobs, queues, pages] = await Promise.all([
-		glob(pattern, {
-			cwd: `${root}/routes`,
+		glob(ROUTE_PATTERN, {
+			cwd: paths.routesDir,
 			absolute: false
 		}),
-		scanWebSocketRoutes(root),
-		glob(pattern, {
-			cwd: `${root}/middleware`,
+		scanWebSocketRoutes(root, paths),
+		glob(ROUTE_PATTERN, {
+			cwd: paths.middlewareDir,
 			absolute: false
 		}).catch(() => []),
-		scanJobs(root),
-		scanQueues(root),
-		scanPages(root, { output: options?.output })
+		scanJobs(root, paths.cronsDir),
+		scanQueues(root, paths.queuesDir),
+		scanPages(root, {
+			output: options?.output,
+			paths
+		})
 	]);
-	const routesDir = `${root}/routes`;
+	const routesDir = paths.routesDir;
 	return {
 		routes: routeFiles.filter((f) => !isWebSocketPatternFile(f)).filter((f) => !f.split("/").some((s) => s.startsWith("_"))).map((f) => {
 			const route = parseRouteFilename(f);
@@ -302,17 +320,38 @@ async function scanRoutes(root, options) {
 			return a.pattern.localeCompare(b.pattern);
 		}),
 		websockets,
-		middleware: middlewareFiles.filter((f) => !f.startsWith("_")).map((f) => {
-			const match = f.split("/").pop().match(/^(\d+)\./);
-			return {
-				order: match ? parseInt(match[1], 10) : Infinity,
-				filePath: f
-			};
-		}).sort((a, b) => a.order - b.order),
+		middleware: parseMiddlewareDefinitions(middlewareFiles),
 		jobs,
 		queues,
 		pages
 	};
 }
+function scanMiddlewareSync(root, paths = readProjectPaths(root)) {
+	let middlewareFiles;
+	try {
+		middlewareFiles = globSync(ROUTE_PATTERN, {
+			cwd: paths.middlewareDir,
+			absolute: false
+		});
+	} catch {
+		middlewareFiles = [];
+	}
+	return parseMiddlewareDefinitions(middlewareFiles);
+}
+function scanRoutePatternsSync(root, paths = readProjectPaths(root)) {
+	let routeFiles;
+	try {
+		routeFiles = globSync(ROUTE_PATTERN, {
+			cwd: paths.routesDir,
+			absolute: false
+		});
+	} catch {
+		routeFiles = [];
+	}
+	return routeFiles.filter((f) => !isWebSocketPatternFile(f)).filter((f) => !f.split("/").some((s) => s.startsWith("_"))).map((f) => parseRouteFilename(f)).sort((a, b) => {
+		if (a.catchAll !== b.catchAll) return a.catchAll ? 1 : -1;
+		return a.pattern.localeCompare(b.pattern);
+	});
+}
 //#endregion
-export { scanJobsSync as i, scanWebSocketRoutesSync as n, scanQueuesSync as r, scanRoutes as t };
+export { scanQueuesSync as a, scanWebSocketRoutesSync as i, scanRoutePatternsSync as n, scanJobsSync as o, scanRoutes as r, scanMiddlewareSync as t };

package/dist/{secret-NDvlqAN2.mjs → secret-mz8t_CML.mjs}

@@ -1,8 +1,8 @@
-import { n as cliTitle } from "./output-D3g5otMC.mjs";
-import { c as getToken, n as PlatformClient } from "./client-C_DYiXeu.mjs";
-import { _ as me, c as R, g as ge, n as Ce, u as Se, v as ue, x as q, y as ye } from "./dist-D2L3_KTK.mjs";
-import { r as readProjectConfig } from "./project-DhB4A8_g.mjs";
-import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-DdjLQ2tB.mjs";
+import { n as cliTitle } from "./output-DeiS4oEX.mjs";
+import { c as getToken, n as PlatformClient } from "./client-C-nH6yz3.mjs";
+import { _ as me, c as R, g as ge, n as Ce, u as Se, v as ue, x as q, y as ye } from "./dist-abzUneor.mjs";
+import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
+import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-CNpUbUHd.mjs";
 import { readFileSync } from "node:fs";
 //#region src/cli/secret.ts
 async function runSecretCommand(root, args) {

package/dist/{skills-SAG0WyVn.mjs → skills-B_ynF4lA.mjs}

@@ -1,6 +1,6 @@
-import { a as join, o as relative } from "./pathe.M-eThtNZ-D-kmWkCS.mjs";
-import { c as R } from "./dist-D2L3_KTK.mjs";
-import { r as getPackageDir } from "./agents-DqkFfc2c.mjs";
+import { a as join, s as relative } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
+import { c as R } from "./dist-abzUneor.mjs";
+import { r as getPackageDir } from "./agents-Dkgafwfr.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, readlinkSync, symlinkSync } from "node:fs";
 //#region src/cli/skills.ts
 function parseSkills(skillsDir) {

package/dist/{subcommand-prompt-q9T06dpg.mjs → subcommand-prompt-CPuV7tPW.mjs}

@@ -1,5 +1,5 @@
-import { s as import_picocolors } from "./output-D3g5otMC.mjs";
-import { a as F, b as z, d as _t, m as et, o as H, r as E, s as J, t as $ } from "./dist-D2L3_KTK.mjs";
+import { s as import_picocolors } from "./output-DeiS4oEX.mjs";
+import { a as F, b as z, d as _t, m as et, o as H, r as E, s as J, t as $ } from "./dist-abzUneor.mjs";
 //#region src/cli/subcommand-prompt.ts
 function promptSubcommand(command, subcommands) {
 	return new Promise((resolve) => {

package/dist/sveltekit.mjs

@@ -1,4 +1,4 @@
-import { a as join, i as isAbsolute, o as relative, s as resolve } from "./pathe.M-eThtNZ-D-kmWkCS.mjs";
+import { a as join, c as resolve, i as isAbsolute, s as relative } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/sveltekit.ts
 /**

package/dist/{validate-DW3ViKTA.mjs → validate-CNWm-PsL.mjs}

@@ -1,6 +1,7 @@
 import { n as __exportAll } from "./chunk-DJd-R1mw.mjs";
-import { a as join } from "./pathe.M-eThtNZ-D-kmWkCS.mjs";
-import { i as stripSqlExt, r as readJournal } from "./collect-HqAuilH6.mjs";
+import { a as join } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
+import { i as stripSqlExt, r as readJournal } from "./collect-9rO3JFNM.mjs";
+import { a as tokenizeSql, t as DESTRUCTIVE_PRAGMA } from "./plan-aD3wRDqF.mjs";
 import { existsSync, readdirSync } from "node:fs";
 //#region src/migrations/validate.ts
 var validate_exports = /* @__PURE__ */ __exportAll({
@@ -15,16 +16,55 @@ var validate_exports = /* @__PURE__ */ __exportAll({
 */
 const DESTRUCTIVE_PATTERNS = [
 	/\bDROP\s+TABLE\b/i,
-	/\bDROP\s+COLUMN\b/i,
-	/\bALTER\s+TABLE\s+\S+\s+RENAME\b/i,
-	/\bTRUNCATE\b/i
+	/\bDROP\s+VIEW\b/i,
+	/\bDROP\s+INDEX\b/i,
+	/\bDROP\s+TRIGGER\b/i,
+	/\bALTER\s+TABLE\b[\s\S]*\bDROP\s+COLUMN\b/i,
+	/\bALTER\s+TABLE\b[\s\S]*\bRENAME\s+TO\b/i,
+	/\bALTER\s+TABLE\b[\s\S]*\bRENAME\s+COLUMN\b/i,
+	/\bALTER\s+TABLE\b[\s\S]*\bRENAME\b[\s\S]*\bTO\b/i,
+	/\bTRUNCATE\b/i,
+	/\bINSERT\s+OR\s+REPLACE\b/i
 ];
-const PRAGMA_COMMENT = "-- void:allow-destructive";
+function splitExecutableStatements(sql) {
+	return sql.split(";").map((statement) => statement.trim()).filter(Boolean);
+}
+function hasTopLevelKeyword(statement, keyword) {
+	let depth = 0;
+	for (let index = 0; index < statement.length; index++) {
+		const character = statement[index];
+		if (character === "(") {
+			depth++;
+			continue;
+		}
+		if (character === ")") {
+			depth = Math.max(0, depth - 1);
+			continue;
+		}
+		if (depth !== 0) continue;
+		if (statement.slice(index, index + keyword.length).toUpperCase() === keyword && !/[A-Z0-9_]/i.test(statement[index - 1] ?? "") && !/[A-Z0-9_]/i.test(statement[index + keyword.length] ?? "")) return true;
+	}
+	return false;
+}
+function hasUnboundedWrite(statement) {
+	if (/\bDELETE\s+FROM\b/i.test(statement)) return !hasTopLevelKeyword(statement, "WHERE");
+	if (/\bUPDATE\b[\s\S]*\bSET\b/i.test(statement)) return !hasTopLevelKeyword(statement, "WHERE");
+	return false;
+}
 /**
 * Check if a SQL migration contains destructive operations.
 */
 function isDestructive(sql) {
-	return DESTRUCTIVE_PATTERNS.some((pattern) => pattern.test(sql));
+	const normalized = sql.replace(/\r\n?/g, "\n");
+	let executable = "";
+	for (const segment of tokenizeSql(normalized)) if (segment.kind === "sql") executable += normalized.slice(segment.start, segment.end);
+	else executable += " ".repeat(segment.end - segment.start);
+	return splitExecutableStatements(executable).some((statement) => {
+		return DESTRUCTIVE_PATTERNS.some((pattern) => pattern.test(statement)) || hasUnboundedWrite(statement);
+	});
+}
+function hasDestructivePragma(sql) {
+	return sql.replace(/\r\n?/g, "\n").split("\n").some((line) => line.trim() === DESTRUCTIVE_PRAGMA);
 }
 /**
 * Validate migration files. Returns the validated list with destructive flags.
@@ -35,14 +75,14 @@ function validateMigrations(files) {
 	const errors = [];
 	for (const file of files) {
 		const destructive = isDestructive(file.sql);
-		if (destructive && !file.sql.includes(PRAGMA_COMMENT)) errors.push(file.name);
+		if (destructive && !hasDestructivePragma(file.sql)) errors.push(file.name);
 		results.push({
 			name: file.name,
 			sql: file.sql,
 			destructive
 		});
 	}
-	if (errors.length > 0) throw new Error(`Destructive migrations detected without pragma:\n` + errors.map((f) => `  - ${f}`).join("\n") + `\n\nAdd "${PRAGMA_COMMENT}" to each file to allow the migration locally and on deploy.`);
+	if (errors.length > 0) throw new Error(`Destructive migrations detected without pragma:\n` + errors.map((f) => `  - ${f}`).join("\n") + `\n\nAdd "${DESTRUCTIVE_PRAGMA}" to each file to allow the migration locally and on deploy.`);
 	return results;
 }
 /**