void 1.1.11 → 1.2.0

package/dist/{platform-management-CnXhgxTM.mjs → platform-management--vDwSn35.mjs}

@@ -1,8 +1,8 @@
 import { S as writePendingInstallationSecrets, _ as removePlatformConnectionForInstallation, g as removeInstallationRecoverySecrets, h as readPendingInstallationSecrets, m as readInstallationRecoverySecrets, o as listInstallationManifests, t as acquirePlatformLifecycleLock, v as resolveInstallationManifest, x as writeInstallationManifest } from "./platform-registry-B9mWX9LO.mjs";
 import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
-import { A as confirm, H as outro, K as select, L as log, tt as isCancel } from "./dist-BVdsO7Py.mjs";
-import { f as import_picocolors, l as formatUrl, m as printSuccess, p as note, r as createSpinner } from "./output-Ba6ZbrzY.mjs";
-import { A as matchesRecordedR2Fingerprint, B as activatePlatformAccessCredentials, C as platformTrafficAttachmentWorker, D as formatPlatformInstallPlan, E as dnsRecordConfigHash, F as platformDatabaseNameFromOwnerUrl, G as PlatformCloudflareClient, I as turnOffInstalledProjectZeroTrust, J as hyperdriveOriginMatches, K as hyperdriveOriginConfigHash, L as assertPlatformOperatorCredentialCanApplyPlan, M as r2BucketConfigHash, N as resourceMarkerProblem, O as hasProvisionIntentStep, P as revalidatePlatformInstallAction, R as resolvePlatformCloudflareCredential, T as createPlatformInstallPlan, W as PlatformCloudflareApiError, Y as verifyPlatformRuntimeTokenPermissions, _ as readPlatformDatabase, a as authenticationSetupRequestHash, b as createPlatformInstallationSecrets, c as REMOTE_INSTALLATION_MANIFEST_KEY, g as formatZeroTrustApplications, h as assertProjectZeroTrustAllowsUninstall, j as platformAdoptionIntentHash, k as legacyResourceConfigHash, l as installPlatform, m as readPlatformProjectZeroTrustState, n as resolvePlatformInstallDatabaseUrl, o as readLoginReplacementFile, p as readPlatformProjectSlugs, q as hyperdriveOriginFromConnectionString, s as replacePendingInstallationAuthentication, t as assertNoninteractivePlatformMutationAcknowledged, u as acquirePlatformDatabaseLifecycleLock, v as loadPlatformRuntime, x as resolveBootstrapGitHubId, y as createPlatformHealthProbeToken, z as verifyPlatformCloudflareCredential } from "./platform-lifecycle-D0TdyXbN.mjs";
+import { A as confirm, H as outro, K as select, L as log, tt as isCancel } from "./dist-Cor9XGoz.mjs";
+import { f as import_picocolors, l as formatUrl, m as printSuccess, p as note, r as createSpinner } from "./output-BpgYODYx.mjs";
+import { $ as hyperdriveOriginMatches, A as dnsRecordConfigHash, B as turnOffInstalledProjectZeroTrust, C as createPlatformHealthProbeToken, D as platformTrafficAttachmentWorker, F as platformAdoptionIntentHash, H as resolvePlatformCloudflareCredential, I as r2BucketConfigHash, J as PlatformCloudflareApiError, L as resourceMarkerProblem, M as hasProvisionIntentStep, N as legacyResourceConfigHash, P as matchesRecordedR2Fingerprint, Q as hyperdriveOriginFromConnectionString, R as revalidatePlatformInstallAction, S as loadPlatformRuntime, T as resolveBootstrapGitHubId, U as verifyPlatformCloudflareCredential, V as assertPlatformOperatorCredentialCanApplyPlan, W as activatePlatformAccessCredentials, X as PlatformRuntimeTokenEmailPermissionError, Y as PlatformCloudflareClient, Z as hyperdriveOriginConfigHash, _ as readPlatformProjectSlugs, a as findPlatformWorkerOutsideChanges, b as formatZeroTrustApplications, c as uploadPlatformWorkerOutsideChanges, d as replacePendingInstallationAuthentication, et as verifyPlatformRuntimeTokenEmailPermissions, f as REMOTE_INSTALLATION_MANIFEST_KEY, j as formatPlatformInstallPlan, k as createPlatformInstallPlan, l as authenticationSetupRequestHash, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, o as formatPlatformWorkerOutsideChanges, p as installPlatform, s as reviewPlatformWorkerOutsideChanges, t as assertNoninteractivePlatformMutationAcknowledged, tt as verifyPlatformRuntimeTokenPermissions, u as readLoginReplacementFile, v as readPlatformProjectZeroTrustState, w as createPlatformInstallationSecrets, x as readPlatformDatabase, y as assertProjectZeroTrustAllowsUninstall, z as platformDatabaseNameFromOwnerUrl } from "./platform-lifecycle-DyKmuNY6.mjs";
 import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, parsePlatformInstallationManifest, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, transitionInstallation } from "@void/platform";
 import { setTimeout } from "node:timers/promises";
 //#region src/cli/platform-teardown.ts
@@ -624,6 +624,7 @@ function platformLifecycleResumeCommand(args, installationId) {
 	if (args.runtime) command.push("--runtime", commandArgument(args.runtime));
 	if (args.subcommand === "rollback" && args.fromRuntime) command.push("--from-runtime", commandArgument(args.fromRuntime));
 	if ("dashboardUrl" in args && args.dashboardUrl) command.push("--dashboard-url", commandArgument(args.dashboardUrl));
+	if ("customDomains" in args && args.customDomains) command.push("--custom-domains");
 	if (args.yes) command.push("--yes");
 	return command.join(" ");
 }
@@ -714,6 +715,7 @@ async function runInstalledPlatformCommand(args) {
 			applicationDomain: deployment.application.baseDomain,
 			controlPlaneDomain: deployment.controlPlane.apiHostname ?? "",
 			...args.subcommand !== "rollback" && args.dashboardUrl !== void 0 ? { dashboardUrl: args.dashboardUrl } : {},
+			...args.subcommand !== "rollback" && args.customDomains ? { customDomains: true } : {},
 			dedicatedZone: deployment.application.dedicatedZone,
 			displayName: deployment.displayName,
 			installationSlug: deployment.installationSlug,
@@ -738,6 +740,8 @@ async function runInstalledPlatformCommand(args) {
 		log.info(manifest.desiredState === "disabled" && args.subcommand !== "enable" ? "Application traffic will stay paused because this installation is disabled." : "Application traffic may pause briefly during a safe cutover.");
 		if (args.plan) {
 			if (loginFile !== void 0) log.info(`Login settings will be replaced from ${loginFile}; a new setup code is printed at the end.`);
+			const outsideChanges = await findPlatformWorkerOutsideChanges(client, plan, runtime, { manifest });
+			if (outsideChanges.length > 0) log.warn(`${formatPlatformWorkerOutsideChanges(outsideChanges)}\nThis command replaces their configuration with the Void configuration. Run it in a terminal to review them first.`);
 			outro("No Cloudflare or local installation state was changed.");
 			return;
 		}
@@ -788,15 +792,42 @@ async function runInstalledPlatformCommand(args) {
 			r2SecretAccessKey: process.env.VOID_PLATFORM_R2_SECRET_ACCESS_KEY || "",
 			...replacedLogin
 		});
-		const runtimeTokenToPreflight = resolvePlatformRuntimeTokenToPreflight(plan, secrets);
+		const runtimeTokenToPreflight = resolvePlatformRuntimeTokenToPreflight(plan, secrets, { enablingCustomDomains: plan.deployment.capabilities.customDomains && !manifest.deployment.capabilities.customDomains });
+		const emailZoneId = installation.desiredState !== "disabled" && plan.deployment.capabilities.email ? plan.deployment.emailSharedZoneId : void 0;
 		if (runtimeTokenToPreflight) await verifyPlatformRuntimeTokenPermissions(new PlatformCloudflareClient(runtimeTokenToPreflight), {
 			accountId: manifest.account.id,
 			applicationDomain: deployment.application.baseDomain,
 			customDomains: plan.deployment.capabilities.customDomains,
+			...emailZoneId ? { emailZoneId } : {},
 			zoneId: plan.zone?.id ?? null
 		});
+		else if (emailZoneId && secrets.cloudflareApiToken) try {
+			await verifyPlatformRuntimeTokenEmailPermissions(new PlatformCloudflareClient(secrets.cloudflareApiToken), {
+				accountId: manifest.account.id,
+				savedToken: true,
+				zoneId: emailZoneId
+			});
+		} catch (error) {
+			if (!(error instanceof PlatformRuntimeTokenEmailPermissionError) || !error.tokenNotValid) throw error;
+			log.warn("The runtime API token saved on this machine is not valid (HTTP 401). Void cannot check the platform email permissions before it changes the platform, and it continues without this check. To do the check, set VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN to the runtime token of the platform.");
+		}
 		markPhase("runtime token");
 		if (!databaseLock?.readAuthenticationState) throw new Error("platform: The database lifecycle lock cannot read authoritative authentication settings.");
+		const outsideChanges = await reviewPlatformWorkerOutsideChanges({
+			client,
+			plan,
+			runtime,
+			installation: {
+				manifest: installation,
+				readAuthenticationState: databaseLock.readAuthenticationState
+			},
+			interactive: process.stdin.isTTY === true && process.stdout.isTTY === true && !args.yes,
+			command: platformLifecycleResumeCommand({
+				...args,
+				yes: false
+			}, manifest.id)
+		});
+		markPhase("outside changes");
 		progress = createSpinner({ onCancel: () => {
 			if (!process.emit("SIGINT")) process.exit(130);
 		} });
@@ -825,6 +856,15 @@ async function runInstalledPlatformCommand(args) {
 			}),
 			client,
 			operatorApiToken: operatorCredential.token,
+			...outsideChanges.length > 0 ? {
+				replaceOutsideChanges: outsideChanges.map((change) => change.name),
+				uploadOutsideChanges: (configs) => uploadPlatformWorkerOutsideChanges(configs, {
+					changes: outsideChanges,
+					client,
+					operatorApiToken: operatorCredential.token,
+					progress
+				})
+			} : {},
 			databaseRollbackSource: rollbackSourceRuntime ?? void 0,
 			onProgress: (message) => {
 				markPhase(message);
@@ -937,9 +977,13 @@ function assertPlatformRollbackCompatibility(installation, target, source) {
 	if (installation.databaseSchemaDigest !== source.manifest.database.schemaDigest) throw new Error("platform: The authoritative installation checkpoint does not record the installed runtime database schema. Repair or roll forward before rollback.");
 	if (target.manifest.safetyProtocols.sandboxDrain < installation.safetyProtocols.sandboxDrain) throw new Error("platform: The rollback target predates the installed sandbox-drain safety protocol.");
 }
-function resolvePlatformRuntimeTokenToPreflight(plan, secrets) {
+function resolvePlatformRuntimeTokenToPreflight(plan, secrets, options = {}) {
 	const explicitUpdate = secrets.workerSecretUpdates?.CF_API_TOKEN;
 	if (explicitUpdate) return explicitUpdate;
+	if (options.enablingCustomDomains) {
+		if (!secrets.cloudflareApiToken) throw new Error("platform: Before enabling project custom domains, set VOID_PLATFORM_RUNTIME_CLOUDFLARE_API_TOKEN to the platform runtime token with Zone → SSL and Certificates → Edit on the application zone so Void can check its access.");
+		return secrets.cloudflareApiToken;
+	}
 	return plan.actions.some((action) => action.kind === "worker" && action.action === "create" && (action.key === "api-worker" || action.key === "proxy-worker")) ? secrets.cloudflareApiToken : "";
 }
 async function resolveInstalledPlatformManifest(selector, dependencies = {}) {

package/dist/{platform-management-BvgbusqL.mjs → platform-management-7m-PLaPJ.mjs}

@@ -1 +1 @@
-export { c as runInstalledPlatformCommand, l as selectAuthoritativePlatformManifest, d as verifyPlatformInstallationOwnership } from "./platform-management-CnXhgxTM.mjs";
+export { c as runInstalledPlatformCommand, l as selectAuthoritativePlatformManifest, d as verifyPlatformInstallationOwnership } from "./platform-management--vDwSn35.mjs";

package/dist/{platform-plans-config-BWn1S2Rv.mjs → platform-plans-config-CeydDSj0.mjs}

@@ -1,5 +1,5 @@
-import { A as confirm, K as select, X as text, tt as isCancel } from "./dist-BVdsO7Py.mjs";
-import { m as printSuccess } from "./output-Ba6ZbrzY.mjs";
+import { A as confirm, K as select, X as text, tt as isCancel } from "./dist-Cor9XGoz.mjs";
+import { m as printSuccess } from "./output-BpgYODYx.mjs";
 import { n as OperatorClient, r as OperatorClientError } from "./operator-client-C-ROjk1I.mjs";
 import { a as resolveOperatorOrigin, r as readOperatorToken } from "./operator-auth-Cr2zCc-J.mjs";
 import { stripVTControlCharacters } from "node:util";

package/dist/{platform-recovery-CH_fThW6.mjs → platform-recovery-BiNpZZab.mjs}

@@ -1,7 +1,7 @@
 import { o as listInstallationManifests, t as acquirePlatformLifecycleLock, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-B9mWX9LO.mjs";
 import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
-import { T as createPlatformInstallPlan, c as REMOTE_INSTALLATION_MANIFEST_KEY } from "./platform-lifecycle-D0TdyXbN.mjs";
-import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management-CnXhgxTM.mjs";
+import { f as REMOTE_INSTALLATION_MANIFEST_KEY, k as createPlatformInstallPlan } from "./platform-lifecycle-DyKmuNY6.mjs";
+import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management--vDwSn35.mjs";
 import { parsePlatformInstallationManifest, setInstallationEndpoints } from "@void/platform";
 //#region src/cli/platform-recovery.ts
 async function recoverPlatformInstallations(client, accountId, verifyEndpoint = verifyInstallationEndpoint, selector = "") {

package/dist/{platform-setup-YvN9VQXV.mjs → platform-setup-Ca53gtt0.mjs}

@@ -1,6 +1,6 @@
 import { u as openBrowser } from "./auth-B6iOCjKI.mjs";
-import { L as log, tt as isCancel } from "./dist-BVdsO7Py.mjs";
-import { f as import_picocolors, s as formatLink } from "./output-Ba6ZbrzY.mjs";
+import { L as log, tt as isCancel } from "./dist-Cor9XGoz.mjs";
+import { f as import_picocolors, s as formatLink } from "./output-BpgYODYx.mjs";
 //#region src/cli/platform-setup.ts
 /** Return a prompt answer, or stop the platform command when the prompt was cancelled. */
 function platformPromptAnswer(value) {
@@ -254,6 +254,7 @@ function platformInstallCommandArguments(options) {
 			flag("--zone", options.zoneName);
 			if (options.dedicatedZone) parts.push("--dedicated-zone");
 			else parts.push("--no-dedicated-zone");
+			if (options.customDomains) parts.push("--custom-domains");
 		}
 		flag("--control-plane-domain", options.controlPlaneDomain);
 		if (!options.controlPlaneDomain) parts.push("--no-control-plane-domain");

package/dist/{plugin-inference-Bekzjuqw.mjs → plugin-inference-DUjCd55H.mjs}

@@ -1,10 +1,11 @@
 import { a as join, l as toSlash, s as relative } from "./dist-ipQi0Q8y.mjs";
 import { n as readProjectPaths } from "./project-paths-DGu_QZ_Q.mjs";
-import { n as globSync } from "./dist-Bn8Kodjp.mjs";
-import { a as isObjectExpression, i as isMemberExpression, n as isIdentifier, r as isLiteral, t as isCallExpression } from "./ast-CPGPjb0V.mjs";
-import { a as staticLiteral, n as parseRouteFilename, o as unwrapStaticExpression, r as parseWebSocketFilename, t as isRouteEnabledForEnvironment } from "./parse-filename-CUbj-1MP.mjs";
+import { n as globSync } from "./dist-D15hFhP0.mjs";
+import { a as isObjectExpression, i as isMemberExpression, n as isIdentifier, r as isLiteral, t as isCallExpression } from "./ast-CsZ_q_gc.mjs";
+import { a as staticLiteral, n as bindingResolver, o as unwrapStaticExpression, r as walk } from "./ast-bindings-C3yaPs1y.mjs";
 import { n as resourceNameWords, t as isResourceName } from "./resource-name-C7LVpcRm.mjs";
-import { r as getSsrServerEntryPath } from "./entry-B_0IhV64.mjs";
+import { n as parseRouteFilename, r as parseWebSocketFilename, t as isRouteEnabledForEnvironment } from "./parse-filename-DioPHiR9.mjs";
+import { r as getSsrServerEntryPath } from "./entry-BEM8ZuGP.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { parseSync } from "vite";
 //#region src/application-features.ts
@@ -31,7 +32,7 @@ function needsApplicationDatabase(bindings, migrationCount) {
 //#region src/shared/convention-files.ts
 /** Handler files under `dir`, relative to it, skipping paths with a `_`-prefixed segment. */
 function listConventionFiles(dir) {
-	return globSync("**/*.{ts,mts,js,mjs}", { cwd: dir }).filter((filePath) => !filePath.split("/").some((segment) => segment.startsWith("_")));
+	return globSync(["**/*.{ts,mts,js,mjs}", ".well-known/**/*.{ts,mts,js,mjs}"], { cwd: dir }).filter((filePath) => !filePath.split("/").some((segment) => segment.startsWith("_")));
 }
 //#endregion
 //#region src/shared/resource-definition.ts
@@ -149,193 +150,6 @@ function readResourceDefinition(filename, source, helpers) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/estree-walker@3.0.3/node_modules/estree-walker/src/walker.js
-/**
-* @typedef { import('estree').Node} Node
-* @typedef {{
-*   skip: () => void;
-*   remove: () => void;
-*   replace: (node: Node) => void;
-* }} WalkerContext
-*/
-var WalkerBase = class {
-	constructor() {
-		/** @type {boolean} */
-		this.should_skip = false;
-		/** @type {boolean} */
-		this.should_remove = false;
-		/** @type {Node | null} */
-		this.replacement = null;
-		/** @type {WalkerContext} */
-		this.context = {
-			skip: () => this.should_skip = true,
-			remove: () => this.should_remove = true,
-			replace: (node) => this.replacement = node
-		};
-	}
-	/**
-	* @template {Node} Parent
-	* @param {Parent | null | undefined} parent
-	* @param {keyof Parent | null | undefined} prop
-	* @param {number | null | undefined} index
-	* @param {Node} node
-	*/
-	replace(parent, prop, index, node) {
-		if (parent && prop) {
-			if (index != null)
- /** @type {Array<Node>} */ parent[prop][index] = node;
-			else
- /** @type {Node} */ parent[prop] = node;
-		}
-	}
-	/**
-	* @template {Node} Parent
-	* @param {Parent | null | undefined} parent
-	* @param {keyof Parent | null | undefined} prop
-	* @param {number | null | undefined} index
-	*/
-	remove(parent, prop, index) {
-		if (parent && prop) {
-			if (index !== null && index !== void 0)
- /** @type {Array<Node>} */ parent[prop].splice(index, 1);
-			else delete parent[prop];
-		}
-	}
-};
-//#endregion
-//#region ../../node_modules/.pnpm/estree-walker@3.0.3/node_modules/estree-walker/src/sync.js
-/**
-* @typedef { import('estree').Node} Node
-* @typedef { import('./walker.js').WalkerContext} WalkerContext
-* @typedef {(
-*    this: WalkerContext,
-*    node: Node,
-*    parent: Node | null,
-*    key: string | number | symbol | null | undefined,
-*    index: number | null | undefined
-* ) => void} SyncHandler
-*/
-var SyncWalker = class extends WalkerBase {
-	/**
-	*
-	* @param {SyncHandler} [enter]
-	* @param {SyncHandler} [leave]
-	*/
-	constructor(enter, leave) {
-		super();
-		/** @type {boolean} */
-		this.should_skip = false;
-		/** @type {boolean} */
-		this.should_remove = false;
-		/** @type {Node | null} */
-		this.replacement = null;
-		/** @type {WalkerContext} */
-		this.context = {
-			skip: () => this.should_skip = true,
-			remove: () => this.should_remove = true,
-			replace: (node) => this.replacement = node
-		};
-		/** @type {SyncHandler | undefined} */
-		this.enter = enter;
-		/** @type {SyncHandler | undefined} */
-		this.leave = leave;
-	}
-	/**
-	* @template {Node} Parent
-	* @param {Node} node
-	* @param {Parent | null} parent
-	* @param {keyof Parent} [prop]
-	* @param {number | null} [index]
-	* @returns {Node | null}
-	*/
-	visit(node, parent, prop, index) {
-		if (node) {
-			if (this.enter) {
-				const _should_skip = this.should_skip;
-				const _should_remove = this.should_remove;
-				const _replacement = this.replacement;
-				this.should_skip = false;
-				this.should_remove = false;
-				this.replacement = null;
-				this.enter.call(this.context, node, parent, prop, index);
-				if (this.replacement) {
-					node = this.replacement;
-					this.replace(parent, prop, index, node);
-				}
-				if (this.should_remove) this.remove(parent, prop, index);
-				const skipped = this.should_skip;
-				const removed = this.should_remove;
-				this.should_skip = _should_skip;
-				this.should_remove = _should_remove;
-				this.replacement = _replacement;
-				if (skipped) return node;
-				if (removed) return null;
-			}
-			/** @type {keyof Node} */
-			let key;
-			for (key in node) {
-				/** @type {unknown} */
-				const value = node[key];
-				if (value && typeof value === "object") {
-					if (Array.isArray(value)) {
-						const nodes = value;
-						for (let i = 0; i < nodes.length; i += 1) {
-							const item = nodes[i];
-							if (isNode(item)) {
-								if (!this.visit(item, node, key, i)) i--;
-							}
-						}
-					} else if (isNode(value)) this.visit(value, node, key, null);
-				}
-			}
-			if (this.leave) {
-				const _replacement = this.replacement;
-				const _should_remove = this.should_remove;
-				this.replacement = null;
-				this.should_remove = false;
-				this.leave.call(this.context, node, parent, prop, index);
-				if (this.replacement) {
-					node = this.replacement;
-					this.replace(parent, prop, index, node);
-				}
-				if (this.should_remove) this.remove(parent, prop, index);
-				const removed = this.should_remove;
-				this.replacement = _replacement;
-				this.should_remove = _should_remove;
-				if (removed) return null;
-			}
-		}
-		return node;
-	}
-};
-/**
-* Ducktype a node.
-*
-* @param {unknown} value
-* @returns {value is Node}
-*/
-function isNode(value) {
-	return value !== null && typeof value === "object" && "type" in value && typeof value.type === "string";
-}
-//#endregion
-//#region ../../node_modules/.pnpm/estree-walker@3.0.3/node_modules/estree-walker/src/index.js
-/**
-* @typedef {import('estree').Node} Node
-* @typedef {import('./sync.js').SyncHandler} SyncHandler
-* @typedef {import('./async.js').AsyncHandler} AsyncHandler
-*/
-/**
-* @param {Node} ast
-* @param {{
-*   enter?: SyncHandler
-*   leave?: SyncHandler
-* }} walker
-* @returns {Node | null}
-*/
-function walk(ast, { enter, leave }) {
-	return new SyncWalker(enter, leave).visit(ast, null);
-}
-//#endregion
 //#region src/shared/module-references.ts
 /** Runtime imports and re-exports, in source order, including empty export lists. */
 function staticModuleReferences(parsed, code) {
@@ -363,8 +177,105 @@ function staticModuleReferences(parsed, code) {
 	});
 }
 //#endregion
+//#region src/inference/client-auth.ts
+const CLIENT_MODULES = /* @__PURE__ */ new Set([
+	"void/client",
+	"void/client/react",
+	"void/client/vue",
+	"void/client/svelte",
+	"void/client/solid"
+]);
+function name(node) {
+	return isIdentifier(node) ? node.name : staticLiteral(node);
+}
+function propertyName(node) {
+	const key = node.property ?? node.key;
+	return node.computed ? staticLiteral(key) : name(key);
+}
+/** Detect runtime auth imports and namespace reads without confusing aliases or type names. */
+function inferClientAuth(parsed, code) {
+	let hasNamespace = false;
+	for (const statement of parsed.module.staticImports) {
+		if (!CLIENT_MODULES.has(statement.moduleRequest.value)) continue;
+		for (const entry of statement.entries) if (!entry.isType) {
+			if (entry.importName.name === "auth") return true;
+			hasNamespace ||= entry.importName.kind === "NamespaceObject";
+		}
+	}
+	for (const statement of parsed.module.staticExports) for (const entry of statement.entries) if (!entry.isType && entry.moduleRequest && CLIENT_MODULES.has(entry.moduleRequest.value)) {
+		if (entry.importName.name === "auth" || entry.importName.kind === "All" || entry.importName.kind === "AllButDefault") return true;
+	}
+	if (!hasNamespace && parsed.module.dynamicImports.length === 0 || !/\bauth\b|\\(?:u|x|h|[0-7\r\n\u2028\u2029])/.test(code)) return false;
+	return inferNamespaceAuth(parsed.program);
+}
+function inferNamespaceAuth(program) {
+	const namespaces = /* @__PURE__ */ new Set();
+	for (const statement of program.body ?? []) {
+		const source = staticLiteral(statement.source);
+		if (typeof source !== "string" || !CLIENT_MODULES.has(source)) continue;
+		if (statement.importKind === "type" || statement.exportKind === "type") continue;
+		if (statement.type === "ExportAllDeclaration") return true;
+		for (const specifier of statement.specifiers ?? []) {
+			if (specifier.importKind === "type" || specifier.exportKind === "type") continue;
+			if (statement.type === "ImportDeclaration") {
+				if (specifier.type === "ImportNamespaceSpecifier") namespaces.add(specifier);
+				else if (name(specifier.imported) === "auth") return true;
+			} else if (statement.type === "ExportNamedDeclaration" && name(specifier.local) === "auth") return true;
+		}
+	}
+	const reads = [];
+	const resolve = bindingResolver(program, { visit(node) {
+		if (isMemberExpression(node) && propertyName(node) === "auth") reads.push(node.object);
+		else if ([
+			"VariableDeclarator",
+			"AssignmentExpression",
+			"AssignmentPattern"
+		].includes(node.type)) {
+			const pattern = node.id ?? node.left;
+			const value = node.init ?? node.right;
+			if (pattern?.type === "ObjectPattern" && (pattern.properties ?? []).some((property) => property.type === "Property" && propertyName(property) === "auth")) reads.push(value);
+		}
+		return isIdentifier(node);
+	} });
+	const namespaceValues = /* @__PURE__ */ new Map();
+	function isClientNamespace(node) {
+		const aliases = [];
+		let found = false;
+		while (node = unwrapStaticExpression(node)) {
+			if (node.type === "AwaitExpression") {
+				node = node.argument;
+				continue;
+			}
+			if (node.type === "ImportExpression") {
+				const source = staticLiteral(node.source);
+				found = typeof source === "string" && CLIENT_MODULES.has(source);
+				break;
+			}
+			if (!isIdentifier(node)) break;
+			const binding = resolve(node, node.name);
+			if (binding && namespaces.has(binding)) {
+				found = true;
+				break;
+			}
+			if (binding?.type !== "VariableDeclarator" || !isIdentifier(binding.id)) break;
+			const cached = namespaceValues.get(binding);
+			if (cached !== void 0) {
+				found = cached;
+				break;
+			}
+			namespaceValues.set(binding, false);
+			aliases.push(binding);
+			node = binding.init;
+		}
+		for (const alias of aliases) namespaceValues.set(alias, found);
+		return found;
+	}
+	return reads.some(isClientNamespace);
+}
+//#endregion
 //#region src/inference/walk.ts
-const ENV_BINDING_RE = /\benv\s*\.\s*(DB|KV|STORAGE|QUEUE_\w+|AI|SANDBOX)\b/;
+const ENV_BINDING_RE = /\benv\b|\\(?:u|x|[0-7\r\n\u2028\u2029])/;
+const RESOURCE_BINDING_RE = /\b(?:DB\b|KV\b|STORAGE\b|AI\b|SANDBOX\b|QUEUE_)|\\(?:u|x|[0-7A-Z_\r\n\u2028\u2029])/;
 /**
 * Infer which Cloudflare bindings a source file uses.
 *
@@ -389,7 +300,9 @@ function inferBindingsFromSource(code, filename) {
 	} catch {
 		return result;
 	}
-	function recordModuleReference(source, statement) {
+	let hasClientModule = false;
+	function recordModuleReference(source) {
+		if (CLIENT_MODULES.has(source)) hasClientModule = true;
 		switch (source) {
 			case "void/db":
 				result.needsD1 = true;
@@ -415,35 +328,29 @@ function inferBindingsFromSource(code, filename) {
 			case "void/email":
 				result.needsEmail = true;
 				break;
-			case "void/live":
-				result.needsLive = true;
-				break;
-			case "void/client":
-			case "void/client/react":
-			case "void/client/vue":
-			case "void/client/svelte":
-			case "void/client/solid": if (/\bauth\b/.test(statement)) result.needsAuth = true;
+			case "void/live": result.needsLive = true;
 		}
 	}
-	for (const reference of staticModuleReferences(parsed, code)) recordModuleReference(reference.source, code.slice(reference.start, reference.end));
+	for (const reference of staticModuleReferences(parsed, code)) recordModuleReference(reference.source);
 	for (const reference of parsed.module.dynamicImports) {
 		const argument = code.slice(reference.moduleRequest.start, reference.moduleRequest.end);
 		const expression = parseSync(filename, `(${argument})`).program.body[0];
 		const source = expression?.type === "ExpressionStatement" ? staticLiteral(expression.expression) : void 0;
-		if (typeof source === "string") recordModuleReference(source, code.slice(reference.start, reference.end));
+		if (typeof source === "string") recordModuleReference(source);
 	}
-	if (!ENV_BINDING_RE.test(code)) return result;
-	walk(parsed.program, { enter(node) {
-		const current = node;
-		if (!isMemberExpression(current)) return;
-		if (current.computed) return;
-		const property = current.property;
-		if (!isIdentifier(property)) return;
-		const obj = current.object;
-		const isViaContextEnv = isMemberExpression(obj) && isIdentifier(obj.property) && obj.property.name === "env";
-		const isDirectEnv = isIdentifier(obj) && obj.name === "env";
-		if (!isViaContextEnv && !isDirectEnv) return;
-		switch (property.name) {
+	if (hasClientModule) result.needsAuth ||= inferClientAuth(parsed, code);
+	if (!ENV_BINDING_RE.test(code) || !RESOURCE_BINDING_RE.test(code)) return result;
+	function propertyName(node) {
+		const key = node.property ?? node.key;
+		const name = !node.computed && isIdentifier(key) ? key.name : staticLiteral(key);
+		return typeof name === "string" ? name : void 0;
+	}
+	function isEnv(node) {
+		node = unwrapStaticExpression(node);
+		return isIdentifier(node) && node.name === "env" || isMemberExpression(node) && propertyName(node) === "env";
+	}
+	function recordBinding(name) {
+		switch (name) {
 			case "DB":
 				result.needsD1 = true;
 				break;
@@ -459,8 +366,28 @@ function inferBindingsFromSource(code, filename) {
 			case "SANDBOX":
 				result.needsSandbox = true;
 				break;
-			default: if (property.name.startsWith("QUEUE_")) result.needsQueues = true;
+			default: if (name?.startsWith("QUEUE_")) result.needsQueues = true;
+		}
+	}
+	function inspectPattern(pattern, fromEnv = false) {
+		if (pattern?.type === "AssignmentPattern") inspectPattern(pattern.left, fromEnv || isEnv(pattern.right));
+		else if (pattern?.type === "ObjectPattern") for (const property of pattern.properties ?? []) {
+			if (property.type !== "Property") continue;
+			const name = propertyName(property);
+			if (fromEnv) recordBinding(name);
+			inspectPattern(property.value, name === "env");
 		}
+		else if (pattern?.type === "ArrayPattern") for (const element of pattern.elements ?? []) inspectPattern(element);
+	}
+	walk(parsed.program, { enter(node) {
+		const current = node;
+		if (isMemberExpression(current) && isEnv(current.object)) recordBinding(propertyName(current));
+		else if (current.type === "VariableDeclarator" || current.type === "AssignmentExpression") inspectPattern(current.id ?? current.left, isEnv(current.init ?? current.right));
+		else if ([
+			"FunctionDeclaration",
+			"FunctionExpression",
+			"ArrowFunctionExpression"
+		].includes(current.type)) for (const parameter of current.params ?? []) inspectPattern(parameter);
 	} });
 	return result;
 }
@@ -707,4 +634,4 @@ function inferProjectBindings(root, options, scanDirs) {
 	return applyBindingOverrides(mergeBindings(allBindings), options?.bindings);
 }
 //#endregion
-export { deriveWebSocketClassNameFromName as a, scanWebSocketRoutesSync as c, walk as d, readResourceDefinition as f, needsApplicationDatabase as h, inferProjectBindings as i, inferBindingsFromSource as l, applyBindingOverrides as m, FRAMEWORK_SCAN_DIRS as n, inferWebSocketResourceName as o, listConventionFiles as p, detectFramework as r, isWebSocketPatternFile as s, DEFAULT_SCAN_DIRS as t, staticModuleReferences as u };
+export { deriveWebSocketClassNameFromName as a, scanWebSocketRoutesSync as c, readResourceDefinition as d, listConventionFiles as f, inferProjectBindings as i, inferBindingsFromSource as l, needsApplicationDatabase as m, FRAMEWORK_SCAN_DIRS as n, inferWebSocketResourceName as o, applyBindingOverrides as p, detectFramework as r, isWebSocketPatternFile as s, DEFAULT_SCAN_DIRS as t, staticModuleReferences as u };

package/dist/{prepare-2XD6kh77.mjs → prepare-BcAE5Sdj.mjs}

@@ -1,6 +1,6 @@
-import { L as log } from "./dist-BVdsO7Py.mjs";
-import { m as printSuccess, p as note } from "./output-Ba6ZbrzY.mjs";
-import { t as prepareProject } from "./prepare-DepAGBcV.mjs";
+import { L as log } from "./dist-Cor9XGoz.mjs";
+import { m as printSuccess, p as note } from "./output-BpgYODYx.mjs";
+import { t as prepareProject } from "./prepare-DA-17DhO.mjs";
 //#region src/cli/prepare.ts
 async function runPrepareCommand(root) {
 	console.log();

package/dist/prepare-C4I0f--h.mjs

@@ -0,0 +1 @@
+export { t as prepareProject } from "./prepare-DA-17DhO.mjs";

package/dist/{prepare-DepAGBcV.mjs → prepare-DA-17DhO.mjs}

@@ -1,14 +1,14 @@
 import { a as join } from "./dist-ipQi0Q8y.mjs";
 import { n as loadVoidAuthConfig } from "./config-CyUJzi3q.mjs";
-import { d as readConfig } from "./config-D26zcdKy.mjs";
+import { c as getDatabaseCasing, p as readConfig } from "./config-DHgSEWT7.mjs";
 import { n as ensureProjectTsconfig, r as writeFileIfChanged } from "./project-tsconfig-Itv1f4WC.mjs";
 import { n as generateDbDts } from "./db-types-NGxPwnlt.mjs";
 import { t as discoverSchema } from "./discover-LaV0tbIu.mjs";
 import { o as loadLocalEnv } from "./env-BJjULvL0.mjs";
-import { n as findEnvFileForPaths, r as generateEnvTypes } from "./env-types-GRchm5dw.mjs";
-import { t as analyzeApplication } from "./application-routing-CZH66gXn.mjs";
-import { n as generateVoidAuthDrizzleSchema, t as generateVoidAuthDatabaseModule } from "./drizzle-BQfyvQKX.mjs";
+import { n as findEnvFileForPaths, r as generateEnvTypes } from "./env-types-BicfKBhV.mjs";
+import { t as analyzeApplication } from "./application-routing-DAhNP4u3.mjs";
 import { n as generateQueueTypes, t as generateRouteTypes } from "./route-types-BZi26DVS.mjs";
+import { n as generateVoidAuthDrizzleSchema, t as generateVoidAuthDatabaseModule } from "./drizzle-BQfyvQKX.mjs";
 import { existsSync, rmSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/codegen/prepare.ts
@@ -40,7 +40,7 @@ async function prepareProject(root) {
 	if (existsSync(paths.queuesDir)) writeGeneratedFile(outDir, "queues.d.ts", generateQueueTypes(scan.queues, paths.queuesDir, outDir), written);
 	else removeGeneratedFile(outDir, "queues.d.ts", removed);
 	const schema = discoverSchema(root, paths);
-	const hasDbRuntime = schema != null || authEnabled;
+	const hasDbRuntime = schema != null || authEnabled || getDatabaseCasing(config) !== void 0;
 	if (hasDbRuntime) {
 		if (generateDbDts(outDir, schema, dialect)) written.push(join(".void", "db.d.ts"));
 	} else removeGeneratedFile(outDir, "db.d.ts", removed);