void 1.2.1 → 1.3.0

package/dist/{platform-auth-recovery-DXVWs-wA.mjs → platform-auth-recovery-Ug12d9W5.mjs}

@@ -3,8 +3,8 @@ import { u as openBrowser } from "./auth-B6iOCjKI.mjs";
 import { A as confirm, tt as isCancel } from "./dist-Cor9XGoz.mjs";
 import { l as formatUrl, m as printSuccess } from "./output-BpgYODYx.mjs";
 import { a as resolveOperatorOrigin } from "./operator-auth-Cr2zCc-J.mjs";
-import { H as resolvePlatformCloudflareCredential, Y as PlatformCloudflareClient, g as platformDatabaseClientUrl, h as acquirePlatformDatabaseLifecycleLockConnection, n as resolvePlatformInstallDatabaseUrl } from "./platform-lifecycle-DyKmuNY6.mjs";
-import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest } from "./platform-management--vDwSn35.mjs";
+import { H as resolvePlatformCloudflareCredential, Y as PlatformCloudflareClient, g as platformDatabaseClientUrl, h as acquirePlatformDatabaseLifecycleLockConnection, n as resolvePlatformInstallDatabaseUrl } from "./platform-lifecycle-3dwFJmnq.mjs";
+import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest } from "./platform-management-ZZ6bQM5j.mjs";
 import { parsePlatformAccessProtection, parsePlatformAdmissionPolicy, parsePlatformLoginConfiguration, platformAuthenticationRecoveryMessage, validatePlatformAdmissionPolicy } from "@void/platform";
 import { createCipheriv, createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, randomUUID } from "node:crypto";
 import { setTimeout } from "node:timers/promises";

package/dist/{platform-cmd-PiNRkopU.mjs → platform-cmd-BYKLMPCn.mjs}

@@ -1 +1 @@
-export { t as discoverPlatform, r as runPlatformCommand } from "./platform-cmd-D5I1beUX.mjs";
+export { t as discoverPlatform, r as runPlatformCommand } from "./platform-cmd-HByuZAO7.mjs";

package/dist/{platform-cmd-D5I1beUX.mjs → platform-cmd-HByuZAO7.mjs}

@@ -96,19 +96,19 @@ async function runPlatformCommand(_root, args) {
 					}]
 				});
 				if (isCancel(group)) return;
-				const { parsePlatformArgs } = await import("./platform-args-kQrgxScY.mjs");
+				const { parsePlatformArgs } = await import("./platform-args-BC8_hsDj.mjs");
 				return runPlatformCommand(_root, parsePlatformArgs(["config", group]));
 			}
 			const { runPlatformPlansConfig } = await import("./platform-plans-config-CeydDSj0.mjs");
 			await runPlatformPlansConfig(args);
 			return;
 		}
-		const { runPlatformAuthConfig } = await import("./platform-auth-config-C-pm5Qzx.mjs");
+		const { runPlatformAuthConfig } = await import("./platform-auth-config-BgnuMbml.mjs");
 		await runPlatformAuthConfig(args);
 		return;
 	}
 	if (args.subcommand === "operator") {
-		const { runOperatorCommand } = await import("./operator-cmd-d2MvJOrl.mjs");
+		const { runOperatorCommand } = await import("./operator-cmd-DDiX7Y3f.mjs");
 		await runOperatorCommand(args);
 		return;
 	}
@@ -176,7 +176,7 @@ async function runPlatformCommand(_root, args) {
 		console.log(`Capabilities: ${Object.entries(discovery.capabilities).filter(([, enabled]) => enabled).map(([name]) => name).join(", ")}`);
 		return;
 	}
-	const { runPlatformLifecycleCommand } = await import("./platform-lifecycle-DH3Yr1qQ.mjs");
+	const { runPlatformLifecycleCommand } = await import("./platform-lifecycle-BRqcxerG.mjs");
 	await runPlatformLifecycleCommand(args);
 }
 function showSavedInstallationStatus(manifest) {

package/dist/{platform-domain-jpmBfZeb.mjs → platform-domain-DLSQ8GF8.mjs}

@@ -2,8 +2,8 @@ import { m as readInstallationRecoverySecrets, t as acquirePlatformLifecycleLock
 import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
 import { A as confirm, X as text, tt as isCancel } from "./dist-Cor9XGoz.mjs";
 import { m as printSuccess, p as note } from "./output-BpgYODYx.mjs";
-import { C as createPlatformHealthProbeToken, E as recordResource, H as resolvePlatformCloudflareCredential, O as recordPlatformWorkerTraffic, V as assertPlatformOperatorCredentialCanApplyPlan, Y as PlatformCloudflareClient, k as createPlatformInstallPlan, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, t as assertNoninteractivePlatformMutationAcknowledged } from "./platform-lifecycle-DyKmuNY6.mjs";
-import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest, o as resolveInstalledPlatformManifest } from "./platform-management--vDwSn35.mjs";
+import { C as createPlatformHealthProbeToken, E as recordResource, H as resolvePlatformCloudflareCredential, O as recordPlatformWorkerTraffic, V as assertPlatformOperatorCredentialCanApplyPlan, Y as PlatformCloudflareClient, k as createPlatformInstallPlan, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, t as assertNoninteractivePlatformMutationAcknowledged } from "./platform-lifecycle-3dwFJmnq.mjs";
+import { d as verifyPlatformInstallationOwnership, l as selectAuthoritativePlatformManifest, o as resolveInstalledPlatformManifest } from "./platform-management-ZZ6bQM5j.mjs";
 import { PLATFORM_HEALTH_HOSTNAME_LABEL, PLATFORM_REMOTE_INSTALLATION_MANIFEST_KEY, createApplicationRoutes, createPlatformDeploymentManifest, normalizeApplicationDomain } from "@void/platform";
 //#region src/cli/platform-domain.ts
 function platformDomainTarget(manifest, domain, zone, dedicatedZone) {

package/dist/{platform-lifecycle-DyKmuNY6.mjs → platform-lifecycle-3dwFJmnq.mjs}

@@ -6,8 +6,8 @@ import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
 import { A as confirm, H as outro, K as select, L as log, U as password, X as text$1, tt as isCancel, z as multiselect } from "./dist-Cor9XGoz.mjs";
 import { f as import_picocolors, l as formatUrl, m as printSuccess, n as cliCommandName, p as note, r as createSpinner, u as getErrorMessage } from "./output-BpgYODYx.mjs";
 import { l as resolveCloudflareOperationArgv } from "./cloudflare-process-8jEYIeim.mjs";
-import { o as createDefaultRunWrangler, v as resolvePinnedApiBaseUrl } from "./provision-DtROpNNI.mjs";
-import { t as parsePlatformArgs } from "./platform-args-DVbVClZl.mjs";
+import { o as createDefaultRunWrangler, v as resolvePinnedApiBaseUrl } from "./provision-B7UFrBH7.mjs";
+import { t as parsePlatformArgs } from "./platform-args-BMD2gjc_.mjs";
 import { o as runCloudflareAuthCommand } from "./cloudflare-auth-Byo_0_N9.mjs";
 import { a as platformManagementSetupPage, c as platformSetupLink, i as platformInstallCommandArguments, l as platformSetupPages, n as formatPlatformSetupPlan, o as platformPromptAnswer, r as openPlatformSetupPage, s as platformSetupFieldHelp, t as formatPlatformInstallCommand } from "./platform-setup-Ca53gtt0.mjs";
 import { copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
@@ -34,6 +34,14 @@ var PlatformCloudflareApiError = class extends Error {
 		this.requestPath = requestPath;
 	}
 };
+var PlatformCloudflarePrerequisiteError = class extends PlatformCloudflareApiError {
+	cause;
+	constructor(message, cause) {
+		super(message, cause.status, cause.requestPath);
+		this.name = "PlatformCloudflarePrerequisiteError";
+		this.cause = cause;
+	}
+};
 var PlatformWorkerCustomDomainsChangedError = class extends Error {
 	constructor(message, options) {
 		super(message, options);
@@ -165,7 +173,14 @@ var PlatformCloudflareClient = class PlatformCloudflareClient {
 		} catch {
 			throw new PlatformCloudflareApiError(`Cloudflare returned a non-JSON response (HTTP ${response.status}).`, response.status, path.split("?")[0]);
 		}
-		if (!response.ok || envelope.success !== true || envelope.result === void 0) throw new PlatformCloudflareApiError(`Cloudflare API error: ${cloudflareErrorDetails(envelope, response.status)} (HTTP ${response.status}; ${init?.method ?? "GET"} ${path.split("?")[0]}).`, response.status, path.split("?")[0]);
+		if (!response.ok || envelope.success !== true || envelope.result === void 0) {
+			const details = cloudflareErrorDetails(envelope, response.status);
+			const requestPath = path.split("?")[0];
+			const error = new PlatformCloudflareApiError(`Cloudflare API error: ${details} (HTTP ${response.status}; ${init?.method ?? "GET"} ${requestPath}).`, response.status, requestPath);
+			const prerequisite = cloudflarePrerequisiteHelp(envelope, response.status, requestPath);
+			if (prerequisite) throw new PlatformCloudflarePrerequisiteError(prerequisite, error);
+			throw error;
+		}
 		return {
 			result: envelope.result,
 			resultInfo: envelope.result_info
@@ -804,6 +819,13 @@ function deletionPath(kind, account, encoded, zoneId) {
 		default: return null;
 	}
 }
+function cloudflarePrerequisiteHelp(envelope, status, path) {
+	if (status !== 403) return;
+	const [, scope, accountId, service, resource] = path.split("/");
+	if (scope !== "accounts" || !accountId) return;
+	if (service === "r2" && envelope.errors?.some((error) => error.code === 10042)) return `Cloudflare R2 is not enabled for this account (code 10042). Complete R2 activation at ${formatUrl(`https://dash.cloudflare.com/${accountId}/r2/overview`)}, then retry the same command.`;
+	if (service === "workers" && resource === "dispatch" && envelope.errors?.some((error) => error.code === 10121)) return `Cloudflare Workers for Platforms requires a paid subscription for this account (code 10121). Enable it at ${formatUrl(`https://dash.cloudflare.com/${accountId}/workers-for-platforms`)}. Enterprise customers can contact their account team. Then retry the same command.`;
+}
 function cloudflareErrorDetails(envelope, status) {
 	return envelope.errors?.filter((error) => error.message).map((error) => error.code === void 0 ? error.message : `${error.message} (code ${error.code})`).join(", ") || `HTTP ${status}`;
 }
@@ -2488,19 +2510,27 @@ async function createPlatformInstallPlan(client, input, existing, options) {
 		}
 		throw error;
 	});
+	const prerequisites = [];
+	const collectPrerequisite = (error) => {
+		if (!(error instanceof PlatformCloudflarePrerequisiteError)) throw error;
+		prerequisites.push(error);
+		return [];
+	};
 	const [aiGateways, routingKv, isrKv, legacyKv, r2Buckets, usageQueues, cronQueues, deploymentQueues, dispatchNamespaces, hyperdrives, workers] = await Promise.all([
 		gatewayInventory,
 		client.listKvNamespaces(account.id, names.routingKv),
 		client.listKvNamespaces(account.id, names.isrCacheKv),
 		client.listKvNamespaces(account.id, names.legacyAssetsKv),
-		client.listR2Buckets(account.id),
+		client.listR2Buckets(account.id).catch(collectPrerequisite),
 		client.listQueues(account.id, names.usageQueue),
 		client.listQueues(account.id, names.cronQueue),
 		options?.deploymentExecution ?? existing?.resources.some((resource) => resource.key === "deployment-queue") ? client.listQueues(account.id, names.deploymentQueue) : Promise.resolve([]),
-		client.listDispatchNamespaces(account.id),
+		client.listDispatchNamespaces(account.id).catch(collectPrerequisite),
 		client.listHyperdriveConfigs(account.id),
 		client.listWorkerNames(account.id)
 	]);
+	if (prerequisites.length === 1) throw prerequisites[0];
+	if (prerequisites.length > 1) throw new AggregateError(prerequisites, `platform: Cloudflare account prerequisites are missing:\n\n${prerequisites.map((error) => error.message).join("\n\n")}`);
 	const dnsRecords = zone ? await listZoneDnsRecords(client, zone, wildcardHostname) : [];
 	const remoteOwnership = existing ? await readRemoteOwnership(client, account.id, routingKv, existing) : null;
 	const intentProofs = /* @__PURE__ */ new Set();
@@ -3739,7 +3769,7 @@ function uploadConflictMessage(result, operation) {
 	}
 	return `platform: The Cloudflare CLI did not ${operation}. It stopped the upload because of a conflict that it could not confirm without a terminal. Fix the conflict, then run the command again.`;
 }
-function assertCleanPlatformWrangler(result, operation) {
+function assertCleanPlatformWrangler(result, operation, accountId) {
 	if (result.status !== 0 || result.signal || result.error) {
 		const conflict = uploadConflictMessage(result, operation);
 		if (conflict) throw new Error(conflict);
@@ -3747,8 +3777,11 @@ function assertCleanPlatformWrangler(result, operation) {
 			...result,
 			stderr: result.stderr.trim() || result.errors?.map((error) => error.message).join("\n") || ""
 		});
-		const analyticsEngineDisabled = result.errorCode === ANALYTICS_ENGINE_NOT_ENABLED || result.errors?.some((error) => error.code === ANALYTICS_ENGINE_NOT_ENABLED) || /\b10089\b/.test(diagnostic ?? "");
-		throw new Error(`platform: Wrangler failed to ${operation} (${diagnostic || `exit ${result.status}`}).` + (analyticsEngineDisabled ? " If the Analytics Engine page offers no way to enable it, follow https://void.cloud/guide/platform/installation/prerequisites#if-cloudflare-rejects-analytics-engine, then retry." : ""));
+		if (result.errorCode === ANALYTICS_ENGINE_NOT_ENABLED || result.errors?.some((error) => error.code === ANALYTICS_ENGINE_NOT_ENABLED) || result.errorCode === void 0 && !result.errors?.some((error) => error.code !== void 0) && (diagnostic?.includes("[code: 10089]") || diagnostic?.includes("[10089]"))) {
+			const dashboard = accountId ? `https://dash.cloudflare.com/${accountId}/workers/analytics-engine` : "https://dash.cloudflare.com/";
+			throw new Error(`platform: Cloudflare could not ${operation}: Analytics Engine is not enabled for this account (code 10089). Open ${formatUrl(dashboard)}${accountId ? "" : ", select your account, and open Analytics Engine"}, then select Enable. Analytics Engine is available on Workers Free. After enabling it, use the printed recovery command if one is shown; otherwise retry this command. If Enable is unavailable, see ${formatUrl("https://void.cloud/guide/platform/installation/prerequisites#if-cloudflare-rejects-analytics-engine")}.`);
+		}
+		throw new Error(`platform: Cloudflare failed to ${operation} (${diagnostic || `exit ${result.status}`}).`);
 	}
 }
 function assertPlatformTriggerStabilization(result, workerName, targetVersionId, operation) {
@@ -3764,7 +3797,7 @@ async function readActivePlatformWorkerVersion(configPath, accountId, workerName
 		configPath,
 		workerName
 	}, accountId, process.cwd(), true);
-	if (result.status !== 0) assertCleanPlatformWrangler(result, `read active version for ${workerName}`);
+	if (result.status !== 0) assertCleanPlatformWrangler(result, `read active version for ${workerName}`, accountId);
 	const value = result.data;
 	if (!value || typeof value !== "object" || !Array.isArray(value.versions)) throw new Error(`platform: Wrangler returned malformed deployment status for ${workerName}.`);
 	const active = value.versions.filter((entry) => entry && typeof entry === "object" && Number(entry.percentage) === 100);
@@ -3807,7 +3840,7 @@ async function readPlatformWorkerDeployments(configPath, accountId, workerName,
 		configPath,
 		workerName
 	}, accountId, process.cwd(), true);
-	if (result.status !== 0) assertCleanPlatformWrangler(result, `read deployment lineage for ${workerName}`);
+	if (result.status !== 0) assertCleanPlatformWrangler(result, `read deployment lineage for ${workerName}`, accountId);
 	const value = result.data;
 	if (!Array.isArray(value)) throw new Error(`platform: Wrangler returned malformed deployment history for ${workerName}.`);
 	return value.map((entry, index) => {
@@ -3894,7 +3927,7 @@ async function readPlatformWorkerVersionSnapshot(configPath, accountId, workerNa
 		configPath,
 		workerName
 	}, accountId, process.cwd(), true);
-	assertCleanPlatformWrangler(result, `read rollback metadata for ${workerName}`);
+	assertCleanPlatformWrangler(result, `read rollback metadata for ${workerName}`, accountId);
 	const value = result.data;
 	if (!value || typeof value !== "object") throw new Error(`platform: Wrangler returned malformed version metadata for ${workerName}.`);
 	const resources = value.resources;
@@ -3957,6 +3990,9 @@ function recordWorkerSecretUpdateState(manifest, generation, state, intentId, co
 		resultHash: intentId
 	}, completedAt);
 }
+function workerCutoverUpdatesSecrets(manifest, generation) {
+	return manifest.steps.some((step) => step.key === `worker-secret-updates:${generation}:pending`);
+}
 function recordWorkerCutoverStage(manifest, generation, key, previousVersionId, stagedVersionId, workerName, previousTriggers, completedAt) {
 	return recordInstallationStep(manifest, {
 		completedAt,
@@ -4219,6 +4255,7 @@ async function recoverInterruptedPlatformWorkerCutover(input) {
 	const { interruptedCutover, configs, previousConfigs, plan, dependencies, ids, previousPublicEndpoints, hasEmailGatewayArtifact, runPinnedPlatformWrangler, now, writeRemoteInstallationCheckpoint, onManifestChange } = input;
 	let { manifest, workerActions } = input;
 	if (interruptedCutover) {
+		const retainUpdatedCredentials = workerCutoverUpdatesSecrets(manifest, interruptedCutover.generation);
 		for (const key of [
 			"dispatch",
 			"tail",
@@ -4236,7 +4273,20 @@ async function recoverInterruptedPlatformWorkerCutover(input) {
 				...previousConfigs[key],
 				name: snapshot.workerName
 			}, preservedRoutes);
-			if (dependencies.recoverWorkerCutover) await dependencies.recoverWorkerCutover({
+			if (retainUpdatedCredentials) {
+				const directory = mkdtempSync(join(tmpdir(), "void-platform-resume-"));
+				try {
+					const configPath = join(directory, "wrangler.json");
+					writeFileSync(configPath, JSON.stringify(recoveryConfig), { mode: 384 });
+					const currentVersionId = await readActivePlatformWorkerVersion(configPath, plan.account.id, snapshot.workerName, runPinnedPlatformWrangler);
+					if (currentVersionId !== snapshot.stagedVersionId && (snapshot.previousVersionId === null || currentVersionId !== snapshot.previousVersionId)) throw new Error(`Worker ${snapshot.workerName} changed concurrently after the credential update; refusing to overwrite it.`);
+				} finally {
+					rmSync(directory, {
+						force: true,
+						recursive: true
+					});
+				}
+			} else if (dependencies.recoverWorkerCutover) await dependencies.recoverWorkerCutover({
 				key,
 				preserveCustomDomains: interruptedCutover.unsafeTraffic.has(key),
 				previousVersionId: snapshot.previousVersionId,
@@ -4272,8 +4322,8 @@ async function recoverInterruptedPlatformWorkerCutover(input) {
 				});
 			}
 		}
-		manifest = recordWorkerCutoverResolution(manifest, interruptedCutover.generation, "restored", now());
-		manifest = recordWorkerTrafficState(manifest, interruptedCutover.generation, previousPublicEndpoints && interruptedCutover.unsafeTraffic.size === 0, now());
+		manifest = recordWorkerCutoverResolution(manifest, interruptedCutover.generation, retainUpdatedCredentials ? "committed" : "restored", now());
+		manifest = recordWorkerTrafficState(manifest, interruptedCutover.generation, !retainUpdatedCredentials && previousPublicEndpoints && interruptedCutover.unsafeTraffic.size === 0, now());
 		onManifestChange(manifest);
 		writeInstallationManifest(manifest);
 		await writeRemoteInstallationCheckpoint(dependencies.client, plan, manifest);
@@ -4555,7 +4605,7 @@ async function deployPlatformWorker(config, secrets, options) {
 		let uploadError;
 		try {
 			uploaded = options.workerExisted ? await options.runner(operation, accountId, directory, true) : await runPlatformWranglerForConditionalCreate(operation, accountId, directory, true, workerName, options.apiBaseUrl, options.operatorApiToken);
-			assertCleanPlatformWrangler(uploaded, `${options.workerExisted ? "upload" : "bootstrap"} ${workerName}`);
+			assertCleanPlatformWrangler(uploaded, `${options.workerExisted ? "upload" : "bootstrap"} ${workerName}`, accountId);
 		} catch (error) {
 			uploadError = error;
 			throw error;
@@ -4581,7 +4631,7 @@ async function deployPlatformWorker(config, secrets, options) {
 					percentage: 100
 				}],
 				message: `Void platform activation ${uploadedVersionId}`
-			}, accountId, directory, true), `activate ${workerName}`);
+			}, accountId, directory, true), `activate ${workerName}`, accountId);
 		}
 		const deploymentsAfterActivation = await readPlatformWorkerDeployments(configPath, accountId, workerName, readRunner);
 		const lineage = classifyPlatformWorkerDeploymentLineage(deploymentsAfterActivation, uploadedVersionId, previousDeploymentId);
@@ -4808,7 +4858,7 @@ async function restorePlatformWorkerDeployment(input) {
 			percentage: version.percentage
 		})),
 		message: `Void platform restoration ${input.restoration.id}`
-	}, input.accountId, input.directory, true), `restore deployment ${input.restoration.id}`);
+	}, input.accountId, input.directory, true), `restore deployment ${input.restoration.id}`, input.accountId);
 	const after = await readPlatformWorkerDeployments(input.configPath, input.accountId, input.workerName, input.runner);
 	if (!samePlatformWorkerTraffic(after[0], input.restoration) || after[1]?.id !== input.expectedActiveDeploymentId) throw new Error(`Worker ${input.workerName} deployment restoration was superseded or did not restore deployment ${input.restoration.id}.`);
 }
@@ -5032,14 +5082,21 @@ async function platformProbeFailure(label, url, response, context) {
 	return new Error(message);
 }
 async function verifyPlatformHealth(apiUrl, installationId, proxyUrl, applicationBaseDomain, platformVersion, usageProtocolVersion, healthProbeToken, fetcher = fetch, dispatchOrigin, context) {
-	const request = (url) => fetcher(url, {
-		headers: {
-			"X-Void-Platform-Probe": healthProbeToken,
-			...cfAccessHeaders(process.env, url)
-		},
-		redirect: "manual",
-		signal: AbortSignal.timeout(3e4)
-	});
+	const request = async (url) => {
+		for (let attempt = 0;; attempt++) try {
+			return await fetcher(url, {
+				headers: {
+					"X-Void-Platform-Probe": healthProbeToken,
+					...cfAccessHeaders(process.env, url)
+				},
+				redirect: "manual",
+				signal: AbortSignal.timeout(3e4)
+			});
+		} catch (error) {
+			if (attempt === 2) throw new Error(`platform: Health check could not reach ${url} after 3 attempts.`, { cause: error });
+			await setTimeout$1(250 * (attempt + 1));
+		}
+	};
 	const dispatchUrl = dispatchOrigin ?? `https://${PLATFORM_HEALTH_HOSTNAME_LABEL}.${applicationBaseDomain}`;
 	const [health, discovery, proxy, dispatch, emailGateway] = await Promise.all([
 		request(`${apiUrl}/health`),
@@ -5459,7 +5516,7 @@ async function verifyInstalledPlatformAccessProtection(input) {
 	}
 	const existingWorkers = input.plan.actions.filter((action) => action.kind === "worker" && action.action === "update").map((action) => action.name);
 	if (existingWorkers.length) {
-		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-SHhvim1L.mjs");
+		const { verifyProtectionWorkerOrigins } = await import("./platform-auth-protection-NjRejttU.mjs");
 		await verifyProtectionWorkerOrigins({
 			request: input.client.request.bind(input.client),
 			listWorkerDomains: input.client.listWorkerDomains.bind(input.client),
@@ -6577,7 +6634,7 @@ async function recoverFailedPlatformInstallation(error, state) {
 	} catch (guardError) {
 		failure = new Error(`platform: ${getErrorMessage(error)} The installation also failed to retain its routing safety gate: ${getErrorMessage(guardError)}`, { cause: error });
 	}
-	if (!workerDeploymentCommitted && workerRollbacks.length > 0 && !(authenticationEnforcementActive && authenticationProtocolTransition)) {
+	if (!workerDeploymentCommitted && workerRollbacks.length > 0 && !state.workerSecretUpdateIntent && !(authenticationEnforcementActive && authenticationProtocolTransition)) {
 		const rollbackFailures = [];
 		for (const rollback of workerRollbacks.reverse()) try {
 			await rollback();
@@ -6689,9 +6746,9 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 	const hasExplicitWorkerSecretUpdates = Object.keys(explicitWorkerSecretUpdates).length > 0;
 	const resumedWorkerSecretUpdateIntent = secrets.pendingWorkerSecretUpdateIntent && platformWorkerSecretUpdateIntentState(manifest, secrets.pendingWorkerSecretUpdateIntent) === "active" ? secrets.pendingWorkerSecretUpdateIntent : null;
 	const workerSecretUpdateIntent = hasExplicitWorkerSecretUpdates ? {
-		baselineGeneration: latestPlatformWorkerCutoverGeneration(manifest),
-		generation: null,
-		id: randomUUID(),
+		baselineGeneration: resumedWorkerSecretUpdateIntent?.baselineGeneration ?? latestPlatformWorkerCutoverGeneration(manifest),
+		generation: resumedWorkerSecretUpdateIntent?.generation ?? null,
+		id: resumedWorkerSecretUpdateIntent?.id ?? randomUUID(),
 		schema: 1,
 		updates: {
 			...resumedWorkerSecretUpdateIntent?.updates,
@@ -6830,7 +6887,7 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		const createsWorker = state.plan.actions.some((action) => action.kind === "worker" && action.action === "create" && (hasEmailGatewayArtifact || action.key !== "email-gateway-worker"));
 		const recoveringCreatedWorker = interruptedCutover !== null && [...interruptedCutover.staged.values()].some((snapshot) => snapshot.previousVersionId === null);
 		const requiresSandboxDrain = !preserveDisabled && targetSandboxDrainProtocol >= 1 && sandboxDrainState === "pending";
-		const requiresTrafficGuard = !previousPublicEndpoints || recoveringUnsafeTraffic || createsWorker || recoveringCreatedWorker || state.manifest.usageProtocolVersion !== targetUsageProtocolVersion || runtime.privatePreviews === 1 && !state.manifest.steps.some((step) => step.key === "private-previews-initialized:v1") || authenticationProtocolTransition || shouldBootstrapSharedEmail || requiresSandboxDrain || !!state.plan.deployment.appAccess && !state.manifest.steps.some((step) => step.key === "app-access-initialized:v1");
+		const requiresTrafficGuard = !previousPublicEndpoints || hadPriorWorkers && !!state.workerSecretUpdateIntent || !!interruptedCutover && workerCutoverUpdatesSecrets(state.manifest, interruptedCutover.generation) || recoveringUnsafeTraffic || createsWorker || recoveringCreatedWorker || state.manifest.usageProtocolVersion !== targetUsageProtocolVersion || runtime.privatePreviews === 1 && !state.manifest.steps.some((step) => step.key === "private-previews-initialized:v1") || authenticationProtocolTransition || shouldBootstrapSharedEmail || requiresSandboxDrain || !!state.plan.deployment.appAccess && !state.manifest.steps.some((step) => step.key === "app-access-initialized:v1");
 		const configInput = {
 			authenticationDatabaseUncached: true,
 			proxyHealthBinding: true,
@@ -6916,6 +6973,11 @@ async function installPlatform(plan, secrets, existing, dependencies) {
 		}));
 		state.workerCutoverGeneration = nextWorkerCutoverGeneration(state.manifest);
 		if (state.workerSecretUpdateIntent) {
+			state.workerSecretUpdateIntent = {
+				...state.workerSecretUpdateIntent,
+				generation: null
+			};
+			writePendingInstallationSecrets(state.manifest, secretCheckpoint(state.secrets, state.workerSecretUpdateIntent));
 			state.manifest = recordWorkerSecretUpdateState(state.manifest, state.workerCutoverGeneration, "pending", state.workerSecretUpdateIntent.id, now());
 			writeInstallationManifest(state.manifest);
 			await writeRemoteInstallationCheckpoint(dependencies.client, state.plan, state.manifest);
@@ -7535,13 +7597,13 @@ function needsReviewUpload(change) {
 * The earlier version of each Worker that the installer makes active again
 * before it deploys. A run that stopped during a Worker cutover left Void's
 * version active, and the next run first restores the earlier one. Like the
-* installer, keep Void's version while the platform changes to configurable
-* sign-in and already requires sign-in. Every Worker that this check reads
-* exists, so the installation had Workers before.
+* installer, retain rotated credentials or a configurable sign-in transition
+* that already requires sign-in. Every Worker that this check reads exists,
+* so the installation had Workers before.
 */
 async function restoredPlatformWorkerVersions(installation, runtime) {
 	const cutover = interruptedWorkerCutover(installation.manifest);
-	if (!cutover || installation.manifest.deployment.authentication.configurable !== true && runtime.manifest.authenticationProtocolVersion === 1 && (await installation.readAuthenticationState?.())?.sessionsRequired === true) return /* @__PURE__ */ new Map();
+	if (!cutover || workerCutoverUpdatesSecrets(installation.manifest, cutover.generation) || installation.manifest.deployment.authentication.configurable !== true && runtime.manifest.authenticationProtocolVersion === 1 && (await installation.readAuthenticationState?.())?.sessionsRequired === true) return /* @__PURE__ */ new Map();
 	return new Map([...cutover.staged.values()].flatMap((snapshot) => snapshot.previousVersionId === null ? [] : [[snapshot.workerName, snapshot.previousVersionId]]));
 }
 /** Find the existing platform Workers that a run uploads and that were changed outside Void. */
@@ -7776,14 +7838,14 @@ function resolvePlatformInstallDatabaseUrl(checkpoint, manifest = null) {
 }
 async function runPlatformLifecycleCommand(commandArgs) {
 	if (commandArgs.subcommand === "domain") {
-		const { runPlatformDomainCommand } = await import("./platform-domain-jpmBfZeb.mjs");
+		const { runPlatformDomainCommand } = await import("./platform-domain-DLSQ8GF8.mjs");
 		await runPlatformDomainCommand(commandArgs);
 		return;
 	}
 	if (commandArgs.subcommand === "discover") {
 		const client = new PlatformCloudflareClient((await resolvePlatformCloudflareCredential()).token);
 		const accountId = await selectAccount(await readAccounts(client), commandArgs.account);
-		const { recoverPlatformInstallations } = await import("./platform-recovery-BiNpZZab.mjs");
+		const { recoverPlatformInstallations } = await import("./platform-recovery-8vNE5dNN.mjs");
 		const recovered = await recoverPlatformInstallations(client, accountId, void 0, commandArgs.selector);
 		if (recovered.length === 0) {
 			log.info(`No recoverable Void platform installations were found in ${accountId}.`);
@@ -7794,7 +7856,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 		return;
 	}
 	if (commandArgs.subcommand !== "install") {
-		const { runInstalledPlatformCommand } = await import("./platform-management-7m-PLaPJ.mjs");
+		const { runInstalledPlatformCommand } = await import("./platform-management-ZK6XcbCo.mjs");
 		await runInstalledPlatformCommand(commandArgs);
 		return;
 	}
@@ -7970,7 +8032,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			progress?.stop("Read the saved installation.");
 			progress = void 0;
 			if (authoritative) {
-				const { selectAuthoritativePlatformManifest } = await import("./platform-management-7m-PLaPJ.mjs");
+				const { selectAuthoritativePlatformManifest } = await import("./platform-management-ZK6XcbCo.mjs");
 				const selected = selectAuthoritativePlatformManifest(existing, authoritative);
 				authoritativeProvisionIntents = true;
 				if (!args.plan && JSON.stringify(selected) !== JSON.stringify(existing)) writeInstallationManifest(selected);
@@ -8410,7 +8472,7 @@ async function runPlatformLifecycleCommand(commandArgs) {
 			})).actions.filter((action) => action.kind === "worker"),
 			revalidateBeforeWorkerDeploy: (manifest, action) => revalidatePlatformInstallAction(client, plan, manifest, action),
 			verifyExistingOwnership: async (manifest, databaseCheckpointExists) => {
-				const { verifyPlatformInstallationOwnership } = await import("./platform-management-7m-PLaPJ.mjs");
+				const { verifyPlatformInstallationOwnership } = await import("./platform-management-ZK6XcbCo.mjs");
 				const retainedReplacementKeys = new Set(plan.actions.filter((action) => {
 					const previous = manifest.resources.find((resource) => resource.key === action.key);
 					return action.action === "create" && previous && previous.name !== action.name;

package/dist/{platform-lifecycle-DH3Yr1qQ.mjs → platform-lifecycle-BRqcxerG.mjs}

@@ -1 +1 @@
-export { r as runPlatformLifecycleCommand } from "./platform-lifecycle-DyKmuNY6.mjs";
+export { r as runPlatformLifecycleCommand } from "./platform-lifecycle-3dwFJmnq.mjs";

package/dist/{platform-management-7m-PLaPJ.mjs → platform-management-ZK6XcbCo.mjs}

@@ -1 +1 @@
-export { c as runInstalledPlatformCommand, l as selectAuthoritativePlatformManifest, d as verifyPlatformInstallationOwnership } from "./platform-management--vDwSn35.mjs";
+export { c as runInstalledPlatformCommand, l as selectAuthoritativePlatformManifest, d as verifyPlatformInstallationOwnership } from "./platform-management-ZZ6bQM5j.mjs";

package/dist/{platform-management--vDwSn35.mjs → platform-management-ZZ6bQM5j.mjs}

@@ -2,7 +2,7 @@ import { S as writePendingInstallationSecrets, _ as removePlatformConnectionForI
 import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
 import { A as confirm, H as outro, K as select, L as log, tt as isCancel } from "./dist-Cor9XGoz.mjs";
 import { f as import_picocolors, l as formatUrl, m as printSuccess, p as note, r as createSpinner } from "./output-BpgYODYx.mjs";
-import { $ as hyperdriveOriginMatches, A as dnsRecordConfigHash, B as turnOffInstalledProjectZeroTrust, C as createPlatformHealthProbeToken, D as platformTrafficAttachmentWorker, F as platformAdoptionIntentHash, H as resolvePlatformCloudflareCredential, I as r2BucketConfigHash, J as PlatformCloudflareApiError, L as resourceMarkerProblem, M as hasProvisionIntentStep, N as legacyResourceConfigHash, P as matchesRecordedR2Fingerprint, Q as hyperdriveOriginFromConnectionString, R as revalidatePlatformInstallAction, S as loadPlatformRuntime, T as resolveBootstrapGitHubId, U as verifyPlatformCloudflareCredential, V as assertPlatformOperatorCredentialCanApplyPlan, W as activatePlatformAccessCredentials, X as PlatformRuntimeTokenEmailPermissionError, Y as PlatformCloudflareClient, Z as hyperdriveOriginConfigHash, _ as readPlatformProjectSlugs, a as findPlatformWorkerOutsideChanges, b as formatZeroTrustApplications, c as uploadPlatformWorkerOutsideChanges, d as replacePendingInstallationAuthentication, et as verifyPlatformRuntimeTokenEmailPermissions, f as REMOTE_INSTALLATION_MANIFEST_KEY, j as formatPlatformInstallPlan, k as createPlatformInstallPlan, l as authenticationSetupRequestHash, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, o as formatPlatformWorkerOutsideChanges, p as installPlatform, s as reviewPlatformWorkerOutsideChanges, t as assertNoninteractivePlatformMutationAcknowledged, tt as verifyPlatformRuntimeTokenPermissions, u as readLoginReplacementFile, v as readPlatformProjectZeroTrustState, w as createPlatformInstallationSecrets, x as readPlatformDatabase, y as assertProjectZeroTrustAllowsUninstall, z as platformDatabaseNameFromOwnerUrl } from "./platform-lifecycle-DyKmuNY6.mjs";
+import { $ as hyperdriveOriginMatches, A as dnsRecordConfigHash, B as turnOffInstalledProjectZeroTrust, C as createPlatformHealthProbeToken, D as platformTrafficAttachmentWorker, F as platformAdoptionIntentHash, H as resolvePlatformCloudflareCredential, I as r2BucketConfigHash, J as PlatformCloudflareApiError, L as resourceMarkerProblem, M as hasProvisionIntentStep, N as legacyResourceConfigHash, P as matchesRecordedR2Fingerprint, Q as hyperdriveOriginFromConnectionString, R as revalidatePlatformInstallAction, S as loadPlatformRuntime, T as resolveBootstrapGitHubId, U as verifyPlatformCloudflareCredential, V as assertPlatformOperatorCredentialCanApplyPlan, W as activatePlatformAccessCredentials, X as PlatformRuntimeTokenEmailPermissionError, Y as PlatformCloudflareClient, Z as hyperdriveOriginConfigHash, _ as readPlatformProjectSlugs, a as findPlatformWorkerOutsideChanges, b as formatZeroTrustApplications, c as uploadPlatformWorkerOutsideChanges, d as replacePendingInstallationAuthentication, et as verifyPlatformRuntimeTokenEmailPermissions, f as REMOTE_INSTALLATION_MANIFEST_KEY, j as formatPlatformInstallPlan, k as createPlatformInstallPlan, l as authenticationSetupRequestHash, m as acquirePlatformDatabaseLifecycleLock, n as resolvePlatformInstallDatabaseUrl, o as formatPlatformWorkerOutsideChanges, p as installPlatform, s as reviewPlatformWorkerOutsideChanges, t as assertNoninteractivePlatformMutationAcknowledged, tt as verifyPlatformRuntimeTokenPermissions, u as readLoginReplacementFile, v as readPlatformProjectZeroTrustState, w as createPlatformInstallationSecrets, x as readPlatformDatabase, y as assertProjectZeroTrustAllowsUninstall, z as platformDatabaseNameFromOwnerUrl } from "./platform-lifecycle-3dwFJmnq.mjs";
 import { PLATFORM_DISABLED_KEY, PLATFORM_DISABLED_VALUE, PLATFORM_R2_OWNERSHIP_MARKER_KEY, parsePlatformInstallationManifest, recordInstallationResource, recordInstallationStep, setInstallationDesiredState, transitionInstallation } from "@void/platform";
 import { setTimeout } from "node:timers/promises";
 //#region src/cli/platform-teardown.ts

package/dist/{platform-recovery-BiNpZZab.mjs → platform-recovery-8vNE5dNN.mjs}

@@ -1,7 +1,7 @@
 import { o as listInstallationManifests, t as acquirePlatformLifecycleLock, x as writeInstallationManifest, y as savePlatformConnection } from "./platform-registry-B9mWX9LO.mjs";
 import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
-import { f as REMOTE_INSTALLATION_MANIFEST_KEY, k as createPlatformInstallPlan } from "./platform-lifecycle-DyKmuNY6.mjs";
-import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management--vDwSn35.mjs";
+import { f as REMOTE_INSTALLATION_MANIFEST_KEY, k as createPlatformInstallPlan } from "./platform-lifecycle-3dwFJmnq.mjs";
+import { a as recoverDurablyMarkedProvisionIntents, d as verifyPlatformInstallationOwnership, r as isPlatformManifestMonotonicExtension } from "./platform-management-ZZ6bQM5j.mjs";
 import { parsePlatformInstallationManifest, setInstallationEndpoints } from "@void/platform";
 //#region src/cli/platform-recovery.ts
 async function recoverPlatformInstallations(client, accountId, verifyEndpoint = verifyInstallationEndpoint, selector = "") {

package/dist/{plugin-inference-DUjCd55H.mjs → plugin-inference-CeiB6BG5.mjs}

@@ -1,10 +1,10 @@
 import { a as join, l as toSlash, s as relative } from "./dist-ipQi0Q8y.mjs";
 import { n as readProjectPaths } from "./project-paths-DGu_QZ_Q.mjs";
 import { n as globSync } from "./dist-D15hFhP0.mjs";
+import { d as deriveFromSource, g as ROUTE_EXTENSIONS, h as parseWebSocketFilename, m as parseRouteFilename, p as isRouteEnabledForEnvironment, t as pageFileEnvironment } from "./scan-N9WzdcAl.mjs";
 import { a as isObjectExpression, i as isMemberExpression, n as isIdentifier, r as isLiteral, t as isCallExpression } from "./ast-CsZ_q_gc.mjs";
 import { a as staticLiteral, n as bindingResolver, o as unwrapStaticExpression, r as walk } from "./ast-bindings-C3yaPs1y.mjs";
 import { n as resourceNameWords, t as isResourceName } from "./resource-name-C7LVpcRm.mjs";
-import { n as parseRouteFilename, r as parseWebSocketFilename, t as isRouteEnabledForEnvironment } from "./parse-filename-DioPHiR9.mjs";
 import { r as getSsrServerEntryPath } from "./entry-BEM8ZuGP.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { parseSync } from "vite";
@@ -30,9 +30,38 @@ function needsApplicationDatabase(bindings, migrationCount) {
 }
 //#endregion
 //#region src/shared/convention-files.ts
+const WELL_KNOWN_DIR = ".well-known";
+/** Include the convention directory's .well-known files when it is inside the scan directory. */
+function conventionFileGlobs(scanDir, pattern, conventionDir = scanDir) {
+	const patterns = [pattern];
+	const conventionRelative = relative(scanDir, conventionDir);
+	if (conventionRelative !== ".." && !conventionRelative.startsWith("../")) patterns.push(join(conventionRelative, WELL_KNOWN_DIR, pattern));
+	return patterns;
+}
+function isConventionPath(filePath) {
+	return filePath.replace(/\\/g, "/").split("/").every((segment, index) => !segment.startsWith("_") && (!segment.startsWith(".") || index === 0 && segment === WELL_KNOWN_DIR));
+}
+/** Whether a path relative to routes/ participates in HTTP or WebSocket routing. */
+function isRouteFile(filePath) {
+	return isConventionPath(filePath) && ROUTE_EXTENSIONS.some((ext) => filePath.endsWith(`.${ext}`));
+}
 /** Handler files under `dir`, relative to it, skipping paths with a `_`-prefixed segment. */
+function listFilesWithExtensions(dir, extensions) {
+	const suffix = `*.{${extensions.join(",")}}`;
+	return globSync(conventionFileGlobs(dir, `**/${suffix}`), { cwd: dir }).filter(isConventionPath);
+}
+/** Cron and queue handlers with .ts, .mts, .js, or .mjs extensions. */
 function listConventionFiles(dir) {
-	return globSync(["**/*.{ts,mts,js,mjs}", ".well-known/**/*.{ts,mts,js,mjs}"], { cwd: dir }).filter((filePath) => !filePath.split("/").some((segment) => segment.startsWith("_")));
+	return listFilesWithExtensions(dir, [
+		"ts",
+		"mts",
+		"js",
+		"mjs"
+	]);
+}
+/** HTTP and WebSocket handlers, also allowing .tsx and .jsx for JSX. */
+function listRouteFiles(dir) {
+	return listFilesWithExtensions(dir, ROUTE_EXTENSIONS);
 }
 //#endregion
 //#region src/shared/resource-definition.ts
@@ -409,7 +438,7 @@ function mergeBindings(bindings) {
 }
 //#endregion
 //#region src/router/websocket.ts
-const WEBSOCKET_ROUTE_RE = /(?:\.(?:dev|prod))?\.ws\.(?:ts|mts|js|mjs)$/;
+const WEBSOCKET_ROUTE_RE = new RegExp(`(?:\\.(?:dev|prod))?\\.ws\\.(?:${ROUTE_EXTENSIONS.join("|")})$`);
 function isWebSocketRouteFile(filePath) {
 	return WEBSOCKET_ROUTE_RE.test(filePath.replace(/\\/g, "/"));
 }
@@ -420,7 +449,10 @@ function deriveWebSocketClassNameFromName(name) {
 	return resourceNameWords(name).map((part) => part[0].toUpperCase() + part.slice(1)).join("") + "Ws";
 }
 function inferWebSocketResourceName(filePath) {
-	const parts = filePath.replace(/\\/g, "/").replace(/\.(ts|mts|js|mjs)$/, "").split("/").filter((segment) => segment.length > 0 && !(segment.startsWith("(") && segment.endsWith(")"))).flatMap(identifierWords);
+	let normalized = filePath.replace(/\\/g, "/");
+	const extension = ROUTE_EXTENSIONS.find((ext) => normalized.endsWith(`.${ext}`));
+	if (extension) normalized = normalized.slice(0, -(extension.length + 1));
+	const parts = normalized.split("/").filter((segment) => segment.length > 0 && !(segment.startsWith("(") && segment.endsWith(")"))).flatMap(identifierWords);
 	return parts.length > 0 ? parts.join("-") : "WebSocket";
 }
 function deriveWebSocketClassName(filePath) {
@@ -471,7 +503,7 @@ function parseWebSocketFiles(root, files, paths = readProjectPaths(root), enviro
 	return routes;
 }
 function scanWebSocketRoutesSync(root, paths = readProjectPaths(root), environment) {
-	return parseWebSocketFiles(root, listConventionFiles(paths.routesDir), paths, environment);
+	return parseWebSocketFiles(root, listRouteFiles(paths.routesDir), paths, environment);
 }
 function isWebSocketPatternFile(filePath) {
 	return isWebSocketRouteFile(filePath);
@@ -589,26 +621,32 @@ function inferProjectBindings(root, options, scanDirs) {
 	const allBindings = [];
 	const scannedFiles = /* @__PURE__ */ new Set();
 	const routesPrefix = `${toSlash(paths.routesDir).replace(/\/$/, "")}/`;
+	const pagesDir = toSlash(paths.pagesDir);
+	const pagesPrefix = pagesDir.endsWith("/") ? pagesDir : `${pagesDir}/`;
+	const scanSourceFiles = (dirPath) => globSync(conventionFileGlobs(dirPath, SOURCE_GLOB, paths.routesDir), {
+		cwd: dirPath,
+		absolute: true
+	});
 	const addFile = (file) => {
 		const normalizedFile = toSlash(file);
 		if (scannedFiles.has(normalizedFile)) return;
 		scannedFiles.add(normalizedFile);
-		if (options?.environment && normalizedFile.startsWith(routesPrefix) && /\.(?:ts|mts|js|mjs)$/.test(normalizedFile)) {
-			const routePath = relative(paths.routesDir, normalizedFile);
+		const routePath = normalizedFile.startsWith(routesPrefix) ? normalizedFile.slice(routesPrefix.length) : void 0;
+		if (options?.environment && routePath !== void 0 && isRouteFile(routePath)) {
 			const route = isWebSocketPatternFile(routePath) ? parseWebSocketFilename(routePath) : parseRouteFilename(routePath);
 			if (!isRouteEnabledForEnvironment(route, options.environment)) return;
 		}
-		const code = readFileSync(file, "utf-8");
-		allBindings.push(inferBindingsFromFile(file, code));
+		if (options?.environment && options.filterPages && normalizedFile.startsWith(pagesPrefix)) {
+			const env = pageFileEnvironment(normalizedFile.slice(pagesPrefix.length));
+			if (!isRouteEnabledForEnvironment({ env }, options.environment)) return;
+		}
+		allBindings.push(deriveFromSource(file, "bindings", (code) => inferBindingsFromFile(file, code)));
 	};
 	for (const dir of dirs) {
 		const dirPath = join(root, dir);
 		let files;
 		try {
-			files = globSync(SOURCE_GLOB, {
-				cwd: dirPath,
-				absolute: true
-			});
+			files = scanSourceFiles(dirPath);
 		} catch {
 			continue;
 		}
@@ -622,10 +660,7 @@ function inferProjectBindings(root, options, scanDirs) {
 		const srcPath = paths.sourceDir ? paths.sourceRoot : join(root, "src");
 		let srcFiles;
 		try {
-			srcFiles = globSync(SOURCE_GLOB, {
-				cwd: srcPath,
-				absolute: true
-			});
+			srcFiles = scanSourceFiles(srcPath);
 		} catch {
 			srcFiles = [];
 		}
@@ -634,4 +669,4 @@ function inferProjectBindings(root, options, scanDirs) {
 	return applyBindingOverrides(mergeBindings(allBindings), options?.bindings);
 }
 //#endregion
-export { deriveWebSocketClassNameFromName as a, scanWebSocketRoutesSync as c, readResourceDefinition as d, listConventionFiles as f, inferProjectBindings as i, inferBindingsFromSource as l, needsApplicationDatabase as m, FRAMEWORK_SCAN_DIRS as n, inferWebSocketResourceName as o, applyBindingOverrides as p, detectFramework as r, isWebSocketPatternFile as s, DEFAULT_SCAN_DIRS as t, staticModuleReferences as u };
+export { deriveWebSocketClassNameFromName as a, scanWebSocketRoutesSync as c, readResourceDefinition as d, listConventionFiles as f, needsApplicationDatabase as h, inferProjectBindings as i, inferBindingsFromSource as l, applyBindingOverrides as m, FRAMEWORK_SCAN_DIRS as n, inferWebSocketResourceName as o, listRouteFiles as p, detectFramework as r, isWebSocketPatternFile as s, DEFAULT_SCAN_DIRS as t, staticModuleReferences as u };

package/dist/{prepare-BcAE5Sdj.mjs → prepare-5BR7Splm.mjs}

@@ -1,6 +1,6 @@
 import { L as log } from "./dist-Cor9XGoz.mjs";
 import { m as printSuccess, p as note } from "./output-BpgYODYx.mjs";
-import { t as prepareProject } from "./prepare-DA-17DhO.mjs";
+import { t as prepareProject } from "./prepare-Dseww74N.mjs";
 //#region src/cli/prepare.ts
 async function runPrepareCommand(root) {
 	console.log();

package/dist/prepare-B3VrSF1Z.mjs

@@ -0,0 +1 @@
+export { t as prepareProject } from "./prepare-Dseww74N.mjs";