void 0.10.1 → 0.10.2

package/dist/{auth-cmd-DBnbrX9Y.mjs → auth-cmd-DLvXvN-0.mjs}

@@ -1,6 +1,6 @@
-import { d as getToken, h as removeToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
+import { f as getToken, g as removeToken, n as PlatformClient } from "./client-CTHvucDv.mjs";
 import { c as R } from "./dist-abzUneor.mjs";
-import { n as runLoginCommand } from "./login-Ca6mhQVI.mjs";
+import { n as runLoginCommand } from "./login-v4wle1vn.mjs";
 import { execSync } from "node:child_process";
 //#region src/cli/auth-cmd.ts
 async function runAuthCommand(root, args) {

package/dist/{cache-DNX0hLsO.mjs → cache-CHFZmqa5.mjs}

@@ -1,5 +1,5 @@
 import { i as dim, n as cliTitle, r as createSpinner } from "./output-DeiS4oEX.mjs";
-import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
+import { f as getToken, n as PlatformClient } from "./client-CTHvucDv.mjs";
 import { c as R, g as ge, y as ye } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-D4O1_fZz.mjs";

package/dist/{cancel-deploy-CDzkVaYZ.mjs → cancel-deploy-BwpT4U4a.mjs}

@@ -1,5 +1,5 @@
 import { n as cliTitle } from "./output-DeiS4oEX.mjs";
-import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
+import { f as getToken, n as PlatformClient } from "./client-CTHvucDv.mjs";
 import { c as R, g as ge, v as ue, x as q, y as ye } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 //#region src/cli/cancel-deploy.ts

package/dist/cli/cli.mjs

@@ -590,6 +590,11 @@ const githubSubcommands = [
 		arg: "[project]",
 		description: "Connect a repository to a project for auto-deploy"
 	},
+	{
+		name: "update",
+		arg: "[project]",
+		description: "Update an existing connection's branch or build executor"
+	},
 	{
 		name: "link",
 		description: "Link your GitHub account to Void"
@@ -657,7 +662,41 @@ function parseGithubArgs(args) {
 			executor
 		};
 	}
-	throw new Error("github: Usage: void github <install|installations|connect|link>.");
+	if (subcommand === "update") {
+		let projectName = "";
+		let branch;
+		let executor;
+		for (let i = 0; i < rest.length; i++) {
+			const arg = rest[i];
+			if (arg === "--branch") {
+				if (i + 1 >= rest.length) throw new Error("github: --branch requires a value.");
+				const value = rest[++i];
+				if (value.trim() === "") throw new Error("github: --branch requires a value.");
+				branch = value.trim();
+			} else if (arg === "--project") {
+				if (i + 1 >= rest.length) throw new Error("github: --project requires a value.");
+				const value = rest[++i];
+				if (value.trim() === "") throw new Error("github: --project requires a value.");
+				if (projectName) throw new Error(`github: Unexpected argument '${value}'.`);
+				projectName = value;
+			} else if (arg === "--executor") {
+				if (i + 1 >= rest.length) throw new Error("github: --executor requires a value.");
+				const value = rest[++i];
+				if (value.trim() === "") throw new Error("github: --executor requires a value.");
+				if (value !== "container" && value !== "github_actions") throw new Error("github: invalid --executor (expected container|github_actions).");
+				executor = value;
+			} else if (arg.startsWith("-")) throw new Error(`github: Unexpected argument '${arg}'.`);
+			else if (projectName) throw new Error(`github: Unexpected argument '${arg}'.`);
+			else projectName = arg;
+		}
+		return {
+			subcommand,
+			projectName,
+			branch,
+			executor
+		};
+	}
+	throw new Error("github: Usage: void github <install|installations|connect|update|link>.");
 }
 //#endregion
 //#region src/cli/ascii.ts
@@ -967,6 +1006,10 @@ const HELP_TREE = {
 				command: "connect [project]",
 				description: "Connect a repository to a project for auto-deploy"
 			},
+			{
+				command: "update [project]",
+				description: "Update an existing connection's branch or build executor"
+			},
 			{
 				command: "link",
 				description: "Link your GitHub account to Void"
@@ -1008,6 +1051,31 @@ const HELP_TREE = {
 					command: "void github connect my-app --installation 42 --repo owner/repo --branch main",
 					description: "Non-interactive connect (all flags explicit)"
 				}]
+			},
+			update: {
+				summary: "Update an existing connection's branch or build executor.",
+				usage: ["void github update [project] [options]"],
+				options: [
+					{
+						command: "--project <name>",
+						description: "Project name (alias for positional)"
+					},
+					{
+						command: "--branch <name>",
+						description: "New branch to deploy from"
+					},
+					{
+						command: "--executor <type>",
+						description: "New build executor: container | github_actions"
+					}
+				],
+				examples: [{
+					command: "void github update my-app --executor github_actions",
+					description: "Switch an existing connection to the GitHub Actions executor"
+				}, {
+					command: "void github update my-app --branch release",
+					description: "Change the deploy branch"
+				}]
 			}
 		}
 	},
@@ -1715,7 +1783,7 @@ else if (command === "deploy") {
 		R.error(err instanceof Error ? err.message : String(err));
 		process.exit(1);
 	}
-	import("../deploy-Cwa5sooV.mjs").then((n) => n.t).then(({ runDeploy }) => {
+	import("../deploy-CuxXxVgz.mjs").then((n) => n.t).then(({ runDeploy }) => {
 		runDeploy(root, {
 			projectSlug: deployArgs.projectSlug,
 			dir: deployArgs.dir,
@@ -1727,14 +1795,14 @@ else if (command === "deploy") {
 			process.exit(1);
 		});
 	});
-} else if (command === "auth") runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (root, parsed) => import("../auth-cmd-DBnbrX9Y.mjs").then(({ runAuthCommand }) => runAuthCommand(root, parsed)));
-else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-CWZeawuN.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
-else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-BRbXyu7E.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
-else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-WvoAHE6w.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
-else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-ERzz4oly.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
-else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-Cx4czPsR.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
+} else if (command === "auth") runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (root, parsed) => import("../auth-cmd-DLvXvN-0.mjs").then(({ runAuthCommand }) => runAuthCommand(root, parsed)));
+else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-DZh-vbEL.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
+else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-gs_yyGZL.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
+else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-Bq6kzr_T.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
+else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-BxnfKs7f.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
+else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-BD3U_0Av.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
 else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-Dgi4D7GC.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
-else if (command === "github") runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (root, parsed) => import("../github-cmd-CUB041gj.mjs").then(({ runGithubCommand }) => runGithubCommand(root, parsed)));
+else if (command === "github") runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (root, parsed) => import("../github-cmd-CD0Z8KCF.mjs").then(({ runGithubCommand }) => runGithubCommand(root, parsed)));
 else if (command === "prepare") {
 	const root = process.cwd();
 	let prepareArgs;
@@ -1752,7 +1820,7 @@ else if (command === "prepare") {
 	});
 } else if (command === "init") {
 	const root = process.cwd();
-	import("../init-DvaRDMIc.mjs").then(({ runInitCommand, parseInitArgs }) => {
+	import("../init-CTe46nIr.mjs").then(({ runInitCommand, parseInitArgs }) => {
 		let initArgs;
 		try {
 			initArgs = parseInitArgs(args.slice(1));
@@ -1765,7 +1833,7 @@ else if (command === "prepare") {
 			process.exit(1);
 		});
 	});
-} else if (command === "mcp") import("../mcp-Cc2MMXdQ.mjs").then(({ runMcp }) => {
+} else if (command === "mcp") import("../mcp-STKL-uWs.mjs").then(({ runMcp }) => {
 	runMcp();
 });
 else if (command === "-v" || command === "--version") {
@@ -1806,7 +1874,7 @@ else if (command === "-v" || command === "--version") {
 		},
 		{
 			name: "github",
-			hint: "install | installations | connect | link",
+			hint: "install | installations | connect | update | link",
 			description: "Connect a GitHub repository for automatic deploys"
 		},
 		{
@@ -1846,27 +1914,27 @@ else if (command === "-v" || command === "--version") {
 		const root = process.cwd();
 		switch (cmd) {
 			case "init": {
-				const { runInitCommand, parseInitArgs } = await import("../init-DvaRDMIc.mjs");
+				const { runInitCommand, parseInitArgs } = await import("../init-CTe46nIr.mjs");
 				await runInitCommand(root, parseInitArgs([]));
 				return;
 			}
 			case "deploy": {
-				const { runDeploy } = await import("../deploy-Cwa5sooV.mjs").then((n) => n.t);
+				const { runDeploy } = await import("../deploy-CuxXxVgz.mjs").then((n) => n.t);
 				await runDeploy(root);
 				return;
 			}
 			case "mcp": {
-				const { runMcp } = await import("../mcp-Cc2MMXdQ.mjs");
+				const { runMcp } = await import("../mcp-STKL-uWs.mjs");
 				runMcp();
 				return;
 			}
-			case "auth": return runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (r, p) => import("../auth-cmd-DBnbrX9Y.mjs").then(({ runAuthCommand }) => runAuthCommand(r, p)));
-			case "project": return runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (r, p) => import("../project-cmd-CWZeawuN.mjs").then(({ runProjectCommand }) => runProjectCommand(r, p)));
-			case "secret": return runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (r, p) => import("../secret-BRbXyu7E.mjs").then(({ runSecretCommand }) => runSecretCommand(r, p)));
-			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-WvoAHE6w.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
-			case "github": return runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (r, p) => import("../github-cmd-CUB041gj.mjs").then(({ runGithubCommand }) => runGithubCommand(r, p)));
-			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-ERzz4oly.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
-			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-Cx4czPsR.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
+			case "auth": return runSubcommandGroup("auth", authSubcommands, parseAuthArgs, (r, p) => import("../auth-cmd-DLvXvN-0.mjs").then(({ runAuthCommand }) => runAuthCommand(r, p)));
+			case "project": return runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (r, p) => import("../project-cmd-DZh-vbEL.mjs").then(({ runProjectCommand }) => runProjectCommand(r, p)));
+			case "secret": return runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (r, p) => import("../secret-gs_yyGZL.mjs").then(({ runSecretCommand }) => runSecretCommand(r, p)));
+			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-Bq6kzr_T.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
+			case "github": return runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (r, p) => import("../github-cmd-CD0Z8KCF.mjs").then(({ runGithubCommand }) => runGithubCommand(r, p)));
+			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-BxnfKs7f.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
+			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-BD3U_0Av.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
 			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-Dgi4D7GC.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
 			case "prepare": {
 				const { runPrepareCommand } = await import("../prepare-DH2WnEpD.mjs");

package/dist/{client-D4awzTnj.mjs → client-CTHvucDv.mjs}

@@ -861,6 +861,23 @@ var PlatformClient = class {
 		if (!res.ok) await throwPlatformApiError("Failed to connect GitHub repository", res);
 		return res.json();
 	}
+	async getGithubConnection(projectId) {
+		const res = await fetch(`${this.baseUrl}/projects/${projectId}/github`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to get GitHub connection", res);
+		return res.json();
+	}
+	async updateGithubConnection(projectId, body) {
+		const res = await fetch(`${this.baseUrl}/projects/${projectId}/github`, {
+			method: "PATCH",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify(body)
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to update GitHub connection", res);
+		return res.json();
+	}
 	async getGithubLinkUrl(redirect, codeChallenge) {
 		const params = new URLSearchParams({
 			redirect,
@@ -888,4 +905,4 @@ var PlatformClient = class {
 	}
 };
 //#endregion
-export { saveToken as _, isExpiredTokenError as a, createCodeChallenge as c, getToken as d, getTokenSource as f, runLogin as g, removeToken as h, isCliOutdatedError as i, createCodeVerifier as l, openBrowser as m, PlatformClient as n, parsePlatformErrorBody as o, isStagingMode as p, client_exports as r, awaitBrowserCallback as s, PlatformApiError as t, getSiteDomain as u };
+export { runLogin as _, isExpiredTokenError as a, createCodeChallenge as c, getSiteDomain as d, getToken as f, removeToken as g, openBrowser as h, isCliOutdatedError as i, createCodeVerifier as l, isStagingMode as m, PlatformClient as n, parsePlatformErrorBody as o, getTokenSource as p, client_exports as r, awaitBrowserCallback as s, PlatformApiError as t, getApiUrl as u, saveToken as v, ensureCloudflaredToken as y };

package/dist/{create-project-CGodxfzH.mjs → create-project-CruTH_TQ.mjs}

@@ -1,6 +1,6 @@
 import { n as __exportAll } from "./chunk-DJd-R1mw.mjs";
 import { s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { t as PlatformApiError, u as getSiteDomain } from "./client-D4awzTnj.mjs";
+import { d as getSiteDomain, t as PlatformApiError } from "./client-CTHvucDv.mjs";
 import { _ as me, c as R, i as Ee, l as Re, v as ue, x as q } from "./dist-abzUneor.mjs";
 import { a as writeProjectConfig } from "./project-CH9pdo16.mjs";
 import { n as validateProjectSlug } from "./project-slug-rX3kTOfY.mjs";

package/dist/{db-ERzz4oly.mjs → db-BxnfKs7f.mjs}

@@ -2,7 +2,7 @@ import { a as join, c as resolve, r as extname, s as relative } from "./pathe.M-
 import { i as dim, n as cliTitle, s as import_picocolors } from "./output-DeiS4oEX.mjs";
 import { n as readProjectPaths } from "./project-paths-CCMrHYQm.mjs";
 import { t as cfAccessHeaders } from "./cf-access-DKDsgwOU.mjs";
-import { d as getToken, n as PlatformClient, p as isStagingMode, t as PlatformApiError } from "./client-D4awzTnj.mjs";
+import { f as getToken, m as isStagingMode, n as PlatformClient, t as PlatformApiError } from "./client-CTHvucDv.mjs";
 import { c as R, g as ge, v as ue, x as q, y as ye } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { c as getDatabaseDialect, f as readConfig, p as resolveBindingNames } from "./config-8dLIngKW.mjs";

package/dist/{delete-CJZGDLBR.mjs → delete-IQe1O4Re.mjs}

@@ -1,5 +1,5 @@
 import { n as cliTitle, r as createSpinner } from "./output-DeiS4oEX.mjs";
-import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
+import { f as getToken, n as PlatformClient } from "./client-CTHvucDv.mjs";
 import { _ as me, c as R, g as ge, l as Re, u as Se, x as q, y as ye } from "./dist-abzUneor.mjs";
 import { i as removeProjectConfig, r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { r as resolveProjectBySlug } from "./resolve-project-D4O1_fZz.mjs";

package/dist/{deploy-Cwa5sooV.mjs → deploy-CuxXxVgz.mjs}

@@ -3,7 +3,8 @@ import { a as join, c as resolve, i as isAbsolute, n as dirname, r as extname, s
 import { n as cliTitle, r as createSpinner, s as import_picocolors } from "./output-DeiS4oEX.mjs";
 import { i as resolveProjectPaths, n as readProjectPaths } from "./project-paths-CCMrHYQm.mjs";
 import { t as findVoidAuthConfig } from "./config-hhMYPVRT.mjs";
-import { a as isExpiredTokenError, d as getToken, f as getTokenSource, i as isCliOutdatedError, n as PlatformClient, o as parsePlatformErrorBody, p as isStagingMode, t as PlatformApiError } from "./client-D4awzTnj.mjs";
+import { t as cfAccessHeaders } from "./cf-access-DKDsgwOU.mjs";
+import { a as isExpiredTokenError, f as getToken, i as isCliOutdatedError, m as isStagingMode, n as PlatformClient, o as parsePlatformErrorBody, p as getTokenSource, t as PlatformApiError, u as getApiUrl, y as ensureCloudflaredToken } from "./client-CTHvucDv.mjs";
 import { c as R, g as ge, u as Se, v as ue, x as q, y as ye } from "./dist-abzUneor.mjs";
 import { a as writeProjectConfig, r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { c as getDatabaseDialect, f as readConfig, l as isNodeTarget, p as resolveBindingNames } from "./config-8dLIngKW.mjs";
@@ -19,11 +20,11 @@ import { n as buildMigrationPlanBundle } from "./plan-aD3wRDqF.mjs";
 import { r as validateMigrations, t as assertJournalCoherence } from "./validate-CNWm-PsL.mjs";
 import { t as scanPages } from "./scan-VCAM1oh3.mjs";
 import { n as STAGING_PROXY_URL, t as DEFAULT_PROXY_URL } from "./proxy-M3pxItg2.mjs";
-import { i as promptProjectSetupAction, n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-CGodxfzH.mjs";
+import { i as promptProjectSetupAction, n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-CruTH_TQ.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-D4O1_fZz.mjs";
 import { t as collectGitDeployMetadata } from "./git-metadata-Ce0AtSZL.mjs";
 import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-BNWymgnH.mjs";
-import { t as promptForLoginToken } from "./login-Ca6mhQVI.mjs";
+import { t as promptForLoginToken } from "./login-v4wle1vn.mjs";
 import { i as resolveProjectCommand, n as detectPreset, r as formatProjectCommand, t as FRAMEWORK_PRESETS } from "./preset-B7ZQZn0u.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
@@ -1168,6 +1169,129 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 //#endregion
+//#region src/cli/github-oidc.ts
+/**
+* GitHub Actions OIDC → Void deploy-token exchange.
+*
+* When `void deploy` runs inside GitHub Actions with no explicit `VOID_TOKEN`,
+* the CLI mints a short-lived GitHub OIDC token (audience `void`) and exchanges
+* it at `POST $VOID_API_URL/auth/github-oidc` for a short-lived, project-scoped
+* Void deploy token. Doing the exchange in-process lets the scaffolded workflow
+* collapse to a single `void deploy` step — no curl/jq token-exchange step.
+*
+* Server contract (platform `POST /auth/github-oidc` handler):
+*   request  { oidcToken: string, project: string }   (project = slug)
+*   response { token: string, projectId, buildId }
+*/
+const OIDC_AUDIENCE = "void";
+/**
+* True when the process is running inside GitHub Actions with the OIDC token
+* request endpoint available — i.e. the workflow granted
+* `permissions: id-token: write`, so GitHub injected the request URL + token.
+*/
+function isGithubActionsOidcAvailable(env = process.env) {
+	return env.GITHUB_ACTIONS === "true" && typeof env.ACTIONS_ID_TOKEN_REQUEST_URL === "string" && env.ACTIONS_ID_TOKEN_REQUEST_URL.length > 0 && typeof env.ACTIONS_ID_TOKEN_REQUEST_TOKEN === "string" && env.ACTIONS_ID_TOKEN_REQUEST_TOKEN.length > 0;
+}
+/**
+* Mint a GitHub Actions OIDC token (audience `void`) and exchange it for a
+* short-lived, project-scoped Void deploy token.
+*
+* Two hops:
+*   1. GET  $ACTIONS_ID_TOKEN_REQUEST_URL&audience=void  (Bearer request token)
+*        → `.value` is the OIDC JWT.
+*   2. POST $apiUrl/auth/github-oidc  { oidcToken, project }
+*        → `.token` is the Void deploy token.
+*
+* Throws a clear, actionable error (including the HTTP status and server error
+* body when available) on any non-OK response or missing field.
+*/
+async function exchangeGithubOidcForDeployToken(apiUrl, project, env = process.env) {
+	const requestUrl = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+	const requestToken = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+	if (!requestUrl || !requestToken) throw new Error("github-oidc: GitHub Actions OIDC is unavailable (missing ACTIONS_ID_TOKEN_REQUEST_URL/TOKEN). Ensure the workflow grants `permissions: id-token: write`.");
+	return exchangeOidcTokenAtApi(apiUrl, project, await requestGithubOidcToken(requestUrl, requestToken));
+}
+/**
+* GET the GitHub Actions OIDC token for audience `void`. GitHub's request URL
+* already carries a query string, so `audience` is appended alongside it.
+*/
+async function requestGithubOidcToken(requestUrl, requestToken) {
+	const url = new URL(requestUrl);
+	url.searchParams.set("audience", OIDC_AUDIENCE);
+	let res;
+	try {
+		res = await fetch(url, { headers: { Authorization: `Bearer ${requestToken}` } });
+	} catch (err) {
+		throw new Error(`github-oidc: Failed to reach the GitHub OIDC token endpoint: ${errText(err)}`);
+	}
+	if (!res.ok) {
+		const body = await safeText(res);
+		throw new Error(`github-oidc: Failed to mint a GitHub OIDC token (${res.status})${body ? `: ${body}` : ""}.`);
+	}
+	let body;
+	try {
+		body = await res.json();
+	} catch {
+		throw new Error("github-oidc: GitHub OIDC token endpoint returned an invalid response.");
+	}
+	const value = body?.value;
+	if (typeof value !== "string" || value.length === 0) throw new Error("github-oidc: GitHub OIDC token endpoint did not return a token value.");
+	return value;
+}
+/** POST the OIDC JWT to the Void API and return the minted deploy token. */
+async function exchangeOidcTokenAtApi(apiUrl, project, oidcToken) {
+	const url = `${apiUrl.endsWith("/") ? apiUrl.slice(0, -1) : apiUrl}/auth/github-oidc`;
+	ensureCloudflaredToken(apiUrl);
+	let res;
+	try {
+		res = await fetch(url, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...cfAccessHeaders(process.env)
+			},
+			body: JSON.stringify({
+				oidcToken,
+				project
+			})
+		});
+	} catch (err) {
+		throw new Error(`github-oidc: Failed to reach ${url}: ${errText(err)}`);
+	}
+	if (!res.ok) {
+		const body = await safeText(res);
+		throw new Error(`github-oidc: OIDC token exchange failed (${res.status})${body ? `: ${body}` : ""}. Confirm the repository is connected to project "${project}" with the github_actions executor.`);
+	}
+	let body;
+	try {
+		body = await res.json();
+	} catch {
+		throw new Error("github-oidc: OIDC token exchange returned an invalid response.");
+	}
+	const token = body?.token;
+	if (typeof token !== "string" || token.length === 0) throw new Error("github-oidc: OIDC token exchange did not return a deploy token.");
+	return token;
+}
+/**
+* Emit a GitHub Actions `::add-mask::` workflow command so `value` is redacted
+* from workflow logs. No-op when not running inside GitHub Actions. GitHub reads
+* workflow commands from stdout.
+*/
+function maskGithubActionsSecret(value, env = process.env) {
+	if (env.GITHUB_ACTIONS !== "true" || !value) return;
+	process.stdout.write(`::add-mask::${value}\n`);
+}
+function errText(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+async function safeText(res) {
+	try {
+		return (await res.text()).trim();
+	} catch {
+		return "";
+	}
+}
+//#endregion
 //#region src/cli/log-file.ts
 /**
 * Walk `err.cause` up to 6 levels and return a plain JSON-friendly chain.
@@ -2377,7 +2501,17 @@ function buildEnv(extra) {
 async function runDeployInner(root, options, cliLog) {
 	let reauthenticated = false;
 	while (true) try {
-		const token = getToken(root);
+		let token = process.env.VOID_TOKEN ?? null;
+		if (!token && isGithubActionsOidcAvailable()) {
+			const slug = getRequestedProjectSlug(options) ?? readProjectConfig(root)?.slug;
+			if (!slug) throw new Error("deploy: running in GitHub Actions but the project is unknown — pass --project <slug> or link the project.");
+			cliLog.info("github_oidc_exchange_start", { slug });
+			token = await exchangeGithubOidcForDeployToken(getApiUrl(root), slug);
+			maskGithubActionsSecret(token);
+			process.env.VOID_TOKEN = token;
+			cliLog.info("github_oidc_exchange_success", { slug });
+		}
+		token ??= getToken(root);
 		if (!token) {
 			R.error("No auth token found. Run `void auth login` first.");
 			process.exit(1);

package/dist/{domain-WvoAHE6w.mjs → domain-Bq6kzr_T.mjs}

@@ -1,5 +1,5 @@
 import { s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
+import { f as getToken, n as PlatformClient } from "./client-CTHvucDv.mjs";
 import { c as R, u as Se } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 //#region src/cli/domain.ts

package/dist/{env-Cx4czPsR.mjs → env-BD3U_0Av.mjs}

@@ -1,6 +1,6 @@
 import { a as join } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
 import { n as cliTitle } from "./output-DeiS4oEX.mjs";
-import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
+import { f as getToken, n as PlatformClient } from "./client-CTHvucDv.mjs";
 import { c as R, g as ge, u as Se, y as ye } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { r as generateEnvTypes, t as findEnvFile } from "./env-types-CaJaIRXU.mjs";

package/dist/{github-cmd-CUB041gj.mjs → github-cmd-CD0Z8KCF.mjs}

@@ -1,5 +1,5 @@
 import { s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { c as createCodeChallenge, d as getToken, l as createCodeVerifier, m as openBrowser, n as PlatformClient, o as parsePlatformErrorBody, s as awaitBrowserCallback, t as PlatformApiError } from "./client-D4awzTnj.mjs";
+import { c as createCodeChallenge, f as getToken, h as openBrowser, l as createCodeVerifier, n as PlatformClient, o as parsePlatformErrorBody, s as awaitBrowserCallback, t as PlatformApiError } from "./client-CTHvucDv.mjs";
 import { _ as me, c as R, i as Ee, l as Re, x as q } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-D4O1_fZz.mjs";
@@ -22,6 +22,18 @@ function describeConnectError(status, errorCode) {
 	return null;
 }
 /**
+* Like {@link describeConnectError}, but for `void github update`. The update
+* flow starts from an EXISTING connection, so a 404 "connection not found"
+* (the project has no GitHub connection, or it was disconnected between the
+* read and the write) is the common case and gets a "connect first" message.
+* Everything else defers to the shared connect mapping.
+*/
+function describeUpdateError(status, errorCode) {
+	const code = errorCode ?? "";
+	if (status === 404 && code.includes("connection not found")) return "This project is not connected to a GitHub repository. Run `void github connect` first.";
+	return describeConnectError(status, code);
+}
+/**
 * Extract `owner/repo` from a `https://github.com/owner/repo(.git)?` URL.
 * Returns null for non-GitHub URLs or null input.
 */
@@ -61,6 +73,7 @@ async function runGithubCommand(root, args) {
 		case "install": return runInstall(root, client);
 		case "installations": return runInstallations(client);
 		case "connect": return runConnect(root, client, args);
+		case "update": return runGithubUpdate(root, client, args);
 		case "link": return runGithubLink(root, client);
 	}
 }
@@ -304,5 +317,125 @@ async function runConnect(root, client, args) {
 	}
 	R.success(`Connected ${repoFullName} (${branch}) → project. Push to ${branch} to deploy.`);
 }
+async function runGithubUpdate(root, client, args) {
+	const isTTY = process.stdin.isTTY === true;
+	if (!isTTY && args.branch === void 0 && args.executor === void 0) {
+		R.error("update: Nothing to update. Pass --branch <name> and/or --executor <container|github_actions>.");
+		process.exit(1);
+	}
+	let projectId;
+	const requestedSlug = getRequestedProjectSlug({ projectSlug: args.projectName || void 0 });
+	if (requestedSlug) {
+		const resolved = resolveProjectBySlug(await client.listProjects(), requestedSlug);
+		if (!resolved) {
+			R.error(`update: No project found with slug '${requestedSlug}'.`);
+			process.exit(1);
+		}
+		projectId = resolved.projectId;
+	} else {
+		const linked = readProjectConfig(root);
+		if (linked) projectId = linked.projectId;
+		else if (!isTTY) {
+			R.error("update: No project specified. Pass a project name or --project <name>, set VOID_PROJECT, or link one with `void project link`.");
+			process.exit(1);
+		} else {
+			const projects = await client.listProjects();
+			if (projects.length === 0) {
+				R.error("No projects found. Create one first with `void deploy`.");
+				process.exit(1);
+			}
+			const picked = await Ee({
+				message: "Select a project:",
+				options: projects.map((p) => ({
+					value: p.id,
+					label: p.slug
+				}))
+			});
+			if (q(picked)) {
+				me("Cancelled.");
+				process.exit(0);
+			}
+			projectId = picked;
+		}
+	}
+	let current;
+	try {
+		current = await client.getGithubConnection(projectId);
+	} catch (err) {
+		if (err instanceof PlatformApiError) {
+			const body = parsePlatformErrorBody(err.body);
+			const code = body?.error ?? body?.message ?? "";
+			const message = describeUpdateError(err.status, code);
+			if (message !== null) {
+				R.error(`update: ${message}`);
+				process.exit(1);
+			}
+		}
+		throw err;
+	}
+	let branch;
+	let executor;
+	if (isTTY) {
+		if (args.branch !== void 0) branch = args.branch;
+		else {
+			const input = await Re({
+				message: "Branch to deploy from:",
+				placeholder: current.branch,
+				initialValue: current.branch
+			});
+			if (q(input)) {
+				me("Cancelled.");
+				process.exit(0);
+			}
+			branch = input.trim() || current.branch;
+		}
+		if (args.executor !== void 0) executor = args.executor;
+		else {
+			const picked = await Ee({
+				message: "Build executor:",
+				options: [{
+					value: "container",
+					label: "container"
+				}, {
+					value: "github_actions",
+					label: "github_actions"
+				}],
+				initialValue: current.build_executor
+			});
+			if (q(picked)) {
+				me("Cancelled.");
+				process.exit(0);
+			}
+			executor = picked;
+		}
+	} else {
+		branch = args.branch ?? current.branch;
+		executor = args.executor ?? current.build_executor;
+	}
+	const patch = {};
+	if (branch !== current.branch) patch.branch = branch;
+	if (executor !== current.build_executor) patch.buildExecutor = executor;
+	if (patch.branch === void 0 && patch.buildExecutor === void 0) {
+		R.info(`No changes. ${current.repo_full_name} already deploys from ${current.branch} via ${current.build_executor}.`);
+		return;
+	}
+	let updated;
+	try {
+		updated = await client.updateGithubConnection(projectId, patch);
+	} catch (err) {
+		if (err instanceof PlatformApiError) {
+			const body = parsePlatformErrorBody(err.body);
+			const code = body?.error ?? body?.message ?? "";
+			const message = describeUpdateError(err.status, code);
+			if (message !== null) {
+				R.error(`update: ${message}`);
+				process.exit(1);
+			}
+			throw err;
+		}
+		throw err;
+	}
+	R.success(`Updated ${updated.repo_full_name} → branch ${updated.branch}, executor ${updated.build_executor}.`);
+}
 //#endregion
 export { runGithubCommand };

package/dist/index.mjs

@@ -1,10 +1,10 @@
 import { r as __toESM } from "./chunk-DJd-R1mw.mjs";
 import { a as join, n as dirname, s as relative } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
 import { u as require_picocolors } from "./output-DeiS4oEX.mjs";
-import { C as hasApiRoutes, S as resolveSandboxConfig, T as resolveAssetRoutingPolicy, _ as readWranglerCompat, a as prerenderPagesNode, b as SANDBOX_MIGRATION_TAG, c as stripInternalEnvKeys, d as ensureWranglerCompatibilityDate, f as ensureWranglerNodejsAlsFlag, g as readExistingLiveBindingConfig, h as normalizeWranglerCompatibilityFlags, i as prerenderPages, l as LIVE_MIGRATION_TAG, m as nextDurableObjectMigrationTag, n as resolveDistDir, o as filterLoadedEnv, p as hasDurableObjectSqliteMigration, r as resolveWorkerDirName, s as resolveRemoteMode, u as ensureWranglerCompat, v as resolveLiveBindingConfig, w as hasDocumentRoutes, x as isSandboxEnabled, y as syncWranglerBindings } from "./deploy-Cwa5sooV.mjs";
+import { C as hasApiRoutes, S as resolveSandboxConfig, T as resolveAssetRoutingPolicy, _ as readWranglerCompat, a as prerenderPagesNode, b as SANDBOX_MIGRATION_TAG, c as stripInternalEnvKeys, d as ensureWranglerCompatibilityDate, f as ensureWranglerNodejsAlsFlag, g as readExistingLiveBindingConfig, h as normalizeWranglerCompatibilityFlags, i as prerenderPages, l as LIVE_MIGRATION_TAG, m as nextDurableObjectMigrationTag, n as resolveDistDir, o as filterLoadedEnv, p as hasDurableObjectSqliteMigration, r as resolveWorkerDirName, s as resolveRemoteMode, u as ensureWranglerCompat, v as resolveLiveBindingConfig, w as hasDocumentRoutes, x as isSandboxEnabled, y as syncWranglerBindings } from "./deploy-CuxXxVgz.mjs";
 import { i as resolveProjectPaths, n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-CCMrHYQm.mjs";
 import { n as loadVoidAuthConfig, t as findVoidAuthConfig } from "./config-hhMYPVRT.mjs";
-import { d as getToken, p as isStagingMode } from "./client-D4awzTnj.mjs";
+import { f as getToken, m as isStagingMode } from "./client-CTHvucDv.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { n as ensureProjectTsconfig, r as writeFileIfChanged } from "./project-tsconfig-BTNuNoJ0.mjs";
 import { c as getDatabaseDialect, f as readConfig, l as isNodeTarget, p as resolveBindingNames } from "./config-8dLIngKW.mjs";
@@ -4916,7 +4916,7 @@ const STAGING_API_URL = "https://api.staging.void.cloud";
 */
 async function runAiSetupPrompt(root, token, staging, server) {
 	const { select, text, isCancel, log } = await import("./dist-abzUneor.mjs").then((n) => n.p);
-	const { PlatformClient } = await import("./client-D4awzTnj.mjs").then((n) => n.r);
+	const { PlatformClient } = await import("./client-CTHvucDv.mjs").then((n) => n.r);
 	const { writeProjectConfig } = await import("./project-CH9pdo16.mjs").then((n) => n.n);
 	const { inferDefaultSlug } = await import("./resolve-project-D4O1_fZz.mjs").then((n) => n.i);
 	const client = new PlatformClient(token, staging ? STAGING_API_URL : DEFAULT_API_URL);
@@ -4945,7 +4945,7 @@ async function runAiSetupPrompt(root, token, staging, server) {
 	let slug;
 	if (result === "__create__") {
 		const { validateProjectSlug } = await import("./project-slug-rX3kTOfY.mjs").then((n) => n.t);
-		const { createProjectWithSlugRetry } = await import("./create-project-CGodxfzH.mjs").then((n) => n.t);
+		const { createProjectWithSlugRetry } = await import("./create-project-CruTH_TQ.mjs").then((n) => n.t);
 		let created;
 		try {
 			created = await createProjectWithSlugRetry(client, inferDefaultSlug(root), async (defaultSlug) => {

package/dist/{init-DvaRDMIc.mjs → init-CTe46nIr.mjs}

@@ -1,7 +1,7 @@
 import { a as join, c as resolve, i as isAbsolute, n as dirname, s as relative, t as basename } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
 import { n as cliTitle } from "./output-DeiS4oEX.mjs";
 import { n as readProjectPaths } from "./project-paths-CCMrHYQm.mjs";
-import { d as getToken, n as PlatformClient, p as isStagingMode } from "./client-D4awzTnj.mjs";
+import { f as getToken, m as isStagingMode, n as PlatformClient } from "./client-CTHvucDv.mjs";
 import { _ as me, c as R, g as ge, i as Ee, l as Re, u as Se, v as ue, x as q, y as ye } from "./dist-abzUneor.mjs";
 import { a as writeProjectConfig, r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { n as ensureProjectTsconfig, t as createProjectTsconfig } from "./project-tsconfig-BTNuNoJ0.mjs";
@@ -11,8 +11,8 @@ import { r as parseDotenvFile, t as expandDotenv } from "./dotenv-lS94ymhM.mjs";
 import { t as MagicString } from "./magic-string.es-C1Fb0uxq.mjs";
 import { n as writeDrizzleConfig } from "./config--wXmVOoe.mjs";
 import { n as getAgentById, r as getPackageDir, t as detectAgents } from "./agents-MhSzNMiC.mjs";
-import { n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-CGodxfzH.mjs";
-import { t as promptForLoginToken } from "./login-Ca6mhQVI.mjs";
+import { n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-CruTH_TQ.mjs";
+import { t as promptForLoginToken } from "./login-v4wle1vn.mjs";
 import { r as formatProjectCommand } from "./preset-B7ZQZn0u.mjs";
 import { n as findInstalledYarnPnpRuntime, r as hasLocalLockfile, t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-DhCHHLAz.mjs";
 import { createRequire } from "node:module";
@@ -1805,10 +1805,12 @@ function getWorkflowSetupSteps(root, pm) {
 }
 /**
 * Scaffold the GitHub Actions workflow that deploys via GitHub OIDC — no
-* long-lived secret stored in the repo. The job requests an OIDC token from
-* GitHub (audience `void`), exchanges it at `POST $VOID_API_URL/auth/github-oidc`
-* for a short-lived (15-min) project-scoped deploy token, then runs
-* `void deploy --project <slug>` with that token exported as `VOID_TOKEN`.
+* long-lived secret stored in the repo. `void deploy` itself detects GitHub
+* Actions, mints an OIDC token (audience `void`), exchanges it at
+* `POST $VOID_API_URL/auth/github-oidc` for a short-lived, project-scoped deploy
+* token, and uses it — so the workflow is a single `void deploy` step (no
+* curl/jq). `permissions: id-token: write` is still required: it is what lets
+* the job (and thus the CLI) mint the OIDC token.
 *
 * `slug` is the linked project slug when known (from `.void/project.json`);
 * otherwise a `${{ vars.VOID_PROJECT }}` placeholder is emitted with a comment
@@ -1830,8 +1832,8 @@ concurrency:
   cancel-in-progress: true
 
 # id-token: write lets the job mint a GitHub OIDC token. No long-lived
-# VOID_TOKEN secret is stored — the token below is exchanged for a
-# short-lived, project-scoped deploy token at deploy time.
+# VOID_TOKEN secret is stored — \`void deploy\` mints that OIDC token and
+# exchanges it for a short-lived, project-scoped deploy token at deploy time.
 permissions:
   id-token: write
   contents: read
@@ -1850,17 +1852,6 @@ jobs:
       - uses: actions/checkout@v6
 ${setup}
 ${install}
-      - name: Exchange GitHub OIDC token for a Void deploy token
-        run: |
-          OIDC_TOKEN="$(curl -sf \\
-            -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \\
-            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=void" | jq -r '.value')"
-          VOID_TOKEN="$(curl -sf \\
-            -H 'Content-Type: application/json' \\
-            -d "$(jq -n --arg t "$OIDC_TOKEN" --arg p "$VOID_PROJECT" '{oidcToken: $t, project: $p}')" \\
-            "$VOID_API_URL/auth/github-oidc" | jq -r '.token')"
-          echo "::add-mask::$VOID_TOKEN"
-          echo "VOID_TOKEN=$VOID_TOKEN" >> "$GITHUB_ENV"
       - name: Deploy
         run: ${runner} deploy --project "$VOID_PROJECT"
 `;

package/dist/{link-CpbWJY3P.mjs → link-BGFW4pHD.mjs}

@@ -1,8 +1,8 @@
 import { n as cliTitle, s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { d as getToken, n as PlatformClient, u as getSiteDomain } from "./client-D4awzTnj.mjs";
+import { d as getSiteDomain, f as getToken, n as PlatformClient } from "./client-CTHvucDv.mjs";
 import { _ as me, c as R, g as ge, y as ye } from "./dist-abzUneor.mjs";
 import { a as writeProjectConfig, r as readProjectConfig } from "./project-CH9pdo16.mjs";
-import { n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-CGodxfzH.mjs";
+import { n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-CruTH_TQ.mjs";
 import { r as resolveProjectBySlug } from "./resolve-project-D4O1_fZz.mjs";
 //#region src/cli/link.ts
 async function runLink(root, slug) {

package/dist/{list-BkwE5vH4.mjs → list-CbGxdbe7.mjs}

@@ -1,5 +1,5 @@
 import { a as ensureUtc, i as dim, l as tablePrefix, n as cliTitle, s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
+import { f as getToken, n as PlatformClient } from "./client-CTHvucDv.mjs";
 import { c as R, g as ge, y as ye } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { r as resolveProjectBySlug } from "./resolve-project-D4O1_fZz.mjs";

package/dist/{login-Ca6mhQVI.mjs → login-v4wle1vn.mjs}

@@ -1,5 +1,5 @@
 import { n as cliTitle, r as createSpinner, s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { _ as saveToken, a as isExpiredTokenError, d as getToken, f as getTokenSource, g as runLogin, h as removeToken, n as PlatformClient, p as isStagingMode } from "./client-D4awzTnj.mjs";
+import { _ as runLogin, a as isExpiredTokenError, f as getToken, g as removeToken, m as isStagingMode, n as PlatformClient, p as getTokenSource, v as saveToken } from "./client-CTHvucDv.mjs";
 import { _ as me, c as R, g as ge, i as Ee, x as q, y as ye } from "./dist-abzUneor.mjs";
 //#region src/cli/login.ts
 async function promptForLoginToken(root = process.cwd()) {

package/dist/{logs-ArQzZquo.mjs → logs-BFgY5Vqc.mjs}

@@ -1,5 +1,5 @@
 import { i as dim, n as cliTitle, s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
+import { f as getToken, n as PlatformClient } from "./client-CTHvucDv.mjs";
 import { c as R, g as ge, y as ye } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 //#region src/cli/logs.ts

package/dist/{mcp-Cc2MMXdQ.mjs → mcp-STKL-uWs.mjs}

@@ -1,5 +1,5 @@
 import { a as join, n as dirname } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
-import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
+import { f as getToken, n as PlatformClient } from "./client-CTHvucDv.mjs";
 import { a as writeProjectConfig } from "./project-CH9pdo16.mjs";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { fileURLToPath } from "node:url";

package/dist/{project-cmd-CWZeawuN.mjs → project-cmd-DZh-vbEL.mjs}

@@ -1,5 +1,5 @@
 import { i as dim, l as tablePrefix, n as cliTitle, s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { d as getToken, n as PlatformClient, u as getSiteDomain } from "./client-D4awzTnj.mjs";
+import { d as getSiteDomain, f as getToken, n as PlatformClient } from "./client-CTHvucDv.mjs";
 import { c as R, g as ge, y as ye } from "./dist-abzUneor.mjs";
 //#region src/cli/projects.ts
 async function runProjectsCommand(root) {
@@ -34,32 +34,32 @@ async function runProjectsCommand(root) {
 //#region src/cli/project-cmd.ts
 async function runProjectCommand(root, args) {
 	if (args.subcommand === "status") {
-		const { runListCommand } = await import("./list-BkwE5vH4.mjs");
+		const { runListCommand } = await import("./list-CbGxdbe7.mjs");
 		return runListCommand(root, args.name || void 0);
 	}
 	if (args.subcommand === "link") {
-		const { runLink } = await import("./link-CpbWJY3P.mjs");
+		const { runLink } = await import("./link-BGFW4pHD.mjs");
 		return runLink(root, args.name || void 0);
 	}
 	if (args.subcommand === "list") return runProjectsCommand(root);
 	if (args.subcommand === "logs") {
-		const { runLogsCommand } = await import("./logs-ArQzZquo.mjs");
+		const { runLogsCommand } = await import("./logs-BFgY5Vqc.mjs");
 		return runLogsCommand(root, args.filter, args.range, args.deployment || void 0, args.level || void 0);
 	}
 	if (args.subcommand === "rollback") {
-		const { runRollbackCommand } = await import("./rollback-BJ60ktsW.mjs");
+		const { runRollbackCommand } = await import("./rollback-o0M0Qo_n.mjs");
 		return runRollbackCommand(root, args.deployId || void 0);
 	}
 	if (args.subcommand === "cancel") {
-		const { runCancelDeployCommand } = await import("./cancel-deploy-CDzkVaYZ.mjs");
+		const { runCancelDeployCommand } = await import("./cancel-deploy-BwpT4U4a.mjs");
 		return runCancelDeployCommand(root, args.deployId || void 0);
 	}
 	if (args.subcommand === "delete") {
-		const { runDeleteCommand } = await import("./delete-CJZGDLBR.mjs");
+		const { runDeleteCommand } = await import("./delete-IQe1O4Re.mjs");
 		return runDeleteCommand(root, args.name || void 0, { force: args.force });
 	}
 	if (args.subcommand === "purge-cache") {
-		const { runPurgeCacheCommand } = await import("./cache-DNX0hLsO.mjs");
+		const { runPurgeCacheCommand } = await import("./cache-CHFZmqa5.mjs");
 		return runPurgeCacheCommand(root, args.projectSlug || void 0);
 	}
 }

package/dist/{rollback-BJ60ktsW.mjs → rollback-o0M0Qo_n.mjs}

@@ -1,5 +1,5 @@
 import { a as ensureUtc, i as dim, n as cliTitle, r as createSpinner, s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
+import { f as getToken, n as PlatformClient } from "./client-CTHvucDv.mjs";
 import { _ as me, c as R, g as ge, i as Ee, v as ue, x as q, y as ye } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 //#region src/cli/rollback.ts

package/dist/{secret-BRbXyu7E.mjs → secret-gs_yyGZL.mjs}

@@ -1,5 +1,5 @@
 import { n as cliTitle } from "./output-DeiS4oEX.mjs";
-import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
+import { f as getToken, n as PlatformClient } from "./client-CTHvucDv.mjs";
 import { _ as me, c as R, g as ge, n as Ce, u as Se, v as ue, x as q, y as ye } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-D4O1_fZz.mjs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "void",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -353,7 +353,7 @@
     "valibot": ">=1.0.0-beta.7",
     "vite": "^8.0.0",
     "zod": "^3.25.0 || ^4.0.0",
-    "@void/md": "0.10.1"
+    "@void/md": "0.10.2"
   },
   "peerDependenciesMeta": {
     "@void/md": {

package/skills/void/docs/guide/deployment.md

@@ -66,7 +66,7 @@ If your CI pipeline runs typechecking or other static analysis before deploy, ru
 
 You can deploy from a GitHub repo on every push to `main`. Running `void init --github` generates `.github/workflows/void-deploy.yml` in your project.
 
-The workflow authenticates with [GitHub OIDC](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect) — there is **no long-lived `VOID_TOKEN` secret to store or rotate**. The job requests a short-lived OIDC token from GitHub, exchanges it at `POST $VOID_API_URL/auth/github-oidc` for a short-lived project-scoped deploy token (about 15 minutes on the free tier; longer on higher plans, capped at ~60 minutes), then runs `void deploy --project <slug>`:
+The workflow authenticates with [GitHub OIDC](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect) — there is **no long-lived `VOID_TOKEN` secret to store or rotate**. `void deploy` detects GitHub Actions and does the exchange itself: it requests a short-lived OIDC token from GitHub (audience `void`), exchanges it at `POST $VOID_API_URL/auth/github-oidc` for a short-lived project-scoped deploy token (about 15 minutes on the free tier; longer on higher plans, capped at ~60 minutes), and deploys — so the workflow is a single `void deploy` step. `permissions: id-token: write` is still required: it is what lets the job (and the CLI) mint the OIDC token.
 
 ```yaml
 name: Deploy to Void
@@ -98,17 +98,6 @@ jobs:
           node-version: lts/*
           cache: npm
       - run: npm ci
-      - name: Exchange GitHub OIDC token for a Void deploy token
-        run: |
-          OIDC_TOKEN="$(curl -sf \
-            -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
-            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=void" | jq -r '.value')"
-          VOID_TOKEN="$(curl -sf \
-            -H 'Content-Type: application/json' \
-            -d "$(jq -n --arg t "$OIDC_TOKEN" --arg p "$VOID_PROJECT" '{oidcToken: $t, project: $p}')" \
-            "$VOID_API_URL/auth/github-oidc" | jq -r '.token')"
-          echo "::add-mask::$VOID_TOKEN"
-          echo "VOID_TOKEN=$VOID_TOKEN" >> "$GITHUB_ENV"
       - name: Deploy
         run: npx void deploy --project "$VOID_PROJECT"
 ```

package/skills/void/docs/reference/cli.md

@@ -86,7 +86,7 @@ After that, the full interactive flow walks through:
 4. **Skills:** links Void skills using the same detected or selected agent context.
 5. **MCP config:** writes MCP server config using that same agent context.
 6. **Demo code:** for existing non-Pages projects, optionally scaffolds a `db/migrations/` directory plus an API route and typed fetch example.
-7. **GitHub Actions:** optionally creates `.github/workflows/void-deploy.yml`. The workflow deploys on pushes to `main` and authenticates via [GitHub OIDC](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect) — no long-lived `VOID_TOKEN` secret is stored in the repo. The job requests an OIDC token (audience `void`), exchanges it at `POST $VOID_API_URL/auth/github-oidc` for a short-lived project-scoped deploy token, then runs `void deploy --project <slug>` with the right package manager. The project slug is baked in from your linked project (`.void/project.json`) when known; otherwise the workflow reads a `VOID_PROJECT` repository variable.
+7. **GitHub Actions:** optionally creates `.github/workflows/void-deploy.yml`. The workflow deploys on pushes to `main` and authenticates via [GitHub OIDC](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect) — no long-lived `VOID_TOKEN` secret is stored in the repo. The workflow is a single `void deploy` step: when it runs in GitHub Actions, `void deploy` mints an OIDC token (audience `void`), exchanges it at `POST $VOID_API_URL/auth/github-oidc` for a short-lived project-scoped deploy token, and deploys. `permissions: id-token: write` is retained so the CLI can mint that token. The project slug is baked in from your linked project (`.void/project.json`) when known; otherwise the workflow reads a `VOID_PROJECT` repository variable.
 8. **`env.ts` scaffold:** if the project has no `env.ts` but has `.env` / `.env.example` / `.env.local` / `.env.development*` files on disk, generates an `env.ts` pre-populated with their keys. Values get conservative type inference (`boolean`/`url`/`number`/`string`) — the file carries a banner nudging you to tighten anything the heuristic got wrong.
 9. **Project setup:** optionally logs you in, lets you select or create a project, and writes `.void/project.json` so your first deploy can just be `void deploy`.
 
@@ -627,6 +627,30 @@ void github connect my-app \
 
 **Project resolution** follows the same order as deploy: positional / `--project`, `VOID_PROJECT`, linked project (`.void/project.json`).
 
+### `void github update`
+
+```
+void github update [project] [options]
+```
+
+Update an existing connection's deploy **branch** and/or **build executor**. Use this to change settings on a project that is already connected — for example, flipping the executor from `container` to `github_actions` for a monorepo whose Void app lives in a subdirectory, or moving the deploy branch. The project must already be connected (run `void github connect` first); the repository and installation are not changed.
+
+**Options**
+
+| Flag                | Description                                         |
+| ------------------- | --------------------------------------------------- |
+| `--project <name>`  | Project name (alias for the positional argument)    |
+| `--branch <name>`   | New branch to deploy from                           |
+| `--executor <type>` | New build executor: `container` or `github_actions` |
+
+Interactively (TTY), `void github update` shows the current branch and executor and prompts for new values, defaulting each to the current setting. When stdin is not a TTY, it never prompts: pass at least one of `--branch` / `--executor`, or it fails closed. If nothing actually changes, the command reports "no changes" and does not call the API.
+
+```
+void github update my-app --executor github_actions
+```
+
+**Project resolution** follows the same order as deploy: positional / `--project`, `VOID_PROJECT`, linked project (`.void/project.json`).
+
 ## Custom Domains
 
 ### `void domain add`