void 0.20.3 → 0.21.1

package/dist/{env-validation-CF6KvTRf.mjs → env-validation-BsFEXps5.mjs}

@@ -1,9 +1,8 @@
-import { n as __exportAll } from "./rolldown-runtime-rQ84J-ij.mjs";
-import { l as resolve, n as dirname, o as join } from "./dist-BrsS7cai.mjs";
+import { a as join, n as dirname, u as resolve } from "./dist-4WkAWhWx.mjs";
 import { i as voidWarn } from "./log-ChfPKsVd.mjs";
-import { t as findEnvFile } from "./env-types-BNPhro-M.mjs";
-import { a as loadLocalEnv, i as isClientEnvKey, r as findLegacyEnvFiles } from "./env-DBKmK4vc.mjs";
-import { o as resolveWranglerArgv } from "./preset-lAy0B0BQ.mjs";
+import { t as findEnvFile } from "./env-types-CWDtqHgw.mjs";
+import { a as loadLocalEnv, i as isClientEnvKey, r as findLegacyEnvFiles } from "./env-DX_v-Q-v.mjs";
+import { o as resolveWranglerArgv } from "./preset-Dowh9tTt.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { spawn } from "node:child_process";
@@ -71,6 +70,17 @@ async function loadUserEnvFile(envFile) {
 	}
 }
 //#endregion
+//#region src/cli/generated-wrangler-config.ts
+/** Parse a generated Wrangler JSON/JSONC config without accepting a partial parse. */
+function readGeneratedWranglerConfigFile(path) {
+	const raw = readFileSync(path, "utf8");
+	const content = raw.startsWith("") ? raw.slice(1) : raw;
+	const errors = [];
+	const parsed = parse(content, errors, { allowTrailingComma: true });
+	if (errors.length > 0 || parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Invalid Wrangler JSON/JSONC config.");
+	return parsed;
+}
+//#endregion
 //#region src/cli/env-validation.ts
 /**
 * Shared env-schema validation for CLI commands.
@@ -82,25 +92,6 @@ async function loadUserEnvFile(envFile) {
 * Used by both `void deploy` (hard error on missing prod env) and
 * `void env check` (CI/pre-push validation).
 */
-var env_validation_exports = /* @__PURE__ */ __exportAll({
-	SelfHostEnvValidationError: () => SelfHostEnvValidationError,
-	SelfHostFirstDeployError: () => SelfHostFirstDeployError,
-	SelfHostSchemaError: () => SelfHostSchemaError,
-	SelfHostSecretListError: () => SelfHostSecretListError,
-	computeInvalidEmittedKeys: () => computeInvalidEmittedKeys,
-	createDefaultSecretListRunner: () => createDefaultSecretListRunner,
-	deriveSelfHostEnvContextFromVars: () => deriveSelfHostEnvContextFromVars,
-	deriveSelfHostSchemaFacts: () => deriveSelfHostSchemaFacts,
-	dischargeSelfHostEnvContext: () => dischargeSelfHostEnvContext,
-	fetchRemoteSecretNames: () => fetchRemoteSecretNames,
-	formatEnvReport: () => formatEnvReport,
-	listSelfHostSecretNames: () => listSelfHostSecretNames,
-	readEmittedWorkerVars: () => readEmittedWorkerVars,
-	secretListEnv: () => secretListEnv,
-	selfHostSchemaFailureMessage: () => selfHostSchemaFailureMessage,
-	validateProdEnv: () => validateProdEnv,
-	validateSecretValues: () => validateSecretValues
-});
 /**
 * Validate plaintext while it is still available to `void secret put/sync`.
 * Existing remote values remain unreadable and are validated again at worker boot.
@@ -430,12 +421,12 @@ function readGeneratedWranglerConfig(root) {
 	try {
 		return {
 			ok: true,
-			config: JSON.parse(readFileSync(redirectedPath, "utf-8"))
+			config: readGeneratedWranglerConfigFile(redirectedPath)
 		};
 	} catch {
 		return {
 			ok: false,
-			reason: `generated wrangler config ${redirectedPath} is not valid JSON.`
+			reason: `generated wrangler config ${redirectedPath} is not valid JSON/JSONC.`
 		};
 	}
 }
@@ -794,7 +785,7 @@ function secretListArgs(configPath) {
 */
 function isWorkerNotFoundOutput(output) {
 	const normalized = output.replace(/\s+/g, " ");
-	return /Worker ".*?"(?: \(env: [^)]*\))? not found\./.test(normalized) && normalized.includes("If this is a new Worker, run `wrangler deploy` first to create it.") && normalized.includes("Otherwise, check that the Worker name is correct and you're logged into the right account.");
+	return /Worker ".*?"(?: \(env: [^)]*\))? not found\./.test(normalized) && (normalized.includes("[code: 10007]") || normalized.includes("[code: 10090]") || normalized.includes("If this is a new Worker, run `wrangler deploy` first to create it.") && normalized.includes("Otherwise, check that the Worker name is correct and you're logged into the right account."));
 }
 /**
 * Build the THROWN message for a wrangler-run failure from the structural
@@ -1014,4 +1005,4 @@ function secretListEnv(accountId, platform) {
 	return env;
 }
 //#endregion
-export { deriveSelfHostEnvContextFromVars as a, fetchRemoteSecretNames as c, readEmittedWorkerVars as d, selfHostSchemaFailureMessage as f, loadUserEnvFile as h, SelfHostSecretListError as i, formatEnvReport as l, validateSecretValues as m, SelfHostFirstDeployError as n, dischargeSelfHostEnvContext as o, validateProdEnv as p, SelfHostSchemaError as r, env_validation_exports as s, SelfHostEnvValidationError as t, listSelfHostSecretNames as u };
+export { validateSecretValues as _, computeInvalidEmittedKeys as a, deriveSelfHostSchemaFacts as c, formatEnvReport as d, listSelfHostSecretNames as f, validateProdEnv as g, selfHostSchemaFailureMessage as h, SelfHostSecretListError as i, dischargeSelfHostEnvContext as l, secretListEnv as m, SelfHostFirstDeployError as n, createDefaultSecretListRunner as o, readEmittedWorkerVars as p, SelfHostSchemaError as r, deriveSelfHostEnvContextFromVars as s, SelfHostEnvValidationError as t, fetchRemoteSecretNames as u, readGeneratedWranglerConfigFile as v, loadUserEnvFile as y };

package/dist/env-validation-DIDGM7h4.mjs

@@ -0,0 +1,2 @@
+import { a as computeInvalidEmittedKeys, c as deriveSelfHostSchemaFacts, p as readEmittedWorkerVars, r as SelfHostSchemaError } from "./env-validation-BsFEXps5.mjs";
+export { SelfHostSchemaError, computeInvalidEmittedKeys, deriveSelfHostSchemaFacts, readEmittedWorkerVars };

package/dist/fetch-CXDChK7B.mjs

@@ -0,0 +1,18 @@
+import { n as ofetch } from "./fetch-error-Dj3crt0e.mjs";
+//#region src/runtime/fetch.ts
+async function fetch(path, options) {
+	let url = path;
+	if (options?.params) for (const [key, value] of Object.entries(options.params)) url = url.replace(`:${key}`, encodeURIComponent(value));
+	return ofetch(url, {
+		method: options?.method ?? "GET",
+		body: options?.body,
+		query: options?.query,
+		headers: options?.headers,
+		signal: options?.signal,
+		baseURL: options?.baseURL,
+		retry: options?.retry,
+		timeout: options?.timeout
+	});
+}
+//#endregion
+export { fetch as t };

package/dist/fetch-_SeGZao9.d.mts

@@ -0,0 +1,57 @@
+import { RouteMap } from "void/routes";
+//#region src/runtime/fetch.d.ts
+type MethodsOf<P extends keyof RouteMap> = keyof RouteMap[P] & string;
+type DefaultMethod<P extends keyof RouteMap> = "GET" extends MethodsOf<P> ? "GET" : never;
+type RouteEntry<P extends keyof RouteMap, M extends MethodsOf<P>> = RouteMap[P][M] extends {
+  input: infer I;
+  output: infer O;
+} ? {
+  input: I;
+  output: O;
+} : {
+  input: {};
+  output: unknown;
+};
+type OutputOf<P extends keyof RouteMap, M extends MethodsOf<P>> = RouteEntry<P, M>["output"];
+type InputOf<P extends keyof RouteMap, M extends MethodsOf<P>> = RouteEntry<P, M>["input"];
+type BodyOption<I> = "body" extends keyof I ? {
+  body: I["body" & keyof I];
+} : {
+  body?: Record<string, unknown> | BodyInit | null;
+};
+type QueryOption<I> = "query" extends keyof I ? {
+  query: I["query" & keyof I];
+} : {
+  query?: Record<string, string>;
+};
+type ParamsOption<I> = "params" extends keyof I ? {
+  params: I["params" & keyof I];
+} : {
+  params?: Record<string, string>;
+};
+type HasRequiredInput<P extends keyof RouteMap, M extends MethodsOf<P>> = "body" extends keyof InputOf<P, M> ? true : "query" extends keyof InputOf<P, M> ? true : "params" extends keyof InputOf<P, M> ? true : false;
+type FetchOptions<P extends keyof RouteMap, M extends MethodsOf<P>> = BodyOption<InputOf<P, M>> & QueryOption<InputOf<P, M>> & ParamsOption<InputOf<P, M>> & {
+  method?: M;
+  headers?: HeadersInit;
+  signal?: AbortSignal;
+  baseURL?: string;
+  retry?: number;
+  timeout?: number;
+};
+/**
+ * Typed fetch client for Void API routes.
+ *
+ * Built on top of ofetch. Supports baseURL, retry, timeout, and all
+ * ofetch features while providing full route type safety.
+ *
+ * ```ts
+ * import { fetch } from "void/client";
+ *
+ * const users = await fetch("/api/users"); // typed!
+ * const user = await fetch("/api/users/:id", { params: { id: "1" } });
+ * ```
+ */
+declare function fetch<P extends keyof RouteMap & string>(path: HasRequiredInput<P, DefaultMethod<P>> extends false ? P : never): Promise<OutputOf<P, DefaultMethod<P>>>;
+declare function fetch<P extends keyof RouteMap & string, M extends MethodsOf<P> = DefaultMethod<P>>(path: P, options: FetchOptions<P, M>): Promise<OutputOf<P, M>>;
+//#endregion
+export { fetch as t };

package/dist/fetch-stream-AOByI7Ki.mjs

@@ -0,0 +1,81 @@
+import { n as ofetch } from "./fetch-error-Dj3crt0e.mjs";
+//#region src/runtime/fetch-stream.ts
+/**
+* Consume an SSE endpoint as an async generator of text chunks.
+*
+* Parses Workers AI SSE format (`data: {"response":"chunk"}` + `data: [DONE]`)
+* and plain text SSE (`data: some text`).
+*
+* ```ts
+* import { fetchStream } from "void/client";
+*
+* for await (const chunk of fetchStream("/api/ai/chat", {
+*   method: "POST",
+*   body: { messages: [{ role: "user", content: "Hello" }] },
+* })) {
+*   output += chunk;
+* }
+* ```
+*
+* @yields {string} Text chunks from SSE data frames.
+*/
+async function* fetchStream(path, options) {
+	let url = path;
+	if (options?.params) for (const [key, value] of Object.entries(options.params)) url = url.replace(`:${key}`, encodeURIComponent(value));
+	const body = (await ofetch.raw(url, {
+		method: options?.method ?? "POST",
+		body: options?.body,
+		query: options?.query,
+		headers: options?.headers,
+		signal: options?.signal,
+		baseURL: options?.baseURL,
+		responseType: "stream"
+	}))._data;
+	if (!body) return;
+	const reader = body.getReader();
+	const decoder = new TextDecoder();
+	let buffer = "";
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			buffer += decoder.decode(value, { stream: true });
+			const lines = buffer.split("\n");
+			buffer = lines.pop();
+			for (const line of lines) {
+				const trimmed = line.trim();
+				if (!trimmed || trimmed.startsWith(":")) continue;
+				if (trimmed.startsWith("data: ")) {
+					const data = trimmed.slice(6);
+					if (data === "[DONE]") return;
+					try {
+						const parsed = JSON.parse(data);
+						if (typeof parsed.response === "string") {
+							yield parsed.response;
+							continue;
+						}
+						if ("response" in parsed) continue;
+					} catch {}
+					yield data;
+				}
+			}
+		}
+		if (buffer.trim()) {
+			const trimmed = buffer.trim();
+			if (trimmed.startsWith("data: ")) {
+				const data = trimmed.slice(6);
+				if (data !== "[DONE]") try {
+					const parsed = JSON.parse(data);
+					if (typeof parsed.response === "string") yield parsed.response;
+					else if (!("response" in parsed)) yield data;
+				} catch {
+					yield data;
+				}
+			}
+		}
+	} finally {
+		reader.releaseLock();
+	}
+}
+//#endregion
+export { fetchStream as t };

package/dist/fetch-stream-Bjf0hoZb.d.mts

@@ -0,0 +1,49 @@
+import { RouteMap } from "void/routes";
+//#region src/runtime/fetch-stream.d.ts
+type MethodsOf<P extends keyof RouteMap> = keyof RouteMap[P] & string;
+type InputOf<P extends keyof RouteMap, M extends MethodsOf<P>> = RouteMap[P][M] extends {
+  input: infer I;
+} ? I : {};
+type BodyOption<I> = "body" extends keyof I ? {
+  body: I["body" & keyof I];
+} : {
+  body?: Record<string, unknown> | BodyInit | null;
+};
+type QueryOption<I> = "query" extends keyof I ? {
+  query: I["query" & keyof I];
+} : {
+  query?: Record<string, string>;
+};
+type ParamsOption<I> = "params" extends keyof I ? {
+  params: I["params" & keyof I];
+} : {
+  params?: Record<string, string>;
+};
+type StreamOptions<P extends keyof RouteMap, M extends MethodsOf<P>> = BodyOption<InputOf<P, M>> & QueryOption<InputOf<P, M>> & ParamsOption<InputOf<P, M>> & {
+  method?: M;
+  headers?: HeadersInit;
+  signal?: AbortSignal;
+  baseURL?: string;
+};
+/**
+ * Consume an SSE endpoint as an async generator of text chunks.
+ *
+ * Parses Workers AI SSE format (`data: {"response":"chunk"}` + `data: [DONE]`)
+ * and plain text SSE (`data: some text`).
+ *
+ * ```ts
+ * import { fetchStream } from "void/client";
+ *
+ * for await (const chunk of fetchStream("/api/ai/chat", {
+ *   method: "POST",
+ *   body: { messages: [{ role: "user", content: "Hello" }] },
+ * })) {
+ *   output += chunk;
+ * }
+ * ```
+ *
+ * @yields {string} Text chunks from SSE data frames.
+ */
+declare function fetchStream<P extends keyof RouteMap & string, M extends MethodsOf<P> = "POST" extends MethodsOf<P> ? "POST" : MethodsOf<P>>(path: P, options?: StreamOptions<P, M>): AsyncGenerator<string, void, undefined>;
+//#endregion
+export { fetchStream as t };

package/dist/gen-B87rlalt.mjs

@@ -0,0 +1,2 @@
+import { r as runGenCommand } from "./gen-pg-Ojg8Y.mjs";
+export { runGenCommand };

package/dist/{gen-B_wPnVTK.mjs → gen-pg-Ojg8Y.mjs}

@@ -1,11 +1,13 @@
-import { c as relative, n as dirname, o as join } from "./dist-BrsS7cai.mjs";
-import { A as outro, C as cancel, D as log, E as intro, I as isCancel, M as select, r as cliTitle } from "./output-B0cfNSx5.mjs";
-import { n as readProjectPaths } from "./project-paths-SK8nMHPp.mjs";
-import { c as getDatabaseDialect, f as readConfig } from "./config-uNGuFsI2.mjs";
-import { n as ensureProjectTsconfig } from "./project-tsconfig-Ql2XsSQp.mjs";
-import { c as collectMigrations, n as listDrizzleArtifacts, t as assertJournalCoherence, u as readJournal } from "./validate-tBBN_dXH.mjs";
-import { n as writeDrizzleConfig } from "./config-NOG_U1aK.mjs";
-import { t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-DxSInkzL.mjs";
+import { a as join, l as relative, n as dirname } from "./dist-4WkAWhWx.mjs";
+import { r as cliTitle } from "./output-CCH48AMM.mjs";
+import { n as readProjectPaths } from "./project-paths-CKQ-Q5JS.mjs";
+import { m as readConfig, u as getDatabaseDialect } from "./config-Dxr6cTXn.mjs";
+import { n as ensureProjectTsconfig } from "./project-tsconfig-CwfqUnVp.mjs";
+import { n as readJournal, t as collectMigrations } from "./collect-DXHNWHcT.mjs";
+import { I as select, O as intro, P as outro, T as cancel, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
+import { t as writeDrizzleConfig } from "./config-BSe70f4T.mjs";
+import { r as listDrizzleArtifacts, t as assertJournalCoherence } from "./validate-qNhV00PD.mjs";
+import { t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-CVEc3gE7.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";
@@ -491,8 +493,8 @@ function runMigration(root, name) {
 		}
 		const configDialect = getDatabaseDialect(readConfig(root));
 		if (configDialect !== journalDialect) {
-			log.error(`db/migrations/meta/_journal.json was generated for ${journalDialect}, but void.json is configured for ${configDialect}.`);
-			log.error(`Generating a new custom migration now would append a snapshot in the wrong dialect. Revert void.json's \`database\` field to ${journalDialect}, or drop db/migrations/ and regenerate from scratch.`);
+			log.error(`db/migrations/meta/_journal.json was generated for ${journalDialect}, but void.config.ts is configured for ${configDialect}.`);
+			log.error(`Generating a new custom migration now would append a snapshot in the wrong dialect. Revert void.config.ts's \`database\` field to ${journalDialect}, or drop db/migrations/ and regenerate from scratch.`);
 			process.exit(1);
 		}
 		const authSchemaPath = join(root, ".void", "better-auth-schema.ts");
@@ -817,4 +819,4 @@ export default function App() {
 `);
 }
 //#endregion
-export { formatTimestamp, runGenCommand };
+export { formatTimestamp as n, runGenCommand as r, detectValidator as t };

package/dist/{generate-RTK8_kK1.mjs → generate-C0VY6RVf.mjs}

@@ -1,5 +1,5 @@
-import { n as dirname, o as join } from "./dist-BrsS7cai.mjs";
-import { c as collectMigrations } from "./validate-tBBN_dXH.mjs";
+import { a as join, n as dirname } from "./dist-4WkAWhWx.mjs";
+import { t as collectMigrations } from "./collect-DXHNWHcT.mjs";
 import { n as openMigrationValidationDatabase } from "./sqlite-validation-BzKMWnO4.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 //#region src/drizzle/generate.ts

package/dist/{github-cmd-C-z_xRrQ.mjs → github-cmd-DsrkweIl.mjs}

@@ -1,7 +1,9 @@
-import { C as cancel, D as log, I as isCancel, M as select, P as text, c as import_picocolors, w as confirm } from "./output-B0cfNSx5.mjs";
-import { S as readProjectConfig, f as openBrowser, i as createCodeVerifier, l as getToken, n as awaitBrowserCallback, r as createCodeChallenge } from "./auth-DPl6kck4.mjs";
-import { n as PlatformClient, o as parsePlatformErrorBody, s as platformErrorMessage, t as PlatformApiError } from "./client-BQBrZoCX.mjs";
-import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project--Vxawf7z.mjs";
+import { c as import_picocolors } from "./output-CCH48AMM.mjs";
+import { c as getToken, d as openBrowser, n as createCodeChallenge, r as createCodeVerifier, t as awaitBrowserCallback } from "./auth-B9_D6ygs.mjs";
+import { o as readProjectConfig } from "./project-CWNIPoXc.mjs";
+import { B as text, E as confirm, I as select, T as cancel, W as isCancel, j as log } from "./dist-Dn6nn2IU.mjs";
+import { n as PlatformClient, o as parsePlatformErrorBody, s as platformErrorMessage, t as PlatformApiError } from "./client-PdAJ-F0t.mjs";
+import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-Xvis70DG.mjs";
 import { t as collectGitDeployMetadata } from "./git-metadata-D-gurjzG.mjs";
 import { randomBytes } from "node:crypto";
 //#region src/cli/github-cmd.ts

package/dist/{handler-D1hLsObx.d.mts → handler-BXJTXd02.d.mts}

@@ -80,6 +80,11 @@ interface CloudContextVariables {
   headDefaults?: HeadDescriptor;
   [key: string]: unknown;
 }
+declare global {
+  interface VoidGeneratedEnvBindings {
+    readonly [key: string]: unknown;
+  }
+}
 /**
  * Hono `Bindings` shape for Void workers.
  *
@@ -88,7 +93,7 @@ interface CloudContextVariables {
  * working for bindings that aren't in the schema (queues, custom
  * bindings, etc.).
  */
-interface CloudBindings {
+interface CloudBindings extends VoidGeneratedEnvBindings {
   DB: D1Database;
   KV: KVNamespace;
   STORAGE: R2Bucket;

package/dist/handler-DghKr6dU.mjs

@@ -0,0 +1,150 @@
+import { t as convertReturnValue } from "./response-Tn7rU0MV.mjs";
+import { t as runValidation } from "./validator-BTOu0fB0.mjs";
+//#region src/runtime/handler.ts
+/**
+* Thrown when `c.rewrite()` is called with a destination whose final path
+* segment ends in a known static-asset extension (e.g. `/hero.png`,
+* `/app.css`). Runtime rewrites only reach routes and SSR entries inside
+* the worker — static asset handlers run in front of the worker, so a
+* `c.rewrite()` into an asset path re-enters the Hono router, matches
+* nothing, and returns a 404. Fail at the call site so users reach for
+* static `routing.rewrites` instead of debugging a mystery 404.
+*/
+var VoidAssetRewriteError = class extends Error {
+	name = "VoidAssetRewriteError";
+	constructor(destination) {
+		super(`c.rewrite() cannot re-dispatch to a static asset path (${JSON.stringify(destination)}). Runtime rewrites only reach routes and SSR entries inside the worker — static asset handlers run in front of the worker. To rewrite into an asset, use a static \`routing.rewrites\` rule in void.json or a \`200!\` entry in _redirects. See https://void.dev/guide/edge/rewrites#runtime-rewrites-cannot-reach-static-assets`);
+	}
+};
+function defineHandler(...args) {
+	if (args.length === 1) return args[0];
+	const middlewares = args.slice(0, -1);
+	const handler = args[args.length - 1];
+	return (async (c) => {
+		let index = 0;
+		const dispatch = async () => {
+			if (index < middlewares.length) {
+				const middleware = middlewares[index++];
+				const middlewareResponse = await middleware(c, dispatch);
+				if (middlewareResponse instanceof Response) c.res = middlewareResponse;
+			} else c.res = convertReturnValue(await handler(c));
+		};
+		await dispatch();
+		return c.res;
+	});
+}
+(function(_defineHandler) {
+	function withValidator(validators) {
+		return (handler) => {
+			return (async (c) => {
+				const result = await runValidation(validators, c);
+				if (!result.ok) return result.response;
+				return convertReturnValue(await handler(c, result.input));
+			});
+		};
+	}
+	_defineHandler.withValidator = withValidator;
+})(defineHandler || (defineHandler = {}));
+/**
+* Identity function that provides type inference for middleware.
+* At runtime it simply returns the function passed to it.
+*/
+function defineMiddleware(handler) {
+	return handler;
+}
+const basicAuthEncoder = new TextEncoder();
+const basicAuthDecoder = new TextDecoder("utf-8", { fatal: true });
+function parseBasicAuthHeader(authorization) {
+	if (!authorization?.toLowerCase().startsWith("basic ")) return null;
+	try {
+		const encoded = authorization.slice(6).trim();
+		const binary = atob(encoded);
+		const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+		const decoded = basicAuthDecoder.decode(bytes);
+		const separator = decoded.indexOf(":");
+		if (separator === -1) return null;
+		return {
+			username: decoded.slice(0, separator),
+			password: decoded.slice(separator + 1)
+		};
+	} catch {
+		return null;
+	}
+}
+function timingSafeStringEqual(actual, expected) {
+	const actualBytes = basicAuthEncoder.encode(actual);
+	const expectedBytes = basicAuthEncoder.encode(expected);
+	let difference = actualBytes.length ^ expectedBytes.length;
+	for (let i = 0; i < expectedBytes.length; i++) difference |= (actualBytes[i] ?? 0) ^ expectedBytes[i];
+	return difference === 0;
+}
+function isVoidInternalPath(pathname) {
+	return pathname === "/__void" || pathname.startsWith("/__void/");
+}
+function basicAuthChallenge(realm, message) {
+	const escapedRealm = realm.replace(/["\\]/g, "\\$&");
+	return new Response(message, {
+		status: 401,
+		headers: {
+			"Cache-Control": "no-store",
+			"WWW-Authenticate": `Basic realm="${escapedRealm}", charset="UTF-8"`
+		}
+	});
+}
+function resolveBasicAuthOption(value, fallback) {
+	if (value === void 0) return fallback;
+	return typeof value === "function" ? value() : value;
+}
+/**
+* Create Basic authentication middleware for temporary site gates and
+* pre-launch protection.
+*
+* Void internal endpoints under `/__void` are always excluded so deploy-time
+* migrations, prerendering, cron/queue dispatch, and remote binding helpers
+* continue to reach Void's own internal-token checks.
+*/
+function basicAuth(options) {
+	return defineMiddleware(async (c, next) => {
+		if (isVoidInternalPath(c.req.path)) {
+			await next();
+			return;
+		}
+		const username = resolveBasicAuthOption(options.username, "");
+		const password = resolveBasicAuthOption(options.password, "");
+		const credentials = parseBasicAuthHeader(c.req.raw.headers.get("Authorization"));
+		const usernameMatches = credentials && timingSafeStringEqual(credentials.username, username);
+		const passwordMatches = credentials && timingSafeStringEqual(credentials.password, password);
+		if (!usernameMatches || !passwordMatches) return basicAuthChallenge(resolveBasicAuthOption(options.realm, "Restricted"), resolveBasicAuthOption(options.message, "Authentication required"));
+		await next();
+	});
+}
+/**
+* Identity function that provides type inference for scheduled jobs.
+* At runtime it simply returns the function passed to it.
+*/
+function defineScheduled(handler) {
+	return handler;
+}
+/**
+* Identity function that provides type inference for SSR render entry.
+* The second argument includes asset tags for client scripts/styles.
+*/
+function defineRender(handler) {
+	return handler;
+}
+/**
+* Identity function that provides type inference for page `head()` exports.
+* At runtime it simply returns the function passed to it.
+*/
+function defineHead(handler) {
+	return handler;
+}
+/**
+* Identity function that provides type inference for queue consumers.
+* At runtime it simply returns the function passed to it.
+*/
+function defineQueue(handler) {
+	return handler;
+}
+//#endregion
+export { defineMiddleware as a, defineScheduled as c, defineHead as i, basicAuth as n, defineQueue as o, defineHandler as r, defineRender as s, VoidAssetRewriteError as t };

package/dist/head-D_QRR5Yd.mjs

@@ -0,0 +1,112 @@
+//#region src/pages/head.ts
+/**
+* Merge head descriptors with precedence: page > middleware > config.
+*
+* - `title`: page wins; `titleTemplate` from config wraps it (`%s` replaced)
+* - `meta`: page overrides entries with same `name`/`property`; others appended
+* - `link`/`script`: concatenated (config first, then middleware, then page)
+* - `htmlAttrs`/`bodyAttrs`: shallow merge, page wins conflicts
+*/
+function resolveHead(configHead, middlewareHead, pageHead) {
+	if (!configHead && !middlewareHead && !pageHead) return;
+	const result = {};
+	const title = pageHead?.title ?? middlewareHead?.title ?? configHead?.title;
+	if (title !== void 0) {
+		const template = configHead?.titleTemplate;
+		result.title = template ? template.replace("%s", title) : title;
+	}
+	const metaMap = /* @__PURE__ */ new Map();
+	const metaOrder = [];
+	for (const layer of [
+		configHead,
+		middlewareHead,
+		pageHead
+	]) {
+		if (!layer?.meta) continue;
+		for (const entry of layer.meta) {
+			const key = entry.charset ? "charset" : entry.property ? `property:${entry.property}` : `name:${entry.name ?? ""}`;
+			if (!metaMap.has(key)) metaOrder.push(key);
+			metaMap.set(key, entry);
+		}
+	}
+	if (metaMap.size > 0) result.meta = metaOrder.map((key) => metaMap.get(key));
+	const links = [];
+	for (const layer of [
+		configHead,
+		middlewareHead,
+		pageHead
+	]) if (layer?.link) links.push(...layer.link);
+	if (links.length > 0) result.link = links;
+	const scripts = [];
+	for (const layer of [
+		configHead,
+		middlewareHead,
+		pageHead
+	]) if (layer?.script) scripts.push(...layer.script);
+	if (scripts.length > 0) result.script = scripts;
+	const htmlAttrs = {};
+	let hasHtmlAttrs = false;
+	for (const layer of [
+		configHead,
+		middlewareHead,
+		pageHead
+	]) if (layer?.htmlAttrs) {
+		Object.assign(htmlAttrs, layer.htmlAttrs);
+		hasHtmlAttrs = true;
+	}
+	if (hasHtmlAttrs) result.htmlAttrs = htmlAttrs;
+	const bodyAttrs = {};
+	let hasBodyAttrs = false;
+	for (const layer of [
+		configHead,
+		middlewareHead,
+		pageHead
+	]) if (layer?.bodyAttrs) {
+		Object.assign(bodyAttrs, layer.bodyAttrs);
+		hasBodyAttrs = true;
+	}
+	if (hasBodyAttrs) result.bodyAttrs = bodyAttrs;
+	if (result.title === void 0 && !result.meta && !result.link && !result.script && !result.htmlAttrs && !result.bodyAttrs) return;
+	return result;
+}
+function escapeHtml(s) {
+	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+/** Serialize a HeadDescriptor to HTML tags for injection into `<head>`. */
+function renderHeadToString(head) {
+	const parts = [];
+	if (head.title !== void 0) parts.push(`<title>${escapeHtml(head.title)}</title>`);
+	if (head.meta) for (const entry of head.meta) {
+		const attrs = [];
+		if (entry.charset) attrs.push(`charset="${escapeHtml(entry.charset)}"`);
+		if (entry.name) attrs.push(`name="${escapeHtml(entry.name)}"`);
+		if (entry.property) attrs.push(`property="${escapeHtml(entry.property)}"`);
+		if (entry.content !== void 0) attrs.push(`content="${escapeHtml(entry.content)}"`);
+		parts.push(`<meta ${attrs.join(" ")}>`);
+	}
+	if (head.link) for (const entry of head.link) {
+		const attrs = Object.entries(entry).filter(([, value]) => value != null).map(([key, value]) => `${key}="${escapeHtml(value)}"`).join(" ");
+		parts.push(`<link ${attrs}>`);
+	}
+	if (head.script) for (const entry of head.script) {
+		const { innerHTML, ...rest } = entry;
+		const attrs = Object.entries(rest).filter(([, value]) => value != null).map(([key, value]) => `${key}="${escapeHtml(value)}"`).join(" ");
+		if (innerHTML) parts.push(`<script${attrs ? " " + attrs : ""}>${innerHTML}<\/script>`);
+		else if (attrs) parts.push(`<script ${attrs}><\/script>`);
+	}
+	return parts.join("\n");
+}
+/** Serialize htmlAttrs to an attribute string (includes leading space). */
+function renderHtmlAttrs(head) {
+	if (!head.htmlAttrs) return "";
+	const attrs = Object.entries(head.htmlAttrs).map(([key, value]) => `${key}="${escapeHtml(value)}"`).join(" ");
+	return attrs ? " " + attrs : "";
+}
+/** Serialize bodyAttrs to an attribute string (includes leading space). */
+function renderBodyAttrs(head) {
+	if (!head.bodyAttrs) return "";
+	const attrs = Object.entries(head.bodyAttrs).map(([key, value]) => `${key}="${escapeHtml(value)}"`).join(" ");
+	return attrs ? " " + attrs : "";
+}
+//#endregion
+export { resolveHead as i, renderHeadToString as n, renderHtmlAttrs as r, renderBodyAttrs as t };