void 0.9.2 → 0.10.1

package/dist/runtime/client.mjs

@@ -1,4 +1,4 @@
-import { t as FetchError } from "../fetch-error-BFIoojjf.mjs";
+import { t as FetchError } from "../fetch-error-C6qffTl2.mjs";
 import { fetch } from "./fetch.mjs";
 import { fetchStream } from "./fetch-stream.mjs";
 import { auth, createAuthClient } from "./auth-client.mjs";

package/dist/runtime/env-helpers.d.mts

@@ -1,2 +1,2 @@
-import { a as getSecretOverride, c as oneOf, i as email, l as string, n as SECRET_OVERRIDE_SYMBOL, o as json, r as boolean, s as number, t as EnvSchema, u as url } from "../env-helpers-Bd2wVdxz.mjs";
+import { a as getSecretOverride, c as oneOf, i as email, l as string, n as SECRET_OVERRIDE_SYMBOL, o as json, r as boolean, s as number, t as EnvSchema, u as url } from "../env-helpers-ZatKyjen.mjs";
 export { EnvSchema, SECRET_OVERRIDE_SYMBOL, boolean, email, getSecretOverride, json, number, oneOf, string, url };

package/dist/runtime/env-public-client.d.mts

@@ -1,4 +1,4 @@
-import { c as oneOf, i as email, l as string, o as json, r as boolean, s as number, t as EnvSchema, u as url } from "../env-helpers-Bd2wVdxz.mjs";
+import { c as oneOf, i as email, l as string, o as json, r as boolean, s as number, t as EnvSchema, u as url } from "../env-helpers-ZatKyjen.mjs";
 
 //#region src/runtime/env-public-client.d.ts
 declare const env: Record<string, unknown>;

package/dist/runtime/env-public.d.mts

@@ -1,6 +1,6 @@
 /// <reference types="@cloudflare/workers-types" />
-import { t as StandardSchemaV1 } from "../standard-schema-Dnsh2vnl.mjs";
-import { c as oneOf, i as email, l as string, o as json, r as boolean, s as number, t as EnvSchema, u as url } from "../env-helpers-Bd2wVdxz.mjs";
+import { t as StandardSchemaV1 } from "../standard-schema-BCBv-QaP.mjs";
+import { c as oneOf, i as email, l as string, o as json, r as boolean, s as number, t as EnvSchema, u as url } from "../env-helpers-ZatKyjen.mjs";
 import * as _$_cloudflare_sandbox0 from "@cloudflare/sandbox";
 
 //#region src/runtime/env-public.d.ts

package/dist/runtime/env-public.mjs

@@ -1,4 +1,4 @@
-import { i as getRawRuntimeEnv } from "../env-raw-RDkMnSTC.mjs";
+import { i as getRawRuntimeEnv } from "../env-raw-Dtj1UAoK.mjs";
 import { getRuntimeEnv } from "./env.mjs";
 import { boolean, email, getSecretOverride, json, number, oneOf, string, url } from "./env-helpers.mjs";
 //#region src/shared/env-mask.ts

package/dist/runtime/env.mjs

@@ -1,4 +1,4 @@
-import { i as getRawRuntimeEnv, n as asEnv, r as envContext, t as INTERNAL_BINDING_PREFIXES } from "../env-raw-RDkMnSTC.mjs";
+import { i as getRawRuntimeEnv, n as asEnv, r as envContext, t as INTERNAL_BINDING_PREFIXES } from "../env-raw-Dtj1UAoK.mjs";
 //#region src/runtime/env.ts
 /**
 * Public runtime env API — exposed via "void/_env".

package/dist/runtime/fetch-stream.d.mts

@@ -1,4 +1,4 @@
-import { t as FetchError } from "../fetch-error-CimrygMq.mjs";
+import { t as FetchError } from "../fetch-error-BQMdPvge.mjs";
 import { RouteMap } from "void/routes";
 
 //#region src/runtime/fetch-stream.d.ts

package/dist/runtime/fetch-stream.mjs

@@ -1,4 +1,4 @@
-import { n as ofetch, t as FetchError } from "../fetch-error-BFIoojjf.mjs";
+import { n as ofetch, t as FetchError } from "../fetch-error-C6qffTl2.mjs";
 //#region src/runtime/fetch-stream.ts
 /**
 * Consume an SSE endpoint as an async generator of text chunks.

package/dist/runtime/fetch.d.mts

@@ -1,4 +1,4 @@
-import { t as FetchError } from "../fetch-error-CimrygMq.mjs";
+import { t as FetchError } from "../fetch-error-BQMdPvge.mjs";
 import { RouteMap } from "void/routes";
 
 //#region src/runtime/fetch.d.ts

package/dist/runtime/fetch.mjs

@@ -1,4 +1,4 @@
-import { n as ofetch, t as FetchError } from "../fetch-error-BFIoojjf.mjs";
+import { n as ofetch, t as FetchError } from "../fetch-error-C6qffTl2.mjs";
 //#region src/runtime/fetch.ts
 async function fetch(path, options) {
 	let url = path;

package/dist/runtime/handler.d.mts

@@ -1,3 +1,3 @@
 /// <reference types="@cloudflare/workers-types" />
-import { C as HandlerInput, S as ValidationError, _ as defineScheduled, a as QueueBatch, b as InferProps, c as RenderAssetTags, d as VoidAssetRewriteError, f as defineHandler, g as defineRender, h as defineQueue, i as CloudEnv, l as TypedHandler, m as defineMiddleware, n as CloudContext, o as QueueMessage, p as defineHead, r as CloudContextVariables, s as QueueRetryOptions, t as CloudBindings, u as TypedQueueHandler, v as Deferred, w as ValidatorSlots, x as defer } from "../handler-xflsMwWM.mjs";
-export { CloudBindings, CloudContext, CloudContextVariables, CloudEnv, Deferred, HandlerInput, InferProps, QueueBatch, QueueMessage, QueueRetryOptions, RenderAssetTags, TypedHandler, TypedQueueHandler, ValidationError, ValidatorSlots, VoidAssetRewriteError, defer, defineHandler, defineHead, defineMiddleware, defineQueue, defineRender, defineScheduled };
+import { C as defer, E as ValidatorSlots, S as InferProps, T as HandlerInput, _ as defineQueue, a as CloudEnv, b as Deferred, c as QueueRetryOptions, d as TypedQueueHandler, f as VoidAssetRewriteError, g as defineMiddleware, h as defineHead, i as CloudContextVariables, l as RenderAssetTags, m as defineHandler, n as CloudBindings, o as QueueBatch, p as basicAuth, r as CloudContext, s as QueueMessage, t as BasicAuthOptions, u as TypedHandler, v as defineRender, w as ValidationError, y as defineScheduled } from "../handler-DczZlaXR.mjs";
+export { BasicAuthOptions, CloudBindings, CloudContext, CloudContextVariables, CloudEnv, Deferred, HandlerInput, InferProps, QueueBatch, QueueMessage, QueueRetryOptions, RenderAssetTags, TypedHandler, TypedQueueHandler, ValidationError, ValidatorSlots, VoidAssetRewriteError, basicAuth, defer, defineHandler, defineHead, defineMiddleware, defineQueue, defineRender, defineScheduled };

package/dist/runtime/handler.mjs

@@ -1,6 +1,6 @@
 import { convertReturnValue } from "./response.mjs";
 import { runValidation } from "./validator.mjs";
-import { i as ValidationError, n as defer } from "../defer-CouVukrf.mjs";
+import { i as ValidationError, n as defer } from "../defer-C-bdSM_b.mjs";
 //#region src/runtime/handler.ts
 /**
 * Thrown when `c.rewrite()` is called with a destination whose final path
@@ -53,6 +53,72 @@ function defineHandler(...args) {
 function defineMiddleware(handler) {
 	return handler;
 }
+const basicAuthEncoder = new TextEncoder();
+const basicAuthDecoder = new TextDecoder("utf-8", { fatal: true });
+function parseBasicAuthHeader(authorization) {
+	if (!authorization?.toLowerCase().startsWith("basic ")) return null;
+	try {
+		const encoded = authorization.slice(6).trim();
+		const binary = atob(encoded);
+		const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+		const decoded = basicAuthDecoder.decode(bytes);
+		const separator = decoded.indexOf(":");
+		if (separator === -1) return null;
+		return {
+			username: decoded.slice(0, separator),
+			password: decoded.slice(separator + 1)
+		};
+	} catch {
+		return null;
+	}
+}
+function timingSafeStringEqual(actual, expected) {
+	const actualBytes = basicAuthEncoder.encode(actual);
+	const expectedBytes = basicAuthEncoder.encode(expected);
+	let difference = actualBytes.length ^ expectedBytes.length;
+	for (let i = 0; i < expectedBytes.length; i++) difference |= (actualBytes[i] ?? 0) ^ expectedBytes[i];
+	return difference === 0;
+}
+function isVoidInternalPath(pathname) {
+	return pathname === "/__void" || pathname.startsWith("/__void/");
+}
+function basicAuthChallenge(realm, message) {
+	const escapedRealm = realm.replace(/["\\]/g, "\\$&");
+	return new Response(message, {
+		status: 401,
+		headers: {
+			"Cache-Control": "no-store",
+			"WWW-Authenticate": `Basic realm="${escapedRealm}", charset="UTF-8"`
+		}
+	});
+}
+function resolveBasicAuthOption(value, fallback) {
+	if (value === void 0) return fallback;
+	return typeof value === "function" ? value() : value;
+}
+/**
+* Create Basic authentication middleware for temporary site gates and
+* pre-launch protection.
+*
+* Void internal endpoints under `/__void` are always excluded so deploy-time
+* migrations, prerendering, cron/queue dispatch, and remote binding helpers
+* continue to reach Void's own internal-token checks.
+*/
+function basicAuth(options) {
+	return defineMiddleware(async (c, next) => {
+		if (isVoidInternalPath(c.req.path)) {
+			await next();
+			return;
+		}
+		const username = resolveBasicAuthOption(options.username, "");
+		const password = resolveBasicAuthOption(options.password, "");
+		const credentials = parseBasicAuthHeader(c.req.raw.headers.get("Authorization"));
+		const usernameMatches = credentials && timingSafeStringEqual(credentials.username, username);
+		const passwordMatches = credentials && timingSafeStringEqual(credentials.password, password);
+		if (!usernameMatches || !passwordMatches) return basicAuthChallenge(resolveBasicAuthOption(options.realm, "Restricted"), resolveBasicAuthOption(options.message, "Authentication required"));
+		await next();
+	});
+}
 /**
 * Identity function that provides type inference for scheduled jobs.
 * At runtime it simply returns the function passed to it.
@@ -82,4 +148,4 @@ function defineQueue(handler) {
 	return handler;
 }
 //#endregion
-export { ValidationError, VoidAssetRewriteError, defer, defineHandler, defineHead, defineMiddleware, defineQueue, defineRender, defineScheduled };
+export { ValidationError, VoidAssetRewriteError, basicAuth, defer, defineHandler, defineHead, defineMiddleware, defineQueue, defineRender, defineScheduled };

package/dist/runtime/isr.mjs

@@ -1,4 +1,4 @@
-import { i as getRawRuntimeEnv } from "../env-raw-RDkMnSTC.mjs";
+import { i as getRawRuntimeEnv } from "../env-raw-Dtj1UAoK.mjs";
 //#region src/runtime/isr.ts
 /**
 * Revalidate ISR-cached pages on demand.

package/dist/runtime/live.d.mts

@@ -1,6 +1,6 @@
 /// <reference types="@cloudflare/workers-types" />
-import { r as AuthUser } from "../auth-CDeb2XAl.mjs";
-import { i as CloudEnv, n as CloudContext } from "../handler-xflsMwWM.mjs";
+import { r as AuthUser } from "../auth-nEUVHuFI.mjs";
+import { a as CloudEnv, r as CloudContext } from "../handler-DczZlaXR.mjs";
 
 //#region src/runtime/live.d.ts
 type MaybePromise<T> = T | Promise<T>;

package/dist/runtime/live.mjs

@@ -1,4 +1,4 @@
-import { i as getRawRuntimeEnv } from "../env-raw-RDkMnSTC.mjs";
+import { i as getRawRuntimeEnv } from "../env-raw-Dtj1UAoK.mjs";
 import { getUser } from "./auth.mjs";
 //#region src/runtime/live.ts
 let liveBindingName = "VOID_LIVE";

package/dist/runtime/migration-handler-pg.mjs

@@ -1,4 +1,4 @@
-import { t as disablePgPassFallback } from "../pg-CMZ_5wsC.mjs";
+import { t as disablePgPassFallback } from "../pg-CempqvEJ.mjs";
 //#region src/runtime/migration-handler-pg.ts
 function createMigrationHandler(env, migrations, _dialect, runAuthMigrations) {
 	return async (request) => {

package/dist/runtime/sandbox.mjs

@@ -1,4 +1,4 @@
-import { i as getRawRuntimeEnv } from "../env-raw-RDkMnSTC.mjs";
+import { i as getRawRuntimeEnv } from "../env-raw-Dtj1UAoK.mjs";
 import { requireRuntimeBinding } from "./env.mjs";
 import { Sandbox, getSandbox as getSandbox$1 } from "@cloudflare/sandbox";
 //#region src/runtime/sandbox.ts

package/dist/runtime/validator.d.mts

@@ -1,2 +1,2 @@
-import { C as HandlerInput, T as runValidation, w as ValidatorSlots } from "../handler-xflsMwWM.mjs";
+import { D as runValidation, E as ValidatorSlots, T as HandlerInput } from "../handler-DczZlaXR.mjs";
 export { HandlerInput, ValidatorSlots, runValidation };

package/dist/runtime/ws-server.d.mts

@@ -1,5 +1,5 @@
-import { n as AuthState } from "../auth-CDeb2XAl.mjs";
-import { i as VoidAuthRuntimeOptions, n as VoidAuthEnv } from "../better-auth-shared-CmEQZs1T.mjs";
+import { n as AuthState } from "../auth-nEUVHuFI.mjs";
+import { i as VoidAuthRuntimeOptions, n as VoidAuthEnv } from "../better-auth-shared-a7H3wk9J.mjs";
 import { AnyWebSocketDefinition } from "./ws.mjs";
 
 //#region src/runtime/ws-server.d.ts

package/dist/runtime/ws.d.mts

@@ -1,6 +1,6 @@
-import { r as AuthUser } from "../auth-CDeb2XAl.mjs";
-import { t as StandardSchemaV1 } from "../standard-schema-Dnsh2vnl.mjs";
-import { i as CloudEnv } from "../handler-xflsMwWM.mjs";
+import { r as AuthUser } from "../auth-nEUVHuFI.mjs";
+import { t as StandardSchemaV1 } from "../standard-schema-BCBv-QaP.mjs";
+import { a as CloudEnv } from "../handler-DczZlaXR.mjs";
 import { WebSocketRouteMap } from "void/routes";
 
 //#region src/runtime/ws.d.ts

package/dist/{scan-BNC_1OsY.mjs → scan-DGEp1-1Q.mjs}

@@ -1,8 +1,8 @@
 import { a as join, i as isAbsolute, t as basename } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
 import { n as readProjectPaths } from "./project-paths-CCMrHYQm.mjs";
-import { n as globSync, t as glob } from "./dist-DR9sIMbM.mjs";
-import { d as isCallExpression, f as isIdentifier, h as isObjectExpression, p as isLiteral } from "./plugin-inference-BUBhHt_1.mjs";
-import { o as parseRouteFilename, s as parseWebSocketFilename, t as scanPages } from "./scan-2YmJkYAf.mjs";
+import { n as globSync, t as glob } from "./dist-5cGIJHQQ.mjs";
+import { d as isCallExpression, f as isIdentifier, h as isObjectExpression, p as isLiteral } from "./plugin-inference-C3fLzFvP.mjs";
+import { o as parseRouteFilename, s as parseWebSocketFilename, t as scanPages } from "./scan-VCAM1oh3.mjs";
 import { readFileSync } from "node:fs";
 import { parseSync } from "vite";
 //#region src/crons/scan.ts
@@ -147,6 +147,7 @@ function detectHttpExports(absPath) {
 	const program = parsed.program;
 	for (const node of program.body ?? []) if (node.type === "ExportNamedDeclaration") {
 		const declarationNode = node;
+		if (declarationNode.exportKind === "type") continue;
 		const decl = declarationNode.declaration;
 		if (decl) {
 			if (decl.type === "VariableDeclaration") {
@@ -157,6 +158,7 @@ function detectHttpExports(absPath) {
 			}
 		}
 		if (declarationNode.specifiers) for (const spec of declarationNode.specifiers) {
+			if (spec.exportKind === "type") continue;
 			const exported = isIdentifier(spec.exported) ? spec.exported.name : isIdentifier(spec.local) ? spec.local.name : void 0;
 			if (exported && HTTP_METHODS.has(exported)) methods.push(exported);
 		}
@@ -286,6 +288,18 @@ function parseMiddlewareDefinitions(files) {
 		};
 	}).sort((a, b) => a.order - b.order);
 }
+function compareRouteSpecificity(a, b) {
+	if (a.catchAll !== b.catchAll) return a.catchAll ? 1 : -1;
+	const aSegments = a.pattern.split("/");
+	const bSegments = b.pattern.split("/");
+	const shared = Math.min(aSegments.length, bSegments.length);
+	for (let i = 0; i < shared; i++) {
+		const aDynamic = aSegments[i].startsWith(":") || aSegments[i] === "*";
+		if (aDynamic !== (bSegments[i].startsWith(":") || bSegments[i] === "*")) return aDynamic ? 1 : -1;
+		if (aSegments[i] !== bSegments[i]) return aSegments[i].localeCompare(bSegments[i]);
+	}
+	return aSegments.length - bSegments.length;
+}
 /**
 * Scan routes/ and middleware/ directories and return a structured manifest.
 * Files starting with _ are ignored.
@@ -315,10 +329,7 @@ async function scanRoutes(root, options) {
 			const route = parseRouteFilename(f);
 			route.methods = detectHttpExports(join(routesDir, f));
 			return route;
-		}).sort((a, b) => {
-			if (a.catchAll !== b.catchAll) return a.catchAll ? 1 : -1;
-			return a.pattern.localeCompare(b.pattern);
-		}),
+		}).sort(compareRouteSpecificity),
 		websockets,
 		middleware: parseMiddlewareDefinitions(middlewareFiles),
 		jobs,
@@ -348,10 +359,7 @@ function scanRoutePatternsSync(root, paths = readProjectPaths(root)) {
 	} catch {
 		routeFiles = [];
 	}
-	return routeFiles.filter((f) => !isWebSocketPatternFile(f)).filter((f) => !f.split("/").some((s) => s.startsWith("_"))).map((f) => parseRouteFilename(f)).sort((a, b) => {
-		if (a.catchAll !== b.catchAll) return a.catchAll ? 1 : -1;
-		return a.pattern.localeCompare(b.pattern);
-	});
+	return routeFiles.filter((f) => !isWebSocketPatternFile(f)).filter((f) => !f.split("/").some((s) => s.startsWith("_"))).map((f) => parseRouteFilename(f)).sort(compareRouteSpecificity);
 }
 //#endregion
 export { scanQueuesSync as a, scanWebSocketRoutesSync as i, scanRoutePatternsSync as n, scanJobsSync as o, scanRoutes as r, scanMiddlewareSync as t };

package/dist/{scan-2YmJkYAf.mjs → scan-VCAM1oh3.mjs}

@@ -1,6 +1,6 @@
 import { a as join, n as dirname, r as extname, t as basename } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
 import { n as readProjectPaths } from "./project-paths-CCMrHYQm.mjs";
-import { t as glob } from "./dist-DR9sIMbM.mjs";
+import { t as glob } from "./dist-5cGIJHQQ.mjs";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/router/parse-filename.ts
 const EXTENSIONS = [
@@ -83,30 +83,29 @@ function toLayoutId(layout) {
 	if (isNamedLayout(layout)) return layout.directory ? `${layout.directory}/_layouts/${layout.name}` : `_layouts/${layout.name}`;
 	return layout.directory ? `${layout.directory}/layout` : "layout";
 }
-/** Resolve the layout chain for a component (innermost last) */
-function resolveLayoutChain(componentId, layouts) {
+function resolveLayoutDirectories(componentId, componentPath) {
+	if (componentPath) {
+		const segments = componentPath.split("/");
+		segments.pop();
+		return segments.map((_, index) => segments.slice(0, index + 1).join("/"));
+	}
 	const parts = componentId.split("/");
+	return parts.slice(0, -1).map((_, index) => parts.slice(0, index + 1).join("/"));
+}
+/** Resolve the layout chain for a component (innermost last) */
+function resolveLayoutChain(componentId, layouts, componentPath) {
 	const chain = [];
 	const root = layouts.find((layout) => layout.directory === "");
 	if (root) chain.push(root);
-	let dir = "";
-	for (let partIndex = 0; partIndex < parts.length - 1; partIndex++) {
-		dir = dir ? `${dir}/${parts[partIndex]}` : parts[partIndex];
+	for (const dir of resolveLayoutDirectories(componentId, componentPath)) {
 		const layout = layouts.find((candidate) => candidate.directory === dir);
 		if (layout) chain.push(layout);
 	}
 	return chain;
 }
 /** Walk up directory tree to find closest _layouts/<name> */
-function resolveNamedLayout(name, componentId, namedLayouts) {
-	const parts = componentId.split("/");
-	const dirs = [];
-	let dir = "";
-	for (let partIndex = 0; partIndex < parts.length - 1; partIndex++) {
-		dir = dir ? `${dir}/${parts[partIndex]}` : parts[partIndex];
-		dirs.push(dir);
-	}
-	dirs.reverse();
+function resolveNamedLayout(name, componentId, namedLayouts, componentPath) {
+	const dirs = resolveLayoutDirectories(componentId, componentPath).reverse();
 	dirs.push("");
 	for (const directory of dirs) {
 		const found = namedLayouts.find((namedLayout) => namedLayout.name === name && namedLayout.directory === directory);
@@ -116,7 +115,7 @@ function resolveNamedLayout(name, componentId, namedLayouts) {
 }
 function resolveEffectiveLayoutEntries(page, layouts, namedLayouts) {
 	if (page.layout === false) return [];
-	const defaultChain = resolveLayoutChain(page.componentId, layouts).map((layout) => ({
+	const defaultChain = resolveLayoutChain(page.componentId, layouts, page.componentPath).map((layout) => ({
 		id: toLayoutId(layout),
 		definition: layout
 	}));
@@ -124,7 +123,7 @@ function resolveEffectiveLayoutEntries(page, layouts, namedLayouts) {
 	const isExclusive = page.layout.startsWith("!");
 	const name = isExclusive ? page.layout.slice(1) : page.layout;
 	if (name.startsWith(".") || name.startsWith("/")) return defaultChain;
-	const resolved = resolveNamedLayout(name, page.componentId, namedLayouts);
+	const resolved = resolveNamedLayout(name, page.componentId, namedLayouts, page.componentPath);
 	if (!resolved) return defaultChain;
 	const namedEntry = {
 		id: toLayoutId(resolved),
@@ -160,13 +159,31 @@ const SERVER_EXTENSIONS = [
 	"mts"
 ];
 const PAGES_EXPORT_RE = /export\s+(?:const|function|async\s+function)\s+(loader|actions?)\b/g;
-const REVALIDATE_RE = /export\s+const\s+revalidate\s*=\s*(\d+)\s*;/;
-const PRERENDER_RE = /export\s+const\s+prerender\s*=\s*true\s*;/;
-const PRERENDER_FALSE_RE = /export\s+const\s+prerender\s*=\s*false\s*;/;
+const REVALIDATE_RE = /export\s+const\s+revalidate\s*=\s*(\d+)\s*;?/;
+const PRERENDER_RE = /export\s+const\s+prerender\s*=\s*true\s*;?/;
+const PRERENDER_FALSE_RE = /export\s+const\s+prerender\s*=\s*false\s*;?/;
+const SSR_TRUE_RE = /export\s+const\s+ssr\s*=\s*true\s*;?/;
+const SSR_FALSE_RE = /export\s+const\s+ssr\s*=\s*false\s*;?/;
 const GET_PRERENDER_PATHS_RE = /export\s+(?:async\s+)?function\s+getPrerenderPaths\b/;
 const LAYOUT_STRING_RE = /export\s+const\s+layout\s*=\s*["']([^"']+)["']\s*;?/;
 const LAYOUT_FALSE_RE = /export\s+const\s+layout\s*=\s*false\s*;?/;
 const MAX_REVALIDATE = 31536e3;
+function inferAutoPrerender(page, options) {
+	const isDynamic = page.params.length > 0 || page.catchAll;
+	if (options?.output === "static") return !isDynamic || page.hasGetPrerenderPaths === true;
+	return page.island === true && !page.methods.includes("loader") && !isDynamic;
+}
+function resolvePageRendering(page, options) {
+	if (page.island && page.ssr === false) throw new Error(`pages: ssr = false is not valid for island page '${page.componentPath}'.`);
+	const ssrMode = page.ssr === true ? "server" : page.ssr === false ? "client" : "auto";
+	const prerenderMode = page.prerender === true ? "force" : page.prerender === false ? "disabled" : "auto";
+	return {
+		ssrMode,
+		prerenderMode,
+		renderMode: page.island === true ? "island" : ssrMode === "client" ? "client" : "server",
+		shouldPrerender: prerenderMode === "force" || prerenderMode === "auto" && inferAutoPrerender(page, options)
+	};
+}
 async function scanPages(root, options) {
 	const pagesDir = options?.pagesDir ?? options?.paths?.pagesDir ?? readProjectPaths(root).pagesDir;
 	if (!existsSync(pagesDir)) return {
@@ -219,7 +236,7 @@ async function scanPages(root, options) {
 		const methods = [];
 		let revalidate;
 		let prerender;
-		let prerenderExplicitlyFalse = false;
+		let ssr;
 		let hasGetPrerenderPaths;
 		const serverBase = hasIslandSuffix ? file.replace(`.island${ext}`, "") : file.replace(ext, "");
 		for (const serverExt of SERVER_EXTENSIONS) {
@@ -231,17 +248,24 @@ async function scanPages(root, options) {
 				const revalidateMatch = content.match(REVALIDATE_RE);
 				if (revalidateMatch) revalidate = Number(revalidateMatch[1]);
 				if (PRERENDER_RE.test(content)) prerender = true;
-				if (PRERENDER_FALSE_RE.test(content)) prerenderExplicitlyFalse = true;
+				else if (PRERENDER_FALSE_RE.test(content)) prerender = false;
+				if (SSR_TRUE_RE.test(content)) ssr = true;
+				else if (SSR_FALSE_RE.test(content)) ssr = false;
 				if (GET_PRERENDER_PATHS_RE.test(content)) hasGetPrerenderPaths = true;
 				break;
 			}
 		}
-		if (options?.output === "static") {
-			if (!prerenderExplicitlyFalse && prerender !== true) {
-				if (!(route.params.length > 0 || route.catchAll) || hasGetPrerenderPaths) prerender = true;
-			}
-		} else if (island && !methods.includes("loader") && route.params.length === 0 && !route.catchAll && !prerenderExplicitlyFalse) prerender = true;
-		if (prerender && revalidate === void 0) revalidate = MAX_REVALIDATE;
+		const rendering = resolvePageRendering({
+			componentPath: file,
+			island,
+			ssr,
+			prerender,
+			methods,
+			params: route.params,
+			catchAll: route.catchAll,
+			hasGetPrerenderPaths
+		}, options);
+		if (rendering.shouldPrerender && revalidate === void 0) revalidate = MAX_REVALIDATE;
 		let metadata;
 		let layout;
 		if (ext === ".md") {
@@ -264,6 +288,8 @@ async function scanPages(root, options) {
 			componentId,
 			revalidate,
 			prerender,
+			ssr,
+			...rendering,
 			hasGetPrerenderPaths,
 			island,
 			metadata,
@@ -291,7 +317,7 @@ async function scanPages(root, options) {
 		if (page.layout === void 0 || page.layout === false) continue;
 		const name = page.layout.startsWith("!") ? page.layout.slice(1) : page.layout;
 		if (name.startsWith(".") || name.startsWith("/")) continue;
-		if (!resolveNamedLayout(name, page.componentId, namedLayouts)) throw new Error(`pages: Page '${page.componentPath}' specifies layout '${page.layout}', but _layouts/${name}.vue was not found in any ancestor directory.`);
+		if (!resolveNamedLayout(name, page.componentId, namedLayouts, page.componentPath)) throw new Error(`pages: Page '${page.componentPath}' specifies layout '${page.layout}', but _layouts/${name}.vue was not found in any ancestor directory.`);
 	}
 	return {
 		pages,

package/dist/{secret-C_uTY7xx.mjs → secret-BRbXyu7E.mjs}

@@ -1,5 +1,5 @@
 import { n as cliTitle } from "./output-DeiS4oEX.mjs";
-import { c as getToken, n as PlatformClient } from "./client-DIfOFf1W.mjs";
+import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
 import { _ as me, c as R, g as ge, n as Ce, u as Se, v as ue, x as q, y as ye } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-D4O1_fZz.mjs";

package/dist/{types-Dm9kep2X.d.mts → types-BnHMXezo.d.mts}

@@ -1,4 +1,8 @@
 //#region src/pages/types.d.ts
+type ExplicitBoolean = true | false | undefined;
+type SsrMode = "auto" | "server" | "client";
+type PrerenderMode = "auto" | "force" | "disabled";
+type PageRenderMode = "server" | "client" | "island";
 type PageDefinition = {
   /** URL pattern, e.g. "/users/:id" */pattern: string; /** Route params, e.g. ["id"] */
   params: Array<string>; /** Whether this is a catch-all route */
@@ -7,8 +11,13 @@ type PageDefinition = {
   serverPath: string | null; /** HTTP methods exported by server handler */
   methods: Array<string>; /** Component ID used in page object, e.g. "users/[id]" */
   componentId: string; /** Edge caching revalidate TTL in seconds, from .server.ts export */
-  revalidate?: number; /** Whether `export const prerender = true` is set in server handler */
-  prerender?: boolean; /** Whether `export function getPrerenderPaths` is defined in server handler */
+  revalidate?: number; /** Whether `export const prerender = true/false` is set in server handler */
+  prerender?: ExplicitBoolean; /** Whether `export const ssr = true/false` is set in server handler */
+  ssr?: ExplicitBoolean; /** Normalized SSR mode from the public `ssr` export */
+  ssrMode: SsrMode; /** Normalized prerender mode from the public `prerender` export */
+  prerenderMode: PrerenderMode; /** Normalized page render mode */
+  renderMode: PageRenderMode; /** Whether this page should participate in prerender collection */
+  shouldPrerender: boolean; /** Whether `export function getPrerenderPaths` is defined in server handler */
   hasGetPrerenderPaths?: boolean; /** Whether this is an island page (.island.tsx/.island.vue) */
   island?: boolean; /** Frontmatter metadata extracted from .md files (title, description) */
   metadata?: {
@@ -39,4 +48,4 @@ type DevCssAsset = {
   css: string;
 };
 //#endregion
-export { PageScanResult as a, PageDefinition as i, LayoutDefinition as n, NamedLayoutDefinition as r, DevCssAsset as t };
+export { PageRenderMode as a, PageDefinition as i, LayoutDefinition as n, PageScanResult as o, NamedLayoutDefinition as r, DevCssAsset as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "void",
-  "version": "0.9.2",
+  "version": "0.10.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -353,7 +353,7 @@
     "valibot": ">=1.0.0-beta.7",
     "vite": "^8.0.0",
     "zod": "^3.25.0 || ^4.0.0",
-    "@void/md": "0.9.2"
+    "@void/md": "0.10.1"
   },
   "peerDependenciesMeta": {
     "@void/md": {

package/schema.json

@@ -154,7 +154,7 @@
             {
               "type": "object",
               "patternProperties": {
-                "^(/|\\*)": {
+                "^(\\/|\\*$)": {
                   "type": "number",
                   "minimum": 0
                 }
@@ -216,7 +216,7 @@
           "type": "object",
           "description": "URL rewrites. Keys are source URL patterns (path-only `/path` or host-scoped `https://host/path`); values are destination paths. Serves content from the destination without changing the browser URL. Destinations must start with \"/\" and must not contain \"?\" — the incoming request's query string is preserved automatically.",
           "patternProperties": {
-            "^(/|https://)": { "type": "string", "pattern": "^/[^?]*$" }
+            "^(/|https://)": { "type": "string", "pattern": "^/(?!/)[^?]*$" }
           },
           "additionalProperties": false
         },
@@ -224,7 +224,7 @@
           "type": "object",
           "description": "Fallback rewrites. Same shape as `rewrites`, but only fire when no static asset matched the request. Useful for SPA shells or default-locale catch-alls without pre-empting real routes. Destinations must start with \"/\" and must not contain \"?\".",
           "patternProperties": {
-            "^(/|https://)": { "type": "string", "pattern": "^/[^?]*$" }
+            "^(/|https://)": { "type": "string", "pattern": "^/(?!/)[^?]*$" }
           },
           "additionalProperties": false
         }

package/skills/void/docs/guide/deployment.md

@@ -64,30 +64,56 @@ If your CI pipeline runs typechecking or other static analysis before deploy, ru
 
 ## GitHub Actions
 
-You can deploy from a GitHub repo with a simple GitHub Actions workflow. Running `void init --github` will generate this as `.github/workflows/deploy.yml` in your project:
+You can deploy from a GitHub repo on every push to `main`. Running `void init --github` generates `.github/workflows/void-deploy.yml` in your project.
+
+The workflow authenticates with [GitHub OIDC](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect) — there is **no long-lived `VOID_TOKEN` secret to store or rotate**. The job requests a short-lived OIDC token from GitHub, exchanges it at `POST $VOID_API_URL/auth/github-oidc` for a short-lived project-scoped deploy token (about 15 minutes on the free tier; longer on higher plans, capped at ~60 minutes), then runs `void deploy --project <slug>`:
 
 ```yaml
-name: Deploy
+name: Deploy to Void
 on:
   push:
     branches: [main]
 
+# Latest push wins: a newer commit cancels an in-flight deploy for the same
+# repo + branch, so an older commit can never overtake a newer one.
+concurrency:
+  group: void-deploy-${{ github.repository }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  id-token: write
+  contents: read
+
+env:
+  VOID_API_URL: ${{ vars.VOID_API_URL || 'https://api.void.cloud' }}
+  VOID_PROJECT: my-app
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: voidzero-dev/setup-vp@v1
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
-          node-version: '22'
-          cache: true
-      - run: vp exec void deploy
-        env:
-          VOID_TOKEN: ${{ secrets.VOID_TOKEN }}
-          VOID_PROJECT: my-app
+          node-version: lts/*
+          cache: npm
+      - run: npm ci
+      - name: Exchange GitHub OIDC token for a Void deploy token
+        run: |
+          OIDC_TOKEN="$(curl -sf \
+            -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=void" | jq -r '.value')"
+          VOID_TOKEN="$(curl -sf \
+            -H 'Content-Type: application/json' \
+            -d "$(jq -n --arg t "$OIDC_TOKEN" --arg p "$VOID_PROJECT" '{oidcToken: $t, project: $p}')" \
+            "$VOID_API_URL/auth/github-oidc" | jq -r '.token')"
+          echo "::add-mask::$VOID_TOKEN"
+          echo "VOID_TOKEN=$VOID_TOKEN" >> "$GITHUB_ENV"
+      - name: Deploy
+        run: npx void deploy --project "$VOID_PROJECT"
 ```
 
-To get a deploy token, run `void auth token` to copy it to your clipboard, then add it as a GitHub Actions secret.
+Connect the repository to your project once with `void github connect <project> --repo <owner/repo> --executor github_actions` to authorize it. This GitHub Actions path requires the `github_actions` build executor — the default `container` executor will not work with this workflow. The exact steps vary by package manager (the scaffold detects pnpm, yarn, bun, or npm). The `VOID_PROJECT` value is baked in from your linked project when known; otherwise the workflow reads a `VOID_PROJECT` repository variable. To target staging, set a `VOID_API_URL` repository variable to `https://api.staging.void.cloud`.
 
 ## Other Targets