void 0.9.2 → 0.9.3

package/dist/{scan-2YmJkYAf.mjs → scan-VCAM1oh3.mjs}

@@ -1,6 +1,6 @@
 import { a as join, n as dirname, r as extname, t as basename } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
 import { n as readProjectPaths } from "./project-paths-CCMrHYQm.mjs";
-import { t as glob } from "./dist-DR9sIMbM.mjs";
+import { t as glob } from "./dist-5cGIJHQQ.mjs";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/router/parse-filename.ts
 const EXTENSIONS = [
@@ -83,30 +83,29 @@ function toLayoutId(layout) {
 	if (isNamedLayout(layout)) return layout.directory ? `${layout.directory}/_layouts/${layout.name}` : `_layouts/${layout.name}`;
 	return layout.directory ? `${layout.directory}/layout` : "layout";
 }
-/** Resolve the layout chain for a component (innermost last) */
-function resolveLayoutChain(componentId, layouts) {
+function resolveLayoutDirectories(componentId, componentPath) {
+	if (componentPath) {
+		const segments = componentPath.split("/");
+		segments.pop();
+		return segments.map((_, index) => segments.slice(0, index + 1).join("/"));
+	}
 	const parts = componentId.split("/");
+	return parts.slice(0, -1).map((_, index) => parts.slice(0, index + 1).join("/"));
+}
+/** Resolve the layout chain for a component (innermost last) */
+function resolveLayoutChain(componentId, layouts, componentPath) {
 	const chain = [];
 	const root = layouts.find((layout) => layout.directory === "");
 	if (root) chain.push(root);
-	let dir = "";
-	for (let partIndex = 0; partIndex < parts.length - 1; partIndex++) {
-		dir = dir ? `${dir}/${parts[partIndex]}` : parts[partIndex];
+	for (const dir of resolveLayoutDirectories(componentId, componentPath)) {
 		const layout = layouts.find((candidate) => candidate.directory === dir);
 		if (layout) chain.push(layout);
 	}
 	return chain;
 }
 /** Walk up directory tree to find closest _layouts/<name> */
-function resolveNamedLayout(name, componentId, namedLayouts) {
-	const parts = componentId.split("/");
-	const dirs = [];
-	let dir = "";
-	for (let partIndex = 0; partIndex < parts.length - 1; partIndex++) {
-		dir = dir ? `${dir}/${parts[partIndex]}` : parts[partIndex];
-		dirs.push(dir);
-	}
-	dirs.reverse();
+function resolveNamedLayout(name, componentId, namedLayouts, componentPath) {
+	const dirs = resolveLayoutDirectories(componentId, componentPath).reverse();
 	dirs.push("");
 	for (const directory of dirs) {
 		const found = namedLayouts.find((namedLayout) => namedLayout.name === name && namedLayout.directory === directory);
@@ -116,7 +115,7 @@ function resolveNamedLayout(name, componentId, namedLayouts) {
 }
 function resolveEffectiveLayoutEntries(page, layouts, namedLayouts) {
 	if (page.layout === false) return [];
-	const defaultChain = resolveLayoutChain(page.componentId, layouts).map((layout) => ({
+	const defaultChain = resolveLayoutChain(page.componentId, layouts, page.componentPath).map((layout) => ({
 		id: toLayoutId(layout),
 		definition: layout
 	}));
@@ -124,7 +123,7 @@ function resolveEffectiveLayoutEntries(page, layouts, namedLayouts) {
 	const isExclusive = page.layout.startsWith("!");
 	const name = isExclusive ? page.layout.slice(1) : page.layout;
 	if (name.startsWith(".") || name.startsWith("/")) return defaultChain;
-	const resolved = resolveNamedLayout(name, page.componentId, namedLayouts);
+	const resolved = resolveNamedLayout(name, page.componentId, namedLayouts, page.componentPath);
 	if (!resolved) return defaultChain;
 	const namedEntry = {
 		id: toLayoutId(resolved),
@@ -160,13 +159,31 @@ const SERVER_EXTENSIONS = [
 	"mts"
 ];
 const PAGES_EXPORT_RE = /export\s+(?:const|function|async\s+function)\s+(loader|actions?)\b/g;
-const REVALIDATE_RE = /export\s+const\s+revalidate\s*=\s*(\d+)\s*;/;
-const PRERENDER_RE = /export\s+const\s+prerender\s*=\s*true\s*;/;
-const PRERENDER_FALSE_RE = /export\s+const\s+prerender\s*=\s*false\s*;/;
+const REVALIDATE_RE = /export\s+const\s+revalidate\s*=\s*(\d+)\s*;?/;
+const PRERENDER_RE = /export\s+const\s+prerender\s*=\s*true\s*;?/;
+const PRERENDER_FALSE_RE = /export\s+const\s+prerender\s*=\s*false\s*;?/;
+const SSR_TRUE_RE = /export\s+const\s+ssr\s*=\s*true\s*;?/;
+const SSR_FALSE_RE = /export\s+const\s+ssr\s*=\s*false\s*;?/;
 const GET_PRERENDER_PATHS_RE = /export\s+(?:async\s+)?function\s+getPrerenderPaths\b/;
 const LAYOUT_STRING_RE = /export\s+const\s+layout\s*=\s*["']([^"']+)["']\s*;?/;
 const LAYOUT_FALSE_RE = /export\s+const\s+layout\s*=\s*false\s*;?/;
 const MAX_REVALIDATE = 31536e3;
+function inferAutoPrerender(page, options) {
+	const isDynamic = page.params.length > 0 || page.catchAll;
+	if (options?.output === "static") return !isDynamic || page.hasGetPrerenderPaths === true;
+	return page.island === true && !page.methods.includes("loader") && !isDynamic;
+}
+function resolvePageRendering(page, options) {
+	if (page.island && page.ssr === false) throw new Error(`pages: ssr = false is not valid for island page '${page.componentPath}'.`);
+	const ssrMode = page.ssr === true ? "server" : page.ssr === false ? "client" : "auto";
+	const prerenderMode = page.prerender === true ? "force" : page.prerender === false ? "disabled" : "auto";
+	return {
+		ssrMode,
+		prerenderMode,
+		renderMode: page.island === true ? "island" : ssrMode === "client" ? "client" : "server",
+		shouldPrerender: prerenderMode === "force" || prerenderMode === "auto" && inferAutoPrerender(page, options)
+	};
+}
 async function scanPages(root, options) {
 	const pagesDir = options?.pagesDir ?? options?.paths?.pagesDir ?? readProjectPaths(root).pagesDir;
 	if (!existsSync(pagesDir)) return {
@@ -219,7 +236,7 @@ async function scanPages(root, options) {
 		const methods = [];
 		let revalidate;
 		let prerender;
-		let prerenderExplicitlyFalse = false;
+		let ssr;
 		let hasGetPrerenderPaths;
 		const serverBase = hasIslandSuffix ? file.replace(`.island${ext}`, "") : file.replace(ext, "");
 		for (const serverExt of SERVER_EXTENSIONS) {
@@ -231,17 +248,24 @@ async function scanPages(root, options) {
 				const revalidateMatch = content.match(REVALIDATE_RE);
 				if (revalidateMatch) revalidate = Number(revalidateMatch[1]);
 				if (PRERENDER_RE.test(content)) prerender = true;
-				if (PRERENDER_FALSE_RE.test(content)) prerenderExplicitlyFalse = true;
+				else if (PRERENDER_FALSE_RE.test(content)) prerender = false;
+				if (SSR_TRUE_RE.test(content)) ssr = true;
+				else if (SSR_FALSE_RE.test(content)) ssr = false;
 				if (GET_PRERENDER_PATHS_RE.test(content)) hasGetPrerenderPaths = true;
 				break;
 			}
 		}
-		if (options?.output === "static") {
-			if (!prerenderExplicitlyFalse && prerender !== true) {
-				if (!(route.params.length > 0 || route.catchAll) || hasGetPrerenderPaths) prerender = true;
-			}
-		} else if (island && !methods.includes("loader") && route.params.length === 0 && !route.catchAll && !prerenderExplicitlyFalse) prerender = true;
-		if (prerender && revalidate === void 0) revalidate = MAX_REVALIDATE;
+		const rendering = resolvePageRendering({
+			componentPath: file,
+			island,
+			ssr,
+			prerender,
+			methods,
+			params: route.params,
+			catchAll: route.catchAll,
+			hasGetPrerenderPaths
+		}, options);
+		if (rendering.shouldPrerender && revalidate === void 0) revalidate = MAX_REVALIDATE;
 		let metadata;
 		let layout;
 		if (ext === ".md") {
@@ -264,6 +288,8 @@ async function scanPages(root, options) {
 			componentId,
 			revalidate,
 			prerender,
+			ssr,
+			...rendering,
 			hasGetPrerenderPaths,
 			island,
 			metadata,
@@ -291,7 +317,7 @@ async function scanPages(root, options) {
 		if (page.layout === void 0 || page.layout === false) continue;
 		const name = page.layout.startsWith("!") ? page.layout.slice(1) : page.layout;
 		if (name.startsWith(".") || name.startsWith("/")) continue;
-		if (!resolveNamedLayout(name, page.componentId, namedLayouts)) throw new Error(`pages: Page '${page.componentPath}' specifies layout '${page.layout}', but _layouts/${name}.vue was not found in any ancestor directory.`);
+		if (!resolveNamedLayout(name, page.componentId, namedLayouts, page.componentPath)) throw new Error(`pages: Page '${page.componentPath}' specifies layout '${page.layout}', but _layouts/${name}.vue was not found in any ancestor directory.`);
 	}
 	return {
 		pages,

package/dist/{types-Dm9kep2X.d.mts → types-DEWCqHtl.d.mts}

@@ -1,4 +1,8 @@
 //#region src/pages/types.d.ts
+type ExplicitBoolean = true | false | undefined;
+type SsrMode = "auto" | "server" | "client";
+type PrerenderMode = "auto" | "force" | "disabled";
+type PageRenderMode = "server" | "client" | "island";
 type PageDefinition = {
   /** URL pattern, e.g. "/users/:id" */pattern: string; /** Route params, e.g. ["id"] */
   params: Array<string>; /** Whether this is a catch-all route */
@@ -7,8 +11,13 @@ type PageDefinition = {
   serverPath: string | null; /** HTTP methods exported by server handler */
   methods: Array<string>; /** Component ID used in page object, e.g. "users/[id]" */
   componentId: string; /** Edge caching revalidate TTL in seconds, from .server.ts export */
-  revalidate?: number; /** Whether `export const prerender = true` is set in server handler */
-  prerender?: boolean; /** Whether `export function getPrerenderPaths` is defined in server handler */
+  revalidate?: number; /** Whether `export const prerender = true/false` is set in server handler */
+  prerender?: ExplicitBoolean; /** Whether `export const ssr = true/false` is set in server handler */
+  ssr?: ExplicitBoolean; /** Normalized SSR mode from the public `ssr` export */
+  ssrMode: SsrMode; /** Normalized prerender mode from the public `prerender` export */
+  prerenderMode: PrerenderMode; /** Normalized page render mode */
+  renderMode: PageRenderMode; /** Whether this page should participate in prerender collection */
+  shouldPrerender: boolean; /** Whether `export function getPrerenderPaths` is defined in server handler */
   hasGetPrerenderPaths?: boolean; /** Whether this is an island page (.island.tsx/.island.vue) */
   island?: boolean; /** Frontmatter metadata extracted from .md files (title, description) */
   metadata?: {
@@ -39,4 +48,4 @@ type DevCssAsset = {
   css: string;
 };
 //#endregion
-export { PageScanResult as a, PageDefinition as i, LayoutDefinition as n, NamedLayoutDefinition as r, DevCssAsset as t };
+export { PageRenderMode as a, PageDefinition as i, LayoutDefinition as n, PageScanResult as o, NamedLayoutDefinition as r, DevCssAsset as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "void",
-  "version": "0.9.2",
+  "version": "0.9.3",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -353,7 +353,7 @@
     "valibot": ">=1.0.0-beta.7",
     "vite": "^8.0.0",
     "zod": "^3.25.0 || ^4.0.0",
-    "@void/md": "0.9.2"
+    "@void/md": "0.9.3"
   },
   "peerDependenciesMeta": {
     "@void/md": {

package/skills/void/docs/guide/pages-routing/layouts.md

@@ -149,7 +149,7 @@ import { useShared, Link } from '@void/solid';
 import type { JSX } from 'solid-js';
 
 export default function Layout(props: { children: JSX.Element }) {
-  const shared = useShared<{ auth: { user: { name: string } | null } }>();
+  const shared = useShared();
   return (
     <>
       <nav>
@@ -307,15 +307,16 @@ Middleware can inject data available on every page via `c.set("shared", {...})`.
 ```ts
 // middleware/01.auth.ts
 import { defineMiddleware } from 'void';
+import { getUser, type AuthUser } from 'void/auth';
 
 declare module 'void' {
   interface CloudContextVariables {
-    shared: { auth: { user: { name: string } | null } };
+    shared: { auth: { user: AuthUser | null } };
   }
 }
 
 export default defineMiddleware(async (c, next) => {
-  const user = await getSessionUser(c);
+  const user = getUser();
   c.set('shared', { auth: { user } });
   await next();
 });
@@ -329,7 +330,7 @@ Access it on the client with `useShared()`. The return type is inferred from you
 import { useShared } from '@void/react';
 
 export default function Page() {
-  const { auth } = useShared(); // { auth: { user: { name: string } | null } }
+  const { auth } = useShared(); // { auth: { user: AuthUser | null } }
   return <p>Hello, {auth?.user?.name}</p>;
 }
 ```
@@ -337,14 +338,14 @@ export default function Page() {
 ```vue [Vue]
 <script setup lang="ts">
 import { useShared } from '@void/vue';
-const { auth } = useShared(); // { auth: { user: { name: string } | null } }
+const { auth } = useShared(); // { auth: { user: AuthUser | null } }
 </script>
 ```
 
 ```svelte [Svelte]
 <script>
   import { useShared } from "@void/svelte";
-  const { auth } = useShared(); // { auth: { user: { name: string } | null } }
+  const { auth } = useShared(); // { auth: { user: AuthUser | null } }
 </script>
 ```
 
@@ -352,7 +353,7 @@ const { auth } = useShared(); // { auth: { user: { name: string } | null } }
 import { useShared } from '@void/solid';
 
 export default function Page() {
-  const shared = useShared(); // { auth: { user: { name: string } | null } }
+  const shared = useShared(); // { auth: { user: AuthUser | null } }
   return <p>Hello, {shared.auth?.user?.name}</p>;
 }
 ```

package/skills/void/docs/guide/pages-routing/loaders.md

@@ -237,7 +237,7 @@ export default function Dashboard(props: Props) {
 
 ### How Streaming Works
 
-On the initial page load (SSR), React uses React 19 streaming SSR and renders the nearest Suspense fallback for deferred props; the other adapters render their loading state. As each deferred function resolves, the server streams an inline `<script>` tag that delivers the data, so no extra HTTP request is needed. On SPA navigation, deferred data streams via NDJSON over the same response.
+On the initial page load (SSR), React uses React 19 streaming SSR and renders the nearest Suspense fallback for deferred props; the other adapters render their loading state. As each deferred function resolves, the server streams an inline `<script>` tag that delivers the data, so no extra HTTP request is needed. Routes with `export const ssr = false` skip server-rendered component HTML but still stream deferred resolution scripts after the client-mounted shell. On SPA navigation, deferred data streams via NDJSON over the same response.
 
 ### Deferred Props After Mutations
 

package/skills/void/docs/guide/pages-routing/overview.md

@@ -100,6 +100,7 @@ Each page can have a companion `.server.ts` file that runs exclusively on the se
 
 - A [**loader**](./loaders), which runs on `GET` and returns the data that becomes the page component's props
 - [**Actions**](./actions-and-forms), which handle mutations from forms and programmatic calls. Export a single `action` or multiple [named actions](./actions-and-forms#named-actions) when a page has several mutations
+- `ssr = false` to opt a route out of server-rendered component HTML while keeping server loaders and client-side routing
 
 File-based routing rules are the same as [server routing](../server-routing.md): `[param]` for dynamic segments, `[...param]` for catch-all, `(group)/` for route groups.
 
@@ -107,14 +108,40 @@ File-based routing rules are the same as [server routing](../server-routing.md):
 
 Pages uses an Inertia-style protocol under the hood:
 
-| Request               | Response                                                              |
-| --------------------- | --------------------------------------------------------------------- |
-| Initial page load     | Full SSR HTML. Client hydrates automatically.                         |
-| Subsequent navigation | JSON with component name + props. Client component swap or re-render. |
-| Form submission       | Runs action, then returns fresh props or a redirect.                  |
+| Request               | Response                                                                                                       |
+| --------------------- | -------------------------------------------------------------------------------------------------------------- |
+| Initial page load     | Full SSR HTML. Client hydrates automatically. Routes with `ssr = false` return a client-mounted shell instead. |
+| Subsequent navigation | JSON with component name + props. Client component swap or re-render.                                          |
+| Form submission       | Runs action, then returns fresh props or a redirect.                                                           |
 
 This means the first page load is server-rendered for SEO and performance, while later navigations stay fast without full page reloads.
 
+To opt a specific route out of server-rendered component HTML, export `ssr = false` from its companion `.server.ts` file:
+
+```ts
+// pages/dashboard.server.ts
+import { defineHandler } from 'void';
+
+export const ssr = false;
+
+export const loader = defineHandler(async () => {
+  return { title: 'Dashboard' };
+});
+```
+
+The loader still runs on the first request, and its props are embedded in the HTML shell. The page component mounts in the browser instead of hydrating server-rendered markup.
+
+Render and prerender flags combine like this:
+
+| Page exports                           | Behavior                                                                  |
+| -------------------------------------- | ------------------------------------------------------------------------- |
+| `ssr` unset or `true`                  | Server-render component HTML on request.                                  |
+| `ssr = false`                          | Return a client-mounted shell on request.                                 |
+| `ssr = false` + `prerender = true`     | Prerender a client-mounted shell with embedded loader data.               |
+| `ssr = false` + `prerender = false`    | Return the client-mounted shell only on request; never prerender it.      |
+| Island page + `ssr = false`            | Invalid. Island pages already use the island renderer.                    |
+| `output: "static"` + `prerender` unset | Auto-prerender pages that have known paths, including client-only shells. |
+
 Use the `Link` component for SPA navigation between pages. It renders an `<a>` tag that intercepts clicks and navigates without a full page reload:
 
 ::: code-group

package/skills/void/docs/guide/server-routing.md

@@ -191,6 +191,34 @@ export default defineMiddleware(async (c, next) => {
 
 `defineMiddleware` uses Hono middleware semantics: `(c, next) => Promise<void> | void`.
 
+For a temporary full-site gate, use the built-in `basicAuth()` middleware with credentials from `void/env`. Void internal endpoints under `/__void` are excluded automatically so deploy migrations and dev tooling continue to work. Wrap `void/env` reads in functions so they are resolved per request after Void has bound the runtime env.
+
+```ts
+// env.ts
+import { defineEnv, string } from 'void/env';
+
+export default defineEnv({
+  BASIC_AUTH_USERNAME: string(),
+  BASIC_AUTH_PASSWORD: string(),
+});
+```
+
+```ts
+// middleware/01.basic-auth.ts
+import { basicAuth } from 'void';
+import { env } from 'void/env';
+
+export default basicAuth({
+  username: () => env.BASIC_AUTH_USERNAME,
+  password: () => env.BASIC_AUTH_PASSWORD,
+  realm: 'Preview',
+});
+```
+
+Set `BASIC_AUTH_USERNAME` and `BASIC_AUTH_PASSWORD` as local environment variables for development and production secrets before deploy.
+
+For app-specific bypasses such as health checks or public webhooks, compose that logic in your own middleware before calling `basicAuth()`.
+
 Middleware can set typed context variables using `c.set()`. Augment the `CloudContextVariables` interface so downstream handlers get full type safety:
 
 ```ts

package/skills/void/docs/node_modules/void/AGENTS.md

@@ -23,6 +23,7 @@ Non-CF targets disable CF-only bindings (`void/db`, `void/kv`, `void/auth`, `voi
 - `defineHandler(fn)` — wraps a route handler `(c: CloudContext) => R`, returns `TypedHandler<{}, R>`
 - `defineHandler.withValidator(validators)(fn)` — validates body/query/params via Standard Schema before calling handler, returns `TypedHandler<V, R>` with phantom types for codegen
 - `defineMiddleware(fn)` — wraps Hono middleware `(c, next) => void`
+- `basicAuth(options)` — built-in Basic Auth middleware for temporary site gates; excludes Void internals under `/__void`
 - Handlers can return plain objects/strings (auto-converted via `convertReturnValue`) or use Hono's `c.json()` / `c.text()` directly.
 - Route files use **named HTTP method exports** (`export const GET`, `export const POST`, etc.) — one file per path, multiple methods per file.
 
@@ -90,20 +91,20 @@ src/
 
 ### Package Exports
 
-| Subpath          | What                                                                                                                    |
-| ---------------- | ----------------------------------------------------------------------------------------------------------------------- |
-| `void`           | `voidPlugin()` named export + `defineHandler` + `defineMiddleware` + `defineHead` + `defineQueue` + `CloudContext` type |
-| `void/handler`   | `defineHandler()`, `defineHandler.withValidator()`, `defineMiddleware()`, `defineHead()`, types                         |
-| `void/response`  | `convertReturnValue()`                                                                                                  |
-| `void/validator` | `runValidation()`, `ValidatorSlots`, `HandlerInput` types                                                               |
-| `void/routes`    | Empty `RouteMap` + `WebSocketRouteMap` stubs (augmented by generated `routes.d.ts`)                                     |
-| `void/client`    | Typed `fetch()` client + `fetchStream()` SSE consumer + `FetchError`                                                    |
-| `void/ws`        | `defineRoom()`, `defineWebSocket()`, typed `connect()`, and WebSocket context types                                     |
-| `void/db`        | `db` Drizzle D1 instance (auto-wired with user schema) + `createDb()` for custom D1 bindings                            |
-| `void/queues`    | `queues` typed proxy + `QueueMap` stub interface (augmented by generated `queues.d.ts`)                                 |
-| `void/ai`        | `ai` proxy — Cloudflare-native `ai.run()`/`ai.stream()`, provider-native `ai.provider().fetch()`, `ai.models()`         |
-| `void/log`       | `logger.error/warn/info(msg, fields?)` — emits stringified JSON to `console.*` so Cloudflare Tail captures level + msg  |
-| `void/env`       | `defineEnv()`, typed `env` proxy, built-in schema helpers (`string`, `number`, `oneOf`, …) + global Cloudflare types    |
+| Subpath          | What                                                                                                                                  |
+| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
+| `void`           | `voidPlugin()` named export + `defineHandler` + `defineMiddleware` + `basicAuth` + `defineHead` + `defineQueue` + `CloudContext` type |
+| `void/handler`   | `defineHandler()`, `defineHandler.withValidator()`, `defineMiddleware()`, `basicAuth()`, `defineHead()`, types                        |
+| `void/response`  | `convertReturnValue()`                                                                                                                |
+| `void/validator` | `runValidation()`, `ValidatorSlots`, `HandlerInput` types                                                                             |
+| `void/routes`    | Empty `RouteMap` + `WebSocketRouteMap` stubs (augmented by generated `routes.d.ts`)                                                   |
+| `void/client`    | Typed `fetch()` client + `fetchStream()` SSE consumer + `FetchError`                                                                  |
+| `void/ws`        | `defineRoom()`, `defineWebSocket()`, typed `connect()`, and WebSocket context types                                                   |
+| `void/db`        | `db` Drizzle D1 instance (auto-wired with user schema) + `createDb()` for custom D1 bindings                                          |
+| `void/queues`    | `queues` typed proxy + `QueueMap` stub interface (augmented by generated `queues.d.ts`)                                               |
+| `void/ai`        | `ai` proxy — `ai.run()`, `ai.stream()`, `ai.models()` with auto-detected backend (service binding / HTTPS / direct)                   |
+| `void/log`       | `logger.error/warn/info(msg, fields?)` — emits stringified JSON to `console.*` so Cloudflare Tail captures level + msg                |
+| `void/env`       | `defineEnv()`, typed `env` proxy, built-in schema helpers (`string`, `number`, `oneOf`, …) + global Cloudflare types                  |
 
 The CLI binary is at `dist/cli/cli.mjs` (declared in `bin` field of package.json).
 

package/skills/void/docs/node_modules/void/README.md

@@ -48,6 +48,7 @@ Runtime helpers include:
 
 - `defineHandler`
 - `defineMiddleware`
+- `basicAuth`
 - `defineScheduled`
 - `defineQueue`
 - `void/db`

package/skills/void/docs/reference/api.md

@@ -118,6 +118,49 @@ export default defineMiddleware(async (c, next) => {
 function defineMiddleware(handler: MiddlewareHandler<CloudEnv>): MiddlewareHandler<CloudEnv>;
 ```
 
+### `basicAuth(options)`
+
+Built-in Basic authentication middleware for temporary site gates and pre-launch protection. Use it from `middleware/` with credentials from `void/env` to protect the whole app, or pass it to `defineHandler()` for a single route.
+
+Void internal endpoints under `/__void` are always excluded so deploy-time migrations, prerendering, cron/queue dispatch, and remote binding helpers still reach Void's own internal-token checks.
+
+When credentials come from `void/env`, wrap the reads in functions so they are resolved per request after Void has bound the runtime env.
+
+For app-specific bypasses such as health checks or public webhooks, compose that logic in your own middleware before calling `basicAuth()`.
+
+```ts
+// env.ts
+import { defineEnv, string } from 'void/env';
+
+export default defineEnv({
+  BASIC_AUTH_USERNAME: string(),
+  BASIC_AUTH_PASSWORD: string(),
+});
+```
+
+```ts
+// middleware/01.basic-auth.ts
+import { basicAuth } from 'void';
+import { env } from 'void/env';
+
+export default basicAuth({
+  username: () => env.BASIC_AUTH_USERNAME,
+  password: () => env.BASIC_AUTH_PASSWORD,
+  realm: 'Preview',
+});
+```
+
+**Signature:**
+
+```ts
+function basicAuth(options: {
+  username: string | (() => string);
+  password: string | (() => string);
+  realm?: string | (() => string);
+  message?: string | (() => string);
+}): MiddlewareHandler<CloudEnv>;
+```
+
 ### `defineScheduled(handler)`
 
 Wraps a Cloudflare [Scheduled handler](https://developers.cloudflare.com/workers/runtime-apis/handlers/scheduled/) with type inference.
@@ -1105,7 +1148,7 @@ This table lists app-facing imports. Exported implementation subpaths such as `v
 | Import path               | Contents                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | `void`                    | `voidPlugin`, handler/type re-exports, `defer`, `Deferred`, `DeferredState`, `InferProps`, `HeadDescriptor`                                                                                                                                                                                                                                                                                                                                                                                                              |
-| `void/handler`            | `defineHandler`, `defineMiddleware`, `defineScheduled`, `defineQueue`, `defineRender`, `defineHead`, types                                                                                                                                                                                                                                                                                                                                                                                                               |
+| `void/handler`            | `defineHandler`, `defineMiddleware`, `basicAuth`, `defineScheduled`, `defineQueue`, `defineRender`, `defineHead`, types                                                                                                                                                                                                                                                                                                                                                                                                  |
 | `void/auth`               | `defineAuth`, `getUser`, `getSession`, `requireAuth`, `AuthUser`, `AuthSession`, `AuthState`                                                                                                                                                                                                                                                                                                                                                                                                                             |
 | `void/client`             | `fetch`, `fetchStream`, `FetchError`, `auth`, `createAuthClient`, `AuthUser`, `AuthSession`, `AuthState`                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `void/client/{framework}` | Same as `void/client`, with framework-specific Better Auth clients for `react`, `vue`, `svelte`, and `solid`                                                                                                                                                                                                                                                                                                                                                                                                             |

package/skills/void/docs/reference/config.md

@@ -172,7 +172,7 @@ Output mode. Controls the default rendering strategy for pages.
 
 When set to `"static"`, all pages are prerendered at build time as static HTML files written to `dist/client/`. Individual pages can opt out with `export const prerender = false`. Dynamic pages (with route params) without a `getPrerenderPaths()` export are implicitly not prerendered.
 
-When omitted or set to `"server"`, pages are server-rendered on request. Individual pages can opt into deploy-time prerendering with `export const prerender = true`.
+When omitted or set to `"server"`, pages are server-rendered on request. Individual pages can opt into deploy-time prerendering with `export const prerender = true`, or opt out of server-rendered component HTML with `export const ssr = false`.
 
 ```json
 { "output": "static" }