void 0.9.3 → 0.10.1

package/dist/runtime/client-svelte.mjs

@@ -1,4 +1,4 @@
-import { t as FetchError } from "../fetch-error-BFIoojjf.mjs";
+import { t as FetchError } from "../fetch-error-C6qffTl2.mjs";
 import { fetch } from "./fetch.mjs";
 import { fetchStream } from "./fetch-stream.mjs";
 import { auth, createAuthClient } from "./auth-client-svelte.mjs";

package/dist/runtime/client-vue.d.mts

@@ -1,6 +1,6 @@
-import { n as AuthState, r as AuthUser, t as AuthSession } from "../auth-CDeb2XAl.mjs";
+import { n as AuthState, r as AuthUser, t as AuthSession } from "../auth-nEUVHuFI.mjs";
 import { auth, createAuthClient } from "./auth-client-vue.mjs";
-import { t as FetchError } from "../fetch-error-CimrygMq.mjs";
+import { t as FetchError } from "../fetch-error-BQMdPvge.mjs";
 import { fetch } from "./fetch.mjs";
 import { fetchStream } from "./fetch-stream.mjs";
 export { type AuthSession, type AuthState, type AuthUser, FetchError, FetchError as StreamError, auth, createAuthClient, fetch, fetchStream };

package/dist/runtime/client-vue.mjs

@@ -1,4 +1,4 @@
-import { t as FetchError } from "../fetch-error-BFIoojjf.mjs";
+import { t as FetchError } from "../fetch-error-C6qffTl2.mjs";
 import { fetch } from "./fetch.mjs";
 import { fetchStream } from "./fetch-stream.mjs";
 import { auth, createAuthClient } from "./auth-client-vue.mjs";

package/dist/runtime/client.d.mts

@@ -1,6 +1,6 @@
-import { n as AuthState, r as AuthUser, t as AuthSession } from "../auth-CDeb2XAl.mjs";
+import { n as AuthState, r as AuthUser, t as AuthSession } from "../auth-nEUVHuFI.mjs";
 import { auth, createAuthClient } from "./auth-client.mjs";
-import { t as FetchError } from "../fetch-error-CimrygMq.mjs";
+import { t as FetchError } from "../fetch-error-BQMdPvge.mjs";
 import { fetch } from "./fetch.mjs";
 import { fetchStream } from "./fetch-stream.mjs";
 export { type AuthSession, type AuthState, type AuthUser, FetchError, FetchError as StreamError, auth, createAuthClient, fetch, fetchStream };

package/dist/runtime/client.mjs

@@ -1,4 +1,4 @@
-import { t as FetchError } from "../fetch-error-BFIoojjf.mjs";
+import { t as FetchError } from "../fetch-error-C6qffTl2.mjs";
 import { fetch } from "./fetch.mjs";
 import { fetchStream } from "./fetch-stream.mjs";
 import { auth, createAuthClient } from "./auth-client.mjs";

package/dist/runtime/env-helpers.d.mts

@@ -1,2 +1,2 @@
-import { a as getSecretOverride, c as oneOf, i as email, l as string, n as SECRET_OVERRIDE_SYMBOL, o as json, r as boolean, s as number, t as EnvSchema, u as url } from "../env-helpers-Bd2wVdxz.mjs";
+import { a as getSecretOverride, c as oneOf, i as email, l as string, n as SECRET_OVERRIDE_SYMBOL, o as json, r as boolean, s as number, t as EnvSchema, u as url } from "../env-helpers-ZatKyjen.mjs";
 export { EnvSchema, SECRET_OVERRIDE_SYMBOL, boolean, email, getSecretOverride, json, number, oneOf, string, url };

package/dist/runtime/env-public-client.d.mts

@@ -1,4 +1,4 @@
-import { c as oneOf, i as email, l as string, o as json, r as boolean, s as number, t as EnvSchema, u as url } from "../env-helpers-Bd2wVdxz.mjs";
+import { c as oneOf, i as email, l as string, o as json, r as boolean, s as number, t as EnvSchema, u as url } from "../env-helpers-ZatKyjen.mjs";
 
 //#region src/runtime/env-public-client.d.ts
 declare const env: Record<string, unknown>;

package/dist/runtime/env-public.d.mts

@@ -1,6 +1,6 @@
 /// <reference types="@cloudflare/workers-types" />
-import { t as StandardSchemaV1 } from "../standard-schema-Dnsh2vnl.mjs";
-import { c as oneOf, i as email, l as string, o as json, r as boolean, s as number, t as EnvSchema, u as url } from "../env-helpers-Bd2wVdxz.mjs";
+import { t as StandardSchemaV1 } from "../standard-schema-BCBv-QaP.mjs";
+import { c as oneOf, i as email, l as string, o as json, r as boolean, s as number, t as EnvSchema, u as url } from "../env-helpers-ZatKyjen.mjs";
 import * as _$_cloudflare_sandbox0 from "@cloudflare/sandbox";
 
 //#region src/runtime/env-public.d.ts

package/dist/runtime/env-public.mjs

@@ -1,4 +1,4 @@
-import { i as getRawRuntimeEnv } from "../env-raw-RDkMnSTC.mjs";
+import { i as getRawRuntimeEnv } from "../env-raw-Dtj1UAoK.mjs";
 import { getRuntimeEnv } from "./env.mjs";
 import { boolean, email, getSecretOverride, json, number, oneOf, string, url } from "./env-helpers.mjs";
 //#region src/shared/env-mask.ts

package/dist/runtime/env.mjs

@@ -1,4 +1,4 @@
-import { i as getRawRuntimeEnv, n as asEnv, r as envContext, t as INTERNAL_BINDING_PREFIXES } from "../env-raw-RDkMnSTC.mjs";
+import { i as getRawRuntimeEnv, n as asEnv, r as envContext, t as INTERNAL_BINDING_PREFIXES } from "../env-raw-Dtj1UAoK.mjs";
 //#region src/runtime/env.ts
 /**
 * Public runtime env API — exposed via "void/_env".

package/dist/runtime/fetch-stream.d.mts

@@ -1,4 +1,4 @@
-import { t as FetchError } from "../fetch-error-CimrygMq.mjs";
+import { t as FetchError } from "../fetch-error-BQMdPvge.mjs";
 import { RouteMap } from "void/routes";
 
 //#region src/runtime/fetch-stream.d.ts

package/dist/runtime/fetch-stream.mjs

@@ -1,4 +1,4 @@
-import { n as ofetch, t as FetchError } from "../fetch-error-BFIoojjf.mjs";
+import { n as ofetch, t as FetchError } from "../fetch-error-C6qffTl2.mjs";
 //#region src/runtime/fetch-stream.ts
 /**
 * Consume an SSE endpoint as an async generator of text chunks.

package/dist/runtime/fetch.d.mts

@@ -1,4 +1,4 @@
-import { t as FetchError } from "../fetch-error-CimrygMq.mjs";
+import { t as FetchError } from "../fetch-error-BQMdPvge.mjs";
 import { RouteMap } from "void/routes";
 
 //#region src/runtime/fetch.d.ts

package/dist/runtime/fetch.mjs

@@ -1,4 +1,4 @@
-import { n as ofetch, t as FetchError } from "../fetch-error-BFIoojjf.mjs";
+import { n as ofetch, t as FetchError } from "../fetch-error-C6qffTl2.mjs";
 //#region src/runtime/fetch.ts
 async function fetch(path, options) {
 	let url = path;

package/dist/runtime/handler.d.mts

@@ -1,3 +1,3 @@
 /// <reference types="@cloudflare/workers-types" />
-import { C as defer, E as ValidatorSlots, S as InferProps, T as HandlerInput, _ as defineQueue, a as CloudEnv, b as Deferred, c as QueueRetryOptions, d as TypedQueueHandler, f as VoidAssetRewriteError, g as defineMiddleware, h as defineHead, i as CloudContextVariables, l as RenderAssetTags, m as defineHandler, n as CloudBindings, o as QueueBatch, p as basicAuth, r as CloudContext, s as QueueMessage, t as BasicAuthOptions, u as TypedHandler, v as defineRender, w as ValidationError, y as defineScheduled } from "../handler-hm9KldPP.mjs";
+import { C as defer, E as ValidatorSlots, S as InferProps, T as HandlerInput, _ as defineQueue, a as CloudEnv, b as Deferred, c as QueueRetryOptions, d as TypedQueueHandler, f as VoidAssetRewriteError, g as defineMiddleware, h as defineHead, i as CloudContextVariables, l as RenderAssetTags, m as defineHandler, n as CloudBindings, o as QueueBatch, p as basicAuth, r as CloudContext, s as QueueMessage, t as BasicAuthOptions, u as TypedHandler, v as defineRender, w as ValidationError, y as defineScheduled } from "../handler-DczZlaXR.mjs";
 export { BasicAuthOptions, CloudBindings, CloudContext, CloudContextVariables, CloudEnv, Deferred, HandlerInput, InferProps, QueueBatch, QueueMessage, QueueRetryOptions, RenderAssetTags, TypedHandler, TypedQueueHandler, ValidationError, ValidatorSlots, VoidAssetRewriteError, basicAuth, defer, defineHandler, defineHead, defineMiddleware, defineQueue, defineRender, defineScheduled };

package/dist/runtime/handler.mjs

@@ -1,6 +1,6 @@
 import { convertReturnValue } from "./response.mjs";
 import { runValidation } from "./validator.mjs";
-import { i as ValidationError, n as defer } from "../defer-CouVukrf.mjs";
+import { i as ValidationError, n as defer } from "../defer-C-bdSM_b.mjs";
 //#region src/runtime/handler.ts
 /**
 * Thrown when `c.rewrite()` is called with a destination whose final path

package/dist/runtime/isr.mjs

@@ -1,4 +1,4 @@
-import { i as getRawRuntimeEnv } from "../env-raw-RDkMnSTC.mjs";
+import { i as getRawRuntimeEnv } from "../env-raw-Dtj1UAoK.mjs";
 //#region src/runtime/isr.ts
 /**
 * Revalidate ISR-cached pages on demand.

package/dist/runtime/live.d.mts

@@ -1,6 +1,6 @@
 /// <reference types="@cloudflare/workers-types" />
-import { r as AuthUser } from "../auth-CDeb2XAl.mjs";
-import { a as CloudEnv, r as CloudContext } from "../handler-hm9KldPP.mjs";
+import { r as AuthUser } from "../auth-nEUVHuFI.mjs";
+import { a as CloudEnv, r as CloudContext } from "../handler-DczZlaXR.mjs";
 
 //#region src/runtime/live.d.ts
 type MaybePromise<T> = T | Promise<T>;

package/dist/runtime/live.mjs

@@ -1,4 +1,4 @@
-import { i as getRawRuntimeEnv } from "../env-raw-RDkMnSTC.mjs";
+import { i as getRawRuntimeEnv } from "../env-raw-Dtj1UAoK.mjs";
 import { getUser } from "./auth.mjs";
 //#region src/runtime/live.ts
 let liveBindingName = "VOID_LIVE";

package/dist/runtime/migration-handler-pg.mjs

@@ -1,4 +1,4 @@
-import { t as disablePgPassFallback } from "../pg-CMZ_5wsC.mjs";
+import { t as disablePgPassFallback } from "../pg-CempqvEJ.mjs";
 //#region src/runtime/migration-handler-pg.ts
 function createMigrationHandler(env, migrations, _dialect, runAuthMigrations) {
 	return async (request) => {

package/dist/runtime/sandbox.mjs

@@ -1,4 +1,4 @@
-import { i as getRawRuntimeEnv } from "../env-raw-RDkMnSTC.mjs";
+import { i as getRawRuntimeEnv } from "../env-raw-Dtj1UAoK.mjs";
 import { requireRuntimeBinding } from "./env.mjs";
 import { Sandbox, getSandbox as getSandbox$1 } from "@cloudflare/sandbox";
 //#region src/runtime/sandbox.ts

package/dist/runtime/validator.d.mts

@@ -1,2 +1,2 @@
-import { D as runValidation, E as ValidatorSlots, T as HandlerInput } from "../handler-hm9KldPP.mjs";
+import { D as runValidation, E as ValidatorSlots, T as HandlerInput } from "../handler-DczZlaXR.mjs";
 export { HandlerInput, ValidatorSlots, runValidation };

package/dist/runtime/ws-server.d.mts

@@ -1,5 +1,5 @@
-import { n as AuthState } from "../auth-CDeb2XAl.mjs";
-import { i as VoidAuthRuntimeOptions, n as VoidAuthEnv } from "../better-auth-shared-CmEQZs1T.mjs";
+import { n as AuthState } from "../auth-nEUVHuFI.mjs";
+import { i as VoidAuthRuntimeOptions, n as VoidAuthEnv } from "../better-auth-shared-a7H3wk9J.mjs";
 import { AnyWebSocketDefinition } from "./ws.mjs";
 
 //#region src/runtime/ws-server.d.ts

package/dist/runtime/ws.d.mts

@@ -1,6 +1,6 @@
-import { r as AuthUser } from "../auth-CDeb2XAl.mjs";
-import { t as StandardSchemaV1 } from "../standard-schema-Dnsh2vnl.mjs";
-import { a as CloudEnv } from "../handler-hm9KldPP.mjs";
+import { r as AuthUser } from "../auth-nEUVHuFI.mjs";
+import { t as StandardSchemaV1 } from "../standard-schema-BCBv-QaP.mjs";
+import { a as CloudEnv } from "../handler-DczZlaXR.mjs";
 import { WebSocketRouteMap } from "void/routes";
 
 //#region src/runtime/ws.d.ts

package/dist/{scan-B2H1Vo2C.mjs → scan-DGEp1-1Q.mjs}

@@ -1,7 +1,7 @@
 import { a as join, i as isAbsolute, t as basename } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
 import { n as readProjectPaths } from "./project-paths-CCMrHYQm.mjs";
 import { n as globSync, t as glob } from "./dist-5cGIJHQQ.mjs";
-import { d as isCallExpression, f as isIdentifier, h as isObjectExpression, p as isLiteral } from "./plugin-inference--7geW5Z2.mjs";
+import { d as isCallExpression, f as isIdentifier, h as isObjectExpression, p as isLiteral } from "./plugin-inference-C3fLzFvP.mjs";
 import { o as parseRouteFilename, s as parseWebSocketFilename, t as scanPages } from "./scan-VCAM1oh3.mjs";
 import { readFileSync } from "node:fs";
 import { parseSync } from "vite";
@@ -147,6 +147,7 @@ function detectHttpExports(absPath) {
 	const program = parsed.program;
 	for (const node of program.body ?? []) if (node.type === "ExportNamedDeclaration") {
 		const declarationNode = node;
+		if (declarationNode.exportKind === "type") continue;
 		const decl = declarationNode.declaration;
 		if (decl) {
 			if (decl.type === "VariableDeclaration") {
@@ -157,6 +158,7 @@ function detectHttpExports(absPath) {
 			}
 		}
 		if (declarationNode.specifiers) for (const spec of declarationNode.specifiers) {
+			if (spec.exportKind === "type") continue;
 			const exported = isIdentifier(spec.exported) ? spec.exported.name : isIdentifier(spec.local) ? spec.local.name : void 0;
 			if (exported && HTTP_METHODS.has(exported)) methods.push(exported);
 		}
@@ -286,6 +288,18 @@ function parseMiddlewareDefinitions(files) {
 		};
 	}).sort((a, b) => a.order - b.order);
 }
+function compareRouteSpecificity(a, b) {
+	if (a.catchAll !== b.catchAll) return a.catchAll ? 1 : -1;
+	const aSegments = a.pattern.split("/");
+	const bSegments = b.pattern.split("/");
+	const shared = Math.min(aSegments.length, bSegments.length);
+	for (let i = 0; i < shared; i++) {
+		const aDynamic = aSegments[i].startsWith(":") || aSegments[i] === "*";
+		if (aDynamic !== (bSegments[i].startsWith(":") || bSegments[i] === "*")) return aDynamic ? 1 : -1;
+		if (aSegments[i] !== bSegments[i]) return aSegments[i].localeCompare(bSegments[i]);
+	}
+	return aSegments.length - bSegments.length;
+}
 /**
 * Scan routes/ and middleware/ directories and return a structured manifest.
 * Files starting with _ are ignored.
@@ -315,10 +329,7 @@ async function scanRoutes(root, options) {
 			const route = parseRouteFilename(f);
 			route.methods = detectHttpExports(join(routesDir, f));
 			return route;
-		}).sort((a, b) => {
-			if (a.catchAll !== b.catchAll) return a.catchAll ? 1 : -1;
-			return a.pattern.localeCompare(b.pattern);
-		}),
+		}).sort(compareRouteSpecificity),
 		websockets,
 		middleware: parseMiddlewareDefinitions(middlewareFiles),
 		jobs,
@@ -348,10 +359,7 @@ function scanRoutePatternsSync(root, paths = readProjectPaths(root)) {
 	} catch {
 		routeFiles = [];
 	}
-	return routeFiles.filter((f) => !isWebSocketPatternFile(f)).filter((f) => !f.split("/").some((s) => s.startsWith("_"))).map((f) => parseRouteFilename(f)).sort((a, b) => {
-		if (a.catchAll !== b.catchAll) return a.catchAll ? 1 : -1;
-		return a.pattern.localeCompare(b.pattern);
-	});
+	return routeFiles.filter((f) => !isWebSocketPatternFile(f)).filter((f) => !f.split("/").some((s) => s.startsWith("_"))).map((f) => parseRouteFilename(f)).sort(compareRouteSpecificity);
 }
 //#endregion
 export { scanQueuesSync as a, scanWebSocketRoutesSync as i, scanRoutePatternsSync as n, scanJobsSync as o, scanRoutes as r, scanMiddlewareSync as t };

package/dist/{secret-C_uTY7xx.mjs → secret-BRbXyu7E.mjs}

@@ -1,5 +1,5 @@
 import { n as cliTitle } from "./output-DeiS4oEX.mjs";
-import { c as getToken, n as PlatformClient } from "./client-DIfOFf1W.mjs";
+import { d as getToken, n as PlatformClient } from "./client-D4awzTnj.mjs";
 import { _ as me, c as R, g as ge, n as Ce, u as Se, v as ue, x as q, y as ye } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-D4O1_fZz.mjs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "void",
-  "version": "0.9.3",
+  "version": "0.10.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -353,7 +353,7 @@
     "valibot": ">=1.0.0-beta.7",
     "vite": "^8.0.0",
     "zod": "^3.25.0 || ^4.0.0",
-    "@void/md": "0.9.3"
+    "@void/md": "0.10.1"
   },
   "peerDependenciesMeta": {
     "@void/md": {

package/schema.json

@@ -154,7 +154,7 @@
             {
               "type": "object",
               "patternProperties": {
-                "^(/|\\*)": {
+                "^(\\/|\\*$)": {
                   "type": "number",
                   "minimum": 0
                 }
@@ -216,7 +216,7 @@
           "type": "object",
           "description": "URL rewrites. Keys are source URL patterns (path-only `/path` or host-scoped `https://host/path`); values are destination paths. Serves content from the destination without changing the browser URL. Destinations must start with \"/\" and must not contain \"?\" — the incoming request's query string is preserved automatically.",
           "patternProperties": {
-            "^(/|https://)": { "type": "string", "pattern": "^/[^?]*$" }
+            "^(/|https://)": { "type": "string", "pattern": "^/(?!/)[^?]*$" }
           },
           "additionalProperties": false
         },
@@ -224,7 +224,7 @@
           "type": "object",
           "description": "Fallback rewrites. Same shape as `rewrites`, but only fire when no static asset matched the request. Useful for SPA shells or default-locale catch-alls without pre-empting real routes. Destinations must start with \"/\" and must not contain \"?\".",
           "patternProperties": {
-            "^(/|https://)": { "type": "string", "pattern": "^/[^?]*$" }
+            "^(/|https://)": { "type": "string", "pattern": "^/(?!/)[^?]*$" }
           },
           "additionalProperties": false
         }

package/skills/void/docs/guide/deployment.md

@@ -64,30 +64,56 @@ If your CI pipeline runs typechecking or other static analysis before deploy, ru
 
 ## GitHub Actions
 
-You can deploy from a GitHub repo with a simple GitHub Actions workflow. Running `void init --github` will generate this as `.github/workflows/deploy.yml` in your project:
+You can deploy from a GitHub repo on every push to `main`. Running `void init --github` generates `.github/workflows/void-deploy.yml` in your project.
+
+The workflow authenticates with [GitHub OIDC](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect) — there is **no long-lived `VOID_TOKEN` secret to store or rotate**. The job requests a short-lived OIDC token from GitHub, exchanges it at `POST $VOID_API_URL/auth/github-oidc` for a short-lived project-scoped deploy token (about 15 minutes on the free tier; longer on higher plans, capped at ~60 minutes), then runs `void deploy --project <slug>`:
 
 ```yaml
-name: Deploy
+name: Deploy to Void
 on:
   push:
     branches: [main]
 
+# Latest push wins: a newer commit cancels an in-flight deploy for the same
+# repo + branch, so an older commit can never overtake a newer one.
+concurrency:
+  group: void-deploy-${{ github.repository }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  id-token: write
+  contents: read
+
+env:
+  VOID_API_URL: ${{ vars.VOID_API_URL || 'https://api.void.cloud' }}
+  VOID_PROJECT: my-app
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: voidzero-dev/setup-vp@v1
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
-          node-version: '22'
-          cache: true
-      - run: vp exec void deploy
-        env:
-          VOID_TOKEN: ${{ secrets.VOID_TOKEN }}
-          VOID_PROJECT: my-app
+          node-version: lts/*
+          cache: npm
+      - run: npm ci
+      - name: Exchange GitHub OIDC token for a Void deploy token
+        run: |
+          OIDC_TOKEN="$(curl -sf \
+            -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=void" | jq -r '.value')"
+          VOID_TOKEN="$(curl -sf \
+            -H 'Content-Type: application/json' \
+            -d "$(jq -n --arg t "$OIDC_TOKEN" --arg p "$VOID_PROJECT" '{oidcToken: $t, project: $p}')" \
+            "$VOID_API_URL/auth/github-oidc" | jq -r '.token')"
+          echo "::add-mask::$VOID_TOKEN"
+          echo "VOID_TOKEN=$VOID_TOKEN" >> "$GITHUB_ENV"
+      - name: Deploy
+        run: npx void deploy --project "$VOID_PROJECT"
 ```
 
-To get a deploy token, run `void auth token` to copy it to your clipboard, then add it as a GitHub Actions secret.
+Connect the repository to your project once with `void github connect <project> --repo <owner/repo> --executor github_actions` to authorize it. This GitHub Actions path requires the `github_actions` build executor — the default `container` executor will not work with this workflow. The exact steps vary by package manager (the scaffold detects pnpm, yarn, bun, or npm). The `VOID_PROJECT` value is baked in from your linked project when known; otherwise the workflow reads a `VOID_PROJECT` repository variable. To target staging, set a `VOID_API_URL` repository variable to `https://api.staging.void.cloud`.
 
 ## Other Targets
 

package/skills/void/docs/guide/edge/headers.md

@@ -56,11 +56,18 @@ Define custom response headers in [`void.json`](../../reference/config) using th
 
 ## Scope
 
-Header rules apply to **all responses** served through the dispatch worker, including static assets, SSR pages, and API routes. They do not apply to:
+Header rules apply to **all responses** served through the dispatch worker, including static assets, SSR pages, API routes, and hashed asset responses (which browsers fetch over `GET` from the immutable edge cache). Serving headers on hashed assets is what lets a cross-origin-isolated app attach `Cross-Origin-Embedder-Policy` and `Cross-Origin-Resource-Policy` to its hashed worker and wasm files — without them, a module worker spawned from a `require-corp` document is blocked.
+
+On hashed (content-addressed, immutable) assets, rules are **additive**. You can add headers such as COOP/COEP/CORP or other security headers, but the platform-managed caching, representation, and framing headers are preserved so an immutable asset cannot be mis-cached or corrupted: `Cache-Control`, `Content-Type`, `Content-Encoding`, `Content-Length`, `Content-Range`, `Accept-Ranges`, and `Transfer-Encoding` keep their platform values even if a broad rule tries to overwrite them. (This is the one case where a user `Cache-Control` does not override the default.)
+
+Header rules do not apply to:
 
-- Hashed asset cache hits (these use immutable caching set by the dispatch worker itself)
 - ISR cache responses (these have their own cache-control headers)
 
+### Blocked headers
+
+Two headers can never be set through rules: `Set-Cookie` and `Clear-Site-Data`. On the shared `*.void.app` domain, `void.app` is the registrable domain, so a cookie operation from one project would reach every project's subdomain. Both are dropped from rule output to keep that tenant boundary intact.
+
 ## Framework `_headers` files
 
 Meta-frameworks like SvelteKit, Nuxt, and Astro generate a `_headers` file with cache rules for their hashed asset directories. Void automatically parses this file during deploy and merges the rules into the deploy manifest.
@@ -74,6 +81,6 @@ No configuration is needed. If the framework generates a `_headers` file, it is
 
 1. `void deploy` reads header rules from the framework `_headers` file (if present) and `routing.headers` in `void.json`, then includes them in the deploy manifest.
 2. The platform stores the rules in the KV routing entry for your project.
-3. The dispatch worker applies matching rules to matching responses before returning them. Cacheable responses are cached with the final headers.
+3. The dispatch worker applies matching rules to matching responses before returning them. Most cacheable responses are cached with the final headers; hashed assets are the exception — their rules are applied on every serve (including cache hits), so a later header-rule change takes effect even when the content hash, and thus the cache entry, is unchanged.
 
 Because rules are evaluated at the edge, there is no extra latency cost. Headers are applied inline before the response is returned and cached.

package/skills/void/docs/guide/edge/rewrites.md

@@ -332,14 +332,14 @@ If you use [`routing.revalidate`](./revalidation) on a dispatch rewrite (`routin
 During `vite dev`, every response carries an `X-Void-Routing` header that traces how the request was resolved. Open the Network tab in devtools and inspect the response headers:
 
 ```
-X-Void-Routing: redirect[/old] → /new 301 (_redirects:12)
-X-Void-Routing: rewrite[/api/*] → /backend/:splat (void.json#routing.rewrites)
-X-Void-Routing: fallback[/docs/*] → /docs.html (void.json#routing.fallbacks)
-X-Void-Routing: c.rewrite → /new-path (middleware)
+X-Void-Routing: redirect[/old] -> /new 301 (_redirects:12)
+X-Void-Routing: rewrite[/api/*] -> /backend/:splat (void.json#routing.rewrites)
+X-Void-Routing: fallback[/docs/*] -> /docs.html (void.json#routing.fallbacks)
+X-Void-Routing: c.rewrite -> /new-path (middleware)
 X-Void-Routing: pass-through
 ```
 
-Phases are separated by `→`. The parenthesised source hint points at the exact declaration — a line number for `_redirects`, a config path for `void.json`, or `spa-default` for the synthetic SPA catch-all. The header is **only emitted in dev** — production builds strip both the trace code and the per-rule `origin` metadata from the bundle and manifest.
+Phases are separated by `->` so the diagnostic value stays valid as an HTTP header. The parenthesised source hint points at the exact declaration — a line number for `_redirects`, a config path for `void.json`, or `spa-default` for the synthetic SPA catch-all. The header is **only emitted in dev** — production builds strip both the trace code and the per-rule `origin` metadata from the bundle and manifest.
 
 ::: info What fires in `vite dev`
 `vite dev` applies the full static routing pipeline on every target — `node`, `bun`, `deno`, and the default target alike. `void.json` rules (`routing.redirects` / `routing.rewrites` / `routing.fallbacks` / `routing.headers`) and file-based rules (`public/_redirects`, `public/_headers`) are merged at plugin load and compiled into the Hono middleware your worker runs behind. Editing `_redirects` or `_headers` during a dev session re-runs the merge and reloads the page — no restart needed. `c.rewrite()` calls in middleware work everywhere because they live inside the worker itself, and the `X-Void-Routing` dev header reports every decision on every target.

package/skills/void/docs/reference/cli.md

@@ -86,7 +86,7 @@ After that, the full interactive flow walks through:
 4. **Skills:** links Void skills using the same detected or selected agent context.
 5. **MCP config:** writes MCP server config using that same agent context.
 6. **Demo code:** for existing non-Pages projects, optionally scaffolds a `db/migrations/` directory plus an API route and typed fetch example.
-7. **GitHub Actions:** optionally creates `.github/workflows/deploy.yml` with the right package manager commands.
+7. **GitHub Actions:** optionally creates `.github/workflows/void-deploy.yml`. The workflow deploys on pushes to `main` and authenticates via [GitHub OIDC](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect) — no long-lived `VOID_TOKEN` secret is stored in the repo. The job requests an OIDC token (audience `void`), exchanges it at `POST $VOID_API_URL/auth/github-oidc` for a short-lived project-scoped deploy token, then runs `void deploy --project <slug>` with the right package manager. The project slug is baked in from your linked project (`.void/project.json`) when known; otherwise the workflow reads a `VOID_PROJECT` repository variable.
 8. **`env.ts` scaffold:** if the project has no `env.ts` but has `.env` / `.env.example` / `.env.local` / `.env.development*` files on disk, generates an `env.ts` pre-populated with their keys. Values get conservative type inference (`boolean`/`url`/`number`/`string`) — the file carries a banner nudging you to tighten anything the heuristic got wrong.
 9. **Project setup:** optionally logs you in, lets you select or create a project, and writes `.void/project.json` so your first deploy can just be `void deploy`.
 
@@ -98,10 +98,12 @@ Use flags to run individual steps without prompts:
 | ------------ | ------------------------------------------------- |
 | `--tsconfig` | Only update `tsconfig.json`                       |
 | `--agents`   | Set up agent instructions, skills, and MCP config |
-| `--github`   | Only create GitHub Actions workflow               |
+| `--github`   | Only create the GitHub Actions deploy workflow    |
 
 Flags can be combined. When any flag is provided, only the specified steps run and interactive prompts are skipped.
 
+The `--github` workflow uses GitHub OIDC: you connect the repository to your Void project once with `void github connect <project> --repo <owner/repo> --executor github_actions` (see the GitHub section below), and pushes to `main` deploy automatically. There is no `VOID_TOKEN` secret to create or rotate. To target staging, set a `VOID_API_URL` repository variable to `https://api.staging.void.cloud`.
+
 For projects that already have `"extends"`, `void init --tsconfig` preserves the existing config and adds `./.void/tsconfig.json`. If the existing config defines `files` or `compilerOptions.paths`, Void also merges its generated declaration files and aliases into the root config because TypeScript replaces those fields across `extends` instead of deeply merging them.
 
 ### `void prepare`
@@ -564,6 +566,67 @@ PORT=3000
 
 See [Environment Variables](../guide/env-vars.md) for the full guide.
 
+## GitHub
+
+Deploy-on-GitHub works from **any** Void login — Google, GitHub, or other SSO. The first time you connect GitHub, Void links your GitHub identity to your current account (a one-time step, independent of how you logged in); it never creates a second account.
+
+### `void github link`
+
+```
+void github link
+```
+
+Link your current Void account to a GitHub identity. Opens your browser to authorize Void on GitHub (a localhost + PKCE handshake, the same mechanics as `void auth login`), then binds that GitHub identity to the logged-in account. Requires an authenticated CLI (`void auth login` first).
+
+You normally don't need to run this directly — `void github install` runs the link automatically when your account has no GitHub identity yet. Run it on its own to link ahead of time, or to link a GitHub identity without installing the App. If that GitHub account is already linked to a different Void account, the command fails and asks you to use a different GitHub account.
+
+### `void github install`
+
+```
+void github install
+```
+
+Open the GitHub App install page in your browser. If your account has no linked GitHub identity yet, `void github install` first runs the GitHub link automatically (browser authorize), then continues. After installing, run `void github connect` to link a repository to your project.
+
+### `void github installations`
+
+```
+void github installations
+```
+
+List all GitHub App installations linked to your account. Each entry includes the `[id: <installation_id>]` needed for `--installation` in non-interactive use.
+
+### `void github connect`
+
+```
+void github connect [project] [options]
+```
+
+Connect a GitHub repository to a Void project for automatic deploys. On every push to the configured branch, Void builds and deploys your project automatically.
+
+**Options**
+
+| Flag                  | Description                                                                     |
+| --------------------- | ------------------------------------------------------------------------------- |
+| `--project <name>`    | Project name (alias for the positional argument)                                |
+| `--installation <id>` | GitHub App installation ID (required when you have multiple installations)      |
+| `--repo <owner/repo>` | Repository full name — required unless the installation grants exactly one repo |
+| `--branch <name>`     | Branch to deploy from — **required in non-interactive mode**                    |
+| `--executor <type>`   | Build executor: `container` (default) or `github_actions`                       |
+
+**Non-interactive use (CI)**
+
+When stdin is not a TTY, `void github connect` never prompts — it fails closed and names any flag it needs. `--branch` is always required. `--project` must be resolvable (positional / `--project` / `VOID_PROJECT` / linked `.void/project.json`). `--installation` is required only when your account has more than one installation; otherwise the sole installation is used. `--repo` is required when the installation grants access to all repos or to more than one selected repo; when it grants exactly one repo that repo is used automatically. Use `void github installations` to discover the `installation_id`.
+
+```
+void github connect my-app \
+  --installation 42 \
+  --repo owner/my-app \
+  --branch main
+```
+
+**Project resolution** follows the same order as deploy: positional / `--project`, `VOID_PROJECT`, linked project (`.void/project.json`).
+
 ## Custom Domains
 
 ### `void domain add`