void 1.3.0 → 1.5.0

package/docs/reference/api/rewrites.md

@@ -10,7 +10,25 @@ URL rewrites re-dispatch a request at a different internal path without changing
 
 Re-dispatches the current request at `destination` and returns the resulting `Response`. The browser URL does not change — this is a server-side hop. If `destination` has no query string, the original request query is preserved. If `destination` includes a query string, it replaces the original query. `destination` must start with `/`; known generated routes autocomplete via [`RewriteDestination`](#rewritedestination), while arbitrary strings remain accepted for dynamic paths.
 
-`c.redirect()` also preserves request query params for internal destinations, but it merges rather than replaces: destination params win on collision, and request-only params are appended. On a request to a [named action](../../guide/pages-routing/actions-and-forms.md#named-actions), the action key (`?delete` in `POST /users/42?delete`) is not carried over, whether the action or middleware redirects. A redirect after which the browser sends the same request again keeps it: `307` and `308`, and `301` or `302` after a `PUT`, `PATCH` or `DELETE`.
+Pass a [`RouteDestination`](./types.md#route-types) object to check the route pattern and its parameters:
+
+```ts
+return c.rewrite({
+  pathname: '/users/:id',
+  params: { id: 42 },
+  query: { tab: 'activity' },
+});
+```
+
+For a typed redirect, build the URL with [`routeUrl()`](./types.md#routeurl-path-options):
+
+```ts
+import { routeUrl } from 'void/routes';
+
+return c.redirect(routeUrl('/users/:id', { params: { id: 42 } }));
+```
+
+`c.redirect()` merges request query parameters into internal destinations, with destination values taking precedence. Redirecting a [named action](../../guide/pages-routing/actions-and-forms.md#named-actions) to a GET page drops the action key: `POST /users/42?delete&tab=profile` redirects to `/users/42?tab=profile`. Redirects that preserve the request method keep the action key: `307` and `308`, or `301` and `302` after a `PUT`, `PATCH`, or `DELETE`.
 
 ```ts
 import { defineHandler } from 'void';
@@ -25,7 +43,7 @@ export const GET = defineHandler((c) => {
 
 ```ts
 interface CloudContext {
-  rewrite(destination: RewriteDestination): Promise<Response>;
+  rewrite(destination: RewriteDestination | RouteDestination): Promise<Response>;
 }
 ```
 

package/docs/reference/api/types.md

@@ -91,3 +91,44 @@ Generated route types used by the typed `fetch` client. Contains each route’s
 ```ts
 import type { RouteMap } from 'void/routes';
 ```
+
+## `void/routes` {#void-routes}
+
+### `routeUrl(path, options?)` {#routeurl-path-options}
+
+Build a relative URL string from a known page, HTTP, or WebSocket route pattern:
+
+```ts
+import { routeUrl } from 'void/routes';
+
+routeUrl('/users/:id', {
+  params: { id: 42 },
+  query: { tab: 'activity' },
+  hash: 'details',
+});
+// /users/42?tab=activity#details
+```
+
+| Option   | Type           | Description                                                                        |
+| -------- | -------------- | ---------------------------------------------------------------------------------- |
+| `params` | Route-specific | Required for dynamic routes. Each parameter accepts a `string` or `number`.        |
+| `query`  | `RouteQuery`   | Query parameters. Arrays become repeated keys; `null` and `undefined` are omitted. |
+| `hash`   | `string`       | URL fragment, such as `'details'` or `'#details'`.                                 |
+
+Static routes accept optional `query` and `hash` options. Pass raw parameter values for URL encoding. Catch-all parameters preserve `/` separators between segments. Invalid or missing path parameters throw a `TypeError`.
+
+Use the returned string with `Link`, `<a>`, and `c.redirect()`. See [Typed URLs and Navigation](../../guide/type-safety.md#typed-urls-and-navigation) for setup and examples.
+
+### Route types {#route-types}
+
+Import these types from `void/routes`:
+
+| Type                  | Description                                                                                     |
+| --------------------- | ----------------------------------------------------------------------------------------------- |
+| `RoutePathMap`        | Generated map of page, HTTP, and WebSocket route patterns to their parameter names.             |
+| `RoutePath`           | Union of the known route patterns in `RoutePathMap`.                                            |
+| `RouteOptions<P>`     | Options for a route pattern `P`, including its required `params`, optional `query`, and `hash`. |
+| `RouteDestination<P>` | `{ pathname: P }` with `RouteOptions<P>`. Defaults to all known routes when `P` is omitted.     |
+| `RouteUrlInput`       | `string`, `URL`, or `RouteDestination`; accepted by router navigation methods.                  |
+| `RouteQuery`          | Query keys mapped to `RouteQueryValue` or readonly arrays of those values.                      |
+| `RouteQueryValue`     | `string`, `number`, `boolean`, `null`, or `undefined`.                                          |

package/docs/reference/api.md

@@ -26,7 +26,7 @@ Use this reference to find public imports, signatures, and return types. For set
 | [Database and seeding](./api/database.md)          | Queries, operators, and seed scripts.                           |
 | [KV, storage, AI, and logging](./api/resources.md) | Resource clients, cache revalidation, and logs.                 |
 | [Deployment artifacts](./api/deploy.md)            | Package built apps for managed deployment.                      |
-| [Types](./api/types.md)                            | Handler context, route types, and head metadata.                |
+| [Types](./api/types.md)                            | Typed URLs, route types, handler context, and head metadata.    |
 | [Environment variables](./api/env.md)              | Validated environment values and binding types.                 |
 | [Pages adapters](./api/pages.md)                   | React, Vue, Svelte, Solid, and Markdown.                        |
 
@@ -64,7 +64,7 @@ Import Void's app-facing APIs from these paths:
 | `void/limits`             | `UsageLimit`, `UsageLimitData`, and `readUsageLimit`. AI and Sandbox limits reject with `UsageLimit`; uncaught limits in Void routes and Pages actions return structured HTTP 429 responses.                                                                                                                                                                                                                                                                                   |
 | `void/isr`                | `revalidate(options)` for on-demand ISR cache invalidation                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | `void/log`                | `logger` structured logging helper                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| `void/routes`             | `RouteMap` and `WebSocketRouteMap` stubs (types only)                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `void/routes`             | [`routeUrl()`](./api/types.md#routeurl-path-options), `RouteDestination`, `RoutePath`, `RouteOptions`, `RouteUrlInput`, and generated route maps                                                                                                                                                                                                                                                                                                                               |
 | `void/queues`             | `queues` proxy for sending messages to typed queues                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | `void/email`              | `sendEmail`, `createEmail`, `defineEmail`, `parseEmail`, `replyEmail`, `MimeError`, `ParseEmailError`, and address, attachment, result, and handler types. See [Email](../guide/email.md).                                                                                                                                                                                                                                                                                     |
 | `void/email/testing`      | `createEmailTestHarness` and `createInboundTestHarness` to capture sends and deliver test messages to `email/` handlers.                                                                                                                                                                                                                                                                                                                                                       |

package/docs/reference/cli/database.md

@@ -20,7 +20,7 @@ For SQLite, Void checks that the migration history applies to a fresh database.
 
 ## `void db status` {#void-db-status}
 
-Show migration status. Displays which migrations are applied or pending locally, then uses the saved deployment target for remote status: the hosted API for Void projects, the pinned D1 database and its configured migration table for direct Cloudflare SQLite projects, or the shell `DATABASE_URL` for direct Cloudflare PostgreSQL/MySQL projects. If the remote credential or service is unavailable, local status is still shown. If the local PostgreSQL or MySQL database cannot be read, local status shows `unknown`; the command fails when remote status is not available either.
+Show applied and pending migrations locally and on the saved deployment target. Direct Cloudflare PostgreSQL and MySQL projects use `DATABASE_URL` from the current shell for remote status.
 
 ## `void db reset` {#void-db-reset}
 
@@ -28,7 +28,7 @@ Show migration status. Displays which migrations are applied or pending locally,
 void db reset [--yes]
 ```
 
-Drop the development database and re-apply all migrations. D1 resets the local database. PostgreSQL drops the tables, views, sequences, and custom types in the `public` schema of the `DATABASE_URL` database from `.env` and keeps installed extensions. If a table, view, or function in another schema uses one of those views, sequences, or types, reset stops before it drops anything and lists those objects. MySQL drops every table and view in that database.
+Reset the development database and re-apply all migrations. D1 resets local data. PostgreSQL clears tables, views, sequences, and custom types from the `public` schema while preserving extensions; dependencies from other schemas must be resolved first. MySQL drops all tables and views. PostgreSQL and MySQL use `DATABASE_URL` from `.env`.
 
 When that `DATABASE_URL` points to a host other than `localhost`, Void names the database and asks before dropping its tables. Pass `--yes` to skip the prompt in scripts and CI; without a terminal, the command stops unless `--yes` is set. If `.env` uses the same URL as your deployment (for example after `void db connect`), reset drops the deployed tables.
 
@@ -87,7 +87,7 @@ By default, targets the local database. Pass `--remote` to open Studio against t
 
 - **Hosted PostgreSQL and MySQL projects**: fetch the stored connection string from the platform and open Studio against it. If the URL isn't stored yet, run `void db set-url` first.
 - **Direct Cloudflare PostgreSQL and MySQL projects**: use `DATABASE_URL` from the current shell.
-- **D1 projects**: remote Studio is not available. Use `void db execute --remote` to query your deployed D1 database.
+- **D1 projects**: use `void db execute --remote` to query the deployed database.
 
 ## `void db restore` {#void-db-restore}
 
@@ -96,19 +96,25 @@ void db restore --bookmark <bookmark> [--platform cloudflare] [--yes]
 void db restore --timestamp <iso-time> [--platform cloudflare] [--yes]
 ```
 
-Restore the deployed D1 database of a direct Cloudflare deploy with D1 [Time Travel](https://developers.cloudflare.com/d1/reference/time-travel/). Before `void deploy --platform cloudflare` applies migrations, it prints the `--bookmark` that undoes them. `--timestamp` restores the state at an ISO 8601 time with `Z` or an offset instead, such as `2026-10-16T09:30:00Z`, with at most millisecond precision. Time Travel keeps 7 days of history on Workers Free and 30 days on Workers Paid. An older bookmark or time can no longer be restored: Cloudflare rejects it and the database stays unchanged. To undo an older migration, write a new migration that reverses it.
+Restore a directly deployed Cloudflare D1 database using [Time Travel](https://developers.cloudflare.com/d1/reference/time-travel/). Use the bookmark printed before deployment migrations, or an ISO 8601 timestamp with a timezone, such as `2026-10-16T09:30:00Z`.
 
-If the project's saved destination is not Cloudflare and you deployed once with `void deploy --platform cloudflare`, pass `--platform cloudflare`; deploy prints the command with it.
+Time Travel keeps 7 days of history on Workers Free and 30 days on Workers Paid. Reverse older migrations with a new migration.
 
-Restoring replaces the whole database and discards every write made after that point. Void names the database and asks before it restores. Pass `--yes` to skip the prompt in scripts and CI; without a terminal, the command stops unless `--yes` is set. Afterwards Void prints the `void db restore` command that undoes the restore.
+Restoring discards every write made after the selected point. Void asks for confirmation and prints a command to undo the restore afterward. Pass `--yes` for scripts and CI.
 
-A restore also rewinds the record of applied migrations. Void lists the migration files the database no longer has applied; the next deploy applies them, so fix or remove the one that caused the problem first. Restoring does not change the deployed code: use [`void project rollback`](./project.md#void-project-rollback-deployid) if the live version needs the newer schema. After a one-off Cloudflare deploy, pass `--platform cloudflare` to `void project rollback` and `void deploy` as well.
+To recover from a bad migration:
+
+1. Roll back the code with [`void project rollback`](./project.md#void-project-rollback-deployid) if the live version needs the newer schema.
+2. Restore the database using the printed bookmark.
+3. Fix or remove the failed migration before deploying again. The restore also rewinds migration history, so the next deploy reapplies pending files.
+
+For a one-off Cloudflare deployment, add `--platform cloudflare` to restore, rollback, and deploy commands.
 
 ## `void db rename-migrations` {#void-db-rename-migrations}
 
-Rename existing migrations from the old numeric prefix format (`0001_name.sql`) to timestamp-based format (`20260410161500_name.sql`). Updates local tracking table and remote records if logged in with a linked project. A project that deploys to Void must be linked first with `void project link`; otherwise the command stops without changes.
+For linked Void platform projects, rename migrations from numeric prefixes (`0001_name.sql`) to timestamps (`20260410161500_name.sql`) and update local and remote migration records. Sign in and run `void project link` first.
 
-Direct Cloudflare deploys are not supported: Void cannot rename the records in the deployed database, so the command stops without changes. Keep the existing names; new migrations use timestamps and run after them.
+For direct Cloudflare deployments, keep existing filenames. New migrations use timestamps and run after them.
 
 ## `void db connect` {#void-db-connect}
 

package/docs/reference/cli/deploy.md

@@ -86,15 +86,16 @@ void deploy --platform cloudflare --require-email   # fail instead of deploying
 
 Void signs you in through your browser when needed and saves the selected account. In CI, set `CLOUDFLARE_API_TOKEN` and, if the token can access several accounts, `CLOUDFLARE_ACCOUNT_ID`.
 
-| Option or setting              | Cloudflare behavior                                                                    |
-| ------------------------------ | -------------------------------------------------------------------------------------- |
-| `--dir`, `--spa`               | Deploy static output through a small Worker and Workers Assets                         |
-| `--skip-build`                 | Reuse existing static, SPA, or SSG output; unavailable for Worker apps                 |
-| `--project`                    | Unavailable; the Worker and account come from `void.config.ts` and `void.lock.json`    |
-| Named environments             | Unavailable; use the top-level `cloudflare` config                                     |
-| `CLOUDFLARE_WORKERS_SUBDOMAIN` | Needed in fresh CI when versions have no preview URL; cached locally after a deploy    |
-| `--require-email`              | Fail instead of deploying without email when the email step cannot run, as in CI       |
-| `DATABASE_URL`                 | Required in the deploy environment for PostgreSQL or MySQL provisioning and migrations |
+| Option or setting              | Cloudflare behavior                                                                                                  |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------- |
+| `--dir`, `--spa`               | Deploy static output through a small Worker and Workers Assets                                                       |
+| `--skip-build`                 | Reuse existing static, SPA, or SSG output; unavailable for Worker apps                                               |
+| `--project`                    | Unavailable; the Worker and account come from `void.config.ts` and `void.lock.json`                                  |
+| Named environments             | Unavailable; use the top-level `cloudflare` config                                                                   |
+| `CLOUDFLARE_WORKERS_SUBDOMAIN` | Needed in fresh CI when versions have no preview URL; cached locally after a deploy                                  |
+| `CF_ACCESS_READINESS_ORIGIN`   | Lets Access credentials reach the readiness check on a route or Custom Domain, for example `https://app.example.com` |
+| `--require-email`              | Fail instead of deploying without email when the email step cannot run, as in CI                                     |
+| `DATABASE_URL`                 | Required in the deploy environment for PostgreSQL or MySQL provisioning and migrations                               |
 
 The token needs Workers Scripts: Edit, read access to bound resources, and edit access to products Void provisions. Commit `void.lock.json` after the first deploy before using other machines or CI.
 

package/docs/reference/cli/email.md

@@ -59,9 +59,11 @@ void email alias <name> [--yes] [--project <name>]
 
 With no name, show the project's address on the platform's shared mail domain and whether inbound mail reaches it.
 
-With a name, give that address a shorter name: `void email alias acme` makes `acme@<mail domain>` and `acme+<tag>@<mail domain>` reach the project and lets it send from them. Only the project owner can set it. The name follows the same rules as a project slug, must not be used by any other project's slug or alias, and names of five characters or fewer need a plan that allows short names.
+As the project owner, run `void email alias acme` to send and receive at `acme@<mail domain>` and `acme+<tag>@<mail domain>`. Choose an available name that follows the project slug rules. Names of five characters or fewer require a plan that allows short names.
 
-The alias is permanent: it cannot be changed or removed, and it is freed only when the project is deleted. The slug address keeps working for sending and receiving, so nothing that already uses it breaks. The CLI asks for confirmation; pass `--yes` to skip the prompt, which is required outside an interactive terminal. Inbound mail at the alias starts once the project has `email/` handlers deployed and its recipient rule is ready; run `void email alias` to check. Redeploy with the current `void` before you share the alias: an app built with an older version sees `message.to` with the alias still in front (`acme+support@…` instead of `support@…`).
+An alias is permanent and reserved until the project is deleted. The original slug address keeps working. The CLI asks for confirmation; use `--yes` in scripts and CI.
+
+Before sharing the alias, redeploy with the current Void version so handlers receive the expected `message.to` address. Inbound mail starts when the project's `email/` handlers and recipient rule are ready; run `void email alias` to check.
 
 ## `void email domain` {#void-email-domain}
 

package/docs/reference/cli/platform-installation.md

@@ -41,7 +41,7 @@ The installed platform needs a separate runtime token to provision resources for
 
 To enable email during install or upgrade, set both `VOID_EMAIL_SENDER_DOMAIN` and `VOID_EMAIL_SHARED_ZONE_ID`. Void records the pair for later upgrades; supplying only one is an error.
 
-Use `--dashboard-url `[`https://dash.example.com`](https://dash.example.com) when deploying the optional user
+Use `--dashboard-url https://dash.example.com` when deploying the optional user
 dashboard separately. The URL must be an HTTPS origin without credentials, a
 path, query, or fragment. Void permits that origin's login callbacks and saves
 it for later maintenance; it does not deploy a dashboard Worker. Omission keeps
@@ -138,7 +138,7 @@ After discovery on another machine, set `VOID_PLATFORM_DATABASE_URL`. See [Manag
 
 Repair and upgrade preserve disabled state. New, resumed, and previously disabled installations block user traffic until all target Workers pass verification; the installer's health probes can still run. Routes and custom domains remain attached.
 
-If a platform Worker was changed outside Void, or has an active version without a Void deployment record, a command that deploys the platform Workers stops before it changes a platform Worker or pauses traffic, unless you agree in a terminal to replace the changes. See [Platform Workers changed outside Void](../../guide/platform/installation/maintenance.md#workers-changed-outside-void).
+Replacing platform Worker configuration changed outside Void requires interactive approval. Follow [Platform Workers changed outside Void](../../guide/platform/installation/maintenance.md#workers-changed-outside-void) if maintenance asks for it.
 
 `--runtime` selects a custom platform build. Relative paths resolve from your current directory. Void verifies the build before making changes; see [Platform Development](../../guide/platform/development/runtime.md#deploying-your-runtime) for creating one.
 

package/docs/reference/cli/project.md

@@ -179,9 +179,9 @@ Roll back to a previous deployment or Worker Version.
 
 On a Void platform, you can select a retained deployment. On Cloudflare, use a complete Worker Version ID or an unambiguous prefix. Void activates that version at 100%. When both versions have complete trigger snapshots, it also restores the selected version's schedules, queues, workflows, routes, and custom domains. Otherwise, rollback keeps the current triggers and restores the code, including versions originally deployed outside Void.
 
-If the project's saved destination is not Cloudflare and you deployed once with `void deploy --platform cloudflare`, pass `--platform cloudflare` to roll back that Worker.
+Pass `--platform cloudflare` to roll back a one-off Cloudflare deployment.
 
-Rollback doesn't reverse database migrations. If older code may run against a newer schema, or migration metadata is missing, Void explains the risk and asks for confirmation. On Cloudflare, undo D1 migrations with [`void db restore`](./database.md#void-db-restore) and the restore point that deploy printed before it applied them, within 7 days on Workers Free or 30 days on Workers Paid.
+Database recovery is separate from code rollback. Void asks for confirmation when the earlier code may be incompatible with the current schema. For D1 on Cloudflare, use [`void db restore`](./database.md#void-db-restore) with the restore point printed during deployment.
 
 ## `void project cancel [deployId]` {#void-project-cancel-deployid}
 

package/docs/reference/cli/secrets.md

@@ -30,7 +30,7 @@ On a direct Cloudflare target, the value is stored as an encrypted Worker secret
 ## `void secret sync` {#void-secret-sync}
 
 ```
-void secret sync <file> [--project <name>]
+void secret sync <file> [--project <name>] [--yes]
 ```
 
 Upload production server values from a dotenv file stored outside your project. Include only keys declared in `env.ts`; leave out local development credentials and public `VITE_*` values.
@@ -39,6 +39,8 @@ Upload production server values from a dotenv file stored outside your project.
 void secret sync /secure/path/production.env
 ```
 
+Pass `--yes` to skip confirmation in scripts and CI.
+
 Existing remote secrets absent from the file are kept. Every entry must be a server key declared in `env.ts`, and its value must pass validation.
 
 ## `void secret delete` {#void-secret-delete}

package/docs/reference/cli/setup.md

@@ -23,7 +23,7 @@ Resources recorded in `void.lock.json` without a matching definition appear sepa
 
 `void migrate` converts legacy `void.json` and root `wrangler.jsonc` or `wrangler.json` files into `void.config.ts`. It also accepts one root `wrangler*.json(c)` file referenced by a supported framework adapter. Void saves backups in `.void/config-migration/`, records resource IDs in `void.lock.json`, and updates supported adapters to use its generated Cloudflare config.
 
-`.void-wrangler.jsonc` is generated for Cloudflare tooling and belongs in `.gitignore`; migration adds the entry. Review and commit `void.config.ts`, `void.lock.json`, and `.gitignore`. `void init` and `void deploy` migrate legacy files automatically. If the project has conflicting or multiple Cloudflare configs, resolve them first. The project's installed `void` package must match the CLI version before Cloudflare deployment.
+The command adds generated `.cloudflare/` and `.void-wrangler.jsonc` files to `.gitignore` as needed. Review and commit `void.config.ts`, `void.lock.json`, and `.gitignore`. `void init` and `void deploy` migrate legacy files automatically. Resolve conflicting Cloudflare configs first, and keep the project's `void` package and CLI on the same version.
 
 ## `void init` {#void-init}
 
@@ -34,7 +34,7 @@ void init [--tsconfig] [--github] [--git | --no-git]
 
 Set up a new or existing Void project. In an empty directory, choose Vite+ or Vite, a framework, and a D1, PostgreSQL, MySQL, or Static Pages starter.
 
-To scaffold without prompts, for example from a script or a coding agent, pass the choices as flags. Without an interactive terminal, init stops and names the flag it needs instead of prompting.
+Pass your choices as flags to scaffold from a script or coding agent:
 
 | Flag          | Values                                    |
 | ------------- | ----------------------------------------- |
@@ -48,7 +48,7 @@ void init --toolchain vite-plus --framework react --starter sqlite --deploy none
 npm create void@latest my-app -- --toolchain vite-plus --framework react --starter sqlite --deploy none
 ```
 
-Cloudflare and Void platform setup still sign in interactively. Without a terminal, choose `--deploy none` and run `void connect` later.
+For non-interactive scaffolding, choose `--deploy none` and run `void connect` later to sign in.
 
 Vite+ projects install dependencies through `vp install`; no global Vite+ installation is required. Void preserves existing package-manager versions and lockfiles. New Vite+ projects without a package-manager configuration use pnpm without pinning a version.
 

package/docs/reference/cli.md

@@ -76,7 +76,7 @@ Use this page as a command reference. If you are setting up a project for the fi
 | `void email alias [name]`         | Show the shared mail address, or give it a shorter permanent name             |
 | `void email domain`               | Send and receive at your own domain on a Cloudflare zone                      |
 | `void init`                       | Set up a new or existing project, including coding agents                     |
-| `void migrate`                    | Convert legacy `void.json` and root Wrangler JSON/JSONC into `void.config.ts` |
+| `void migrate`                    | Update project configuration                                                  |
 
 ## Binary Invocation {#binary-invocation}
 

package/docs/reference/config.md

@@ -63,7 +63,7 @@ With that config, Void reads `src/pages`, `src/routes`, `src/db/schema.ts`, `src
 
 ### `ai`
 
-`ai.gateway` names the Cloudflare AI Gateway that `ai.provider().fetch()` uses when your app runs on your own Cloudflare account. `ai.run()`, `ai.stream()`, and `ai.image()` use the Workers AI binding and do not need a gateway. On a Void platform, the platform selects the gateway and ignores this setting.
+Set `ai.gateway` to the Cloudflare AI Gateway used by `ai.provider().fetch()` on your own Cloudflare account. `ai.run()`, `ai.stream()`, and `ai.image()` use the Workers AI binding. On a Void platform, the platform selects the gateway.
 
 ```json
 { "ai": { "gateway": "my-gateway" } }
@@ -297,7 +297,7 @@ Void-managed WebSocket route files (`*.ws.ts`) are Cloudflare-only because they
 
 ### `worker`
 
-Curated Cloudflare Workers configuration. `void init` pins `compatibility_date` here. Binding arrays such as `d1_databases`, `kv_namespaces`, and `r2_buckets` go in [`cloudflare`](#cloudflare), where Void preserves custom settings and resolved IDs during deployment.
+Cloudflare Workers settings, including the `compatibility_date` pinned by `void init`. Put binding arrays such as `d1_databases`, `kv_namespaces`, and `r2_buckets` in [`cloudflare`](#cloudflare).
 
 | Field                 | Type       | Description                            |
 | --------------------- | ---------- | -------------------------------------- |
@@ -366,6 +366,16 @@ This choice applies to subsequent `void deploy` runs. Atomic deployment sends tr
 
 Routing and edge configuration for headers, redirects, rewrites, and caching.
 
+#### `routing.alwaysUseHttps`
+
+Redirect HTTP requests to HTTPS with a permanent `308` redirect. Omitted or `false` means off. Requires the Cloudflare target. `localhost` stays on HTTP. See [HTTP to HTTPS](../guide/edge/redirects#http-to-https) for where it works.
+
+```ts
+routing: {
+  alwaysUseHttps: true,
+}
+```
+
 #### `routing.headers`
 
 Custom response headers. Keys are URL patterns, values are arrays of `"Name: value"` strings. See [Custom Headers](../guide/edge/headers) for details.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "void",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "Full-stack framework and deployment CLI for Cloudflare Workers, powered by Vite.",
   "homepage": "https://void.cloud",
   "bugs": {
@@ -90,7 +90,9 @@
       "require": "./dist/runtime/validator.mjs"
     },
     "./routes": {
-      "types": "./dist/routes-stub.d.mts"
+      "types": "./dist/routes-stub.d.mts",
+      "import": "./dist/routes-stub.mjs",
+      "require": "./dist/routes-stub.mjs"
     },
     "./nitro": {
       "types": "./dist/nitro.d.mts",
@@ -341,55 +343,57 @@
     }
   },
   "dependencies": {
-    "@cloudflare/build-output-utils": "^0.9.3",
-    "@cloudflare/codemods": "^0.5.1",
-    "@cloudflare/config": "^0.27.0",
-    "@cloudflare/sandbox": "^1.0.2",
-    "@cloudflare/vite-plugin": "^1.64.0",
-    "@cloudflare/workers-auth": "^0.14.1",
-    "@cloudflare/workers-types": "^5.20261019.1",
+    "@cloudflare/build-output-utils": "^0.9.7",
+    "@cloudflare/codemods": "^0.7.1",
+    "@cloudflare/config": "^0.29.1",
+    "@cloudflare/sandbox": "^1.0.3",
+    "@cloudflare/vite-plugin": "^2.0.0-beta.v.9",
+    "@cloudflare/workers-auth": "^0.15.4",
+    "@cloudflare/workers-types": "^5.20261102.1",
+    "@cloudflare/workers-utils": "^0.50.2",
     "@napi-rs/keyring": "^2.1.2",
-    "@void/deploy-cloudflare": "1.3.0",
-    "@void/deploy-core": "1.3.0",
-    "@void/edge": "1.3.0",
-    "@void/isr": "1.3.0",
-    "@void/platform": "1.3.0",
-    "better-auth": "^1.7.11",
+    "@void/deploy-cloudflare": "1.5.0",
+    "@void/deploy-core": "1.5.0",
+    "@void/edge": "1.5.0",
+    "@void/isr": "1.5.0",
+    "@void/platform": "1.5.0",
+    "better-auth": "^1.7.14",
     "better-sqlite3": "^13.0.3",
     "blake3-jit": "^1.1.0",
-    "cf": ">=1.0.0-beta.18 <1.0.0-beta.19",
+    "cf": "^1.0.0-beta.26",
     "drizzle-arktype": "^0.1.3",
     "drizzle-kit": "^0.31.11",
     "drizzle-orm": "^0.45.4",
     "drizzle-valibot": "^0.4.2",
     "drizzle-zod": "^0.8.3",
     "email-validator": "^2.0.4",
-    "hono": "^4.13.13",
-    "ignore": "^7.0.12",
+    "hono": "^4.13.16",
+    "ignore": "^7.0.14",
     "jiti": "^2.7.0",
     "jsonc-parser": "^3.3.1",
-    "mime": "^4.1.1",
-    "miniflare": "^5.20261012.1-beta",
-    "minimatch": "^10.2.6",
+    "mime": "^4.1.2",
+    "miniflare": "^5.20261101.0-beta",
+    "minimatch": "^11.0.3",
     "mysql2": "^3.24.6",
     "pg": "^8.23.1",
-    "postal-mime": "^4.0.11",
+    "postal-mime": "^4.2.0",
     "proper-lockfile": "^4.1.2",
+    "smol-toml": "^1.9.1",
     "terminal-link": "^5.0.0",
     "yaml": "^2.9.1"
   },
   "devDependencies": {
-    "@electric-sql/pglite": "0.5.10",
+    "@electric-sql/pglite": "0.5.14",
     "@types/better-sqlite3": "^9.6.0",
-    "@types/node": "^26.6.5",
+    "@types/node": "^26.6.6",
     "@types/pg": "^8.23.1",
     "@types/proper-lockfile": "^4.1.4",
-    "@voidzero-dev/vite-plus-prompts": "1.3.0",
-    "arktype": "^2.2.8",
+    "@voidzero-dev/vite-plus-prompts": "1.4.0",
+    "arktype": "^2.2.9",
     "ci-info": "^4.4.0",
     "estree-walker": "^3.0.3",
     "fast-wrap-ansi": "^0.2.2",
-    "magic-string": "^1.4.3",
+    "magic-string": "^1.4.5",
     "ofetch": "2.0.0-alpha.3",
     "pathslash": "^0.1.0",
     "pglite-server": "0.1.5",
@@ -397,12 +401,12 @@
     "tinyglobby": "^0.2.17",
     "typescript": "7.0.2",
     "valibot": "^1.5.0",
-    "vite": "npm:@voidzero-dev/vite-plus-core@1.3.0",
-    "vite-plus": "1.3.0",
+    "vite": "npm:@voidzero-dev/vite-plus-core@1.4.0",
+    "vite-plus": "1.4.0",
     "zod": "^4.6.7"
   },
   "peerDependencies": {
-    "@void/md": "1.3.0",
+    "@void/md": "1.5.0",
     "arktype": ">=2.0.0",
     "valibot": ">=1.0.0-beta.7",
     "vite": "^8.0.0",
@@ -423,7 +427,7 @@
     }
   },
   "engines": {
-    "node": ">=24.21.0"
+    "node": "^24.22.0 || >=26.12.0"
   },
   "scripts": {
     "build": "node scripts/sync-docs.mjs && vp pack",

package/sandbox.Dockerfile

@@ -1,4 +1,4 @@
 FROM node:26.12.1-trixie-slim
-COPY --from=docker.io/cloudflare/sandbox:1.0.2 /usr/local/bin/sandbox-shim /usr/local/bin/sandbox-shim
+COPY --from=docker.io/cloudflare/sandbox:1.0.3 /usr/local/bin/sandbox-shim /usr/local/bin/sandbox-shim
 WORKDIR /workspace
 CMD ["sleep", "infinity"]

package/schema.json

@@ -144,6 +144,10 @@
       "type": "object",
       "description": "Routing configuration — headers, redirects, rewrites, fallbacks, revalidation, prerendering.",
       "properties": {
+        "alwaysUseHttps": {
+          "type": "boolean",
+          "description": "Redirect HTTP requests to HTTPS with a permanent 308 redirect. Omitted or false means off. Requires the Cloudflare target; localhost stays on HTTP."
+        },
         "isr": {
           "type": "boolean",
           "description": "Enable inferred ISR caching. Set false to disable ISR and edge prerendering, including per-page prerender and revalidate policies. Does not disable output: static build-time prerendering."

package/skills/void/SKILL.md

@@ -49,7 +49,7 @@ the app's existing saved destination, including when the target project is new.
 | Email                                      | `docs/guide/email.md`, then the matching guide under `docs/guide/email/`                  |
 | KV / storage / queues / cron jobs          | `docs/guide/kv.md`, `docs/guide/storage.md`, `docs/guide/queues.md`, `docs/guide/jobs.md` |
 | SSR and caching                            | `docs/guide/ssr.md`, `docs/guide/edge/*.md`                                               |
-| Rewrites, redirects, fallbacks             | `docs/guide/edge/rewrites.md`, `docs/guide/edge/redirects.md`, `docs/reference/config.md` |
+| HTTPS, rewrites, redirects, fallbacks      | `docs/guide/edge/rewrites.md`, `docs/guide/edge/redirects.md`, `docs/reference/config.md` |
 | Static site generation                     | `docs/guide/ssg.md`                                                                       |
 | Connected apps and artifact preparation    | `docs/guide/platform/administration/connected-apps.md`, `docs/reference/api/deploy.md`    |
 | Deployment and CI                          | `docs/guide/deployment.md`, `docs/reference/cli/deploy.md`                                |

package/dist/auth-DkcFflXV.d.mts

@@ -1,42 +0,0 @@
-import { AsyncLocalStorage } from "node:async_hooks";
-import { BetterAuthOptions, Session, User } from "better-auth";
-import { Context, Env } from "hono";
-//#region src/runtime/auth.d.ts
-type AuthUser = User;
-type AuthSession = Session;
-type AuthState = {
-  session: AuthSession;
-  user: AuthUser;
-};
-type VoidAuthConfigContext = {
-  defaults: BetterAuthOptions;
-  env: Record<string, unknown>;
-  dialect: "sqlite" | "postgresql" | "mysql";
-  request: Request;
-};
-type VoidAuthConfig = BetterAuthOptions | ((ctx: VoidAuthConfigContext) => BetterAuthOptions);
-/**
- * Shared AsyncLocalStorage that holds the authenticated Better Auth state for the
- * current request.
- *
- * Stored on `globalThis` under a `Symbol.for` key so duplicate module loads
- * (e.g. once by void's bundled runtime and once by Vite's SSR module runner
- * when user code imports from `void/auth`) share a single ALS instance. Without
- * this, the middleware writes to one instance and `getUser()` reads another,
- * always returning null.
- */
-type AuthContextStore = {
-  user: AuthUser | null;
-  state: AuthState | null;
-};
-declare const authContext: AsyncLocalStorage<AuthContextStore>;
-declare function defineAuth<T extends VoidAuthConfig>(config: T): T;
-declare function getUser(): AuthUser | null;
-declare function getSession(): AuthState | null;
-declare function requireAuth<E extends Env & {
-  Variables: {
-    user: AuthUser | null;
-  };
-}>(c: Context<E>): AuthUser;
-//#endregion
-export { VoidAuthConfigContext as a, getSession as c, VoidAuthConfig as i, getUser as l, AuthState as n, authContext as o, AuthUser as r, defineAuth as s, AuthSession as t, requireAuth as u };

package/dist/cf-build-output-DlBkWdNU.mjs

@@ -1 +0,0 @@
-export { t as prepareCfBuildOutput } from "./cf-build-output-Bapzc_8Z.mjs";

package/dist/client-DyxPQnF_.mjs

@@ -1 +0,0 @@
-export { r as PlatformClient } from "./client-BEMtySaV.mjs";

package/dist/collect-BWhkgtAn.mjs

@@ -1 +0,0 @@
-export { t as collectMigrations } from "./collect-Dew86qce.mjs";

package/dist/config-BTu1o3Dc.mjs

@@ -1,49 +0,0 @@
-import { n as readProjectPaths } from "./project-paths-DGu_QZ_Q.mjs";
-import { existsSync, readFileSync } from "node:fs";
-import { pathToFileURL } from "node:url";
-import { isRunnableDevEnvironment, parseSync } from "vite";
-//#region src/auth/config.ts
-function isVoidAuthConfigSource(code, filename) {
-	if (!code.includes("void/auth")) return false;
-	let program;
-	try {
-		program = parseSync(filename, code).program;
-	} catch {
-		return false;
-	}
-	return (program.body ?? []).some((node) => {
-		if (node.type !== "ImportDeclaration" && node.type !== "ExportNamedDeclaration" && node.type !== "ExportAllDeclaration") return false;
-		return node.source?.value === "void/auth";
-	});
-}
-function findVoidAuthConfig(root, paths = readProjectPaths(root)) {
-	for (const absPath of paths.authConfigCandidates) {
-		if (!existsSync(absPath)) continue;
-		if (isVoidAuthConfigSource(readFileSync(absPath, "utf-8"), absPath)) return absPath;
-	}
-	return null;
-}
-/**
-* The dev server evaluates the auth config in this Node environment. A native
-* `import()` would keep the first evaluation for the life of the process; the
-* module runner reads the config again once its files are invalidated, and the
-* module graph lists the local files the config imports.
-*/
-const AUTH_CONFIG_ENVIRONMENT = "void_auth_config";
-/** The dev server's importer for the auth config, when it has the environment. */
-function devAuthConfigImporter(server) {
-	const environment = server.environments[AUTH_CONFIG_ENVIRONMENT];
-	return environment && isRunnableDevEnvironment(environment) ? (path) => environment.runner.import(path) : void 0;
-}
-/**
-* Evaluate the auth config. A native `import()` keeps its first evaluation for
-* the life of the process, which suits one-off commands; the dev server passes
-* its module runner.
-*/
-async function loadVoidAuthConfig(configPath, importModule = (path) => import(pathToFileURL(path).href)) {
-	if (!configPath) return;
-	const mod = await importModule(configPath);
-	return mod.default ?? mod.auth ?? mod.config;
-}
-//#endregion
-export { loadVoidAuthConfig as i, devAuthConfigImporter as n, findVoidAuthConfig as r, AUTH_CONFIG_ENVIRONMENT as t };

package/dist/deploy-CtHE2A3R.mjs

@@ -1,2 +0,0 @@
-import "./deploy-transport-JCxw7QDi.mjs";
-export { i as checkWranglerMigrationApplySet, t as parseRootWranglerConfig, r as runDeploy } from "./deploy-hRPvw8ci.mjs";