void 1.4.0 → 1.6.0

package/dist/validation-error-uAAjlsiW.mjs

@@ -0,0 +1,82 @@
+// src/runtime/handler-composition.ts
+const compositionKey = "__voidHandlerComposition";
+function getHandlerComposition(handler) {
+	return handler?.[compositionKey];
+}
+/** Record the composition; a nested composed leaf is flattened into one chain. */
+function setHandlerComposition(handler, middlewares, leaf) {
+	const nested = getHandlerComposition(leaf);
+	const composition = nested ? {
+		middlewares: [...middlewares, ...nested.middlewares],
+		leaf: nested.leaf
+	} : {
+		middlewares,
+		leaf
+	};
+	Object.defineProperty(handler, compositionKey, { value: composition });
+	return handler;
+}
+/**
+* Run middleware on the current context around `endpoint`, the way Hono's
+* compose does: a Response returned by a middleware replaces `c.res`, the
+* endpoint's Response becomes `c.res`, and middleware can edit `c.res` after
+* `next()`. Returns the final `c.res`.
+*/
+async function executeComposedHandler(c, middlewares, endpoint) {
+	let index = 0;
+	const dispatch = async () => {
+		if (index < middlewares.length) {
+			const response = await middlewares[index++](c, dispatch);
+			if (response instanceof Response) c.res = response;
+		} else c.res = await endpoint();
+	};
+	await dispatch();
+	return c.res;
+}
+// src/pages/defer.ts
+const DEFERRED = Symbol("deferred");
+function defer(groupOrResolver, maybeResolver) {
+	const [group, resolver] = typeof groupOrResolver === "string" ? [groupOrResolver, maybeResolver] : [null, groupOrResolver];
+	return {
+		[DEFERRED]: true,
+		group,
+		resolver
+	};
+}
+/**
+* Separate a loader's return value into immediate props and deferred sentinels.
+* For single-prop deferred (group=null), the object key becomes the group name.
+* For named groups, all keys sharing the same group name are collected.
+*/
+function separateDeferred(props) {
+	const immediateProps = {};
+	const deferredMap = {};
+	for (const [key, value] of Object.entries(props)) if (value && typeof value === "object" && DEFERRED in value) {
+		const sentinel = value;
+		const groupName = sentinel.group ?? key;
+		if (!deferredMap[groupName]) deferredMap[groupName] = {
+			resolver: sentinel.resolver,
+			keys: []
+		};
+		deferredMap[groupName].keys.push(key);
+		immediateProps[key] = {
+			value: null,
+			loading: true,
+			error: null
+		};
+	} else immediateProps[key] = value;
+	return {
+		immediateProps,
+		deferredMap
+	};
+}
+// src/pages/validation-error.ts
+var ValidationError = class extends Error {
+	errors;
+	constructor(errors) {
+		super("Validation failed");
+		this.name = "ValidationError";
+		this.errors = errors;
+	}
+};
+export { executeComposedHandler as a, separateDeferred as i, DEFERRED as n, getHandlerComposition as o, defer as r, setHandlerComposition as s, ValidationError as t };

package/dist/{validator-BTOu0fB0.mjs → validator-CTfmzZYb.mjs}

@@ -1,4 +1,4 @@
-//#region src/runtime/validator.ts
+// src/runtime/validator.ts
 function flattenIssues(issues) {
 	return Array.from(issues, (issue) => ({
 		message: issue.message,
@@ -29,9 +29,7 @@ async function runValidation(validators, c) {
 		});
 	}
 	if (validators.query) {
-		const url = new URL(c.req.url);
-		const raw = {};
-		for (const [key, value] of url.searchParams) raw[key] = value;
+		const raw = Object.fromEntries(Object.entries(c.req.queries()).map(([key, values]) => [key, values.length === 1 ? values[0] : values]));
 		const result = await validateSlot(validators.query, raw);
 		if (result.ok) input.query = result.value;
 		else allIssues.push({
@@ -68,5 +66,4 @@ async function runValidation(validators, c) {
 		input
 	};
 }
-//#endregion
 export { runValidation as t };

package/dist/{version-metadata-D2vfMQzv.mjs → version-metadata-C8hLzQkv.mjs}

@@ -1,6 +1,6 @@
-import { a as join } from "./dist-ipQi0Q8y.mjs";
-import { l as bindingNamesForField, p as findBindingNameOwner } from "./wrangler-I-scB_1t.mjs";
-//#region src/shared/untrusted-env.ts
+import { a as join } from "./dist-DMYe8CZJ.mjs";
+import { l as bindingNamesForField, p as findBindingNameOwner } from "./wrangler-DESSbN8L.mjs";
+// src/shared/untrusted-env.ts
 /** Authentication inputs that Wrangler may consume from the environment. */
 const WRANGLER_AUTH_CREDENTIAL_ENV_VARS = [
 	"CLOUDFLARE_API_TOKEN",
@@ -48,8 +48,7 @@ function buildEnv(extra, options) {
 	env[pathKey] = existing ? `${binDir}${delimiter}${existing}` : binDir;
 	return env;
 }
-//#endregion
-//#region src/shared/version-metadata.ts
+// src/shared/version-metadata.ts
 /** Build-only marker: an existing-site handoff must not add Worker bindings. */
 const CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV = "VOID_CLOUDFLARE_PRESERVE_BINDINGS";
 const DEFAULT_VERSION_METADATA_BINDING = "__VOID_VERSION_METADATA";
@@ -70,5 +69,4 @@ function selectNativeVersionMetadataBinding(config, options) {
 	if (owner) throw new Error(`Cloudflare version metadata binding ${DEFAULT_VERSION_METADATA_BINDING} conflicts with ${owner}.`);
 	return DEFAULT_VERSION_METADATA_BINDING;
 }
-//#endregion
 export { buildEnv as a, WRANGLER_AUTH_CREDENTIAL_ENV_VARS as i, readVersionMetadataBinding as n, selectNativeVersionMetadataBinding as r, CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV as t };

package/dist/{worker-conditions-AWFRcFxR.mjs → worker-conditions-CBZ0RYsZ.mjs}

@@ -1,4 +1,4 @@
-//#region src/cli/worker-conditions.ts
+// src/cli/worker-conditions.ts
 const WORKER_CONDITIONS = [
 	"workerd",
 	"worker",
@@ -7,5 +7,4 @@ const WORKER_CONDITIONS = [
 	"import",
 	"default"
 ];
-//#endregion
 export { WORKER_CONDITIONS as t };

package/dist/{wrangler-I-scB_1t.mjs → wrangler-DESSbN8L.mjs}

@@ -1,14 +1,14 @@
-import { a as join, c as resolve, n as dirname, o as normalize, t as basename } from "./dist-ipQi0Q8y.mjs";
-import { o as TYPED_CONFIG_FILE, s as loadTypedVoidConfigFile } from "./project-paths-DGu_QZ_Q.mjs";
-import { h as validateConfig, p as readConfig } from "./config-OFOAimzt.mjs";
-import { a as persistCloudflareConfig, i as materializeCloudflareConfig, r as ignoreMaterializedCloudflareConfig } from "./cloudflare-config-CH1AylZT.mjs";
+import { a as join, c as resolve, n as dirname, o as normalize, t as basename } from "./dist-DMYe8CZJ.mjs";
+import { o as TYPED_CONFIG_FILE, s as loadTypedVoidConfigFile } from "./project-paths-CdGv9Tmi.mjs";
+import { h as validateConfig, p as readConfig } from "./config-BITKQ3O6.mjs";
+import { a as persistCloudflareConfig, i as materializeCloudflareConfig, r as ignoreMaterializedCloudflareConfig } from "./cloudflare-config-eQunqX6A.mjs";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { parseSync } from "vite";
 import { appendSqliteClassMigration, isRecord } from "@void/deploy-core";
 import { createHash } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { SyntaxKind, applyEdits, createScanner, findNodeAtLocation, modify, parse, parseTree } from "jsonc-parser";
-//#region src/config-write.ts
+// src/config-write.ts
 const GENERATED_MARKERS = [
 	"// Generated by void migrate.",
 	"// Generated from void.json by void migrate.",
@@ -62,8 +62,7 @@ function writeVoidProjectConfig(root, config) {
 	}
 	writeFileSync(path, renderVoidConfig(config, "// Generated by void init."));
 }
-//#endregion
-//#region src/cli/wrangler.ts
+// src/cli/wrangler.ts
 const COMPAT_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 /** UTF-8 byte-order mark. Node's utf-8 read preserves a leading one. */
 const UTF8_BOM = "";
@@ -1467,5 +1466,4 @@ function normalizeMigrationsPath(p) {
 	const normalized = normalize(p.replace(/\\/g, "/"));
 	return normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
 }
-//#endregion
 export { syncWranglerWebSockets as A, readWranglerManagedQueueCleanupCandidates as C, sameMigrationsDir as D, resolveLiveBindingConfig as E, canRewriteVoidProjectConfig as F, renderVoidConfig as I, writeVoidProjectConfig as L, writeProvisionedWranglerConfig as M, writeWranglerPublishedTrafficSnapshot as N, syncWranglerBindings as O, GENERATED_MARKERS as P, readWranglerCustomDomains as S, readWranglerWebSocketTombstones as T, persistMaterializedWranglerConfig as _, LIVE_MIGRATION_TAG as a, readRootWranglerConfig as b, bindingEntriesForField as c, ensureWranglerCompatibilityDate as d, ensureWranglerNodejsAlsFlag as f, normalizeWranglerCompatibilityFlags as g, nextDurableObjectMigrationTag as h, LATEST_KNOWN_COMPAT_DATE as i, updateWranglerCustomDomain as j, syncWranglerDurableObjects as k, bindingNamesForField as l, hasDurableObjectSqliteMigration as m, DEFAULT_LIVE_CLASS as n, acknowledgeWranglerManagedQueueRemovals as o, findBindingNameOwner as p, FRIENDLY_BINDING_NAMES as r, assertNoDuplicateMembers as s, DEFAULT_LIVE_BINDING as t, ensureWranglerCompat as u, readExistingLiveBindingConfig as v, readWranglerPublishedTrafficSnapshot as w, readWranglerCompat as x, readProvisionedBindingEntry as y };

package/dist/wrangler-DUB3MGHV.mjs

@@ -0,0 +1 @@
+export { b as readRootWranglerConfig } from "./wrangler-DESSbN8L.mjs";

package/dist/{wrapper-BBl1rC32.mjs → wrapper-C9SUxoj7.mjs}

@@ -1,16 +1,16 @@
-import { a as join, l as toSlash, n as dirname, r as extname } from "./dist-ipQi0Q8y.mjs";
-import { n as readProjectPaths } from "./project-paths-DGu_QZ_Q.mjs";
-import { l as getDatabaseDialect, p as readConfig } from "./config-OFOAimzt.mjs";
-import { n as isIdentifier, r as isLiteral } from "./ast-CsZ_q_gc.mjs";
-import { t as MagicString } from "./dist-Cegxq8gs.mjs";
-import { c as voidDbBundlerPlugin, r as cloudflareQueueName, t as generateQueueResolverSource } from "./dispatch-CLa2LThw.mjs";
-import { t as WORKER_CONDITIONS } from "./worker-conditions-AWFRcFxR.mjs";
+import { a as join, l as toSlash, n as dirname, r as extname } from "./dist-DMYe8CZJ.mjs";
+import { n as readProjectPaths } from "./project-paths-CdGv9Tmi.mjs";
+import { l as getDatabaseDialect, p as readConfig } from "./config-BITKQ3O6.mjs";
+import { n as isIdentifier, r as isLiteral } from "./ast-Cv0JwXqb.mjs";
+import { t as MagicString } from "./dist-B6eN80gc.mjs";
+import { c as voidDbBundlerPlugin, r as cloudflareQueueName, t as generateQueueResolverSource } from "./dispatch-BNLB5_Gm.mjs";
+import { t as WORKER_CONDITIONS } from "./worker-conditions-CBZ0RYsZ.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { build, parseSync } from "vite";
 import { fileURLToPath } from "node:url";
 import { createHash } from "node:crypto";
-//#region src/cli/worker-require-transform.ts
+// src/cli/worker-require-transform.ts
 function nodes(root) {
 	const found = [];
 	const pending = [root];
@@ -77,8 +77,7 @@ function transformWorkerRequireBundle(code, filename, requireShim, database) {
 	if (transformed.includes("createRequire") || transformed.includes("__require(\"pgpass\")")) throw new Error(`deploy: ${database} bundle ${filename} still contains an unsupported require.`);
 	return pgpassCalls > 0 ? `const __voidPgpassNoop = Object.assign(function pgpass(_connectionInfo, callback) { callback(undefined); }, { warnTo() {} });\n${transformed}` : transformed;
 }
-//#endregion
-//#region src/cli/wrapper.ts
+// src/cli/wrapper.ts
 const BUNDLED_ENTRY_RE = /^index\.(?:m?js|cjs)$/;
 const envModuleFile = fileURLToPath(import.meta.resolve("#self/_env"));
 const WRAPPER_MARKER = "// Generated by Void: deployment wrapper.";
@@ -151,8 +150,8 @@ async function generateWrapper(workerDir, workerMain, root, features) {
 	let migrations;
 	let migrationPlanBundle;
 	if (features.hasMigrations) {
-		const { collectMigrations } = await import("./collect-BWhkgtAn.mjs");
-		const { buildMigrationPlanBundle } = await import("./plan-CKX_jWnD.mjs");
+		const { collectMigrations } = await import("./collect-8i0wU63d.mjs");
+		const { buildMigrationPlanBundle } = await import("./plan-CQ-N4gws.mjs");
 		const migrationsDir = readProjectPaths(root).migrationsDir;
 		migrations = collectMigrations(migrationsDir);
 		migrationPlanBundle = features.migrationDialect === "sqlite" ? buildMigrationPlanBundle(migrations) : void 0;
@@ -651,11 +650,15 @@ export async function handleQueueRelay(payload, env, ctx) {
     retryAll(options) { for (const message of messages) message.retry(options); },
   };
   let ok = true;
-  try { await handleQueue(batch, env, ctx); } catch { ok = false; }
+  try {
+    await handleQueue(batch, env, ctx);
+  } catch (error) {
+    console.error(\`[void] Queue handler failed for queue "\${payload.queue}":\`, error);
+    ok = false;
+  }
   return { ok, ...(decisions.size ? { decisions: Object.fromEntries(decisions) } : {}) };
 }`);
 	}
 	return lines.join("\n");
 }
-//#endregion
 export { needsWrapper as a, generateWrapper as i, bundleWorkerSqlDriver as n, cleanupWrapper as r, bundleEntry as t };

package/dist/{ws-B3ClMVDh.d.mts → ws-Dmjg5NH2.d.mts}

@@ -1,8 +1,7 @@
-import { t as StandardSchemaV1 } from "./standard-schema-Fo_vCAZh.mjs";
-import { r as AuthUser } from "./auth-g2TQbDLD.mjs";
-import { a as CloudEnv } from "./handler-BHktmuTL.mjs";
+import { t as StandardSchemaV1 } from "./standard-schema-CuDawHOC.mjs";
+import { r as AuthUser } from "./auth-CH4PLAX1.mjs";
+import { a as CloudEnv } from "./handler-BR6Tvjkp.mjs";
 import { WebSocketRouteMap } from "void/routes";
-//#region src/runtime/ws.d.ts
 type MaybePromise<T> = T | Promise<T>;
 type ParamsRecord = Record<string, string>;
 type WebSocketInstanceKey = (context: {
@@ -135,5 +134,4 @@ declare class VoidSocket<P extends keyof WebSocketRouteMap & string> {
 }
 declare function connect<P extends keyof WebSocketRouteMap & string>(path: HasParams<P> extends false ? P : never): VoidSocket<P>;
 declare function connect<P extends keyof WebSocketRouteMap & string>(path: P, options: ConnectOptions<P>): VoidSocket<P>;
-//#endregion
 export { RoomDefinition as a, VoidSocket as c, WebSocketConnection as d, WebSocketInstanceKey as f, defineWebSocket as h, RoomController as i, VoidSocketCloseEvent as l, defineRoom as m, ConnectCommonOptions as n, SocketContext as o, connect as p, RoomContext as r, SocketDefinition as s, AnyWebSocketDefinition as t, WebSocketBaseContext as u };

package/dist/{yarn-pnp-DLbEFMT0.mjs → yarn-pnp-DgWbE7z5.mjs}

@@ -1,7 +1,7 @@
-import { a as join, n as dirname } from "./dist-ipQi0Q8y.mjs";
+import { a as join, n as dirname } from "./dist-DMYe8CZJ.mjs";
 import { existsSync, readdirSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
-//#region src/cli/yarn-pnp.ts
+// src/cli/yarn-pnp.ts
 const drizzleKitBin = join(fileURLToPath(import.meta.resolve("drizzle-kit")), "..", "bin.cjs");
 /** Read the PnP runtime files in `dir` only, or `undefined` when neither exists. */
 function readPnpRuntimeAt(dir) {
@@ -88,5 +88,4 @@ function buildDrizzleKitSpawnEnv(root) {
 	env.NODE_OPTIONS = process.env.NODE_OPTIONS ? `${injected} ${process.env.NODE_OPTIONS}` : injected;
 	return env;
 }
-//#endregion
 export { hasLocalLockfile as i, drizzleKitBin as n, findInstalledYarnPnpRuntime as r, buildDrizzleKitSpawnEnv as t };

package/docs/guide/database.md

@@ -56,8 +56,8 @@ Define your tables in `db/schema.ts` using column helpers from `void/schema-d1`,
 ::: code-group
 
 ```ts [SQLite (D1)]
-import { sql } from 'void/db';
 // db/schema.ts
+import { sql } from 'void/db';
 import { sqliteTable, text, integer } from 'void/schema-d1';
 
 export const users = sqliteTable('users', {
@@ -314,8 +314,8 @@ export const insertUserSchema = createInsertSchema(users, {
 ```
 
 ```ts [Valibot]
-import { pipe, minLength, email } from 'valibot';
 // db/schema.ts
+import { pipe, minLength, email } from 'valibot';
 import { createInsertSchema } from 'void/drizzle-valibot';
 
 export const insertUserSchema = createInsertSchema(users, {
@@ -325,8 +325,8 @@ export const insertUserSchema = createInsertSchema(users, {
 ```
 
 ```ts [ArkType]
-import { type } from 'arktype';
 // db/schema.ts
+import { type } from 'arktype';
 import { createInsertSchema } from 'void/drizzle-arktype';
 
 export const insertUserSchema = createInsertSchema(users, {
@@ -342,8 +342,8 @@ export const insertUserSchema = createInsertSchema(users, {
 Use the derived schema in your route handlers with [`withValidator()`](./server-routing.md#validation):
 
 ```ts
-import { users, insertUserSchema } from '@schema';
 // routes/api/users/index.ts
+import { users, insertUserSchema } from '@schema';
 import { defineHandler } from 'void';
 import { db } from 'void/db';
 

package/docs/guide/deployment.md

@@ -35,7 +35,7 @@ void db generate
 
 Review and commit the SQL, then deploy again. Rollback does not reverse database migrations. See [Database](./database.md) for the local workflow.
 
-On your own Cloudflare account, deploy saves a D1 [Time Travel](https://developers.cloudflare.com/d1/reference/time-travel/) restore point before it applies pending migrations and prints the [`void db restore`](../reference/cli/database.md#void-db-restore) command for it. If no restore point can be saved, deploy stops before it migrates. If deploy fails after it applied the migrations, for example when the upload fails, it prints the command again. Usually you fix the error and deploy again; restore only if the live version cannot run against the new schema. To recover from a bad migration, roll back the code with `void project rollback` if the new version is live, restore the database, then fix or remove the migration before you deploy again. After a one-off `void deploy --platform cloudflare`, add `--platform cloudflare` to each of these commands. Restoring discards every write made after the restore point. Restore points expire after 7 days on Workers Free and 30 days on Workers Paid; after that, undo a migration with a new one.
+For D1 on your own Cloudflare account, deploy saves a restore point before applying migrations and prints a [`void db restore`](../reference/cli/database.md#void-db-restore) command. Use it to recover from a bad migration, then fix the migration before deploying again. A restore discards writes made after that point; check that your deployed code works with the restored schema. See the command reference for the recovery steps and retention limits.
 
 ### Environment variables
 

package/docs/guide/edge/headers.md

@@ -24,6 +24,8 @@ Define custom response headers in [`void.config.ts`](../../reference/config) usi
 - **Header values** use `Name: value` format. The value may contain colons.
 - All matching rules are merged. When multiple rules set the same header name, the **last match wins**.
 - User-defined `Cache-Control` overrides the built-in default. The default still applies when no rule matches.
+- With [authentication](../auth.md), responses to requests that send cookies or credentials stay private, and auth endpoints stay uncached, during local development, with `void deploy --platform cloudflare`, and on [other runtimes](../deployment.md#other-runtimes). On a [Void platform](../deployment.md#deploy-to-a-team-platform), a `Cache-Control` rule replaces the app's value, so do not match signed-in pages or `/api/auth/*` with a public cache rule.
+- Rules apply to matching error responses too, including 404 responses. An immutable cache rule can therefore cache a missing file. Use immutable caching only for URLs that change when their content changes.
 
 ## Scope
 
@@ -35,13 +37,9 @@ Header rules do not apply to ISR cache responses.
 
 ### Cookie headers
 
-On a [Void platform](../deployment.md#deploy-to-a-team-platform), apps usually share an application domain, such as `apps.example.com`. Header rules on a platform deploy change two headers on all hostnames of the app, including custom domains:
+On a [Void platform](../deployment.md#deploy-to-a-team-platform), set cookies in your app's response. Header rules ignore `Set-Cookie`, remove `"cookies"` from `Clear-Site-Data`, and ignore `Clear-Site-Data` rules containing `"*"`. You can use directives such as `"cache"` and `"storage"` in header rules.
 
-- Void ignores `Set-Cookie` in header rules.
-- Void removes the `"cookies"` directive from `Clear-Site-Data` in header rules. Other directives, such as `"cache"` and `"storage"`, still apply.
-- Void ignores the full value of a `Clear-Site-Data` rule that includes `"*"`. The response then keeps the `Clear-Site-Data` value from your app's response, without `"cookies"`. If that value also includes `"*"`, the response has no `Clear-Site-Data`.
-
-This stops a header rule from setting or clearing cookies for other apps on the same domain. These limits apply only to header rules. Your app's own response can set cookies and send `Clear-Site-Data`, and on a shared domain those can affect other apps. See [Domains and Resources](../platform/installation/domains.md#adding-a-domain).
+These limits apply on all of your app's hostnames, including custom domains, to protect cookies for other apps on the shared domain. Your app's own cookie headers can still affect those apps, so scope cookies carefully. See [Domains and Resources](../platform/installation/domains.md#adding-a-domain).
 
 During local development, with `void deploy --platform cloudflare`, and on [other runtimes](../deployment.md#other-runtimes), header rules apply both headers as written.
 

package/docs/guide/edge/redirects.md

@@ -65,13 +65,13 @@ export default defineConfig({
 });
 ```
 
-Void answers with a permanent `308` redirect to the same URL over HTTPS. The path, query string, and request method stay the same. Omitted or `false` means off. `localhost` and loopback addresses such as `127.0.0.1` stay on HTTP, so local development and `vite preview` are unchanged.
+Void returns a permanent `308` redirect that preserves the path, query string, and request method. The option defaults to `false`. Localhost and loopback addresses stay on HTTP for local development and previews.
 
-It works on the Void platform and for Void apps on `void deploy --platform cloudflare`. It needs the Cloudflare target: setting it with `target: 'node'`, `'bun'`, or `'deno'` is a config error.
+This option requires the Cloudflare target and works for Void apps and static sites on either deployment platform.
 
-On `void deploy --platform cloudflare`, built files with a content hash in their name, such as `/assets/index-abc123.js`, can be served by Cloudflare before Void runs, so they may still answer over HTTP. Pages always redirect, so browsers load these files over HTTPS. To redirect every request, also turn on [Always Use HTTPS](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/always-use-https/) for your Cloudflare zone.
+For direct Cloudflare deployments, also enable [Always Use HTTPS](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/always-use-https/) on your zone to cover assets served directly by Cloudflare.
 
-SvelteKit, Nuxt, Astro, Analog, TanStack Start, React Router, and vinext apps run their own Worker, so `void deploy --platform cloudflare` stops with an error when the option is on. Static builds of these frameworks, deployed with `--dir` or `inference.appType`, redirect as usual. For the others, redirect to HTTPS in the framework, or turn on [Always Use HTTPS](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/always-use-https/) for your Cloudflare zone.
+For direct Cloudflare deployments of SvelteKit, Nuxt, Astro, Analog, TanStack Start, React Router, or vinext, configure HTTPS in the framework or your Cloudflare zone. Use `routing.alwaysUseHttps` only for their static builds, deployed with `--dir` or `inference.appType`.
 
 ## Framework `_redirects` files
 

package/docs/guide/edge/rewrites.md

@@ -56,7 +56,7 @@ Keep access checks on any destination that needs them.
 
 A destination without `?` preserves the incoming query string. `c.rewrite('/search')` keeps `?q=...`, while `c.rewrite('/search?q=all')` replaces it.
 
-Your editor suggests known routes through the [`RewriteDestination`](../../reference/api/rewrites.md#rewritedestination) type. Dynamic strings are also accepted.
+Your editor suggests known routes through the [`RewriteDestination`](../../reference/api/rewrites.md#rewritedestination) type. Dynamic strings are also accepted. With [`routing.typedRoutes`](../../reference/config.md#routing-typedroutes), a string must match one of your routes; add `as RouteUrl` to a path built at runtime, such as ``c.rewrite(`/en${c.req.path}` as RouteUrl)``.
 
 ### Runtime rewrites cannot reach static assets
 

package/docs/guide/edge/static-assets.md

@@ -37,16 +37,6 @@ With `void deploy --platform cloudflare`, generated JavaScript bundles with cont
 
 Use [Custom Headers](./headers) to choose a cache policy for other files. Apply immutable caching only to URLs that change whenever their content changes.
 
-Cloudflare serves these fingerprinted JavaScript bundles without starting your Worker, so they do not count as Worker requests, when your app:
-
-- has no global middleware
-- has no header, redirect, rewrite or fallback rules, and no `routing.notFound` setting
-- uses the default `base` of `/`
-- has no route or page that matches paths in the assets directory (`assets/` by default)
-- builds at most 99 fingerprinted bundles
-
-Otherwise these bundles go through your Worker and keep the same caching.
-
 ## Non-hashed assets
 
 Other static files, such as `index.html` and `favicon.ico`, are cached until the next deploy. You do not need to purge them manually.

package/docs/guide/email/domains.md

@@ -16,7 +16,9 @@ void email domain add acme.com
 
 `add` opens a Cloudflare API-token template. Restrict the token to the selected account and mail zone before creating it; Workers Scripts permission applies across that account. The CLI accepts a masked paste or a newly copied token and asks you to confirm those restrictions. The platform encrypts the credential for the zone connection, so projects sharing that zone do not need separate ingress Workers.
 
-Platform-managed custom inbound email requires the apex of a Cloudflare zone. Cloudflare’s catch-all only covers that apex, so a subdomain of the selected zone cannot receive arbitrary addresses. `add` refuses to register a new apex that already has MX records, or whose catch-all already routes elsewhere, so it never takes over mail hosted with another provider such as Microsoft 365 or Google Workspace. Use an apex that has no mail yet, or the platform’s shared mail address. To only send from an apex that keeps its current mail provider, ask your platform administrator to register it as [outbound-only](../platform/administration/email.md#sending-from-a-domain-that-already-receives-mail). Running `add` again for a registered apex, for example to renew its token, keeps working. Each custom apex belongs to one project; a project can register more than one apex.
+For inbound mail, use a Cloudflare zone apex with no existing mail service, such as `example.com`. Each apex belongs to one project, and a project can register several. Existing MX records or a catch-all pointing elsewhere block registration to protect your current mail service.
+
+To keep receiving mail through another provider, ask your platform administrator to register the domain as [outbound-only](../platform/administration/email.md#sending-from-a-domain-that-already-receives-mail). You can also use the platform's shared mail address.
 
 If setup is interrupted, use `void email domain status <domain>` to inspect the saved operation before retrying.
 

package/docs/guide/email/receiving.md

@@ -78,7 +78,7 @@ export default defineEmail(async (message, env, ctx, info) => {
 });
 ```
 
-`replyEmail()` replies to the original sender with a threaded subject. You can override `subject`.
+`replyEmail()` replies to the original sender with a threaded subject. You can override `subject`. To reply after the handler returns, use [`sendEmail` with `threading`](./sending.md#reply-later).
 
 On a Void platform, the default sender is your project's shared address, or the address that received mail on your registered domain. Use that default for shared mail; `message.to` has the project prefix removed. Sender overrides must belong to your project.
 
@@ -94,15 +94,15 @@ deployed `email/` handlers without per-project DNS setup once the platform has v
 handlers once its inbound readiness is `ready`. Use `void email domain status`
 to check current provider routing and any remaining setup steps.
 
-A project with an [email alias](../../reference/cli/email.md#void-email-alias) also receives at `<alias>+anything@<mail domain>`. Routing ignores which prefix was used: with the slug `acme-store` and the alias `acme`, both `acme-store+support@…` and `acme+support@…` reach `email/support.ts`.
+A project with an [email alias](../../reference/cli/email.md#void-email-alias) also receives at `<alias>+anything@<mail domain>`. For example, both `acme-store+support@…` and its alias `acme+support@…` reach `email/support.ts`.
 
 For direct deployments, follow [Your own Cloudflare account](./domains.md#your-own-cloudflare-account) to configure inbound addresses.
 
-The local dev server provides the outbound email inbox but has no inbound email trigger. Test inbound handlers with `createInboundTestHarness` below.
+Test inbound handlers locally with `createInboundTestHarness` below.
 
 ## Testing inbound handlers {#testing-inbound-handlers}
 
-Use `createInboundTestHarness` to capture replies, forwards, and rejections. For shared platform mail, pass the full address including the project prefix, such as [`acme+support+abc-123@acme.dev`](mailto:acme+support+abc-123@acme.dev). For direct Cloudflare mail, set `slug: null` and use [`support+abc-123@mail.acme.com`](mailto:support+abc-123@mail.acme.com).
+Use `createInboundTestHarness` to capture replies, forwards, and rejections. For shared platform mail, pass the full address including the project prefix, such as `acme+support+abc-123@acme.dev`. For direct Cloudflare mail, set `slug: null` and use `support+abc-123@mail.acme.com`.
 
 ```ts
 import { describe, it, expect } from 'vitest';

package/docs/guide/email/sending.md

@@ -67,18 +67,19 @@ For mail to arbitrary users, [register your own domain](./domains.md#your-own-do
 
 ## Options {#options}
 
-| Option           | Type                         | Notes                                                                                                           |
-| ---------------- | ---------------------------- | --------------------------------------------------------------------------------------------------------------- |
-| `from`           | `string \| { email, name? }` | Optional. Pinned to the project sender — see below.                                                             |
-| `to`             | `Address \| Address[]`       | Required. One or more recipients.                                                                               |
-| `subject`        | `string`                     | Required. UTF-8 supported (encoded as RFC 2047).                                                                |
-| `text`           | `string`                     | At least one of `text` / `html` is required.                                                                    |
-| `html`           | `string`                     | Sent as `multipart/alternative` if both are provided.                                                           |
-| `replyTo`        | `Address`                    | Optional `Reply-To` header.                                                                                     |
-| `cc`, `bcc`      | `Address \| Address[]`       | Optional. Each recipient is sent its own message envelope.                                                      |
-| `headers`        | `Record<string, string>`     | Custom headers; reserved headers (From, Date, etc.) are ignored.                                                |
-| `attachments`    | `Attachment[]`               | See [Attachments](#attachments).                                                                                |
-| `idempotencyKey` | `string`                     | Optional on the Void Platform: 1–128 printable, non-space ASCII characters. Reuse for retries of the same send. |
+| Option           | Type                          | Notes                                                                                                           |
+| ---------------- | ----------------------------- | --------------------------------------------------------------------------------------------------------------- |
+| `from`           | `string \| { email, name? }`  | Optional. Pinned to the project sender — see below.                                                             |
+| `to`             | `Address \| Address[]`        | Required. One or more recipients.                                                                               |
+| `subject`        | `string`                      | Required. UTF-8 supported (encoded as RFC 2047).                                                                |
+| `text`           | `string`                      | At least one of `text` / `html` is required.                                                                    |
+| `html`           | `string`                      | Sent as `multipart/alternative` if both are provided.                                                           |
+| `replyTo`        | `Address`                     | Optional `Reply-To` header.                                                                                     |
+| `cc`, `bcc`      | `Address \| Address[]`        | Optional. Each recipient is sent its own message envelope.                                                      |
+| `headers`        | `Record<string, string>`      | Custom headers; reserved headers (From, Date, etc.) are ignored.                                                |
+| `threading`      | `{ inReplyTo?, references? }` | Optional. Threads the email under an earlier message. See [Reply later](#reply-later).                          |
+| `attachments`    | `Attachment[]`                | See [Attachments](#attachments).                                                                                |
+| `idempotencyKey` | `string`                      | Optional on the Void Platform: 1–128 printable, non-space ASCII characters. Reuse for retries of the same send. |
 
 You can send to at most 50 recipients across `to`, `cc`, and `bcc`. Use standard email addresses with ASCII local parts, and punycode for internationalized domains.
 
@@ -88,6 +89,35 @@ On the platform the sender is pinned to your project. `from` must be your projec
 
 On your own Cloudflare account, `from` defaults to `email.from` from `void.config.ts` and must be on a domain your account can send from; Cloudflare rejects any other sender and `sendEmail` reports it as `INVALID_FROM`.
 
+## Reply later {#reply-later}
+
+`replyEmail()` works only while the inbound handler runs. To reply later, for example from a queue job, save the thread ids in the handler and pass them to `sendEmail` as `threading`:
+
+```ts
+// email/support.ts
+export default defineEmail(async (message) => {
+  await tickets.save({
+    from: message.from,
+    subject: message.headers.get('Subject') ?? '',
+    messageId: message.headers.get('Message-ID') ?? '',
+    references: message.headers.get('References') ?? '',
+  });
+});
+
+// Later, in a queue job
+await sendEmail({
+  to: ticket.from,
+  subject: `Re: ${ticket.subject}`,
+  text: 'We fixed it.',
+  threading: {
+    inReplyTo: ticket.messageId,
+    references: `${ticket.references} ${ticket.messageId}`,
+  },
+});
+```
+
+`inReplyTo` is the parent message's `Message-ID`. `references` lists the thread's ids, oldest first, ending with the parent; it defaults to `inReplyTo`. Mail clients use them to show the reply in the same conversation. An id that cannot be sent, such as one with a control character, is left out. If `references` cannot be sent, it falls back to `inReplyTo`. The email still sends. `headers` cannot set `In-Reply-To` or `References`.
+
 ## Attachments {#attachments}
 
 ```ts
@@ -195,7 +225,7 @@ The inbox keeps the most recent 100 messages through HMR and clears on a full se
 
 The dev inbox works in native Void apps, TanStack Start, and React Router. It is unavailable in SvelteKit, Nuxt, Analog, and Astro; sends from those apps return `BINDING_MISSING`. Use `createEmailTestHarness` from `void/email/testing` to capture sends in tests. If a configured inbox cannot be reached, `sendEmail` returns `UPSTREAM_ERROR` without sending.
 
-`sendInDev` is deprecated. During local development it skips the inbox and returns `BINDING_MISSING`, so it never delivers. Remove it, and deploy the app to test real delivery.
+Remove the deprecated `sendInDev` option to use the local inbox. Deploy the app to test real delivery.
 
 ## Testing {#testing}