void 1.5.0 → 1.6.0

package/dist/runtime/routing.d.mts

@@ -1,5 +1,5 @@
-import { A as filterInternalBindings, M as createClientAssetTags, N as createManifestLoader, O as createAssetFallback, j as ClientAssetTags, k as createWorkerFetch } from "../handler-Drm_lyrV.mjs";
-import { a as handlePageMutation, i as handlePageGet } from "../protocol-xdrl-In0.mjs";
+import { A as filterInternalBindings, M as createClientAssetTags, N as createManifestLoader, O as createAssetFallback, j as ClientAssetTags, k as createWorkerFetch } from "../handler-BR6Tvjkp.mjs";
+import { a as handlePageMutation, i as handlePageGet } from "../protocol-CkwjASep.mjs";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { Context, Hono, MiddlewareHandler, TypedResponse } from "hono";
 import { RouteDestination, RouteUrlInput } from "void/routes";
@@ -100,7 +100,7 @@ export type RoutingRuntime = {
   contextMiddleware: MiddlewareHandler;
   requestMiddleware: MiddlewareHandler;
   routingMiddleware: (rules: Array<RoutingRule>) => MiddlewareHandler;
-  headerMiddleware: (rules: Array<RoutingHeaderRule>) => MiddlewareHandler;
+  headerMiddleware: (rules: Array<RoutingHeaderRule>, phase?: "auth-error") => MiddlewareHandler;
   applyFallback: (context: Context, rules: Array<RoutingRule>) => Promise<Response | undefined>;
   markNoMatch: (request: Request, response: Response) => Response;
 };

package/dist/runtime/routing.mjs

@@ -2,10 +2,10 @@ import { n as createClientAssetTags, r as createManifestLoader, t as ASSET_EXTEN
 import { t as renderDefaultErrorPage } from "../error-pages-COVBnzK7.mjs";
 import { t as convertReturnValue } from "../response-HmNjB30w.mjs";
 import { i as searchWithoutActionKey, n as hasActionKey, r as markActionKey, t as actionKeySegment } from "../action-key-XtKKbbsi.mjs";
-import { n as handlePageGet, r as handlePageMutation } from "../protocol-0-lp9ZYx.mjs";
-import { t as VoidAssetRewriteError } from "../handler-xmzz0U38.mjs";
+import { n as handlePageGet, r as handlePageMutation } from "../protocol-COyySMki.mjs";
+import { t as VoidAssetRewriteError } from "../handler-CKeTtYID.mjs";
+import { i as authDependentRequests, n as markStaticAsset, r as SHARED_CACHE_HEADERS, t as isUnchangedStaticAsset } from "../static-asset-marker-DsQKz6lt.mjs";
 import { r as toUrlString } from "../route-url-CRDF-I0I.mjs";
-import { n as markStaticAsset } from "../static-asset-marker-NR1XS2z5.mjs";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { compilePattern, matchPattern, matchPatternCaptures, mergeQueryIntoLocation, redirectToHttps, substituteParams } from "@void/edge";
 // src/runtime/routing-worker.ts
@@ -747,6 +747,8 @@ function createErrorRenderer(options) {
 function createRoutingRuntime(app, options = {}) {
 	const originalUrls = /* @__PURE__ */ new WeakMap();
 	const fallbackHandled = /* @__PURE__ */ new WeakSet();
+	const fallbackServed = /* @__PURE__ */ new WeakSet();
+	const headerApplied = /* @__PURE__ */ new WeakSet();
 	const warnedPatterns = /* @__PURE__ */ new Set();
 	const requestContext = new AsyncLocalStorage();
 	const assetExtensions = options.blockedAssetExtensions ?? ASSET_EXTENSIONS;
@@ -761,7 +763,11 @@ function createRoutingRuntime(app, options = {}) {
 			headers
 		});
 	};
-	const dispatch = (request, c) => Promise.resolve(options.nodeTarget ? app.fetch(request, c.env) : app.fetch(request, c.env, c.executionCtx));
+	const dispatch = async (request, c, trace) => {
+		const response = annotate(await (options.nodeTarget ? app.fetch(request, c.env) : app.fetch(request, c.env, c.executionCtx)), trace);
+		if (authDependentRequests.has(request)) authDependentRequests.add(c.req.raw);
+		return response;
+	};
 	const rememberOriginal = (request, c) => {
 		originalUrls.set(request, originalUrls.get(c.req.raw) ?? new URL(c.req.url));
 	};
@@ -793,10 +799,12 @@ function createRoutingRuntime(app, options = {}) {
 				const request = new Request(rewriteUrl.toString(), c.req.raw);
 				rememberOriginal(request, c);
 				keepActionKey(c.req.raw, request, search);
-				if (fallback) fallbackHandled.add(request);
-				const response = await dispatch(request, c);
+				if (fallback) {
+					fallbackHandled.add(request);
+					fallbackServed.add(c.req.raw);
+				}
 				const kind = rule.force === true ? "rewrite" : "fallback";
-				return annotate(response, `${kind}[${rule.source}] -> ${destination} (${rule.origin || "unknown"})`);
+				return dispatch(request, c, `${kind}[${rule.source}] -> ${destination} (${rule.origin || "unknown"})`);
 			}
 			const location = mergeQueryIntoLocation(destination, url.search);
 			return annotate(c.redirect(location, rule.status), `redirect[${rule.source}] -> ${destination} ${rule.status} (${rule.origin || "unknown"})`);
@@ -825,7 +833,7 @@ function createRoutingRuntime(app, options = {}) {
 			const request = new Request(url.toString(), c.req.raw);
 			rememberOriginal(request, c);
 			keepActionKey(c.req.raw, request, search);
-			return dispatch(request, c).then((response) => annotate(response, `c.rewrite -> ${path} (middleware)`));
+			return dispatch(request, c, `c.rewrite -> ${path} (middleware)`);
 		};
 		const redirect = context.redirect.bind(context);
 		c.redirect = (destination, status) => {
@@ -855,8 +863,19 @@ function createRoutingRuntime(app, options = {}) {
 				c.res.headers.set("X-Void-Routing", "pass-through");
 			} catch {}
 		},
-		headerMiddleware: (rules) => async (c, next) => {
+		headerMiddleware: (rules, phase) => async (c, next) => {
+			const authErrorsOnly = phase === "auth-error";
 			await next();
+			if (authErrorsOnly && (!c.error || headerApplied.has(c))) return;
+			if (!authErrorsOnly) headerApplied.add(c);
+			const protectCache = authErrorsOnly || authDependentRequests.has(c.req.raw);
+			if (protectCache) {
+				authDependentRequests.add(c.req.raw);
+				c.header("Cache-Control", "no-store");
+				c.header("Pragma", "no-cache");
+				for (const name of SHARED_CACHE_HEADERS) if (c.res.headers.has(name)) c.header(name, void 0);
+			}
+			if (fallbackServed.has(c.req.raw)) return;
 			const pathname = new URL(c.req.url).pathname;
 			const matched = [];
 			for (const rule of rules) {
@@ -869,13 +888,15 @@ function createRoutingRuntime(app, options = {}) {
 				if (matchPattern(rule.pattern, pathname)) matched.push(...rule.headers);
 			}
 			if (!matched.length) return;
-			const headers = new Headers(c.res.headers);
-			for (const [name, value] of matched) headers.set(name, value);
-			c.res = new Response(c.res.body, {
-				headers,
-				status: c.res.status,
-				statusText: c.res.statusText
-			});
+			const last = /* @__PURE__ */ new Map();
+			for (const [name, value] of matched) last.set(name.toLowerCase(), [name, value]);
+			const asset = isUnchangedStaticAsset(c);
+			for (const [key, [name, value]] of last) {
+				if (protectCache && (key === "cache-control" || key === "pragma" || SHARED_CACHE_HEADERS.includes(key))) continue;
+				if (key === "set-cookie" && c.res.headers.getSetCookie().at(-1) === value) continue;
+				c.header(name, value, { append: key === "set-cookie" });
+			}
+			if (asset) markStaticAsset(c, c.res);
 		},
 		applyFallback: (c, rules) => fallbackHandled.has(c.req.raw) ? Promise.resolve(void 0) : applyRules(c, rules, true),
 		markNoMatch

package/dist/runtime/validator.d.mts

@@ -1,2 +1,2 @@
-import { D as runValidation, E as ValidatorSlots, T as HandlerInput } from "../handler-Drm_lyrV.mjs";
+import { D as runValidation, E as ValidatorSlots, T as HandlerInput } from "../handler-BR6Tvjkp.mjs";
 export { HandlerInput, ValidatorSlots, runValidation };

package/dist/runtime/ws-server.d.mts

@@ -1,6 +1,6 @@
 import { n as AuthState } from "../auth-CH4PLAX1.mjs";
 import { r as VoidAuthRuntimeOptions, t as VoidAuthEnv } from "../better-auth-shared-BJyG2mH0.mjs";
-import { f as WebSocketInstanceKey, t as AnyWebSocketDefinition } from "../ws-DzBD-NUj.mjs";
+import { f as WebSocketInstanceKey, t as AnyWebSocketDefinition } from "../ws-Dmjg5NH2.mjs";
 export type WebSocketRouteMeta = {
   name?: string;
   key?: WebSocketInstanceKey;

package/dist/runtime/ws.d.mts

@@ -1,2 +1,2 @@
-import { a as RoomDefinition, c as VoidSocket, d as WebSocketConnection, f as WebSocketInstanceKey, h as defineWebSocket, i as RoomController, l as VoidSocketCloseEvent, m as defineRoom, n as ConnectCommonOptions, o as SocketContext, p as connect, r as RoomContext, s as SocketDefinition, t as AnyWebSocketDefinition, u as WebSocketBaseContext } from "../ws-DzBD-NUj.mjs";
+import { a as RoomDefinition, c as VoidSocket, d as WebSocketConnection, f as WebSocketInstanceKey, h as defineWebSocket, i as RoomController, l as VoidSocketCloseEvent, m as defineRoom, n as ConnectCommonOptions, o as SocketContext, p as connect, r as RoomContext, s as SocketDefinition, t as AnyWebSocketDefinition, u as WebSocketBaseContext } from "../ws-Dmjg5NH2.mjs";
 export { AnyWebSocketDefinition, ConnectCommonOptions, RoomContext, RoomController, RoomDefinition, SocketContext, SocketDefinition, VoidSocket, VoidSocketCloseEvent, WebSocketBaseContext, WebSocketConnection, WebSocketInstanceKey, connect, defineRoom, defineWebSocket };

package/dist/{scan-DSQtH3oS.mjs → scan-X2rDDRNa.mjs}

@@ -575,11 +575,13 @@ async function scanPages(root, options) {
 		if (rendering.shouldPrerender && revalidate === void 0) revalidate = MAX_REVALIDATE;
 		let metadata;
 		let layout;
-		if (ext === ".md") ({metadata, layout} = deriveFromSource(join(pagesDir, file), "page-markdown", (source) => ({
-			metadata: extractFrontmatterMeta(source),
-			layout: extractFrontmatterLayout(source)
-		})));
-		else layout = deriveFromSource(join(pagesDir, file), "page-layout", (source) => componentLayout(source, file));
+		if (ext === ".md") {
+			const { default: matter } = await import("gray-matter");
+			({metadata, layout} = deriveFromSource(join(pagesDir, file), "page-markdown", (source) => ({
+				metadata: extractFrontmatterMeta(source),
+				layout: extractFrontmatterLayout(source, matter)
+			})));
+		} else layout = deriveFromSource(join(pagesDir, file), "page-layout", (source) => componentLayout(source, file));
 		pages.push({
 			pattern: route.pattern,
 			params: route.params,
@@ -701,12 +703,18 @@ function extractFrontmatterMeta(source) {
 	};
 }
 /** Extract layout field from YAML frontmatter in markdown source. */
-function extractFrontmatterLayout(source) {
+function extractFrontmatterLayout(source, matter) {
 	const yaml = markdownFrontmatter(source);
 	if (yaml === void 0) return;
-	const value = frontmatterField(yaml, "layout");
-	if (!value) return;
-	if (value === "false") return false;
-	return value;
+	let frontmatter;
+	try {
+		frontmatter = matter(`---\n${yaml}\n---`, {}).data;
+	} catch {
+		return;
+	}
+	const value = frontmatter.layout;
+	if (value === void 0 || value === null || value === "") return;
+	if (value === false || value === "false") return false;
+	return typeof value === "string" ? value : JSON.stringify(value);
 }
 export { resolveLayoutChain as a, editIslandSource as c, deriveFromSource as d, invalidateSourceAnalysis as f, ROUTE_EXTENSIONS as g, parseWebSocketFilename as h, resolveEffectiveLayoutChain as i, findIslandImports as l, parseRouteFilename as m, scanPages as n, resolveLayoutIds as o, isRouteEnabledForEnvironment as p, generateComponentManifest as r, resolveNamedLayout as s, pageFileEnvironment as t, findStaticCssImports as u };

package/dist/{secret-C_QtTzJG.mjs → secret-CPq-B_vp.mjs}

@@ -1,7 +1,7 @@
 import { n as readDeploymentPlatform, r as readProjectConfig } from "./project-CLwxcEdq.mjs";
 import { c as getToken } from "./auth-Dy8svcqQ.mjs";
 import { A as confirm, H as outro, L as log, O as cancel, U as password, tt as isCancel } from "./dist-D23AAMxT.mjs";
-import { r as PlatformClient } from "./client-Qayy9xEh.mjs";
+import { r as PlatformClient } from "./client-CoxPEhJq.mjs";
 import { m as printSuccess, o as formatCount, p as note } from "./output-BCdLioKP.mjs";
 import { a as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-D0YNnJfm.mjs";
 import { _ as validateSecretValues } from "./env-validation-GV1oD4EV.mjs";
@@ -97,7 +97,7 @@ async function resolveSecretBackend(root, args) {
 }
 async function resolveCloudflareSecretBackend(root, args) {
 	if (args.projectName) throw new Error("secret: --project selects a Void platform project and is not used for direct Cloudflare apps.");
-	const { deleteCloudflareSecret, listCloudflareSecrets, putCloudflareSecret, resolveCloudflareOperationContext, syncCloudflareSecrets } = await import("./cloudflare-operations-D8MoezuN.mjs");
+	const { deleteCloudflareSecret, listCloudflareSecrets, putCloudflareSecret, resolveCloudflareOperationContext, syncCloudflareSecrets } = await import("./cloudflare-operations-oLvAd9Nd.mjs");
 	const context = resolveCloudflareOperationContext(root);
 	return {
 		target: "Cloudflare Worker",

package/dist/{static-asset-marker-NR1XS2z5.mjs → static-asset-marker-DsQKz6lt.mjs}

@@ -1,3 +1,10 @@
+// src/runtime/auth-response.ts
+const authDependentRequests = /* @__PURE__ */ new WeakSet();
+const SHARED_CACHE_HEADERS = [
+	"cdn-cache-control",
+	"cloudflare-cdn-cache-control",
+	"surrogate-control"
+];
 // src/runtime/static-asset-marker.ts
 const STATIC_ASSET_KEY = "__voidStaticAsset";
 /**
@@ -28,4 +35,4 @@ function isUnchangedStaticAsset(c) {
 		304
 	].includes(c.res.status) && c.res.body === mark.body && (c.res.headers.get("cache-control") ?? "") === mark.policy && !c.res.headers.has("set-cookie");
 }
-export { markStaticAsset as n, isUnchangedStaticAsset as t };
+export { authDependentRequests as i, markStaticAsset as n, SHARED_CACHE_HEADERS as r, isUnchangedStaticAsset as t };

package/dist/validation-error-uAAjlsiW.mjs

@@ -0,0 +1,82 @@
+// src/runtime/handler-composition.ts
+const compositionKey = "__voidHandlerComposition";
+function getHandlerComposition(handler) {
+	return handler?.[compositionKey];
+}
+/** Record the composition; a nested composed leaf is flattened into one chain. */
+function setHandlerComposition(handler, middlewares, leaf) {
+	const nested = getHandlerComposition(leaf);
+	const composition = nested ? {
+		middlewares: [...middlewares, ...nested.middlewares],
+		leaf: nested.leaf
+	} : {
+		middlewares,
+		leaf
+	};
+	Object.defineProperty(handler, compositionKey, { value: composition });
+	return handler;
+}
+/**
+* Run middleware on the current context around `endpoint`, the way Hono's
+* compose does: a Response returned by a middleware replaces `c.res`, the
+* endpoint's Response becomes `c.res`, and middleware can edit `c.res` after
+* `next()`. Returns the final `c.res`.
+*/
+async function executeComposedHandler(c, middlewares, endpoint) {
+	let index = 0;
+	const dispatch = async () => {
+		if (index < middlewares.length) {
+			const response = await middlewares[index++](c, dispatch);
+			if (response instanceof Response) c.res = response;
+		} else c.res = await endpoint();
+	};
+	await dispatch();
+	return c.res;
+}
+// src/pages/defer.ts
+const DEFERRED = Symbol("deferred");
+function defer(groupOrResolver, maybeResolver) {
+	const [group, resolver] = typeof groupOrResolver === "string" ? [groupOrResolver, maybeResolver] : [null, groupOrResolver];
+	return {
+		[DEFERRED]: true,
+		group,
+		resolver
+	};
+}
+/**
+* Separate a loader's return value into immediate props and deferred sentinels.
+* For single-prop deferred (group=null), the object key becomes the group name.
+* For named groups, all keys sharing the same group name are collected.
+*/
+function separateDeferred(props) {
+	const immediateProps = {};
+	const deferredMap = {};
+	for (const [key, value] of Object.entries(props)) if (value && typeof value === "object" && DEFERRED in value) {
+		const sentinel = value;
+		const groupName = sentinel.group ?? key;
+		if (!deferredMap[groupName]) deferredMap[groupName] = {
+			resolver: sentinel.resolver,
+			keys: []
+		};
+		deferredMap[groupName].keys.push(key);
+		immediateProps[key] = {
+			value: null,
+			loading: true,
+			error: null
+		};
+	} else immediateProps[key] = value;
+	return {
+		immediateProps,
+		deferredMap
+	};
+}
+// src/pages/validation-error.ts
+var ValidationError = class extends Error {
+	errors;
+	constructor(errors) {
+		super("Validation failed");
+		this.name = "ValidationError";
+		this.errors = errors;
+	}
+};
+export { executeComposedHandler as a, separateDeferred as i, DEFERRED as n, getHandlerComposition as o, defer as r, setHandlerComposition as s, ValidationError as t };

package/dist/{version-metadata-Blf5H9BQ.mjs → version-metadata-C8hLzQkv.mjs}

@@ -1,5 +1,5 @@
 import { a as join } from "./dist-DMYe8CZJ.mjs";
-import { l as bindingNamesForField, p as findBindingNameOwner } from "./wrangler-p-kLCJqF.mjs";
+import { l as bindingNamesForField, p as findBindingNameOwner } from "./wrangler-DESSbN8L.mjs";
 // src/shared/untrusted-env.ts
 /** Authentication inputs that Wrangler may consume from the environment. */
 const WRANGLER_AUTH_CREDENTIAL_ENV_VARS = [

package/dist/{wrangler-p-kLCJqF.mjs → wrangler-DESSbN8L.mjs}

@@ -1,7 +1,7 @@
 import { a as join, c as resolve, n as dirname, o as normalize, t as basename } from "./dist-DMYe8CZJ.mjs";
 import { o as TYPED_CONFIG_FILE, s as loadTypedVoidConfigFile } from "./project-paths-CdGv9Tmi.mjs";
-import { h as validateConfig, p as readConfig } from "./config-DkA9jYF2.mjs";
-import { a as persistCloudflareConfig, i as materializeCloudflareConfig, r as ignoreMaterializedCloudflareConfig } from "./cloudflare-config-Chet188_.mjs";
+import { h as validateConfig, p as readConfig } from "./config-BITKQ3O6.mjs";
+import { a as persistCloudflareConfig, i as materializeCloudflareConfig, r as ignoreMaterializedCloudflareConfig } from "./cloudflare-config-eQunqX6A.mjs";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { parseSync } from "vite";
 import { appendSqliteClassMigration, isRecord } from "@void/deploy-core";

package/dist/wrangler-DUB3MGHV.mjs

@@ -0,0 +1 @@
+export { b as readRootWranglerConfig } from "./wrangler-DESSbN8L.mjs";

package/dist/{wrapper-iejSJDwL.mjs → wrapper-C9SUxoj7.mjs}

@@ -1,9 +1,9 @@
 import { a as join, l as toSlash, n as dirname, r as extname } from "./dist-DMYe8CZJ.mjs";
 import { n as readProjectPaths } from "./project-paths-CdGv9Tmi.mjs";
-import { l as getDatabaseDialect, p as readConfig } from "./config-DkA9jYF2.mjs";
+import { l as getDatabaseDialect, p as readConfig } from "./config-BITKQ3O6.mjs";
 import { n as isIdentifier, r as isLiteral } from "./ast-Cv0JwXqb.mjs";
 import { t as MagicString } from "./dist-B6eN80gc.mjs";
-import { c as voidDbBundlerPlugin, r as cloudflareQueueName, t as generateQueueResolverSource } from "./dispatch-CiJ1Xrba.mjs";
+import { c as voidDbBundlerPlugin, r as cloudflareQueueName, t as generateQueueResolverSource } from "./dispatch-BNLB5_Gm.mjs";
 import { t as WORKER_CONDITIONS } from "./worker-conditions-CBZ0RYsZ.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";

package/dist/{ws-DzBD-NUj.d.mts → ws-Dmjg5NH2.d.mts}

@@ -1,6 +1,6 @@
 import { t as StandardSchemaV1 } from "./standard-schema-CuDawHOC.mjs";
 import { r as AuthUser } from "./auth-CH4PLAX1.mjs";
-import { a as CloudEnv } from "./handler-Drm_lyrV.mjs";
+import { a as CloudEnv } from "./handler-BR6Tvjkp.mjs";
 import { WebSocketRouteMap } from "void/routes";
 type MaybePromise<T> = T | Promise<T>;
 type ParamsRecord = Record<string, string>;

package/docs/guide/edge/headers.md

@@ -24,6 +24,8 @@ Define custom response headers in [`void.config.ts`](../../reference/config) usi
 - **Header values** use `Name: value` format. The value may contain colons.
 - All matching rules are merged. When multiple rules set the same header name, the **last match wins**.
 - User-defined `Cache-Control` overrides the built-in default. The default still applies when no rule matches.
+- With [authentication](../auth.md), responses to requests that send cookies or credentials stay private, and auth endpoints stay uncached, during local development, with `void deploy --platform cloudflare`, and on [other runtimes](../deployment.md#other-runtimes). On a [Void platform](../deployment.md#deploy-to-a-team-platform), a `Cache-Control` rule replaces the app's value, so do not match signed-in pages or `/api/auth/*` with a public cache rule.
+- Rules apply to matching error responses too, including 404 responses. An immutable cache rule can therefore cache a missing file. Use immutable caching only for URLs that change when their content changes.
 
 ## Scope
 

package/docs/guide/edge/rewrites.md

@@ -56,7 +56,7 @@ Keep access checks on any destination that needs them.
 
 A destination without `?` preserves the incoming query string. `c.rewrite('/search')` keeps `?q=...`, while `c.rewrite('/search?q=all')` replaces it.
 
-Your editor suggests known routes through the [`RewriteDestination`](../../reference/api/rewrites.md#rewritedestination) type. Dynamic strings are also accepted.
+Your editor suggests known routes through the [`RewriteDestination`](../../reference/api/rewrites.md#rewritedestination) type. Dynamic strings are also accepted. With [`routing.typedRoutes`](../../reference/config.md#routing-typedroutes), a string must match one of your routes; add `as RouteUrl` to a path built at runtime, such as ``c.rewrite(`/en${c.req.path}` as RouteUrl)``.
 
 ### Runtime rewrites cannot reach static assets
 

package/docs/guide/email/receiving.md

@@ -78,7 +78,7 @@ export default defineEmail(async (message, env, ctx, info) => {
 });
 ```
 
-`replyEmail()` replies to the original sender with a threaded subject. You can override `subject`.
+`replyEmail()` replies to the original sender with a threaded subject. You can override `subject`. To reply after the handler returns, use [`sendEmail` with `threading`](./sending.md#reply-later).
 
 On a Void platform, the default sender is your project's shared address, or the address that received mail on your registered domain. Use that default for shared mail; `message.to` has the project prefix removed. Sender overrides must belong to your project.
 

package/docs/guide/email/sending.md

@@ -67,18 +67,19 @@ For mail to arbitrary users, [register your own domain](./domains.md#your-own-do
 
 ## Options {#options}
 
-| Option           | Type                         | Notes                                                                                                           |
-| ---------------- | ---------------------------- | --------------------------------------------------------------------------------------------------------------- |
-| `from`           | `string \| { email, name? }` | Optional. Pinned to the project sender — see below.                                                             |
-| `to`             | `Address \| Address[]`       | Required. One or more recipients.                                                                               |
-| `subject`        | `string`                     | Required. UTF-8 supported (encoded as RFC 2047).                                                                |
-| `text`           | `string`                     | At least one of `text` / `html` is required.                                                                    |
-| `html`           | `string`                     | Sent as `multipart/alternative` if both are provided.                                                           |
-| `replyTo`        | `Address`                    | Optional `Reply-To` header.                                                                                     |
-| `cc`, `bcc`      | `Address \| Address[]`       | Optional. Each recipient is sent its own message envelope.                                                      |
-| `headers`        | `Record<string, string>`     | Custom headers; reserved headers (From, Date, etc.) are ignored.                                                |
-| `attachments`    | `Attachment[]`               | See [Attachments](#attachments).                                                                                |
-| `idempotencyKey` | `string`                     | Optional on the Void Platform: 1–128 printable, non-space ASCII characters. Reuse for retries of the same send. |
+| Option           | Type                          | Notes                                                                                                           |
+| ---------------- | ----------------------------- | --------------------------------------------------------------------------------------------------------------- |
+| `from`           | `string \| { email, name? }`  | Optional. Pinned to the project sender — see below.                                                             |
+| `to`             | `Address \| Address[]`        | Required. One or more recipients.                                                                               |
+| `subject`        | `string`                      | Required. UTF-8 supported (encoded as RFC 2047).                                                                |
+| `text`           | `string`                      | At least one of `text` / `html` is required.                                                                    |
+| `html`           | `string`                      | Sent as `multipart/alternative` if both are provided.                                                           |
+| `replyTo`        | `Address`                     | Optional `Reply-To` header.                                                                                     |
+| `cc`, `bcc`      | `Address \| Address[]`        | Optional. Each recipient is sent its own message envelope.                                                      |
+| `headers`        | `Record<string, string>`      | Custom headers; reserved headers (From, Date, etc.) are ignored.                                                |
+| `threading`      | `{ inReplyTo?, references? }` | Optional. Threads the email under an earlier message. See [Reply later](#reply-later).                          |
+| `attachments`    | `Attachment[]`                | See [Attachments](#attachments).                                                                                |
+| `idempotencyKey` | `string`                      | Optional on the Void Platform: 1–128 printable, non-space ASCII characters. Reuse for retries of the same send. |
 
 You can send to at most 50 recipients across `to`, `cc`, and `bcc`. Use standard email addresses with ASCII local parts, and punycode for internationalized domains.
 
@@ -88,6 +89,35 @@ On the platform the sender is pinned to your project. `from` must be your projec
 
 On your own Cloudflare account, `from` defaults to `email.from` from `void.config.ts` and must be on a domain your account can send from; Cloudflare rejects any other sender and `sendEmail` reports it as `INVALID_FROM`.
 
+## Reply later {#reply-later}
+
+`replyEmail()` works only while the inbound handler runs. To reply later, for example from a queue job, save the thread ids in the handler and pass them to `sendEmail` as `threading`:
+
+```ts
+// email/support.ts
+export default defineEmail(async (message) => {
+  await tickets.save({
+    from: message.from,
+    subject: message.headers.get('Subject') ?? '',
+    messageId: message.headers.get('Message-ID') ?? '',
+    references: message.headers.get('References') ?? '',
+  });
+});
+
+// Later, in a queue job
+await sendEmail({
+  to: ticket.from,
+  subject: `Re: ${ticket.subject}`,
+  text: 'We fixed it.',
+  threading: {
+    inReplyTo: ticket.messageId,
+    references: `${ticket.references} ${ticket.messageId}`,
+  },
+});
+```
+
+`inReplyTo` is the parent message's `Message-ID`. `references` lists the thread's ids, oldest first, ending with the parent; it defaults to `inReplyTo`. Mail clients use them to show the reply in the same conversation. An id that cannot be sent, such as one with a control character, is left out. If `references` cannot be sent, it falls back to `inReplyTo`. The email still sends. `headers` cannot set `In-Reply-To` or `References`.
+
 ## Attachments {#attachments}
 
 ```ts

package/docs/guide/pages-routing/actions-and-forms.md

@@ -29,6 +29,8 @@ export const action = defineHandler.withValidator({
 | Nothing (void)        | Re-runs the loader, page re-renders with fresh props. |
 | `c.redirect('/path')` | Navigates to another page.                            |
 
+Middleware does not run again after the action. To change [shared data](./layouts.md#shared-data), update it in the action or redirect.
+
 ## Form
 
 Pair `Form` with `useForm` to submit values and display validation and action errors. Inputs stay editable when a submission fails.
@@ -196,8 +198,26 @@ const form = useForm(
 
 `onError` receives a field-error map or a `VoidActionError`. Callbacks can be async; `form.pending` stays true until they finish, and thrown errors reach the nearest React error boundary. Callbacks run before React commits the updated UI, so use an effect or ref callback to focus an element that appears after submission.
 
+If a callback awaits `router.visit()` or `router.refresh()`, pass `{ resolveOn: 'data' }` so it can finish before React commits the navigation. See [React navigation completion](../../reference/api/pages.md#react-navigation-completion).
+
 Vue, Svelte, and Solid submissions return a promise instead; use `await form.post()` to run work after a submission.
 
+### Scroll after submission
+
+Actions and forms keep the current scroll position when updating the page in place. Redirects and submissions that open another page scroll to the top, or to the destination's hash target.
+
+Pass `preserveScroll: false` to reset scroll after an in-place update, or `true` to keep it even after a redirect:
+
+```ts
+await action('/users/:id?update', {
+  params: { id: '42' },
+  data: { name: 'Alice' },
+  preserveScroll: false,
+});
+```
+
+In React, set `preserveScroll` in the third argument to `useForm()`. In Vue, Svelte, and Solid, pass it to the submit method, such as `form.post({ preserveScroll: false })`.
+
 ## Named Actions
 
 When a page needs multiple mutations, such as updating and deleting a user on the same page, export `actions` (plural) instead of `action`:
@@ -270,7 +290,7 @@ if (!result.ok) {
 
 `action()` defaults to `POST`. Pass `data`, `params`, and `method` to set the body, route parameters, or HTTP method.
 
-A successful call returns `{ ok: true, pageData }`. Expected errors, such as validation failures or conflicts, return `{ ok: false, error }`.
+A successful call returns `{ ok: true, pageData }`. Expected errors, such as validation failures or conflicts, return `{ ok: false, error }`. `error.message` is the message of an [`HTTPException`](../../integrations/hono.md#utilities) with a `4xx` status, or the body of another plain-text `4xx` response. For other errors, it is a status summary such as `Action failed with 404 Not Found`.
 
 ## Validation Errors
 

package/docs/guide/pages-routing/islands.md

@@ -96,11 +96,11 @@ export default function BlogIndex({ posts }) {
 
 ```vue [Vue]
 <!-- pages/blog/index.island.vue -->
-<script setup>
+<script setup lang="ts">
 import Counter from './_Counter.vue' with { island: 'load' };
 import PostForm from './_PostForm.vue' with { island: 'visible' };
 
-defineProps({ posts: Array });
+const { posts } = defineProps<{ posts: { slug: string; title: string }[] }>();
 </script>
 
 <template>
@@ -249,7 +249,7 @@ export default function PostForm() {
 ```
 
 ```vue [Vue]
-<script setup>
+<script setup lang="ts">
 import { useIslandForm } from '@void/vue';
 
 const form = useIslandForm({ title: '', body: '' });

package/docs/guide/pages-routing/layouts.md

@@ -167,7 +167,7 @@ export default function Page() {
 ```
 
 ```vue [Vue]
-<script>
+<script lang="ts">
 export const layout = 'landing';
 </script>
 
@@ -238,4 +238,18 @@ export default defineMiddleware(async (c, next) => {
 });
 ```
 
-Call `useShared()` from your framework adapter, as in the layout examples above. Its return type is inferred from `CloudContextVariables`. Shared data comes from middleware; page props come from the loader. See [Context variables](../type-safety.md#context-variables).
+Call `useShared()` from your framework adapter, as in the layout examples above. Its return type is inferred from `CloudContextVariables`. See [Context variables](../type-safety.md#context-variables).
+
+Middleware sets the starting value. A loader or action can update it before the page is sent:
+
+```ts
+// pages/profile.server.ts
+import { defineHandler } from 'void';
+
+export const action = defineHandler(async (c) => {
+  const user = await updateProfile(c);
+  c.set('shared', { ...c.get('shared'), auth: { user } });
+});
+```
+
+Middleware runs before the action. If an action changes data that shared data is built from, update shared data in the action, or redirect with `c.redirect()` so middleware runs again on the next page load.

package/docs/guide/pages-routing/loaders.md

@@ -51,7 +51,7 @@ export default function UsersPage({ users }: Props) {
 <!-- pages/users/index.vue -->
 <script setup lang="ts">
 import type { Props } from './index.server';
-defineProps<Props>();
+const { users } = defineProps<Props>();
 </script>
 
 <template>
@@ -177,7 +177,7 @@ Check `loading` first, then `error`. TypeScript narrows `value` to `T` in the re
 ```vue [Vue]
 <script setup lang="ts">
 import type { Props } from './dashboard.server';
-defineProps<Props>();
+const { projects, usage } = defineProps<Props>();
 </script>
 
 <template>

package/docs/guide/pages-routing/markdown.md

@@ -190,7 +190,7 @@ export default function DocsLayout({ children }) {
 ```
 
 ```vue [Vue]
-<script setup>
+<script setup lang="ts">
 import { useFrontmatter } from '@void/md';
 
 const fm = useFrontmatter();