@abide/abide 0.28.0

package/src/lib/server/runtime/createUiPageRenderer.ts

@@ -0,0 +1,181 @@
+import { appNameSlot } from '../../shared/appNameSlot.ts'
+import { SSR_CACHE_CONTROL } from '../../shared/CACHE_CONTROL_VALUES.ts'
+import { formatTraceparent } from '../../shared/formatTraceparent.ts'
+import { layoutChainForRoute } from '../../shared/layoutChainForRoute.ts'
+import { renderChain } from '../../ui/renderChain.ts'
+import { renderToStream } from '../../ui/renderToStream.ts'
+import type { UiComponent } from '../../ui/runtime/types/UiComponent.ts'
+import { pageUrlFromStore } from './pageUrlFromStore.ts'
+import { SSR_SWAP_SCRIPT } from './SSR_SWAP_SCRIPT.ts'
+import { safeJsonForScript } from './safeJsonForScript.ts'
+import { serializeCacheSnapshot } from './serializeCacheSnapshot.ts'
+import type { RequestStore } from './types/RequestStore.ts'
+
+/* A abide-ui page module: its default export is the compiled component. */
+type LoadPage = () => Promise<{ default: UiComponent }>
+
+const SSR_MARKER = /<!--ssr:(head|body|state)-->/g
+const BODY_MARKER = '<!--ssr:body-->'
+
+function wantsJson(request: Request): boolean {
+    return (request.headers.get('accept') ?? '').includes('application/json')
+}
+
+/*
+The abide-ui SSR document renderer. A matched route + params in, a finished HTML
+Response out.
+
+A page with no `await` block renders synchronously and ships buffered. A page with
+await blocks STREAMS: the pending shell flushes first, then each resolved fragment
+(`<abide-resolve data-resume>`) as its promise settles, swapped into its boundary
+by the inline SSR_SWAP_SCRIPT — which also registers the value into the resume
+manifest so client hydration adopts it without re-fetching (see abide/ui/awaitBlock).
+
+`__SSR__` carries the route/params, mount base, trace, app name, client timeout,
+and the settled cache snapshot (the client seeds its tab store from it). A route's
+`layout.abide` files wrap the page outermost-first (every ancestor directory's
+layout applies); the chain server-renders as one document via `renderChain`, the
+page folded into each layout's `<slot/>` outlet. The client router re-resolves the
+same chain and keeps shared layouts mounted across navigation.
+*/
+export function createUiPageRenderer({
+    shell,
+    base,
+    clientTimeout,
+    pages,
+    layouts,
+    healthPayload,
+}: {
+    shell: string
+    base: string
+    clientTimeout: number | undefined
+    pages: Record<string, LoadPage>
+    layouts: Record<string, LoadPage>
+    healthPayload: (request: Request) => Promise<Record<string, unknown>>
+}): {
+    renderPage: (
+        routeUrl: string,
+        params: Record<string, string>,
+        store: RequestStore,
+    ) => Promise<Response>
+    renderError: (
+        status: number,
+        message: string,
+        store: RequestStore,
+        stack?: string,
+    ) => Promise<Response | undefined>
+} {
+    /* Build the __SSR__ <script> the client (startClient) reads on boot. */
+    async function stateTag(
+        routeUrl: string,
+        params: Record<string, string>,
+        store: RequestStore,
+    ): Promise<string> {
+        const { inline } = await serializeCacheSnapshot(store.cache)
+        const health = store.healthRead ? await healthPayload(store.req) : undefined
+        const payload = safeJsonForScript({
+            route: routeUrl,
+            params,
+            cache: inline,
+            base: base || undefined,
+            trace: formatTraceparent(store.trace),
+            app: appNameSlot.name,
+            health,
+            clientTimeout,
+        })
+        return `<script>window.__SSR__ = ${payload};</script>`
+    }
+
+    async function renderPage(
+        routeUrl: string,
+        params: Record<string, string>,
+        store: RequestStore,
+    ): Promise<Response> {
+        store.route = routeUrl
+        store.params = params
+        /* Touch pageUrl so the page proxy resolves the browser-space URL during SSR. */
+        pageUrlFromStore(store)
+        if (wantsJson(store.req)) {
+            return Response.json(
+                { route: routeUrl, params },
+                { headers: { Vary: 'Accept', 'Cache-Control': SSR_CACHE_CONTROL } },
+            )
+        }
+        const loadPage = pages[routeUrl]
+        if (loadPage === undefined) {
+            throw new Error(`[abide] unknown route: ${routeUrl}`)
+        }
+        /* Outermost layout → … → page: load every applicable layout chunk plus the
+           page, then render the chain as one document (shared block-id pass). */
+        const chainKeys = layoutChainForRoute(routeUrl, Object.keys(layouts))
+        const views = await Promise.all([
+            ...chainKeys.map((key) => layouts[key]?.().then((module) => module.default)),
+            loadPage().then((module) => module.default),
+        ])
+        const ssr = renderChain(
+            views.filter((view): view is UiComponent => view !== undefined),
+            params,
+        )
+
+        /* No await blocks → render synchronously, ship buffered. */
+        if (ssr.awaits.length === 0) {
+            const html = shell.replace(SSR_MARKER, (_match, key: string) =>
+                key === 'body' ? ssr.html : key === 'state' ? '' : '',
+            )
+            const withState = html.replace(
+                '</body>',
+                `${await stateTag(routeUrl, params, store)}</body>`,
+            )
+            return new Response(withState, {
+                headers: {
+                    'Content-Type': 'text/html; charset=utf-8',
+                    Vary: 'Accept',
+                    'Cache-Control': SSR_CACHE_CONTROL,
+                },
+            })
+        }
+
+        /* Await blocks → stream the shell, then resolved fragments as they settle.
+           Fill head/state but LEAVE the body marker intact — it's the split point for
+           streaming the page body into `#app`; consuming it here would append the body
+           after the whole shell (outside `#app`), breaking hydration. */
+        const head = `<script>${SSR_SWAP_SCRIPT}</script>${await stateTag(routeUrl, params, store)}`
+        const filled = shell.replace(/<!--ssr:(head|state)-->/g, (_match, key: string) =>
+            key === 'head' ? head : '',
+        )
+        const [before, after] = filled.split(BODY_MARKER)
+        const encoder = new TextEncoder()
+        return new Response(
+            new ReadableStream({
+                async start(controller) {
+                    controller.enqueue(encoder.encode(before ?? ''))
+                    let first = true
+                    for await (const chunk of renderToStream(() => ssr)) {
+                        controller.enqueue(
+                            encoder.encode(
+                                first ? chunk : `${chunk}<script>__abideSwap()</script>`,
+                            ),
+                        )
+                        first = false
+                    }
+                    controller.enqueue(encoder.encode(after ?? ''))
+                    controller.close()
+                },
+            }),
+            {
+                headers: {
+                    'Content-Type': 'text/html; charset=utf-8',
+                    'Cache-Control': SSR_CACHE_CONTROL,
+                },
+            },
+        )
+    }
+
+    /* Error pages are not framework-resolved in abide-ui — no error view to render,
+       so the caller falls back to its plain Response (404 text) or rethrows. */
+    async function renderError(): Promise<Response | undefined> {
+        return undefined
+    }
+
+    return { renderPage, renderError }
+}

package/src/lib/server/runtime/crossOriginForbidden.ts

@@ -0,0 +1,17 @@
+import { NO_STORE } from '../../shared/CACHE_CONTROL_VALUES.ts'
+import { TEXT_PLAIN } from '../../shared/TEXT_PLAIN.ts'
+
+/*
+The framework's CSRF refusal, shared by every same-origin gate — the socket
+upgrade, the socket REST publish face, the MCP endpoint, and mutating rpc
+verbs — so the 403 body can't drift between surfaces. `hint` appends a
+surface-specific remedy; rpc names its `crossOrigin: true` opt-out so the
+first developer this 403s can self-serve.
+*/
+export function crossOriginForbidden(hint?: string): Response {
+    const detail = hint ? ` ${hint}` : ''
+    return new Response(
+        `Forbidden: cross-origin browser request refused (CSRF protection).${detail}`,
+        { status: 403, headers: { 'Content-Type': TEXT_PLAIN, 'Cache-Control': NO_STORE } },
+    )
+}

package/src/lib/server/runtime/crossOriginGate.ts

@@ -0,0 +1,29 @@
+import { isReadOnlyMethod } from '../../shared/isReadOnlyMethod.ts'
+import type { HttpVerb } from '../../shared/types/HttpVerb.ts'
+import { crossOriginForbidden } from './crossOriginForbidden.ts'
+import { isCrossOriginRequest } from './isCrossOriginRequest.ts'
+
+/*
+The framework's CSRF/CSWSH posture in one place: a cross-origin browser
+request to a mutating framework endpoint is refused. Every endpoint that
+parses bodies ignoring Content-Type (rpc verbs, socket publish, MCP JSON-RPC)
+must gate here — a hostile page's text/plain form trick could otherwise
+smuggle a payload in with the visitor's ambient cookies; non-browser clients
+send no Origin and pass. Returns the 403 to send, or undefined to proceed.
+Mount sites declare their variation: `allowReadOnly` lets GET/HEAD reads
+through (rpc reads and socket tails stay open cross-origin), `optOut` honours
+a verb's explicit `crossOrigin: true`, `hint` names the remedy in the 403.
+*/
+export function crossOriginGate(
+    req: Request,
+    url: URL,
+    options: { allowReadOnly?: boolean; optOut?: boolean; hint?: string } = {},
+): Response | undefined {
+    if (options.optOut) {
+        return undefined
+    }
+    if (options.allowReadOnly && isReadOnlyMethod(req.method as HttpVerb)) {
+        return undefined
+    }
+    return isCrossOriginRequest(req, url) ? crossOriginForbidden(options.hint) : undefined
+}

package/src/lib/server/runtime/devClientFingerprint.ts

@@ -0,0 +1,117 @@
+import { relative } from 'node:path'
+import { analyzeComponent } from '../../ui/compile/analyzeComponent.ts'
+import { compileComponent } from '../../ui/compile/compileComponent.ts'
+import { nearestProjectRoot } from '../../ui/compile/nearestProjectRoot.ts'
+import { globToPathSet } from './globToPathSet.ts'
+import type { DevReloadStamp } from './types/DevReloadStamp.ts'
+
+// The shell's entry-stylesheet link: any `/_app/*.css` href, either quote style.
+const CSS_HREF = /href=(["'])([^"']*\/_app\/[^"']*\.css)\1/
+// Every `/_app/<hashed-asset>` ref in the shell (the JS entry, the stylesheet) —
+// content-hashed names that move on any rebuild. Normalised out of `structure` so
+// a component/CSS edit (which re-hashes the bundle) doesn't read as a reload; the
+// source-based signals (components, non-component hashes, cssHref) catch real changes.
+const APP_ASSET = /\/_app\/[^"'\s)]*/g
+// src/.abide is the build's own generated output (route d.ts) — rewritten every
+// rebuild, so it must stay out of the hash or the page would always reload.
+const GENERATED = /(^|\/)\.abide\//
+
+// page.abide / layout.abide are router-mounted, not `mountChild`-tracked, so they
+// can't hot-swap — they fold into `structure` (a reload) instead.
+function isPageOrLayout(moduleId: string): boolean {
+    const file = moduleId.split('/').pop() ?? ''
+    return file === 'page.abide' || file === 'layout.abide'
+}
+
+/*
+The dev live-reload stamp, computed once at worker boot from SOURCE (the dev
+watcher only watches src/, so source is what a rebuild can reflect). Splits the
+edit space so the browser keeps its page where it can:
+
+  - Each `.abide` is hashed by its client BUILD (`compileComponent`, which carries
+    no CSS), so a style-only edit doesn't change it. A leaf component with no
+    imports that isn't a page/layout is hot-swappable: its hash goes in
+    `components`, keyed by the same module id the loader stamps (so it matches the
+    registry). Every other component (page, layout, import-bearing) folds its hash
+    into `structure` — editing it reloads.
+  - `structure` also covers non-`.abide` source, public stamps, the shell (with
+    the stylesheet href normalised out), and the sorted component-id set (so
+    adding/removing a component reloads).
+  - `cssHref` is the entry stylesheet's current URL, read from the shell.
+
+A compile failure (mid-edit syntax error) falls back to a raw-source hash marked
+non-hot, so the worst case is a reload, never a throw at boot.
+*/
+export async function devClientFingerprint({
+    srcDir,
+    publicDir,
+    shell,
+    projectRoot,
+}: {
+    srcDir: string
+    publicDir: string
+    shell: string
+    projectRoot: string
+}): Promise<DevReloadStamp> {
+    const srcFiles = [...(await globToPathSet(srcDir, '**/*', (file) => file, { dot: true }))]
+        .filter((file) => !GENERATED.test(file))
+        .sort()
+
+    const components: Record<string, string> = {}
+    const nonHotComponents: string[] = []
+    const componentIds: string[] = []
+    const otherSource: string[] = []
+
+    await Promise.all(
+        srcFiles.map(async (file) => {
+            const full = `${srcDir}/${file}`
+            if (!file.endsWith('.abide')) {
+                const bytes = await Bun.file(full)
+                    .arrayBuffer()
+                    .catch(() => undefined)
+                otherSource.push(`${file}:${bytes ? Bun.hash(bytes) : 0}`)
+                return
+            }
+            const source = await Bun.file(full)
+                .text()
+                .catch(() => '')
+            const moduleId = relative(nearestProjectRoot(full, projectRoot), full)
+            componentIds.push(moduleId)
+            let bodyHash: string
+            let hot = false
+            try {
+                const isLayout = moduleId.endsWith('layout.abide')
+                bodyHash = Bun.hash(compileComponent(source, isLayout, moduleId)).toString(36)
+                hot = analyzeComponent(source).imports === '' && !isPageOrLayout(moduleId)
+            } catch {
+                bodyHash = Bun.hash(source).toString(36)
+            }
+            if (hot) {
+                components[moduleId] = bodyHash
+            } else {
+                nonHotComponents.push(`${moduleId}:${bodyHash}`)
+            }
+        }),
+    )
+
+    const publicFiles = [
+        ...(await globToPathSet(publicDir, '**/*', (file) => file, { dot: true })),
+    ].sort()
+    const publicStamps = publicFiles.map((file) => {
+        const stat = Bun.file(`${publicDir}/${file}`)
+        return `${file}:${stat.size}:${stat.lastModified}`
+    })
+
+    const cssHref = shell.match(CSS_HREF)?.[2]
+    const structureShell = shell.replace(APP_ASSET, '/_app/HASH')
+    const structure = Bun.hash(
+        [
+            otherSource.sort().join('\n'),
+            publicStamps.join('\n'),
+            structureShell,
+            componentIds.sort().join(','),
+            nonHotComponents.sort().join('\n'),
+        ].join('\0'),
+    ).toString(36)
+    return { structure, cssHref, components }
+}

package/src/lib/server/runtime/devHotModuleResponse.ts

@@ -0,0 +1,40 @@
+import { resolve } from 'node:path'
+import { NO_STORE } from '../../shared/CACHE_CONTROL_VALUES.ts'
+import { compileModule } from '../../ui/compile/compileModule.ts'
+
+// Reused across requests — strips the embedded author TypeScript to browser JS.
+const TRANSPILER = new Bun.Transpiler({ loader: 'ts' })
+
+/*
+Serves one edited `.abide`'s hot module (dev component HMR). Compiles it in hot
+mode — runtime sourced from `window.__abide`, self-invoking `hotReplace` — and
+transpiles the embedded author TypeScript to plain JS the browser can import
+directly (the normal pipeline relies on the bundler's `ts` loader for this). The
+browser imports this in place of a reload; on load it swaps the component's live
+instances. The id is guarded as a project-relative `.abide` under cwd; a bad or
+missing file 404s so the client falls back to a reload.
+*/
+export async function devHotModuleResponse(moduleId: string): Promise<Response> {
+    const root = process.cwd()
+    const path = resolve(root, moduleId)
+    if (!moduleId.endsWith('.abide') || !path.startsWith(`${root}/`)) {
+        return new Response('bad request', { status: 400 })
+    }
+    const source = await Bun.file(path)
+        .text()
+        .catch(() => undefined)
+    if (source === undefined) {
+        return new Response('not found', { status: 404 })
+    }
+    const code = compileModule(source, {
+        isLayout: moduleId.endsWith('layout.abide'),
+        moduleId,
+        hot: true,
+    })
+    return new Response(TRANSPILER.transformSync(code), {
+        headers: {
+            'Content-Type': 'application/javascript; charset=utf-8',
+            'Cache-Control': NO_STORE,
+        },
+    })
+}

package/src/lib/server/runtime/devReloadResponse.ts

@@ -0,0 +1,41 @@
+import { NO_STORE } from '../../shared/CACHE_CONTROL_VALUES.ts'
+import type { DevReloadStamp } from './types/DevReloadStamp.ts'
+
+// Keepalive comment cadence — keeps the idle SSE connection from being dropped.
+const KEEPALIVE_INTERVAL_MS = 15000
+const TEXT_ENCODER = new TextEncoder()
+
+/*
+The dev live-reload channel (`/__abide/dev`, dev only). An SSE stream carrying
+one event: the worker's reload stamp (devClientFingerprint) as JSON. The
+connection drops when the dev orchestrator swaps the server after a rebuild;
+the browser-side client (DEV_RELOAD_CLIENT_SCRIPT) reconnects and compares — a
+changed `structure` reloads, a changed `cssHref` alone swaps the stylesheet in
+place, and a server-only edit (both equal) keeps the page alive. The opening
+`retry: 250` shortens EventSource's reconnect backoff; a periodic comment keeps
+the idle connection alive. The interval is cleared when the consumer disconnects.
+*/
+export function devReloadResponse(stamp: DevReloadStamp): Response {
+    let keepalive: ReturnType<typeof setInterval>
+    const body = new ReadableStream<Uint8Array>({
+        start(controller) {
+            controller.enqueue(
+                TEXT_ENCODER.encode(`retry: 250\ndata: ${JSON.stringify(stamp)}\n\n`),
+            )
+            keepalive = setInterval(() => {
+                controller.enqueue(TEXT_ENCODER.encode(': keepalive\n\n'))
+            }, KEEPALIVE_INTERVAL_MS)
+        },
+        cancel() {
+            clearInterval(keepalive)
+        },
+    })
+    return new Response(body, {
+        headers: {
+            'Content-Type': 'text/event-stream; charset=utf-8',
+            'Cache-Control': NO_STORE,
+            'X-Content-Type-Options': 'nosniff',
+            Connection: 'keep-alive',
+        },
+    })
+}

package/src/lib/server/runtime/disableIdleTimeoutForStream.ts

@@ -0,0 +1,27 @@
+import type { Server } from 'bun'
+import { isStreamingResponse } from '../../shared/isStreamingResponse.ts'
+
+/*
+Opts a long-lived streaming response (SSE / JSONL) out of Bun's per-connection
+idle timeout. Such a stream can stay quiet for longer than the 10s default
+between frames, which Bun would otherwise read as an idle connection and close
+mid-stream. `server.timeout(req, 0)` clears the timeout for just this in-flight
+request, leaving the global default in place for ordinary traffic. Streaming is
+detected by Content-Type (the shared signal the CLI/MCP drain paths use) rather
+than `body instanceof ReadableStream`, since every bodied Response exposes one.
+
+A streamed SSR page (`text/html`) is deliberately not opted out: it inherits the
+configured `idleTimeout` as a bounded cap on how long it can hold the connection,
+and the client re-fetches any placeholder left unresolved by a cut stream (see
+flushUnresolvedPlaceholders). Non-stream responses pass through.
+*/
+export function disableIdleTimeoutForStream(
+    server: Server<unknown>,
+    req: Request,
+    response: Response,
+): Response {
+    if (isStreamingResponse(response)) {
+        server.timeout(req, 0)
+    }
+    return response
+}

package/src/lib/server/runtime/envSchemaStore.ts

@@ -0,0 +1,15 @@
+import type { StandardSchemaV1 } from '../../shared/types/StandardSchemaV1.ts'
+
+/*
+Holds the schema handed to env() so the bundle launcher can project the
+first-run setup form from it (jsonSchemaForSchema) without re-running boot
+validation. `skipValidation` lets the launcher import src/server/config.ts
+purely to register the schema: env() records it and returns early instead of
+validating Bun.env — which the launcher has no business doing, that's the
+embedded server's job at its own boot. In-process module state, so the server
+child the launcher spawns gets a fresh store and validates normally.
+*/
+export const envSchemaStore: {
+    schema: StandardSchemaV1 | undefined
+    skipValidation: boolean
+} = { schema: undefined, skipValidation: false }

package/src/lib/server/runtime/findOpenPort.ts

@@ -0,0 +1,21 @@
+import { listenOnOpenPort } from './listenOnOpenPort.ts'
+
+/*
+Returns the first bindable TCP port at or above `start`, probing upward.
+Used when no PORT is configured so the server lands on a predictable
+3000+ port (3000, then 3001, …) instead of a random kernel-assigned one —
+running a second app just steps to the next free port. The scan policy
+(range, kernel-assigned fallback) lives in listenOnOpenPort; this variant
+binds a throwaway server and releases it, so like any release-then-rebind
+there's a tiny race before the real listener takes the port — negligible
+for a local boot.
+*/
+export function findOpenPort(start: number): number {
+    const probe = listenOnOpenPort(
+        (port) => Bun.serve({ port, fetch: () => new Response() }),
+        start,
+    )
+    const bound = probe.port as number
+    probe.stop(true)
+    return bound
+}

package/src/lib/server/runtime/getActiveServer.ts

@@ -0,0 +1,6 @@
+import type { Server } from 'bun'
+import { serverSlot } from './serverSlot.ts'
+
+export function getActiveServer(): Server<unknown> | undefined {
+    return serverSlot.active
+}

package/src/lib/server/runtime/globToPathSet.ts

@@ -0,0 +1,29 @@
+import { Glob } from 'bun'
+
+/*
+Scans `cwd` for files matching `pattern` and returns their request paths as
+a Set, mapping each relative file path to a root-relative URL via `keyFor`.
+Used to snapshot the on-disk asset trees (the `public/` files, the `_app`
+precompressed `.gz` siblings) once at boot so the request path is a Set
+lookup instead of a filesystem stat.
+
+A missing directory makes scan throw ENOENT — swallowed to an empty Set so
+the caller just falls through. This scan-and-catch is also the reliable
+directory existence test: `Bun.file(dir).exists()` returns false for a
+directory, so guarding the scan with it silently yields an empty Set.
+*/
+export async function globToPathSet(
+    cwd: string,
+    pattern: string,
+    keyFor: (file: string) => string,
+    options?: { dot?: boolean },
+): Promise<Set<string>> {
+    try {
+        const files = await Array.fromAsync(
+            new Glob(pattern).scan({ cwd, dot: options?.dot ?? false }),
+        )
+        return new Set(files.map(keyFor))
+    } catch {
+        return new Set()
+    }
+}

package/src/lib/server/runtime/gzipResponse.ts

@@ -0,0 +1,46 @@
+import { isStreamingResponse } from '../../shared/isStreamingResponse.ts'
+import { acceptsGzip } from './acceptsGzip.ts'
+
+/*
+Compressible Content-Types — text and structured-text payloads. Binary or
+already-compressed bodies (images, fonts, archives, zstd/gzip blobs) gain
+nothing from a second pass and only burn CPU.
+*/
+const COMPRESSIBLE_TYPE =
+    /^(?:text\/|application\/(?:json|javascript|xml|[\w.-]+\+(?:json|xml))|image\/svg)/
+
+/*
+Gzips a dynamic response (SSR HTML, rpc/json replies, the plain 404) when the
+client accepts it, piping the body through a CompressionStream so a buffered
+body and a streamed SSR document take the identical path. Static assets never
+reach here — they already carry a precompressed Content-Encoding, which
+short-circuits the first guard. Skipped for: already-encoded bodies, bodiless
+responses (204/304/HEAD), non-compressible types (images, fonts, archives),
+and frame-delimited streams (SSE/jsonl, where gzip buffering would stall
+per-frame flush). No byte-size floor: Bun doesn't expose a string body's length
+before send, and measuring would mean buffering the streamed SSR document —
+the framing overhead on the rare tiny body is negligible against compressing
+every page and rpc payload.
+*/
+export function gzipResponse(req: Request, response: Response): Response {
+    if (!response.body || response.headers.has('Content-Encoding')) {
+        return response
+    }
+    if (!acceptsGzip(req) || isStreamingResponse(response)) {
+        return response
+    }
+    const contentType = (response.headers.get('content-type') ?? '').toLowerCase()
+    if (!COMPRESSIBLE_TYPE.test(contentType)) {
+        return response
+    }
+    const headers = new Headers(response.headers)
+    headers.set('Content-Encoding', 'gzip')
+    headers.append('Vary', 'Accept-Encoding')
+    /* The stored length no longer matches the compressed body (and is unknown for a stream). */
+    headers.delete('Content-Length')
+    return new Response(response.body.pipeThrough(new CompressionStream('gzip')), {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    })
+}

package/src/lib/server/runtime/inProcessServer.ts

@@ -0,0 +1,20 @@
+import type { Server } from 'bun'
+
+/*
+The Server `server()` hands back under in-process dispatch (CLI / MCP / test
+client), where no Bun.serve has booted so there is no live connection to act on.
+Each member is the honest no-op for a request that never rode a socket: timeout
+and upgrade do nothing, publish reaches no subscribers (0 bytes sent),
+subscriberCount is 0, requestIP has no peer (null). Handlers using these idioms
+run unchanged in-process instead of throwing; createServer's live Server takes
+precedence whenever one is booted. Connection-scoped only — config-shaped
+members (port, url, hostname …) are intentionally absent: there is no server to
+describe, and a stubbed value would mislead more than their plain absence.
+*/
+export const inProcessServer = {
+    timeout() {},
+    upgrade: () => false,
+    publish: () => 0,
+    subscriberCount: () => 0,
+    requestIP: () => null,
+} as unknown as Server<unknown>

package/src/lib/server/runtime/internalErrorResponse.ts

@@ -0,0 +1,25 @@
+import { NO_STORE } from '../../shared/CACHE_CONTROL_VALUES.ts'
+
+/*
+The framework's default 500 response. Shared by the per-request scope's catch
+(runWithRequestScope) and Bun.serve's global error() fallback so the two can't
+drift. Only reached when the app supplies no `handleError` hook.
+
+Secure by default: a bare `Internal Server Error` so paths, library versions,
+and message contents never leak to clients in production. The full stack is
+shown only under `abide dev` (ABIDE_DEV=1, the orchestrator's signal); the
+cause is logged server-side regardless.
+*/
+export function internalErrorResponse(error: unknown): Response {
+    const body =
+        Bun.env.ABIDE_DEV === '1'
+            ? `<pre>${String((error as Error)?.stack ?? error)}</pre>`
+            : 'Internal Server Error'
+    return new Response(body, {
+        status: 500,
+        headers: {
+            'Content-Type': 'text/html; charset=utf-8',
+            'Cache-Control': NO_STORE,
+        },
+    })
+}

package/src/lib/server/runtime/isCrossOriginRequest.ts

@@ -0,0 +1,23 @@
+/*
+True when the request carries a browser Origin that doesn't match the
+request's own host — the cross-site request forgery shape, in both its
+WebSocket form (CSWSH) and its HTTP form (a hostile page firing a form post
+or no-preflight fetch at an rpc/MCP URL inside a visitor's authenticated
+browser, ambient cookies attached). Native clients (CLI, MCP, curl) send no
+Origin, so an absent header is allowed; only a present-and-mismatched (or
+unparseable) Origin is rejected. An unparseable Origin is treated as
+cross-origin (fail closed). `requestUrl` lets a caller that already parsed
+the URL pass it in; otherwise the parse is deferred until an Origin is
+actually present, keeping the no-Origin hot path allocation-free.
+*/
+export function isCrossOriginRequest(request: Request, requestUrl?: URL): boolean {
+    const origin = request.headers.get('origin')
+    if (!origin) {
+        return false
+    }
+    try {
+        return new URL(origin).host !== (requestUrl ?? new URL(request.url)).host
+    } catch {
+        return true
+    }
+}