@bascik/adapter-cloudflare 1.0.0-rc.1 → 1.0.0-rc.10

package/dist/build.js

@@ -3,13 +3,17 @@
  *
  * Cloudflare adapter build implementation.
  */
-import { pageAliasesFor } from "@bascik/bascik/adapter";
+import { pageAliasesFor, } from "@bascik/bascik/adapter";
 import { resolve, dirname, join, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { mkdir, copyFile, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { existsSync, realpathSync } from "node:fs";
+import { mkdir, copyFile, readFile, realpath, writeFile, } from "node:fs/promises";
 import { CLOUDFLARE_COMPATIBILITY_DATE, CLOUDFLARE_COMPATIBILITY_FLAGS, PAGES_ROUTES_LIMIT, classifyNodeBuiltin, formatUnsupportedImport, } from "./compat.js";
-import { resolveWorkerName } from "./config.js";
+import { deploymentCompatSettings, discoverWranglerConfig, generateWranglerConfig, resolveWorkerName, } from "./config.js";
+import { buildHeadersFile, workerPageHeaderOverrides } from "./headers-file.js";
 import { build as esbuildBuild } from "esbuild";
+import { isBascikFolderName, manifestHasComponents, } from "@bascik/bascik/runtime";
 export { pageAliasesFor };
 const withBasePath = (path, base) => {
     if (base === "/" || !base)
@@ -22,30 +26,86 @@ export const buildInvocationRoutes = (input) => {
     for (const path of input.dynamicPagePaths)
         for (const alias of pageAliasesFor(path, input.base))
             include.add(alias);
+    if (input.hasStaticNotFoundPage)
+        for (const alias of pageAliasesFor("/404", input.base))
+            include.add(alias);
     if (input.hasApiRoutes)
         include.add(withBasePath("/api/*", input.base));
     include.add(withBasePath("/_routes.json", input.base));
     include.add(withBasePath("/_worker.js", input.base));
     const sorted = Array.from(include).sort();
     if (sorted.length > PAGES_ROUTES_LIMIT) {
-        return { include: [withBasePath("/*", input.base)], exclude: [], overflowed: true };
+        return {
+            include: [withBasePath("/*", input.base)],
+            exclude: [],
+            overflowed: true,
+        };
     }
     return { include: sorted, exclude: [], overflowed: false };
 };
+/**
+ * Public paths a deployment reserves. Pages reads `_worker.js` and
+ * `_routes.json` from the public root; the Worker answers 404 for both on
+ * every target (runtime.ts, GENERATED_CONTROL_PATHS), so on Workers an
+ * authored one would deploy and never be served. The Workers variant's
+ * worker.js and wrangler.jsonc sit beside public/, never in it.
+ */
 const CONTROL_FILES = {
     pages: ["_worker.js", "_routes.json"],
-    workers: ["wrangler.jsonc", "worker.js"],
+    workers: ["_worker.js", "_routes.json"],
 };
+const ASSET_CONTROL_FILES = new Set(["_headers", "_redirects"]);
 export const detectControlCollisions = (publicPaths, variant) => {
     const control = new Set(CONTROL_FILES[variant] ?? []);
     const problems = [];
     for (const path of [...publicPaths].sort()) {
         if (control.has(path)) {
-            problems.push(`[bascik] --target cloudflare-${variant}: authored file "${path}" collides with a generated control file. Rename it or remove it from directory.pages.`);
+            problems.push(variant === "pages"
+                ? `[bascik] --target cloudflare-${variant}: authored file "${path}" collides with a generated control file. Rename it or remove it from directory.pages.`
+                : `[bascik] --target cloudflare-${variant}: authored file "${path}" would never be served: the Worker answers 404 for it, a Cloudflare control path. Rename it or remove it from directory.pages.`);
         }
     }
     return problems;
 };
+/**
+ * Whether the authored `assets.run_worker_first` sends every request of the
+ * site to the Worker first: `true`, or a list with `/*` (or the base's
+ * `/shop/*`) and no `!` exclusion.
+ */
+export const runsWorkerFirst = (assets, base) => {
+    if (typeof assets !== "object" || assets === null)
+        return false;
+    const value = assets.run_worker_first;
+    if (value === true)
+        return true;
+    if (!Array.isArray(value))
+        return false;
+    if (value.some((p) => typeof p !== "string" || p.startsWith("!")))
+        return false;
+    return value.includes("/*") || value.includes(withBasePath("/*", base));
+};
+/**
+ * The wrangler/config-schema.json installed for the project, for the
+ * generated config's `$schema` (editor help only; Wrangler ignores it).
+ * Undefined when wrangler is not installed where the project resolves it.
+ */
+const wranglerSchemaPath = (projectRoot) => {
+    try {
+        const pkg = createRequire(join(projectRoot, "package.json")).resolve("wrangler/package.json");
+        const schema = join(dirname(pkg), "config-schema.json");
+        return existsSync(schema) ? schema : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+const NO_COMPONENTS = "bascik-no-components";
+/**
+ * component-host.ts's exports for a site without components: nothing to
+ * render. Output scoping stays in runtime.ts, since page jobs carry a scope
+ * without any renderable manifest.
+ */
+const COMPONENT_HOST_STUB = "export const componentExecution = () => null;";
 export const build = async (context) => {
     const { graph, distDir, outDir, projectRoot, variant = "workers" } = context;
     if (variant !== "pages" && variant !== "workers") {
@@ -53,11 +113,30 @@ export const build = async (context) => {
     }
     const publicDir = join(outDir, "public");
     await mkdir(publicDir, { recursive: true });
+    // Discover authored user config and resolve worker name in priority order:
+    // 1. Environment variables (CLOUDFLARE_WORKER_NAME, WORKER_NAME, CF_PAGES_PROJECT_NAME)
+    // 2. Authored wrangler.jsonc / wrangler.json / wrangler.toml in project root
+    // 3. Project package.json "name"
+    // 4. Fallback to "bascik-site"
+    // The config is discovered even when the name comes from the
+    // environment: its other keys are carried into the generated config.
+    const workerConfig = variant === "workers"
+        ? await resolveWorkerName(projectRoot, await discoverWranglerConfig(projectRoot))
+        : undefined;
+    // The author asked for the Worker before every static file: it sends the
+    // static files' headers itself, so nothing is written into _headers for
+    // them (Cloudflare's rule and line limits no longer apply).
+    const workerFirst = variant === "workers" &&
+        runsWorkerFirst(workerConfig?.discoveredConfig?.values?.assets, graph.base);
     const collisions = detectControlCollisions(graph.publicFiles, variant);
     if (collisions.length)
         throw new Error(collisions.join("\n"));
+    // esbuild names importers by their real path: a project reached through
+    // a symlinked folder (macOS tmpdir, a linked workspace) is keyed and
+    // reported by it too, or no import chain would find its owner.
+    const realRoot = await realpath(projectRoot).catch(() => projectRoot);
     const owners = new Map();
-    const addOwner = (file, owner) => {
+    const addOwnerAt = (file, owner) => {
         let set = owners.get(file);
         if (!set) {
             set = new Set();
@@ -65,28 +144,72 @@ export const build = async (context) => {
         }
         set.add(owner);
     };
+    const addOwner = (file, owner) => {
+        addOwnerAt(file, owner);
+        let real = file;
+        try {
+            real = realpathSync(file);
+        }
+        catch {
+            // Not on disk (yet): only the spelling the graph gave is known.
+        }
+        if (real !== file)
+            addOwnerAt(real, owner);
+    };
+    // A dynamic /404 page already answers 404 from the worker. A static one is
+    // served by the asset layer, which answers 200 at its own URL.
+    const hasStaticNotFoundPage = graph.publicFiles.includes("404.html") && graph.pages["/404"] === undefined;
     const here = fileURLToPath(import.meta.url);
     const runtimeFile = resolve(here, `../runtime${here.endsWith(".ts") ? ".ts" : ".js"}`);
     const lines = [];
     lines.push(`import { createCloudflareWorker } from ${JSON.stringify(runtimeFile)};`);
+    const specifierOf = (job) => job.source.kind === "module" ? job.source.path : job.source.stagedPath;
+    // `outputScope` and `owner` are written only when given, so a site
+    // without component scripts emits the entry it always did. The owner goes
+    // with component jobs only: the Worker's log of a failing one names the
+    // component file from it, since the bundled stack never does.
+    const jobLiteral = (id, mode, outputScope, specifier, owner) => 
+    // codeql[js/bad-code-sanitization] Emits a standalone JS module (never inline HTML), and JSON.stringify yields valid JS string literals.
+    `${JSON.stringify(id)}: { id: ${JSON.stringify(id)}, mode: ${JSON.stringify(mode)}, ${outputScope ? `outputScope: ${JSON.stringify(outputScope)}, ` : ""}${owner ? `owner: ${JSON.stringify(owner)}, ` : ""}load: () => import(${JSON.stringify(specifier)}) }`;
+    // Request-time components (prompt 157): the manifest and the component
+    // scripts it names, emitted only when the manifest has a component the
+    // renderer can expand (the runtime's own predicate, so the bundle never
+    // carries a renderer the Worker would never call). A static site, or one
+    // whose components are all unsupported, keeps its entry byte for byte.
+    // The scripts are owned by their component file, so an unsupported import
+    // is reported there.
+    const components = manifestHasComponents(graph.components?.manifest)
+        ? graph.components
+        : undefined;
+    let manifestLiteral;
+    if (components) {
+        const manifestScopes = new Map();
+        for (const entry of Object.values(components.manifest.components))
+            for (const job of entry.jobs)
+                manifestScopes.set(job.id, job.outputScope);
+        const componentJobLiterals = [];
+        for (const [id, job] of Object.entries(components.jobs)) {
+            const specifier = specifierOf(job);
+            addOwner(specifier, job.owner);
+            componentJobLiterals.push(jobLiteral(id, job.mode, job.outputScope ?? manifestScopes.get(id), specifier, job.owner));
+        }
+        manifestLiteral = JSON.stringify(components.manifest);
+        lines.push(`const componentManifest = ${manifestLiteral};`);
+        lines.push(`const componentJobs = { ${componentJobLiterals.join(",\n  ")} };`);
+    }
     const pageLiterals = [];
-    for (const [httpPath, page] of Object.entries(graph.pages).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
+    for (const [httpPath, page] of Object.entries(graph.pages).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
         const jobLiterals = [];
         for (const [id, job] of Object.entries(page.jobs)) {
-            let specifier;
-            if (job.source.kind === "module") {
-                specifier = job.source.path;
-            }
-            else {
-                specifier = job.source.stagedPath;
-            }
+            const specifier = specifierOf(job);
             addOwner(specifier, job.owner);
-            jobLiterals.push(`${JSON.stringify(id)}: { id: ${JSON.stringify(id)}, mode: ${JSON.stringify(job.mode)}, load: () => import(${JSON.stringify(specifier)}) }`);
+            jobLiterals.push(jobLiteral(id, job.mode, job.outputScope, specifier));
         }
         pageLiterals.push(`${JSON.stringify(httpPath)}: { path: ${JSON.stringify(httpPath)}, is404: ${page.is404}, segments: ${JSON.stringify(page.segments)}, jobs: { ${jobLiterals.join(", ")} } }`);
     }
     const routeLiterals = graph.apiRoutes.map((r) => {
         addOwner(r.filePath, `API route ${r.path}`);
+        // codeql[js/bad-code-sanitization] Emits a standalone JS module (never inline HTML), and JSON.stringify yields valid JS string literals.
         return `{ path: ${JSON.stringify(r.path)}, filePath: ${JSON.stringify(relative(projectRoot, r.filePath).replace(/\\/g, "/"))}, paramNames: ${JSON.stringify(r.paramNames)}, isDynamic: ${r.isDynamic}, load: () => import(${JSON.stringify(r.filePath)}) }`;
     });
     lines.push(`const graph = {`);
@@ -97,129 +220,320 @@ export const build = async (context) => {
     lines.push(`  release: ${JSON.stringify(graph.release)},`);
     if (graph.custom500 !== undefined)
         lines.push(`  custom500: ${JSON.stringify(graph.custom500)},`);
+    if (hasStaticNotFoundPage)
+        lines.push(`  staticNotFoundPage: true,`);
     lines.push(`  pages: { ${pageLiterals.join(",\n    ")} },`);
     lines.push(`  apiRoutes: [ ${routeLiterals.join(",\n    ")} ],`);
+    if (components)
+        lines.push(`  components: { manifest: componentManifest, jobs: componentJobs },`);
+    // Opt-in contentSecurityPolicy: the policy and the hashes of the pages
+    // the Worker renders (static pages get _headers rules below, or, when the
+    // Worker runs first, theirs too).
+    const csp = graph.contentSecurityPolicy;
+    if (csp) {
+        const workerHashes = {};
+        const paths = [
+            ...Object.keys(graph.pages),
+            ...(workerFirst ? csp.staticRoutes : []),
+        ];
+        for (const path of paths)
+            if (csp.hashes[path])
+                workerHashes[path] = csp.hashes[path];
+        lines.push(`  contentSecurityPolicy: { policy: ${JSON.stringify(csp.policy)}, hashes: ${JSON.stringify(workerHashes)} },`);
+    }
+    if (workerFirst)
+        lines.push(`  assetHeaders: { cspRoutes: ${JSON.stringify(csp ? csp.staticRoutes : [])} },`);
+    // A static 404.html's policy goes into an exact-path _headers rule, which
+    // the asset layer matches on the request path: a miss for any other URL
+    // is answered with the page but without its policy. Only a Worker in front
+    // of every static file can send it there (runtime.ts, withAssetHeaders).
+    const staticNotFoundRoutes = (csp?.staticRoutes ?? []).filter((route) => route === "/404" || route.endsWith("/404"));
+    if (csp && !workerFirst && staticNotFoundRoutes.length)
+        context.log(`[bascik] --target cloudflare-${variant}: the Content-Security-Policy of the static 404 page ` +
+            `(${staticNotFoundRoutes.map((route) => withBasePath(route, graph.base)).join(", ")}) is sent at its own URL only. ` +
+            `Cloudflare's _headers rules match the request path, not the response status, so a 404 for any other URL ` +
+            `is served with the page but without its policy. ` +
+            (variant === "workers"
+                ? `Set "assets": { "run_worker_first": true } in your wrangler config to have the Worker send it on every 404.`
+                : `Cloudflare Pages cannot run the Worker before static files: build with --target cloudflare-workers and ` +
+                    `"assets": { "run_worker_first": true } to send it on every 404.`));
+    // The build's security headers, dotfile rule, ANSI handling and render
+    // limits (Collin 2026-10-29): the Worker has no config of its own, so it
+    // applies what the build resolved. A graph without them is today's Worker.
+    // codeql[js/bad-code-sanitization] Emits a standalone JS module (never inline HTML), and JSON.stringify yields valid JS literals.
+    if (graph.responseSecurity !== undefined)
+        lines.push(`  responseSecurity: ${JSON.stringify(graph.responseSecurity)},`);
+    if (graph.hideDotfiles !== undefined)
+        lines.push(`  hideDotfiles: ${graph.hideDotfiles === false ? "false" : "true"},`);
+    if (graph.stripAnsi !== undefined)
+        lines.push(`  stripAnsi: ${graph.stripAnsi === false ? "false" : "true"},`);
+    if (graph.renderLimits !== undefined)
+        lines.push(`  renderLimits: ${JSON.stringify(graph.renderLimits)},`);
     lines.push(`};`);
     lines.push(`export default createCloudflareWorker(graph);`);
+    const invocationRoutes = buildInvocationRoutes({
+        base: graph.base,
+        dynamicPagePaths: Object.keys(graph.pages),
+        hasApiRoutes: graph.apiRoutes.length > 0,
+        hasStaticNotFoundPage,
+    });
+    // The Workers variant's config is generated before bundling: node:*
+    // imports are checked against the compatibility date and flags it deploys
+    // with (the authored ones when set), not only the adapter's pinned date.
+    // Pages takes them from the Pages project's settings, which the adapter
+    // cannot read: the pinned ones are what the docs tell you to set there.
+    const pinned = {
+        compatibilityDate: CLOUDFLARE_COMPATIBILITY_DATE,
+        compatibilityFlags: CLOUDFLARE_COMPATIBILITY_FLAGS,
+    };
+    let wrangler;
+    let deploymentCompat = [pinned];
+    if (variant === "workers") {
+        const { workerName, discoveredConfig } = workerConfig ?? (await resolveWorkerName(projectRoot));
+        // The authored config is carried over whole: the adapter owns only the
+        // keys it must (config.ts, generateWranglerConfig).
+        const generated = generateWranglerConfig({
+            authored: discoveredConfig,
+            projectRoot,
+            outDir,
+            workerName,
+            runWorkerFirst: workerFirst ? true : invocationRoutes.include,
+            schemaPath: wranglerSchemaPath(projectRoot),
+            compatibilityDate: CLOUDFLARE_COMPATIBILITY_DATE,
+            compatibilityFlags: CLOUDFLARE_COMPATIBILITY_FLAGS,
+        });
+        wrangler = generated.config;
+        for (const warning of generated.warnings)
+            context.log(warning);
+        deploymentCompat = deploymentCompatSettings(wrangler, discoveredConfig?.filename, pinned);
+    }
     const stagingDir = join(outDir, ".staging");
     await mkdir(stagingDir, { recursive: true });
     const entryPath = join(stagingDir, "worker-entry.mjs");
     await writeFile(entryPath, lines.join("\n"), "utf8");
     // Bundle with esbuild owned by this adapter
     const unsupported = [];
-    const result = await esbuildBuild({
-        entryPoints: [entryPath],
-        bundle: true,
-        write: false,
-        format: "esm",
-        platform: "neutral",
-        target: "es2022",
-        mainFields: ["workerd", "worker", "browser", "module", "main"],
-        conditions: ["workerd", "worker", "browser", "import", "module", "default"],
-        logLevel: "silent",
-        metafile: true,
-        absWorkingDir: projectRoot,
-        plugins: [
-            {
-                name: "bascik-request-time-graph",
-                setup(buildInstance) {
-                    buildInstance.onResolve({ filter: /^@\// }, (args) => ({
-                        errors: [
-                            {
-                                text: `"${args.path}" cannot be resolved from a module file. The @/ alias is available inside ` +
-                                    `<script> blocks only; in ${relative(projectRoot, args.importer).replace(/\\/g, "/")} use a relative import.`,
-                            },
-                        ],
-                    }));
-                    buildInstance.onResolve({ filter: /^file:/ }, (args) => {
-                        const resolved = fileURLToPath(args.path);
-                        for (const owner of owners.get(args.importer) ?? [])
-                            addOwner(resolved, owner);
-                        return { path: resolved };
-                    });
-                    buildInstance.onResolve({ filter: /^\.\.?\// }, (args) => {
-                        const resolved = resolve(dirname(args.importer), args.path);
-                        for (const owner of owners.get(args.importer) ?? [])
-                            addOwner(resolved, owner);
-                        return undefined;
-                    });
-                    buildInstance.onResolve({ filter: /^(node:)?[a-z_/]+$/ }, (args) => {
-                        const kind = classifyNodeBuiltin(args.path);
-                        if (kind === "not-builtin")
+    // esbuild rejects when a build has errors (a missing import, a syntax
+    // error past the core's checks): its own message names only the staging
+    // path, so the errors are formatted here with the authored owner.
+    const bundlingFailed = (errors) => new Error(`[bascik] --target cloudflare-${variant}: bundling failed:\n${errors
+        .map((e) => {
+        const at = e.location
+            ? `${e.location.file}:${e.location.line}:${e.location.column}: `
+            : "";
+        const owned = e.location
+            ? owners.get(resolve(projectRoot, e.location.file))
+            : undefined;
+        const from = owned?.size
+            ? `\n    Reached from: ${[...owned].join(", ")}`
+            : "";
+        return `  ${at}${e.text}${from}`;
+    })
+        .join("\n")}`);
+    let result;
+    try {
+        result = await esbuildBuild({
+            entryPoints: [entryPath],
+            bundle: true,
+            write: false,
+            format: "esm",
+            platform: "neutral",
+            target: "es2022",
+            mainFields: ["workerd", "worker", "browser", "module", "main"],
+            conditions: [
+                "workerd",
+                "worker",
+                "browser",
+                "import",
+                "module",
+                "default",
+            ],
+            logLevel: "silent",
+            metafile: true,
+            absWorkingDir: projectRoot,
+            plugins: [
+                {
+                    name: "bascik-request-time-graph",
+                    setup(buildInstance) {
+                        // A site whose manifest has nothing to render never renders a
+                        // component, so its Worker gets a stub in place of the component
+                        // host (prompt 157): no renderer and no `node:crypto` in its
+                        // bundle. (Not byte for byte the bundle before prompt 157:
+                        // runtime.ts itself changed.)
+                        if (!components) {
+                            buildInstance.onResolve({ filter: /^\.\/component-host\.js$/ }, (args) => args.importer === runtimeFile
+                                ? { path: "component-host", namespace: NO_COMPONENTS }
+                                : undefined);
+                            buildInstance.onLoad({ filter: /.*/, namespace: NO_COMPONENTS }, () => ({ contents: COMPONENT_HOST_STUB, loader: "js" }));
+                        }
+                        buildInstance.onResolve({ filter: /^@\// }, (args) => ({
+                            errors: [
+                                {
+                                    text: `"${args.path}" cannot be resolved from a module file. The @/ alias is available inside ` +
+                                        `<script> blocks only; in ${relative(realRoot, args.importer).replace(/\\/g, "/")} use a relative import.`,
+                                },
+                            ],
+                        }));
+                        buildInstance.onResolve({ filter: /^file:/ }, (args) => {
+                            const resolved = fileURLToPath(args.path);
+                            for (const owner of owners.get(args.importer) ?? [])
+                                addOwner(resolved, owner);
+                            return { path: resolved };
+                        });
+                        buildInstance.onResolve({ filter: /^\.\.?\// }, (args) => {
+                            const resolved = resolve(dirname(args.importer), args.path);
+                            for (const owner of owners.get(args.importer) ?? [])
+                                addOwner(resolved, owner);
                             return undefined;
-                        if (kind === "provided")
-                            return { path: args.path.startsWith("node:") ? args.path : `node:${args.path}`, external: true };
-                        const ownerList = [...(owners.get(args.importer) ?? [])];
-                        unsupported.push(formatUnsupportedImport({ specifier: args.path, importer: args.importer, projectRoot, owners: ownerList }));
-                        return { path: args.path, external: true };
-                    });
+                        });
+                        // Digits too: `node:http2` and `v8` are builtins, and esbuild's
+                        // own error for them would suggest `platform: "node"`.
+                        buildInstance.onResolve({ filter: /^(node:)?[a-z0-9_/]+$/ }, (args) => {
+                            if (classifyNodeBuiltin(args.path) === "not-builtin")
+                                return undefined;
+                            // Every deployment of the config (the top level and each
+                            // env.<name>) must provide it.
+                            const missingIn = deploymentCompat.find((compat) => classifyNodeBuiltin(args.path, compat) !== "provided");
+                            if (!missingIn)
+                                return {
+                                    path: args.path.startsWith("node:")
+                                        ? args.path
+                                        : `node:${args.path}`,
+                                    external: true,
+                                };
+                            const ownerList = [...(owners.get(args.importer) ?? [])];
+                            unsupported.push(formatUnsupportedImport({
+                                specifier: args.path,
+                                importer: args.importer,
+                                projectRoot: realRoot,
+                                owners: ownerList,
+                                compat: missingIn,
+                            }));
+                            return { path: args.path, external: true };
+                        });
+                    },
                 },
-            },
-        ],
-    });
+            ],
+        });
+    }
+    catch (err) {
+        // A failure to bundle (not a crash of esbuild itself) carries its errors.
+        const errors = err.errors;
+        if (!Array.isArray(errors) || !errors.length)
+            throw err;
+        // An unsupported builtin found on the way is reported too.
+        throw new Error([...new Set(unsupported), bundlingFailed(errors).message].join("\n"));
+    }
     if (unsupported.length)
         throw new Error([...new Set(unsupported)].join("\n"));
-    if (result.errors.length) {
-        throw new Error(`[bascik] --target cloudflare-${variant}: bundling failed:\n${result.errors.map((e) => `  ${e.location?.file ? `${e.location.file}: ` : ""}${e.text}`).join("\n")}`);
-    }
+    if (result.errors.length)
+        throw bundlingFailed(result.errors);
     const workerCode = result.outputFiles?.[0]?.text ?? "";
-    // Copy public files
+    // Copy public files. The asset layer maps a request URL straight to a file
+    // under public/, and every URL of a non-root base site carries the prefix,
+    // so assets are staged below it. Control files stay at the public root,
+    // where the platform reads them.
+    const assetRoot = graph.base && graph.base !== "/"
+        ? join(publicDir, ...graph.base.split("/").filter(Boolean))
+        : publicDir;
     for (const rel of graph.publicFiles) {
+        // Bascik's private build folder is never deployed, whatever the graph
+        // lists and however a case-insensitive filesystem spells it.
+        if (isBascikFolderName(rel.split("/")[0] ?? ""))
+            continue;
         const from = join(distDir, rel);
-        const to = join(publicDir, rel);
+        const to = join(ASSET_CONTROL_FILES.has(rel) ? publicDir : assetRoot, rel);
         if (!resolve(to).startsWith(publicDir + sep))
             continue;
         await mkdir(dirname(to), { recursive: true });
         await copyFile(from, to);
     }
-    const invocationRoutes = buildInvocationRoutes({
-        base: graph.base,
-        dynamicPagePaths: Object.keys(graph.pages),
-        hasApiRoutes: graph.apiRoutes.length > 0,
-    });
+    // Static files are served without the Worker: the security headers (one
+    // site-wide rule) and each static page's CSP header go into
+    // public/_headers, merged with the author's own rules (headers-file.ts).
+    // When the Worker runs first it sends them, and the file stays the author's.
+    {
+        const headersPath = join(publicDir, "_headers");
+        let authored = "";
+        try {
+            authored = await readFile(headersPath, "utf8");
+        }
+        catch {
+            authored = "";
+        }
+        if (!workerFirst) {
+            const text = buildHeadersFile({
+                authored,
+                security: graph.responseSecurity,
+                base: graph.base,
+                csp: csp
+                    ? {
+                        policy: csp.policy,
+                        hashes: csp.hashes,
+                        staticRoutes: csp.staticRoutes,
+                    }
+                    : undefined,
+                variant,
+            });
+            if (text !== "" && text !== authored)
+                await writeFile(headersPath, text, "utf8");
+        }
+        // _headers reaches static files only: say so where an author's rule
+        // would change a security header on a page the Worker renders.
+        for (const warning of workerPageHeaderOverrides({
+            authored,
+            security: graph.responseSecurity,
+            base: graph.base,
+            workerPages: Object.keys(graph.pages),
+        }))
+            context.log(warning);
+    }
     let workerPath;
     if (variant === "pages") {
         workerPath = join(publicDir, "_worker.js");
         await writeFile(workerPath, workerCode, "utf8");
-        await writeFile(join(publicDir, "_routes.json"), JSON.stringify({ version: 1, include: invocationRoutes.include, exclude: invocationRoutes.exclude }, null, 2), "utf8");
+        await writeFile(join(publicDir, "_routes.json"), JSON.stringify({
+            version: 1,
+            include: invocationRoutes.include,
+            exclude: invocationRoutes.exclude,
+        }, null, 2), "utf8");
     }
     else {
         workerPath = join(outDir, "worker.js");
         await writeFile(workerPath, workerCode, "utf8");
-        // Discover authored user config and resolve worker name in priority order:
-        // 1. Environment variables (CLOUDFLARE_WORKER_NAME, WORKER_NAME, CF_PAGES_PROJECT_NAME)
-        // 2. Authored wrangler.jsonc / wrangler.json / wrangler.toml in project root
-        // 3. Project package.json "name"
-        // 4. Fallback to "bascik-site"
-        const { workerName, discoveredConfig } = await resolveWorkerName(projectRoot);
-        const authoredFlags = Array.isArray(discoveredConfig?.values?.compatibility_flags)
-            ? discoveredConfig.values.compatibility_flags.filter((f) => typeof f === "string" && f.trim().length > 0)
-            : [];
-        const wrangler = {
-            $schema: "node_modules/wrangler/config-schema.json",
-            name: workerName,
-            main: "worker.js",
-            compatibility_date: discoveredConfig?.values?.compatibility_date ?? CLOUDFLARE_COMPATIBILITY_DATE,
-            compatibility_flags: [...new Set([...authoredFlags, ...CLOUDFLARE_COMPATIBILITY_FLAGS])],
-            assets: {
-                directory: "./public",
-                binding: "ASSETS",
-                not_found_handling: "404-page",
-                run_worker_first: invocationRoutes.include,
-            },
-        };
         await writeFile(join(outDir, "wrangler.jsonc"), `${JSON.stringify(wrangler, null, 2)}\n`, "utf8");
     }
     const bundleBytes = Buffer.byteLength(workerCode, "utf8");
+    // What the Worker deploys with: the generated config's top level for
+    // Workers (tools such as e2e/fixture/serve.ts read these notes), the
+    // pinned settings Pages projects are told to use.
+    const notes = [
+        `compatibility date: ${deploymentCompat[0].compatibilityDate}`,
+        `compatibility flags: ${deploymentCompat[0].compatibilityFlags.join(", ")}`,
+        workerFirst
+            ? "invocation routes: every request (run_worker_first: true); the Worker sends the static files' headers"
+            : `invocation routes: ${invocationRoutes.include.length} rules`,
+    ];
+    // Pages reads the compatibility date and flags from the project, not the
+    // upload, and `wrangler pages deploy` has no option for them: without
+    // nodejs_compat, every page routed to the Worker fails at request time.
+    if (variant === "pages")
+        notes.push(`Pages project settings: compatibility date ${CLOUDFLARE_COMPATIBILITY_DATE} or later and the ` +
+            `${CLOUDFLARE_COMPATIBILITY_FLAGS.join(", ")} flag, for Production and Preview. wrangler pages deploy ` +
+            `does not set them: set them in the Pages project's settings in the Cloudflare dashboard before the first deploy.`);
+    // The manifest is part of the bundle; its share of bundleBytes is shown so
+    // a growing component library is visible against the Worker size limit.
+    if (components && manifestLiteral !== undefined) {
+        const count = Object.keys(components.manifest.components).length;
+        notes.push(`component manifest: ${Buffer.byteLength(manifestLiteral, "utf8")} bytes (${count} ${count === 1 ? "component" : "components"})`);
+    }
     return {
         workerPath,
         publicDir,
         bundleBytes,
-        notes: [
-            `compatibility date: ${CLOUDFLARE_COMPATIBILITY_DATE}`,
-            `compatibility flags: ${CLOUDFLARE_COMPATIBILITY_FLAGS.join(", ")}`,
-            `invocation routes: ${invocationRoutes.include.length} rules`,
-        ],
+        notes,
+        // The runtime renders component tags in script output (prompt 157).
+        components: true,
     };
 };
 //# sourceMappingURL=build.js.map