@finesoft/front 0.1.47 → 0.1.49

package/dist/index.mjs

@@ -1,4 +1,3 @@
-import { n as parseAcceptLanguage } from "./locale-CvU-U6aP.mjs";
 import { Hono } from "hono";
 //#region ../core/src/actions/types.ts
 /**
@@ -38,22 +37,23 @@ function makeExternalUrlAction(url) {
 }
 //#endregion
 //#region ../core/src/actions/dispatcher.ts
+/** CompoundAction 最大递归展开深度 */
+const MAX_COMPOUND_DEPTH = 32;
 var ActionDispatcher = class {
 	handlers = /* @__PURE__ */ new Map();
-	wiredActions = /* @__PURE__ */ new Set();
 	/** 注册指定 kind 的 handler（防止重复注册） */
 	onAction(kind, handler) {
-		if (this.wiredActions.has(kind)) {
+		if (this.handlers.has(kind)) {
 			console.warn(`[ActionDispatcher] kind="${kind}" already registered, skipping`);
 			return;
 		}
-		this.wiredActions.add(kind);
 		this.handlers.set(kind, handler);
 	}
-	/** 执行一个 Action（CompoundAction 递归展开） */
-	async perform(action) {
+	/** 执行一个 Action（CompoundAction 递归展开，有深度限制） */
+	async perform(action, _depth = 0) {
 		if (isCompoundAction(action)) {
-			for (const subAction of action.actions) await this.perform(subAction);
+			if (_depth >= MAX_COMPOUND_DEPTH) throw new Error(`[ActionDispatcher] CompoundAction recursion depth exceeded (max ${MAX_COMPOUND_DEPTH})`);
+			for (const subAction of action.actions) await this.perform(subAction, _depth + 1);
 			return;
 		}
 		const handler = this.handlers.get(action.kind);
@@ -87,6 +87,7 @@ var IntentDispatcher = class {
 //#region ../core/src/dependencies/container.ts
 var Container = class {
 	registrations = /* @__PURE__ */ new Map();
+	resolutionStack = /* @__PURE__ */ new Set();
 	/** 注册依赖（默认单例） */
 	register(key, factory, singleton = true) {
 		this.registrations.set(key, {
@@ -100,7 +101,15 @@ var Container = class {
 		const reg = this.registrations.get(key);
 		if (!reg) throw new Error(`[Container] No registration for key: "${key}"`);
 		if (reg.singleton) {
-			if (reg.instance === void 0) reg.instance = reg.factory();
+			if (reg.instance === void 0) {
+				if (this.resolutionStack.has(key)) throw new Error(`[Container] Circular dependency detected: ${[...this.resolutionStack, key].join(" → ")}`);
+				this.resolutionStack.add(key);
+				try {
+					reg.instance = reg.factory();
+				} finally {
+					this.resolutionStack.delete(key);
+				}
+			}
 			return reg.instance;
 		}
 		return reg.factory();
@@ -212,20 +221,11 @@ const DEP_KEYS = {
 	LOGGER: "logger",
 	LOGGER_FACTORY: "loggerFactory",
 	NET: "net",
-	LOCALE: "locale",
 	STORAGE: "storage",
 	FEATURE_FLAGS: "featureFlags",
 	METRICS: "metrics",
 	FETCH: "fetch"
 };
-var DefaultLocale = class {
-	language = "en";
-	storefront = "us";
-	setActiveLocale(language, storefront) {
-		this.language = language;
-		this.storefront = storefront;
-	}
-};
 var MemoryStorage = class {
 	store = /* @__PURE__ */ new Map();
 	get(key) {
@@ -264,16 +264,11 @@ var ConsoleMetrics = class {
 	}
 };
 function makeDependencies(container, options = {}) {
-	const { fetch: fetchFn = globalThis.fetch?.bind(globalThis), language = "en", storefront = "us", featureFlags = {} } = options;
+	const { fetch: fetchFn = globalThis.fetch?.bind(globalThis), featureFlags = {} } = options;
 	const loggerFactory = new ConsoleLoggerFactory();
 	container.register(DEP_KEYS.LOGGER_FACTORY, () => loggerFactory);
 	container.register(DEP_KEYS.LOGGER, () => loggerFactory.loggerFor("framework"));
 	container.register(DEP_KEYS.NET, () => ({ fetch: (url, opts) => fetchFn(url, opts) }));
-	container.register(DEP_KEYS.LOCALE, () => {
-		const locale = new DefaultLocale();
-		locale.setActiveLocale(language, storefront);
-		return locale;
-	});
 	container.register(DEP_KEYS.STORAGE, () => new MemoryStorage());
 	container.register(DEP_KEYS.FEATURE_FLAGS, () => new DefaultFeatureFlags(featureFlags));
 	container.register(DEP_KEYS.METRICS, () => new ConsoleMetrics());
@@ -293,6 +288,7 @@ var Router = class {
 		const regexStr = pattern.split(/(\/:[\w]+\??)/).map((segment) => {
 			const paramMatch = segment.match(/^\/:(\w+)(\?)?$/);
 			if (paramMatch) {
+				if (paramNames.includes(paramMatch[1])) throw new Error(`[Router] Duplicate parameter name ":${paramMatch[1]}" in pattern "${pattern}"`);
 				paramNames.push(paramMatch[1]);
 				return paramMatch[2] ? "(?:/([^/]+))?" : "/([^/]+)";
 			}
@@ -311,8 +307,7 @@ var Router = class {
 	}
 	/** 解析 URL → RouteMatch */
 	resolve(urlOrPath) {
-		const path = this.extractPath(urlOrPath);
-		const queryParams = this.extractQueryParams(urlOrPath);
+		const { path, queryParams } = this.parseUrl(urlOrPath);
 		for (const route of this.routes) {
 			const match = path.match(route.regex);
 			if (match) {
@@ -340,23 +335,22 @@ var Router = class {
 	getRoutes() {
 		return this.routes.map((r) => `${r.pattern} → ${r.intentId}`);
 	}
-	extractPath(url) {
-		try {
-			return new URL(url, "http://localhost").pathname;
-		} catch {
-			return url.split("?")[0].split("#")[0];
-		}
-	}
-	extractQueryParams(url) {
+	parseUrl(url) {
 		try {
 			const parsed = new URL(url, "http://localhost");
 			const params = {};
 			parsed.searchParams.forEach((v, k) => {
 				params[k] = v;
 			});
-			return params;
+			return {
+				path: parsed.pathname,
+				queryParams: params
+			};
 		} catch {
-			return {};
+			return {
+				path: url.split("?")[0].split("#")[0],
+				queryParams: {}
+			};
 		}
 	}
 };
@@ -416,14 +410,33 @@ async function runAfterLoadGuards(guards, ctx) {
 *
 * 用作缓存 key：相同内容的对象始终产生相同字符串。
 */
-function stableStringify(obj, _seen) {
+/** WeakMap 缓存已序列化的对象，避免重复计算 */
+const stringifyCache = /* @__PURE__ */ new WeakMap();
+/** 最大递归深度 */
+const MAX_DEPTH = 50;
+function stableStringify(obj, _seen, _depth) {
 	if (obj === null || obj === void 0) return String(obj);
 	if (typeof obj !== "object") return JSON.stringify(obj);
+	const cached = stringifyCache.get(obj);
+	if (cached !== void 0) return cached;
+	const depth = _depth ?? 0;
+	if (depth > MAX_DEPTH) return "\"[Max Depth]\"";
 	const seen = _seen ?? /* @__PURE__ */ new Set();
 	if (seen.has(obj)) return "\"[Circular]\"";
 	seen.add(obj);
-	if (Array.isArray(obj)) return "[" + obj.map((v) => stableStringify(v, seen)).join(",") + "]";
-	return "{" + Object.keys(obj).sort().filter((k) => obj[k] !== void 0).map((k) => JSON.stringify(k) + ":" + stableStringify(obj[k], seen)).join(",") + "}";
+	let result;
+	if (Array.isArray(obj)) result = "[" + obj.map((v) => stableStringify(v, seen, depth + 1)).join(",") + "]";
+	else {
+		const keys = Object.keys(obj).sort();
+		const parts = [];
+		for (const k of keys) {
+			const v = obj[k];
+			if (v !== void 0) parts.push(JSON.stringify(k) + ":" + stableStringify(v, seen, depth + 1));
+		}
+		result = "{" + parts.join(",") + "}";
+	}
+	stringifyCache.set(obj, result);
+	return result;
 }
 //#endregion
 //#region ../core/src/prefetched-intents/prefetched-intents.ts
@@ -482,6 +495,7 @@ var Framework = class Framework {
 	prefetchedIntents;
 	beforeGuards = [];
 	afterGuards = [];
+	_logger;
 	constructor(container, prefetchedIntents) {
 		this.container = container;
 		this.intentDispatcher = new IntentDispatcher();
@@ -497,9 +511,12 @@ var Framework = class Framework {
 		config.setupRoutes?.(fw.router);
 		return fw;
 	}
+	getLogger() {
+		return this._logger ??= this.container.resolve(DEP_KEYS.LOGGER);
+	}
 	/** 分发 Intent — 获取页面数据 */
 	async dispatch(intent) {
-		const logger = this.container.resolve(DEP_KEYS.LOGGER);
+		const logger = this.getLogger();
 		const cached = this.prefetchedIntents.get(intent);
 		if (cached !== void 0) {
 			logger.debug(`[Framework] re-using prefetched intent response for: ${intent.id}`, intent.params);
@@ -510,7 +527,7 @@ var Framework = class Framework {
 	}
 	/** 执行 Action — 处理用户交互 */
 	async perform(action) {
-		this.container.resolve(DEP_KEYS.LOGGER).debug(`[Framework] perform action: ${action.kind}`);
+		this.getLogger().debug(`[Framework] perform action: ${action.kind}`);
 		return this.actionDispatcher.perform(action);
 	}
 	/** 路由 URL — 将 URL 解析为 Intent + Action */
@@ -645,7 +662,12 @@ var HttpClient = class {
 			const body = await response.text().catch(() => void 0);
 			throw new HttpError(response.status, response.statusText, body);
 		}
-		return response.json();
+		try {
+			return await response.json();
+		} catch (e) {
+			if (e instanceof SyntaxError) throw new HttpError(response.status, "Invalid JSON response", await response.text().catch(() => void 0));
+			throw e;
+		}
 	}
 	/** 构建完整 URL — 子类可覆写以自定义 URL 拼接逻辑 */
 	buildUrl(path, params) {
@@ -771,6 +793,7 @@ var LruMap = class {
 	map = /* @__PURE__ */ new Map();
 	capacity;
 	constructor(capacity) {
+		if (capacity < 1) throw new Error(`[LruMap] capacity must be >= 1, got ${capacity}`);
 		this.capacity = capacity;
 	}
 	get(key) {
@@ -1300,17 +1323,15 @@ function createPrefetchedIntentsFromDom() {
 * 自动执行 hydration 全流程。
 */
 async function startBrowserApp(config) {
-	const { bootstrap, defaultLocale = "en", mountId = "app", mount, callbacks } = config;
+	const { bootstrap, mountId = "app", mount, callbacks } = config;
 	const prefetchedIntents = createPrefetchedIntentsFromDom();
 	const framework = Framework.create({ prefetchedIntents });
 	bootstrap(framework);
 	const log = framework.container.resolve(DEP_KEYS.LOGGER_FACTORY).loggerFor("browser");
 	const initialAction = framework.routeUrl(window.location.pathname + window.location.search);
-	const locale = document.documentElement.lang || defaultLocale;
-	const updateApp = mount(document.getElementById(mountId), {
-		framework,
-		locale
-	});
+	const target = document.getElementById(mountId);
+	if (!target) throw new Error(`[startBrowserApp] Mount target not found: #${mountId}. Ensure your HTML has <div id="${mountId}"></div>.`);
+	const updateApp = mount(target, { framework });
 	registerActionHandlers({
 		framework,
 		log,
@@ -1393,7 +1414,8 @@ async function ssrRender(options) {
 			head: result.head,
 			css: result.css,
 			serverData,
-			renderMode: match?.renderMode
+			renderMode: match?.renderMode,
+			slots: result.slots
 		};
 	} finally {
 		framework.dispose();
@@ -1432,7 +1454,8 @@ async function handleMiddlewareResult(result, getErrorPage, renderApp, framework
 				html: rendered.html,
 				head: rendered.head,
 				css: rendered.css,
-				serverData: []
+				serverData: [],
+				slots: rendered.slots
 			};
 		}
 	}
@@ -1442,16 +1465,16 @@ async function handleMiddlewareResult(result, getErrorPage, renderApp, framework
 /**
 * 创建 render 函数
 *
-* @returns `render(url, locale, ssrContext?)` — 供 @finesoft/server SSRModule 使用
+* @returns `render(url, ssrContext?)` — 供 @finesoft/server SSRModule 使用
 */
 function createSSRRender(config) {
 	const { bootstrap, getErrorPage, renderApp, frameworkConfig } = config;
-	return (url, locale, ssrContext) => ssrRender({
+	return (url, ssrContext) => ssrRender({
 		url,
 		frameworkConfig: frameworkConfig ?? {},
 		bootstrap,
 		getErrorPage,
-		renderApp: (page) => renderApp(page, locale),
+		renderApp: (page) => renderApp(page),
 		ssrContext
 	});
 }
@@ -1462,22 +1485,28 @@ function createSSRRender(config) {
 */
 /** SSR HTML 模板占位符常量 */
 const SSR_PLACEHOLDERS = {
-	LANG: "<!--ssr-lang-->",
 	HEAD: "<!--ssr-head-->",
 	BODY: "<!--ssr-body-->",
 	DATA: "<!--ssr-data-->"
 };
+/** 匹配所有 <!--ssr-xxx--> 占位符（含内置与自定义） */
+const PLACEHOLDER_REGEX = /<!--ssr-([a-z][a-z0-9-]*)-->/g;
 function injectSSRContent(options) {
-	const { template, locale, head, css, html, serializedData } = options;
-	const cssTag = css ? `<style>${css}</style>` : "";
-	return template.replace(SSR_PLACEHOLDERS.LANG, locale).replace(SSR_PLACEHOLDERS.HEAD, `${head}\n${cssTag}`).replace(SSR_PLACEHOLDERS.BODY, html).replace(SSR_PLACEHOLDERS.DATA, `<script id="serialized-server-data" type="application/json">${serializedData}<\/script>`);
+	const { template, head, css, html, serializedData, slots } = options;
+	const replacements = {
+		head: `${head}\n${css ? `<style>${css}</style>` : ""}`,
+		body: html,
+		data: `<script id="serialized-server-data" type="application/json">${serializedData}<\/script>`,
+		...slots
+	};
+	return template.replace(PLACEHOLDER_REGEX, (_, name) => replacements[name] ?? "");
 }
 /**
-* CSR 空壳注入 — 只替换 lang，清空 body/head/data 占位符
+* CSR 空壳注入 — 清空所有占位符
 * 用于 renderMode === "csr" 的路由
 */
-function injectCSRShell(template, locale) {
-	return template.replace(SSR_PLACEHOLDERS.LANG, locale).replace(SSR_PLACEHOLDERS.HEAD, "").replace(SSR_PLACEHOLDERS.BODY, "").replace(SSR_PLACEHOLDERS.DATA, "");
+function injectCSRShell(template) {
+	return template.replace(PLACEHOLDER_REGEX, () => "");
 }
 //#endregion
 //#region ../ssr/src/server-data.ts
@@ -1517,12 +1546,23 @@ async function dynamicImport(specifier) {
 }
 //#endregion
 //#region ../server/src/proxy.ts
+/** 代理路径最大长度 */
+const MAX_PROXY_PATH_LENGTH = 2048;
+/** 代理响应最大体积（10 MB） */
+const MAX_RESPONSE_SIZE = 10 * 1024 * 1024;
 /**
-* 校验代理路径，防止 SSRF（协议相对 URL 绕过）。
+* 校验代理路径，防止 SSRF（协议相对 URL 绕过、编码绕过）。
 * 返回规范化的路径，或 null 表示非法。
 */
 function sanitizeProxyPath(raw) {
+	if (raw.length > MAX_PROXY_PATH_LENGTH) return null;
+	try {
+		if (decodeURIComponent(raw) !== raw) return null;
+	} catch {
+		return null;
+	}
 	if (raw.startsWith("//")) return null;
+	if (!/^[/\w.\-~%:@!$&'()*+,;=]*$/.test(raw)) return null;
 	return raw.startsWith("/") ? raw : `/${raw}`;
 }
 /**
@@ -1531,7 +1571,10 @@ function sanitizeProxyPath(raw) {
 */
 function validateConfig(config) {
 	if (!config.prefix.startsWith("/")) throw new Error(`[proxy] prefix must start with "/": "${config.prefix}"`);
-	if (!config.target.startsWith("https://")) throw new Error(`[proxy] target must use HTTPS: "${config.target}"`);
+	const isHttps = config.target.startsWith("https://");
+	const isHttp = config.target.startsWith("http://");
+	if (!isHttps && !isHttp) throw new Error(`[proxy] target must start with "https://" or "http://": "${config.target}"`);
+	if (isHttp) console.warn(`[proxy] ⚠ target "${config.target}" uses plain HTTP — traffic will not be encrypted. Use HTTPS in production to prevent data interception.`);
 }
 /**
 * 注册声明式代理路由到 Hono app（运行时使用：dev / preview / createServer）
@@ -1545,18 +1588,24 @@ function registerProxyRoutes(app, configs) {
 			const subPath = sanitizeProxyPath(c.req.path.replace(config.prefix, ""));
 			if (!subPath) return c.text("Invalid path", 400);
 			const targetUrl = new URL(subPath, config.target);
+			const expectedOrigin = new URL(config.target).origin;
+			if (targetUrl.origin !== expectedOrigin) return c.text("Invalid proxy target", 400);
 			new URL(c.req.url).searchParams.forEach((v, k) => targetUrl.searchParams.set(k, v));
 			const headers = { ...config.headers };
 			if (config.auth) {
-				const token = process.env[config.auth.envKey] ?? "";
-				if (token) headers.Authorization = config.auth.type === "bearer" ? `Bearer ${token}` : `Basic ${token}`;
+				const token = process.env[config.auth.envKey];
+				if (!token) console.warn(`[Proxy ${config.prefix}] Auth env var "${config.auth.envKey}" is not set`);
+				else headers.Authorization = config.auth.type === "bearer" ? `Bearer ${token}` : `Basic ${token}`;
 			}
 			try {
 				const resp = await fetch(targetUrl.toString(), {
 					headers,
 					redirect: config.followRedirects ? "follow" : "manual"
 				});
+				const contentLength = resp.headers.get("Content-Length");
+				if (contentLength && parseInt(contentLength, 10) > MAX_RESPONSE_SIZE) return c.text("Proxy response too large", 502);
 				const body = await resp.text();
+				if (body.length > MAX_RESPONSE_SIZE) return c.text("Proxy response too large", 502);
 				const respHeaders = { "Content-Type": resp.headers.get("Content-Type") ?? "application/json" };
 				if (config.cache) respHeaders["Cache-Control"] = config.cache;
 				return c.newResponse(body, resp.status, respHeaders);
@@ -1578,7 +1627,10 @@ function generateProxyCode(configs) {
 	blocks.push(`
 // ─── 框架声明式代理路由 ───
 function _sanitizeProxyPath(raw) {
+  if (raw.length > 2048) return null;
+  try { if (decodeURIComponent(raw) !== raw) return null; } catch { return null; }
   if (raw.startsWith("//")) return null;
+  if (!/^[/\\w.\\-~%:@!$&'()*+,;=]*$/.test(raw)) return null;
   return raw.startsWith("/") ? raw : "/" + raw;
 }
 `);
@@ -1596,6 +1648,7 @@ function _sanitizeProxyPath(raw) {
   const _sub = _sanitizeProxyPath(c.req.path.replace(${JSON.stringify(config.prefix)}, ""));
   if (!_sub) return c.text("Invalid path", 400);
   const _target = new URL(_sub, ${JSON.stringify(config.target)});
+  if (_target.origin !== ${JSON.stringify(new URL(config.target).origin)}) return c.text("Invalid proxy target", 400);
   const _reqUrl = new URL(c.req.url);
   _reqUrl.searchParams.forEach((v, k) => _target.searchParams.set(k, v));
   const _headers = ${headersJson};${authCode}
@@ -1656,14 +1709,12 @@ const NODE_BUILTINS = [
 /**
 * 生成 SSR serverless/edge 入口源码
 *
-* 内联 parseAcceptLanguage / injectSSR 以避免
+* 内联 injectSSR 以避免
 * @finesoft/front → @finesoft/server → vite-plugin → import("vite") 依赖链。
 */
 function generateSSREntry(ctx, opts) {
 	const setupImport = ctx.setupPath ? `import _setupDefault from "./${ctx.setupPath}";` : ``;
 	const setupCall = ctx.setupPath ? `if (typeof _setupDefault === "function") await _setupDefault(app);` : ``;
-	const locales = JSON.stringify(ctx.locales);
-	const defaultLocale = JSON.stringify(ctx.defaultLocale);
 	const renderModes = JSON.stringify(ctx.renderModes ?? {});
 	const cacheImpl = opts.platformCache ? opts.platformCache : `
 const ISR_CACHE_MAX = 1000;
@@ -1685,38 +1736,23 @@ import { render, serializeServerData } from "./${ctx.ssrEntry}";
 ${setupImport}
 
 const TEMPLATE = ${JSON.stringify(ctx.templateHtml)};
-const LOCALES = ${locales};
-const DEFAULT_LOCALE = ${defaultLocale};
 const RENDER_MODES = ${renderModes};
 ${cacheImpl}
 
-function parseAcceptLanguage(header) {
-  if (!header) return DEFAULT_LOCALE;
-  const langs = header.split(",").map(p => {
-    const [l, q] = p.trim().split(";q=");
-    return { l: l.trim().toLowerCase(), q: q ? (+q || 0) : 1 };
-  }).sort((a, b) => b.q - a.q);
-  for (const { l } of langs) {
-    const prefix = l.split("-")[0];
-    if (LOCALES.includes(prefix)) return prefix;
-  }
-  return DEFAULT_LOCALE;
-}
-
-function injectSSR(t, locale, head, css, html, data) {
+function injectSSR(t, head, css, html, data) {
   return t
-    .replace("<!--ssr-lang-->", locale)
-    .replace("<!--ssr-head-->", head + "\\n<style>" + css + "</style>")
-    .replace("<!--ssr-body-->", html)
-    .replace("<!--ssr-data-->", '<script id="serialized-server-data" type="application/json">' + data + "<\/script>");
+    .replace(/<!--ssr-([a-z][a-z0-9-]*)-->/g, (_, name) => {
+      const replacements = {
+        head: head + "\\n<style>" + css + "</style>",
+        body: html,
+        data: '<script id="serialized-server-data" type="application/json">' + data + "<\/script>",
+      };
+      return replacements[name] ?? "";
+    });
 }
 
-function injectCSRShell(t, locale) {
-  return t
-    .replace("<!--ssr-lang-->", locale)
-    .replace("<!--ssr-head-->", "")
-    .replace("<!--ssr-body-->", "")
-    .replace("<!--ssr-data-->", "");
+function injectCSRShell(t) {
+  return t.replace(/<!--ssr-([a-z][a-z0-9-]*)-->/g, () => "");
 }
 
 function matchRenderMode(url) {
@@ -1762,32 +1798,29 @@ app.get("*", async (c) => {
 
   const url = c.req.path + (c.req.url.includes("?") ? "?" + c.req.url.split("?")[1] : "");
   try {
-    const locale = parseAcceptLanguage(c.req.header("accept-language"));
-
     // Vite 配置级别覆盖: CSR 直接返回空壳
     const overrideMode = matchRenderMode(url);
     if (overrideMode === "csr") {
-      return c.html(injectCSRShell(TEMPLATE, locale));
+      return c.html(injectCSRShell(TEMPLATE));
     }
 
-    // ISR 缓存命中（key 含 locale，避免跨语言缓存污染）
-    const _cacheKey = locale + ":" + url;
-    const cached = await platformCacheGet(_cacheKey);
+    // ISR 缓存命中
+    const cached = await platformCacheGet(url);
     if (cached) return c.html(cached);
 
-    const { html: appHtml, head, css, serverData, renderMode } = await render(url, locale, { fetch: _createInternalFetch(_ssrDepth + 1) });
+    const { html: appHtml, head, css, serverData, renderMode } = await render(url, { fetch: _createInternalFetch(_ssrDepth + 1) });
 
     // 路由级 CSR
     if (renderMode === "csr") {
-      return c.html(injectCSRShell(TEMPLATE, locale));
+      return c.html(injectCSRShell(TEMPLATE));
     }
 
     const serializedData = serializeServerData(serverData);
-    const finalHtml = injectSSR(TEMPLATE, locale, head, css, appHtml, serializedData);
+    const finalHtml = injectSSR(TEMPLATE, head, css, appHtml, serializedData);
 
     // Prerender ISR 缓存（包括 Vite 配置覆盖和路由级）
     if (renderMode === "prerender" || overrideMode === "prerender") {
-      await platformCacheSet(_cacheKey, finalHtml);
+      await platformCacheSet(url, finalHtml);
       ${opts.platformPrerenderResponseHook ?? ""}
     }
 
@@ -1863,21 +1896,24 @@ async function prerenderRoutes(ctx) {
 	const ssrPath = pathToFileURL(path.resolve(root, "dist/server/ssr.js")).href;
 	const ssrModule = await dynamicImport(ssrPath);
 	const results = [];
-	for (const routePath of prerenderPaths) for (const locale of ctx.locales) {
-		const url = locale === ctx.defaultLocale ? routePath : `/${locale}${routePath === "/" ? "" : routePath}`;
-		try {
-			const { html: appHtml, head, css, serverData } = await ssrModule.render(url, locale);
-			const serializedData = ssrModule.serializeServerData(serverData);
-			const finalHtml = ctx.templateHtml.replace("<!--ssr-lang-->", locale).replace("<!--ssr-head-->", head + "\n<style>" + css + "</style>").replace("<!--ssr-body-->", appHtml).replace("<!--ssr-data-->", "<script id=\"serialized-server-data\" type=\"application/json\">" + serializedData + "<\/script>");
-			results.push({
-				url,
-				html: finalHtml
-			});
-		} catch (e) {
-			console.warn(`  [prerender] Failed to render ${url}:`, e);
-		}
+	for (const url of prerenderPaths) try {
+		const { html: appHtml, head, css, serverData } = await ssrModule.render(url);
+		const serializedData = ssrModule.serializeServerData(serverData);
+		const finalHtml = ctx.templateHtml.replace(/<!--ssr-([a-z][a-z0-9-]*)-->/g, (_match, name) => {
+			return {
+				head: head + "\n<style>" + css + "</style>",
+				body: appHtml,
+				data: "<script id=\"serialized-server-data\" type=\"application/json\">" + serializedData + "<\/script>"
+			}[name] ?? "";
+		});
+		results.push({
+			url,
+			html: finalHtml
+		});
+	} catch (e) {
+		console.warn(`  [prerender] Failed to render ${url}:`, e);
 	}
-	if (results.length > 0) console.log(`  Pre-rendered ${results.length} pages (${prerenderPaths.size} routes × ${ctx.locales.length} locales)\n`);
+	if (results.length > 0) console.log(`  Pre-rendered ${results.length} pages (${prerenderPaths.size} routes)\n`);
 	return results;
 }
 //#endregion
@@ -2111,22 +2147,15 @@ function staticAdapter(opts = {}) {
 			const ssrModule = await dynamicImport(ssrPath);
 			ctx.copyStaticAssets(outputDir, { excludeHtml: true });
 			const { paths: routePaths, defs: routeDefs } = await extractRoutesWithModes(ctx, opts);
-			const allUrls = [];
-			for (const routePath of routePaths) for (const locale of ctx.locales) {
-				const url = locale === ctx.defaultLocale ? routePath : `/${locale}${routePath === "/" ? "" : routePath}`;
-				allUrls.push(url);
-			}
-			console.log(`  Pre-rendering ${allUrls.length} pages (${routePaths.length} routes × ${ctx.locales.length} locales)...\n`);
-			for (const url of allUrls) try {
-				const locale = inferLocale(url, ctx.locales, ctx.defaultLocale);
-				const routeDef = routeDefs.find((r) => r.path === stripLocalePrefix(url, ctx.locales));
-				const mode = resolveRenderMode(stripLocalePrefix(url, ctx.locales), routeDef?.renderMode, ctx.renderModes);
+			console.log(`  Pre-rendering ${routePaths.length} pages...\n`);
+			for (const url of routePaths) try {
+				const mode = resolveRenderMode(url, routeDefs.find((r) => r.path === url)?.renderMode, ctx.renderModes);
 				let finalHtml;
-				if (mode === "csr") finalHtml = injectCSRShellForStatic(ctx.templateHtml, locale);
+				if (mode === "csr") finalHtml = injectCSRShellForStatic(ctx.templateHtml);
 				else {
-					const { html: appHtml, head, css, serverData } = await ssrModule.render(url, locale);
+					const { html: appHtml, head, css, serverData } = await ssrModule.render(url);
 					const serializedData = ssrModule.serializeServerData(serverData);
-					finalHtml = injectSSRForStatic(ctx.templateHtml, locale, head, css, appHtml, serializedData);
+					finalHtml = injectSSRForStatic(ctx.templateHtml, head, css, appHtml, serializedData);
 				}
 				const filePath = url === "/" ? path.join(outputDir, "index.html") : path.join(outputDir, url, "index.html");
 				fs.mkdirSync(path.resolve(filePath, ".."), { recursive: true });
@@ -2181,28 +2210,19 @@ async function extractRoutesWithModes(ctx, opts) {
 		defs
 	};
 }
-/** 从 URL 推断 locale */
-function inferLocale(url, locales, defaultLocale) {
-	const segments = url.split("/").filter(Boolean);
-	if (segments.length > 0 && locales.includes(segments[0])) return segments[0];
-	return defaultLocale;
-}
-/** 内联 SSR 注入（同 shared 中的逻辑） */
-function injectSSRForStatic(template, locale, head, css, html, serializedData) {
-	return template.replace("<!--ssr-lang-->", locale).replace("<!--ssr-head-->", head + "\n<style>" + css + "</style>").replace("<!--ssr-body-->", html).replace("<!--ssr-data-->", "<script id=\"serialized-server-data\" type=\"application/json\">" + serializedData + "<\/script>");
+/** 内联 SSR 注入 */
+function injectSSRForStatic(template, head, css, html, serializedData) {
+	const PLACEHOLDER_REGEX = /<!--ssr-([a-z][a-z0-9-]*)-->/g;
+	const replacements = {
+		head: head + "\n<style>" + css + "</style>",
+		body: html,
+		data: "<script id=\"serialized-server-data\" type=\"application/json\">" + serializedData + "<\/script>"
+	};
+	return template.replace(PLACEHOLDER_REGEX, (_, name) => replacements[name] ?? "");
 }
 /** CSR 空壳注入 */
-function injectCSRShellForStatic(template, locale) {
-	return template.replace("<!--ssr-lang-->", locale).replace("<!--ssr-head-->", "").replace("<!--ssr-body-->", "").replace("<!--ssr-data-->", "");
-}
-/** 从 URL 去除 locale 前缀，还原路由路径 */
-function stripLocalePrefix(url, locales) {
-	const segments = url.split("/").filter(Boolean);
-	if (segments.length > 0 && locales.includes(segments[0])) {
-		const rest = segments.slice(1).join("/");
-		return rest ? `/${rest}` : "/";
-	}
-	return url;
+function injectCSRShellForStatic(template) {
+	return template.replace(/<!--ssr-([a-z][a-z0-9-]*)-->/g, () => "");
 }
 /** 解析最终渲染模式：Vite 配置覆盖 > 路由级 > 默认 "ssr" */
 function resolveRenderMode(routePath, routeRenderMode, renderModes) {
@@ -2402,7 +2422,7 @@ function matchRenderModeOverride(url, renderModes) {
 	return null;
 }
 function createSSRApp(options) {
-	const { root, vite, isProduction, ssrEntryPath = "/src/ssr.ts", ssrProductionModule, supportedLocales, defaultLocale, parentFetch, renderModes } = options;
+	const { root, vite, isProduction, ssrEntryPath = "/src/ssr.ts", ssrProductionModule, parentFetch, renderModes } = options;
 	const app = new Hono();
 	/** ISR 内存缓存（prerender 路由首次请求后缓存，LRU 驱逐） */
 	const ISR_CACHE_MAX = 1e3;
@@ -2446,28 +2466,28 @@ function createSSRApp(options) {
 		const url = c.req.path + (c.req.url.includes("?") ? "?" + c.req.url.split("?")[1] : "");
 		try {
 			const template = await readTemplate(url);
-			const { render, serializeServerData } = await loadSSRModule();
-			const locale = parseAcceptLanguage(c.req.header("accept-language"), supportedLocales, defaultLocale);
+			const ssrMod = await loadSSRModule();
+			if (typeof ssrMod.render !== "function" || typeof ssrMod.serializeServerData !== "function") throw new Error("[SSR] Module missing required exports: render, serializeServerData");
+			const { render, serializeServerData } = ssrMod;
 			const overrideMode = matchRenderModeOverride(url, renderModes);
-			if (overrideMode === "csr") return c.html(injectCSRShell(template, locale));
-			const cacheKey = `${locale}:${url}`;
-			const cached = isrCache.get(cacheKey);
+			if (overrideMode === "csr") return c.html(injectCSRShell(template));
+			const cached = isrCache.get(url);
 			if (cached) return c.html(cached);
 			const requestFetch = parentFetch ? createInternalFetch(parentFetch, ssrDepth + 1) : void 0;
 			const ssrContext = { request: c.req.raw };
 			if (requestFetch) ssrContext.fetch = requestFetch;
-			const { html: appHtml, head, css, serverData, renderMode, redirect: middlewareRedirect } = await render(url, locale, ssrContext);
+			const { html: appHtml, head, css, serverData, renderMode, redirect: middlewareRedirect, slots } = await render(url, ssrContext);
 			if (middlewareRedirect) return c.redirect(middlewareRedirect.url, middlewareRedirect.status);
-			if (renderMode === "csr") return c.html(injectCSRShell(template, locale));
+			if (renderMode === "csr") return c.html(injectCSRShell(template));
 			const finalHtml = injectSSRContent({
 				template,
-				locale,
 				head,
 				css,
 				html: appHtml,
-				serializedData: serializeServerData(serverData)
+				serializedData: serializeServerData(serverData),
+				slots
 			});
-			if (renderMode === "prerender" || overrideMode === "prerender") isrSet(cacheKey, finalHtml);
+			if (renderMode === "prerender" || overrideMode === "prerender") isrSet(url, finalHtml);
 			return c.html(finalHtml);
 		} catch (e) {
 			if (!isProduction && vite) vite.ssrFixStacktrace(e);
@@ -2517,7 +2537,7 @@ async function resolveRoot(importMetaUrl, levelsUp = 0) {
 * 支持 Node.js (dev HMR + prod)、Deno、Bun、Vercel。
 */
 async function startServer(options) {
-	const { app, root, port = 3e3, isProduction, vite, routes, locales, ssrEntryPath } = options;
+	const { app, root, port = 3e3, isProduction, vite, routes, ssrEntryPath } = options;
 	const { isDeno, isBun, isVercel } = options.runtime ?? detectRuntime();
 	function printStartupBanner() {
 		const lines = [`\n  Server running at http://localhost:${port}\n`];
@@ -2526,9 +2546,8 @@ async function startServer(options) {
 			for (const r of routes) lines.push(`    ${r}`);
 			lines.push("");
 		}
-		if (locales && locales.length > 0) lines.push(`  Locales: ${locales.join(", ")}`);
 		if (ssrEntryPath) lines.push(`  SSR Entry: ${ssrEntryPath}`);
-		if (locales?.length || ssrEntryPath) lines.push("");
+		if (ssrEntryPath) lines.push("");
 		console.log(lines.join("\n"));
 	}
 	if (isVercel) return { vite };
@@ -2587,21 +2606,22 @@ async function startServer(options) {
 * @example
 * ```ts
 * const { app } = await createServer({
-*   locales: ["zh", "en"],
 *   setup: (app) => registerProxies(app),
 * });
 * export { app };
 * ```
 */
 async function createServer(config = {}) {
-	const { root: rootOverride, locales, defaultLocale, port = Number(process.env.PORT) || 3e3, setup, proxies, ssr } = config;
+	const { root: rootOverride, port = Number(process.env.PORT) || 3e3, setup, proxies, ssr } = config;
 	const root = rootOverride ?? process.cwd();
 	const { existsSync } = await dynamicImport("node:fs");
 	const envPath = (await dynamicImport("node:path")).resolve(root, ".env");
 	if (existsSync(envPath)) try {
 		const { config: dotenvConfig } = await dynamicImport("dotenv");
 		dotenvConfig({ path: envPath });
-	} catch {}
+	} catch (e) {
+		console.warn(`[Server] Failed to load .env: ${e.message}`);
+	}
 	const runtime = detectRuntime();
 	let vite;
 	if (!runtime.isProduction && !runtime.isVercel) {
@@ -2619,8 +2639,6 @@ async function createServer(config = {}) {
 		root,
 		vite,
 		isProduction: runtime.isProduction,
-		supportedLocales: locales,
-		defaultLocale,
 		parentFetch: app.fetch.bind(app),
 		...ssr
 	});
@@ -2632,7 +2650,6 @@ async function createServer(config = {}) {
 		isProduction: runtime.isProduction,
 		vite,
 		runtime,
-		locales,
 		ssrEntryPath: ssr?.ssrEntryPath
 	});
 	return {
@@ -2642,6 +2659,35 @@ async function createServer(config = {}) {
 	};
 }
 //#endregion
+//#region ../server/src/locale.ts
+/**
+* Accept-Language 解析
+*/
+/** Accept-Language 头最大长度 */
+const MAX_HEADER_LENGTH = 1024;
+/** 最大解析语言条目数 */
+const MAX_LANG_ENTRIES = 50;
+function parseAcceptLanguage(header, supported, fallback) {
+	const effectiveSupported = supported ?? ["zh", "en"];
+	const effectiveFallback = fallback ?? effectiveSupported[0] ?? "en";
+	if (!header || header.length > MAX_HEADER_LENGTH) return effectiveFallback;
+	const parts = header.split(",");
+	if (parts.length > MAX_LANG_ENTRIES) return effectiveFallback;
+	const langs = parts.map((part) => {
+		const [lang, q] = part.trim().split(";q=");
+		const qVal = q ? parseFloat(q) : 1;
+		return {
+			lang: lang.trim().toLowerCase(),
+			q: Number.isFinite(qVal) && qVal >= 0 && qVal <= 1 ? qVal : 0
+		};
+	}).sort((a, b) => b.q - a.q);
+	for (const { lang } of langs) {
+		const prefix = lang.split("-")[0];
+		if (effectiveSupported.includes(prefix)) return prefix;
+	}
+	return effectiveFallback;
+}
+//#endregion
 //#region ../server/src/vite-plugin.ts
 /**
 * finesoftFrontViteConfig — Vite 插件
@@ -2711,11 +2757,12 @@ function finesoftFrontViteConfig(options = {}) {
 				}
 				const cssUrls = [];
 				const visited = /* @__PURE__ */ new Set();
-				function walk(mod) {
+				function walk(mod, depth = 0) {
+					if (depth > 100) return;
 					if (!mod?.url || visited.has(mod.url)) return;
 					visited.add(mod.url);
 					if (CSS_EXTENSIONS.test(mod.url) && !mod.url.includes(".svelte")) cssUrls.push(mod.url);
-					if (mod.importedModules) for (const imported of mod.importedModules) walk(imported);
+					if (mod.importedModules) for (const imported of mod.importedModules) walk(imported, depth + 1);
 				}
 				const browserMod = await server.moduleGraph.getModuleByUrl(browserEntry);
 				if (browserMod) walk(browserMod);
@@ -2749,8 +2796,6 @@ function finesoftFrontViteConfig(options = {}) {
 					vite: server,
 					isProduction: false,
 					ssrEntryPath: "/" + ssrEntry,
-					supportedLocales: options.locales,
-					defaultLocale: options.defaultLocale,
 					parentFetch: app.fetch.bind(app),
 					renderModes: options.renderModes
 				});
@@ -2767,10 +2812,17 @@ function finesoftFrontViteConfig(options = {}) {
 				const path = await dynamicImport("node:path");
 				const { pathToFileURL } = await dynamicImport("node:url");
 				const { Hono: HonoClass } = await dynamicImport("hono");
-				const { parseAcceptLanguage } = await import("./locale-CvU-U6aP.mjs").then((n) => n.t);
 				const { getRequestListener } = await dynamicImport("@hono/node-server");
 				const app = new HonoClass();
+				const ISR_CACHE_MAX = 1e3;
 				const isrCache = /* @__PURE__ */ new Map();
+				function isrSet(key, val) {
+					if (isrCache.size >= ISR_CACHE_MAX) {
+						const first = isrCache.keys().next().value;
+						if (first !== void 0) isrCache.delete(first);
+					}
+					isrCache.set(key, val);
+				}
 				if (options.proxies?.length) registerProxyRoutes(app, options.proxies);
 				if (typeof options.setup === "function") await options.setup(app);
 				else if (typeof options.setup === "string") try {
@@ -2788,23 +2840,20 @@ function finesoftFrontViteConfig(options = {}) {
 					if (ssrDepth >= 5) return c.text("SSR recursion loop detected", 508);
 					const url = c.req.path + (c.req.url.includes("?") ? "?" + c.req.url.split("?")[1] : "");
 					try {
-						const locale = parseAcceptLanguage(c.req.header("accept-language"), options.locales, options.defaultLocale);
 						const overrideMode = matchRenderModeConfig(url, options.renderModes);
-						if (overrideMode === "csr") return c.html(injectCSRShell(template, locale));
-						const cacheKey = `${locale}:${url}`;
-						const cached = isrCache.get(cacheKey);
+						if (overrideMode === "csr") return c.html(injectCSRShell(template));
+						const cached = isrCache.get(url);
 						if (cached) return c.html(cached);
-						const { html: appHtml, head, css, serverData, renderMode } = await ssrModule.render(url, locale, { fetch: createInternalFetch(app.fetch.bind(app), ssrDepth + 1) });
-						if (renderMode === "csr") return c.html(injectCSRShell(template, locale));
+						const { html: appHtml, head, css, serverData, renderMode } = await ssrModule.render(url, { fetch: createInternalFetch(app.fetch.bind(app), ssrDepth + 1) });
+						if (renderMode === "csr") return c.html(injectCSRShell(template));
 						const finalHtml = injectSSRContent({
 							template,
-							locale,
 							head,
 							css,
 							html: appHtml,
 							serializedData: ssrModule.serializeServerData(serverData)
 						});
-						if (renderMode === "prerender" || overrideMode === "prerender") isrCache.set(cacheKey, finalHtml);
+						if (renderMode === "prerender" || overrideMode === "prerender") isrSet(url, finalHtml);
 						return c.html(finalHtml);
 					} catch (e) {
 						console.error("[SSR Preview Error]", e);
@@ -2851,16 +2900,12 @@ function finesoftFrontViteConfig(options = {}) {
 				}
 				if (options.adapter) {
 					const adapter = resolveAdapter(options.adapter);
-					const locales = options.locales ?? ["zh", "en"];
-					const defaultLocale = options.defaultLocale ?? locales[0] ?? "en";
 					const templateHtml = fs.readFileSync(path.resolve(root, "dist/client/index.html"), "utf-8");
 					const ctx = {
 						root,
 						ssrEntry,
 						setupPath: typeof options.setup === "string" ? options.setup : void 0,
 						bootstrapEntry: options.bootstrapEntry,
-						locales,
-						defaultLocale,
 						templateHtml,
 						renderModes: options.renderModes,
 						proxies: options.proxies,