@finesoft/front 0.1.70 → 0.1.74

package/dist/index.d.mts

@@ -46,8 +46,16 @@ declare function makeExternalUrlAction(url: string): ExternalUrlAction;
 type ActionHandler<A extends Action = Action> = (action: A) => Promise<void> | void;
 declare class ActionDispatcher {
   private handlers;
-  /** 注册指定 kind 的 handler（防止重复注册） */
+  /**
+   * 注册指定 kind 的 handler。
+   *
+   * 重复 kind 时保留第一个注册者并发出警告——这是有意设计：
+   * framework 内部 handler 先注册，应用层意外覆盖会被记录而非静默生效。
+   * 如需显式替换，先调用 removeAction(kind)。
+   */
   onAction<A extends Action>(kind: string, handler: ActionHandler<A>): void;
+  /** 移除指定 kind 的 handler（用于显式覆盖场景） */
+  removeAction(kind: string): boolean;
   /** 执行一个 Action（CompoundAction 递归展开，有深度限制） */
   perform(action: Action, _depth?: number): Promise<void>;
 }
@@ -61,6 +69,7 @@ declare class Container {
   private registrations;
   private resolutionStack;
   private parent?;
+  private children;
   /** 注册依赖（默认单例） */
   register<T>(key: string, factory: Factory<T>, singleton?: boolean): this;
   /** 解析依赖 — 当前容器未注册时回退到 parent */
@@ -71,10 +80,17 @@ declare class Container {
    * 创建子容器（请求级 scope）
    *
    * 子容器可覆写父容器的依赖（如每请求的 locale、user），
-   * 未覆写的 key 自动回退到父容器解析。
+   * 未覆写的 key 自动回退到父容器解析。子容器会被父容器跟踪，
+   * 父容器 dispose 时一并销毁所有未独立 dispose 的子容器。
    */
   createScope(): Container;
-  /** 销毁容器，清除所有缓存 */
+  /**
+   * 销毁容器，清除所有缓存。
+   *
+   * - 递归 dispose 所有 createScope() 创建的未 dispose 子容器
+   * - 自身被 dispose 后从父容器移除引用，允许 GC
+   * - 重复 dispose 安全（幂等）
+   */
   dispose(): void;
 }
 //#endregion
@@ -604,7 +620,7 @@ interface BaseItem {
  *
  * 用作缓存 key：相同内容的对象始终产生相同字符串。
  */
-declare function stableStringify(obj: unknown, _seen?: Set<object>, _depth?: number): string;
+declare function stableStringify(obj: unknown): string;
 //#endregion
 //#region ../core/src/http/client.d.ts
 /**
@@ -1288,6 +1304,14 @@ interface SSRRenderResult {
     lang: string;
     dir: string;
   };
+  /** 中间件 deny 时的 HTTP 状态码（服务端应据此设置 response status） */
+  status?: number;
+  /**
+   * afterLoad rewrite 产生的内部 URL。
+   * 此时数据按原 URL 已加载，页面正常渲染——rewriteUrl 仅供 server 层
+   * 用于 canonical link / response header 等场景，**不会触发 HTTP 跳转**。
+   */
+  rewriteUrl?: string;
 }
 declare function ssrRender(options: SSRRenderOptions): Promise<SSRRenderResult>;
 //#endregion
@@ -1543,6 +1567,8 @@ interface SSRModule {
       lang: string;
       dir: string;
     };
+    status?: number; /** afterLoad rewrite 产生的内部 URL，仅供 server 用作 canonical link */
+    rewriteUrl?: string;
   }>;
   serializeServerData: (data: unknown) => string;
 }

package/dist/index.mjs

@@ -41,7 +41,13 @@ function makeExternalUrlAction(url) {
 const MAX_COMPOUND_DEPTH = 32;
 var ActionDispatcher = class {
 	handlers = /* @__PURE__ */ new Map();
-	/** 注册指定 kind 的 handler（防止重复注册） */
+	/**
+	* 注册指定 kind 的 handler。
+	*
+	* 重复 kind 时保留第一个注册者并发出警告——这是有意设计：
+	* framework 内部 handler 先注册，应用层意外覆盖会被记录而非静默生效。
+	* 如需显式替换，先调用 removeAction(kind)。
+	*/
 	onAction(kind, handler) {
 		if (this.handlers.has(kind)) {
 			console.warn(`[ActionDispatcher] kind="${kind}" already registered, skipping`);
@@ -49,6 +55,10 @@ var ActionDispatcher = class {
 		}
 		this.handlers.set(kind, handler);
 	}
+	/** 移除指定 kind 的 handler（用于显式覆盖场景） */
+	removeAction(kind) {
+		return this.handlers.delete(kind);
+	}
 	/** 执行一个 Action（CompoundAction 递归展开，有深度限制） */
 	async perform(action, _depth = 0) {
 		if (isCompoundAction(action)) {
@@ -89,6 +99,7 @@ var Container = class Container {
 	registrations = /* @__PURE__ */ new Map();
 	resolutionStack = /* @__PURE__ */ new Set();
 	parent;
+	children = /* @__PURE__ */ new Set();
 	/** 注册依赖（默认单例） */
 	register(key, factory, singleton = true) {
 		this.registrations.set(key, {
@@ -126,17 +137,32 @@ var Container = class Container {
 	* 创建子容器（请求级 scope）
 	*
 	* 子容器可覆写父容器的依赖（如每请求的 locale、user），
-	* 未覆写的 key 自动回退到父容器解析。
+	* 未覆写的 key 自动回退到父容器解析。子容器会被父容器跟踪，
+	* 父容器 dispose 时一并销毁所有未独立 dispose 的子容器。
 	*/
 	createScope() {
 		const child = new Container();
 		child.parent = this;
+		this.children.add(child);
 		return child;
 	}
-	/** 销毁容器，清除所有缓存 */
+	/**
+	* 销毁容器，清除所有缓存。
+	*
+	* - 递归 dispose 所有 createScope() 创建的未 dispose 子容器
+	* - 自身被 dispose 后从父容器移除引用，允许 GC
+	* - 重复 dispose 安全（幂等）
+	*/
 	dispose() {
+		const childSnapshot = Array.from(this.children);
+		for (const child of childSnapshot) child.dispose();
+		this.children.clear();
 		for (const reg of this.registrations.values()) reg.instance = void 0;
 		this.registrations.clear();
+		if (this.parent) {
+			this.parent.children.delete(this);
+			this.parent = void 0;
+		}
 	}
 };
 //#endregion
@@ -505,7 +531,12 @@ var ReportingLogger = class extends BaseLogger {
 		return "";
 	}
 	maybeReport(level, args) {
-		if (LEVEL_PRIORITY[level] >= this.minPriority) this.report(level, this.category, args);
+		if (LEVEL_PRIORITY[level] < this.minPriority) return;
+		try {
+			this.report(level, this.category, args);
+		} catch (e) {
+			console.error("[ReportingLogger] report callback threw:", e);
+		}
 	}
 };
 var ReportingLoggerFactory = class {
@@ -679,6 +710,9 @@ function makeDependencies(container, options = {}) {
 /**
 * URL 路由器 — URL pattern → Intent + FlowAction
 */
+function createNullPrototypeRecord(source) {
+	return Object.assign(Object.create(null), source);
+}
 var Router = class {
 	routes = [];
 	/** 添加路由规则 */
@@ -711,12 +745,11 @@ var Router = class {
 		for (const route of this.routes) {
 			const match = path.match(route.regex);
 			if (match) {
-				const params = Object.create(null);
+				const params = createNullPrototypeRecord(queryParams);
 				route.paramNames.forEach((name, index) => {
 					const value = match[index + 1];
 					if (value) params[name] = value;
 				});
-				for (const [k, v] of Object.entries(queryParams)) if (!(k in params)) params[k] = v;
 				return {
 					intent: {
 						id: route.intentId,
@@ -738,10 +771,7 @@ var Router = class {
 	parseUrl(url) {
 		try {
 			const parsed = new URL(url, "http://localhost");
-			const params = Object.create(null);
-			parsed.searchParams.forEach((v, k) => {
-				params[k] = v;
-			});
+			const params = createNullPrototypeRecord(Object.fromEntries(parsed.searchParams));
 			return {
 				path: parsed.pathname,
 				queryParams: params
@@ -749,7 +779,7 @@ var Router = class {
 		} catch {
 			return {
 				path: url.split("?")[0].split("#")[0],
-				queryParams: Object.create(null)
+				queryParams: createNullPrototypeRecord()
 			};
 		}
 	}
@@ -783,29 +813,34 @@ async function runAfterLoadGuards(guards, ctx) {
 const stringifyCache = /* @__PURE__ */ new WeakMap();
 /** 最大递归深度 */
 const MAX_DEPTH = 50;
-function stableStringify(obj, _seen, _depth) {
+function stableStringify(obj) {
+	return stringifyWithContext(obj, /* @__PURE__ */ new Set(), 0);
+}
+function stringifyWithContext(obj, seen, depth) {
 	if (obj === null || obj === void 0) return String(obj);
 	if (typeof obj !== "object") return JSON.stringify(obj);
 	const cached = stringifyCache.get(obj);
 	if (cached !== void 0) return cached;
-	const depth = _depth ?? 0;
 	if (depth > MAX_DEPTH) return "\"[Max Depth]\"";
-	const seen = _seen ?? /* @__PURE__ */ new Set();
 	if (seen.has(obj)) return "\"[Circular]\"";
 	seen.add(obj);
-	let result;
-	if (Array.isArray(obj)) result = "[" + obj.map((v) => stableStringify(v, seen, depth + 1)).join(",") + "]";
-	else {
-		const keys = Object.keys(obj).sort();
-		const parts = [];
-		for (const k of keys) {
-			const v = obj[k];
-			if (v !== void 0) parts.push(JSON.stringify(k) + ":" + stableStringify(v, seen, depth + 1));
+	try {
+		let result;
+		if (Array.isArray(obj)) result = "[" + obj.map((v) => stringifyWithContext(v, seen, depth + 1)).join(",") + "]";
+		else {
+			const keys = Object.keys(obj).sort();
+			const parts = [];
+			for (const k of keys) {
+				const v = obj[k];
+				if (v !== void 0) parts.push(JSON.stringify(k) + ":" + stringifyWithContext(v, seen, depth + 1));
+			}
+			result = "{" + parts.join(",") + "}";
 		}
-		result = "{" + parts.join(",") + "}";
+		stringifyCache.set(obj, result);
+		return result;
+	} finally {
+		seen.delete(obj);
 	}
-	stringifyCache.set(obj, result);
-	return result;
 }
 //#endregion
 //#region ../core/src/prefetched-intents/prefetched-intents.ts
@@ -1049,7 +1084,7 @@ var HttpClient = class {
 			headers
 		};
 		if (options?.body !== void 0) {
-			headers["Content-Type"] = headers["Content-Type"] ?? "application/json";
+			if (!Object.keys(headers).some((k) => k.toLowerCase() === "content-type")) headers["Content-Type"] = "application/json";
 			init.body = JSON.stringify(options.body);
 		}
 		for (const interceptor of this.requestInterceptors) init = await interceptor(url, init);
@@ -1199,11 +1234,10 @@ var LruMap = class {
 		this.capacity = capacity;
 	}
 	get(key) {
+		if (!this.map.has(key)) return void 0;
 		const value = this.map.get(key);
-		if (value !== void 0) {
-			this.map.delete(key);
-			this.map.set(key, value);
-		}
+		this.map.delete(key);
+		this.map.set(key, value);
 		return value;
 	}
 	set(key, value) {
@@ -1559,9 +1593,7 @@ function tryScroll(log, getScrollableElement, scrollY) {
 		});
 		mutationObserver.observe(root, {
 			childList: true,
-			subtree: true,
-			characterData: true,
-			attributes: true
+			subtree: true
 		});
 	}
 	function cleanup() {
@@ -1681,7 +1713,7 @@ var History = class {
 		const newState = update(currentState?.state);
 		this.log.info("updateState", newState, this.currentStateId);
 		this.entries.set(this.currentStateId, {
-			...currentState,
+			scrollY: currentState?.scrollY ?? 0,
 			state: newState
 		});
 	}
@@ -1848,7 +1880,30 @@ function registerFlowActionHandler(deps) {
 		const pagePromise = framework.dispatch(routeMatch.intent);
 		await Promise.race([pagePromise, new Promise((r) => setTimeout(r, 500))]).catch(() => {});
 		updateApp({
-			page: pagePromise.then((page) => {
+			page: pagePromise.then(async (page) => {
+				const postCtx = {
+					...navCtx,
+					page
+				};
+				const afterResult = await framework.runAfterLoad(postCtx, routeMatch.afterGuards);
+				if (afterResult.kind === "redirect") {
+					log.debug(`popstate afterLoad → redirect to ${afterResult.url}`);
+					const newNav = ++navigationId;
+					navigateTo(afterResult.url, 0, newNav);
+					return page;
+				}
+				if (afterResult.kind === "rewrite") {
+					log.debug(`popstate afterLoad → rewrite URL to ${afterResult.url}`);
+					const stateId = window.history.state?.id;
+					window.history.replaceState({ id: stateId }, "", afterResult.url);
+					callbacks.onNavigate(new URL(afterResult.url, window.location.origin).pathname);
+					didEnterPage(page);
+					return page;
+				}
+				if (afterResult.kind === "deny") {
+					log.warn(`popstate afterLoad → denied (${afterResult.status})`);
+					return page;
+				}
 				didEnterPage(page);
 				return page;
 			}),
@@ -1985,7 +2040,13 @@ function getBrowserFetch(fetchFn) {
 * 3. dispatch → Page 数据
 * 4. 调用应用层提供的渲染函数
 */
+/** SSR 内部 rewrite 最大递归深度，防止 guard 配置错导致无限重路由 */
+const MAX_SSR_REWRITE_DEPTH = 5;
 async function ssrRender(options) {
+	return ssrRenderInternal(options, 0);
+}
+async function ssrRenderInternal(options, rewriteDepth) {
+	if (rewriteDepth >= MAX_SSR_REWRITE_DEPTH) throw new Error(`[SSR] Rewrite recursion depth exceeded (max ${MAX_SSR_REWRITE_DEPTH}) at "${options.url}"`);
 	const { url, frameworkConfig, bootstrap, getErrorPage, renderApp, ssrContext, resolveLocale, loadMessages } = options;
 	const parsed = new URL(url, "http://localhost");
 	const fullPath = parsed.pathname + parsed.search;
@@ -2024,6 +2085,7 @@ async function ssrRender(options) {
 		};
 		let page;
 		let serverData = [];
+		let rewriteUrl;
 		if (match) {
 			const navCtx = createServerContext({
 				url: fullPath,
@@ -2032,6 +2094,10 @@ async function ssrRender(options) {
 				request: ssrContext?.request
 			});
 			const beforeResult = await framework.runBeforeLoad(navCtx, match.beforeGuards);
+			if (beforeResult.kind === "rewrite") return ssrRenderInternal({
+				...options,
+				url: beforeResult.url
+			}, rewriteDepth + 1);
 			if (beforeResult.kind !== "next") {
 				const earlyReturn = await handleMiddlewareResult(beforeResult, getErrorPage, renderApp, framework);
 				if (earlyReturn) return earlyReturn;
@@ -2043,7 +2109,7 @@ async function ssrRender(options) {
 					data: page
 				}];
 			} catch (e) {
-				console.error(`[SSR] dispatch failed for intent "${match.intent.id}":`, e);
+				framework.container.resolve(DEP_KEYS.LOGGER).error(`[SSR] dispatch failed for intent "${match.intent.id}":`, e);
 				page = getErrorPage(500, "Internal error");
 			}
 			const postCtx = {
@@ -2051,7 +2117,8 @@ async function ssrRender(options) {
 				page
 			};
 			const afterResult = await framework.runAfterLoad(postCtx, match.afterGuards);
-			if (afterResult.kind !== "next") {
+			if (afterResult.kind === "rewrite") rewriteUrl = afterResult.url;
+			else if (afterResult.kind !== "next") {
 				const lateReturn = await handleMiddlewareResult(afterResult, getErrorPage, renderApp, framework);
 				if (lateReturn) return lateReturn;
 			}
@@ -2065,7 +2132,8 @@ async function ssrRender(options) {
 			serverData,
 			renderMode: match?.renderMode,
 			slots: result.slots,
-			locale
+			locale,
+			rewriteUrl
 		};
 	} finally {
 		framework.dispose();
@@ -2081,10 +2149,13 @@ function getSSRFetch(fetchFn) {
 /**
 * 将中间件结果转换为 SSRRenderResult（如果需要短路返回）。
 * 返回 null 表示继续正常流程。
+*
+* 注意：`rewrite` 不在此处理 — 它由 ssrRenderInternal 直接处理（内部重路由或标记 rewriteUrl）。
 */
 async function handleMiddlewareResult(result, getErrorPage, renderApp, framework) {
 	switch (result.kind) {
-		case "next": return null;
+		case "next":
+		case "rewrite": return null;
 		case "redirect": return {
 			html: "",
 			head: "",
@@ -2095,16 +2166,6 @@ async function handleMiddlewareResult(result, getErrorPage, renderApp, framework
 				status: result.status
 			}
 		};
-		case "rewrite": return {
-			html: "",
-			head: "",
-			css: "",
-			serverData: [],
-			redirect: {
-				url: result.url,
-				status: 301
-			}
-		};
 		case "deny": {
 			const rendered = await renderApp(getErrorPage(result.status, result.message), framework);
 			return {
@@ -2112,7 +2173,8 @@ async function handleMiddlewareResult(result, getErrorPage, renderApp, framework
 				head: rendered.head,
 				css: rendered.css,
 				serverData: [],
-				slots: rendered.slots
+				slots: rendered.slots,
+				status: result.status
 			};
 		}
 	}
@@ -2173,10 +2235,12 @@ function injectCSRShell(template, locale) {
 	if (locale) result = applyLocaleToHtml(result, locale);
 	return result;
 }
-/** 将 lang/dir 注入到 <html> 标签 */
+/** 将 lang/dir 注入到 <html> 标签（支持双引号 / 单引号 / 无引号属性值） */
+const HTML_LANG_PATTERN = /\s+lang=("[^"]*"|'[^']*'|[^\s>]+)/gi;
+const HTML_DIR_PATTERN = /\s+dir=("[^"]*"|'[^']*'|[^\s>]+)/gi;
 function applyLocaleToHtml(html, locale) {
 	return html.replace(/(<html)([^>]*)(>)/i, (_match, open, attrs, close) => {
-		return `${open}${attrs.replace(/\s+lang="[^"]*"/gi, "").replace(/\s+dir="[^"]*"/gi, "")} lang="${locale.lang}" dir="${locale.dir}"${close}`;
+		return `${open}${attrs.replace(HTML_LANG_PATTERN, "").replace(HTML_DIR_PATTERN, "")} lang="${locale.lang}" dir="${locale.dir}"${close}`;
 	});
 }
 //#endregion
@@ -2238,6 +2302,10 @@ const MAX_RESPONSE_SIZE = 10 * 1024 * 1024;
 /**
 * 校验代理路径，防止 SSRF（协议相对 URL 绕过、编码绕过）。
 * 返回规范化的路径，或 null 表示非法。
+*
+* 策略保守：拒绝任何含编码字符的路径，避免上游对 %2F 等解码差异导致绕过。
+* 副作用：合法的 %20、%E4%B8%AD（Unicode）也会被拒。
+* 如需放宽，应在上层路由前自行 decode，或为该代理单独提供 sanitizer 选项。
 */
 function sanitizeProxyPath(raw) {
 	if (raw.length > MAX_PROXY_PATH_LENGTH) return null;
@@ -2289,8 +2357,8 @@ function registerProxyRoutes(app, configs) {
 				});
 				const contentLength = resp.headers.get("Content-Length");
 				if (contentLength && parseInt(contentLength, 10) > MAX_RESPONSE_SIZE) return c.text("Proxy response too large", 502);
-				const body = await resp.text();
-				if (body.length > MAX_RESPONSE_SIZE) return c.text("Proxy response too large", 502);
+				const body = await resp.arrayBuffer();
+				if (body.byteLength > MAX_RESPONSE_SIZE) return c.text("Proxy response too large", 502);
 				const respHeaders = { "Content-Type": resp.headers.get("Content-Type") ?? "application/json" };
 				if (config.cache) respHeaders["Cache-Control"] = config.cache;
 				return c.newResponse(body, resp.status, respHeaders);
@@ -2339,7 +2407,16 @@ function _sanitizeProxyPath(raw) {
   const _headers = ${headersJson};${authCode}
   try {
     const _resp = await fetch(_target.toString(), { headers: _headers, redirect: ${redirect} });
-    const _body = await _resp.text();
+    // Content-Length 快速拒绝，防止 serverless/edge 加载超大响应到内存
+    const _cl = _resp.headers.get("Content-Length");
+    if (_cl && parseInt(_cl, 10) > ${MAX_RESPONSE_SIZE}) {
+      return c.text("Proxy response too large", 502);
+    }
+    // arrayBuffer 保留二进制完整性
+    const _body = await _resp.arrayBuffer();
+    if (_body.byteLength > ${MAX_RESPONSE_SIZE}) {
+      return c.text("Proxy response too large", 502);
+    }
     const _rh = { "Content-Type": _resp.headers.get("Content-Type") || "application/json" };
     if (${cacheStr}) _rh["Cache-Control"] = ${cacheStr};
     return c.newResponse(_body, _resp.status, _rh);
@@ -2440,8 +2517,10 @@ function injectSSR(t, head, css, html, data, locale) {
 
 function applyLocaleToHtml(html, locale) {
   if (!locale) return html;
-  return html.replace(/<html([^>]*)>/, (_, attrs) => {
-    let a = attrs.replace(/s*lang="[^"]*"/g, "").replace(/s*dir="[^"]*"/g, "");
+  return html.replace(/<html([^>]*)>/i, (_, attrs) => {
+    const a = attrs
+      .replace(/\\s+lang=("[^"]*"|'[^']*'|[^\\s>]+)/gi, "")
+      .replace(/\\s+dir=("[^"]*"|'[^']*'|[^\\s>]+)/gi, "");
     return "<html" + a + ' lang="' + locale.lang + '" dir="' + locale.dir + '">';
   });
 }
@@ -2620,8 +2699,8 @@ async function prerenderRoutes(ctx) {
 		if (locale) {
 			const { getLocaleAttributes } = await dynamicImport("@finesoft/core");
 			const attrs = getLocaleAttributes(locale);
-			finalHtml = finalHtml.replace(/<html([^>]*)>/, (_m, a) => {
-				return `<html${a.replace(/\s*lang="[^"]*"/g, "").replace(/\s*dir="[^"]*"/g, "")} lang="${attrs.lang}" dir="${attrs.dir}">`;
+			finalHtml = finalHtml.replace(/<html([^>]*)>/i, (_m, a) => {
+				return `<html${a.replace(/\s+lang=("[^"]*"|'[^']*'|[^\s>]+)/gi, "").replace(/\s+dir=("[^"]*"|'[^']*'|[^\s>]+)/gi, "")} lang="${attrs.lang}" dir="${attrs.dir}">`;
 			});
 		}
 		results.push({
@@ -3142,16 +3221,7 @@ function matchRenderModeOverride(url, renderModes) {
 function createSSRApp(options) {
 	const { root, vite, isProduction, ssrEntryPath = "/src/ssr.ts", ssrProductionModule, parentFetch, renderModes, defaultLocale } = options;
 	const app = new Hono();
-	/** ISR 内存缓存（prerender 路由首次请求后缓存，LRU 驱逐） */
-	const ISR_CACHE_MAX = 1e3;
-	const isrCache = /* @__PURE__ */ new Map();
-	function isrSet(key, val) {
-		if (isrCache.size >= ISR_CACHE_MAX) {
-			const first = isrCache.keys().next().value;
-			if (first !== void 0) isrCache.delete(first);
-		}
-		isrCache.set(key, val);
-	}
+	const isrCache = new LruMap(1e3);
 	/** 生产环境模板缓存（模板不变，避免每请求重复读盘） */
 	let templateCache;
 	async function readTemplate(url) {
@@ -3194,7 +3264,7 @@ function createSSRApp(options) {
 			const requestFetch = parentFetch ? createInternalFetch(parentFetch, ssrDepth + 1) : void 0;
 			const ssrContext = { request: c.req.raw };
 			if (requestFetch) ssrContext.fetch = requestFetch;
-			const { html: appHtml, head, css, serverData, renderMode, redirect: middlewareRedirect, slots, locale } = await render(url, ssrContext);
+			const { html: appHtml, head, css, serverData, renderMode, redirect: middlewareRedirect, slots, locale, status, rewriteUrl } = await render(url, ssrContext);
 			if (middlewareRedirect) return c.redirect(middlewareRedirect.url, middlewareRedirect.status);
 			if (renderMode === "csr") return c.html(injectCSRShell(template, locale));
 			const finalHtml = injectSSRContent({
@@ -3206,7 +3276,9 @@ function createSSRApp(options) {
 				slots,
 				locale
 			});
-			if (renderMode === "prerender" || overrideMode === "prerender") isrSet(url, finalHtml);
+			if ((renderMode === "prerender" || overrideMode === "prerender") && !status && !rewriteUrl) isrCache.set(url, finalHtml);
+			if (rewriteUrl) c.header("Content-Location", rewriteUrl);
+			if (status && status >= 400) return c.html(finalHtml, status);
 			return c.html(finalHtml);
 		} catch (e) {
 			if (!isProduction && vite) vite.ssrFixStacktrace(e);
@@ -3399,7 +3471,7 @@ function parseAcceptLanguage(header, supported, fallback) {
 			lang: lang.trim().toLowerCase(),
 			q: Number.isFinite(qVal) && qVal >= 0 && qVal <= 1 ? qVal : 0
 		};
-	}).sort((a, b) => b.q - a.q);
+	}).filter((entry) => entry.q > 0).sort((a, b) => b.q - a.q);
 	for (const { lang } of langs) {
 		const prefix = lang.split("-")[0];
 		if (effectiveSupported.includes(prefix)) return prefix;
@@ -3571,15 +3643,7 @@ export async function loadMessages(locale) {
 				const { Hono: HonoClass } = await dynamicImport("hono");
 				const { getRequestListener } = await dynamicImport("@hono/node-server");
 				const app = new HonoClass();
-				const ISR_CACHE_MAX = 1e3;
-				const isrCache = /* @__PURE__ */ new Map();
-				function isrSet(key, val) {
-					if (isrCache.size >= ISR_CACHE_MAX) {
-						const first = isrCache.keys().next().value;
-						if (first !== void 0) isrCache.delete(first);
-					}
-					isrCache.set(key, val);
-				}
+				const isrCache = new LruMap(1e3);
 				if (options.proxies?.length) registerProxyRoutes(app, options.proxies);
 				if (typeof options.setup === "function") await options.setup(app);
 				else if (typeof options.setup === "string") try {
@@ -3601,7 +3665,8 @@ export async function loadMessages(locale) {
 						if (overrideMode === "csr") return c.html(injectCSRShell(template, options.defaultLocale ? getLocaleAttributes(options.defaultLocale) : void 0));
 						const cached = isrCache.get(url);
 						if (cached) return c.html(cached);
-						const { html: appHtml, head, css, serverData, renderMode, locale } = await ssrModule.render(url, { fetch: createInternalFetch(app.fetch.bind(app), ssrDepth + 1) });
+						const { html: appHtml, head, css, serverData, renderMode, redirect: middlewareRedirect, slots, locale, status, rewriteUrl } = await ssrModule.render(url, { fetch: createInternalFetch(app.fetch.bind(app), ssrDepth + 1) });
+						if (middlewareRedirect) return c.redirect(middlewareRedirect.url, middlewareRedirect.status);
 						if (renderMode === "csr") return c.html(injectCSRShell(template, locale));
 						const finalHtml = injectSSRContent({
 							template,
@@ -3609,9 +3674,12 @@ export async function loadMessages(locale) {
 							css,
 							html: appHtml,
 							serializedData: ssrModule.serializeServerData(serverData),
+							slots,
 							locale
 						});
-						if (renderMode === "prerender" || overrideMode === "prerender") isrSet(url, finalHtml);
+						if ((renderMode === "prerender" || overrideMode === "prerender") && !status && !rewriteUrl) isrCache.set(url, finalHtml);
+						if (rewriteUrl) c.header("Content-Location", rewriteUrl);
+						if (status && status >= 400) return c.html(finalHtml, status);
 						return c.html(finalHtml);
 					} catch (e) {
 						console.error("[SSR Preview Error]", e);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finesoft/front",
-  "version": "0.1.70",
+  "version": "0.1.74",
   "description": "Full-stack framework: router, DI, actions, SSR, and server — all in one package",
   "license": "MIT",
   "files": [
@@ -20,12 +20,12 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@hono/node-server": "^1.14.1",
+    "@hono/node-server": "^1.19.13",
     "@types/node": "^22",
     "dotenv": "^17.3.1",
-    "hono": "^4.7.10",
+    "hono": "^4.12.12",
     "vite": "npm:@voidzero-dev/vite-plus-core@0.1.16",
-    "vite-plus": "0.1.16"
+    "vite-plus": "0.1.17"
   },
   "peerDependencies": {
     "@hono/node-server": "^1.0.0",