@finesoft/front 0.5.1 → 0.5.3

package/dist/src-Ftl_0rhu.mjs

@@ -0,0 +1,28 @@
+//#region ../core/src/dependencies/token.ts
+function createToken(id) {
+	if (!id) throw new Error("Token ID must not be empty");
+	return Object.freeze({ id });
+}
+//#endregion
+//#region ../core/src/dependencies/make-dependencies.ts
+const DEP_KEYS = {
+	LOGGER: createToken("logger"),
+	LOGGER_FACTORY: createToken("loggerFactory"),
+	STORAGE: createToken("storage"),
+	FEATURE_FLAGS: createToken("featureFlags"),
+	FETCH: createToken("fetch"),
+	/**
+	* `fetch` 包了 SSRF 防护（拒绝 private / loopback / 保留 IP + DNS resolve 后逐 IP 校验）。
+	* 当 controller 用用户可控的 URL 发起请求（图片代理、链接预览、回调等），
+	* 优先 resolve 这个 key 而不是 `FETCH`。要 opt-out 可手动调 `secureFetch(baseFetch, { allowInternalHosts: true })`。
+	*/
+	SAFE_FETCH: createToken("safeFetch"),
+	EVENT_RECORDER: createToken("eventRecorder"),
+	LOCALE: createToken("locale"),
+	PLATFORM: createToken("platform"),
+	TRANSLATOR: createToken("translator")
+};
+//#endregion
+export { createToken as n, DEP_KEYS as t };
+
+//# sourceMappingURL=src-Ftl_0rhu.mjs.map

package/dist/ssr-BLzYP4wU.d.mts

@@ -0,0 +1,207 @@
+import { E as ParamSchema, c as ExecutionContext, j as Container } from "./path-CXT6xGPO.mjs";
+import { B as ControllerContext, En as LocaleAttributes, H as SERVER_CONTROLLER, Jn as QuerySchemaMap, Mn as BaseController, P as WebConfiguration, Pn as ControllerInput, W as ServerRequestState, en as NavigationContext, g as WebAppView, mt as RouteDefinition, vn as RouteIntent, z as WebAppDefinition } from "./session-DnB4ZC3x.mjs";
+import { t as SecureFetchOptions } from "./secure-fetch-Xlht2jd7.mjs";
+import { a as WebHydration, r as ServerControllerRequest } from "./server-controller-proxy-BkVuVWVD.mjs";
+import { r as HttpHandler } from "./http-B6CJqDyf.mjs";
+//#region ../ssr/src/render.d.ts
+interface SSRContext {
+  identity?: string;
+  traceId?: string;
+  safeFetch?: SecureFetchOptions;
+  fetch?: typeof globalThis.fetch;
+  request?: Request;
+  bindings?: Readonly<Record<string, unknown>>;
+  /** Request metadata and explicit response mutations scoped to this render. */
+  requestState?: ServerRequestState;
+}
+interface SSRAppResult {
+  html: string;
+  head?: string;
+  css?: string;
+  slots?: Record<string, string>;
+}
+interface SSRRenderResult {
+  headers?: HeadersInit;
+  cache?: "public";
+  html: string;
+  head: string;
+  css: string;
+  serverData: WebHydration;
+  renderMode?: string;
+  redirect?: {
+    url: string;
+    status: number;
+  };
+  slots?: Record<string, string>;
+  locale?: {
+    lang: string;
+    dir: string;
+  };
+  status?: number;
+  rewriteUrl?: string;
+}
+//#endregion
+//#region ../ssr/src/create-render.d.ts
+interface SSRRenderConfig<Definition extends WebAppDefinition = WebAppDefinition> {
+  readonly definition: Definition;
+  readonly configuration?: WebConfiguration;
+  readonly render: (app: WebAppView<Definition>) => string | SSRAppResult | Promise<string | SSRAppResult>;
+  readonly resolveLocale?: (url: string, request?: Request) => LocaleAttributes | undefined;
+}
+/** One request scope and one native root serve ordinary and composed navigation. */
+declare function createSSRRender<Definition extends WebAppDefinition>(config: SSRRenderConfig<Definition>): ((url: string, context?: SSRContext, remote?: ServerControllerRequest) => Promise<SSRRenderResult>) & {
+  controller: (input: ServerControllerRequest, context: SSRContext) => Promise<SSRRenderResult>;
+  routes: readonly RouteDefinition<string, Record<string, ParamSchema>, QuerySchemaMap>[];
+  dispose: () => Promise<void>;
+};
+//#endregion
+//#region ../ssr/src/inject.d.ts
+/** SSR HTML 模板占位符常量 */
+declare const SSR_PLACEHOLDERS: {
+  readonly HEAD: "<!--ssr-head-->";
+  readonly BODY: "<!--ssr-body-->";
+  readonly DATA: "<!--ssr-data-->";
+};
+interface InjectSSROptions {
+  template: string;
+  head: string;
+  css: string;
+  html: string;
+  serializedData: string;
+  /** 自定义 slot 替换：`{ "my-slot": "<div>content</div>" }` 会替换 `<!--ssr-my-slot-->`（含 `<!--ssr-lang-->`） */
+  slots?: Record<string, string>;
+  /** Locale 属性，自动注入到 <html> 标签 */
+  locale?: {
+    lang: string;
+    dir: string;
+  };
+}
+declare function injectSSRContent(options: InjectSSROptions): string;
+/**
+ * CSR 空壳注入 — 清空所有占位符
+ * 用于 renderMode === "csr" 的路由
+ *
+ * @param locale - 可选的 locale 属性，注入到 `<html lang="" dir="">`
+ */
+declare function injectCSRShell(template: string, locale?: {
+  lang: string;
+  dir: string;
+}): string;
+//#endregion
+//#region ../ssr/src/server-data.d.ts
+interface SerializeServerDataOptions {
+  readonly buildId?: string;
+  readonly onUnmarkedPage?: "base-fields" | "strict";
+}
+/** Copy declared public data now; never keep request-backed objects/getters in a response. */
+declare function materializeServerData(data: WebHydration, options?: SerializeServerDataOptions): WebHydration;
+/** The shared response assembler remains the single HTML-safe wire serializer owner. */
+declare function serializeServerData(data: WebHydration, options?: SerializeServerDataOptions): string;
+//#endregion
+//#region ../ssr/src/middleware/context.d.ts
+interface ServerContextOptions {
+  url: string;
+  intent: RouteIntent;
+  container: Container;
+  /** 原始 Request 对象（提取 cookie 和 header） */
+  request?: Request;
+}
+/** 从 Request 对象构建服务端上下文 */
+declare function createServerContext(options: ServerContextOptions): NavigationContext;
+//#endregion
+//#region ../ssr/src/server-controller.d.ts
+interface CookieOptions {
+  readonly path?: string;
+  readonly domain?: string;
+  readonly maxAge?: number;
+  readonly expires?: Date;
+  readonly httpOnly?: boolean;
+  readonly secure?: boolean;
+  readonly sameSite?: "Strict" | "Lax" | "None";
+}
+interface ServerControllerContext extends ControllerContext {
+  readonly isServer: true;
+  readonly request: Request;
+  readonly responseHeaders: Headers;
+  /** Write response cookies; request cookies remain the values supplied by the caller. */
+  setCookie(name: string, value: string, options?: CookieOptions): void;
+  deleteCookie(name: string, options?: CookieOptions): void;
+}
+type ServerControllerInput<P extends Record<string, unknown> = Record<string, unknown>, Q extends Record<string, unknown> = Record<string, unknown>> = ControllerInput<P, Q, ServerControllerContext>;
+/** Server execution reuses the ordinary controller lifecycle; the Vite boundary removes its module from clients. */
+declare abstract class BaseServerController<I extends ServerControllerInput = ServerControllerInput, R = unknown> extends BaseController<I, R> {
+  readonly [SERVER_CONTROLLER] = true;
+  protected prepareContext(context: ExecutionContext): I["context"];
+}
+//#endregion
+//#region ../server/src/ssr-handler.d.ts
+interface SSRRequestContext {
+  readonly request: Request;
+  readonly bindings: Readonly<Record<string, unknown>>;
+  readonly fetch?: typeof globalThis.fetch;
+  readonly safeFetch?: SecureFetchOptions;
+  readonly requestState?: ServerRequestState;
+}
+interface SSRResponseResult<TData = unknown> {
+  html: string;
+  head: string;
+  css: string;
+  serverData: TData;
+  renderMode?: string;
+  redirect?: {
+    url: string;
+    status: number;
+  };
+  slots?: Record<string, string>;
+  locale?: {
+    lang: string;
+    dir: string;
+  } | string;
+  status?: number;
+  headers?: HeadersInit;
+  rewriteUrl?: string;
+  /** Explicit guarantee that this result is public and independent of request bindings. */
+  cache?: "public";
+}
+interface SSRModule<TData = unknown> {
+  render: ((url: string, context?: SSRRequestContext) => SSRResponseResult<TData> | Promise<SSRResponseResult<TData>>) & {
+    dispose?(): Promise<void>;
+    readonly routes?: readonly {
+      readonly path: string;
+      readonly renderMode?: string;
+    }[];
+    controller?(input: ServerControllerRequest, context: SSRRequestContext): Promise<SSRResponseResult<TData>>;
+  };
+  serializeServerData: (data: TData) => string;
+}
+interface SSRCache {
+  get(key: string): string | null | undefined | Promise<string | null | undefined>;
+  set(key: string, html: string): void | Promise<void>;
+}
+interface SSRHandlerBaseOptions {
+  /** Transfer loaded renderer shutdown to this handler. Default: borrowed renderers. */
+  readonly ownRenderers?: boolean;
+  template: string | ((request: Request) => string | Promise<string>);
+  renderModes?: Record<string, string>;
+  defaultLocale?: string;
+  /** Internal dispatcher; receives the current invocation bindings. */
+  fetch?: (request: Request, bindings?: Readonly<Record<string, unknown>>) => Response | Promise<Response>;
+  safeFetch?: SecureFetchOptions;
+  /** Omit to use a bounded process-local cache. Only explicitly public responses qualify. */
+  cache?: SSRCache;
+  onError?: (error: unknown) => void;
+  publicCacheHeaders?: Record<string, string>;
+}
+/** Load a module per invocation when the host selects its renderer/serializer dynamically. */
+type SSRHandlerOptions<TData = unknown> = SSRHandlerBaseOptions & (SSRModule<TData> | {
+  loadModule: (request: Request) => SSRModule<TData> | Promise<SSRModule<TData>>;
+});
+declare function matchRenderModeOverride(url: string, renderModes?: Record<string, string>): string | undefined;
+interface SSRHandler extends HttpHandler {
+  dispose(this: void): Promise<void>;
+}
+/** Standard Request/Response HTML assembly; owns no Node, Hono, filesystem or Vite state. */
+declare function createSSRHandler<TData = unknown>(options: SSRHandlerOptions<TData>): SSRHandler;
+//#endregion
+export { createSSRRender as C, SSRRenderResult as E, SSRRenderConfig as S, SSRContext as T, serializeServerData as _, SSRRequestContext as a, injectCSRShell as b, matchRenderModeOverride as c, ServerControllerContext as d, ServerControllerInput as f, materializeServerData as g, SerializeServerDataOptions as h, SSRModule as i, BaseServerController as l, createServerContext as m, SSRHandler as n, SSRResponseResult as o, ServerContextOptions as p, SSRHandlerOptions as r, createSSRHandler as s, SSRCache as t, CookieOptions as u, InjectSSROptions as v, SSRAppResult as w, injectSSRContent as x, SSR_PLACEHOLDERS as y };
+//# sourceMappingURL=ssr-BLzYP4wU.d.mts.map

package/dist/ssr-Tn4YkuxM.mjs

@@ -0,0 +1,357 @@
+import { D as SERVER_REQUEST, E as SERVER_CONTROLLER, F as serializeNavigation, P as deserializeNavigation, T as getWebPlan, at as stack, d as createWebSession, i as createWebRuntime, r as resolveInitialNavigation, rt as leaf, t as parseCookieString, x as getFrameworkBuildId } from "./src-BQBfaaPO.mjs";
+import { n as ExecutionError } from "./path-CGFl2w7D.mjs";
+import { i as getPublicFields, n as BASE_PAGE_FIELDS, s as BaseController, t as resolveConfiguredMessages } from "./messages-CAt2QdGr.mjs";
+import "./src-Ftl_0rhu.mjs";
+import "./proxy-z02VvGIj.mjs";
+//#region ../ssr/src/server-data.ts
+const MATERIALIZED = Symbol("materialized-public-data");
+/** Copy declared public data now; never keep request-backed objects/getters in a response. */
+function materializeServerData(data, options = {}) {
+	const materialized = data[MATERIALIZED];
+	if (materialized) {
+		if (options.onUnmarkedPage === "strict" && materialized === "unmarked") throw Error("markPublic-required");
+		return data;
+	}
+	let allMarked = true;
+	const pages = data.pages.map((entry) => {
+		const marked = getPublicFields(entry.data) !== null;
+		allMarked &&= marked;
+		if (options.onUnmarkedPage === "strict" && !marked) throw Error("markPublic-required");
+		try {
+			return {
+				...entry.entryId ? { entryId: entry.entryId } : {},
+				intent: {
+					id: entry.intent.id,
+					...entry.intent.params === void 0 ? {} : { params: cloneJson(entry.intent.params, /* @__PURE__ */ new Set()) },
+					...entry.intent.query === void 0 ? {} : { query: cloneJson(entry.intent.query, /* @__PURE__ */ new Set()) }
+				},
+				data: project(entry.data, void 0, true, /* @__PURE__ */ new Set())
+			};
+		} catch {
+			throw Error("public-materialization-failed");
+		}
+	});
+	const result = {
+		tree: data.tree && serializeNavigation(deserializeNavigation(data.tree)),
+		pages
+	};
+	Object.defineProperty(result, MATERIALIZED, { value: allMarked ? "marked" : "unmarked" });
+	return result;
+}
+/** The shared response assembler remains the single HTML-safe wire serializer owner. */
+function serializeServerData(data, options = {}) {
+	const json = JSON.stringify({
+		protocolVersion: 2,
+		buildId: options.buildId ?? getFrameworkBuildId(),
+		payload: materializeServerData(data, options)
+	});
+	const escapes = {
+		"<": "\\u003C",
+		">": "\\u003E",
+		"/": "\\u002F",
+		"&": "\\u0026",
+		"\u2028": "\\u2028",
+		"\u2029": "\\u2029"
+	};
+	return json.replace(/[<>/&\u2028\u2029]/g, (value) => escapes[value]);
+}
+function scalar(value) {
+	return value === null || value === void 0 || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value);
+}
+function isCodec(value) {
+	return value.kind === "codec" && typeof value.encode === "function";
+}
+function project(value, declaration, base, ancestors) {
+	if (declaration && declaration !== true && isCodec(declaration)) return cloneJson(declaration.encode(value), /* @__PURE__ */ new Set());
+	if (scalar(value)) return value;
+	if (typeof value !== "object" || value === null) throw Error("invalid-public-value");
+	if (ancestors.has(value)) throw Error("cyclic-public-value");
+	ancestors.add(value);
+	try {
+		if (Array.isArray(value)) {
+			if (!declaration || declaration === true) {
+				if (!value.every((item) => getPublicFields(item) !== null)) return [];
+			}
+			return value.map((item) => project(item, declaration, false, ancestors));
+		}
+		const marker = declaration && declaration !== true ? declaration : getPublicFields(value);
+		const projection = marker && marker !== true && !Array.isArray(marker) ? marker : void 0;
+		const fields = marker === true ? Object.keys(value) : [...base ? BASE_PAGE_FIELDS : [], ...Array.isArray(marker) ? marker : projection ? Object.keys(projection) : []];
+		const result = Object.create(null);
+		for (const field of new Set(fields)) {
+			if (!(field in value)) continue;
+			const item = project(value[field], projection?.[field], false, ancestors);
+			if (item !== void 0) result[field] = item;
+		}
+		return result;
+	} finally {
+		ancestors.delete(value);
+	}
+}
+/** Explicit codecs may emit JSON records/arrays; methods, class instances and cycles are rejected. */
+function cloneJson(value, ancestors) {
+	if (scalar(value)) return value;
+	if (typeof value !== "object" || value === null || ancestors.has(value)) throw Error("invalid-codec-value");
+	if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) throw Error("invalid-codec-value");
+	ancestors.add(value);
+	try {
+		if (Array.isArray(value)) return value.map((item) => cloneJson(item, ancestors));
+		const result = Object.create(null);
+		for (const field of Object.keys(value)) {
+			const item = cloneJson(value[field], ancestors);
+			if (item !== void 0) result[field] = item;
+		}
+		return result;
+	} finally {
+		ancestors.delete(value);
+	}
+}
+//#endregion
+//#region ../ssr/src/create-render.ts
+/** One request scope and one native root serve ordinary and composed navigation. */
+function createSSRRender(config) {
+	const owner = createWebRuntime({
+		...config.configuration,
+		definition: config.definition,
+		storageScope: "execution"
+	});
+	const active = /* @__PURE__ */ new Set();
+	let closing;
+	const render = async (url, context = {}, remote) => {
+		const request = context.request ?? new Request(new URL(url || "/", "http://localhost"));
+		const requestState = context.requestState ?? {
+			request,
+			responseHeaders: new Headers(),
+			remote: !!remote,
+			cookies: parseCookieString(request.headers.get("cookie") ?? "")
+		};
+		const configuration = {
+			...config.definition.configuration,
+			...config.configuration
+		};
+		const resolvedLocale = config.resolveLocale?.(url, context.request);
+		const locale = resolvedLocale?.lang ?? configuration.locale;
+		const fetch = context.fetch ?? configuration.fetch ?? globalThis.fetch?.bind(globalThis);
+		const messages = await resolveConfiguredMessages({
+			locale,
+			loadMessages: config.definition.loadMessages,
+			context: locale ? {
+				runtime: "server",
+				url,
+				request: context.request,
+				fetch
+			} : void 0
+		});
+		const web = createWebRuntime({
+			...configuration,
+			definition: config.definition,
+			runtime: owner.runtime,
+			storageScope: "execution",
+			locale,
+			localeAttributes: resolvedLocale,
+			messages,
+			fetch,
+			safeFetch: {
+				...context.safeFetch,
+				...configuration.safeFetch
+			},
+			invocation: {
+				signal: context.request?.signal,
+				identity: context.identity,
+				traceId: context.traceId,
+				fetch,
+				bindings: {
+					...context.bindings,
+					request: context.request,
+					[SERVER_REQUEST]: {
+						...requestState,
+						remote: !!remote
+					}
+				}
+			}
+		});
+		let controller;
+		const execution = web.createExecution();
+		let failed = false;
+		try {
+			const resolved = remote ? void 0 : await resolveInitialNavigation(web, url);
+			const initial = remote ? stack(leaf(remote.intent, remote.params, {
+				query: remote.query,
+				...remote.url ? { url: remote.url } : {}
+			})) : resolved?.tree ?? stack(leaf("@finesoft/not-found", {}, { url }));
+			const base = {
+				head: "",
+				css: "",
+				html: "",
+				serverData: { pages: [] },
+				locale: await web.getLocale(execution),
+				headers: requestState.responseHeaders
+			};
+			if (!remote && resolved?.renderMode === "csr") return {
+				...base,
+				renderMode: "csr"
+			};
+			let redirect;
+			const cookies = requestState.cookies;
+			controller = createWebSession({
+				web,
+				execution,
+				initial,
+				isServer: true,
+				onRedirect: (value) => {
+					redirect ??= value;
+				},
+				createContext: ({ intent, params, query, url: matchedUrl }) => ({
+					url: matchedUrl ?? url,
+					path: new URL(matchedUrl ?? url, "http://localhost").pathname,
+					intent: {
+						id: intent,
+						params,
+						query
+					},
+					params,
+					query: query ?? {},
+					container: execution.context.container,
+					isServer: true,
+					getCookie: (name) => cookies.get(name),
+					getHeader: (name) => context.request?.headers.get(name) ?? void 0
+				})
+			});
+			for (const kind of ["flow", "externalUrl"]) controller.onAction(kind, () => {
+				throw new ExecutionError("configuration", "SSR views cannot initiate browser actions");
+			});
+			const candidate = await controller.start();
+			if (redirect || candidate.redirect) return {
+				...base,
+				redirect: redirect ?? candidate.redirect
+			};
+			const snapshot = candidate;
+			const status = snapshot.destinations.at(-1)?.status;
+			execution.context.signal.throwIfAborted();
+			const serverData = materializeServerData(status ? { pages: [] } : {
+				tree: serializeNavigation(snapshot.tree),
+				pages: snapshot.destinations.map((entry) => ({
+					entryId: entry.entryId,
+					intent: {
+						id: entry.intent,
+						params: entry.params,
+						...entry.query ? { query: entry.query } : {}
+					},
+					data: entry.page
+				}))
+			});
+			const native = remote ? "" : await config.render(controller);
+			execution.context.signal.throwIfAborted();
+			const output = typeof native === "string" ? { html: native } : native;
+			return {
+				...base,
+				...output,
+				head: output.head ?? "",
+				css: output.css ?? "",
+				serverData,
+				renderMode: snapshot.destinations.at(-1)?.renderMode ?? resolved?.renderMode,
+				status,
+				rewriteUrl: snapshot.destinations.at(-1)?.rewriteUrl,
+				...!status && snapshot.destinations.length && snapshot.destinations.every((d) => d.cache === "public") ? { cache: "public" } : {}
+			};
+		} catch (error) {
+			failed = true;
+			throw error;
+		} finally {
+			const errors = (await Promise.allSettled([
+				controller?.dispose(),
+				execution.dispose(),
+				web.dispose()
+			])).filter((result) => result.status === "rejected").map((result) => result.reason);
+			if (!failed && errors.length) throw new AggregateError(errors, "SSR cleanup failed");
+		}
+	};
+	const run = (url, context, remote) => {
+		if (closing) return Promise.reject(Error("SSR renderer disposed"));
+		const work = render(url, context, remote);
+		active.add(work);
+		work.then(() => active.delete(work), () => active.delete(work));
+		return work;
+	};
+	return Object.assign(run, {
+		controller: (input, context) => run(input.url || "/", context, input),
+		routes: getWebPlan(config.definition).routes,
+		dispose: () => closing ??= (async () => {
+			while (active.size) await Promise.allSettled(active);
+			await owner.dispose();
+		})()
+	});
+}
+//#endregion
+//#region ../ssr/src/middleware/context.ts
+/** 从 Request 对象构建服务端上下文 */
+function createServerContext(options) {
+	const { url, intent, container, request } = options;
+	const parsed = new URL(url, "http://localhost");
+	const cookieHeader = request?.headers.get("cookie") ?? "";
+	const cookies = parseCookieString(cookieHeader);
+	return {
+		url,
+		path: parsed.pathname,
+		params: intent.params ?? {},
+		query: intent.query ?? {},
+		intent,
+		isServer: true,
+		container,
+		getCookie: (name) => cookies.get(name),
+		getHeader: (name) => request?.headers.get(name) ?? void 0
+	};
+}
+//#endregion
+//#region ../ssr/src/server-controller.ts
+/** Server execution reuses the ordinary controller lifecycle; the Vite boundary removes its module from clients. */
+var BaseServerController = class extends BaseController {
+	[SERVER_CONTROLLER] = true;
+	prepareContext(context) {
+		const state = context.bindings[SERVER_REQUEST];
+		if (!state || !(state.request instanceof Request) || !context.isServer) throw new ExecutionError("capability", "BaseServerController requires a server request");
+		const setCookie = (name, value, options = {}) => {
+			context.signal.throwIfAborted();
+			if (!/^[!#$%&'*+.^_`|~\w-]+$/.test(name)) throw new TypeError("Invalid cookie name");
+			const parts = [`${name}=${encodeURIComponent(value)}`];
+			for (const [key, item] of [["Path", options.path ?? "/"], ["Domain", options.domain]]) if (item !== void 0) {
+				if (/[;\r\n]/.test(item)) throw new TypeError("Invalid cookie attribute");
+				parts.push(`${key}=${item}`);
+			}
+			if (options.maxAge !== void 0) {
+				if (!Number.isSafeInteger(options.maxAge)) throw new TypeError("Invalid cookie maxAge");
+				parts.push(`Max-Age=${options.maxAge}`);
+			}
+			if (options.expires) {
+				if (!Number.isFinite(options.expires.getTime())) throw new TypeError("Invalid cookie expiry");
+				parts.push(`Expires=${options.expires.toUTCString()}`);
+			}
+			if (options.httpOnly) parts.push("HttpOnly");
+			if (options.secure) parts.push("Secure");
+			if (options.sameSite) {
+				if (![
+					"Strict",
+					"Lax",
+					"None"
+				].includes(options.sameSite)) throw new TypeError("Invalid SameSite");
+				parts.push(`SameSite=${options.sameSite}`);
+			}
+			state.responseHeaders.append("set-cookie", parts.join("; "));
+		};
+		return Object.freeze({
+			...context,
+			isServer: true,
+			request: state.request,
+			responseHeaders: state.responseHeaders,
+			setCookie,
+			deleteCookie: (name, options) => setCookie(name, "", {
+				...options,
+				maxAge: 0
+			})
+		});
+	}
+};
+//#endregion
+export { serializeServerData as a, materializeServerData as i, createServerContext as n, createSSRRender as r, BaseServerController as t };
+
+//# sourceMappingURL=ssr-Tn4YkuxM.mjs.map

package/dist/ssr.d.mts

@@ -0,0 +1,3 @@
+import { C as createSSRRender, E as SSRRenderResult, S as SSRRenderConfig, T as SSRContext, _ as serializeServerData, a as SSRRequestContext, b as injectCSRShell, c as matchRenderModeOverride, d as ServerControllerContext, f as ServerControllerInput, g as materializeServerData, h as SerializeServerDataOptions, i as SSRModule, l as BaseServerController, m as createServerContext, n as SSRHandler, o as SSRResponseResult, p as ServerContextOptions, r as SSRHandlerOptions, s as createSSRHandler, t as SSRCache, u as CookieOptions, v as InjectSSROptions, w as SSRAppResult, x as injectSSRContent, y as SSR_PLACEHOLDERS } from "./ssr-BLzYP4wU.mjs";
+import { a as registerProxyRoutes, n as ProxyRouteConfig, r as ProxyRouter, t as ProxyAuthConfig } from "./proxy-2dSWO-Xw.mjs";
+export { BaseServerController, type CookieOptions, type InjectSSROptions, type ProxyAuthConfig, type ProxyRouteConfig, type ProxyRouter, type SSRAppResult, SSRCache, type SSRContext, SSRHandler, SSRHandlerOptions, SSRModule, type SSRRenderConfig, type SSRRenderResult, SSRRequestContext, SSRResponseResult, SSR_PLACEHOLDERS, type SerializeServerDataOptions, type ServerContextOptions, type ServerControllerContext, type ServerControllerInput, createSSRHandler, createSSRRender, createServerContext, injectCSRShell, injectSSRContent, matchRenderModeOverride, materializeServerData, registerProxyRoutes, serializeServerData };

package/dist/ssr.mjs

@@ -0,0 +1,3 @@
+import { a as serializeServerData, i as materializeServerData, n as createServerContext, r as createSSRRender, t as BaseServerController } from "./ssr-Tn4YkuxM.mjs";
+import { c as injectSSRContent, i as matchRenderModeOverride, n as registerProxyRoutes, o as SSR_PLACEHOLDERS, r as createSSRHandler, s as injectCSRShell } from "./proxy-z02VvGIj.mjs";
+export { BaseServerController, SSR_PLACEHOLDERS, createSSRHandler, createSSRRender, createServerContext, injectCSRShell, injectSSRContent, matchRenderModeOverride, materializeServerData, registerProxyRoutes, serializeServerData };

package/dist/svelte-Dr5to3SE.d.mts

@@ -0,0 +1,16 @@
+import { g as WebAppView, h as ViewProps } from "./session-DnB4ZC3x.mjs";
+import Outlet from "./Outlet.svelte";
+import { Component } from "svelte";
+declare namespace svelte_d_exports {
+  export { NativeView, NativeViews, Outlet, ViewProps, WebAppView, useSnapshot };
+}
+/** Views choose their page subtype; Outlet supplies the common runtime props. */
+type NativeView = Component<never>;
+type NativeViews = Readonly<Record<string, NativeView>>;
+/** Svelte components consume this small store with `$snapshot`. */
+declare function useSnapshot(app: WebAppView): {
+  subscribe(run: (value: ReturnType<WebAppView["getSnapshot"]>) => void): () => void;
+};
+//#endregion
+export { useSnapshot as a, svelte_d_exports as i, NativeViews as n, Outlet as r, NativeView as t };
+//# sourceMappingURL=svelte-Dr5to3SE.d.mts.map

package/dist/svelte.d.mts

@@ -0,0 +1,3 @@
+import { g as WebAppView, h as ViewProps } from "./session-DnB4ZC3x.mjs";
+import { a as useSnapshot, n as NativeViews, r as Outlet, t as NativeView } from "./svelte-Dr5to3SE.mjs";
+export { NativeView, NativeViews, Outlet, type ViewProps, type WebAppView, useSnapshot };

package/dist/svelte.mjs

@@ -0,0 +1,13 @@
+import Outlet from "./Outlet.svelte";
+//#region src/svelte.ts
+/** Svelte components consume this small store with `$snapshot`. */
+function useSnapshot(app) {
+	return { subscribe(run) {
+		run(app.getSnapshot());
+		return app.subscribe(() => run(app.getSnapshot()));
+	} };
+}
+//#endregion
+export { Outlet, useSnapshot };
+
+//# sourceMappingURL=svelte.mjs.map

package/dist/typegen-C-WeJCtf.d.mts

@@ -0,0 +1,12 @@
+//#region ../server/src/public-types.d.ts
+interface FrontTypeOptions {
+  /** Project directory; defaults to the current working directory. */
+  root?: string;
+  /** Project tsconfig, relative to root. Existing options and comments are preserved. */
+  tsconfig?: string;
+}
+/** Maintain an exact root alias with only the project's installed platform/native contracts. */
+declare function generateFrontTypes(options?: FrontTypeOptions): readonly string[];
+//#endregion
+export { generateFrontTypes as n, FrontTypeOptions as t };
+//# sourceMappingURL=typegen-C-WeJCtf.d.mts.map

package/dist/typegen-cli.d.mts

@@ -0,0 +1 @@
+export {}

package/dist/typegen-cli.mjs

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { r as generateControllerTypes, t as generateFrontTypes } from "./public-types-BcJM-AYc.mjs";
+import "./typegen.mjs";
+//#region src/typegen-cli.ts
+const root = process.argv[2] ?? process.cwd();
+generateFrontTypes({ root });
+generateControllerTypes({ root });
+//#endregion
+export {};
+
+//# sourceMappingURL=typegen-cli.mjs.map

package/dist/typegen.d.mts

@@ -0,0 +1,3 @@
+import { n as ControllerTypeResult, r as generateControllerTypes, t as ControllerTypeOptions } from "./controller-types-CgmJ6-le.mjs";
+import { n as generateFrontTypes, t as FrontTypeOptions } from "./typegen-C-WeJCtf.mjs";
+export { type ControllerTypeOptions, type ControllerTypeResult, type FrontTypeOptions, generateControllerTypes, generateFrontTypes };

package/dist/typegen.mjs

@@ -0,0 +1,2 @@
+import { r as generateControllerTypes, t as generateFrontTypes } from "./public-types-BcJM-AYc.mjs";
+export { generateControllerTypes, generateFrontTypes };