@finesoft/front 0.5.2 → 0.5.4

package/dist/vite.mjs

@@ -1,5 +1,5 @@
-import { a as isPublicSSRResult, i as matchRenderModeOverride, n as registerProxyRoutes, r as createSSRHandler, t as generateProxyCode } from "./proxy-1SphZ7x7.mjs";
-import { r as dynamicImport, t as nodeSafeFetchOptions } from "./fetch-policy-BHT8RtrL.mjs";
+import { a as isPublicSSRResult, i as matchRenderModeOverride, n as registerProxyRoutes, r as createSSRHandler, t as generateProxyCode } from "./proxy-BkKVP3Ha.mjs";
+import { r as dynamicImport, t as nodeSafeFetchOptions } from "./fetch-policy-Cxk7F-Cu.mjs";
 import { n as createControllerTypeWatcher, r as generateControllerTypes, t as generateFrontTypes } from "./public-types-BcJM-AYc.mjs";
 import { createRequire } from "node:module";
 import fs from "node:fs";
@@ -85,8 +85,8 @@ const RENDER_MODES = ${JSON.stringify(ctx.renderModes ?? {})};
 const DEFAULT_LOCALE = ${JSON.stringify(ctx.defaultLocale ?? null)};
 ${opts.platformCache ?? ""}
 const app = new Hono();
-${generateProxyCode(ctx.proxies ?? [])}
 ${ctx.setupPath ? "await _setupDefault(app);" : ""}
+${generateProxyCode(ctx.proxies ?? [])}
 ${opts.platformMiddleware ?? ""}
 const ssr = createSSRHandler({
         ownRenderers: true,
@@ -95,7 +95,7 @@ const ssr = createSSRHandler({
     serializeServerData,
     renderModes: RENDER_MODES,
     defaultLocale: DEFAULT_LOCALE,
-    safeFetch: ${opts.dnsPolicy === "hostname" ? "{ validateDns: false }" : "_safeFetchOptions"},
+    safeFetch: ${opts.dnsPolicy === "hostname" ? JSON.stringify({ trustedOrigins: opts.trustedOrigins ?? [] }) : "_safeFetchOptions"},
     fetch: (request, bindings) => app.fetch(request, bindings),
     ${opts.platformCache ? "cache: {get: platformCacheGet, set: platformCacheSet}," : ""}
     ${opts.publicCacheHeaders ? `publicCacheHeaders: ${JSON.stringify(opts.publicCacheHeaders)},` : ""}
@@ -224,7 +224,12 @@ async function prerenderRoutes(ctx) {
 * 注意：Cloudflare Workers 不支持原生 Node.js API。
 * 若 setup 代理使用了 process.env，需在 wrangler.toml 启用 nodejs_compat。
 */
-function cloudflareAdapter() {
+function cloudflareAdapter(options = {}) {
+	const trustedOrigins = [...options.trustedOrigins ?? []];
+	for (const origin of trustedOrigins) {
+		const parsed = new URL(origin);
+		if (parsed.origin !== origin || !["https:", "http:"].includes(parsed.protocol)) throw new TypeError(`Expected an exact HTTP(S) origin: ${origin}`);
+	}
 	return {
 		name: "cloudflare",
 		async build(ctx) {
@@ -236,6 +241,7 @@ function cloudflareAdapter() {
 			});
 			await buildGeneratedEntry(ctx, ".cf-entry.tmp.mjs", generateSSREntry(ctx, {
 				dnsPolicy: "hostname",
+				trustedOrigins,
 				platformImport: ``,
 				platformExport: `export default app;`,
 				platformCache: `
@@ -334,7 +340,7 @@ function nodeAdapter() {
 			await buildGeneratedEntry(ctx, ".node-entry.tmp.mjs", generateSSREntry(ctx, {
 				platformImport: `import { startNodeHandler } from "@finesoft/front";
 import { readFileSync, existsSync } from "node:fs";
-import { resolve, dirname } from "node:path";
+import { resolve, dirname, relative, isAbsolute, sep } from "node:path";
 import { fileURLToPath } from "node:url";`,
 				platformMiddleware: `
 // 预渲染文件中间件：检查 dist/prerender/ 下是否有对应的静态 HTML
@@ -349,6 +355,8 @@ app.use("*", async (c, next) => {
   ];
   if (urlPath === "/") candidates.unshift(resolve(prerenderDir, "index.html"));
   for (const f of candidates) {
+    const contained = relative(prerenderDir, f);
+    if (contained === ".." || contained.startsWith(".." + sep) || isAbsolute(contained)) continue;
     if (existsSync(f)) {
       const html = readFileSync(f, "utf-8");
       return c.html(html);
@@ -604,7 +612,99 @@ function serverControllerModules(getRoot) {
 		return source;
 	};
 	const has = (node, kind) => getCompiler().canHaveModifiers(node) && getCompiler().getModifiers(node)?.some((m) => m.kind === kind);
-	async function exported(context, specifier, importer, name, seen) {
+	function unwrap(node) {
+		const c = getCompiler();
+		while (c.isParenthesizedExpression(node) || c.isAsExpression(node) || c.isTypeAssertionExpression(node) || c.isNonNullExpression(node) || c.isSatisfiesExpression(node)) node = node.expression;
+		return node;
+	}
+	function propertyName(node) {
+		const c = getCompiler();
+		if (c.isIdentifier(node) || c.isStringLiteralLike(node) || c.isNumericLiteral(node)) return node.text;
+		return c.isComputedPropertyName(node) && c.isStringLiteralLike(unwrap(node.expression)) ? unwrap(node.expression).text : void 0;
+	}
+	function bindingPath(node, name) {
+		const c = getCompiler();
+		if (c.isIdentifier(node)) return node.text === name ? [] : void 0;
+		for (let index = 0; index < node.elements.length; index++) {
+			const item = node.elements[index];
+			if (!c.isBindingElement(item) || item.dotDotDotToken) continue;
+			const nested = bindingPath(item.name, name);
+			const member = c.isArrayBindingPattern(node) ? String(index) : item.propertyName ? propertyName(item.propertyName) : c.isIdentifier(item.name) ? item.name.text : void 0;
+			if (nested && member !== void 0) return [member, ...nested];
+		}
+	}
+	async function exportedMember(context, specifier, importer, name, members, seen, baseOnly) {
+		if (!members.length) return exported(context, specifier, importer, name, seen, baseOnly);
+		if (specifier.startsWith("@finesoft/")) return false;
+		const file = (await context.resolve(specifier, importer, { skipSelf: true }))?.id.split("?")[0];
+		if (!file) return false;
+		const key = `${file}:export-member:${JSON.stringify([name, ...members])}`;
+		if (seen.has(key)) return false;
+		seen.add(key);
+		const source = read(file);
+		if (!source) return false;
+		context.addWatchFile(file);
+		const c = getCompiler();
+		for (const statement of source.statements) {
+			if (c.isExportDeclaration(statement) && !statement.isTypeOnly) {
+				const module = statement.moduleSpecifier && c.isStringLiteral(statement.moduleSpecifier) ? statement.moduleSpecifier.text : void 0;
+				const clause = statement.exportClause;
+				if (module && clause && c.isNamespaceExport(clause) && clause.name.text === name) return exportedMember(context, module, file, members[0], members.slice(1), seen, baseOnly);
+				if (module && !clause && await exportedMember(context, module, file, name, members, new Set(seen), baseOnly)) return true;
+				if (clause && c.isNamedExports(clause)) for (const item of clause.elements) {
+					if (item.isTypeOnly || item.name.text !== name) continue;
+					const local = item.propertyName ?? item.name;
+					return module ? exportedMember(context, module, file, local.text, members, seen, baseOnly) : memberExpression(context, source, local, members, seen, baseOnly);
+				}
+			}
+			if (c.isVariableStatement(statement) && has(statement, c.SyntaxKind.ExportKeyword)) {
+				for (const item of statement.declarationList.declarations) if (c.isIdentifier(item.name) && item.name.text === name && item.initializer) return memberExpression(context, source, item.initializer, members, seen, baseOnly);
+			}
+			if (name === "default" && c.isExportAssignment(statement)) return memberExpression(context, source, statement.expression, members, seen, baseOnly);
+		}
+		return false;
+	}
+	async function memberExpression(context, source, node, members, seen, baseOnly) {
+		if (!members.length) return expression(context, source, node, seen, baseOnly);
+		node = unwrap(node);
+		const key = `${source.fileName}:member:${node.pos}:${node.end}:${JSON.stringify(members)}`;
+		if (seen.has(key)) return false;
+		seen.add(key);
+		const c = getCompiler();
+		if (c.isPropertyAccessExpression(node)) return memberExpression(context, source, node.expression, [node.name.text, ...members], seen, baseOnly);
+		if (c.isElementAccessExpression(node) && c.isStringLiteralLike(node.argumentExpression)) return memberExpression(context, source, node.expression, [node.argumentExpression.text, ...members], seen, baseOnly);
+		if (c.isObjectLiteralExpression(node)) for (const item of [...node.properties].reverse()) {
+			if (c.isSpreadAssignment(item)) {
+				if (await memberExpression(context, source, item.expression, members, new Set(seen), baseOnly)) return true;
+				continue;
+			}
+			if (propertyName(item.name) !== members[0]) continue;
+			if (c.isPropertyAssignment(item)) return memberExpression(context, source, item.initializer, members.slice(1), seen, baseOnly);
+			if (c.isShorthandPropertyAssignment(item)) return memberExpression(context, source, item.name, members.slice(1), seen, baseOnly);
+		}
+		if (c.isArrayLiteralExpression(node)) {
+			const item = node.elements[Number(members[0])];
+			return !!item && memberExpression(context, source, item, members.slice(1), seen, baseOnly);
+		}
+		if (!c.isIdentifier(node)) return false;
+		for (const statement of source.statements) {
+			if (c.isVariableStatement(statement)) for (const item of statement.declarationList.declarations) {
+				const prefix = bindingPath(item.name, node.text);
+				if (prefix && item.initializer) return memberExpression(context, source, item.initializer, [...prefix, ...members], seen, baseOnly);
+			}
+			if (!c.isImportDeclaration(statement) || !c.isStringLiteral(statement.moduleSpecifier) || statement.importClause?.isTypeOnly) continue;
+			const clause = statement.importClause;
+			const binding = clause?.namedBindings;
+			const specifier = statement.moduleSpecifier.text;
+			if (binding && c.isNamespaceImport(binding) && binding.name.text === node.text) return exportedMember(context, specifier, source.fileName, members[0], members.slice(1), seen, baseOnly);
+			if (clause?.name?.text === node.text) return exportedMember(context, specifier, source.fileName, "default", members, seen, baseOnly);
+			if (binding && c.isNamedImports(binding)) {
+				for (const item of binding.elements) if (!item.isTypeOnly && item.name.text === node.text) return exportedMember(context, specifier, source.fileName, (item.propertyName ?? item.name).text, members, seen, baseOnly);
+			}
+		}
+		return false;
+	}
+	async function exported(context, specifier, importer, name, seen, baseOnly = false) {
 		if (specifier === "@finesoft/front" || serverEntries.has(specifier)) return name === "BaseServerController";
 		if (specifier.startsWith("@finesoft/")) return false;
 		const resolved = await context.resolve(specifier, importer, { skipSelf: true });
@@ -619,52 +719,55 @@ function serverControllerModules(getRoot) {
 		const c = getCompiler();
 		for (const statement of source.statements) {
 			if (c.isClassDeclaration(statement) && has(statement, c.SyntaxKind.ExportKeyword)) {
-				if ((has(statement, c.SyntaxKind.DefaultKeyword) ? "default" : statement.name?.text) === name) return serverClass(context, source, statement, seen);
+				if ((has(statement, c.SyntaxKind.DefaultKeyword) ? "default" : statement.name?.text) === name) return !baseOnly && serverClass(context, source, statement, seen);
+			}
+			if (c.isVariableStatement(statement) && has(statement, c.SyntaxKind.ExportKeyword)) {
+				for (const item of statement.declarationList.declarations) if (c.isIdentifier(item.name) && item.name.text === name && item.initializer) return expression(context, source, item.initializer, seen, baseOnly);
 			}
 			if (c.isExportDeclaration(statement) && !statement.isTypeOnly) {
 				const module = statement.moduleSpecifier && c.isStringLiteral(statement.moduleSpecifier) ? statement.moduleSpecifier.text : void 0;
-				if (!statement.exportClause && module && await exported(context, module, file, name, new Set(seen))) return true;
+				if (!statement.exportClause && module && await exported(context, module, file, name, new Set(seen), baseOnly)) return true;
 				if (statement.exportClause && c.isNamedExports(statement.exportClause)) for (const item of statement.exportClause.elements) {
 					if (item.isTypeOnly || item.name.text !== name) continue;
 					const local = (item.propertyName ?? item.name).text;
-					return module ? exported(context, module, file, local, seen) : identifier(context, source, local, seen);
+					return module ? exported(context, module, file, local, seen, baseOnly) : identifier(context, source, local, seen, baseOnly);
 				}
 			}
-			if (name === "default" && c.isExportAssignment(statement)) return expression(context, source, statement.expression, seen);
+			if (name === "default" && c.isExportAssignment(statement)) return expression(context, source, statement.expression, seen, baseOnly);
 		}
 		return false;
 	}
-	async function identifier(context, source, name, seen) {
+	async function identifier(context, source, name, seen, baseOnly = false) {
 		const key = `${source.fileName}:local:${name}`;
 		if (seen.has(key)) return false;
 		seen.add(key);
 		const c = getCompiler();
 		for (const statement of source.statements) {
-			if (c.isClassDeclaration(statement) && statement.name?.text === name) return serverClass(context, source, statement, seen);
-			if (c.isVariableStatement(statement)) {
-				for (const item of statement.declarationList.declarations) if (c.isIdentifier(item.name) && item.name.text === name && item.initializer) return expression(context, source, item.initializer, seen);
+			if (c.isClassDeclaration(statement) && statement.name?.text === name) return !baseOnly && serverClass(context, source, statement, seen);
+			if (c.isVariableStatement(statement)) for (const item of statement.declarationList.declarations) {
+				const members = bindingPath(item.name, name);
+				if (members && item.initializer) return memberExpression(context, source, item.initializer, members, seen, baseOnly);
 			}
 			if (!c.isImportDeclaration(statement) || !c.isStringLiteral(statement.moduleSpecifier) || statement.importClause?.isTypeOnly) continue;
 			const clause = statement.importClause;
-			if (clause?.name?.text === name) return exported(context, statement.moduleSpecifier.text, source.fileName, "default", seen);
+			if (clause?.name?.text === name) return exported(context, statement.moduleSpecifier.text, source.fileName, "default", seen, baseOnly);
 			if (clause?.namedBindings && c.isNamedImports(clause.namedBindings)) {
-				for (const item of clause.namedBindings.elements) if (!item.isTypeOnly && item.name.text === name) return exported(context, statement.moduleSpecifier.text, source.fileName, (item.propertyName ?? item.name).text, seen);
+				for (const item of clause.namedBindings.elements) if (!item.isTypeOnly && item.name.text === name) return exported(context, statement.moduleSpecifier.text, source.fileName, (item.propertyName ?? item.name).text, seen, baseOnly);
 			}
 		}
 		return false;
 	}
-	async function expression(context, source, node, seen) {
+	async function expression(context, source, node, seen, baseOnly = false) {
 		const c = getCompiler();
-		if (c.isIdentifier(node)) return identifier(context, source, node.text, seen);
-		if (c.isPropertyAccessExpression(node) && c.isIdentifier(node.expression)) for (const statement of source.statements) {
-			if (!c.isImportDeclaration(statement) || !c.isStringLiteral(statement.moduleSpecifier)) continue;
-			const binding = statement.importClause?.namedBindings;
-			if (binding && c.isNamespaceImport(binding) && binding.name.text === node.expression.text) return exported(context, statement.moduleSpecifier.text, source.fileName, node.name.text, seen);
-		}
-		if (c.isClassExpression(node)) return serverClass(context, source, node, seen);
+		node = unwrap(node);
+		if (c.isIdentifier(node)) return identifier(context, source, node.text, seen, baseOnly);
+		const member = c.isPropertyAccessExpression(node) ? node.name.text : c.isElementAccessExpression(node) && c.isStringLiteralLike(node.argumentExpression) ? node.argumentExpression.text : void 0;
+		if (member && (c.isPropertyAccessExpression(node) || c.isElementAccessExpression(node))) return memberExpression(context, source, node.expression, [member], seen, baseOnly);
+		if (baseOnly && c.isElementAccessExpression(node) && !member) return memberExpression(context, source, node.expression, ["BaseServerController"], seen, true);
+		if (c.isClassExpression(node)) return !baseOnly && serverClass(context, source, node, seen);
 		if (c.isCallExpression(node)) {
-			if (await expression(context, source, node.expression, new Set(seen))) return true;
-			for (const argument of node.arguments) if (await expression(context, source, argument, new Set(seen))) return true;
+			if (!baseOnly && await expression(context, source, node.expression, new Set(seen))) return true;
+			for (const argument of node.arguments) if (await expression(context, source, argument, new Set(seen), baseOnly) || baseOnly && await memberExpression(context, source, argument, ["BaseServerController"], new Set(seen), true)) return true;
 		}
 		return false;
 	}
@@ -672,6 +775,77 @@ function serverControllerModules(getRoot) {
 		const base = node.heritageClauses?.find((clause) => clause.token === getCompiler().SyntaxKind.ExtendsKeyword)?.types[0];
 		return !!base && expression(context, source, base.expression, seen);
 	}
+	/** One classification drives cold dependency indexing and every browser load form. */
+	async function classify(context, source) {
+		const c = getCompiler();
+		const classes = [];
+		const uses = [];
+		const visit = (node) => {
+			if (c.isImportDeclaration(node) || c.isExportDeclaration(node) || c.isTypeNode(node)) return;
+			if (c.isClassDeclaration(node) || c.isClassExpression(node)) classes.push(node);
+			if (c.isIdentifier(node) || c.isPropertyAccessExpression(node) || c.isElementAccessExpression(node) || c.isCallExpression(node)) uses.push(node);
+			c.forEachChild(node, visit);
+		};
+		visit(source);
+		const owned = /* @__PURE__ */ new Set();
+		for (const node of classes) if (await serverClass(context, source, node, /* @__PURE__ */ new Set())) owned.add(node);
+		const names = /* @__PURE__ */ new Map();
+		const defaultNames = /* @__PURE__ */ new Map();
+		const reserved = new Set(uses.filter(c.isIdentifier).map((node) => node.text));
+		const generatedName = (prefix) => {
+			let name = prefix;
+			while (reserved.has(name)) name += "_";
+			reserved.add(name);
+			return name;
+		};
+		for (const statement of source.statements) {
+			if (c.isClassDeclaration(statement) && owned.has(statement)) {
+				const name = statement.name?.text ?? "__ServerController";
+				names.set(name, name);
+			}
+			if (c.isVariableStatement(statement)) {
+				for (const item of statement.declarationList.declarations) if (c.isIdentifier(item.name) && item.initializer && owned.has(unwrap(item.initializer))) names.set(item.name.text, item.name.text);
+			}
+			if (c.isExportAssignment(statement) && owned.has(unwrap(statement.expression))) {
+				const name = generatedName("__ServerControllerDefault");
+				defaultNames.set(statement, name);
+				names.set(name, name);
+			}
+		}
+		let changed = true;
+		while (changed) {
+			changed = false;
+			for (const statement of source.statements) {
+				if (!c.isVariableStatement(statement)) continue;
+				for (const item of statement.declarationList.declarations) {
+					if (!c.isIdentifier(item.name) || !item.initializer || names.has(item.name.text)) continue;
+					const value = unwrap(item.initializer);
+					if (c.isIdentifier(value) && names.has(value.text)) {
+						names.set(item.name.text, names.get(value.text));
+						changed = true;
+					}
+				}
+			}
+		}
+		let server = owned.size > 0;
+		if (!server) {
+			const checked = /* @__PURE__ */ new Set();
+			for (const use of uses) {
+				const key = use.getText(source);
+				if (checked.has(key)) continue;
+				checked.add(key);
+				if (await expression(context, source, use, /* @__PURE__ */ new Set(), true)) {
+					server = true;
+					break;
+				}
+			}
+		}
+		return {
+			server,
+			names,
+			defaultNames
+		};
+	}
 	async function protectDependencies(context, file, seen = /* @__PURE__ */ new Set()) {
 		if (seen.has(file)) return;
 		seen.add(file);
@@ -719,12 +893,11 @@ function serverControllerModules(getRoot) {
 		}
 		if (!pending.size) return;
 		indexing = (async () => {
-			const c = getCompiler();
 			for (const file of pending) {
 				pending.delete(file);
 				const source = read(file);
 				if (!source) continue;
-				if (privateFiles.has(file) || (await Promise.all(source.statements.filter(c.isClassDeclaration).map((node) => serverClass(context, source, node, /* @__PURE__ */ new Set())))).some(Boolean)) await protectDependencies(context, file);
+				if (privateFiles.has(file) || (await classify(context, source)).server) await protectDependencies(context, file);
 			}
 		})();
 		try {
@@ -748,12 +921,8 @@ function serverControllerModules(getRoot) {
 				return null;
 			}
 			const c = getCompiler();
-			const names = /* @__PURE__ */ new Map();
-			for (const statement of source.statements) if (c.isClassDeclaration(statement) && await serverClass(context, source, statement, /* @__PURE__ */ new Set())) {
-				const name = statement.name?.text ?? "__ServerController";
-				names.set(name, name);
-			}
-			if (!names.size) {
+			const { server, names, defaultNames } = await classify(context, source);
+			if (!server) {
 				if (privateFiles.has(file)) throw Error(`Server controller dependency cannot be loaded by the browser: ${file}`);
 				return null;
 			}
@@ -763,6 +932,7 @@ function serverControllerModules(getRoot) {
 				"v",
 				"import"
 			].includes(key))) throw Error(`Server controller source cannot be loaded as an asset: ${file}`);
+			if (!names.size) throw Error(`Unsupported server controller syntax; use a module-scope class: ${file}`);
 			const exports = [];
 			for (const statement of source.statements) {
 				if (c.isInterfaceDeclaration(statement) || c.isTypeAliasDeclaration(statement)) continue;
@@ -770,7 +940,11 @@ function serverControllerModules(getRoot) {
 					const name = statement.name?.text ?? "__ServerController";
 					if (!names.has(name)) throw Error(`Server controller modules cannot export shared implementations: ${file}`);
 					exports.push(has(statement, c.SyntaxKind.DefaultKeyword) ? `export default ${name};` : `export { ${name} };`);
-				} else if (c.isExportDeclaration(statement) && !statement.isTypeOnly) {
+				} else if (c.isVariableStatement(statement) && has(statement, c.SyntaxKind.ExportKeyword)) for (const item of statement.declarationList.declarations) {
+					if (!c.isIdentifier(item.name) || !names.has(item.name.text)) throw Error(`Server controller modules can only export controllers and types: ${file}`);
+					exports.push(`export { ${item.name.text} };`);
+				}
+				else if (c.isExportDeclaration(statement) && !statement.isTypeOnly) {
 					if (statement.moduleSpecifier || !statement.exportClause || !c.isNamedExports(statement.exportClause)) throw Error(`Move re-exports out of the server controller implementation module: ${file}`);
 					for (const item of statement.exportClause.elements) {
 						if (item.isTypeOnly) continue;
@@ -779,12 +953,14 @@ function serverControllerModules(getRoot) {
 						exports.push(`export { ${name} as ${item.name.text} };`);
 					}
 				} else if (c.isExportAssignment(statement)) {
-					if (!c.isIdentifier(statement.expression) || !names.has(statement.expression.text)) throw Error(`Invalid server controller default export: ${file}`);
-					exports.push(`export default ${statement.expression.text};`);
+					const value = unwrap(statement.expression);
+					const name = defaultNames.get(statement) ?? (c.isIdentifier(value) ? value.text : void 0);
+					if (!name || !names.has(name)) throw Error(`Invalid server controller default export: ${file}`);
+					exports.push(`export default ${name};`);
 				} else if (has(statement, c.SyntaxKind.ExportKeyword)) throw Error(`Server controller modules can only export controllers and types: ${file}`);
 			}
 			return {
-				code: `import { ServerControllerProxy as __Proxy } from "@finesoft/front";\n${[...names].map(([name]) => `class ${name} extends __Proxy {}`).join("\n")}\n${exports.join("\n")}`,
+				code: `import { ServerControllerProxy as __Proxy } from "@finesoft/front";\n${[...names].map(([name, original]) => name === original ? `class ${name} extends __Proxy {}` : `const ${name} = ${original};`).join("\n")}\n${exports.join("\n")}`,
 				map: {
 					version: 3,
 					sources: [],
@@ -2202,9 +2378,9 @@ export async function loadMessages(locale) {
 				const { getRequestListener } = await dynamicImport("@hono/node-server");
 				printDevSafetyBanner();
 				const app = new HonoClass();
-				if (options.proxies?.length) registerProxyRoutes(app, options.proxies);
 				if (typeof options.setup === "function") await options.setup(app);
 				else if (typeof options.setup === "string") await (await server.ssrLoadModule("/" + options.setup)).default(app);
+				if (options.proxies?.length) registerProxyRoutes(app, options.proxies);
 				const ssrApp = createSSRApp({
 					root,
 					vite: server,
@@ -2236,14 +2412,12 @@ export async function loadMessages(locale) {
 				const { Hono: HonoClass } = await dynamicImport("hono");
 				const { getRequestListener } = await dynamicImport("@hono/node-server");
 				const app = new HonoClass();
-				if (options.proxies?.length) registerProxyRoutes(app, options.proxies);
 				if (typeof options.setup === "function") await options.setup(app);
-				else if (typeof options.setup === "string") try {
+				else if (typeof options.setup === "string") {
 					const setupPath = pathToFileURL(path.resolve(root, "dist/server/setup.mjs")).href;
 					await (await dynamicImport(setupPath)).default(app);
-				} catch {
-					console.warn("[finesoft] Could not load setup module for preview. API routes disabled.");
 				}
+				if (options.proxies?.length) registerProxyRoutes(app, options.proxies);
 				const template = readFileSync(path.resolve(root, "dist/client/index.html"), "utf-8");
 				const ssrPath = pathToFileURL(path.resolve(root, "dist/server/ssr.js")).href;
 				const ssrModule = await dynamicImport(ssrPath);

package/dist/{vue-DGmzuKho.d.mts → vue-DsZIYP1c.d.mts}

@@ -1,4 +1,4 @@
-import { f as AppSnapshot, g as WebAppView, h as ViewProps } from "./session-DnB4ZC3x.mjs";
+import { f as AppSnapshot, g as WebAppView, h as ViewProps } from "./session-BR1vd3yY.mjs";
 import { Component, PropType } from "vue";
 declare namespace vue_d_exports {
   export { NativeView, NativeViews, Outlet, ViewProps, WebAppView, useSnapshot };
@@ -29,4 +29,4 @@ declare const Outlet: import("vue").DefineComponent<import("vue").ExtractPropTyp
 }>> & Readonly<{}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, true, {}, any>;
 //#endregion
 export { vue_d_exports as a, useSnapshot as i, NativeViews as n, Outlet as r, NativeView as t };
-//# sourceMappingURL=vue-DGmzuKho.d.mts.map
+//# sourceMappingURL=vue-DsZIYP1c.d.mts.map

package/dist/vue.d.mts

@@ -1,3 +1,3 @@
-import { g as WebAppView, h as ViewProps } from "./session-DnB4ZC3x.mjs";
-import { i as useSnapshot, n as NativeViews, r as Outlet, t as NativeView } from "./vue-DGmzuKho.mjs";
+import { g as WebAppView, h as ViewProps } from "./session-BR1vd3yY.mjs";
+import { i as useSnapshot, n as NativeViews, r as Outlet, t as NativeView } from "./vue-DsZIYP1c.mjs";
 export { NativeView, NativeViews, Outlet, type ViewProps, type WebAppView, useSnapshot };

package/dist/web.d.mts

@@ -1,6 +1,6 @@
-import { A as makeSchema, C as ImpressionEntry, D as StandardIssue, E as ParamSchema, F as Token, I as createToken, M as Provider, N as ProviderContext, O as StandardResult, P as provide, S as EventRecorder, T as InferOutput, _ as OperationPolicy, a as compilePath, b as RuntimeOptions, c as ExecutionContext, d as ExecutionHandle, f as Implementation, g as OperationHandler, h as Operation, i as PathParams, j as Container, k as StandardSchemaV1, l as ExecutionError, m as ModuleDefinition, n as PathDescriptor, o as AnyOperation, p as Invocation, r as PathParameterDescriptor, s as AppDefinition, t as CompiledPath, u as ExecutionErrorCode, v as QueryCache, w as MetricsFieldsProvider, x as executionErrorFromHttp, y as RuntimeHandle } from "./path-CXT6xGPO.mjs";
-import { $ as createActiveLeafCodec, $n as list, $t as MiddlewareResult, A as SessionStore, An as PlatformInfo, At as isCompoundAction, B as ControllerContext, Bn as ConsoleLoggerFactory, Bt as NavigationPath, C as SessionFailure, Cn as Storage, Ct as ACTION_KINDS, D as SessionSlice, Dn as LocaleInfo, Dt as ExternalUrlAction, E as SessionRestoreResult, En as LocaleAttributes, Et as CompoundAction, F as WebRuntime, Fn as ReportCallback, Ft as LeafNode, G as controllerContext, Gn as InferParams, Gt as SplitColumn, H as SERVER_CONTROLLER, Hn as Logger, Ht as NavigationSnapshot, I as WebRuntimeOptions, In as ReportingLogger, It as NAVIGATION_NODE_KINDS, J as resolveConfiguredMessages, Jn as QuerySchemaMap, Jt as StackNode, K as MessagesLoader, Kn as InferQuery, Kt as SplitNode, L as createWebRuntime, Ln as ReportingLoggerFactory, Lt as NavigationError, M as SessionWriteResult, Mn as BaseController, Mt as isFlowAction, N as StorageUnavailableError, Nn as ControllerFailure, Nt as makeExternalUrlAction, O as SessionSnapshot, On as TextDirection, Ot as FlowAction, P as WebConfiguration, Pn as ControllerInput, Pt as makeFlowAction, Q as NavigationRouterLike, Qn as isMultiValueSchema, Qt as DenyResult, R as PageControllerDefinition, Rn as ReportingLoggerOptions, Rt as NavigationNode, S as SessionErrorContext, Sn as FeatureFlagsProvider, St as ActionHandler, T as SessionNavigation, Tn as resolveMessages, Tt as ActionInvocation, U as SERVER_REQUEST, Un as LoggerFactory, Ut as ResolvedDestination, V as PageControllerInput, Vn as LogFilter, Vt as NavigationPathStep, W as ServerRequestState, Wn as ExtractParamNames, Wt as SPLIT_VISIBILITIES, X as FullStateCodecOptions, Xn as ListOptions, Xt as AfterLoadGuard, Y as DEFAULT_NAV_PARAM, Yn as StripOptional, Yt as TabsNode, Z as NavigationCodec, Zn as MultiValueSchema, Zt as BeforeLoadGuard, _ as AsyncStorage, _n as RouteInput, _t as PrefetchedIntents, a as NavigationCommitContext, an as deny, at as SerializedSplit, b as SESSION_DEFAULT_VERSION, bn as DEP_KEYS, bt as Router, c as NavigationTransactionContext, cn as rewrite, ct as SerializedTabs, d as createWebSession, dn as FINESOFT_PUBLIC, dt as serializeNavigationStable, en as NavigationContext, er as Intent, et as createFullStateCodec, f as AppSnapshot, fn as PublicProjection, ft as PageRoute, g as WebAppView, gn as markPublic, gt as PrefetchedIntent, h as ViewProps, hn as isPublicMarked, ht as route, i as BeforeNavigateResult, in as RewriteResult, it as SerializedNavigation, j as SessionStoreOptions, jn as detectPlatform, jt as isExternalUrlAction, k as SessionStateProvider, kn as Translator, kt as TreeAction, l as WebSession, ln as BASE_PAGE_FIELDS, lt as deserializeNavigation, m as ViewEntry, mn as getPublicFields, mt as RouteDefinition, n as BeforeCommitResult, nn as PostLoadContext, nt as encodeNavigationTreeParam, o as NavigationCommitError, on as next, ot as SerializedSplitColumn, p as NavigationSummary, pn as PublicValueCodec, pt as RenderMode, q as MessagesLoaderContext, qn as ParamsFor, qt as SplitVisibility, r as BeforeNavigatePolicy, rn as RedirectResult, rt as SerializedLeaf, s as NavigationContextInput, sn as redirect, st as SerializedStack, t as BeforeCommitPolicy, tn as NextResult, tt as decodeNavigationTreeParam, u as WebSessionOptions, un as BasePage, ut as serializeNavigation, v as NavigationScopedState, vn as RouteIntent, vt as RouteAddOptions, w as SessionLoadResult, wn as TranslationMessages, wt as Action, x as SessionError, xn as FeatureFlags, xt as ActionDispatcher, y as SESSION_DEFAULT_KEY, yn as RouteParams, yt as RouteMatch, z as WebAppDefinition, zn as ConsoleLogger, zt as NavigationNodeKind } from "./session-DnB4ZC3x.mjs";
-import { $ as SimpleTranslatorOptions, $t as uuid, A as setVisibility, At as fetchWithRedirects, B as split, Bt as HttpError, C as popTo, Ct as isSome, D as resolveActivePath, Dt as mapEach, E as replaceTop, Et as Mapper, F as isLeafNode, Ft as HttpClientConfig, G as safeErrorPage, Gt as withDefault, H as tabs, Ht as CompositeLogger, I as isSplitNode, It as HttpRequestOptions, J as defineModule, Jt as bool, K as createRuntime, Kt as NumOptions, L as isStackNode, Lt as RequestInterceptor, M as resourceKey, Mt as classifyHost, N as SplitColumnInit, Nt as classifyUrl, O as selectColumn, Ot as pipe, P as TabsInit, Pt as HttpClient, Q as SimpleTranslator, Qt as str, R as isTabsNode, Rt as ResponseInterceptor, S as pop, St as isNone, T as push, Tt as AsyncMapper, U as RouteInputFor, Ut as CompositeLoggerFactory, V as stack, Vt as stableStringify, W as SafeErrorPageOptions, Wt as optional, X as implementController, Xt as num, Y as defineOperation, Yt as int, Z as implementOperation, Zt as oneOf, _ as collectAllLeaves, _t as removeHost, a as LoadPageOptions, at as PluralCategory, b as findNode, bt as None, c as defineWebApp, ct as interpolate, d as runBeforeLoadGuards, dt as VoidEventRecorder, et as getLocaleAttributes, f as createSessionStore, ft as ConsoleEventRecorder, g as encodeSnapshot, gt as getBaseUrl, h as decodeSnapshot, ht as buildUrl, i as resolveInitialNavigation, it as resolveLocaleFromUrl, j as visibleSplitColumns, jt as HostCheckResult, k as selectTab, kt as pipeAsync, l as getWebPlan, lt as resolvePluralKey, m as createNavigationScopedState, mt as generateUuid, n as PageReference, nt as isRtl, o as PageLoadResult, ot as PluralRuleProvider, p as collectLeafKeys, pt as CompositeEventRecorder, q as defineApp, qt as StrOptions, r as definePage, rt as makeLocaleInfo, s as loadPage, st as englishPlural, t as parseCookieString, tt as getTextDirection, u as runAfterLoadGuards, ut as WithFieldsRecorder, v as collectVisibleDestinations, vt as removeQueryParams, w as popToRoot, wt as LruMap, x as mapNavigationLeaves, xt as Optional, y as findNearestStack, yt as removeScheme, z as leaf, zt as HostGuardError } from "./cookies-Bpf9VayB.mjs";
-import { a as enforceHostGuard, i as TargetGuardOptions, n as secureFetch, r as DnsLookup, t as SecureFetchOptions } from "./secure-fetch-Xlht2jd7.mjs";
-import { a as WebHydration, c as decodeWireEnvelope, i as FRAMEWORK_PROTOCOL_VERSION, l as getFrameworkBuildId, n as ServerControllerProxy, o as WireDecodeResult, r as ServerControllerRequest, s as WireEnvelope, t as SERVER_CONTROLLER_PATH } from "./server-controller-proxy-BkVuVWVD.mjs";
-export { ACTION_KINDS, type Action, ActionDispatcher, type ActionHandler, type ActionInvocation, type AfterLoadGuard, AnyOperation, AppDefinition, AppSnapshot, type AsyncMapper, type AsyncStorage, BASE_PAGE_FIELDS, BaseController, type BasePage, type BeforeCommitPolicy, type BeforeCommitResult, type BeforeLoadGuard, type BeforeNavigatePolicy, type BeforeNavigateResult, type CompiledPath, CompositeEventRecorder, CompositeLogger, CompositeLoggerFactory, type CompoundAction, ConsoleEventRecorder, ConsoleLogger, ConsoleLoggerFactory, Container, ControllerContext, type ControllerFailure, type ControllerInput, DEFAULT_NAV_PARAM, DEP_KEYS, type DenyResult, type DnsLookup, type EventRecorder, ExecutionContext, ExecutionError, ExecutionErrorCode, ExecutionHandle, type ExternalUrlAction, type ExtractParamNames, FINESOFT_PUBLIC, FRAMEWORK_PROTOCOL_VERSION, type FeatureFlags, type FeatureFlagsProvider, type FlowAction, type FullStateCodecOptions, type HostCheckResult, HostGuardError, HttpClient, type HttpClientConfig, HttpError, type HttpRequestOptions, Implementation, type ImpressionEntry, type InferOutput, type InferParams, type InferQuery, type Intent, Invocation, type LeafNode, type ListOptions, type LoadPageOptions, type LocaleAttributes, type LocaleInfo, type LogFilter, type Logger, type LoggerFactory, LruMap, type Mapper, type MessagesLoader, type MessagesLoaderContext, type MetricsFieldsProvider, type MiddlewareResult, ModuleDefinition, type MultiValueSchema, NAVIGATION_NODE_KINDS, type NavigationCodec, type NavigationCommitContext, NavigationCommitError, type NavigationContext, type NavigationContextInput, NavigationError, type NavigationNode, type NavigationNodeKind, type NavigationPath, type NavigationPathStep, type NavigationRouterLike, type NavigationScopedState, type NavigationSnapshot, NavigationSummary, type NavigationTransactionContext, type NextResult, type None, type NumOptions, Operation, OperationHandler, OperationPolicy, type Optional, type PageControllerDefinition, PageControllerInput, type PageLoadResult, type PageReference, type PageRoute, type ParamSchema, type ParamsFor, type PathDescriptor, type PathParameterDescriptor, type PathParams, type PlatformInfo, type PluralCategory, type PluralRuleProvider, type PostLoadContext, type PrefetchedIntent, PrefetchedIntents, type Provider, type ProviderContext, type PublicProjection, type PublicValueCodec, QueryCache, type QuerySchemaMap, type RedirectResult, type RenderMode, type ReportCallback, ReportingLogger, ReportingLoggerFactory, type ReportingLoggerOptions, type RequestInterceptor, type ResolvedDestination, type ResponseInterceptor, type RewriteResult, type RouteAddOptions, type RouteDefinition, type RouteInput, type RouteInputFor, type RouteIntent, type RouteMatch, type RouteParams, Router, RuntimeHandle, RuntimeOptions, SERVER_CONTROLLER, SERVER_CONTROLLER_PATH, SERVER_REQUEST, SESSION_DEFAULT_KEY, SESSION_DEFAULT_VERSION, SPLIT_VISIBILITIES, type SafeErrorPageOptions, type SecureFetchOptions, type SerializedLeaf, type SerializedNavigation, type SerializedSplit, type SerializedSplitColumn, type SerializedStack, type SerializedTabs, ServerControllerProxy, type ServerControllerRequest, ServerRequestState, SessionError, type SessionErrorContext, type SessionFailure, type SessionLoadResult, type SessionNavigation, type SessionRestoreResult, type SessionSlice, type SessionSnapshot, type SessionStateProvider, type SessionStore, type SessionStoreOptions, type SessionWriteResult, SimpleTranslator, type SimpleTranslatorOptions, type SplitColumn, type SplitColumnInit, type SplitNode, type SplitVisibility, type StackNode, type StandardIssue, type StandardResult, type StandardSchemaV1, type Storage, StorageUnavailableError, type StrOptions, type StripOptional, type TabsInit, type TabsNode, type TargetGuardOptions, type TextDirection, type Token, type TranslationMessages, type Translator, type TreeAction, ViewEntry, ViewProps, VoidEventRecorder, type WebAppDefinition, WebAppView, type WebConfiguration, type WebHydration, type WebRuntime, type WebRuntimeOptions, type WebSession, type WebSessionOptions, type WireDecodeResult, type WireEnvelope, WithFieldsRecorder, bool, buildUrl, classifyHost, classifyUrl, collectAllLeaves, collectLeafKeys, collectVisibleDestinations, compilePath, controllerContext, createActiveLeafCodec, createFullStateCodec, createNavigationScopedState, createRuntime, createSessionStore, createToken, createWebRuntime, createWebSession, decodeNavigationTreeParam, decodeSnapshot, decodeWireEnvelope, defineApp, defineModule, defineOperation, definePage, defineWebApp, deny, deserializeNavigation, detectPlatform, encodeNavigationTreeParam, encodeSnapshot, enforceHostGuard, englishPlural, executionErrorFromHttp, fetchWithRedirects, findNearestStack, findNode, generateUuid, getBaseUrl, getFrameworkBuildId, getLocaleAttributes, getPublicFields, getTextDirection, getWebPlan, implementController, implementOperation, int, interpolate, isCompoundAction, isExternalUrlAction, isFlowAction, isLeafNode, isMultiValueSchema, isNone, isPublicMarked, isRtl, isSome, isSplitNode, isStackNode, isTabsNode, leaf, list, loadPage, makeExternalUrlAction, makeFlowAction, makeLocaleInfo, makeSchema, mapEach, mapNavigationLeaves, markPublic, next, num, oneOf, optional, parseCookieString, pipe, pipeAsync, pop, popTo, popToRoot, provide, push, redirect, removeHost, removeQueryParams, removeScheme, replaceTop, resolveActivePath, resolveConfiguredMessages, resolveInitialNavigation, resolveLocaleFromUrl, resolveMessages, resolvePluralKey, resourceKey, rewrite, route, runAfterLoadGuards, runBeforeLoadGuards, safeErrorPage, secureFetch, selectColumn, selectTab, serializeNavigation, serializeNavigationStable, setVisibility, split, stableStringify, stack, str, tabs, uuid, visibleSplitColumns, withDefault };
+import { A as makeSchema, C as ImpressionEntry, D as StandardIssue, E as ParamSchema, F as Token, I as createToken, M as Provider, N as ProviderContext, O as StandardResult, P as provide, S as EventRecorder, T as InferOutput, _ as OperationPolicy, a as compilePath, b as RuntimeOptions, c as ExecutionContext, d as ExecutionHandle, f as Implementation, g as OperationHandler, h as Operation, i as PathParams, j as Container, k as StandardSchemaV1, l as ExecutionError, m as ModuleDefinition, n as PathDescriptor, o as AnyOperation, p as Invocation, r as PathParameterDescriptor, s as AppDefinition, t as CompiledPath, u as ExecutionErrorCode, v as QueryCache, w as MetricsFieldsProvider, x as executionErrorFromHttp, y as RuntimeHandle } from "./path-C-b1ChKq.mjs";
+import { $ as createActiveLeafCodec, $n as list, $t as MiddlewareResult, A as SessionStore, An as PlatformInfo, At as isCompoundAction, B as ControllerContext, Bn as ConsoleLoggerFactory, Bt as NavigationPath, C as SessionFailure, Cn as Storage, Ct as ACTION_KINDS, D as SessionSlice, Dn as LocaleInfo, Dt as ExternalUrlAction, E as SessionRestoreResult, En as LocaleAttributes, Et as CompoundAction, F as WebRuntime, Fn as ReportCallback, Ft as LeafNode, G as controllerContext, Gn as InferParams, Gt as SplitColumn, H as SERVER_CONTROLLER, Hn as Logger, Ht as NavigationSnapshot, I as WebRuntimeOptions, In as ReportingLogger, It as NAVIGATION_NODE_KINDS, J as resolveConfiguredMessages, Jn as QuerySchemaMap, Jt as StackNode, K as MessagesLoader, Kn as InferQuery, Kt as SplitNode, L as createWebRuntime, Ln as ReportingLoggerFactory, Lt as NavigationError, M as SessionWriteResult, Mn as BaseController, Mt as isFlowAction, N as StorageUnavailableError, Nn as ControllerFailure, Nt as makeExternalUrlAction, O as SessionSnapshot, On as TextDirection, Ot as FlowAction, P as WebConfiguration, Pn as ControllerInput, Pt as makeFlowAction, Q as NavigationRouterLike, Qn as isMultiValueSchema, Qt as DenyResult, R as PageControllerDefinition, Rn as ReportingLoggerOptions, Rt as NavigationNode, S as SessionErrorContext, Sn as FeatureFlagsProvider, St as ActionHandler, T as SessionNavigation, Tn as resolveMessages, Tt as ActionInvocation, U as SERVER_REQUEST, Un as LoggerFactory, Ut as ResolvedDestination, V as PageControllerInput, Vn as LogFilter, Vt as NavigationPathStep, W as ServerRequestState, Wn as ExtractParamNames, Wt as SPLIT_VISIBILITIES, X as FullStateCodecOptions, Xn as ListOptions, Xt as AfterLoadGuard, Y as DEFAULT_NAV_PARAM, Yn as StripOptional, Yt as TabsNode, Z as NavigationCodec, Zn as MultiValueSchema, Zt as BeforeLoadGuard, _ as AsyncStorage, _n as RouteInput, _t as PrefetchedIntents, a as NavigationCommitContext, an as deny, at as SerializedSplit, b as SESSION_DEFAULT_VERSION, bn as DEP_KEYS, bt as Router, c as NavigationTransactionContext, cn as rewrite, ct as SerializedTabs, d as createWebSession, dn as FINESOFT_PUBLIC, dt as serializeNavigationStable, en as NavigationContext, er as Intent, et as createFullStateCodec, f as AppSnapshot, fn as PublicProjection, ft as PageRoute, g as WebAppView, gn as markPublic, gt as PrefetchedIntent, h as ViewProps, hn as isPublicMarked, ht as route, i as BeforeNavigateResult, in as RewriteResult, it as SerializedNavigation, j as SessionStoreOptions, jn as detectPlatform, jt as isExternalUrlAction, k as SessionStateProvider, kn as Translator, kt as TreeAction, l as WebSession, ln as BASE_PAGE_FIELDS, lt as deserializeNavigation, m as ViewEntry, mn as getPublicFields, mt as RouteDefinition, n as BeforeCommitResult, nn as PostLoadContext, nt as encodeNavigationTreeParam, o as NavigationCommitError, on as next, ot as SerializedSplitColumn, p as NavigationSummary, pn as PublicValueCodec, pt as RenderMode, q as MessagesLoaderContext, qn as ParamsFor, qt as SplitVisibility, r as BeforeNavigatePolicy, rn as RedirectResult, rt as SerializedLeaf, s as NavigationContextInput, sn as redirect, st as SerializedStack, t as BeforeCommitPolicy, tn as NextResult, tt as decodeNavigationTreeParam, u as WebSessionOptions, un as BasePage, ut as serializeNavigation, v as NavigationScopedState, vn as RouteIntent, vt as RouteAddOptions, w as SessionLoadResult, wn as TranslationMessages, wt as Action, x as SessionError, xn as FeatureFlags, xt as ActionDispatcher, y as SESSION_DEFAULT_KEY, yn as RouteParams, yt as RouteMatch, z as WebAppDefinition, zn as ConsoleLogger, zt as NavigationNodeKind } from "./session-BR1vd3yY.mjs";
+import { $ as SimpleTranslator, $t as str, A as setVisibility, At as pipeAsync, B as split, Bt as HostGuardError, C as popTo, Ct as isNone, D as resolveActivePath, Dt as Mapper, E as replaceTop, Et as AsyncMapper, F as isLeafNode, Ft as HttpClient, G as SafeErrorPageOptions, Gt as optional, H as tabs, Ht as stableStringify, I as isSplitNode, It as HttpClientConfig, J as defineApp, Jt as StrOptions, K as safeErrorPage, Kt as withDefault, L as isStackNode, Lt as HttpRequestOptions, M as resourceKey, Mt as HostCheckResult, N as SplitColumnInit, Nt as classifyHost, O as selectColumn, Ot as mapEach, P as TabsInit, Pt as classifyUrl, Q as implementOperation, Qt as oneOf, R as isTabsNode, Rt as RequestInterceptor, S as pop, St as Optional, T as push, Tt as LruMap, U as RouteInputFor, Ut as CompositeLogger, V as stack, Vt as HttpError, W as createHydrationDigest, Wt as CompositeLoggerFactory, X as defineOperation, Xt as int, Y as defineModule, Yt as bool, Z as implementController, Zt as num, _ as collectAllLeaves, _t as getBaseUrl, a as LoadPageOptions, at as resolveLocaleFromUrl, b as findNode, bt as removeScheme, c as defineWebApp, ct as englishPlural, d as runBeforeLoadGuards, dt as WithFieldsRecorder, en as uuid, et as SimpleTranslatorOptions, f as createSessionStore, ft as VoidEventRecorder, g as encodeSnapshot, gt as buildUrl, h as decodeSnapshot, ht as generateUuid, i as resolveInitialNavigation, it as makeLocaleInfo, j as visibleSplitColumns, jt as fetchWithRedirects, k as selectTab, kt as pipe, l as getWebPlan, lt as interpolate, m as createNavigationScopedState, mt as CompositeEventRecorder, n as PageReference, nt as getTextDirection, o as PageLoadResult, ot as PluralCategory, p as collectLeafKeys, pt as ConsoleEventRecorder, q as createRuntime, qt as NumOptions, r as definePage, rt as isRtl, s as loadPage, st as PluralRuleProvider, t as parseCookieString, tt as getLocaleAttributes, u as runAfterLoadGuards, ut as resolvePluralKey, v as collectVisibleDestinations, vt as removeHost, w as popToRoot, wt as isSome, x as mapNavigationLeaves, xt as None, y as findNearestStack, yt as removeQueryParams, z as leaf, zt as ResponseInterceptor } from "./cookies-BXCwZoS_.mjs";
+import { a as enforceHostGuard, i as TargetGuardOptions, n as secureFetch, r as DnsLookup, t as SecureFetchOptions } from "./secure-fetch--QwYr5uJ.mjs";
+import { a as WebHydration, c as decodeWireEnvelope, i as FRAMEWORK_PROTOCOL_VERSION, l as getFrameworkBuildId, n as ServerControllerProxy, o as WireDecodeResult, r as ServerControllerRequest, s as WireEnvelope, t as SERVER_CONTROLLER_PATH } from "./server-controller-proxy-CFdU_nGs.mjs";
+export { ACTION_KINDS, type Action, ActionDispatcher, type ActionHandler, type ActionInvocation, type AfterLoadGuard, AnyOperation, AppDefinition, AppSnapshot, type AsyncMapper, type AsyncStorage, BASE_PAGE_FIELDS, BaseController, type BasePage, type BeforeCommitPolicy, type BeforeCommitResult, type BeforeLoadGuard, type BeforeNavigatePolicy, type BeforeNavigateResult, type CompiledPath, CompositeEventRecorder, CompositeLogger, CompositeLoggerFactory, type CompoundAction, ConsoleEventRecorder, ConsoleLogger, ConsoleLoggerFactory, Container, ControllerContext, type ControllerFailure, type ControllerInput, DEFAULT_NAV_PARAM, DEP_KEYS, type DenyResult, type DnsLookup, type EventRecorder, ExecutionContext, ExecutionError, ExecutionErrorCode, ExecutionHandle, type ExternalUrlAction, type ExtractParamNames, FINESOFT_PUBLIC, FRAMEWORK_PROTOCOL_VERSION, type FeatureFlags, type FeatureFlagsProvider, type FlowAction, type FullStateCodecOptions, type HostCheckResult, HostGuardError, HttpClient, type HttpClientConfig, HttpError, type HttpRequestOptions, Implementation, type ImpressionEntry, type InferOutput, type InferParams, type InferQuery, type Intent, Invocation, type LeafNode, type ListOptions, type LoadPageOptions, type LocaleAttributes, type LocaleInfo, type LogFilter, type Logger, type LoggerFactory, LruMap, type Mapper, type MessagesLoader, type MessagesLoaderContext, type MetricsFieldsProvider, type MiddlewareResult, ModuleDefinition, type MultiValueSchema, NAVIGATION_NODE_KINDS, type NavigationCodec, type NavigationCommitContext, NavigationCommitError, type NavigationContext, type NavigationContextInput, NavigationError, type NavigationNode, type NavigationNodeKind, type NavigationPath, type NavigationPathStep, type NavigationRouterLike, type NavigationScopedState, type NavigationSnapshot, NavigationSummary, type NavigationTransactionContext, type NextResult, type None, type NumOptions, Operation, OperationHandler, OperationPolicy, type Optional, type PageControllerDefinition, PageControllerInput, type PageLoadResult, type PageReference, type PageRoute, type ParamSchema, type ParamsFor, type PathDescriptor, type PathParameterDescriptor, type PathParams, type PlatformInfo, type PluralCategory, type PluralRuleProvider, type PostLoadContext, type PrefetchedIntent, PrefetchedIntents, type Provider, type ProviderContext, type PublicProjection, type PublicValueCodec, QueryCache, type QuerySchemaMap, type RedirectResult, type RenderMode, type ReportCallback, ReportingLogger, ReportingLoggerFactory, type ReportingLoggerOptions, type RequestInterceptor, type ResolvedDestination, type ResponseInterceptor, type RewriteResult, type RouteAddOptions, type RouteDefinition, type RouteInput, type RouteInputFor, type RouteIntent, type RouteMatch, type RouteParams, Router, RuntimeHandle, RuntimeOptions, SERVER_CONTROLLER, SERVER_CONTROLLER_PATH, SERVER_REQUEST, SESSION_DEFAULT_KEY, SESSION_DEFAULT_VERSION, SPLIT_VISIBILITIES, type SafeErrorPageOptions, type SecureFetchOptions, type SerializedLeaf, type SerializedNavigation, type SerializedSplit, type SerializedSplitColumn, type SerializedStack, type SerializedTabs, ServerControllerProxy, type ServerControllerRequest, ServerRequestState, SessionError, type SessionErrorContext, type SessionFailure, type SessionLoadResult, type SessionNavigation, type SessionRestoreResult, type SessionSlice, type SessionSnapshot, type SessionStateProvider, type SessionStore, type SessionStoreOptions, type SessionWriteResult, SimpleTranslator, type SimpleTranslatorOptions, type SplitColumn, type SplitColumnInit, type SplitNode, type SplitVisibility, type StackNode, type StandardIssue, type StandardResult, type StandardSchemaV1, type Storage, StorageUnavailableError, type StrOptions, type StripOptional, type TabsInit, type TabsNode, type TargetGuardOptions, type TextDirection, type Token, type TranslationMessages, type Translator, type TreeAction, ViewEntry, ViewProps, VoidEventRecorder, type WebAppDefinition, WebAppView, type WebConfiguration, type WebHydration, type WebRuntime, type WebRuntimeOptions, type WebSession, type WebSessionOptions, type WireDecodeResult, type WireEnvelope, WithFieldsRecorder, bool, buildUrl, classifyHost, classifyUrl, collectAllLeaves, collectLeafKeys, collectVisibleDestinations, compilePath, controllerContext, createActiveLeafCodec, createFullStateCodec, createHydrationDigest, createNavigationScopedState, createRuntime, createSessionStore, createToken, createWebRuntime, createWebSession, decodeNavigationTreeParam, decodeSnapshot, decodeWireEnvelope, defineApp, defineModule, defineOperation, definePage, defineWebApp, deny, deserializeNavigation, detectPlatform, encodeNavigationTreeParam, encodeSnapshot, enforceHostGuard, englishPlural, executionErrorFromHttp, fetchWithRedirects, findNearestStack, findNode, generateUuid, getBaseUrl, getFrameworkBuildId, getLocaleAttributes, getPublicFields, getTextDirection, getWebPlan, implementController, implementOperation, int, interpolate, isCompoundAction, isExternalUrlAction, isFlowAction, isLeafNode, isMultiValueSchema, isNone, isPublicMarked, isRtl, isSome, isSplitNode, isStackNode, isTabsNode, leaf, list, loadPage, makeExternalUrlAction, makeFlowAction, makeLocaleInfo, makeSchema, mapEach, mapNavigationLeaves, markPublic, next, num, oneOf, optional, parseCookieString, pipe, pipeAsync, pop, popTo, popToRoot, provide, push, redirect, removeHost, removeQueryParams, removeScheme, replaceTop, resolveActivePath, resolveConfiguredMessages, resolveInitialNavigation, resolveLocaleFromUrl, resolveMessages, resolvePluralKey, resourceKey, rewrite, route, runAfterLoadGuards, runBeforeLoadGuards, safeErrorPage, secureFetch, selectColumn, selectTab, serializeNavigation, serializeNavigationStable, setVisibility, split, stableStringify, stack, str, tabs, uuid, visibleSplitColumns, withDefault };

package/dist/web.mjs

@@ -1,8 +1,8 @@
-import { $ as isLeafNode, A as createActiveLeafCodec, At as getTextDirection, B as findNode, Bt as fetchWithRedirects, C as runBeforeLoadGuards, Ct as defineModule, D as SERVER_REQUEST, Dt as SimpleTranslator, E as SERVER_CONTROLLER, Et as implementOperation, F as serializeNavigation, Ft as interpolate, G as push, Gt as ConsoleLogger, H as pop, Ht as stableStringify, I as serializeNavigationStable, It as resolvePluralKey, J as selectColumn, Jt as CompositeLoggerFactory, K as replaceTop, Kt as ConsoleLoggerFactory, L as collectAllLeaves, Lt as generateUuid, M as decodeNavigationTreeParam, Mt as makeLocaleInfo, N as encodeNavigationTreeParam, Nt as resolveLocaleFromUrl, O as controllerContext, Ot as resolveMessages, P as deserializeNavigation, Pt as englishPlural, Q as resourceKey, R as collectVisibleDestinations, Rt as detectPlatform, S as runAfterLoadGuards, St as defineApp, T as getWebPlan, Tt as implementController, U as popTo, Ut as ReportingLogger, V as mapNavigationLeaves, Vt as enforceHostGuard, W as popToRoot, Wt as ReportingLoggerFactory, X as setVisibility, Xt as list, Y as selectTab, Yt as isMultiValueSchema, Z as visibleSplitColumns, Zt as Container, _ as SERVER_CONTROLLER_PATH, _t as isFlowAction, a as createSessionStore, at as stack, b as decodeWireEnvelope, bt as provide, c as decodeSnapshot, ct as NavigationError, d as createWebSession, dt as PrefetchedIntents, et as isSplitNode, f as SESSION_DEFAULT_KEY, ft as Router, g as loadPage, gt as isExternalUrlAction, h as StorageUnavailableError, ht as isCompoundAction, i as createWebRuntime, it as split, j as createFullStateCodec, jt as isRtl, k as DEFAULT_NAV_PARAM, kt as getLocaleAttributes, l as encodeSnapshot, lt as SPLIT_VISIBILITIES, m as SessionError, mt as ACTION_KINDS, n as definePage, nt as isTabsNode, o as collectLeafKeys, ot as tabs, p as SESSION_DEFAULT_VERSION, pt as ActionDispatcher, q as resolveActivePath, qt as CompositeLogger, r as resolveInitialNavigation, rt as leaf, s as createNavigationScopedState, st as NAVIGATION_NODE_KINDS, t as parseCookieString, tt as isStackNode, u as NavigationCommitError, ut as route, v as ServerControllerProxy, vt as makeExternalUrlAction, w as defineWebApp, wt as defineOperation, x as getFrameworkBuildId, xt as createRuntime, y as FRAMEWORK_PROTOCOL_VERSION, yt as makeFlowAction, z as findNearestStack, zt as secureFetch } from "./src-qwx7Vw8g.mjs";
-import { C as bool, D as str, E as oneOf, O as uuid, S as withDefault, T as num, _ as mapEach, a as safeErrorPage, b as HttpClient, c as ConsoleEventRecorder, d as getBaseUrl, f as removeHost, g as isSome, h as isNone, i as rewrite, k as makeSchema, l as CompositeEventRecorder, m as removeScheme, n as next, o as WithFieldsRecorder, p as removeQueryParams, r as redirect, s as VoidEventRecorder, t as deny, u as buildUrl, v as pipe, w as int, x as optional, y as pipeAsync } from "./types-BuaZHRG7.mjs";
-import { i as HttpError, n as classifyUrl, r as HostGuardError, t as classifyHost } from "./host-guard-DDWxLpFL.mjs";
+import { $ as isLeafNode, A as createActiveLeafCodec, At as getLocaleAttributes, B as findNode, Bt as secureFetch, C as runBeforeLoadGuards, Ct as defineApp, D as SERVER_REQUEST, Dt as implementOperation, E as SERVER_CONTROLLER, Et as implementController, F as serializeNavigation, Ft as englishPlural, G as push, Gt as ReportingLoggerFactory, H as pop, Ht as enforceHostGuard, I as serializeNavigationStable, It as interpolate, J as selectColumn, Jt as CompositeLogger, K as replaceTop, Kt as ConsoleLogger, L as collectAllLeaves, Lt as resolvePluralKey, M as decodeNavigationTreeParam, Mt as isRtl, N as encodeNavigationTreeParam, Nt as makeLocaleInfo, O as controllerContext, Ot as SimpleTranslator, P as deserializeNavigation, Pt as resolveLocaleFromUrl, Q as resourceKey, Qt as Container, R as collectVisibleDestinations, Rt as generateUuid, S as runAfterLoadGuards, St as createRuntime, T as getWebPlan, Tt as defineOperation, U as popTo, Ut as stableStringify, V as mapNavigationLeaves, Vt as fetchWithRedirects, W as popToRoot, Wt as ReportingLogger, X as setVisibility, Xt as isMultiValueSchema, Y as selectTab, Yt as CompositeLoggerFactory, Z as visibleSplitColumns, Zt as list, _ as SERVER_CONTROLLER_PATH, _t as isExternalUrlAction, a as createSessionStore, at as stack, b as decodeWireEnvelope, bt as makeFlowAction, c as decodeSnapshot, ct as NavigationError, d as createWebSession, dt as createHydrationDigest, et as isSplitNode, f as SESSION_DEFAULT_KEY, ft as PrefetchedIntents, g as loadPage, gt as isCompoundAction, h as StorageUnavailableError, ht as ACTION_KINDS, i as createWebRuntime, it as split, j as createFullStateCodec, jt as getTextDirection, k as DEFAULT_NAV_PARAM, kt as resolveMessages, l as encodeSnapshot, lt as SPLIT_VISIBILITIES, m as SessionError, mt as ActionDispatcher, n as definePage, nt as isTabsNode, o as collectLeafKeys, ot as tabs, p as SESSION_DEFAULT_VERSION, pt as Router, q as resolveActivePath, qt as ConsoleLoggerFactory, r as resolveInitialNavigation, rt as leaf, s as createNavigationScopedState, st as NAVIGATION_NODE_KINDS, t as parseCookieString, tt as isStackNode, u as NavigationCommitError, ut as route, v as ServerControllerProxy, vt as isFlowAction, w as defineWebApp, wt as defineModule, x as getFrameworkBuildId, xt as provide, y as FRAMEWORK_PROTOCOL_VERSION, yt as makeExternalUrlAction, z as findNearestStack, zt as detectPlatform } from "./src-D_Bzbr80.mjs";
+import { C as bool, D as str, E as oneOf, O as uuid, S as withDefault, T as num, _ as mapEach, a as safeErrorPage, b as HttpClient, c as ConsoleEventRecorder, d as getBaseUrl, f as removeHost, g as isSome, h as isNone, i as rewrite, k as makeSchema, l as CompositeEventRecorder, m as removeScheme, n as next, o as WithFieldsRecorder, p as removeQueryParams, r as redirect, s as VoidEventRecorder, t as deny, u as buildUrl, v as pipe, w as int, x as optional, y as pipeAsync } from "./types-DD09OkGZ.mjs";
+import { i as HttpError, n as classifyUrl, r as HostGuardError, t as classifyHost } from "./host-guard-DX4e3-45.mjs";
 import { n as ExecutionError, r as executionErrorFromHttp, t as compilePath } from "./path-CGFl2w7D.mjs";
 import { a as isPublicMarked, i as getPublicFields, n as BASE_PAGE_FIELDS, o as markPublic, r as FINESOFT_PUBLIC, s as BaseController, t as resolveConfiguredMessages } from "./messages-CAt2QdGr.mjs";
 import { t as LruMap } from "./lru-map-BKoUAySU.mjs";
 import { n as createToken, t as DEP_KEYS } from "./src-Ftl_0rhu.mjs";
-export { ACTION_KINDS, ActionDispatcher, BASE_PAGE_FIELDS, BaseController, CompositeEventRecorder, CompositeLogger, CompositeLoggerFactory, ConsoleEventRecorder, ConsoleLogger, ConsoleLoggerFactory, Container, DEFAULT_NAV_PARAM, DEP_KEYS, ExecutionError, FINESOFT_PUBLIC, FRAMEWORK_PROTOCOL_VERSION, HostGuardError, HttpClient, HttpError, LruMap, NAVIGATION_NODE_KINDS, NavigationCommitError, NavigationError, PrefetchedIntents, ReportingLogger, ReportingLoggerFactory, Router, SERVER_CONTROLLER, SERVER_CONTROLLER_PATH, SERVER_REQUEST, SESSION_DEFAULT_KEY, SESSION_DEFAULT_VERSION, SPLIT_VISIBILITIES, ServerControllerProxy, SessionError, SimpleTranslator, StorageUnavailableError, VoidEventRecorder, WithFieldsRecorder, bool, buildUrl, classifyHost, classifyUrl, collectAllLeaves, collectLeafKeys, collectVisibleDestinations, compilePath, controllerContext, createActiveLeafCodec, createFullStateCodec, createNavigationScopedState, createRuntime, createSessionStore, createToken, createWebRuntime, createWebSession, decodeNavigationTreeParam, decodeSnapshot, decodeWireEnvelope, defineApp, defineModule, defineOperation, definePage, defineWebApp, deny, deserializeNavigation, detectPlatform, encodeNavigationTreeParam, encodeSnapshot, enforceHostGuard, englishPlural, executionErrorFromHttp, fetchWithRedirects, findNearestStack, findNode, generateUuid, getBaseUrl, getFrameworkBuildId, getLocaleAttributes, getPublicFields, getTextDirection, getWebPlan, implementController, implementOperation, int, interpolate, isCompoundAction, isExternalUrlAction, isFlowAction, isLeafNode, isMultiValueSchema, isNone, isPublicMarked, isRtl, isSome, isSplitNode, isStackNode, isTabsNode, leaf, list, loadPage, makeExternalUrlAction, makeFlowAction, makeLocaleInfo, makeSchema, mapEach, mapNavigationLeaves, markPublic, next, num, oneOf, optional, parseCookieString, pipe, pipeAsync, pop, popTo, popToRoot, provide, push, redirect, removeHost, removeQueryParams, removeScheme, replaceTop, resolveActivePath, resolveConfiguredMessages, resolveInitialNavigation, resolveLocaleFromUrl, resolveMessages, resolvePluralKey, resourceKey, rewrite, route, runAfterLoadGuards, runBeforeLoadGuards, safeErrorPage, secureFetch, selectColumn, selectTab, serializeNavigation, serializeNavigationStable, setVisibility, split, stableStringify, stack, str, tabs, uuid, visibleSplitColumns, withDefault };
+export { ACTION_KINDS, ActionDispatcher, BASE_PAGE_FIELDS, BaseController, CompositeEventRecorder, CompositeLogger, CompositeLoggerFactory, ConsoleEventRecorder, ConsoleLogger, ConsoleLoggerFactory, Container, DEFAULT_NAV_PARAM, DEP_KEYS, ExecutionError, FINESOFT_PUBLIC, FRAMEWORK_PROTOCOL_VERSION, HostGuardError, HttpClient, HttpError, LruMap, NAVIGATION_NODE_KINDS, NavigationCommitError, NavigationError, PrefetchedIntents, ReportingLogger, ReportingLoggerFactory, Router, SERVER_CONTROLLER, SERVER_CONTROLLER_PATH, SERVER_REQUEST, SESSION_DEFAULT_KEY, SESSION_DEFAULT_VERSION, SPLIT_VISIBILITIES, ServerControllerProxy, SessionError, SimpleTranslator, StorageUnavailableError, VoidEventRecorder, WithFieldsRecorder, bool, buildUrl, classifyHost, classifyUrl, collectAllLeaves, collectLeafKeys, collectVisibleDestinations, compilePath, controllerContext, createActiveLeafCodec, createFullStateCodec, createHydrationDigest, createNavigationScopedState, createRuntime, createSessionStore, createToken, createWebRuntime, createWebSession, decodeNavigationTreeParam, decodeSnapshot, decodeWireEnvelope, defineApp, defineModule, defineOperation, definePage, defineWebApp, deny, deserializeNavigation, detectPlatform, encodeNavigationTreeParam, encodeSnapshot, enforceHostGuard, englishPlural, executionErrorFromHttp, fetchWithRedirects, findNearestStack, findNode, generateUuid, getBaseUrl, getFrameworkBuildId, getLocaleAttributes, getPublicFields, getTextDirection, getWebPlan, implementController, implementOperation, int, interpolate, isCompoundAction, isExternalUrlAction, isFlowAction, isLeafNode, isMultiValueSchema, isNone, isPublicMarked, isRtl, isSome, isSplitNode, isStackNode, isTabsNode, leaf, list, loadPage, makeExternalUrlAction, makeFlowAction, makeLocaleInfo, makeSchema, mapEach, mapNavigationLeaves, markPublic, next, num, oneOf, optional, parseCookieString, pipe, pipeAsync, pop, popTo, popToRoot, provide, push, redirect, removeHost, removeQueryParams, removeScheme, replaceTop, resolveActivePath, resolveConfiguredMessages, resolveInitialNavigation, resolveLocaleFromUrl, resolveMessages, resolvePluralKey, resourceKey, rewrite, route, runAfterLoadGuards, runBeforeLoadGuards, safeErrorPage, secureFetch, selectColumn, selectTab, serializeNavigation, serializeNavigationStable, setVisibility, split, stableStringify, stack, str, tabs, uuid, visibleSplitColumns, withDefault };

package/dist/worker.d.mts

@@ -1,2 +1,2 @@
-import { a as HttpHost, i as HttpHandlerOptions, l as runManagedTask, o as ManagedTask, r as HttpHandler, s as createHttpHandler } from "./http-B6CJqDyf.mjs";
+import { a as HttpHost, i as HttpHandlerOptions, l as runManagedTask, o as ManagedTask, r as HttpHandler, s as createHttpHandler } from "./http-B8r7MWao.mjs";
 export { type HttpHandler, type HttpHandlerOptions, type HttpHost, type ManagedTask, createHttpHandler, runManagedTask };

package/docs/02-routing-and-controllers.md

@@ -199,6 +199,8 @@ Generated page inputs use `ControllerContext` or `ServerControllerContext`. Port
 
 A server controller module may export controller classes and types only. Its local runtime imports are also private to the server; importing these dependencies from client code fails. Use `import type` for shared contracts and separate modules for client implementations. Keep secret-dependent construction inside the protected module or server configuration, rather than arguments to the shared `create` factory.
 
+The compiler recognizes module-scope class declarations, variable-bound and default class expressions, transparent parentheses/type assertions, local aliases, namespace imports and static re-exports. Unsupported factories or computed selections involving the raw server base fail the browser build instead of returning original source. Prefer a module-scope class when that diagnostic occurs. Pure re-export barrels and ordinary consumers of the generated controller references remain shared.
+
 Client bundles and source maps omit the replaced implementation. The development plugin rejects raw controller assets and direct browser source requests for protected dependencies. It indexes modules once, caches ASTs, and reanalyzes changed files. Dependencies remain protected for the lifetime of a development server; restart when intentionally moving one back into shared code. Computed file paths, `public/` assets, and independently copied source are outside the static import boundary. Development servers still belong on trusted development networks.
 
 Use the framework Vite plugin and a request host such as Node or Worker. Static-only hosting cannot run the remote endpoint. The endpoint loads registered server page controllers; it does not expose arbitrary methods or replace explicit login/registration command endpoints.

package/docs/04-rendering-and-hydration.md

@@ -8,4 +8,6 @@ Outlet subscribes to stable `AppSnapshot` values. EntryId keeps its wrapper stab
 
 SSR materializes public projections while request resources are alive and performs one native render. Hydration explicitly carries `{ tree, pages }`, with page results associated with entries. Protocol/build mismatches trigger fresh loading; persisted sessions have their own version. Denied data does not enter the wire.
 
+The standard SSR assembler fingerprints the initial DOM. Before native mounting, changed markup can select a fresh mount with the same SSR data when no protected browser state would be discarded. This does not require extension-specific rules. See [hydration recovery and its limits](./pitfalls/ssr-hydration-mismatch.md).
+
 CSR returns an HTML shell. Prerender produces static HTML. Runtime public HTML reuse still executes current guards and rendering, so it is not a render-skipping guarantee. During cleanup, await session disposal before unmounting the application's native root.

package/docs/06-http-client.md

@@ -34,10 +34,14 @@ const api = new UserApi({ baseUrl: "https://api.example.com", fetch, ...nodeSafe
 
 Browser code may construct the same class with an absolute API URL, its chosen fetch implementation and `validateDns: false`. That explicitly gives DNS resolution to the browser. Do not silently disable a required server capability. Internal/loopback targets are blocked by default; host configuration must deliberately opt in where required.
 
+The shared literal/connection policy also rejects the non-public benchmark range `198.18.0.0/15`, including mapped IPv6 forms. For hosts without a DNS policy, `trustedOrigins` lists exact origins that the application explicitly trusts without DNS checks; all other hostnames still require a resolver. These exceptions are checked on every redirect and do not allow private IP literals. Cloudflare adapter configuration is described in [Deployment hosts](./09-server-and-deployment.md).
+
 The Node entry includes its connection transport as a lazy chunk; consumers need no extra transport package. Standard Node/Vercel/Netlify, development and preview hosts use `nodeSafeFetchOptions`: all DNS answers are checked inside connection creation, and those exact addresses reach the socket while hostname, TLS SNI, cancellation and pooling remain intact. The pool loads lazily and stays outside browser/Worker graphs. Custom Node fetch implementations must honor Undici's `dispatcher` option. `nodeDnsLookup` alone is only a preflight and does not prevent a DNS change before connection.
 
 Protected fetch checks each redirect, follows at most 20 hops and removes authentication/cookie headers across origins. Explicit `manual` / `error` modes retain their meaning. Opaque browser redirects are rejected because their destination is unreadable. Redirects requiring replay of `Request.body` or a streamed body are rejected without unbounded tee buffering; use a replayable `RequestInit.body` (such as a string) or the final URL. `allowInternalHosts: true` explicitly opts out of these protections.
 
 For scoped business services, declare a typed provider and acquire it with `context.get(token)`; see [Dependencies](./07-di-container.md). Bind the invocation's fetch and signal so request cancellation propagates. A cancelled command may already have performed a write; cancellation is not rollback. The operation runtime does not implicitly retry or cache commands.
 
+The full-template `ApiClient` forwards the entire configuration before applying its `/api` and JSON-header defaults. Subclasses should preserve `wrapFetch`, `context`, `trustedOrigins` and interceptors together with the other options; copying `validateDns: false` without its Node transport wrapper removes connection-address protection.
+
 Request and response interceptors run in registration order. `HttpError` represents non-success HTTP results. The generic result type describes expected data; validate untrusted response payloads at the business boundary when necessary. The lower-level protected methods are `get`, `post`, `put`, `del` and `request`; `get`/`del` accept query parameters before request options.

package/docs/09-server-and-deployment.md

@@ -77,6 +77,19 @@ Node’s host requires `@hono/node-server`. Worker fetch has no Node compatibili
 
 When `setup` is a module path, that module must `export default` its setup function. Development, preview and generated hosts use this explicit export; named functions are not discovered automatically.
 
+Setup runs before declared proxies, so `app.use(...)` authentication covers proxy requests as well as application routes. Register guards before terminal handlers in setup. A terminal setup route can override a proxy on the same path. A configured setup that fails to load aborts preview startup. Proxy `auth` supplies an upstream credential; it does not authenticate the incoming caller. Proxies without application guards remain public.
+
+Cloudflare output fails closed for arbitrary `SAFE_FETCH` hostnames because the adapter has no connection-time DNS enforcement. To use a known trusted API, configure exact origins explicitly:
+
+```ts
+import { cloudflareAdapter, finesoftFrontViteConfig } from "@finesoft/front";
+finesoftFrontViteConfig({
+    adapter: cloudflareAdapter({ trustedOrigins: ["https://api.example.com"] }),
+});
+```
+
+This is an explicit trust exception for those origins, not DNS pinning. The origin includes scheme and port; no wildcards, paths or prefix matching are used. Redirects are checked again and private IP literals remain blocked. Relative in-process API calls retain their behavior. The `"cloudflare"` adapter shortcut has an empty trusted-origin list.
+
 ## Static hosting boundary
 
 `staticAdapter` reads built `render.routes` by default, uses the same SSR host to generate HTML and awaits cleanup. `dynamicRoutes` supplies concrete dynamic paths; `routesExport` is an explicit extension. Discovery and rendering failures fail the build. Plain HTML cannot express redirects, error status, Set-Cookie or custom HTTP response headers, so the adapter rejects these responses; choose a request host when they are required.