@finesoft/front 0.5.2 → 0.5.4

package/docs/11-navigation.md

@@ -205,6 +205,8 @@ Admission receives `from`, candidate `tree`, stable `transitionId`, active `exec
 
 A denial returns an uncommitted snapshot with `rejection`, including for empty trees. Session restore rejects it before replacing scopes or slices. Initial browser denial renders the error without committing navigation or recording a page visit; later denial preserves the displayed draft. Both flat and navigation SSR honor these policies and emit no rejected page data or public-cache permission. CSR shells still defer navigation to the browser.
 
+If any visible page fails during initial navigation, the whole candidate stays uncommitted and only its error presentation is exposed. Successful siblings are withheld from the native view and SSR hydration data until a successful retry passes the commit boundary. Initial browser redirects that hand off to an external site likewise withhold successful siblings while the browser leaves. Page failures do not invoke `beforeCommit`; later failed navigation preserves the previously committed view.
+
 Owned back/forward rejection compensates to the committed history entry and restores its scroll identity. Additive history metadata preserves ownership and position across reloads. Entries without compatible ownership metadata are diagnosed; the framework cannot infer a safe traversal distance for external entries.
 
 Low-level hosts configuring `createWebSession({ createContext })` return a `NavigationContext` directly. The execution supplies its DI container and cancellation signal; request cookies and headers stay in the host context. The session uses the application's `getErrorPage` unless explicitly overridden.

package/docs/advanced/multi-tenant-scopes.md

@@ -15,3 +15,27 @@ await runtime.execute(operation, input, {
 ```
 
 Use `provide({ token, lifetime: "scope", create, dispose })` for per-request resources. Concurrent initialization deduplicates and a failed initialization may retry. Runtime-scoped providers cannot depend on request-scoped values. Externally supplied values remain external unless owned explicitly; created values are released in dependency order. A command is not retried or cached automatically; cancellation does not roll back an already applied mutation.
+
+## Query cache partitions
+
+Cached queries with invocation bindings or an invocation-specific `fetch` default to execution-local reuse, even with `scope: "runtime"`. Bindings can contain opaque resources and tenant-specific providers, so the runtime does not serialize them into a shared key. Web and SSR hosts also supply bindings and therefore use this isolation by default. Queries without invocation bindings/fetch retain runtime reuse partitioned by identity, locale and input.
+
+To share completed results across executions, explicitly declare the complete trusted security partition:
+
+```ts
+const tenantSummary = defineOperation({
+    id: "tenant-summary",
+    kind: "query",
+    cache: {
+        ttlMs: 10_000,
+        partition: (context) => {
+            const tenant = context.bindings.tenant;
+            if (typeof tenant !== "string") throw new ExecutionError("configuration");
+            return tenant;
+        },
+    },
+    handler: loadTenantSummary,
+});
+```
+
+The partition must cover every result-affecting binding and fetch authority in addition to the existing identity, locale and input key. A constant partition asserts that the result is independent of all other invocation state. `cache.key(input)` still controls only the input key; it cannot enable shared caching by itself. Policies run before every cache hit, invalidation still applies across partitions, and `scope: "execution"` always remains local.

package/docs/pitfalls/ssr-hydration-mismatch.md

@@ -5,3 +5,13 @@ Share the same page definition, App and Outlet view registry between browser and
 Hydrate the server snapshot before restoring persisted state. Avoid random values, time or browser globals during the first render. Do not await ready before mounting or manually mutate Outlet's child tree.
 
 Declare explicit public projections; nested data needs a nested declaration or codec. Wire/buildId mismatches trigger fresh loading. Inspect browser warnings, DOM, requests and entry identity when diagnosing a mismatch.
+
+Declare the site's locale in `defineWebApp({ configuration: { locale: "en" }, ... })` so SSR and the browser use the same value. The SSR assembler writes `lang` and `dir` on `<html>`. The browser also scopes those attributes to the selected app target, together with `data-fs-app`, so embedded applications can retain their own locale without changing the containing document. A static `<html lang="en">` alone does not configure the server runtime's locale.
+
+`injectSSRContent` also stamps a compact fingerprint of the data script's parent container. `createBrowserApp` compares that fingerprint immediately before returning the native mount handle, after consuming valid SSR data. This detects changed attributes, text, comments and structure without identifying browser extensions. The comparison follows parsed HTML rather than raw HTML strings; custom element hosts and their contents are opaque to this check. Root attributes and nodes outside the app are outside its scope.
+
+When the DOM changed and replacement is safe, `shouldHydrate` is false: the existing React/Vue/Svelte template mounts a fresh native root using the SSR page data. It does not restart the page controller. The host logs `source: "hydration", code: "dom-changed", recovery: "native-mount"`. No plugin rules, global console filters or repeated recovery loop are installed. Normal markup continues to hydrate, and SPA navigation does not repeat the check.
+
+The host keeps native hydration when it detects existing focus, selection, edited controls, scrolling, editable content, active media, custom elements, nested apps or opaque browser contexts. That path logs `recovery: "deferred"`; native warnings and native hydration behavior remain in effect. It avoids an additional destructive remount, but cannot guarantee preservation if the native renderer itself fails hydration. Manually assembled HTML without a fingerprint, or a data script outside the selected target, retains the usual native hydration behavior.
+
+This is a startup recovery boundary, not extension isolation or a security check. A changed fingerprint does not identify the cause: an extension, application script or HTML rewriter can all modify DOM. Head styles, opaque component internals, changes after inspection and errors in an extension's own execution context are not repaired. Native mismatches with an unchanged server DOM are still reported normally.

package/docs/zh/02-routing-and-controllers.md

@@ -150,6 +150,8 @@ export class AccountController extends BaseServerController {
 
 服务端 Controller 模块只导出 Controller 类和类型。该模块的本地运行时依赖也属于服务端边界；客户端直接导入这些依赖会报错。共享类型请使用 `import type`，共享的客户端实现放在独立模块。构造函数内的依赖创建属于受保护模块；不要在共享的 `create` 工厂参数、共享配置或页面组件中写入机密。
 
+编译器识别模块级类声明、绑定到变量或默认导出的类表达式、括号／类型断言、本地别名、命名空间导入及静态转导出。涉及原始服务端基类但无法安全代理的工厂或计算属性形式会令浏览器构建报错，不再直接返回原始源码；出现该诊断时改用模块级类。纯转导出模块和使用生成代理的普通业务模块仍可共享。
+
 生产客户端 JS / source map 不包含被替换的实现。开发服务拒绝 Controller 的原始资源导入和受保护依赖的源码请求。模块与依赖索引在启动时建立，后续缓存 AST，只重新分析变更文件；开发期间已识别的私有依赖保持保护，若要将它迁回共享模块，应重启开发服务。动态计算的文件路径、`public/` 资源和另行复制的源码不属于静态导入边界。开发服务器仍只用于受信任的开发环境。
 
 使用框架 Vite 插件及具有 SSR 请求处理能力的 Node / Worker 等宿主。纯静态托管没有远程执行端点。此入口用于注册的服务端页面 Controller，不会自动发布任意方法或代替登录、注册等命令端点。

package/docs/zh/04-rendering-and-hydration.md

@@ -8,4 +8,6 @@ Outlet 订阅稳定的 `AppSnapshot`，以 EntryId 保持外层元素，以 Entr
 
 SSR 在释放请求资源前物化公开投影，原生组件只渲染一次。水合协议明确包含 `{ tree, pages }`，每份页面数据关联 entry。协议版本或 buildId 不匹配时重新加载；会话持久化另有版本。被守卫拒绝的页面数据不进入 wire。
 
+标准 SSR 组装流程会生成初始 DOM 的校验值。原生挂载前发现 DOM 已变化，且没有需要保留的浏览器状态时，框架会使用同一份 SSR 数据选择重新挂载，无需按插件编写规则。详见[水合恢复及其边界](./pitfalls/ssr-hydration-mismatch.md)。
+
 CSR 返回 HTML shell。prerender 输出静态 HTML；运行时公开 HTML 缓存仍先运行本次守卫与渲染，不能视为跳过业务执行。清理时应用先等待会话 dispose，再卸载自己的原生根。

package/docs/zh/09-server-and-deployment.md

@@ -77,6 +77,19 @@ Node 主机需要 `@hono/node-server`。可移植 Worker 图无需 Node 兼容
 
 当 `setup` 是模块路径时，该模块必须通过 `export default` 导出 setup 函数。开发、预览与生成的部署主机统一使用这个导出，不再自动猜测命名函数。
 
+`setup` 先于声明式代理运行，先注册的 `app.use(...)` 鉴权中间件因此也保护代理请求。请先注册鉴权，再注册终止请求的处理器；setup 中同路径的终止路由会覆盖代理。配置的 setup 加载失败时，预览启动失败。代理的 `auth` 仅提供上游凭据，不认证调用者；未安装应用鉴权的代理仍公开可用。
+
+Cloudflare 适配器没有连接时 DNS 校验能力，因此 `SAFE_FETCH` 默认拒绝任意域名。访问已知可信 API 时，显式配置完整来源：
+
+```ts
+import { cloudflareAdapter, finesoftFrontViteConfig } from "@finesoft/front";
+finesoftFrontViteConfig({
+    adapter: cloudflareAdapter({ trustedOrigins: ["https://api.example.com"] }),
+});
+```
+
+这是对该来源的显式信任例外，不是 DNS 地址固定。来源包含协议和端口，不支持路径、通配符或前缀匹配；重定向逐跳重查，私有 IP 字面量仍被拒绝。相对路径的进程内 API 调用保持可用。`"cloudflare"` 字符串快捷方式使用空的可信来源列表。
+
 ## 静态托管边界
 
 `staticAdapter` 默认读取构建产物的 `render.routes`，通过同一 SSR host 生成 HTML 并等待释放；`dynamicRoutes` 提供具体动态路径，`routesExport` 仅作显式扩展。发现路由或渲染失败会令构建失败。纯 HTML 不能表达重定向、错误状态、Set-Cookie 或自定义 HTTP 响应头，因此适配器拒绝这些响应；需要它们时选择 Node/Worker 等请求主机。

package/docs/zh/pitfalls/ssr-hydration-mismatch.md

@@ -5,3 +5,13 @@
 先水合服务器快照，再恢复持久化状态。避免首次渲染读取随机数、时间或浏览器独有全局。不要在挂载前等待 ready，也不要手动改动 Outlet 的子树。
 
 显式声明公开数据投影；嵌套对象需要嵌套声明或 codec。wire/buildId 不匹配时重新加载。排查时同时检查实际浏览器警告、页面 DOM、网络请求和 entry 身份。
+
+整站语言应在 `defineWebApp({ configuration: { locale: "en" }, ... })` 中声明，让 SSR 与浏览器使用同一个值。SSR 组装器在 `<html>` 上输出 `lang`、`dir`；浏览器还会在所选应用容器上设置这两个属性和 `data-fs-app`，使嵌入应用能使用自己的语言而不改动宿主文档。仅在静态模板中写 `<html lang="en">`，不会配置服务端运行时的 locale。
+
+`injectSSRContent` 会在数据脚本上附带其父容器的 DOM 校验值。`createBrowserApp` 消费有效的 SSR 数据后，在返回原生挂载句柄前核对校验值，检测属性、文本、注释和结构变化，不识别具体浏览器插件。比较对象是解析后的 HTML，不是原始 HTML 字符串；自定义元素的宿主属性及内部内容由组件自己管理，不进入比较。根容器自身的属性和应用外部节点也不在检查范围内。
+
+DOM 已变化且可以安全替换时，`shouldHydrate` 返回 false，现有 React/Vue/Svelte 模板使用 SSR 页面数据重新挂载原生根，不重新执行页面控制器。宿主记录 `source: "hydration", code: "dom-changed", recovery: "native-mount"`。没有插件名单、全局日志过滤或反复重建循环。正常 DOM 继续水合，SPA 导航不重复检查。
+
+存在焦点、选区、已修改表单、滚动、可编辑内容、活动媒体、自定义元素、嵌套应用或不透明的浏览器上下文时，宿主继续原生水合，记录 `recovery: "deferred"`，保留原生水合行为及诊断。这避免框架额外强制重建，但原生渲染器自身水合失败时仍不能保证状态保留。手工组装 HTML 未附带校验值，或数据脚本不直接位于所选 target 内时，保持通常的原生水合流程。
+
+这是启动恢复边界，不是插件隔离或安全校验。校验值变化不能确定来源：插件、应用脚本及 HTML 改写服务都可能修改 DOM。它不修复 head 中的样式、组件自己的内部结构、检查之后发生的改动或扩展自身运行环境中的错误。服务端 DOM 未变化时，应用自身的水合错误仍正常报告。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finesoft/front",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Application runtime, routing, native UI and platform hosts through one public API",
   "license": "MIT",
   "repository": {
@@ -12,15 +12,15 @@
     "finesoft-types": "./dist/typegen-cli.mjs"
   },
   "files": [
-    "dist/browser-DIU6Sxl3.mjs",
-    "dist/browser-kFMjlLGT.d.mts",
+    "dist/browser-CrZcKSpr.d.mts",
+    "dist/browser-D6If-9VF.mjs",
     "dist/browser.d.mts",
     "dist/browser.mjs",
     "dist/controller-types-CgmJ6-le.d.mts",
-    "dist/cookies-Bpf9VayB.d.mts",
-    "dist/fetch-policy-BHT8RtrL.mjs",
-    "dist/host-guard-DDWxLpFL.mjs",
-    "dist/http-B6CJqDyf.d.mts",
+    "dist/cookies-BXCwZoS_.d.mts",
+    "dist/fetch-policy-Cxk7F-Cu.mjs",
+    "dist/host-guard-DX4e3-45.mjs",
+    "dist/http-B8r7MWao.d.mts",
     "dist/http-CaxrMD1A.d.mts",
     "dist/http-D70PL72H.mjs",
     "dist/http.d.mts",
@@ -35,36 +35,36 @@
     "dist/load-portable.mjs",
     "dist/lru-map-BKoUAySU.mjs",
     "dist/messages-CAt2QdGr.mjs",
-    "dist/native-contract-DuR25hYB.d.mts",
+    "dist/native-contract-B_2pn5ST.d.mts",
     "dist/native-contract.d.mts",
     "dist/native-contract.mjs",
-    "dist/node-D9hB4dsz.d.mts",
+    "dist/node-DbGzbatF.d.mts",
     "dist/node.d.mts",
     "dist/node.mjs",
     "dist/Outlet.svelte",
     "dist/Outlet.svelte.d.ts",
+    "dist/path-C-b1ChKq.d.mts",
     "dist/path-CGFl2w7D.mjs",
-    "dist/path-CXT6xGPO.d.mts",
     "dist/portable-CaxrMD1A.d.mts",
     "dist/portable.d.mts",
     "dist/portable.mjs",
-    "dist/proxy-1SphZ7x7.mjs",
     "dist/proxy-2dSWO-Xw.d.mts",
+    "dist/proxy-BkKVP3Ha.mjs",
     "dist/public-types-BcJM-AYc.mjs",
-    "dist/react-DhwBRw01.d.mts",
+    "dist/react-C8AnI9sx.d.mts",
     "dist/react.d.mts",
     "dist/react.mjs",
     "dist/rolldown-runtime-B4iAMlE-.mjs",
-    "dist/secure-fetch-Xlht2jd7.d.mts",
-    "dist/server-controller-proxy-BkVuVWVD.d.mts",
-    "dist/session-DnB4ZC3x.d.mts",
+    "dist/secure-fetch--QwYr5uJ.d.mts",
+    "dist/server-controller-proxy-CFdU_nGs.d.mts",
+    "dist/session-BR1vd3yY.d.mts",
+    "dist/src-D_Bzbr80.mjs",
     "dist/src-Ftl_0rhu.mjs",
-    "dist/src-qwx7Vw8g.mjs",
-    "dist/ssr-BEUNDvbj.d.mts",
-    "dist/ssr-C8xnYXoY.mjs",
+    "dist/ssr-DqwPGqOd.mjs",
+    "dist/ssr-lzuGJ2ux.d.mts",
     "dist/ssr.d.mts",
     "dist/ssr.mjs",
-    "dist/svelte-Dr5to3SE.d.mts",
+    "dist/svelte-CMFFDLBi.d.mts",
     "dist/svelte.d.mts",
     "dist/svelte.mjs",
     "dist/typegen-C-WeJCtf.d.mts",
@@ -72,12 +72,12 @@
     "dist/typegen-cli.mjs",
     "dist/typegen.d.mts",
     "dist/typegen.mjs",
-    "dist/types-BuaZHRG7.mjs",
+    "dist/types-DD09OkGZ.mjs",
     "dist/undici-CPfL25Hr.mjs",
-    "dist/vite-Cj4SPA8D.d.mts",
+    "dist/vite-BjWtbemg.d.mts",
     "dist/vite.d.mts",
     "dist/vite.mjs",
-    "dist/vue-DGmzuKho.d.mts",
+    "dist/vue-DsZIYP1c.d.mts",
     "dist/vue.d.mts",
     "dist/vue.mjs",
     "dist/web.d.mts",

package/dist/proxy-1SphZ7x7.mjs

@@ -1,436 +0,0 @@
-import { Bt as fetchWithRedirects, _ as SERVER_CONTROLLER_PATH, kt as getLocaleAttributes, t as parseCookieString } from "./src-qwx7Vw8g.mjs";
-import { t as LruMap } from "./lru-map-BKoUAySU.mjs";
-import "./src-Ftl_0rhu.mjs";
-//#region ../ssr/src/inject.ts
-/**
-* injectSSRContent — 将 SSR 渲染结果注入 HTML 模板
-*/
-/** SSR HTML 模板占位符常量 */
-const SSR_PLACEHOLDERS = {
-	HEAD: "<!--ssr-head-->",
-	BODY: "<!--ssr-body-->",
-	DATA: "<!--ssr-data-->"
-};
-/** 匹配所有 <!--ssr-xxx--> 占位符（含内置与自定义） */
-const PLACEHOLDER_REGEX = /<!--ssr-([a-z][a-z0-9-]*)-->/g;
-function injectSSRContent(options) {
-	const { template, head, css, html, serializedData, slots, locale } = options;
-	const replacements = {
-		head: `${head}\n${css ? `<style>${css}</style>` : ""}`,
-		body: html,
-		data: `<script data-fs-server-data type="application/json">${serializedData}<\/script>`,
-		...slots
-	};
-	let result = template.replace(PLACEHOLDER_REGEX, (_, name) => replacements[name] ?? "");
-	if (locale) result = applyLocaleToHtml(result, locale);
-	return result;
-}
-/**
-* CSR 空壳注入 — 清空所有占位符
-* 用于 renderMode === "csr" 的路由
-*
-* @param locale - 可选的 locale 属性，注入到 `<html lang="" dir="">`
-*/
-function injectCSRShell(template, locale) {
-	let result = template.replace(PLACEHOLDER_REGEX, () => "");
-	if (locale) result = applyLocaleToHtml(result, locale);
-	return result;
-}
-/** 将 lang/dir 注入到 <html> 标签（支持双引号 / 单引号 / 无引号属性值） */
-const HTML_LANG_PATTERN = /\s+lang=("[^"]*"|'[^']*'|[^\s>]+)/gi;
-const HTML_DIR_PATTERN = /\s+dir=("[^"]*"|'[^']*'|[^\s>]+)/gi;
-function applyLocaleToHtml(html, locale) {
-	return html.replace(/(<html)([^>]*)(>)/i, (_match, open, attrs, close) => {
-		return `${open}${attrs.replace(HTML_LANG_PATTERN, "").replace(HTML_DIR_PATTERN, "")} lang="${escapeAttribute(locale.lang)}" dir="${escapeAttribute(locale.dir)}"${close}`;
-	});
-}
-function escapeAttribute(value) {
-	return value.replace(/[&<>"']/g, (character) => {
-		switch (character) {
-			case "&": return "&amp;";
-			case "<": return "&lt;";
-			case ">": return "&gt;";
-			case "\"": return "&quot;";
-			default: return "&#39;";
-		}
-	});
-}
-//#endregion
-//#region ../server/src/internal-fetch.ts
-/**
-* createInternalFetch — SSR 内部路由回环 fetch 包装器
-*
-* 将相对路径（/api/…）请求转为 Hono app.fetch 内存调用，
-* 绝对 URL 和非字符串 input 走 globalThis.fetch（真实网络）。
-*
-* 递归深度保护采用请求头传递：每次 SSR 回环在请求头中写入深度值，
-* SSR catch-all 读取深度判断是否超限。对比闭包计数器方案：
-* - 并发安全：无共享可变状态
-* - 跨渲染准确：深度随请求在 Hono 路由链中传递
-*/
-const SSR_DEPTH_HEADER = "x-ssr-depth";
-/**
-* 创建请求级 internal fetch
-*
-* @param appFetch - Hono app.fetch（父级路由）
-* @param depth - 当前 SSR 深度（由 catch-all handler 从请求头读取后 +1 传入）
-*/
-function createInternalFetch(appFetch, depth = 1, context) {
-	return ((input, init) => {
-		if (typeof input === "string" && input.startsWith("/")) {
-			const base = context?.request.url ?? "http://localhost";
-			const target = new URL(input, base);
-			if (target.origin !== new URL(base).origin) throw new TypeError("Internal fetch must stay on the request origin");
-			const signal = context ? AbortSignal.any([context.request.signal, ...init?.signal ? [init.signal] : []]) : init?.signal;
-			const request = new Request(target, {
-				...init,
-				signal
-			});
-			request.headers.set(SSR_DEPTH_HEADER, String(depth));
-			return Promise.resolve(appFetch(request, context?.bindings));
-		}
-		const signal = context ? AbortSignal.any([
-			context.request.signal,
-			...input instanceof Request ? [input.signal] : [],
-			...init?.signal ? [init.signal] : []
-		]) : init?.signal;
-		return globalThis.fetch(input, signal ? {
-			...init,
-			signal
-		} : init);
-	});
-}
-//#endregion
-//#region ../server/src/ssr-cache.ts
-/** Shared HTML must be explicitly public and carry no request-specific response metadata. */
-function isPublicSSRResult(result, headers = new Headers(result.headers)) {
-	return result.cache === "public" && !result.redirect && !result.rewriteUrl && (result.status ?? 200) === 200 && headers.keys().next().done === true;
-}
-//#endregion
-//#region ../server/src/ssr-handler.ts
-function matchRenderModeOverride(url, renderModes) {
-	const path = url.split("?")[0];
-	if (renderModes?.[path]) return renderModes[path];
-	for (const [pattern, mode] of Object.entries(renderModes ?? {})) if (pattern.includes("*")) {
-		const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
-		if (new RegExp("^" + escaped.replace(/\*/g, ".*") + "$").test(path)) return mode;
-	}
-}
-/** Standard Request/Response HTML assembly; owns no Node, Hono, filesystem or Vite state. */
-function createSSRHandler(options) {
-	const cache = options.cache ?? new LruMap(1e3);
-	const ownRenderers = options.ownRenderers ?? false;
-	const owners = /* @__PURE__ */ new Set();
-	if (ownRenderers && "render" in options) owners.add(options.render);
-	const active = /* @__PURE__ */ new Set();
-	let closing;
-	const respond = async (request, bindings = {}) => {
-		const parsed = new URL(request.url);
-		const url = parsed.pathname + parsed.search;
-		const depth = Number(request.headers.get("x-ssr-depth") ?? 0);
-		const remote = parsed.pathname === SERVER_CONTROLLER_PATH;
-		if (!Number.isInteger(depth) || depth < 0 || depth >= 5) return new Response("SSR recursion loop detected", { status: 508 });
-		if (remote && (request.method !== "POST" || request.headers.get("origin") !== parsed.origin || request.headers.get("x-finesoft-controller") !== "1" || request.headers.get("sec-fetch-site") === "cross-site" || request.headers.get("content-type")?.split(";")[0]?.trim() !== "application/json")) return new Response("Forbidden", {
-			status: 403,
-			headers: { "cache-control": "no-store" }
-		});
-		if (!remote && request.method !== "GET" && request.method !== "HEAD") return new Response("Method not allowed", {
-			status: 405,
-			headers: { Allow: "GET, HEAD" }
-		});
-		const requestState = {
-			request,
-			responseHeaders: new Headers(),
-			remote,
-			cookies: parseCookieString(request.headers.get("cookie") ?? "")
-		};
-		try {
-			request.signal.throwIfAborted();
-			const template = remote ? "" : typeof options.template === "string" ? options.template : await options.template(request);
-			const override = matchRenderModeOverride(url, options.renderModes);
-			const defaultLocale = options.defaultLocale ? getLocaleAttributes(options.defaultLocale) : void 0;
-			const respond = (html, status = 200, headers = new Headers()) => {
-				if (!headers.has("content-type")) headers.set("content-type", "text/html; charset=utf-8");
-				return new Response(request.method === "HEAD" || status === 204 || status === 304 ? null : html, {
-					status,
-					headers
-				});
-			};
-			if (!remote && override === "csr") return respond(injectCSRShell(template, defaultLocale));
-			const publicRequest = !request.headers.has("cookie") && !request.headers.has("authorization");
-			const module = "loadModule" in options ? await options.loadModule(request) : options;
-			if (ownRenderers) owners.add(module.render);
-			const context = {
-				request,
-				bindings,
-				requestState,
-				safeFetch: options.safeFetch,
-				fetch: options.fetch ? createInternalFetch(options.fetch, depth + 1, {
-					request,
-					bindings
-				}) : void 0
-			};
-			let result;
-			if (remote) {
-				if (!module.render.controller) return new Response("Not found", {
-					status: 404,
-					headers: { "cache-control": "no-store" }
-				});
-				const input = await readControllerRequest(request);
-				if (!input) return new Response("Invalid controller request", {
-					status: 400,
-					headers: { "cache-control": "no-store" }
-				});
-				result = await module.render.controller(input, context);
-			} else result = await module.render(url, context);
-			request.signal.throwIfAborted();
-			const headers = requestState.responseHeaders;
-			if (result.headers && result.headers !== headers) {
-				const supplied = new Headers(result.headers);
-				for (const [key, value] of supplied) if (key !== "set-cookie") headers.set(key, value);
-				for (const cookie of supplied.getSetCookie()) headers.append("set-cookie", cookie);
-			}
-			if (remote) {
-				headers.set("content-type", "application/json");
-				headers.set("cache-control", "no-store");
-				if (result.rewriteUrl) headers.set("content-location", result.rewriteUrl);
-				const body = result.redirect ? JSON.stringify({ redirect: result.redirect }) : result.status && result.status >= 400 ? JSON.stringify({ rejection: {
-					status: result.status,
-					message: result.status === 401 ? "Authentication required" : result.status === 403 ? "Access denied" : result.status === 404 ? "Page not found" : "Page load failed"
-				} }) : module.serializeServerData(result.serverData);
-				return new Response(body, { headers });
-			}
-			if (result.redirect) {
-				headers.set("location", result.redirect.url);
-				return new Response(null, {
-					status: result.redirect.status,
-					headers
-				});
-			}
-			const locale = typeof result.locale === "string" ? getLocaleAttributes(result.locale) : result.locale ?? defaultLocale;
-			if (result.rewriteUrl) headers.set("content-location", result.rewriteUrl);
-			const mode = override ?? result.renderMode;
-			const eligible = mode === "prerender" && publicRequest && isPublicSSRResult(result, headers);
-			const cacheKey = JSON.stringify([
-				parsed.href,
-				locale?.lang,
-				locale?.dir
-			]);
-			const cached = eligible ? await cache.get(cacheKey) : void 0;
-			if (cached !== void 0 && cached !== null) return respond(cached, 200, new Headers(options.publicCacheHeaders));
-			const html = mode === "csr" ? injectCSRShell(template, locale) : injectSSRContent({
-				template,
-				html: result.html,
-				head: result.head,
-				css: result.css,
-				serializedData: module.serializeServerData(result.serverData),
-				slots: result.slots,
-				locale
-			});
-			if (eligible) {
-				await cache.set(cacheKey, html);
-				for (const [key, value] of Object.entries(options.publicCacheHeaders ?? {})) headers.set(key, value);
-			}
-			return respond(html, result.status, headers);
-		} catch (error) {
-			try {
-				options.onError?.(error);
-			} catch {}
-			const headers = new Headers(requestState.responseHeaders);
-			headers.set("content-type", "text/plain; charset=utf-8");
-			headers.set("cache-control", "no-store");
-			return new Response(request.signal.aborted ? "Execution cancelled" : "Internal Server Error", {
-				status: request.signal.aborted ? 499 : 500,
-				headers
-			});
-		}
-	};
-	return {
-		fetch(request, bindings) {
-			if (closing) return Promise.resolve(new Response("Application closed", { status: 503 }));
-			const work = respond(request, bindings);
-			active.add(work);
-			work.then(() => active.delete(work), () => active.delete(work));
-			return work;
-		},
-		dispose: () => closing ??= (async () => {
-			while (active.size) await Promise.allSettled(active);
-			const results = await Promise.allSettled([...owners].map(async (render) => {
-				await render.dispose?.();
-			}));
-			owners.clear();
-			const errors = results.filter((result) => result.status === "rejected").map((result) => result.reason);
-			if (errors.length) throw new AggregateError(errors, "SSR cleanup failed");
-		})()
-	};
-}
-async function readControllerRequest(request) {
-	const reader = request.body?.getReader();
-	if (!reader) return;
-	const chunks = [];
-	let size = 0;
-	try {
-		for (;;) {
-			const { value, done } = await reader.read();
-			if (done) break;
-			size += value.byteLength;
-			if (size > 65536) {
-				await reader.cancel();
-				return;
-			}
-			chunks.push(value);
-		}
-		const bytes = new Uint8Array(size);
-		let offset = 0;
-		for (const chunk of chunks) {
-			bytes.set(chunk, offset);
-			offset += chunk.length;
-		}
-		const value = JSON.parse(new TextDecoder().decode(bytes));
-		const record = (item) => item !== null && typeof item === "object" && !Array.isArray(item);
-		if (!record(value) || typeof value.intent !== "string" || !value.intent || typeof value.url !== "string" || !record(value.params) || !record(value.query)) return;
-		if (value.url && (!value.url.startsWith("/") || new URL(value.url, request.url).origin !== new URL(request.url).origin)) return;
-		return {
-			intent: value.intent,
-			params: value.params,
-			query: value.query,
-			url: value.url
-		};
-	} catch {
-		return;
-	} finally {
-		reader.releaseLock();
-	}
-}
-//#endregion
-//#region ../server/src/proxy.ts
-/**
-* 框架级声明式代理路由
-*
-* 将代理路由从业务层手写 Hono 路由，改为框架级配置。
-* 框架统一执行路径校验（SSRF 防护）、Host 限制、错误处理、响应头控制。
-*/
-/** 代理路径最大长度 */
-const MAX_PROXY_PATH_LENGTH = 2048;
-/** 代理响应最大体积（10 MB） */
-const MAX_RESPONSE_SIZE = 10485760;
-/**
-* 校验代理路径，防止 SSRF（协议相对 URL 绕过、编码绕过）。
-* 返回规范化的路径，或 null 表示非法。
-*
-* 策略保守：拒绝任何含编码字符的路径，避免上游对 %2F 等解码差异导致绕过。
-* 副作用：合法的 %20、%E4%B8%AD（Unicode）也会被拒。
-* 如需放宽，应在上层路由前自行 decode，或为该代理单独提供 sanitizer 选项。
-*/
-function sanitizeProxyPath(raw) {
-	if (raw.length > MAX_PROXY_PATH_LENGTH) return null;
-	try {
-		if (decodeURIComponent(raw) !== raw) return null;
-	} catch {
-		return null;
-	}
-	if (raw.startsWith("//")) return null;
-	if (!/^[/\w.\-~%:@!$&'()*+,;=]*$/.test(raw)) return null;
-	return raw.startsWith("/") ? raw : `/${raw}`;
-}
-/**
-* 校验代理配置合法性。
-* 在注册时（启动阶段）调用，非法配置直接抛错阻止启动。
-*/
-function validateConfig(config) {
-	if (!config.prefix.startsWith("/")) throw new Error(`[proxy] prefix must start with "/": "${config.prefix}"`);
-	const isHttps = config.target.startsWith("https://");
-	const isHttp = config.target.startsWith("http://");
-	if (!isHttps && !isHttp) throw new Error(`[proxy] target must start with "https://" or "http://": "${config.target}"`);
-	if (isHttp) console.warn(`[proxy] ⚠ target "${config.target}" uses plain HTTP — traffic will not be encrypted. Use HTTPS in production to prevent data interception.`);
-}
-/**
-* 注册声明式代理路由到 Hono app（运行时使用：Vite dev / preview / generated hosts）
-*/
-function registerProxyRoutes(app, configs) {
-	for (const config of configs) {
-		validateConfig(config);
-		const methods = config.methods ?? ["all"];
-		const pattern = `${config.prefix}/*`;
-		const handler = createProxyHandler(config);
-		for (const method of methods) app[method](pattern, handler);
-	}
-}
-function createProxyHandler(config) {
-	return async (c) => {
-		const subPath = sanitizeProxyPath(c.req.path.replace(config.prefix, ""));
-		if (!subPath) return c.text("Invalid path", 400);
-		const targetUrl = new URL(subPath, config.target);
-		const expectedOrigin = new URL(config.target).origin;
-		if (targetUrl.origin !== expectedOrigin) return c.text("Invalid proxy target", 400);
-		new URL(c.req.url).searchParams.forEach((v, k) => targetUrl.searchParams.set(k, v));
-		const headers = { ...config.headers };
-		if (config.auth) {
-			const token = globalThis.process?.env?.[config.auth.envKey];
-			if (!token) console.warn(`[Proxy ${config.prefix}] Auth env var "${config.auth.envKey}" is not set`);
-			else headers.Authorization = config.auth.type === "bearer" ? `Bearer ${token}` : `Basic ${token}`;
-		}
-		try {
-			const resp = await fetchWithRedirects(fetch, targetUrl.toString(), {
-				headers,
-				redirect: config.followRedirects ? "follow" : "manual"
-			}, (url) => {
-				if (new URL(url).origin !== expectedOrigin) throw new TypeError("Invalid proxy redirect target");
-			});
-			const contentLength = resp.headers.get("Content-Length");
-			if (contentLength && parseInt(contentLength, 10) > MAX_RESPONSE_SIZE) {
-				resp.body?.cancel().catch(() => {});
-				return c.text("Proxy response too large", 502);
-			}
-			const body = await readProxyBody(resp);
-			if (!body) return c.text("Proxy response too large", 502);
-			const respHeaders = { "Content-Type": resp.headers.get("Content-Type") ?? "application/json" };
-			if (config.cache) respHeaders["Cache-Control"] = config.cache;
-			return c.newResponse(body, resp.status, respHeaders);
-		} catch (e) {
-			console.error(`[Proxy ${config.prefix}]`, e);
-			return c.json({ error: "Proxy request failed" }, 502);
-		}
-	};
-}
-/** Bound allocation while preserving binary bytes, even without Content-Length. */
-async function readProxyBody(response) {
-	if (!response.body) return /* @__PURE__ */ new ArrayBuffer(0);
-	const reader = response.body.getReader();
-	const chunks = [];
-	let size = 0;
-	try {
-		for (;;) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			size += value.byteLength;
-			if (size > MAX_RESPONSE_SIZE) {
-				reader.cancel().catch(() => {});
-				return;
-			}
-			chunks.push(value);
-		}
-	} finally {
-		reader.releaseLock();
-	}
-	const body = new Uint8Array(size);
-	let offset = 0;
-	for (const chunk of chunks) {
-		body.set(chunk, offset);
-		offset += chunk.byteLength;
-	}
-	return body.buffer;
-}
-/**
-* 生成代理路由注册代码（用于 serverless/edge 入口）。
-* 生成的入口从公开 SSR 边界导入 registerProxyRoutes，因此安全策略只有一个运行时实现。
-*/
-function generateProxyCode(configs) {
-	if (!configs || configs.length === 0) return "";
-	for (const config of configs) validateConfig(config);
-	return `// ─── 框架声明式代理路由 ───\nregisterProxyRoutes(app, ${JSON.stringify(configs)});`;
-}
-//#endregion
-export { isPublicSSRResult as a, injectSSRContent as c, matchRenderModeOverride as i, registerProxyRoutes as n, SSR_PLACEHOLDERS as o, createSSRHandler as r, injectCSRShell as s, generateProxyCode as t };
-
-//# sourceMappingURL=proxy-1SphZ7x7.mjs.map