@finesoft/front 0.5.3 → 0.5.4

package/dist/vite.mjs

@@ -1,5 +1,5 @@
-import { a as isPublicSSRResult, i as matchRenderModeOverride, n as registerProxyRoutes, r as createSSRHandler, t as generateProxyCode } from "./proxy-z02VvGIj.mjs";
-import { r as dynamicImport, t as nodeSafeFetchOptions } from "./fetch-policy-BHT8RtrL.mjs";
+import { a as isPublicSSRResult, i as matchRenderModeOverride, n as registerProxyRoutes, r as createSSRHandler, t as generateProxyCode } from "./proxy-BkKVP3Ha.mjs";
+import { r as dynamicImport, t as nodeSafeFetchOptions } from "./fetch-policy-Cxk7F-Cu.mjs";
 import { n as createControllerTypeWatcher, r as generateControllerTypes, t as generateFrontTypes } from "./public-types-BcJM-AYc.mjs";
 import { createRequire } from "node:module";
 import fs from "node:fs";
@@ -85,8 +85,8 @@ const RENDER_MODES = ${JSON.stringify(ctx.renderModes ?? {})};
 const DEFAULT_LOCALE = ${JSON.stringify(ctx.defaultLocale ?? null)};
 ${opts.platformCache ?? ""}
 const app = new Hono();
-${generateProxyCode(ctx.proxies ?? [])}
 ${ctx.setupPath ? "await _setupDefault(app);" : ""}
+${generateProxyCode(ctx.proxies ?? [])}
 ${opts.platformMiddleware ?? ""}
 const ssr = createSSRHandler({
         ownRenderers: true,
@@ -95,7 +95,7 @@ const ssr = createSSRHandler({
     serializeServerData,
     renderModes: RENDER_MODES,
     defaultLocale: DEFAULT_LOCALE,
-    safeFetch: ${opts.dnsPolicy === "hostname" ? "{ validateDns: false }" : "_safeFetchOptions"},
+    safeFetch: ${opts.dnsPolicy === "hostname" ? JSON.stringify({ trustedOrigins: opts.trustedOrigins ?? [] }) : "_safeFetchOptions"},
     fetch: (request, bindings) => app.fetch(request, bindings),
     ${opts.platformCache ? "cache: {get: platformCacheGet, set: platformCacheSet}," : ""}
     ${opts.publicCacheHeaders ? `publicCacheHeaders: ${JSON.stringify(opts.publicCacheHeaders)},` : ""}
@@ -224,7 +224,12 @@ async function prerenderRoutes(ctx) {
 * 注意：Cloudflare Workers 不支持原生 Node.js API。
 * 若 setup 代理使用了 process.env，需在 wrangler.toml 启用 nodejs_compat。
 */
-function cloudflareAdapter() {
+function cloudflareAdapter(options = {}) {
+	const trustedOrigins = [...options.trustedOrigins ?? []];
+	for (const origin of trustedOrigins) {
+		const parsed = new URL(origin);
+		if (parsed.origin !== origin || !["https:", "http:"].includes(parsed.protocol)) throw new TypeError(`Expected an exact HTTP(S) origin: ${origin}`);
+	}
 	return {
 		name: "cloudflare",
 		async build(ctx) {
@@ -236,6 +241,7 @@ function cloudflareAdapter() {
 			});
 			await buildGeneratedEntry(ctx, ".cf-entry.tmp.mjs", generateSSREntry(ctx, {
 				dnsPolicy: "hostname",
+				trustedOrigins,
 				platformImport: ``,
 				platformExport: `export default app;`,
 				platformCache: `
@@ -334,7 +340,7 @@ function nodeAdapter() {
 			await buildGeneratedEntry(ctx, ".node-entry.tmp.mjs", generateSSREntry(ctx, {
 				platformImport: `import { startNodeHandler } from "@finesoft/front";
 import { readFileSync, existsSync } from "node:fs";
-import { resolve, dirname } from "node:path";
+import { resolve, dirname, relative, isAbsolute, sep } from "node:path";
 import { fileURLToPath } from "node:url";`,
 				platformMiddleware: `
 // 预渲染文件中间件：检查 dist/prerender/ 下是否有对应的静态 HTML
@@ -349,6 +355,8 @@ app.use("*", async (c, next) => {
   ];
   if (urlPath === "/") candidates.unshift(resolve(prerenderDir, "index.html"));
   for (const f of candidates) {
+    const contained = relative(prerenderDir, f);
+    if (contained === ".." || contained.startsWith(".." + sep) || isAbsolute(contained)) continue;
     if (existsSync(f)) {
       const html = readFileSync(f, "utf-8");
       return c.html(html);
@@ -604,7 +612,99 @@ function serverControllerModules(getRoot) {
 		return source;
 	};
 	const has = (node, kind) => getCompiler().canHaveModifiers(node) && getCompiler().getModifiers(node)?.some((m) => m.kind === kind);
-	async function exported(context, specifier, importer, name, seen) {
+	function unwrap(node) {
+		const c = getCompiler();
+		while (c.isParenthesizedExpression(node) || c.isAsExpression(node) || c.isTypeAssertionExpression(node) || c.isNonNullExpression(node) || c.isSatisfiesExpression(node)) node = node.expression;
+		return node;
+	}
+	function propertyName(node) {
+		const c = getCompiler();
+		if (c.isIdentifier(node) || c.isStringLiteralLike(node) || c.isNumericLiteral(node)) return node.text;
+		return c.isComputedPropertyName(node) && c.isStringLiteralLike(unwrap(node.expression)) ? unwrap(node.expression).text : void 0;
+	}
+	function bindingPath(node, name) {
+		const c = getCompiler();
+		if (c.isIdentifier(node)) return node.text === name ? [] : void 0;
+		for (let index = 0; index < node.elements.length; index++) {
+			const item = node.elements[index];
+			if (!c.isBindingElement(item) || item.dotDotDotToken) continue;
+			const nested = bindingPath(item.name, name);
+			const member = c.isArrayBindingPattern(node) ? String(index) : item.propertyName ? propertyName(item.propertyName) : c.isIdentifier(item.name) ? item.name.text : void 0;
+			if (nested && member !== void 0) return [member, ...nested];
+		}
+	}
+	async function exportedMember(context, specifier, importer, name, members, seen, baseOnly) {
+		if (!members.length) return exported(context, specifier, importer, name, seen, baseOnly);
+		if (specifier.startsWith("@finesoft/")) return false;
+		const file = (await context.resolve(specifier, importer, { skipSelf: true }))?.id.split("?")[0];
+		if (!file) return false;
+		const key = `${file}:export-member:${JSON.stringify([name, ...members])}`;
+		if (seen.has(key)) return false;
+		seen.add(key);
+		const source = read(file);
+		if (!source) return false;
+		context.addWatchFile(file);
+		const c = getCompiler();
+		for (const statement of source.statements) {
+			if (c.isExportDeclaration(statement) && !statement.isTypeOnly) {
+				const module = statement.moduleSpecifier && c.isStringLiteral(statement.moduleSpecifier) ? statement.moduleSpecifier.text : void 0;
+				const clause = statement.exportClause;
+				if (module && clause && c.isNamespaceExport(clause) && clause.name.text === name) return exportedMember(context, module, file, members[0], members.slice(1), seen, baseOnly);
+				if (module && !clause && await exportedMember(context, module, file, name, members, new Set(seen), baseOnly)) return true;
+				if (clause && c.isNamedExports(clause)) for (const item of clause.elements) {
+					if (item.isTypeOnly || item.name.text !== name) continue;
+					const local = item.propertyName ?? item.name;
+					return module ? exportedMember(context, module, file, local.text, members, seen, baseOnly) : memberExpression(context, source, local, members, seen, baseOnly);
+				}
+			}
+			if (c.isVariableStatement(statement) && has(statement, c.SyntaxKind.ExportKeyword)) {
+				for (const item of statement.declarationList.declarations) if (c.isIdentifier(item.name) && item.name.text === name && item.initializer) return memberExpression(context, source, item.initializer, members, seen, baseOnly);
+			}
+			if (name === "default" && c.isExportAssignment(statement)) return memberExpression(context, source, statement.expression, members, seen, baseOnly);
+		}
+		return false;
+	}
+	async function memberExpression(context, source, node, members, seen, baseOnly) {
+		if (!members.length) return expression(context, source, node, seen, baseOnly);
+		node = unwrap(node);
+		const key = `${source.fileName}:member:${node.pos}:${node.end}:${JSON.stringify(members)}`;
+		if (seen.has(key)) return false;
+		seen.add(key);
+		const c = getCompiler();
+		if (c.isPropertyAccessExpression(node)) return memberExpression(context, source, node.expression, [node.name.text, ...members], seen, baseOnly);
+		if (c.isElementAccessExpression(node) && c.isStringLiteralLike(node.argumentExpression)) return memberExpression(context, source, node.expression, [node.argumentExpression.text, ...members], seen, baseOnly);
+		if (c.isObjectLiteralExpression(node)) for (const item of [...node.properties].reverse()) {
+			if (c.isSpreadAssignment(item)) {
+				if (await memberExpression(context, source, item.expression, members, new Set(seen), baseOnly)) return true;
+				continue;
+			}
+			if (propertyName(item.name) !== members[0]) continue;
+			if (c.isPropertyAssignment(item)) return memberExpression(context, source, item.initializer, members.slice(1), seen, baseOnly);
+			if (c.isShorthandPropertyAssignment(item)) return memberExpression(context, source, item.name, members.slice(1), seen, baseOnly);
+		}
+		if (c.isArrayLiteralExpression(node)) {
+			const item = node.elements[Number(members[0])];
+			return !!item && memberExpression(context, source, item, members.slice(1), seen, baseOnly);
+		}
+		if (!c.isIdentifier(node)) return false;
+		for (const statement of source.statements) {
+			if (c.isVariableStatement(statement)) for (const item of statement.declarationList.declarations) {
+				const prefix = bindingPath(item.name, node.text);
+				if (prefix && item.initializer) return memberExpression(context, source, item.initializer, [...prefix, ...members], seen, baseOnly);
+			}
+			if (!c.isImportDeclaration(statement) || !c.isStringLiteral(statement.moduleSpecifier) || statement.importClause?.isTypeOnly) continue;
+			const clause = statement.importClause;
+			const binding = clause?.namedBindings;
+			const specifier = statement.moduleSpecifier.text;
+			if (binding && c.isNamespaceImport(binding) && binding.name.text === node.text) return exportedMember(context, specifier, source.fileName, members[0], members.slice(1), seen, baseOnly);
+			if (clause?.name?.text === node.text) return exportedMember(context, specifier, source.fileName, "default", members, seen, baseOnly);
+			if (binding && c.isNamedImports(binding)) {
+				for (const item of binding.elements) if (!item.isTypeOnly && item.name.text === node.text) return exportedMember(context, specifier, source.fileName, (item.propertyName ?? item.name).text, members, seen, baseOnly);
+			}
+		}
+		return false;
+	}
+	async function exported(context, specifier, importer, name, seen, baseOnly = false) {
 		if (specifier === "@finesoft/front" || serverEntries.has(specifier)) return name === "BaseServerController";
 		if (specifier.startsWith("@finesoft/")) return false;
 		const resolved = await context.resolve(specifier, importer, { skipSelf: true });
@@ -619,52 +719,55 @@ function serverControllerModules(getRoot) {
 		const c = getCompiler();
 		for (const statement of source.statements) {
 			if (c.isClassDeclaration(statement) && has(statement, c.SyntaxKind.ExportKeyword)) {
-				if ((has(statement, c.SyntaxKind.DefaultKeyword) ? "default" : statement.name?.text) === name) return serverClass(context, source, statement, seen);
+				if ((has(statement, c.SyntaxKind.DefaultKeyword) ? "default" : statement.name?.text) === name) return !baseOnly && serverClass(context, source, statement, seen);
+			}
+			if (c.isVariableStatement(statement) && has(statement, c.SyntaxKind.ExportKeyword)) {
+				for (const item of statement.declarationList.declarations) if (c.isIdentifier(item.name) && item.name.text === name && item.initializer) return expression(context, source, item.initializer, seen, baseOnly);
 			}
 			if (c.isExportDeclaration(statement) && !statement.isTypeOnly) {
 				const module = statement.moduleSpecifier && c.isStringLiteral(statement.moduleSpecifier) ? statement.moduleSpecifier.text : void 0;
-				if (!statement.exportClause && module && await exported(context, module, file, name, new Set(seen))) return true;
+				if (!statement.exportClause && module && await exported(context, module, file, name, new Set(seen), baseOnly)) return true;
 				if (statement.exportClause && c.isNamedExports(statement.exportClause)) for (const item of statement.exportClause.elements) {
 					if (item.isTypeOnly || item.name.text !== name) continue;
 					const local = (item.propertyName ?? item.name).text;
-					return module ? exported(context, module, file, local, seen) : identifier(context, source, local, seen);
+					return module ? exported(context, module, file, local, seen, baseOnly) : identifier(context, source, local, seen, baseOnly);
 				}
 			}
-			if (name === "default" && c.isExportAssignment(statement)) return expression(context, source, statement.expression, seen);
+			if (name === "default" && c.isExportAssignment(statement)) return expression(context, source, statement.expression, seen, baseOnly);
 		}
 		return false;
 	}
-	async function identifier(context, source, name, seen) {
+	async function identifier(context, source, name, seen, baseOnly = false) {
 		const key = `${source.fileName}:local:${name}`;
 		if (seen.has(key)) return false;
 		seen.add(key);
 		const c = getCompiler();
 		for (const statement of source.statements) {
-			if (c.isClassDeclaration(statement) && statement.name?.text === name) return serverClass(context, source, statement, seen);
-			if (c.isVariableStatement(statement)) {
-				for (const item of statement.declarationList.declarations) if (c.isIdentifier(item.name) && item.name.text === name && item.initializer) return expression(context, source, item.initializer, seen);
+			if (c.isClassDeclaration(statement) && statement.name?.text === name) return !baseOnly && serverClass(context, source, statement, seen);
+			if (c.isVariableStatement(statement)) for (const item of statement.declarationList.declarations) {
+				const members = bindingPath(item.name, name);
+				if (members && item.initializer) return memberExpression(context, source, item.initializer, members, seen, baseOnly);
 			}
 			if (!c.isImportDeclaration(statement) || !c.isStringLiteral(statement.moduleSpecifier) || statement.importClause?.isTypeOnly) continue;
 			const clause = statement.importClause;
-			if (clause?.name?.text === name) return exported(context, statement.moduleSpecifier.text, source.fileName, "default", seen);
+			if (clause?.name?.text === name) return exported(context, statement.moduleSpecifier.text, source.fileName, "default", seen, baseOnly);
 			if (clause?.namedBindings && c.isNamedImports(clause.namedBindings)) {
-				for (const item of clause.namedBindings.elements) if (!item.isTypeOnly && item.name.text === name) return exported(context, statement.moduleSpecifier.text, source.fileName, (item.propertyName ?? item.name).text, seen);
+				for (const item of clause.namedBindings.elements) if (!item.isTypeOnly && item.name.text === name) return exported(context, statement.moduleSpecifier.text, source.fileName, (item.propertyName ?? item.name).text, seen, baseOnly);
 			}
 		}
 		return false;
 	}
-	async function expression(context, source, node, seen) {
+	async function expression(context, source, node, seen, baseOnly = false) {
 		const c = getCompiler();
-		if (c.isIdentifier(node)) return identifier(context, source, node.text, seen);
-		if (c.isPropertyAccessExpression(node) && c.isIdentifier(node.expression)) for (const statement of source.statements) {
-			if (!c.isImportDeclaration(statement) || !c.isStringLiteral(statement.moduleSpecifier)) continue;
-			const binding = statement.importClause?.namedBindings;
-			if (binding && c.isNamespaceImport(binding) && binding.name.text === node.expression.text) return exported(context, statement.moduleSpecifier.text, source.fileName, node.name.text, seen);
-		}
-		if (c.isClassExpression(node)) return serverClass(context, source, node, seen);
+		node = unwrap(node);
+		if (c.isIdentifier(node)) return identifier(context, source, node.text, seen, baseOnly);
+		const member = c.isPropertyAccessExpression(node) ? node.name.text : c.isElementAccessExpression(node) && c.isStringLiteralLike(node.argumentExpression) ? node.argumentExpression.text : void 0;
+		if (member && (c.isPropertyAccessExpression(node) || c.isElementAccessExpression(node))) return memberExpression(context, source, node.expression, [member], seen, baseOnly);
+		if (baseOnly && c.isElementAccessExpression(node) && !member) return memberExpression(context, source, node.expression, ["BaseServerController"], seen, true);
+		if (c.isClassExpression(node)) return !baseOnly && serverClass(context, source, node, seen);
 		if (c.isCallExpression(node)) {
-			if (await expression(context, source, node.expression, new Set(seen))) return true;
-			for (const argument of node.arguments) if (await expression(context, source, argument, new Set(seen))) return true;
+			if (!baseOnly && await expression(context, source, node.expression, new Set(seen))) return true;
+			for (const argument of node.arguments) if (await expression(context, source, argument, new Set(seen), baseOnly) || baseOnly && await memberExpression(context, source, argument, ["BaseServerController"], new Set(seen), true)) return true;
 		}
 		return false;
 	}
@@ -672,6 +775,77 @@ function serverControllerModules(getRoot) {
 		const base = node.heritageClauses?.find((clause) => clause.token === getCompiler().SyntaxKind.ExtendsKeyword)?.types[0];
 		return !!base && expression(context, source, base.expression, seen);
 	}
+	/** One classification drives cold dependency indexing and every browser load form. */
+	async function classify(context, source) {
+		const c = getCompiler();
+		const classes = [];
+		const uses = [];
+		const visit = (node) => {
+			if (c.isImportDeclaration(node) || c.isExportDeclaration(node) || c.isTypeNode(node)) return;
+			if (c.isClassDeclaration(node) || c.isClassExpression(node)) classes.push(node);
+			if (c.isIdentifier(node) || c.isPropertyAccessExpression(node) || c.isElementAccessExpression(node) || c.isCallExpression(node)) uses.push(node);
+			c.forEachChild(node, visit);
+		};
+		visit(source);
+		const owned = /* @__PURE__ */ new Set();
+		for (const node of classes) if (await serverClass(context, source, node, /* @__PURE__ */ new Set())) owned.add(node);
+		const names = /* @__PURE__ */ new Map();
+		const defaultNames = /* @__PURE__ */ new Map();
+		const reserved = new Set(uses.filter(c.isIdentifier).map((node) => node.text));
+		const generatedName = (prefix) => {
+			let name = prefix;
+			while (reserved.has(name)) name += "_";
+			reserved.add(name);
+			return name;
+		};
+		for (const statement of source.statements) {
+			if (c.isClassDeclaration(statement) && owned.has(statement)) {
+				const name = statement.name?.text ?? "__ServerController";
+				names.set(name, name);
+			}
+			if (c.isVariableStatement(statement)) {
+				for (const item of statement.declarationList.declarations) if (c.isIdentifier(item.name) && item.initializer && owned.has(unwrap(item.initializer))) names.set(item.name.text, item.name.text);
+			}
+			if (c.isExportAssignment(statement) && owned.has(unwrap(statement.expression))) {
+				const name = generatedName("__ServerControllerDefault");
+				defaultNames.set(statement, name);
+				names.set(name, name);
+			}
+		}
+		let changed = true;
+		while (changed) {
+			changed = false;
+			for (const statement of source.statements) {
+				if (!c.isVariableStatement(statement)) continue;
+				for (const item of statement.declarationList.declarations) {
+					if (!c.isIdentifier(item.name) || !item.initializer || names.has(item.name.text)) continue;
+					const value = unwrap(item.initializer);
+					if (c.isIdentifier(value) && names.has(value.text)) {
+						names.set(item.name.text, names.get(value.text));
+						changed = true;
+					}
+				}
+			}
+		}
+		let server = owned.size > 0;
+		if (!server) {
+			const checked = /* @__PURE__ */ new Set();
+			for (const use of uses) {
+				const key = use.getText(source);
+				if (checked.has(key)) continue;
+				checked.add(key);
+				if (await expression(context, source, use, /* @__PURE__ */ new Set(), true)) {
+					server = true;
+					break;
+				}
+			}
+		}
+		return {
+			server,
+			names,
+			defaultNames
+		};
+	}
 	async function protectDependencies(context, file, seen = /* @__PURE__ */ new Set()) {
 		if (seen.has(file)) return;
 		seen.add(file);
@@ -719,12 +893,11 @@ function serverControllerModules(getRoot) {
 		}
 		if (!pending.size) return;
 		indexing = (async () => {
-			const c = getCompiler();
 			for (const file of pending) {
 				pending.delete(file);
 				const source = read(file);
 				if (!source) continue;
-				if (privateFiles.has(file) || (await Promise.all(source.statements.filter(c.isClassDeclaration).map((node) => serverClass(context, source, node, /* @__PURE__ */ new Set())))).some(Boolean)) await protectDependencies(context, file);
+				if (privateFiles.has(file) || (await classify(context, source)).server) await protectDependencies(context, file);
 			}
 		})();
 		try {
@@ -748,12 +921,8 @@ function serverControllerModules(getRoot) {
 				return null;
 			}
 			const c = getCompiler();
-			const names = /* @__PURE__ */ new Map();
-			for (const statement of source.statements) if (c.isClassDeclaration(statement) && await serverClass(context, source, statement, /* @__PURE__ */ new Set())) {
-				const name = statement.name?.text ?? "__ServerController";
-				names.set(name, name);
-			}
-			if (!names.size) {
+			const { server, names, defaultNames } = await classify(context, source);
+			if (!server) {
 				if (privateFiles.has(file)) throw Error(`Server controller dependency cannot be loaded by the browser: ${file}`);
 				return null;
 			}
@@ -763,6 +932,7 @@ function serverControllerModules(getRoot) {
 				"v",
 				"import"
 			].includes(key))) throw Error(`Server controller source cannot be loaded as an asset: ${file}`);
+			if (!names.size) throw Error(`Unsupported server controller syntax; use a module-scope class: ${file}`);
 			const exports = [];
 			for (const statement of source.statements) {
 				if (c.isInterfaceDeclaration(statement) || c.isTypeAliasDeclaration(statement)) continue;
@@ -770,7 +940,11 @@ function serverControllerModules(getRoot) {
 					const name = statement.name?.text ?? "__ServerController";
 					if (!names.has(name)) throw Error(`Server controller modules cannot export shared implementations: ${file}`);
 					exports.push(has(statement, c.SyntaxKind.DefaultKeyword) ? `export default ${name};` : `export { ${name} };`);
-				} else if (c.isExportDeclaration(statement) && !statement.isTypeOnly) {
+				} else if (c.isVariableStatement(statement) && has(statement, c.SyntaxKind.ExportKeyword)) for (const item of statement.declarationList.declarations) {
+					if (!c.isIdentifier(item.name) || !names.has(item.name.text)) throw Error(`Server controller modules can only export controllers and types: ${file}`);
+					exports.push(`export { ${item.name.text} };`);
+				}
+				else if (c.isExportDeclaration(statement) && !statement.isTypeOnly) {
 					if (statement.moduleSpecifier || !statement.exportClause || !c.isNamedExports(statement.exportClause)) throw Error(`Move re-exports out of the server controller implementation module: ${file}`);
 					for (const item of statement.exportClause.elements) {
 						if (item.isTypeOnly) continue;
@@ -779,12 +953,14 @@ function serverControllerModules(getRoot) {
 						exports.push(`export { ${name} as ${item.name.text} };`);
 					}
 				} else if (c.isExportAssignment(statement)) {
-					if (!c.isIdentifier(statement.expression) || !names.has(statement.expression.text)) throw Error(`Invalid server controller default export: ${file}`);
-					exports.push(`export default ${statement.expression.text};`);
+					const value = unwrap(statement.expression);
+					const name = defaultNames.get(statement) ?? (c.isIdentifier(value) ? value.text : void 0);
+					if (!name || !names.has(name)) throw Error(`Invalid server controller default export: ${file}`);
+					exports.push(`export default ${name};`);
 				} else if (has(statement, c.SyntaxKind.ExportKeyword)) throw Error(`Server controller modules can only export controllers and types: ${file}`);
 			}
 			return {
-				code: `import { ServerControllerProxy as __Proxy } from "@finesoft/front";\n${[...names].map(([name]) => `class ${name} extends __Proxy {}`).join("\n")}\n${exports.join("\n")}`,
+				code: `import { ServerControllerProxy as __Proxy } from "@finesoft/front";\n${[...names].map(([name, original]) => name === original ? `class ${name} extends __Proxy {}` : `const ${name} = ${original};`).join("\n")}\n${exports.join("\n")}`,
 				map: {
 					version: 3,
 					sources: [],
@@ -2202,9 +2378,9 @@ export async function loadMessages(locale) {
 				const { getRequestListener } = await dynamicImport("@hono/node-server");
 				printDevSafetyBanner();
 				const app = new HonoClass();
-				if (options.proxies?.length) registerProxyRoutes(app, options.proxies);
 				if (typeof options.setup === "function") await options.setup(app);
 				else if (typeof options.setup === "string") await (await server.ssrLoadModule("/" + options.setup)).default(app);
+				if (options.proxies?.length) registerProxyRoutes(app, options.proxies);
 				const ssrApp = createSSRApp({
 					root,
 					vite: server,
@@ -2236,14 +2412,12 @@ export async function loadMessages(locale) {
 				const { Hono: HonoClass } = await dynamicImport("hono");
 				const { getRequestListener } = await dynamicImport("@hono/node-server");
 				const app = new HonoClass();
-				if (options.proxies?.length) registerProxyRoutes(app, options.proxies);
 				if (typeof options.setup === "function") await options.setup(app);
-				else if (typeof options.setup === "string") try {
+				else if (typeof options.setup === "string") {
 					const setupPath = pathToFileURL(path.resolve(root, "dist/server/setup.mjs")).href;
 					await (await dynamicImport(setupPath)).default(app);
-				} catch {
-					console.warn("[finesoft] Could not load setup module for preview. API routes disabled.");
 				}
+				if (options.proxies?.length) registerProxyRoutes(app, options.proxies);
 				const template = readFileSync(path.resolve(root, "dist/client/index.html"), "utf-8");
 				const ssrPath = pathToFileURL(path.resolve(root, "dist/server/ssr.js")).href;
 				const ssrModule = await dynamicImport(ssrPath);

package/dist/{vue-DGmzuKho.d.mts → vue-DsZIYP1c.d.mts}

@@ -1,4 +1,4 @@
-import { f as AppSnapshot, g as WebAppView, h as ViewProps } from "./session-DnB4ZC3x.mjs";
+import { f as AppSnapshot, g as WebAppView, h as ViewProps } from "./session-BR1vd3yY.mjs";
 import { Component, PropType } from "vue";
 declare namespace vue_d_exports {
   export { NativeView, NativeViews, Outlet, ViewProps, WebAppView, useSnapshot };
@@ -29,4 +29,4 @@ declare const Outlet: import("vue").DefineComponent<import("vue").ExtractPropTyp
 }>> & Readonly<{}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, true, {}, any>;
 //#endregion
 export { vue_d_exports as a, useSnapshot as i, NativeViews as n, Outlet as r, NativeView as t };
-//# sourceMappingURL=vue-DGmzuKho.d.mts.map
+//# sourceMappingURL=vue-DsZIYP1c.d.mts.map

package/dist/vue.d.mts

@@ -1,3 +1,3 @@
-import { g as WebAppView, h as ViewProps } from "./session-DnB4ZC3x.mjs";
-import { i as useSnapshot, n as NativeViews, r as Outlet, t as NativeView } from "./vue-DGmzuKho.mjs";
+import { g as WebAppView, h as ViewProps } from "./session-BR1vd3yY.mjs";
+import { i as useSnapshot, n as NativeViews, r as Outlet, t as NativeView } from "./vue-DsZIYP1c.mjs";
 export { NativeView, NativeViews, Outlet, type ViewProps, type WebAppView, useSnapshot };

package/dist/web.d.mts

@@ -1,6 +1,6 @@
-import { A as makeSchema, C as ImpressionEntry, D as StandardIssue, E as ParamSchema, F as Token, I as createToken, M as Provider, N as ProviderContext, O as StandardResult, P as provide, S as EventRecorder, T as InferOutput, _ as OperationPolicy, a as compilePath, b as RuntimeOptions, c as ExecutionContext, d as ExecutionHandle, f as Implementation, g as OperationHandler, h as Operation, i as PathParams, j as Container, k as StandardSchemaV1, l as ExecutionError, m as ModuleDefinition, n as PathDescriptor, o as AnyOperation, p as Invocation, r as PathParameterDescriptor, s as AppDefinition, t as CompiledPath, u as ExecutionErrorCode, v as QueryCache, w as MetricsFieldsProvider, x as executionErrorFromHttp, y as RuntimeHandle } from "./path-CXT6xGPO.mjs";
-import { $ as createActiveLeafCodec, $n as list, $t as MiddlewareResult, A as SessionStore, An as PlatformInfo, At as isCompoundAction, B as ControllerContext, Bn as ConsoleLoggerFactory, Bt as NavigationPath, C as SessionFailure, Cn as Storage, Ct as ACTION_KINDS, D as SessionSlice, Dn as LocaleInfo, Dt as ExternalUrlAction, E as SessionRestoreResult, En as LocaleAttributes, Et as CompoundAction, F as WebRuntime, Fn as ReportCallback, Ft as LeafNode, G as controllerContext, Gn as InferParams, Gt as SplitColumn, H as SERVER_CONTROLLER, Hn as Logger, Ht as NavigationSnapshot, I as WebRuntimeOptions, In as ReportingLogger, It as NAVIGATION_NODE_KINDS, J as resolveConfiguredMessages, Jn as QuerySchemaMap, Jt as StackNode, K as MessagesLoader, Kn as InferQuery, Kt as SplitNode, L as createWebRuntime, Ln as ReportingLoggerFactory, Lt as NavigationError, M as SessionWriteResult, Mn as BaseController, Mt as isFlowAction, N as StorageUnavailableError, Nn as ControllerFailure, Nt as makeExternalUrlAction, O as SessionSnapshot, On as TextDirection, Ot as FlowAction, P as WebConfiguration, Pn as ControllerInput, Pt as makeFlowAction, Q as NavigationRouterLike, Qn as isMultiValueSchema, Qt as DenyResult, R as PageControllerDefinition, Rn as ReportingLoggerOptions, Rt as NavigationNode, S as SessionErrorContext, Sn as FeatureFlagsProvider, St as ActionHandler, T as SessionNavigation, Tn as resolveMessages, Tt as ActionInvocation, U as SERVER_REQUEST, Un as LoggerFactory, Ut as ResolvedDestination, V as PageControllerInput, Vn as LogFilter, Vt as NavigationPathStep, W as ServerRequestState, Wn as ExtractParamNames, Wt as SPLIT_VISIBILITIES, X as FullStateCodecOptions, Xn as ListOptions, Xt as AfterLoadGuard, Y as DEFAULT_NAV_PARAM, Yn as StripOptional, Yt as TabsNode, Z as NavigationCodec, Zn as MultiValueSchema, Zt as BeforeLoadGuard, _ as AsyncStorage, _n as RouteInput, _t as PrefetchedIntents, a as NavigationCommitContext, an as deny, at as SerializedSplit, b as SESSION_DEFAULT_VERSION, bn as DEP_KEYS, bt as Router, c as NavigationTransactionContext, cn as rewrite, ct as SerializedTabs, d as createWebSession, dn as FINESOFT_PUBLIC, dt as serializeNavigationStable, en as NavigationContext, er as Intent, et as createFullStateCodec, f as AppSnapshot, fn as PublicProjection, ft as PageRoute, g as WebAppView, gn as markPublic, gt as PrefetchedIntent, h as ViewProps, hn as isPublicMarked, ht as route, i as BeforeNavigateResult, in as RewriteResult, it as SerializedNavigation, j as SessionStoreOptions, jn as detectPlatform, jt as isExternalUrlAction, k as SessionStateProvider, kn as Translator, kt as TreeAction, l as WebSession, ln as BASE_PAGE_FIELDS, lt as deserializeNavigation, m as ViewEntry, mn as getPublicFields, mt as RouteDefinition, n as BeforeCommitResult, nn as PostLoadContext, nt as encodeNavigationTreeParam, o as NavigationCommitError, on as next, ot as SerializedSplitColumn, p as NavigationSummary, pn as PublicValueCodec, pt as RenderMode, q as MessagesLoaderContext, qn as ParamsFor, qt as SplitVisibility, r as BeforeNavigatePolicy, rn as RedirectResult, rt as SerializedLeaf, s as NavigationContextInput, sn as redirect, st as SerializedStack, t as BeforeCommitPolicy, tn as NextResult, tt as decodeNavigationTreeParam, u as WebSessionOptions, un as BasePage, ut as serializeNavigation, v as NavigationScopedState, vn as RouteIntent, vt as RouteAddOptions, w as SessionLoadResult, wn as TranslationMessages, wt as Action, x as SessionError, xn as FeatureFlags, xt as ActionDispatcher, y as SESSION_DEFAULT_KEY, yn as RouteParams, yt as RouteMatch, z as WebAppDefinition, zn as ConsoleLogger, zt as NavigationNodeKind } from "./session-DnB4ZC3x.mjs";
-import { $ as SimpleTranslator, $t as str, A as setVisibility, At as pipeAsync, B as split, Bt as HostGuardError, C as popTo, Ct as isNone, D as resolveActivePath, Dt as Mapper, E as replaceTop, Et as AsyncMapper, F as isLeafNode, Ft as HttpClient, G as SafeErrorPageOptions, Gt as optional, H as tabs, Ht as stableStringify, I as isSplitNode, It as HttpClientConfig, J as defineApp, Jt as StrOptions, K as safeErrorPage, Kt as withDefault, L as isStackNode, Lt as HttpRequestOptions, M as resourceKey, Mt as HostCheckResult, N as SplitColumnInit, Nt as classifyHost, O as selectColumn, Ot as mapEach, P as TabsInit, Pt as classifyUrl, Q as implementOperation, Qt as oneOf, R as isTabsNode, Rt as RequestInterceptor, S as pop, St as Optional, T as push, Tt as LruMap, U as RouteInputFor, Ut as CompositeLogger, V as stack, Vt as HttpError, W as createHydrationDigest, Wt as CompositeLoggerFactory, X as defineOperation, Xt as int, Y as defineModule, Yt as bool, Z as implementController, Zt as num, _ as collectAllLeaves, _t as getBaseUrl, a as LoadPageOptions, at as resolveLocaleFromUrl, b as findNode, bt as removeScheme, c as defineWebApp, ct as englishPlural, d as runBeforeLoadGuards, dt as WithFieldsRecorder, en as uuid, et as SimpleTranslatorOptions, f as createSessionStore, ft as VoidEventRecorder, g as encodeSnapshot, gt as buildUrl, h as decodeSnapshot, ht as generateUuid, i as resolveInitialNavigation, it as makeLocaleInfo, j as visibleSplitColumns, jt as fetchWithRedirects, k as selectTab, kt as pipe, l as getWebPlan, lt as interpolate, m as createNavigationScopedState, mt as CompositeEventRecorder, n as PageReference, nt as getTextDirection, o as PageLoadResult, ot as PluralCategory, p as collectLeafKeys, pt as ConsoleEventRecorder, q as createRuntime, qt as NumOptions, r as definePage, rt as isRtl, s as loadPage, st as PluralRuleProvider, t as parseCookieString, tt as getLocaleAttributes, u as runAfterLoadGuards, ut as resolvePluralKey, v as collectVisibleDestinations, vt as removeHost, w as popToRoot, wt as isSome, x as mapNavigationLeaves, xt as None, y as findNearestStack, yt as removeQueryParams, z as leaf, zt as ResponseInterceptor } from "./cookies-BiRlUanX.mjs";
-import { a as enforceHostGuard, i as TargetGuardOptions, n as secureFetch, r as DnsLookup, t as SecureFetchOptions } from "./secure-fetch-Xlht2jd7.mjs";
-import { a as WebHydration, c as decodeWireEnvelope, i as FRAMEWORK_PROTOCOL_VERSION, l as getFrameworkBuildId, n as ServerControllerProxy, o as WireDecodeResult, r as ServerControllerRequest, s as WireEnvelope, t as SERVER_CONTROLLER_PATH } from "./server-controller-proxy-BkVuVWVD.mjs";
+import { A as makeSchema, C as ImpressionEntry, D as StandardIssue, E as ParamSchema, F as Token, I as createToken, M as Provider, N as ProviderContext, O as StandardResult, P as provide, S as EventRecorder, T as InferOutput, _ as OperationPolicy, a as compilePath, b as RuntimeOptions, c as ExecutionContext, d as ExecutionHandle, f as Implementation, g as OperationHandler, h as Operation, i as PathParams, j as Container, k as StandardSchemaV1, l as ExecutionError, m as ModuleDefinition, n as PathDescriptor, o as AnyOperation, p as Invocation, r as PathParameterDescriptor, s as AppDefinition, t as CompiledPath, u as ExecutionErrorCode, v as QueryCache, w as MetricsFieldsProvider, x as executionErrorFromHttp, y as RuntimeHandle } from "./path-C-b1ChKq.mjs";
+import { $ as createActiveLeafCodec, $n as list, $t as MiddlewareResult, A as SessionStore, An as PlatformInfo, At as isCompoundAction, B as ControllerContext, Bn as ConsoleLoggerFactory, Bt as NavigationPath, C as SessionFailure, Cn as Storage, Ct as ACTION_KINDS, D as SessionSlice, Dn as LocaleInfo, Dt as ExternalUrlAction, E as SessionRestoreResult, En as LocaleAttributes, Et as CompoundAction, F as WebRuntime, Fn as ReportCallback, Ft as LeafNode, G as controllerContext, Gn as InferParams, Gt as SplitColumn, H as SERVER_CONTROLLER, Hn as Logger, Ht as NavigationSnapshot, I as WebRuntimeOptions, In as ReportingLogger, It as NAVIGATION_NODE_KINDS, J as resolveConfiguredMessages, Jn as QuerySchemaMap, Jt as StackNode, K as MessagesLoader, Kn as InferQuery, Kt as SplitNode, L as createWebRuntime, Ln as ReportingLoggerFactory, Lt as NavigationError, M as SessionWriteResult, Mn as BaseController, Mt as isFlowAction, N as StorageUnavailableError, Nn as ControllerFailure, Nt as makeExternalUrlAction, O as SessionSnapshot, On as TextDirection, Ot as FlowAction, P as WebConfiguration, Pn as ControllerInput, Pt as makeFlowAction, Q as NavigationRouterLike, Qn as isMultiValueSchema, Qt as DenyResult, R as PageControllerDefinition, Rn as ReportingLoggerOptions, Rt as NavigationNode, S as SessionErrorContext, Sn as FeatureFlagsProvider, St as ActionHandler, T as SessionNavigation, Tn as resolveMessages, Tt as ActionInvocation, U as SERVER_REQUEST, Un as LoggerFactory, Ut as ResolvedDestination, V as PageControllerInput, Vn as LogFilter, Vt as NavigationPathStep, W as ServerRequestState, Wn as ExtractParamNames, Wt as SPLIT_VISIBILITIES, X as FullStateCodecOptions, Xn as ListOptions, Xt as AfterLoadGuard, Y as DEFAULT_NAV_PARAM, Yn as StripOptional, Yt as TabsNode, Z as NavigationCodec, Zn as MultiValueSchema, Zt as BeforeLoadGuard, _ as AsyncStorage, _n as RouteInput, _t as PrefetchedIntents, a as NavigationCommitContext, an as deny, at as SerializedSplit, b as SESSION_DEFAULT_VERSION, bn as DEP_KEYS, bt as Router, c as NavigationTransactionContext, cn as rewrite, ct as SerializedTabs, d as createWebSession, dn as FINESOFT_PUBLIC, dt as serializeNavigationStable, en as NavigationContext, er as Intent, et as createFullStateCodec, f as AppSnapshot, fn as PublicProjection, ft as PageRoute, g as WebAppView, gn as markPublic, gt as PrefetchedIntent, h as ViewProps, hn as isPublicMarked, ht as route, i as BeforeNavigateResult, in as RewriteResult, it as SerializedNavigation, j as SessionStoreOptions, jn as detectPlatform, jt as isExternalUrlAction, k as SessionStateProvider, kn as Translator, kt as TreeAction, l as WebSession, ln as BASE_PAGE_FIELDS, lt as deserializeNavigation, m as ViewEntry, mn as getPublicFields, mt as RouteDefinition, n as BeforeCommitResult, nn as PostLoadContext, nt as encodeNavigationTreeParam, o as NavigationCommitError, on as next, ot as SerializedSplitColumn, p as NavigationSummary, pn as PublicValueCodec, pt as RenderMode, q as MessagesLoaderContext, qn as ParamsFor, qt as SplitVisibility, r as BeforeNavigatePolicy, rn as RedirectResult, rt as SerializedLeaf, s as NavigationContextInput, sn as redirect, st as SerializedStack, t as BeforeCommitPolicy, tn as NextResult, tt as decodeNavigationTreeParam, u as WebSessionOptions, un as BasePage, ut as serializeNavigation, v as NavigationScopedState, vn as RouteIntent, vt as RouteAddOptions, w as SessionLoadResult, wn as TranslationMessages, wt as Action, x as SessionError, xn as FeatureFlags, xt as ActionDispatcher, y as SESSION_DEFAULT_KEY, yn as RouteParams, yt as RouteMatch, z as WebAppDefinition, zn as ConsoleLogger, zt as NavigationNodeKind } from "./session-BR1vd3yY.mjs";
+import { $ as SimpleTranslator, $t as str, A as setVisibility, At as pipeAsync, B as split, Bt as HostGuardError, C as popTo, Ct as isNone, D as resolveActivePath, Dt as Mapper, E as replaceTop, Et as AsyncMapper, F as isLeafNode, Ft as HttpClient, G as SafeErrorPageOptions, Gt as optional, H as tabs, Ht as stableStringify, I as isSplitNode, It as HttpClientConfig, J as defineApp, Jt as StrOptions, K as safeErrorPage, Kt as withDefault, L as isStackNode, Lt as HttpRequestOptions, M as resourceKey, Mt as HostCheckResult, N as SplitColumnInit, Nt as classifyHost, O as selectColumn, Ot as mapEach, P as TabsInit, Pt as classifyUrl, Q as implementOperation, Qt as oneOf, R as isTabsNode, Rt as RequestInterceptor, S as pop, St as Optional, T as push, Tt as LruMap, U as RouteInputFor, Ut as CompositeLogger, V as stack, Vt as HttpError, W as createHydrationDigest, Wt as CompositeLoggerFactory, X as defineOperation, Xt as int, Y as defineModule, Yt as bool, Z as implementController, Zt as num, _ as collectAllLeaves, _t as getBaseUrl, a as LoadPageOptions, at as resolveLocaleFromUrl, b as findNode, bt as removeScheme, c as defineWebApp, ct as englishPlural, d as runBeforeLoadGuards, dt as WithFieldsRecorder, en as uuid, et as SimpleTranslatorOptions, f as createSessionStore, ft as VoidEventRecorder, g as encodeSnapshot, gt as buildUrl, h as decodeSnapshot, ht as generateUuid, i as resolveInitialNavigation, it as makeLocaleInfo, j as visibleSplitColumns, jt as fetchWithRedirects, k as selectTab, kt as pipe, l as getWebPlan, lt as interpolate, m as createNavigationScopedState, mt as CompositeEventRecorder, n as PageReference, nt as getTextDirection, o as PageLoadResult, ot as PluralCategory, p as collectLeafKeys, pt as ConsoleEventRecorder, q as createRuntime, qt as NumOptions, r as definePage, rt as isRtl, s as loadPage, st as PluralRuleProvider, t as parseCookieString, tt as getLocaleAttributes, u as runAfterLoadGuards, ut as resolvePluralKey, v as collectVisibleDestinations, vt as removeHost, w as popToRoot, wt as isSome, x as mapNavigationLeaves, xt as None, y as findNearestStack, yt as removeQueryParams, z as leaf, zt as ResponseInterceptor } from "./cookies-BXCwZoS_.mjs";
+import { a as enforceHostGuard, i as TargetGuardOptions, n as secureFetch, r as DnsLookup, t as SecureFetchOptions } from "./secure-fetch--QwYr5uJ.mjs";
+import { a as WebHydration, c as decodeWireEnvelope, i as FRAMEWORK_PROTOCOL_VERSION, l as getFrameworkBuildId, n as ServerControllerProxy, o as WireDecodeResult, r as ServerControllerRequest, s as WireEnvelope, t as SERVER_CONTROLLER_PATH } from "./server-controller-proxy-CFdU_nGs.mjs";
 export { ACTION_KINDS, type Action, ActionDispatcher, type ActionHandler, type ActionInvocation, type AfterLoadGuard, AnyOperation, AppDefinition, AppSnapshot, type AsyncMapper, type AsyncStorage, BASE_PAGE_FIELDS, BaseController, type BasePage, type BeforeCommitPolicy, type BeforeCommitResult, type BeforeLoadGuard, type BeforeNavigatePolicy, type BeforeNavigateResult, type CompiledPath, CompositeEventRecorder, CompositeLogger, CompositeLoggerFactory, type CompoundAction, ConsoleEventRecorder, ConsoleLogger, ConsoleLoggerFactory, Container, ControllerContext, type ControllerFailure, type ControllerInput, DEFAULT_NAV_PARAM, DEP_KEYS, type DenyResult, type DnsLookup, type EventRecorder, ExecutionContext, ExecutionError, ExecutionErrorCode, ExecutionHandle, type ExternalUrlAction, type ExtractParamNames, FINESOFT_PUBLIC, FRAMEWORK_PROTOCOL_VERSION, type FeatureFlags, type FeatureFlagsProvider, type FlowAction, type FullStateCodecOptions, type HostCheckResult, HostGuardError, HttpClient, type HttpClientConfig, HttpError, type HttpRequestOptions, Implementation, type ImpressionEntry, type InferOutput, type InferParams, type InferQuery, type Intent, Invocation, type LeafNode, type ListOptions, type LoadPageOptions, type LocaleAttributes, type LocaleInfo, type LogFilter, type Logger, type LoggerFactory, LruMap, type Mapper, type MessagesLoader, type MessagesLoaderContext, type MetricsFieldsProvider, type MiddlewareResult, ModuleDefinition, type MultiValueSchema, NAVIGATION_NODE_KINDS, type NavigationCodec, type NavigationCommitContext, NavigationCommitError, type NavigationContext, type NavigationContextInput, NavigationError, type NavigationNode, type NavigationNodeKind, type NavigationPath, type NavigationPathStep, type NavigationRouterLike, type NavigationScopedState, type NavigationSnapshot, NavigationSummary, type NavigationTransactionContext, type NextResult, type None, type NumOptions, Operation, OperationHandler, OperationPolicy, type Optional, type PageControllerDefinition, PageControllerInput, type PageLoadResult, type PageReference, type PageRoute, type ParamSchema, type ParamsFor, type PathDescriptor, type PathParameterDescriptor, type PathParams, type PlatformInfo, type PluralCategory, type PluralRuleProvider, type PostLoadContext, type PrefetchedIntent, PrefetchedIntents, type Provider, type ProviderContext, type PublicProjection, type PublicValueCodec, QueryCache, type QuerySchemaMap, type RedirectResult, type RenderMode, type ReportCallback, ReportingLogger, ReportingLoggerFactory, type ReportingLoggerOptions, type RequestInterceptor, type ResolvedDestination, type ResponseInterceptor, type RewriteResult, type RouteAddOptions, type RouteDefinition, type RouteInput, type RouteInputFor, type RouteIntent, type RouteMatch, type RouteParams, Router, RuntimeHandle, RuntimeOptions, SERVER_CONTROLLER, SERVER_CONTROLLER_PATH, SERVER_REQUEST, SESSION_DEFAULT_KEY, SESSION_DEFAULT_VERSION, SPLIT_VISIBILITIES, type SafeErrorPageOptions, type SecureFetchOptions, type SerializedLeaf, type SerializedNavigation, type SerializedSplit, type SerializedSplitColumn, type SerializedStack, type SerializedTabs, ServerControllerProxy, type ServerControllerRequest, ServerRequestState, SessionError, type SessionErrorContext, type SessionFailure, type SessionLoadResult, type SessionNavigation, type SessionRestoreResult, type SessionSlice, type SessionSnapshot, type SessionStateProvider, type SessionStore, type SessionStoreOptions, type SessionWriteResult, SimpleTranslator, type SimpleTranslatorOptions, type SplitColumn, type SplitColumnInit, type SplitNode, type SplitVisibility, type StackNode, type StandardIssue, type StandardResult, type StandardSchemaV1, type Storage, StorageUnavailableError, type StrOptions, type StripOptional, type TabsInit, type TabsNode, type TargetGuardOptions, type TextDirection, type Token, type TranslationMessages, type Translator, type TreeAction, ViewEntry, ViewProps, VoidEventRecorder, type WebAppDefinition, WebAppView, type WebConfiguration, type WebHydration, type WebRuntime, type WebRuntimeOptions, type WebSession, type WebSessionOptions, type WireDecodeResult, type WireEnvelope, WithFieldsRecorder, bool, buildUrl, classifyHost, classifyUrl, collectAllLeaves, collectLeafKeys, collectVisibleDestinations, compilePath, controllerContext, createActiveLeafCodec, createFullStateCodec, createHydrationDigest, createNavigationScopedState, createRuntime, createSessionStore, createToken, createWebRuntime, createWebSession, decodeNavigationTreeParam, decodeSnapshot, decodeWireEnvelope, defineApp, defineModule, defineOperation, definePage, defineWebApp, deny, deserializeNavigation, detectPlatform, encodeNavigationTreeParam, encodeSnapshot, enforceHostGuard, englishPlural, executionErrorFromHttp, fetchWithRedirects, findNearestStack, findNode, generateUuid, getBaseUrl, getFrameworkBuildId, getLocaleAttributes, getPublicFields, getTextDirection, getWebPlan, implementController, implementOperation, int, interpolate, isCompoundAction, isExternalUrlAction, isFlowAction, isLeafNode, isMultiValueSchema, isNone, isPublicMarked, isRtl, isSome, isSplitNode, isStackNode, isTabsNode, leaf, list, loadPage, makeExternalUrlAction, makeFlowAction, makeLocaleInfo, makeSchema, mapEach, mapNavigationLeaves, markPublic, next, num, oneOf, optional, parseCookieString, pipe, pipeAsync, pop, popTo, popToRoot, provide, push, redirect, removeHost, removeQueryParams, removeScheme, replaceTop, resolveActivePath, resolveConfiguredMessages, resolveInitialNavigation, resolveLocaleFromUrl, resolveMessages, resolvePluralKey, resourceKey, rewrite, route, runAfterLoadGuards, runBeforeLoadGuards, safeErrorPage, secureFetch, selectColumn, selectTab, serializeNavigation, serializeNavigationStable, setVisibility, split, stableStringify, stack, str, tabs, uuid, visibleSplitColumns, withDefault };

package/dist/web.mjs

@@ -1,6 +1,6 @@
-import { $ as isLeafNode, A as createActiveLeafCodec, At as getLocaleAttributes, B as findNode, Bt as secureFetch, C as runBeforeLoadGuards, Ct as defineApp, D as SERVER_REQUEST, Dt as implementOperation, E as SERVER_CONTROLLER, Et as implementController, F as serializeNavigation, Ft as englishPlural, G as push, Gt as ReportingLoggerFactory, H as pop, Ht as enforceHostGuard, I as serializeNavigationStable, It as interpolate, J as selectColumn, Jt as CompositeLogger, K as replaceTop, Kt as ConsoleLogger, L as collectAllLeaves, Lt as resolvePluralKey, M as decodeNavigationTreeParam, Mt as isRtl, N as encodeNavigationTreeParam, Nt as makeLocaleInfo, O as controllerContext, Ot as SimpleTranslator, P as deserializeNavigation, Pt as resolveLocaleFromUrl, Q as resourceKey, Qt as Container, R as collectVisibleDestinations, Rt as generateUuid, S as runAfterLoadGuards, St as createRuntime, T as getWebPlan, Tt as defineOperation, U as popTo, Ut as stableStringify, V as mapNavigationLeaves, Vt as fetchWithRedirects, W as popToRoot, Wt as ReportingLogger, X as setVisibility, Xt as isMultiValueSchema, Y as selectTab, Yt as CompositeLoggerFactory, Z as visibleSplitColumns, Zt as list, _ as SERVER_CONTROLLER_PATH, _t as isExternalUrlAction, a as createSessionStore, at as stack, b as decodeWireEnvelope, bt as makeFlowAction, c as decodeSnapshot, ct as NavigationError, d as createWebSession, dt as createHydrationDigest, et as isSplitNode, f as SESSION_DEFAULT_KEY, ft as PrefetchedIntents, g as loadPage, gt as isCompoundAction, h as StorageUnavailableError, ht as ACTION_KINDS, i as createWebRuntime, it as split, j as createFullStateCodec, jt as getTextDirection, k as DEFAULT_NAV_PARAM, kt as resolveMessages, l as encodeSnapshot, lt as SPLIT_VISIBILITIES, m as SessionError, mt as ActionDispatcher, n as definePage, nt as isTabsNode, o as collectLeafKeys, ot as tabs, p as SESSION_DEFAULT_VERSION, pt as Router, q as resolveActivePath, qt as ConsoleLoggerFactory, r as resolveInitialNavigation, rt as leaf, s as createNavigationScopedState, st as NAVIGATION_NODE_KINDS, t as parseCookieString, tt as isStackNode, u as NavigationCommitError, ut as route, v as ServerControllerProxy, vt as isFlowAction, w as defineWebApp, wt as defineModule, x as getFrameworkBuildId, xt as provide, y as FRAMEWORK_PROTOCOL_VERSION, yt as makeExternalUrlAction, z as findNearestStack, zt as detectPlatform } from "./src-BQBfaaPO.mjs";
-import { C as bool, D as str, E as oneOf, O as uuid, S as withDefault, T as num, _ as mapEach, a as safeErrorPage, b as HttpClient, c as ConsoleEventRecorder, d as getBaseUrl, f as removeHost, g as isSome, h as isNone, i as rewrite, k as makeSchema, l as CompositeEventRecorder, m as removeScheme, n as next, o as WithFieldsRecorder, p as removeQueryParams, r as redirect, s as VoidEventRecorder, t as deny, u as buildUrl, v as pipe, w as int, x as optional, y as pipeAsync } from "./types-B1BT0N3t.mjs";
-import { i as HttpError, n as classifyUrl, r as HostGuardError, t as classifyHost } from "./host-guard-DDWxLpFL.mjs";
+import { $ as isLeafNode, A as createActiveLeafCodec, At as getLocaleAttributes, B as findNode, Bt as secureFetch, C as runBeforeLoadGuards, Ct as defineApp, D as SERVER_REQUEST, Dt as implementOperation, E as SERVER_CONTROLLER, Et as implementController, F as serializeNavigation, Ft as englishPlural, G as push, Gt as ReportingLoggerFactory, H as pop, Ht as enforceHostGuard, I as serializeNavigationStable, It as interpolate, J as selectColumn, Jt as CompositeLogger, K as replaceTop, Kt as ConsoleLogger, L as collectAllLeaves, Lt as resolvePluralKey, M as decodeNavigationTreeParam, Mt as isRtl, N as encodeNavigationTreeParam, Nt as makeLocaleInfo, O as controllerContext, Ot as SimpleTranslator, P as deserializeNavigation, Pt as resolveLocaleFromUrl, Q as resourceKey, Qt as Container, R as collectVisibleDestinations, Rt as generateUuid, S as runAfterLoadGuards, St as createRuntime, T as getWebPlan, Tt as defineOperation, U as popTo, Ut as stableStringify, V as mapNavigationLeaves, Vt as fetchWithRedirects, W as popToRoot, Wt as ReportingLogger, X as setVisibility, Xt as isMultiValueSchema, Y as selectTab, Yt as CompositeLoggerFactory, Z as visibleSplitColumns, Zt as list, _ as SERVER_CONTROLLER_PATH, _t as isExternalUrlAction, a as createSessionStore, at as stack, b as decodeWireEnvelope, bt as makeFlowAction, c as decodeSnapshot, ct as NavigationError, d as createWebSession, dt as createHydrationDigest, et as isSplitNode, f as SESSION_DEFAULT_KEY, ft as PrefetchedIntents, g as loadPage, gt as isCompoundAction, h as StorageUnavailableError, ht as ACTION_KINDS, i as createWebRuntime, it as split, j as createFullStateCodec, jt as getTextDirection, k as DEFAULT_NAV_PARAM, kt as resolveMessages, l as encodeSnapshot, lt as SPLIT_VISIBILITIES, m as SessionError, mt as ActionDispatcher, n as definePage, nt as isTabsNode, o as collectLeafKeys, ot as tabs, p as SESSION_DEFAULT_VERSION, pt as Router, q as resolveActivePath, qt as ConsoleLoggerFactory, r as resolveInitialNavigation, rt as leaf, s as createNavigationScopedState, st as NAVIGATION_NODE_KINDS, t as parseCookieString, tt as isStackNode, u as NavigationCommitError, ut as route, v as ServerControllerProxy, vt as isFlowAction, w as defineWebApp, wt as defineModule, x as getFrameworkBuildId, xt as provide, y as FRAMEWORK_PROTOCOL_VERSION, yt as makeExternalUrlAction, z as findNearestStack, zt as detectPlatform } from "./src-D_Bzbr80.mjs";
+import { C as bool, D as str, E as oneOf, O as uuid, S as withDefault, T as num, _ as mapEach, a as safeErrorPage, b as HttpClient, c as ConsoleEventRecorder, d as getBaseUrl, f as removeHost, g as isSome, h as isNone, i as rewrite, k as makeSchema, l as CompositeEventRecorder, m as removeScheme, n as next, o as WithFieldsRecorder, p as removeQueryParams, r as redirect, s as VoidEventRecorder, t as deny, u as buildUrl, v as pipe, w as int, x as optional, y as pipeAsync } from "./types-DD09OkGZ.mjs";
+import { i as HttpError, n as classifyUrl, r as HostGuardError, t as classifyHost } from "./host-guard-DX4e3-45.mjs";
 import { n as ExecutionError, r as executionErrorFromHttp, t as compilePath } from "./path-CGFl2w7D.mjs";
 import { a as isPublicMarked, i as getPublicFields, n as BASE_PAGE_FIELDS, o as markPublic, r as FINESOFT_PUBLIC, s as BaseController, t as resolveConfiguredMessages } from "./messages-CAt2QdGr.mjs";
 import { t as LruMap } from "./lru-map-BKoUAySU.mjs";

package/dist/worker.d.mts

@@ -1,2 +1,2 @@
-import { a as HttpHost, i as HttpHandlerOptions, l as runManagedTask, o as ManagedTask, r as HttpHandler, s as createHttpHandler } from "./http-B6CJqDyf.mjs";
+import { a as HttpHost, i as HttpHandlerOptions, l as runManagedTask, o as ManagedTask, r as HttpHandler, s as createHttpHandler } from "./http-B8r7MWao.mjs";
 export { type HttpHandler, type HttpHandlerOptions, type HttpHost, type ManagedTask, createHttpHandler, runManagedTask };

package/docs/02-routing-and-controllers.md

@@ -199,6 +199,8 @@ Generated page inputs use `ControllerContext` or `ServerControllerContext`. Port
 
 A server controller module may export controller classes and types only. Its local runtime imports are also private to the server; importing these dependencies from client code fails. Use `import type` for shared contracts and separate modules for client implementations. Keep secret-dependent construction inside the protected module or server configuration, rather than arguments to the shared `create` factory.
 
+The compiler recognizes module-scope class declarations, variable-bound and default class expressions, transparent parentheses/type assertions, local aliases, namespace imports and static re-exports. Unsupported factories or computed selections involving the raw server base fail the browser build instead of returning original source. Prefer a module-scope class when that diagnostic occurs. Pure re-export barrels and ordinary consumers of the generated controller references remain shared.
+
 Client bundles and source maps omit the replaced implementation. The development plugin rejects raw controller assets and direct browser source requests for protected dependencies. It indexes modules once, caches ASTs, and reanalyzes changed files. Dependencies remain protected for the lifetime of a development server; restart when intentionally moving one back into shared code. Computed file paths, `public/` assets, and independently copied source are outside the static import boundary. Development servers still belong on trusted development networks.
 
 Use the framework Vite plugin and a request host such as Node or Worker. Static-only hosting cannot run the remote endpoint. The endpoint loads registered server page controllers; it does not expose arbitrary methods or replace explicit login/registration command endpoints.

package/docs/06-http-client.md

@@ -34,10 +34,14 @@ const api = new UserApi({ baseUrl: "https://api.example.com", fetch, ...nodeSafe
 
 Browser code may construct the same class with an absolute API URL, its chosen fetch implementation and `validateDns: false`. That explicitly gives DNS resolution to the browser. Do not silently disable a required server capability. Internal/loopback targets are blocked by default; host configuration must deliberately opt in where required.
 
+The shared literal/connection policy also rejects the non-public benchmark range `198.18.0.0/15`, including mapped IPv6 forms. For hosts without a DNS policy, `trustedOrigins` lists exact origins that the application explicitly trusts without DNS checks; all other hostnames still require a resolver. These exceptions are checked on every redirect and do not allow private IP literals. Cloudflare adapter configuration is described in [Deployment hosts](./09-server-and-deployment.md).
+
 The Node entry includes its connection transport as a lazy chunk; consumers need no extra transport package. Standard Node/Vercel/Netlify, development and preview hosts use `nodeSafeFetchOptions`: all DNS answers are checked inside connection creation, and those exact addresses reach the socket while hostname, TLS SNI, cancellation and pooling remain intact. The pool loads lazily and stays outside browser/Worker graphs. Custom Node fetch implementations must honor Undici's `dispatcher` option. `nodeDnsLookup` alone is only a preflight and does not prevent a DNS change before connection.
 
 Protected fetch checks each redirect, follows at most 20 hops and removes authentication/cookie headers across origins. Explicit `manual` / `error` modes retain their meaning. Opaque browser redirects are rejected because their destination is unreadable. Redirects requiring replay of `Request.body` or a streamed body are rejected without unbounded tee buffering; use a replayable `RequestInit.body` (such as a string) or the final URL. `allowInternalHosts: true` explicitly opts out of these protections.
 
 For scoped business services, declare a typed provider and acquire it with `context.get(token)`; see [Dependencies](./07-di-container.md). Bind the invocation's fetch and signal so request cancellation propagates. A cancelled command may already have performed a write; cancellation is not rollback. The operation runtime does not implicitly retry or cache commands.
 
+The full-template `ApiClient` forwards the entire configuration before applying its `/api` and JSON-header defaults. Subclasses should preserve `wrapFetch`, `context`, `trustedOrigins` and interceptors together with the other options; copying `validateDns: false` without its Node transport wrapper removes connection-address protection.
+
 Request and response interceptors run in registration order. `HttpError` represents non-success HTTP results. The generic result type describes expected data; validate untrusted response payloads at the business boundary when necessary. The lower-level protected methods are `get`, `post`, `put`, `del` and `request`; `get`/`del` accept query parameters before request options.

package/docs/09-server-and-deployment.md

@@ -77,6 +77,19 @@ Node’s host requires `@hono/node-server`. Worker fetch has no Node compatibili
 
 When `setup` is a module path, that module must `export default` its setup function. Development, preview and generated hosts use this explicit export; named functions are not discovered automatically.
 
+Setup runs before declared proxies, so `app.use(...)` authentication covers proxy requests as well as application routes. Register guards before terminal handlers in setup. A terminal setup route can override a proxy on the same path. A configured setup that fails to load aborts preview startup. Proxy `auth` supplies an upstream credential; it does not authenticate the incoming caller. Proxies without application guards remain public.
+
+Cloudflare output fails closed for arbitrary `SAFE_FETCH` hostnames because the adapter has no connection-time DNS enforcement. To use a known trusted API, configure exact origins explicitly:
+
+```ts
+import { cloudflareAdapter, finesoftFrontViteConfig } from "@finesoft/front";
+finesoftFrontViteConfig({
+    adapter: cloudflareAdapter({ trustedOrigins: ["https://api.example.com"] }),
+});
+```
+
+This is an explicit trust exception for those origins, not DNS pinning. The origin includes scheme and port; no wildcards, paths or prefix matching are used. Redirects are checked again and private IP literals remain blocked. Relative in-process API calls retain their behavior. The `"cloudflare"` adapter shortcut has an empty trusted-origin list.
+
 ## Static hosting boundary
 
 `staticAdapter` reads built `render.routes` by default, uses the same SSR host to generate HTML and awaits cleanup. `dynamicRoutes` supplies concrete dynamic paths; `routesExport` is an explicit extension. Discovery and rendering failures fail the build. Plain HTML cannot express redirects, error status, Set-Cookie or custom HTTP response headers, so the adapter rejects these responses; choose a request host when they are required.

package/docs/11-navigation.md

@@ -205,6 +205,8 @@ Admission receives `from`, candidate `tree`, stable `transitionId`, active `exec
 
 A denial returns an uncommitted snapshot with `rejection`, including for empty trees. Session restore rejects it before replacing scopes or slices. Initial browser denial renders the error without committing navigation or recording a page visit; later denial preserves the displayed draft. Both flat and navigation SSR honor these policies and emit no rejected page data or public-cache permission. CSR shells still defer navigation to the browser.
 
+If any visible page fails during initial navigation, the whole candidate stays uncommitted and only its error presentation is exposed. Successful siblings are withheld from the native view and SSR hydration data until a successful retry passes the commit boundary. Initial browser redirects that hand off to an external site likewise withhold successful siblings while the browser leaves. Page failures do not invoke `beforeCommit`; later failed navigation preserves the previously committed view.
+
 Owned back/forward rejection compensates to the committed history entry and restores its scroll identity. Additive history metadata preserves ownership and position across reloads. Entries without compatible ownership metadata are diagnosed; the framework cannot infer a safe traversal distance for external entries.
 
 Low-level hosts configuring `createWebSession({ createContext })` return a `NavigationContext` directly. The execution supplies its DI container and cancellation signal; request cookies and headers stay in the host context. The session uses the application's `getErrorPage` unless explicitly overridden.

package/docs/advanced/multi-tenant-scopes.md

@@ -15,3 +15,27 @@ await runtime.execute(operation, input, {
 ```
 
 Use `provide({ token, lifetime: "scope", create, dispose })` for per-request resources. Concurrent initialization deduplicates and a failed initialization may retry. Runtime-scoped providers cannot depend on request-scoped values. Externally supplied values remain external unless owned explicitly; created values are released in dependency order. A command is not retried or cached automatically; cancellation does not roll back an already applied mutation.
+
+## Query cache partitions
+
+Cached queries with invocation bindings or an invocation-specific `fetch` default to execution-local reuse, even with `scope: "runtime"`. Bindings can contain opaque resources and tenant-specific providers, so the runtime does not serialize them into a shared key. Web and SSR hosts also supply bindings and therefore use this isolation by default. Queries without invocation bindings/fetch retain runtime reuse partitioned by identity, locale and input.
+
+To share completed results across executions, explicitly declare the complete trusted security partition:
+
+```ts
+const tenantSummary = defineOperation({
+    id: "tenant-summary",
+    kind: "query",
+    cache: {
+        ttlMs: 10_000,
+        partition: (context) => {
+            const tenant = context.bindings.tenant;
+            if (typeof tenant !== "string") throw new ExecutionError("configuration");
+            return tenant;
+        },
+    },
+    handler: loadTenantSummary,
+});
+```
+
+The partition must cover every result-affecting binding and fetch authority in addition to the existing identity, locale and input key. A constant partition asserts that the result is independent of all other invocation state. `cache.key(input)` still controls only the input key; it cannot enable shared caching by itself. Policies run before every cache hit, invalidation still applies across partitions, and `scope: "execution"` always remains local.

package/docs/zh/02-routing-and-controllers.md

@@ -150,6 +150,8 @@ export class AccountController extends BaseServerController {
 
 服务端 Controller 模块只导出 Controller 类和类型。该模块的本地运行时依赖也属于服务端边界；客户端直接导入这些依赖会报错。共享类型请使用 `import type`，共享的客户端实现放在独立模块。构造函数内的依赖创建属于受保护模块；不要在共享的 `create` 工厂参数、共享配置或页面组件中写入机密。
 
+编译器识别模块级类声明、绑定到变量或默认导出的类表达式、括号／类型断言、本地别名、命名空间导入及静态转导出。涉及原始服务端基类但无法安全代理的工厂或计算属性形式会令浏览器构建报错，不再直接返回原始源码；出现该诊断时改用模块级类。纯转导出模块和使用生成代理的普通业务模块仍可共享。
+
 生产客户端 JS / source map 不包含被替换的实现。开发服务拒绝 Controller 的原始资源导入和受保护依赖的源码请求。模块与依赖索引在启动时建立，后续缓存 AST，只重新分析变更文件；开发期间已识别的私有依赖保持保护，若要将它迁回共享模块，应重启开发服务。动态计算的文件路径、`public/` 资源和另行复制的源码不属于静态导入边界。开发服务器仍只用于受信任的开发环境。
 
 使用框架 Vite 插件及具有 SSR 请求处理能力的 Node / Worker 等宿主。纯静态托管没有远程执行端点。此入口用于注册的服务端页面 Controller，不会自动发布任意方法或代替登录、注册等命令端点。