@fluixi/start 0.1.0-alpha.43

package/dist/internal.js

@@ -0,0 +1,302 @@
+import { readdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { resolve as resolvePath, relative as relativePath } from 'node:path';
+import { extractHeadMarker } from '@fluixi/head';
+/** The virtual module that registers every `"use server"` fn + re-exports the dispatcher. */
+export const SERVER_FNS_VMOD = 'virtual:fluixi-server-fns';
+/** The virtual module exposing auto-discovered translations: `{ messages, locales, defaultLocale }`. */
+export const I18N_VMOD = 'virtual:fluixi-i18n';
+/**
+ * Auto-discover translations. Scans `<dir>/<locale>.json` (e.g. `src/i18n/en.json`, `fr.json`)
+ * and provides `virtual:fluixi-i18n` exporting `{ messages, locales, defaultLocale }` — wire it
+ * into the built-in i18n in one line:
+ *
+ *   import { createI18n } from '@fluixi/core/i18n';
+ *   import { messages, locales, defaultLocale } from 'virtual:fluixi-i18n';
+ *   export const { t, locale, setLocale } = createI18n({ locale: defaultLocale, locales, messages });
+ *
+ * Configured via `fluixi.config`'s `i18n` (folder / locales / defaultLocale); `i18n: false` disables it.
+ */
+export function i18nVitePlugin(opts) {
+    let root = process.cwd();
+    const id = '\0' + I18N_VMOD;
+    return {
+        name: 'fluixi-i18n',
+        configResolved(config) {
+            root = config.root || root;
+        },
+        resolveId(source) {
+            return source === I18N_VMOD ? id : null;
+        },
+        load(source) {
+            if (source !== id)
+                return null;
+            const dir = resolvePath(root, opts.dir);
+            let files = [];
+            try {
+                files = readdirSync(dir).filter((f) => f.endsWith('.json'));
+            }
+            catch {
+                /* folder doesn't exist → empty bundle (i18n stays a no-op until you add files) */
+            }
+            const discovered = files.map((f) => f.replace(/\.json$/, '')).sort();
+            const locales = opts.locales?.length ? opts.locales : discovered;
+            const defaultLocale = opts.defaultLocale ?? locales[0] ?? 'en';
+            // Static JSON imports so Vite bundles + watches them; `messages` keyed by locale.
+            const imports = locales
+                .map((l, i) => `import _${i} from ${JSON.stringify(resolvePath(dir, l + '.json'))};`)
+                .join('\n');
+            const messages = `export const messages = {${locales.map((l, i) => `${JSON.stringify(l)}:_${i}`).join(',')}};`;
+            return (`${imports}\n` +
+                `export const locales = ${JSON.stringify(locales)};\n` +
+                `export const defaultLocale = ${JSON.stringify(defaultLocale)};\n` +
+                `${messages}\n`);
+        },
+    };
+}
+/**
+ * Load env files into `process.env` for SERVER code — the framework's environment manager.
+ *
+ * SECURITY MODEL (Vite-aligned): only `VITE_`-prefixed vars are exposed to the client (via
+ * `import.meta.env`, inlined into the browser bundle). Everything else is server-only. This
+ * loads ALL vars (`.env`, `.env.local`, `.env.[mode]`, `.env.[mode].local`) into `process.env`
+ * so loaders + `"use server"` functions can read secrets — WITHOUT ever exposing non-`VITE_`
+ * vars to the browser. A real (OS) env var always wins, so deploys/secret managers override files.
+ *
+ * Result: `process.env.STRIPE_SECRET` works on the server and never ships to the web; only
+ * `VITE_*` reaches the client. Apps stop hand-rolling dotenv loaders + risking secret leaks.
+ */
+export async function loadServerEnv(root, mode) {
+    const { loadEnv } = await import('vite');
+    const env = loadEnv(mode, root, ''); // '' prefix = ALL vars (server-only via process.env)
+    for (const [k, v] of Object.entries(env)) {
+        if (process.env[k] === undefined)
+            process.env[k] = v; // real env wins
+    }
+}
+/**
+ * Build the `declare module 'virtual:fluixi-i18n'` block — TYPED off the actual JSON files
+ * so `createI18n({ messages })` infers translation keys end-to-end from auto-discovery.
+ *
+ * Instead of typing `messages` as `Record<string, unknown>` (which erases keys), we reference
+ * each `<locale>.json` via `(typeof import('./i18n/en.json'))['default']`. TS reads the JSON's
+ * real shape, so `t('…')` autocompletes keys discovered from `src/i18n/*.json` — no codegen of
+ * the key union, the compiler derives it. Falls back to the loose shape when no files exist yet
+ * (or a configured locale has no file), keeping the module typed-but-open rather than broken.
+ *
+ * NOTE: relies on `resolveJsonModule` (Vite's default tsconfig has it).
+ */
+function i18nTypeBlock(root, i18n) {
+    const dir = resolvePath(root, i18n.dir);
+    let discovered = [];
+    try {
+        discovered = readdirSync(dir)
+            .filter((f) => f.endsWith('.json'))
+            .map((f) => f.replace(/\.json$/, ''))
+            .sort();
+    }
+    catch {
+        /* folder absent → fall through to the loose block */
+    }
+    const locales = i18n.locales?.length ? i18n.locales : discovered;
+    const defaultLocale = i18n.defaultLocale ?? locales[0] ?? 'en';
+    // Typed only when every locale we'd export has a backing JSON file (else `import()` would error).
+    const typed = locales.length > 0 && locales.every((l) => discovered.includes(l));
+    if (!typed) {
+        return [
+            `declare module 'virtual:fluixi-i18n' {`,
+            `  export const messages: Record<string, Record<string, unknown>>;`,
+            `  export const locales: string[];`,
+            `  export const defaultLocale: string;`,
+            `}`,
+        ];
+    }
+    const srcDir = resolvePath(root, 'src'); // the .d.ts lives in src/, so import paths are relative to it
+    const toSpec = (l) => {
+        const rel = relativePath(srcDir, resolvePath(dir, l + '.json')).split(/[\\/]/).join('/');
+        return rel.startsWith('.') ? rel : './' + rel;
+    };
+    const entries = locales.map((l) => `    ${JSON.stringify(l)}: (typeof import(${JSON.stringify(toSpec(l))}))['default'];`);
+    const tuple = locales.map((l) => JSON.stringify(l)).join(', ');
+    return [
+        `declare module 'virtual:fluixi-i18n' {`,
+        `  export const messages: {`,
+        ...entries,
+        `  };`,
+        `  export const locales: readonly [${tuple}];`,
+        `  export const defaultLocale: ${JSON.stringify(defaultLocale)};`,
+        `}`,
+    ];
+}
+/**
+ * Auto-generate ambient TypeScript declarations for @fluixi/start's virtual modules
+ * (`virtual:fluixi-server-fns`, `virtual:fluixi-i18n`) into `src/fluixi-start-env.d.ts`, the
+ * way the routes plugin writes `fluixi-env.d.ts`. So apps NEVER hand-write these `declare
+ * module` blocks — the modules AND their types are both generated. Idempotent (only writes on
+ * change), runs in dev + build.
+ */
+export function startTypesPlugin(cfg) {
+    let root = process.cwd();
+    return {
+        name: 'fluixi-start-types',
+        configResolved(config) {
+            root = config.root || root;
+        },
+        buildStart() {
+            const blocks = [
+                `declare module 'virtual:fluixi-server-fns' {`,
+                `  export function isServerFnRequest(request: Request): boolean;`,
+                `  export function handleServerFn(request: Request): Promise<Response>;`,
+                `}`,
+                `declare module 'virtual:fluixi-api' {`,
+                `  export function isApiRequest(request: Request): boolean;`,
+                `  export function handleApiRequest(request: Request): Promise<Response>;`,
+                `}`,
+            ];
+            if (cfg.i18n)
+                blocks.push(...i18nTypeBlock(root, cfg.i18n));
+            const content = `// Auto-generated by @fluixi/start — do not edit.\n${blocks.join('\n')}\n`;
+            const file = resolvePath(root, 'src/fluixi-start-env.d.ts');
+            try {
+                if (!existsSync(file) || readFileSync(file, 'utf8') !== content)
+                    writeFileSync(file, content);
+            }
+            catch {
+                /* read-only fs (some CI) — types are a dev convenience, build still works */
+            }
+        },
+    };
+}
+/**
+ * The fluixi build plugins @fluixi/start provides by default: file-based routing
+ * (fluixiRoutesPlugin → virtual:fluixi-routes) + the JSX/SSR transform
+ * (createVitePlugin). This is what makes start "sit on top of fluixi" — apps get
+ * zero-config routing + SSR. Apps using `fluixi dev|build` should therefore NOT add
+ * these to their own vite.config (start owns them); keep vite.config for app-specific
+ * bits only (optimizeDeps, ssr.noExternal via config, etc.).
+ */
+export async function fluixiPlugins(cfg) {
+    const { createVitePlugin, fluixiRoutesPlugin } = await import('@fluixi/core/plugins');
+    const { serverFunctionsVitePlugin } = await import('@fluixi/compiler/integrations');
+    // polyfills:false — the meta-framework is SSR-first; the browser node-polyfill shims
+    // break server rendering. Apps that need Buffer/process in the browser opt in later.
+    // serverFunctionsVitePlugin applies the "use server" transform (client RPC stub /
+    // server registration) per-build via the ssr flag.
+    const plugins = [
+        serverFunctionsVitePlugin(),
+        fluixiRoutesPlugin({ routesDir: cfg.routesDir, polyfills: false }),
+        createVitePlugin(),
+    ];
+    // Auto-discover translations (src/i18n/<locale>.json → virtual:fluixi-i18n) unless disabled.
+    if (cfg.i18n)
+        plugins.push(i18nVitePlugin(cfg.i18n));
+    // File-based API routes (src/api/** → virtual:fluixi-api). No-op until the folder has files.
+    const { apiRoutesVitePlugin } = await import('./api.js');
+    plugins.push(apiRoutesVitePlugin({ dir: cfg.apiDir }));
+    // Auto-generate the ambient .d.ts for the virtual modules (server-fns + i18n).
+    plugins.push(startTypesPlugin(cfg));
+    return plugins;
+}
+/**
+ * Inject server-rendered app HTML into the template's mount element
+ * (`<div id="root"></div>`). Falls back to a `<!--ssr-outlet-->` marker, then to
+ * just before `</body>`.
+ */
+export function injectApp(template, appHtml, mountId = 'root') {
+    const mount = new RegExp(`<div id=["']${mountId}["']\\s*>\\s*</div>`);
+    if (mount.test(template)) {
+        return template.replace(mount, `<div id="${mountId}">${appHtml}</div>`);
+    }
+    if (template.includes('<!--ssr-outlet-->')) {
+        return template.replace('<!--ssr-outlet-->', appHtml);
+    }
+    return template.replace('</body>', `<div id="${mountId}">${appHtml}</div></body>`);
+}
+/**
+ * Split the template at the mount point for streaming: `head` is everything up to and
+ * including the open mount tag (flushed first so the browser fetches assets while the
+ * server awaits data); `tail` is the close tag onward (client script + `</body>`).
+ * Mirrors injectApp's three cases (mount div, `<!--ssr-outlet-->`, before `</body>`).
+ */
+export function splitTemplate(template, mountId = 'root') {
+    const mount = new RegExp(`<div id=["']${mountId}["']\\s*>\\s*</div>`);
+    const m = template.match(mount);
+    if (m && m.index !== undefined) {
+        return {
+            head: template.slice(0, m.index) + `<div id="${mountId}">`,
+            tail: `</div>` + template.slice(m.index + m[0].length),
+        };
+    }
+    const outlet = template.indexOf('<!--ssr-outlet-->');
+    if (outlet !== -1) {
+        return {
+            head: template.slice(0, outlet),
+            tail: template.slice(outlet + '<!--ssr-outlet-->'.length),
+        };
+    }
+    const body = template.indexOf('</body>');
+    if (body !== -1) {
+        return {
+            head: template.slice(0, body) + `<div id="${mountId}">`,
+            tail: `</div>` + template.slice(body),
+        };
+    }
+    return { head: template, tail: '' };
+}
+/** Set/replace an attribute on the template's <html> tag (e.g. lang). */
+function setHtmlAttr(html, name, value) {
+    const existing = new RegExp(`(<html\\b[^>]*?)\\s${name}="[^"]*"`, 'i');
+    if (existing.test(html))
+        return html.replace(existing, `$1 ${name}="${value}"`);
+    return html.replace(/<html\b/i, `<html ${name}="${value}"`);
+}
+/**
+ * Inject the rendered app into the mount point AND lift any @fluixi/head metadata (carried back as
+ * a marker by renderRequestAsync) into <head> + <html>. If the page set a title, the template's own
+ * <title> is dropped so there's only one. No marker → identical to injectApp.
+ */
+export function injectAppAndHead(template, rendered, mountId = 'root') {
+    const { head, body } = extractHeadMarker(rendered);
+    let html = injectApp(template, body, mountId);
+    if (head) {
+        if (head.headHtml) {
+            if (/<title[\s>]/i.test(head.headHtml))
+                html = html.replace(/<title>[\s\S]*?<\/title>/i, '');
+            html = html.replace('</head>', `${head.headHtml}</head>`);
+        }
+        for (const [k, v] of Object.entries(head.htmlAttrs))
+            html = setHtmlAttr(html, k, v);
+    }
+    return html;
+}
+/**
+ * Wrap a fetch handler so a thrown/rejected error becomes a 500 instead of an
+ * unhandled rejection. `createRequestHandler` already guards the renderer; this
+ * covers the middleware chain that wraps it. `onError` lets dev map the stack first.
+ */
+export function guardHandler(handler, onError) {
+    return async (request) => {
+        try {
+            return await handler(request);
+        }
+        catch (e) {
+            onError?.(e);
+            return new Response(String(e?.stack || e), {
+                status: 500,
+                headers: { 'content-type': 'text/plain; charset=utf-8' },
+            });
+        }
+    };
+}
+let _guardsInstalled = false;
+/**
+ * A render fires the route's data fetches eagerly; if the backend is down those
+ * promises can reject AFTER we've already responded, with nothing awaiting them —
+ * a floating rejection would kill the dev server. Swallow + log instead.
+ */
+export function installCrashGuards() {
+    if (_guardsInstalled)
+        return;
+    _guardsInstalled = true;
+    process.on('unhandledRejection', (reason) => console.warn('[fluixi] unhandled rejection (backend likely down) —', reason?.message || reason));
+    process.on('uncaughtException', (err) => console.warn('[fluixi] uncaught exception —', err?.message || err));
+}

package/dist/middleware.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Request middleware — a chain that runs BEFORE the SSR render, in both `fluixi dev`
+ * and `fluixi start`. Each middleware gets `(request, next)`; calling `next()` runs
+ * the rest of the chain (ending in the renderer). A middleware may short-circuit
+ * (return a Response without calling `next` — e.g. an auth redirect or a 401), or
+ * call `next()` and adjust the result (add headers, rewrite). Runtime-neutral: a
+ * middleware sees a Web `Request` and returns a Web `Response`.
+ *
+ * Convention: `src/middleware.ts`, default-exporting `defineMiddleware([...])`.
+ *
+ *   // src/middleware.ts
+ *   import { defineMiddleware } from '@fluixi/start';
+ *   export default defineMiddleware([
+ *     (req, next) => {
+ *       const url = new URL(req.url);
+ *       if (url.pathname.startsWith('/admin') && !isAuthed(req))
+ *         return new Response(null, { status: 302, headers: { location: '/login' } });
+ *       return next();
+ *     },
+ *   ]);
+ */
+import type { FetchHandler } from './handler.js';
+export type MiddlewareNext = () => Promise<Response>;
+export type Middleware = (request: Request, next: MiddlewareNext) => Response | Promise<Response>;
+/** Identity helper for `export default` — accepts one middleware or an array. */
+export declare function defineMiddleware(mw: Middleware | Middleware[]): Middleware[];
+/**
+ * Normalize a loaded `src/middleware.ts` module's default export into a Middleware[].
+ * Tolerates a single function, an array, `defineMiddleware(...)` output, or nothing.
+ */
+export declare function normalizeMiddleware(mod: unknown): Middleware[];
+/**
+ * Compose a middleware chain around a core handler (the renderer). Returns a handler
+ * that runs `middlewares[0] → … → core`. `next()` must be called at most once per
+ * middleware; a second call rejects.
+ */
+export declare function composeMiddleware(middlewares: Middleware[], core: FetchHandler): FetchHandler;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,MAAM,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;AACrD,MAAM,MAAM,UAAU,GAAG,CACvB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,cAAc,KACjB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElC,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,UAAU,GAAG,UAAU,EAAE,GAAG,UAAU,EAAE,CAE5E;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,EAAE,CAK9D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,UAAU,EAAE,EACzB,IAAI,EAAE,YAAY,GACjB,YAAY,CAed"}

package/dist/middleware.js

@@ -0,0 +1,39 @@
+/** Identity helper for `export default` — accepts one middleware or an array. */
+export function defineMiddleware(mw) {
+    return Array.isArray(mw) ? mw.slice() : [mw];
+}
+/**
+ * Normalize a loaded `src/middleware.ts` module's default export into a Middleware[].
+ * Tolerates a single function, an array, `defineMiddleware(...)` output, or nothing.
+ */
+export function normalizeMiddleware(mod) {
+    const def = mod?.default ?? mod;
+    if (def == null)
+        return [];
+    if (Array.isArray(def))
+        return def.filter((m) => typeof m === 'function');
+    return typeof def === 'function' ? [def] : [];
+}
+/**
+ * Compose a middleware chain around a core handler (the renderer). Returns a handler
+ * that runs `middlewares[0] → … → core`. `next()` must be called at most once per
+ * middleware; a second call rejects.
+ */
+export function composeMiddleware(middlewares, core) {
+    if (middlewares.length === 0)
+        return core;
+    return (request) => {
+        let lastCalled = -1;
+        const dispatch = (i) => {
+            if (i <= lastCalled) {
+                return Promise.reject(new Error('middleware called next() more than once'));
+            }
+            lastCalled = i;
+            const mw = middlewares[i];
+            if (!mw)
+                return Promise.resolve(core(request));
+            return Promise.resolve(mw(request, () => dispatch(i + 1)));
+        };
+        return dispatch(0);
+    };
+}

package/dist/router.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `@fluixi/start/router` — the app-facing routing surface, re-exported from
+ * `@fluixi/core/router-next` (the framework-agnostic `@fluixi/router` core + its
+ * fluixi adapter). Importing routing from the meta-framework gives apps a single,
+ * stable dependency surface — they don't reach into fluixi internals:
+ *
+ *   import { Router, Outlet, Link, createMemoryHistory } from '@fluixi/start/router';
+ *
+ * Framework primitives (Suspense, lazy, signals, components) still come from
+ * `@fluixi/core` — only routing lives here.
+ */
+export * from '@fluixi/core/router-next';
+//# sourceMappingURL=router.d.ts.map

package/dist/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,cAAc,0BAA0B,CAAC"}

package/dist/router.js

@@ -0,0 +1,12 @@
+/**
+ * `@fluixi/start/router` — the app-facing routing surface, re-exported from
+ * `@fluixi/core/router-next` (the framework-agnostic `@fluixi/router` core + its
+ * fluixi adapter). Importing routing from the meta-framework gives apps a single,
+ * stable dependency surface — they don't reach into fluixi internals:
+ *
+ *   import { Router, Outlet, Link, createMemoryHistory } from '@fluixi/start/router';
+ *
+ * Framework primitives (Suspense, lazy, signals, components) still come from
+ * `@fluixi/core` — only routing lives here.
+ */
+export * from '@fluixi/core/router-next';

package/dist/server-fn-setup.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Server-only bridge: wire `@fluixi/server`'s request context into the server-function
+ * dispatcher so `getRequestEvent()` works inside a `"use server"` function. Imported by
+ * `virtual:fluixi-server-fns` (server build only) — never by the client.
+ */
+import { getRequestEvent } from '@fluixi/server';
+export { getRequestEvent };
+//# sourceMappingURL=server-fn-setup.d.ts.map

package/dist/server-fn-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-fn-setup.d.ts","sourceRoot":"","sources":["../src/server-fn-setup.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAA+C,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAa9F,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/server-fn-setup.js

@@ -0,0 +1,17 @@
+/**
+ * Server-only bridge: wire `@fluixi/server`'s request context into the server-function
+ * dispatcher so `getRequestEvent()` works inside a `"use server"` function. Imported by
+ * `virtual:fluixi-server-fns` (server build only) — never by the client.
+ */
+import { createRequestContext, runWithRequestContext, getRequestEvent } from '@fluixi/server';
+import { setServerFnContextRunner } from './server-fn.js';
+setServerFnContextRunner((request, run) => {
+    const responseHeaders = {};
+    const event = { request, url: new URL(request.url).pathname, responseHeaders };
+    const ctx = createRequestContext(event);
+    const result = Promise.resolve(runWithRequestContext(ctx, run));
+    return { result, responseHeaders };
+});
+// Re-exported so a server function can `import { getRequestEvent } from '@fluixi/start/server-fn-setup'`
+// — though importing from `@fluixi/server` directly works too.
+export { getRequestEvent };

package/dist/server-fn.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Server-functions runtime — the target of the `"use server"` compiler transform.
+ * Client-safe (web APIs only, no node imports): on the client the registry/dispatcher
+ * are dead code and the stub `fetch()`es the RPC endpoint; on the server the bodies are
+ * registered and `handleServerFn` dispatches them.
+ */
+/** The RPC endpoint server functions POST to. */
+export declare const SERVER_FN_ENDPOINT = "/_server";
+/** Server build: register a server function body by its stable id. Returns it. */
+export declare function $$registerServerFn<F extends (...args: any[]) => any>(id: string, fn: F): F;
+/** Client build: an RPC stub that calls the server function by id. */
+export declare function $$createServerReference(id: string): (...args: any[]) => Promise<any>;
+/**
+ * Runs a server function inside a request context so `getRequestEvent()` (request,
+ * headers, cookies) works inside it. Injected by `@fluixi/start/server-fn-setup` (which
+ * bridges `@fluixi/server`'s AsyncLocalStorage) so this module stays client-safe — no
+ * node imports here. `event.responseHeaders` set inside the fn are returned to the host.
+ */
+type ContextRunner = (request: Request, run: () => any) => {
+    result: Promise<any>;
+    responseHeaders?: Record<string, string>;
+};
+export declare function setServerFnContextRunner(runner: ContextRunner | null): void;
+export declare function setServerFnFetch(f: typeof fetch): void;
+/** True if `request` is a server-function RPC call (so the host should dispatch it). */
+export declare function isServerFnRequest(request: Request): boolean;
+/**
+ * Dispatch a server-function RPC: same-origin (CSRF) check, look up the id, run it with
+ * the JSON args, return the JSON result. A thrown error → 500; unknown id → 404.
+ */
+export declare function handleServerFn(request: Request): Promise<Response>;
+export {};
+//# sourceMappingURL=server-fn.d.ts.map

package/dist/server-fn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-fn.d.ts","sourceRoot":"","sources":["../src/server-fn.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,iDAAiD;AACjD,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAO7C,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAG1F;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,IACxC,GAAG,MAAM,GAAG,EAAE,kBACvB;AAED;;;;;GAKG;AACH,KAAK,aAAa,GAAG,CACnB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,GAAG,KACX;IAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAExE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,IAAI,CAE3E;AAKD,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,KAAK,GAAG,IAAI,CAEtD;AAgBD,wFAAwF;AACxF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyCxE"}

package/dist/server-fn.js

@@ -0,0 +1,96 @@
+/**
+ * Server-functions runtime — the target of the `"use server"` compiler transform.
+ * Client-safe (web APIs only, no node imports): on the client the registry/dispatcher
+ * are dead code and the stub `fetch()`es the RPC endpoint; on the server the bodies are
+ * registered and `handleServerFn` dispatches them.
+ */
+/** The RPC endpoint server functions POST to. */
+export const SERVER_FN_ENDPOINT = '/_server';
+const HEADER = 'x-fluixi-server-fn';
+// id → server function. Populated at module init on the server (the transform emits
+// `$$registerServerFn` calls); empty/unused on the client.
+const registry = new Map();
+/** Server build: register a server function body by its stable id. Returns it. */
+export function $$registerServerFn(id, fn) {
+    registry.set(id, fn);
+    return fn;
+}
+/** Client build: an RPC stub that calls the server function by id. */
+export function $$createServerReference(id) {
+    return (...args) => callServer(id, args);
+}
+let contextRunner = null;
+export function setServerFnContextRunner(runner) {
+    contextRunner = runner;
+}
+// The fetch the RPC client uses. Pluggable so interceptors (auth headers, 401 handling,
+// retry) apply to server-function calls — `addInterceptor` swaps in the intercepted fetch.
+let _fetch = (...a) => fetch(...a);
+export function setServerFnFetch(f) {
+    _fetch = f;
+}
+async function callServer(id, args) {
+    const res = await _fetch(SERVER_FN_ENDPOINT, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', [HEADER]: id },
+        body: JSON.stringify(args),
+    });
+    if (!res.ok) {
+        throw new Error(`server function "${id}" failed: ${res.status} ${await res.text()}`);
+    }
+    return (res.headers.get('content-type') || '').includes('application/json')
+        ? res.json()
+        : res.text();
+}
+/** True if `request` is a server-function RPC call (so the host should dispatch it). */
+export function isServerFnRequest(request) {
+    return request.method === 'POST' && request.headers.has(HEADER);
+}
+/**
+ * Dispatch a server-function RPC: same-origin (CSRF) check, look up the id, run it with
+ * the JSON args, return the JSON result. A thrown error → 500; unknown id → 404.
+ */
+export async function handleServerFn(request) {
+    // CSRF: reject cross-origin POSTs (a same-origin fetch always sends a matching Origin).
+    const origin = request.headers.get('origin');
+    if (origin) {
+        try {
+            if (new URL(origin).host !== new URL(request.url).host) {
+                return new Response('forbidden', { status: 403 });
+            }
+        }
+        catch {
+            return new Response('forbidden', { status: 403 });
+        }
+    }
+    const id = request.headers.get(HEADER);
+    const fn = registry.get(id);
+    if (!fn)
+        return new Response(`unknown server function: ${id}`, { status: 404 });
+    let args = [];
+    try {
+        const parsed = await request.json();
+        args = Array.isArray(parsed) ? parsed : [parsed];
+    }
+    catch {
+        /* no/!json body → no args */
+    }
+    try {
+        const headers = { 'content-type': 'application/json' };
+        let result;
+        if (contextRunner) {
+            // Run inside the request context so getRequestEvent() works in the fn; collect any
+            // response headers (e.g. Set-Cookie) the fn set on the event.
+            const ran = contextRunner(request, () => fn(...args));
+            result = await ran.result;
+            Object.assign(headers, ran.responseHeaders || {});
+        }
+        else {
+            result = await fn(...args);
+        }
+        return new Response(JSON.stringify(result ?? null), { status: 200, headers });
+    }
+    catch (e) {
+        return new Response(String(e?.message || e), { status: 500 });
+    }
+}