@hozu/runtime-server 0.6.0 → 0.8.0

package/dist/handler.js

@@ -1,18 +1,19 @@
 import { planRoute } from '@hozu/compiler';
-import { FORM_FIELD, hashJson, publicPath, routeParams, routePattern, routeTable, } from '@hozu/core/ir';
+import { canonicalStringify, codes, FORM_FIELD, hashJson, join, publicPath, resolveSource, routeParams, routePattern, routeTable, } from '@hozu/core/ir';
 import { createDataRuntime } from '@hozu/data';
 import { compileValue } from '@hozu/machine';
+import { appHandlerOptions, appOptionsOf } from './app.js';
 import { clientBundle } from './assets.js';
 import { memoryCache } from './cache.js';
 import { pageEntries, robotsTxt, sitemapXml } from './crawl.js';
-import { formFields, formNode, runForm } from './forms.js';
+import { endpointForm, formFields, formNode, runForm } from './forms.js';
 import { serviceWorker, serviceWorkerRegistration, webManifest } from './pwa.js';
 import { fnsModule, inlineScriptHashes, pathOf, renderPage, renderToString, } from './render.js';
 import { instantiate } from './rendered.js';
 import { matcher } from './routing.js';
-import { parseSearch } from './search.js';
-import { contentSecurityPolicy, crossSite, ERROR_HTML } from './security.js';
-import { sessionCookie } from './session.js';
+import { parseSearch, queryInput } from './search.js';
+import { contentSecurityPolicy, crossSite, ERROR_HTML, NOT_FOUND_HTML } from './security.js';
+import { memorySessions, signedCookie } from './session.js';
 import { publicAssets } from './static.js';
 import { assertWidgetBundle } from './widgets.js';
 const mime = {
@@ -69,7 +70,10 @@ const readEffect = async (request) => {
             files.set(key, value);
     return { body: String(form.get('request') ?? '{}'), files };
 };
-export function createHandler({ build, resolvers, session: sessionOption = () => null, now = Date.now, styles = null, widgets = null, onError = (error, info) => console.error('[hozu]', info, error), csp = {}, cache = memoryCache(), readFile, manifest, images = null, env: rawEnv = {}, preview, og = null, render, }) {
+export function createHandler(first, host) {
+    return handlerFor(appOptionsOf(first) ? appHandlerOptions(first, host) : first);
+}
+function handlerFor({ build, resolvers, session: sessionOption, now = Date.now, styles = null, widgets = null, onError = (error, info) => console.error('[hozu]', info, error), csp = {}, cache = memoryCache(), readFile, manifest, images = null, env: rawEnv = {}, preview, og = null, render, }) {
     const generated = render ? instantiate(render) : undefined;
     const cards = new Map();
     const ogImage = (url) => {
@@ -95,7 +99,7 @@ export function createHandler({ build, resolvers, session: sessionOption = () =>
     if (preview && preview.secret.length < 32)
         throw new Error('preview.secret must be at least 32 characters');
     const previewCookie = preview
-        ? sessionCookie({
+        ? signedCookie({
             name: 'hozu_preview',
             secret: preview.secret,
             maxAge: 60 * 60,
@@ -110,26 +114,44 @@ export function createHandler({ build, resolvers, session: sessionOption = () =>
     const variants = manifest?.images ?? images?.variants ?? null;
     if (manifest && manifest.irHash !== hashJson(build.ir))
         throw new Error('The build manifest does not match this project; run `hozu build` again');
-    const untransformed = build.diagnostics.find((d) => d.code === 'HZ044' || d.code === 'HZ047');
+    const untransformed = build.diagnostics.find((d) => ['HZ044', 'HZ047', 'HZ059'].includes(d.code));
     if (untransformed)
         throw new Error(`${untransformed.message}. ${untransformed.fix?.summary ?? ''}`);
-    const store = typeof sessionOption === 'function' ? null : sessionOption;
+    const { ir } = build;
+    if (sessionOption === undefined && ir.session && !rawEnv.SESSION_SECRET && rawEnv.NODE_ENV === 'production')
+        throw new Error('This project declares a session: set SESSION_SECRET, or pass createHandler({ session: memorySessions({ secret }) })');
+    const store = typeof sessionOption === 'function'
+        ? null
+        : (sessionOption ??
+            (ir.session
+                ? memorySessions({
+                    secret: rawEnv.SESSION_SECRET,
+                    secure: rawEnv.SESSION_SECURE
+                        ? rawEnv.SESSION_SECURE === 'true'
+                        : rawEnv.NODE_ENV === 'production',
+                })
+                : null));
     const session = store
         ? (request) => store.read(request)
-        : async (request) => sessionOption(request);
-    const { ir } = build;
+        : async (request) => sessionOption?.(request) ?? null;
     const { basePath, redirects, headers: headerRules } = ir.http;
     const assets = manifest
         ? publicAssets(basePath, manifest.styles, Object.fromEntries(Object.entries(manifest.widgets).map(([k, w]) => [k, w.url])))
         : publicAssets(basePath, styles, widgets?.urls ?? {});
     assertWidgetBundle(ir, assets.widgets, Boolean(manifest || widgets));
     const data = createDataRuntime({ build, resolvers, now, onError, env: rawEnv });
-    const previewData = {
-        ...data,
-        run: (ref, input, who, files) => data.run(ref, input, who, files, { preview: true }),
+    const scopes = new WeakMap();
+    const dataFor = (request) => {
+        let scope = scopes.get(request);
+        if (!scope) {
+            scope = session(request).then((who) => data.scope(who, { preview: previewing.get(request) === true }));
+            scopes.set(request, scope);
+        }
+        return scope;
     };
-    const dataFor = (request) => (previewing.get(request) ? previewData : data);
-    const internal = (path) => (path?.startsWith('/') && !path.startsWith('//') ? path : null);
+    const hasSession = build.ir.session !== null;
+    const privately = (read) => read ? { 'cache-control': 'private, no-cache', ...(hasSession ? { vary: 'Cookie' } : {}) } : {};
+    const internal = (path) => path && /^\/(?![/\\])/.test(path) && ![...path].some((c) => c < ' ') ? path : null;
     const enterPreview = async (url) => {
         const given = new TextEncoder().encode(url.searchParams.get('secret') ?? '');
         const want = new TextEncoder().encode(preview?.secret ?? '');
@@ -173,29 +195,13 @@ export function createHandler({ build, resolvers, session: sessionOption = () =>
             return { locale: null, rest: path };
         const segment = path.split('/')[1] ?? '';
         if (!locales.includes(segment))
-            return null;
+            return { locale: ir.site.lang, rest: path };
         return { locale: segment, rest: path.slice(segment.length + 1) || '/' };
     };
-    const negotiate = (request, url, path) => {
-        const wanted = (request.headers.get('accept-language') ?? '')
-            .split(',')
-            .map((part) => {
-            const [tag = '', q] = part.trim().split(';q=');
-            return { tag: tag.toLowerCase(), q: q === undefined ? 1 : Number(q) };
-        })
-            .filter((w) => w.tag && w.q > 0)
-            .sort((a, b) => b.q - a.q);
-        const list = locales ?? [];
-        const best = wanted
-            .map((w) => list.find((l) => l.toLowerCase() === w.tag) ??
-            list.find((l) => l.toLowerCase().split('-')[0] === w.tag.split('-')[0]))
-            .find(Boolean) ?? ir.site.lang;
-        return new Response(null, {
-            status: 307,
-            headers: { location: publicPath(ir, path, best) + url.search, vary: 'Accept-Language' },
-        });
-    };
     const queries = Object.values(ir.features).flatMap((f) => Object.keys(f.queries).map((q) => `${f.id}.${q}`));
+    const perRequest = new Set(Object.values(ir.features).flatMap((f) => Object.entries(f.queries)
+        .filter(([, q]) => q.freshness.kind === 'request')
+        .map(([q]) => `${f.id}.${q}`)));
     const regenerating = new Map();
     const fns = fnsModule(build);
     const manifestText = webManifest(ir);
@@ -240,32 +246,75 @@ export function createHandler({ build, resolvers, session: sessionOption = () =>
     };
     const generate = async (path, route, params, search, locale) => {
         const at = now();
-        const { html, tags, status, redirect } = await renderToString({
-            build,
-            data,
-            route,
-            params,
-            search,
-            assets,
-            images: variants,
-            ...(generated ? { render: generated } : {}),
-            env: publicEnv,
-            locale,
-        });
-        const page = { html, status, redirect, at, ttl: ttlOf(route), tags: [...tags] };
-        await cache.set(path, page);
-        return page;
-    };
-    const listeners = new Set();
-    const revalidate = async (tags) => {
-        if (tags.length) {
-            const message = encoder.encode(`data: ${JSON.stringify(tags)}\n\n`);
-            for (const c of listeners)
-                c.enqueue(message);
+        const started = epoch;
+        generating++;
+        try {
+            const { html, tags, status, redirect } = await renderToString({
+                build,
+                data,
+                route,
+                params,
+                search,
+                assets,
+                images: variants,
+                ...(generated ? { render: generated } : {}),
+                env: publicEnv,
+                locale,
+            });
+            const page = { html, status, redirect, at, ttl: ttlOf(route), tags: [...tags] };
+            if (!page.tags.some((t) => (revalidatedAt.get(t) ?? -1) > started))
+                await cache.set(path, page);
+            return page;
+        }
+        finally {
+            if (--generating === 0)
+                revalidatedAt.clear();
         }
-        data.invalidate(tags);
+    };
+    let epoch = 0;
+    let generating = 0;
+    const revalidatedAt = new Map();
+    const dropPages = async (tags) => {
+        if (!tags.length)
+            return 0;
+        epoch++;
+        if (generating)
+            for (const t of tags)
+                revalidatedAt.set(t, epoch);
         return cache.deleteTags(tags);
     };
+    const listeners = new Map();
+    const broadcast = (tags) => {
+        if (!tags.length)
+            return;
+        for (const [c, subscribed] of listeners) {
+            const mine = tags.filter((t) => subscribed.has(t));
+            if (mine.length)
+                c.enqueue(encoder.encode(`data: ${JSON.stringify(mine)}\n\n`));
+        }
+    };
+    const after = (tags) => {
+        if (tags.length)
+            setTimeout(() => broadcast(tags), 0);
+    };
+    const TAG_USE = Symbol.for('hozu.tagUse');
+    const tagKeyOf = (use) => {
+        const u = use[TAG_USE];
+        const ref = u ? build.bindings.refs.get(u.tag) : undefined;
+        if (!u || !ref)
+            throw new TypeError('revalidate takes tag uses of this project: server.revalidate([notesTag()])');
+        const dot = ref.indexOf('.');
+        return ir.features[ref.slice(0, dot)]?.tags[ref.slice(dot + 1)]?.param
+            ? `${ref}(${canonicalStringify(u.param)})`
+            : ref;
+    };
+    const revalidate = async (uses) => {
+        const tags = [...new Set(uses.map(tagKeyOf))];
+        const entries = data.invalidate(tags);
+        const pages = await dropPages(tags);
+        broadcast(tags);
+        return { entries, pages };
+    };
     const json = (body, headers = {}) => new Response(JSON.stringify(body), { headers: { 'content-type': 'application/json', ...headers } });
     const plain = (status, body, headers = {}) => new Response(body, { status, headers: { 'content-type': 'text/plain', ...headers } });
     const see = (location, cookie = null) => new Response(null, { status: 303, headers: { location, ...(cookie ? { 'set-cookie': cookie } : {}) } });
@@ -273,25 +322,29 @@ export function createHandler({ build, resolvers, session: sessionOption = () =>
     const effect = async (request) => {
         const { body, files } = await readEffect(request);
         const { effect, input, keys } = JSON.parse(body);
-        const who = await session(request);
-        const result = (await data.run(effect, input, who, files));
+        const scope = await dataFor(request);
+        const result = (await scope.run(effect, input, files));
         const invalidated = result.invalidated ?? [];
-        if (invalidated.length)
-            await revalidate(invalidated);
+        await dropPages(invalidated);
+        const changed = new Set(invalidated);
         const refreshed = [];
-        if (invalidated.length)
-            for (const key of keys) {
-                const ref = queries.find((q) => key.startsWith(q) && '{["tfn0123456789-'.includes(key[q.length] ?? ''));
-                if (ref)
-                    refreshed.push([
-                        key,
-                        (await data.run(ref, JSON.parse(key.slice(ref.length)), who)),
-                    ]);
-            }
-        const cookie = store && 'session' in result ? await store.write(result.session) : null;
+        for (const key of keys) {
+            const ref = queries.find((q) => key.startsWith(q) && '{["tfn0123456789-'.includes(key[q.length] ?? ''));
+            if (!ref)
+                continue;
+            const input = JSON.parse(key.slice(ref.length));
+            if (perRequest.has(ref) || data.tagsOf(ref, input).some((t) => changed.has(t)))
+                refreshed.push([key, (await scope.run(ref, input))]);
+        }
+        const cookie = store && scope.written ? await store.write(scope.written.value, request) : null;
         const { invalidated: _, session: __, ...rest } = result;
-        const response = { result: rest, refreshed };
-        return json(response, cookie ? { 'set-cookie': cookie } : {});
+        const response = {
+            result: rest,
+            refreshed,
+            ...(scope.written ? { session: true } : {}),
+        };
+        after(invalidated);
+        return json(response, { ...privately(true), ...(cookie ? { 'set-cookie': cookie } : {}) });
     };
     const page = async (path, route, params, search, request, missing, locale) => {
         const headers = {
@@ -302,9 +355,16 @@ export function createHandler({ build, resolvers, session: sessionOption = () =>
         const head = request.method === 'HEAD';
         const statusOf = (s) => (missing ? 404 : s);
         const inPreview = previewing.get(request) === true;
+        const plan = planRoute(ir, route).plan;
         if (inPreview)
             Object.assign(headers, { 'cache-control': 'private, no-store', 'x-robots-tag': 'noindex' });
-        if (!inPreview && planRoute(ir, route).plan.cacheable) {
+        else if (plan.cacheable)
+            Object.assign(headers, { 'cache-control': 'public, max-age=0, must-revalidate' });
+        else if (plan.regions.some((r) => r.scope === 'user'))
+            Object.assign(headers, privately(true));
+        else
+            Object.assign(headers, { 'cache-control': 'no-cache' });
+        if (!inPreview && plan.cacheable) {
             let cached = await cache.get(path);
             let state = 'hit';
             if (!cached) {
@@ -327,11 +387,11 @@ export function createHandler({ build, resolvers, session: sessionOption = () =>
         }
         const rendered = await renderPage({
             build,
-            data: dataFor(request),
+            data,
+            scope: await dataFor(request),
             route,
             params,
             search,
-            session: await session(request),
             assets,
             images: variants,
             ...(generated ? { render: generated } : {}),
@@ -348,8 +408,8 @@ export function createHandler({ build, resolvers, session: sessionOption = () =>
     const formPost = async (request, url, path) => {
         const id = url.searchParams.get(FORM_FIELD);
         const where = split(path);
-        const found = where ? match(where.rest) : null;
-        const locale = where?.locale ?? null;
+        const found = match(where.rest);
+        const locale = where.locale;
         const form = id ? formNode(build, id) : null;
         if (!found || !form)
             return notAllowed();
@@ -357,50 +417,53 @@ export function createHandler({ build, resolvers, session: sessionOption = () =>
         query.delete(FORM_FIELD);
         const search = parseSearch(ir.routes[found.route]?.search ?? null, query);
         const fields = await formFields(request);
-        const who = await session(request);
+        const scope = await dataFor(request);
         const outcome = await runForm({
             build,
-            data,
+            data: scope,
             routes: tableOf(locale),
             form,
             fields,
+            route: found.route,
             params: found.params,
             search,
-            session: who,
         });
         if (!outcome)
             return notAllowed();
-        if (outcome.invalidated.length)
-            await revalidate(outcome.invalidated);
-        const cookie = store && outcome.session ? await store.write(outcome.session.value) : null;
+        await dropPages(outcome.invalidated);
+        const cookie = store && outcome.session ? await store.write(outcome.session.value, request) : null;
         const back = pathOf(tableOf(locale)[found.route] ?? url.pathname, found.params, search);
-        const target = outcome.navigate ?? (outcome.unchanged ? back : null);
-        if (target)
+        const target = outcome.invalid ? null : (outcome.navigate ?? (outcome.unchanged ? back : null));
+        if (target) {
+            after(outcome.invalidated);
             return see(target, cookie);
+        }
         const rendered = await renderPage({
             build,
             data,
+            scope,
             route: found.route,
             params: found.params,
             search,
             snapshots: outcome.snapshots,
-            session: who,
             assets,
             images: variants,
             ...(generated ? { render: generated } : {}),
             env: publicEnv,
             locale,
         });
-        return new Response(stream(rendered.chunks, (e) => onError(e, { path })), {
-            status: outcome.unexpected ? 500 : rendered.status,
+        const response = new Response(stream(rendered.chunks, (e) => onError(e, { path })), {
+            status: outcome.unexpected ? 500 : outcome.invalid ? 400 : rendered.status,
             headers: {
                 ...extraHeaders(found.route),
                 'content-type': 'text/html; charset=utf-8',
-                'cache-control': 'no-store',
+                ...privately(true),
                 ...(cookie ? { 'set-cookie': cookie } : {}),
                 ...(await secureHeaders()),
             },
         });
+        after(outcome.invalidated);
+        return response;
     };
     const files = {};
     for (const [href, file] of Object.entries(styles?.assets ?? {}))
@@ -423,12 +486,12 @@ export function createHandler({ build, resolvers, session: sessionOption = () =>
     const text = (type, body, head, cacheControl) => new Response(head ? null : body, {
         headers: { 'content-type': type, ...(cacheControl ? { 'cache-control': cacheControl } : {}) },
     });
-    const live = () => {
+    const live = (url) => {
         let self = null;
         const body = new ReadableStream({
             start(controller) {
                 self = controller;
-                listeners.add(controller);
+                listeners.set(controller, new Set(url.searchParams.getAll('tag')));
                 controller.enqueue(encoder.encode(': live\n\n'));
             },
             cancel() {
@@ -440,44 +503,98 @@ export function createHandler({ build, resolvers, session: sessionOption = () =>
             headers: { 'content-type': 'text/event-stream', 'cache-control': 'no-cache' },
         });
     };
-    const missing = (request, locale = null) => ir.notFound
+    const missing = async (request, locale = null) => ir.notFound
         ? page(`#404:${locale ?? ''}`, ir.notFound, null, null, request, true, locale)
-        : plain(404, request.method === 'HEAD' ? null : 'Not found');
+        : new Response(request.method === 'HEAD' ? null : NOT_FOUND_HTML, {
+            status: 404,
+            headers: { 'content-type': 'text/html; charset=utf-8', ...(await secureHeaders()) },
+        });
     const endpointRefs = new Map(Object.values(ir.features).flatMap((f) => Object.entries(f.endpoints ?? {}).map(([symbol, e]) => [`${e.method} ${e.path}`, `${f.id}.${symbol}`])));
+    const LINK = Symbol.for('hozu.link');
+    const locationOf = (href) => {
+        const l = href?.[LINK];
+        const ref = l ? build.bindings.refs.get(l.route) : undefined;
+        return ref?.startsWith('#route:') ? pathOf(table[ref.slice(7)] ?? '/', l.params, l.search) : null;
+    };
+    const endpointIRs = new Map(Object.values(ir.features).flatMap((f) => Object.entries(f.endpoints).map(([sym, e]) => [
+        `${f.id}.${sym}`,
+        { feature: f, sym, e },
+    ])));
+    const htmlFromEndpoint = (ref) => {
+        const { feature, sym } = endpointIRs.get(ref);
+        const pointer = join('', 'features', feature.id, 'endpoints', sym);
+        const diagnostic = {
+            code: 'HZ053',
+            severity: codes.HZ053.severity,
+            message: `Endpoint ${ref} answered text/html`,
+            location: { feature: feature.id, pointer, source: resolveSource(build.sources, pointer) },
+            cause: 'A page is rendered from the IR, with its CSP, headers, lang and view-transition opt-in; HTML from an endpoint has none of them. The framework answers 500 instead.',
+            fix: {
+                summary: 'Render it as a ui.page, and answer 403 / 404 / 410 or redirect through head.failed',
+                snippet: `ui.page(route, { views: [...], head: { query, input, render, failed: { Forbidden: 403 } } })`,
+                patch: null,
+            },
+        };
+        return Object.assign(new Error(`HZ053 ${diagnostic.message}. ${diagnostic.fix.summary}`), { diagnostic });
+    };
     const endpointCall = async (request, url, ref) => {
-        let input;
-        if (request.method === 'GET')
-            input = Object.fromEntries(url.searchParams);
+        const { feature, e } = endpointIRs.get(ref);
+        let input = null;
+        let bytes;
+        if (e.raw)
+            bytes = new Uint8Array(await request.arrayBuffer());
+        else if (request.method !== 'POST')
+            input = queryInput(feature.schemas[e.input] ?? null, url.searchParams);
         else if ((request.headers.get('content-type') ?? '').includes('json'))
             input = (await request.json().catch(() => null));
-        else {
-            const form = await request.formData().catch(() => null);
-            input = Object.fromEntries([...(form?.entries() ?? [])].filter((e) => typeof e[1] === 'string'));
-        }
-        let next = null;
-        const result = await dataFor(request).endpoint(ref, input, {
-            request,
-            session: await session(request),
-            setSession: (value) => {
-                next = { value };
-            },
-            preview: previewing.get(request) === true,
-        });
-        const saved = next;
-        const cookie = store && saved ? await store.write(saved.value) : null;
-        const withCookie = (response) => {
+        else
+            input = await endpointForm(feature.schemas[e.input] ?? null, request).catch(() => null);
+        const scope = await dataFor(request);
+        const result = await scope.endpoint(ref, input, { request, ...(bytes ? { bytes } : {}) });
+        const cookie = store && scope.written ? await store.write(scope.written.value, request) : null;
+        const finish = (response) => {
+            const out = new Response(response.body, response);
+            for (const [k, v] of Object.entries(base))
+                if (!out.headers.has(k))
+                    out.headers.set(k, v);
             if (cookie)
-                response.headers.append('set-cookie', cookie);
-            return response;
+                out.headers.append('set-cookie', cookie);
+            if (!out.headers.has('cache-control'))
+                for (const [k, v] of Object.entries(privately(scope.readSession)))
+                    out.headers.set(k, v);
+            return out;
         };
         if (!result.ok)
-            return withCookie(new Response(JSON.stringify({ message: result.message, fields: result.fields }), {
-                status: result.status,
-                headers: { 'content-type': 'application/json' },
-            }));
-        if (result.value instanceof Response)
-            return withCookie(result.value);
-        return json(result.value, cookie ? { 'set-cookie': cookie } : {});
+            return finish(new Response(JSON.stringify({
+                error: result.error,
+                message: result.message,
+                ...(result.fields ? { fields: result.fields } : {}),
+            }), { status: result.status, headers: { 'content-type': 'application/json' } }));
+        await dropPages(result.invalidated);
+        let response;
+        const to = result.redirect === undefined ? null : locationOf(result.redirect);
+        if (result.redirect !== undefined && !to) {
+            onError(new Error(`${ref} returned redirect() of something that is not ui.link(route, …)`), {
+                path: url.pathname,
+            });
+            response = plain(500, 'Internal error');
+        }
+        else if (to)
+            response = see(to);
+        else if (result.value instanceof Response) {
+            if ((result.value.headers.get('content-type') ?? '').toLowerCase().includes('text/html')) {
+                const error = htmlFromEndpoint(ref);
+                onError(error, { path: url.pathname });
+                response = plain(500, error.message);
+            }
+            else
+                response = result.value;
+        }
+        else
+            response = json(result.value);
+        const out = finish(response);
+        after(result.invalidated);
+        return out;
     };
     const route = async (request, url, path) => {
         if (request.method === 'POST' && crossSite(request))
@@ -493,10 +610,12 @@ export function createHandler({ build, resolvers, session: sessionOption = () =>
             const { query, input } = (await request.json());
             if (!queries.includes(query))
                 return plain(400, 'Unknown query');
-            return json(await dataFor(request).run(query, input, await session(request)));
+            const scope = await dataFor(request);
+            const result = await scope.run(query, input);
+            return json(result, privately(scope.readSession));
         }
         if (path === '/_hozu/live')
-            return live();
+            return live(url);
         if (path === '/manifest.webmanifest' && manifestText)
             return text('application/manifest+json', manifestText, request.method === 'HEAD');
         if (path === '/sw.js' && worker)
@@ -548,11 +667,7 @@ export function createHandler({ build, resolvers, session: sessionOption = () =>
         const moved = redirectFor(path, url.search);
         if (moved)
             return moved;
-        if (locales && path === '/')
-            return negotiate(request, url, '/');
         const where = split(path);
-        if (!where)
-            return match(path) ? negotiate(request, url, path) : missing(request);
         const found = match(where.rest);
         if (!found)
             return missing(request, where.locale);