@janit/fu 0.0.4 → 0.2.1

package/README.md

@@ -8,9 +8,10 @@ No Vite, no Babel, no esbuild. The bundler, JSX transform and CSS engine are
 all Rust.
 
 ```
-core     ~300 lines   router + render + client + hmr runtime
-drivers  ~400 lines   build + dev + shared rolldown plugins
+core     ~560 lines   router + render + client + hmr runtime
+drivers  ~490 lines   build + dev + shared driver glue + rolldown plugins
 ```
+(code lines, comments and blanks excluded)
 
 ## What this is
 
@@ -27,10 +28,10 @@ It is experimental and primarily just for myself. Use it accordingly.
 deno add npm:@janit/fu        # or: npm i @janit/fu
 ```
 
-Install from **npm**, not JSR. The framework hands its own runtime modules to
-rolldown, and a bundler cannot resolve a remote module — Deno keeps JSR packages
-as `https:` URLs, so `jsr:@janit/fu` builds nothing. npm gives a real directory
-on disk. (The JSR copy exists for reading the API and for runtime-only use.)
+npm is the only channel. The framework hands its own runtime modules to
+rolldown, so it must be a real directory on disk, which an npm install is. It
+was on JSR up to 0.0.4 and was withdrawn from there: Deno keeps JSR packages
+as remote `https:` modules, and a bundler cannot fetch one.
 
 The npm package ships compiled JavaScript, because Deno refuses to type-strip
 TypeScript inside `node_modules`.
@@ -47,15 +48,19 @@ deno task todo:dev     # the fu-todo example app
 deno task todo:build
 deno task todo:start   # serve its build on :1337
 
-deno task test     # 41 unit tests
-deno task check    # types + tests + jsr publish dry-run
-deno task check:pkg  # build and serve a real app from the packed npm artefact
+deno task test     # unit tests, no browser
+deno task check    # format, lint, types (framework and both apps), tests
+deno task check:pkg  # build, serve and dev-serve a real app from the packed npm artefact
 ```
 
 Both example apps build against **this checkout's `src/`**, never a published
 package, so the framework and the apps can be changed and tested together
-before anything is released. `npm install` at the root is the only setup step;
-it serves the whole repo.
+before anything is released. The drivers make that hold: they alias the
+framework's own package name to the runtime copy they are running from, so an
+app's `import { App } from "@janit/fu"` cannot drift to a stale
+`dist/` through Node's package self-reference. The apps are Deno workspace
+members, so `deno check` sees the same mapping. `npm install` at the root is
+the only setup step; it serves the whole repo.
 
 Then run the build on whichever runtime you like — one artifact, three runtimes:
 
@@ -146,6 +151,18 @@ export const redirects: Middleware<State> = (ctx) => {
 };
 ```
 
+Nothing in a request says whether `fu dev` or a build is serving it, and the
+same middleware runs in both. So the dev server sets `FU_DEV=1` in its own
+environment before it starts the app, and a built server never does. Read it
+for anything that must be laxer in dev — a Content-Security-Policy, say, which
+has to name the HMR socket on `port + 1`, because a different port is a
+different origin:
+
+```ts
+const dev = Deno.env.get("FU_DEV") === "1"; // process.env.FU_DEV on Node and Bun
+const connectSrc = dev ? "connect-src 'self' ws://localhost:*" : "connect-src 'self'";
+```
+
 ## Errors
 
 Anything thrown by a handler, a page or a middleware is turned into a response
@@ -176,8 +193,13 @@ Two things the framework does for you:
   During a deploy a valid URL can 404 for a few seconds, and a shared cache
   would pin that.
 
-Errors are caught at the route boundary and returned *through* the middleware
-chain, so security headers and logging middleware still see them.
+Errors from a handler or a page are caught at the route boundary and returned
+*through* the middleware chain, so security headers and logging middleware still
+see them. A middleware that throws is different: the throw propagates outward
+past every `await ctx.next()`, so an outer middleware can catch it, and only what
+nobody catches becomes an error response — at the very top, after the chain has
+unwound, without the headers the middleware would have set. To refuse a request
+from middleware, return the response rather than throwing.
 
 ## Page metadata
 
@@ -232,9 +254,17 @@ type RouteManifest = Record<string, () => Promise<RouteModule>>;
 type Assets = { js: { href: string }[]; css: { href: string }[] };
 ```
 
-Everything bundler-specific lives in the drivers (`src/build.ts`, `src/dev.ts`)
-and the shared plugins (`src/plugins.ts`). The same core ran unchanged under a
-Vite driver during prototyping, so swapping the build layer stays cheap.
+Everything bundler-specific lives in the drivers (`src/build.ts`, `src/dev.ts`),
+the glue they share (`src/driver.ts`: locating the runtime modules, scanning a
+project, the rolldown and nitro option sets) and the rolldown plugins
+(`src/plugins.ts`). The same core ran unchanged under a Vite driver during
+prototyping, so swapping the build layer stays cheap.
+
+Routing is on `URLPattern`, but `exec` costs microseconds per route on Deno,
+so it only runs when it can matter: a route with no pattern syntax is matched
+by string equality against its canonical pathname, and a pattern whose
+segment count cannot fit the path is skipped. A static hit is ~65 ns and a
+dynamic one ~1.6 µs with 16 routes, down from 28 µs and 57 µs.
 
 See [the design doc](docs/design.md) for
 the full rationale and the nine undocumented traps this implementation encodes.
@@ -245,16 +275,18 @@ the full rationale and the nine undocumented traps this implementation encodes.
 deno task test
 ```
 
-`deno test` over `src/`, no browser needed. The suite is written against the
+`deno test` over the whole workspace, no browser needed. The framework suite is written against the
 failure modes this framework actually hit, so each one guards a real regression:
 
 | area | what it pins down |
 |---|---|
-| router | static beats dynamic beats wildcard; wildcards span segments; params decode |
+| router | static beats dynamic beats wildcard; wildcards span segments and match their own base path; params decode, but an escaped `/`, NUL, backslash or dot segment never reaches one; a non-ASCII static route matches its percent-encoded request |
 | middleware | outer unwinds last and decorates inner short-circuits; `next()` twice rejects; throws propagate |
 | render | head escaping; JSON-LD cannot close its own `<script>`; 404 vs 405; islands get a marker |
 | errors | a 500 never leaks its message; error responses are uncacheable; a broken error page falls back |
-| plugins | `composes` keeps every class name; CSS output changes with content; the JSX transform never touches rolldown's runtime; the H3Event unwrap |
+| plugins | `composes` keeps every class name; CSS output changes with content; the JSX transform never touches rolldown's runtime; the package self-alias |
+| driver | the server entry imports only the optional files that exist; the H3Event unwrap |
+| dev | the HMR socket admits only the dev server's own pages, not another site or a rebound name |
 
 Two of these were found by writing the suite, not before it: `ctx.next()` called
 twice resumed at the wrong depth, and a middleware throwing synchronously
@@ -274,8 +306,11 @@ private history leaks:
 the privacy boundary, a staged-tree backstop that refuses the push if anything
 private reaches the index anyway, semver tagging derived from the public repo's
 existing tags, and version stamping so the git tag and `deno.json` cannot drift.
-`fu-todo/` is stripped from `janit/fu`; the framework specifier is rewritten
-from `../src/mod.ts` on the way into `janit/fu-todo`.
+`fu-todo/` is stripped from `janit/fu`, and from its Deno workspace; the
+framework specifier is rewritten from `../src/mod.ts` on the way into
+`janit/fu-todo`, which also gets its own `nodeModulesDir` since it is no
+longer a workspace member there. Both flows can be rehearsed against a local
+bare repository by overriding `PUBLIC_REPO`.
 
 ## Known gaps
 

package/dist/app.d.ts

@@ -20,6 +20,4 @@ export declare class App<S = Record<string, unknown>> {
     use(middleware: Middleware<S>): this;
     /** The registered chain, in registration order. */
     get middleware(): readonly Middleware<S>[];
-    /** Wrap a terminal handler in this app's chain. */
-    compose(terminal: (ctx: Ctx<S>) => Response | Promise<Response>): (ctx: Ctx<S>) => Promise<Response>;
 }

package/dist/app.js

@@ -72,9 +72,5 @@ export class App {
     get middleware() {
         return this.#middleware;
     }
-    /** Wrap a terminal handler in this app's chain. */
-    compose(terminal) {
-        return compose(this.#middleware, terminal);
-    }
 }
 //# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,SAAS,MAAM,CAAC,EAAsC;IACpD,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,UAAoC,EACpC,QAAuD;IAEvD,OAAO,CAAC,IAAY,EAAqB,EAAE;QACzC,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,IAAY,EAAqB,EAAE;YAC9D,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YACzB,oEAAoE;YACpE,sEAAsE;YACtE,uCAAuC;YACvC,IAAI,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAE7C,qEAAqE;YACrE,yEAAyE;YACzE,qEAAqE;YACrE,yDAAyD;YACzD,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,MAAM,GAAG,GAAW;gBAClB,GAAG,IAAI;gBACP,IAAI,EAAE,GAAG,EAAE;oBACT,IAAI,MAAM,EAAE,CAAC;wBACX,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,wDAAwD,CAAC,CACpE,CAAC;oBACJ,CAAC;oBACD,MAAM,GAAG,IAAI,CAAC;oBACd,OAAO,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC9B,CAAC;aACF,CAAC;YACF,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,OAAO,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,GAAG;IACL,WAAW,GAAoB,EAAE,CAAC;IAE3C,gEAAgE;IAChE,GAAG,CAAC,UAAyB;QAC3B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mDAAmD;IACnD,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,mDAAmD;IACnD,OAAO,CACL,QAAuD;QAEvD,OAAO,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;CACF"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,SAAS,MAAM,CAAC,EAAsC;IACpD,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,UAAoC,EACpC,QAAuD;IAEvD,OAAO,CAAC,IAAY,EAAqB,EAAE;QACzC,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,IAAY,EAAqB,EAAE;YAC9D,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YACzB,oEAAoE;YACpE,sEAAsE;YACtE,uCAAuC;YACvC,IAAI,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAE7C,qEAAqE;YACrE,yEAAyE;YACzE,qEAAqE;YACrE,yDAAyD;YACzD,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,MAAM,GAAG,GAAW;gBAClB,GAAG,IAAI;gBACP,IAAI,EAAE,GAAG,EAAE;oBACT,IAAI,MAAM,EAAE,CAAC;wBACX,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,wDAAwD,CAAC,CACpE,CAAC;oBACJ,CAAC;oBACD,MAAM,GAAG,IAAI,CAAC;oBACd,OAAO,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC9B,CAAC;aACF,CAAC;YACF,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,OAAO,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,GAAG;IACL,WAAW,GAAoB,EAAE,CAAC;IAE3C,gEAAgE;IAChE,GAAG,CAAC,UAAyB;QAC3B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mDAAmD;IACnD,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF"}

package/dist/build.d.ts

@@ -1,4 +1,2 @@
 import type { FuOptions } from "./types.js";
 export declare function build(opts: FuOptions): Promise<void>;
-/** Concatenate collected stylesheets into one hashed file. Returns its name. */
-export declare function writeSheets(dir: string, sheets: Map<string, string>): string | null;

package/dist/build.js

@@ -1,52 +1,17 @@
 // Production driver: rolldown builds the client, nitro builds the server.
 import { rolldown } from "rolldown";
 import { build as nitroBuild, copyPublicAssets, createNitro } from "nitro/builder";
-import * as fs from "node:fs";
 import * as path from "node:path";
-import { bootModule, css, jsx, optional, ssrModule, virtual, walk } from "./plugins.js";
-/**
- * Directory holding the framework's own runtime modules, whose paths are handed
- * to rolldown. `import.meta.dirname` is undefined when this module is loaded
- * from a remote URL, and a bundler cannot fetch `https:` modules anyway — so
- * fail with the reason rather than a TypeError three frames later.
- */
-const HERE = import.meta.dirname ?? remoteFrameworkError();
-/**
- * Extension of the framework's own runtime modules: `.ts` when running from
- * source (this repo, or JSR), `.js` when running from the compiled npm build.
- */
-const EXT = import.meta.url.endsWith(".js") ? ".js" : ".ts";
-function remoteFrameworkError() {
-    throw new Error("fu: the framework is loaded from a remote URL (" + import.meta.url + "), " +
-        "so its runtime modules cannot be handed to the bundler. Install it " +
-        "instead — `npm:@janit/fu` in a Deno import map, or `npm i @janit/fu` — " +
-        "so it resolves to a real directory.");
-}
+import { clientInput, emptyDir, nitroOptions, scanProject, writeSheets, writeSsrEntry, } from "./driver.js";
 export async function build(opts) {
-    const root = path.resolve(opts.root);
-    const outDir = opts.outDir ? path.resolve(opts.outDir) : path.join(root, ".output");
-    const clientDir = path.join(root, "dist/client");
-    const genDir = path.join(root, ".fu");
-    const routeFiles = walk(root, path.join(root, "routes"));
-    const islandFiles = walk(root, path.join(root, "islands"));
+    const project = scanProject(opts.root);
+    const outDir = opts.outDir ? path.resolve(opts.outDir) : path.join(project.root, ".output");
     // ---- client ----
-    fs.rmSync(clientDir, { recursive: true, force: true });
-    fs.mkdirSync(clientDir, { recursive: true });
+    emptyDir(project.clientDir);
     const sheets = new Map();
-    const bundle = await rolldown({
-        input: { boot: "fu:boot" },
-        plugins: [
-            virtual({ "fu:boot": bootModule(path.join(HERE, `client${EXT}`), islandFiles, root) }),
-            css(sheets),
-            jsx(),
-        ],
-        platform: "browser",
-        // rolldown types modules by extension and refuses to bundle CSS; css()
-        // has already replaced their contents with JS.
-        moduleTypes: { ".css": "js" },
-    });
+    const bundle = await rolldown(clientInput(project, sheets));
     const result = await bundle.write({
-        dir: clientDir,
+        dir: project.clientDir,
         format: "esm",
         entryFileNames: "[name]-[hash].js",
         chunkFileNames: "[name]-[hash].js",
@@ -55,54 +20,14 @@ export async function build(opts) {
     const entry = result.output.find((o) => o.type === "chunk" && o.isEntry);
     if (!entry)
         throw new Error("fu: client build produced no entry chunk");
-    const cssHref = writeSheets(clientDir, sheets);
+    const cssFile = writeSheets(project.clientDir, sheets);
     // ---- server ----
-    fs.rmSync(genDir, { recursive: true, force: true });
-    fs.mkdirSync(genDir, { recursive: true });
-    const assets = {
+    const ssrEntry = writeSsrEntry(project, {
         js: [{ href: "/" + entry.fileName }],
-        css: cssHref ? [{ href: "/" + cssHref }] : [],
-    };
-    // nitro path-resolves `handlers[].handler`, so a virtual id would not survive
-    // its routing codegen — generate a real file.
-    const ssrEntry = path.join(genDir, "ssr.ts");
-    fs.writeFileSync(ssrEntry, ssrModule({
-        renderPath: path.join(HERE, `render${EXT}`),
-        routeFiles,
-        root,
-        assets: JSON.stringify(assets),
-        appPath: optional(root, "app.ts", "app.tsx"),
-        shellPath: optional(root, "routes/_app.tsx"),
-        errorPath: optional(root, "routes/_error.tsx"),
-    }));
-    const nitro = await createNitro({
-        rootDir: root,
-        // Point nitro's scanner at the generated dir, never the project root, or it
-        // claims `routes/` as its own server routes and shadows our catch-all.
-        serverDir: genDir,
-        scanDirs: [],
-        output: { dir: outDir },
-        publicAssets: [{ dir: clientDir, baseURL: "/" }],
-        handlers: [{ route: "/**", handler: ssrEntry, format: "web", lazy: false }],
-        rollupConfig: {
-            // Islands are imported on the server too, so SSR needs the same handling.
-            plugins: [css(new Map()), jsx({ stampIslands: true })],
-            moduleTypes: { ".css": "js" },
-        },
+        css: cssFile ? [{ href: "/" + cssFile }] : [],
     });
+    const nitro = await createNitro({ ...nitroOptions(project, ssrEntry), output: { dir: outDir } });
     await copyPublicAssets(nitro);
     await nitroBuild(nitro);
 }
-/** Concatenate collected stylesheets into one hashed file. Returns its name. */
-export function writeSheets(dir, sheets) {
-    if (sheets.size === 0)
-        return null;
-    const merged = [...sheets.values()].join("\n");
-    let h = 7;
-    for (let i = 0; i < merged.length; i++)
-        h = (Math.imul(h, 31) + merged.charCodeAt(i)) >>> 0;
-    const name = `style-${h.toString(36)}.css`;
-    fs.writeFileSync(path.join(dir, name), merged);
-    return name;
-}
 //# sourceMappingURL=build.js.map

package/dist/build.js.map

@@ -1 +1 @@
-{"version":3,"file":"build.js","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAGxF;;;;;GAKG;AACH,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,OAAO,IAAI,oBAAoB,EAAE,CAAC;AAE3D;;;GAGG;AACH,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AAE5D,SAAS,oBAAoB;IAC3B,MAAM,IAAI,KAAK,CACb,iDAAiD,GAAG,OAAO,IAAI,CAAC,GAAG,GAAG,KAAK;QACzE,qEAAqE;QACrE,yEAAyE;QACzE,qCAAqC,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAe;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAEtC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IAE3D,mBAAmB;IACnB,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC;QAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1B,OAAO,EAAE;YACP,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,MAAM,CAAC;YACX,GAAG,EAAE;SACN;QACD,QAAQ,EAAE,SAAS;QACnB,uEAAuE;QACvE,+CAA+C;QAC/C,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;KAC9B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC;QAChC,GAAG,EAAE,SAAS;QACd,MAAM,EAAE,KAAK;QACb,cAAc,EAAE,kBAAkB;QAClC,cAAc,EAAE,kBAAkB;KACnC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAErB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAE/C,mBAAmB;IACnB,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG;QACb,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;KAC9C,CAAC;IACF,8EAA8E;IAC9E,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7C,EAAE,CAAC,aAAa,CACd,QAAQ,EACR,SAAS,CAAC;QACR,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,EAAE,CAAC;QAC3C,UAAU;QACV,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAC9B,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC5C,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;QAC5C,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;KAC/C,CAAC,CACH,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC;QAC9B,OAAO,EAAE,IAAI;QACb,4EAA4E;QAC5E,uEAAuE;QACvE,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;QACvB,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAChD,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC3E,YAAY,EAAE;YACZ,0EAA0E;YAC1E,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SAC9B;KACmC,CAAC,CAAC;IACxC,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,MAA2B;IAClE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC;IAC3C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,WAAW,EACX,aAAa,GACd,MAAM,aAAa,CAAC;AAGrB,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAe;IACzC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAE5F,mBAAmB;IACnB,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC;QAChC,GAAG,EAAE,OAAO,CAAC,SAAS;QACtB,MAAM,EAAE,KAAK;QACb,cAAc,EAAE,kBAAkB;QAClC,cAAc,EAAE,kBAAkB;KACnC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAErB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAEvD,mBAAmB;IACnB,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE;QACtC,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;KAC9C,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACjG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC"}

package/dist/cli.js

@@ -1,15 +1,15 @@
 #!/usr/bin/env -S deno run -A
+import process from "node:process";
 import { build } from "./build.js";
 import { dev } from "./dev.js";
 export async function main(argv) {
     const [cmd = "dev", ...rest] = argv;
-    const portArg = rest.find((a) => a.startsWith("--port="));
-    const hostArg = rest.find((a) => a.startsWith("--host="));
-    const rootArg = rest.find((a) => !a.startsWith("-"));
+    const flag = (name) => rest.find((a) => a.startsWith(`--${name}=`))?.slice(name.length + 3);
+    const port = flag("port");
     const opts = {
-        root: rootArg ?? Deno?.cwd?.() ?? process.cwd(),
-        port: portArg ? Number(portArg.slice("--port=".length)) : undefined,
-        hostname: hostArg ? hostArg.slice("--host=".length) : undefined,
+        root: rest.find((a) => !a.startsWith("-")) ?? process.cwd(),
+        port: port ? Number(port) : undefined,
+        hostname: flag("host"),
     };
     if (cmd === "build")
         await build(opts);
@@ -21,5 +21,5 @@ export async function main(argv) {
     }
 }
 if (import.meta.main)
-    await main(globalThis.process?.argv.slice(2) ?? []);
+    await main(process.argv.slice(2));
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc;IACvC,MAAM,CAAC,GAAG,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE;QAC/C,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACnE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;KAChE,CAAC;IACF,IAAI,GAAG,KAAK,OAAO;QAAE,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;SAClC,IAAI,GAAG,KAAK,KAAK;QAAE,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;SACnC,CAAC;QACJ,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,wBAAwB,CAAC,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAID,IAAI,OAAO,IAAI,CAAC,IAAI;IAAE,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc;IACvC,MAAM,CAAC,GAAG,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE;QAC3D,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QACrC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC;KACvB,CAAC;IACF,IAAI,GAAG,KAAK,OAAO;QAAE,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;SAClC,IAAI,GAAG,KAAK,KAAK;QAAE,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;SACnC,CAAC;QACJ,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,wBAAwB,CAAC,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,IAAI,OAAO,IAAI,CAAC,IAAI;IAAE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/client.d.ts

@@ -1,6 +1,12 @@
 import { type FunctionComponent } from "preact";
 type Props = Record<string, unknown>;
-/** Hydrate every `[data-island]` marker the server rendered. */
+/**
+ * Hydrate every `[data-island]` marker the server rendered.
+ *
+ * Every distinct island module is fetched at once, then the markers are
+ * hydrated in document order; awaiting each in turn would serialise one
+ * network round-trip per island.
+ */
 export declare function hydrateIslands(manifest: Record<string, () => Promise<{
     default: FunctionComponent<Props>;
 }>>): Promise<void>;

package/dist/client.js

@@ -25,18 +25,29 @@ function proxyFor(key, impl) {
     proxies.set(key, entry);
     return entry;
 }
-/** Hydrate every `[data-island]` marker the server rendered. */
+/**
+ * Hydrate every `[data-island]` marker the server rendered.
+ *
+ * Every distinct island module is fetched at once, then the markers are
+ * hydrated in document order; awaiting each in turn would serialise one
+ * network round-trip per island.
+ */
 export async function hydrateIslands(manifest) {
-    for (const el of document.querySelectorAll("[data-island]")) {
-        const key = el.dataset.island;
+    const els = [...document.querySelectorAll("[data-island]")];
+    const keys = [...new Set(els.map((el) => el.dataset.island))];
+    const loaded = new Map(await Promise.all(keys.map(async (key) => {
         const loader = manifest[key];
-        if (!loader) {
+        if (!loader)
             console.warn("[fu] no island module for", key);
+        return [key, loader ? (await loader()).default : null];
+    })));
+    for (const el of els) {
+        const key = el.dataset.island;
+        const impl = loaded.get(key);
+        if (!impl)
             continue;
-        }
-        const mod = await loader();
         const props = JSON.parse(el.dataset.props || "{}");
-        hydrate(h(proxyFor(key, mod.default).Component, props), el);
+        hydrate(h(proxyFor(key, impl).Component, props), el);
         const list = mounted.get(key) ?? [];
         list.push({ el, props });
         mounted.set(key, list);

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAepE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;AAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;AAC/C,IAAI,UAAU,GAAG,CAAC,CAAC;AAEnB;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,GAAW,EAAE,IAA8B;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAC7B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjC,6EAA6E;IAC7E,8EAA8E;IAC9E,uCAAuC;IACvC,MAAM,SAAS,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAS,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClF,MAAM,KAAK,GAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAA8E;IAE9E,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,gBAAgB,CAAc,eAAe,CAAC,EAAE,CAAC;QACzE,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,MAAO,CAAC;QAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAU,CAAC;QAC5D,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,cAAc,EAAE,CAAC;AACnB,CAAC;AAED,yEAAyE;AACzE,SAAS,cAAc;IACpB,UAAsC,CAAC,UAAU,GAAG,CACnD,GAAW,EACX,GAA0C,EACpC,EAAE;QACR,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,MAAM;YAAE,OAAO;QAC1B,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,EAAE,UAAU,CAAC;QAC3B,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,IAAI;YAAE,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAepE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;AAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;AAC/C,IAAI,UAAU,GAAG,CAAC,CAAC;AAEnB;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,GAAW,EAAE,IAA8B;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAC7B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjC,6EAA6E;IAC7E,8EAA8E;IAC9E,uCAAuC;IACvC,MAAM,SAAS,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAS,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClF,MAAM,KAAK,GAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAA8E;IAE9E,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,gBAAgB,CAAc,eAAe,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,MAAO,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAU,CAAC;IAClE,CAAC,CAAC,CAAC,CACJ,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,MAAO,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAU,CAAC;QAC5D,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,cAAc,EAAE,CAAC;AACnB,CAAC;AAED,yEAAyE;AACzE,SAAS,cAAc;IACpB,UAAsC,CAAC,UAAU,GAAG,CACnD,GAAW,EACX,GAA0C,EACpC,EAAE;QACR,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,MAAM;YAAE,OAAO;QAC1B,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,EAAE,UAAU,CAAC;QAC3B,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,IAAI;YAAE,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC;AACJ,CAAC"}

package/dist/dev.d.ts

@@ -1,2 +1,10 @@
 import type { FuOptions } from "./types.js";
+/**
+ * Whether a page at `origin` may open the HMR socket. A browser lets any site
+ * open a WebSocket to localhost, and this one streams module source on every
+ * save, so only the dev server's own pages get in: its port, on a loopback
+ * name or the host it was bound to. The HMR runtime dials localhost, so a page
+ * on another machine never gets a working socket anyway.
+ */
+export declare function hmrOriginAllowed(origin: string | null, port: number, hostname: string): boolean;
 export declare function dev(opts: FuOptions): Promise<void>;

package/dist/dev.js

@@ -5,71 +5,75 @@ import { serve } from "crossws/server";
 import { build as nitroBuild, createDevServer, createNitro, prepare } from "nitro/builder";
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { bootModule, css, jsx, optional, ssrModule, virtual, walk } from "./plugins.js";
-/**
- * Directory holding the framework's own runtime modules, whose paths are handed
- * to rolldown. `import.meta.dirname` is undefined when this module is loaded
- * from a remote URL, and a bundler cannot fetch `https:` modules anyway — so
- * fail with the reason rather than a TypeError three frames later.
- */
-const HERE = import.meta.dirname ?? remoteFrameworkError();
+import { clientInput, emptyDir, nitroOptions, runtime, scanProject, writeSheets, writeSsrEntry, } from "./driver.js";
+/** Set an env var on whichever runtime we are on; `Deno.env` is Deno-only. */
+function setEnv(name, value) {
+    const g = globalThis;
+    if (g.Deno)
+        g.Deno.env.set(name, value);
+    else if (g.process)
+        g.process.env[name] = value;
+}
+const LOOPBACK = new Set(["localhost", "127.0.0.1", "[::1]"]);
 /**
- * Extension of the framework's own runtime modules: `.ts` when running from
- * source (this repo, or JSR), `.js` when running from the compiled npm build.
+ * Whether a page at `origin` may open the HMR socket. A browser lets any site
+ * open a WebSocket to localhost, and this one streams module source on every
+ * save, so only the dev server's own pages get in: its port, on a loopback
+ * name or the host it was bound to. The HMR runtime dials localhost, so a page
+ * on another machine never gets a working socket anyway.
  */
-const EXT = import.meta.url.endsWith(".js") ? ".js" : ".ts";
-function remoteFrameworkError() {
-    throw new Error("fu: the framework is loaded from a remote URL (" + import.meta.url + "), " +
-        "so its runtime modules cannot be handed to the bundler. Install it " +
-        "instead — `npm:@janit/fu` in a Deno import map, or `npm i @janit/fu` — " +
-        "so it resolves to a real directory.");
+export function hmrOriginAllowed(origin, port, hostname) {
+    if (!origin)
+        return false;
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        return false;
+    if (url.port !== String(port))
+        return false;
+    return LOOPBACK.has(url.hostname) || url.hostname === hostname;
 }
 export async function dev(opts) {
-    const root = path.resolve(opts.root);
+    const project = scanProject(opts.root);
+    const { clientDir } = project;
     const port = opts.port ?? 1337;
     // Bind all interfaces so the dev server is reachable from other machines
     // and from inside containers, not just loopback.
     const hostname = opts.hostname ?? "0.0.0.0";
     const hmrPort = port + 1;
-    const clientDir = path.join(root, "dist/client");
-    const genDir = path.join(root, ".fu");
-    const routeFiles = walk(root, path.join(root, "routes"));
-    const islandFiles = walk(root, path.join(root, "islands"));
-    fs.rmSync(clientDir, { recursive: true, force: true });
-    fs.mkdirSync(clientDir, { recursive: true });
+    // An app cannot otherwise tell dev from production: nothing in the
+    // environment says so, and the same middleware runs in both. Anything that
+    // must be laxer in dev — a CSP that has to allow the HMR socket on
+    // `hmrPort`, a verbose error page — reads this.
+    setEnv("FU_DEV", "1");
+    emptyDir(clientDir);
     const sheets = new Map();
     const peers = new Map();
     let cssVersion = 0;
-    const writeSheets = () => {
-        if (sheets.size)
-            fs.writeFileSync(path.join(clientDir, "style.css"), [...sheets.values()].join("\n"));
-    };
+    const flushCss = () => writeSheets(clientDir, sheets, "style.css");
     // `implement` takes the runtime SOURCE, not a path — a path gets inlined
     // literally and parsed as a regex. `$ADDR` is only substituted in rolldown's
     // own default runtime, so do it here.
-    const hmrRuntime = fs.readFileSync(path.join(HERE, "hmr-runtime.js"), "utf8")
-        .replaceAll("$ADDR", `localhost:${hmrPort}`);
+    const hmrRuntime = fs.readFileSync(runtime.hmr, "utf8").replaceAll("$ADDR", `localhost:${hmrPort}`);
     const engine = await DevEngine.create({
-        input: { boot: "fu:boot" },
-        plugins: [
-            virtual({ "fu:boot": bootModule(path.join(HERE, `client${EXT}`), islandFiles, root) }),
-            css(sheets),
-            jsx({ hmr: true }),
-        ],
-        platform: "browser",
-        moduleTypes: { ".css": "js" },
+        ...clientInput(project, sheets, true),
         experimental: { devMode: { host: "localhost", port: hmrPort, implement: hmrRuntime } },
     }, { dir: clientDir, format: "esm", entryFileNames: "[name].js", chunkFileNames: "[name].js" }, {
         watch: { enabled: true },
         onOutput(o) {
             if (o instanceof Error)
                 return console.error("[fu] client build failed:", o.message);
-            writeSheets();
+            flushCss();
         },
         onHmrUpdates(r) {
             if (r instanceof Error)
                 return console.error("[fu] hmr error:", r.message);
-            writeSheets();
+            flushCss();
             for (const { clientId, update } of r.updates) {
                 const peer = peers.get(clientId);
                 if (!peer || update.type === "Noop")
@@ -112,8 +116,14 @@ export async function dev(opts) {
     };
     serve({
         port: hmrPort,
+        hostname,
         fetch: () => new Response("fu hmr"),
         websocket: {
+            upgrade(req) {
+                if (!hmrOriginAllowed(req.headers.get("origin"), port, hostname)) {
+                    return new Response("Forbidden", { status: 403 });
+                }
+            },
             async open(peer) {
                 const id = clientIdOf(peer);
                 if (!id)
@@ -132,31 +142,11 @@ export async function dev(opts) {
         },
     });
     // SSR.
-    fs.rmSync(genDir, { recursive: true, force: true });
-    fs.mkdirSync(genDir, { recursive: true });
-    const ssrEntry = path.join(genDir, "ssr.ts");
-    const assets = `{ js: [{ href: "/boot.js" }], css: [{ href: "/style.css" }] }`;
-    fs.writeFileSync(ssrEntry, ssrModule({
-        renderPath: path.join(HERE, `render${EXT}`),
-        routeFiles,
-        root,
-        assets,
-        appPath: optional(root, "app.ts", "app.tsx"),
-        shellPath: optional(root, "routes/_app.tsx"),
-        errorPath: optional(root, "routes/_error.tsx"),
-    }));
-    const nitro = await createNitro({
-        dev: true,
-        rootDir: root,
-        serverDir: genDir,
-        scanDirs: [],
-        publicAssets: [{ dir: clientDir, baseURL: "/" }],
-        handlers: [{ route: "/**", handler: ssrEntry, format: "web", lazy: false }],
-        rollupConfig: {
-            plugins: [css(new Map()), jsx({ stampIslands: true })],
-            moduleTypes: { ".css": "js" },
-        },
+    const ssrEntry = writeSsrEntry(project, {
+        js: [{ href: "/boot.js" }],
+        css: [{ href: "/style.css" }],
     });
+    const nitro = await createNitro({ ...nitroOptions(project, ssrEntry), dev: true });
     const server = createDevServer(nitro);
     server.listen({ port, hostname });
     // Order matters: listen -> prepare -> build. `build` starts the dev runner.