@jk2908/solas 0.3.8 → 0.4.1

package/dist/internal/http-router/router.js

@@ -1,9 +1,11 @@
-import path from 'node:path';
 import { match as createMatch } from 'path-to-regexp';
+import { BasePath } from '../../utils/base-path.js';
 import { Solas } from '../../solas.js';
 import { HttpException } from '../navigation/http-exception.js';
 import { maybeAction } from '../server/actions.js';
+import { enforce } from '../server/csrf.js';
 import { getAlternatePathname, normalisePathname, toPathPattern } from './utils.js';
+const BASE_PATH = BasePath.normalise(import.meta.env.BASE_URL);
 /**
  * Handle routing and matching for server requests
  */
@@ -121,7 +123,7 @@ export class HttpRouter {
     /**
      * Match a path and method, returning params and route
      */
-    match(path, method) {
+    #match(path, method) {
         for (const candidate of HttpRouter.#candidates(path)) {
             const direct = this.#routes.static.get(`${method}:${candidate}`);
             if (direct)
@@ -163,51 +165,53 @@ export class HttpRouter {
     async fetch(req) {
         const url = new URL(req.url);
         const trailingSlash = this.opts.trailingSlash ?? 'never';
-        const path = trailingSlash === 'ignore'
-            ? url.pathname
-            : normalisePathname(url.pathname, trailingSlash);
+        const routedPath = BasePath.strip(url.pathname, BASE_PATH);
+        const path = routedPath == null
+            ? null
+            : trailingSlash === 'ignore'
+                ? routedPath
+                : normalisePathname(routedPath, trailingSlash);
         let match = null;
         let action = false;
         try {
             const method = req.method.toUpperCase();
-            if ((method === 'GET' || method === 'HEAD') && path !== url.pathname) {
-                url.pathname = path;
+            const canonicalPathname = path == null ? null : BasePath.apply(path, BASE_PATH);
+            if (canonicalPathname != null &&
+                (method === 'GET' || method === 'HEAD') &&
+                canonicalPathname !== url.pathname) {
+                url.pathname = canonicalPathname;
                 return Response.redirect(url.toString(), 308);
             }
-            if (path !== url.pathname) {
-                // rebuild the request with the canonical pathname so downstream code
-                // sees the same url the router matched against
-                url.pathname = path;
+            if (canonicalPathname != null && canonicalPathname !== url.pathname) {
+                // rebuild the request so the rest of the app sees the same path the router used
+                url.pathname = canonicalPathname;
                 req = new Request(url.toString(), req);
             }
             const { action: isAction, formData: parsedFormData } = await maybeAction(req);
             action = isAction;
-            // action requests stay on the same pathname only the method is
-            // normalised to GET this lets page/layout routes match for
-            // rerender action execution still reads POST body and
-            // may redirect()
-            match = this.match(path, action ? 'GET' : method);
+            // action requests stay on the same path, but we match them like GET so
+            // the normal page tree can rerender around the action result
+            match = path == null ? null : this.#match(path, action ? 'GET' : method);
             if (!match) {
                 const error = new HttpException(404, 'Not found');
-                // unmatched requests still pass through the shared error hook with the
-                // same request metadata shape as matched requests
+                // unmatched requests still go through the same error hook shape as matched ones
                 return (this.#onError?.(error, Object.assign(req, {
                     [Solas.Config.REQUEST_META_KEY]: { match: null, error, action },
                 })) ?? new Response(error.message, { status: error.status }));
             }
             const matched = match;
-            // attach routing state to the request once so middleware and handlers can
-            // read the same per-request metadata
+            // attach route state once so middleware and handlers read the same request data
             const request = Object.assign(req, {
                 [Solas.Config.REQUEST_META_KEY]: { match: matched, action, parsedFormData },
             });
-            // global middleware stays outside route middleware by preserving
-            // registration order here before composition in #run
+            // check csrf before any middleware or handler runs
+            enforce(request, this.opts.csrf);
+            // keep global middleware outside route middleware and preserve registration order
             const stack = [...this.#middleware.global, ...matched.route.middleware];
             return this.#run(stack, request, () => matched.route.handler?.(request) ?? new Response('Not found', { status: 404 }));
         }
         catch (err) {
-            // normalise unknown throwables so the error hook always receives an Error
+            // turn unknown throws into Error objects so the error hook sees one shape
             const error = err instanceof Error ? err : new Error(String(err), { cause: err });
             const request = Object.assign(req, {
                 [Solas.Config.REQUEST_META_KEY]: { match, error, action },
@@ -224,17 +228,16 @@ export class HttpRouter {
      * Run middleware stack
      */
     #run(stack, req, next) {
-        // compose middleware stack
+        // build the middleware chain from the inside out
         let run = () => Promise.resolve(next());
-        // unwind stack
+        // wrap each middleware around the current chain
         for (let i = stack.length - 1; i >= 0; i -= 1) {
             const handler = stack[i];
             const prev = run;
             run = () => {
                 let called = false;
                 return Promise.resolve(handler(req, () => {
-                    // guard against double invocation so handlers/inner middleware
-                    // only execute once per request
+                    // next() can only be used once per middleware call
                     if (called)
                         throw new Error('next() called more than once');
                     called = true;
@@ -242,43 +245,13 @@ export class HttpRouter {
                 }));
             };
         }
-        // run composed middleware stack
+        // start the middleware chain
         return run();
     }
-    /**
-     * Serve static assets from the output directory
-     * @note generated /assets/* handlers bypass +middleware conventions
-     */
-    static static(config) {
-        return async (req) => {
-            const pathname = new URL(req.url).pathname;
-            const outDir = path.resolve(Solas.Config.OUT_DIR);
-            const staticRoot = path.resolve(outDir, 'client');
-            let decodedPathname = pathname;
-            try {
-                // validate any percent-encoding before resolving the asset path
-                decodedPathname = decodeURIComponent(pathname);
-            }
-            catch {
-                return new Response('Bad Request', { status: 400 });
-            }
-            const relativePath = decodedPathname.replace(/^\/+/, '');
-            const filePath = path.resolve(staticRoot, relativePath);
-            // keep asset requests pinned under the client output root even if the
-            // incoming path contains traversal segments
-            if (filePath !== staticRoot && !filePath.startsWith(`${staticRoot}${path.sep}`)) {
-                return new Response('Forbidden', { status: 403 });
-            }
-            // emitted assets are fingerprinted so they can be cached aggressively
-            return HttpRouter.serve(filePath, req, config.precompress, {
-                'Cache-Control': 'public, immutable, max-age=31536000',
-            });
-        };
-    }
     /**
      * Serve a file with optional compression content negotiation
      */
-    static async serve(filePath, req, precompress = false, headers = {}) {
+    static async serveStatic(filePath, req, precompress = false, headers = {}) {
         const accept = req.headers.get('accept-encoding') ?? '';
         let file = Bun.file(filePath);
         let encoding = null;

package/dist/internal/navigation/http-exception.d.ts

@@ -8,8 +8,9 @@ export declare namespace HttpException {
 }
 export declare const HTTP_EXCEPTION_NAME_MAP: Record<HttpException.StatusCode, string>;
 export type HttpExceptionLike = Pick<Error, 'name' | 'message' | 'stack'> & Partial<Pick<HttpException, 'digest' | 'payload' | 'status'>>;
+export declare const HTTP_EXCEPTION_DIGEST_PREFIX = "HTTP_EXCEPTION";
 /**
- * An exception representing an HTTP error, with an optional payload
+ * An exception representing an HttpException error, with an optional payload
  * and cause
  */
 export declare class HttpException extends Error {
@@ -19,9 +20,8 @@ export declare class HttpException extends Error {
     digest?: string;
     constructor(status: HttpException.StatusCode, message: string, opts?: HttpException.Options);
 }
-export declare const HTTP_EXCEPTION_DIGEST_PREFIX = "HTTP_EXCEPTION";
 /**
- * Check if an error is an HTTPException
+ * Check if an error is an HttpException
  */
 export declare function isHttpException(err: unknown): err is HttpException;
 /**
@@ -34,7 +34,7 @@ export declare function toHttpException(err: unknown): HttpException;
  */
 export declare function toHttpExceptionLike(error: HttpException | Error): HttpExceptionLike;
 /**
- * Throw an HTTPException
+ * Throw an HttpException
  */
 export declare function abort(status: HttpException.StatusCode, message: string, opts?: {
     payload?: HttpException.Payload;

package/dist/internal/navigation/http-exception.js

@@ -4,8 +4,9 @@ export const HTTP_EXCEPTION_NAME_MAP = {
     404: 'NOT_FOUND',
     500: 'INTERNAL_SERVER_ERROR',
 };
+export const HTTP_EXCEPTION_DIGEST_PREFIX = 'HTTP_EXCEPTION';
 /**
- * An exception representing an HTTP error, with an optional payload
+ * An exception representing an HttpException error, with an optional payload
  * and cause
  */
 export class HttpException extends Error {
@@ -22,7 +23,6 @@ export class HttpException extends Error {
         this.digest = `${HTTP_EXCEPTION_DIGEST_PREFIX}:${status}:${message}`;
     }
 }
-export const HTTP_EXCEPTION_DIGEST_PREFIX = 'HTTP_EXCEPTION';
 /**
  * Status type predicate
  */
@@ -30,7 +30,7 @@ function isStatusCode(value) {
     return value === 401 || value === 403 || value === 404 || value === 500;
 }
 /**
- * Check if an error is an HTTPException
+ * Check if an error is an HttpException
  */
 export function isHttpException(err) {
     return (typeof err === 'object' &&
@@ -82,7 +82,6 @@ export function toHttpExceptionLike(error) {
     return {
         name: error.name,
         message: error.message,
-        stack: error.stack,
         ...('digest' in error && typeof error.digest === 'string'
             ? { digest: error.digest }
             : {}),
@@ -93,7 +92,7 @@ export function toHttpExceptionLike(error) {
     };
 }
 /**
- * Throw an HTTPException
+ * Throw an HttpException
  */
 export function abort(status, message, opts) {
     throw new HttpException(status, message, {

package/dist/internal/navigation/redirect-boundary.js

@@ -1,7 +1,7 @@
 'use client';
 import { jsx as _jsx } from "react/jsx-runtime";
 import { Component } from 'react';
-import { isRedirect, REDIRECT_DIGEST_PREFIX } from './redirect.js';
+import { isRedirect, toRedirect } from './redirect.js';
 class Boundary extends Component {
     constructor(props) {
         super(props);
@@ -27,15 +27,6 @@ export function RedirectBoundary({ children }) {
     return (_jsx(Boundary, { fallback: err => {
             if (!isRedirect(err))
                 throw err;
-            if ('digest' in err && typeof err.digest === 'string') {
-                // rejoin after status so urls with colons (https://...) stay intact
-                const [type, , ...parts] = err.digest.split(':');
-                if (type === REDIRECT_DIGEST_PREFIX) {
-                    const url = parts.join(':');
-                    if (url)
-                        return _jsx("meta", { httpEquiv: "refresh", content: `0;url=${url}` });
-                }
-            }
-            return null;
+            return _jsx("meta", { httpEquiv: "refresh", content: `0;url=${toRedirect(err).url}` });
         }, children: children }));
 }

package/dist/internal/navigation/redirect.d.ts

@@ -1,4 +1,5 @@
 export type RedirectStatusCode = 301 | 302 | 307 | 308;
+export type RedirectLike = Pick<Error, 'name' | 'message' | 'stack'> & Partial<Pick<Redirect, 'digest' | 'status' | 'url'>>;
 /**
  * Redirect exception class to signal a redirect
  */
@@ -13,6 +14,8 @@ export declare const REDIRECT_DIGEST_PREFIX = "REDIRECT";
  * Check if an error is a Redirect error
  */
 export declare function isRedirect(err: unknown): err is Redirect;
+export declare function toRedirect(err: unknown): Redirect;
+export declare function toRedirectLike(error: Redirect | Error): RedirectLike;
 /**
  * Throws a Redirect exc`eption to signal a redirect
  * @param url - the application-relative URL or absolute http/https URL to redirect to

package/dist/internal/navigation/redirect.js

@@ -1,4 +1,7 @@
 import { Solas } from '../../solas.js';
+function isRedirectStatusCode(value) {
+    return value === 301 || value === 302 || value === 307 || value === 308;
+}
 /**
  * Redirect exception class to signal a redirect
  */
@@ -53,6 +56,54 @@ export function isRedirect(err) {
         typeof err.digest === 'string' &&
         err.digest.startsWith(REDIRECT_DIGEST_PREFIX));
 }
+export function toRedirect(err) {
+    if (err instanceof Redirect)
+        return err;
+    let digestStatus;
+    let digestUrl;
+    if (typeof err === 'object' &&
+        err !== null &&
+        'digest' in err &&
+        typeof err.digest === 'string') {
+        const [type, rawStatus, ...rawUrlParts] = err.digest.split(':');
+        const status = Number(rawStatus);
+        if (type === REDIRECT_DIGEST_PREFIX && isRedirectStatusCode(status)) {
+            digestStatus = status;
+            digestUrl = rawUrlParts.join(':');
+        }
+    }
+    const status = digestStatus ??
+        (typeof err === 'object' &&
+            err !== null &&
+            'status' in err &&
+            isRedirectStatusCode(err.status)
+            ? err.status
+            : 307);
+    const url = digestUrl ||
+        (typeof err === 'object' &&
+            err !== null &&
+            'url' in err &&
+            typeof err.url === 'string'
+            ? err.url
+            : undefined);
+    if (!url) {
+        throw new TypeError(`[${Solas.Config.NAME}] failed to reconstruct redirect`);
+    }
+    return new Redirect(url, status);
+}
+export function toRedirectLike(error) {
+    return {
+        name: error.name,
+        message: error.message,
+        ...('digest' in error && typeof error.digest === 'string'
+            ? { digest: error.digest }
+            : {}),
+        ...('url' in error && typeof error.url === 'string' ? { url: error.url } : {}),
+        ...('status' in error && isRedirectStatusCode(error.status)
+            ? { status: error.status }
+            : {}),
+    };
+}
 /**
  * Throws a Redirect exc`eption to signal a redirect
  * @param url - the application-relative URL or absolute http/https URL to redirect to

package/dist/internal/postbuild.d.ts

@@ -0,0 +1 @@
+export declare function postbuild(cwd?: string): Promise<void>;

package/dist/{cli/build.js → internal/postbuild.js}

@@ -2,33 +2,11 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { Compress } from '../utils/compress.js';
 import { Logger } from '../utils/logger.js';
-import { Prerender } from '../internal/prerender.js';
 import { Solas } from '../solas.js';
+import { Prerender } from './prerender.js';
 const logger = new Logger();
-/**
- * The build command does more than just run vite build - it also handles prerendering and
- * precompressing assets. This is because prerendering needs to run against the built
- * server entry to ensure the same code paths as preview, and precompressing needs
- * to include the prerendered html and json files
- */
-export async function build() {
-    // build and prerender should both run in production mode
-    process.env.NODE_ENV = 'production';
-    const cwd = process.cwd();
+export async function postbuild(cwd = process.cwd()) {
     const manifestPath = path.join(cwd, Solas.Config.GENERATED_DIR, 'build.json');
-    // run vite build
-    logger.info('[build]', 'running vite build...');
-    const vite = Bun.spawnSync(['bunx', '--bun', 'vite', 'build', '--mode', 'production'], {
-        cwd,
-        stdout: 'inherit',
-        stderr: 'inherit',
-        env: { ...process.env, NODE_ENV: 'production' },
-    });
-    if (vite.exitCode !== 0) {
-        logger.error('[build] vite build failed');
-        process.exit(1);
-    }
-    // read build manifest
     let manifest;
     try {
         const raw = await fs.readFile(manifestPath, 'utf-8');
@@ -36,7 +14,7 @@ export async function build() {
     }
     catch (err) {
         logger.error('[build] failed to read build manifest', err);
-        process.exit(1);
+        throw err;
     }
     const outDir = path.resolve(cwd, Solas.Config.OUT_DIR);
     const rscDir = path.join(outDir, 'rsc');
@@ -44,16 +22,11 @@ export async function build() {
     // clear old prerender artifacts so routes that have switched modes
     // do not keep stale metadata from a previous build
     await fs.rm(artifactRoot, { recursive: true, force: true });
-    // prerender routes
+    const artifactManifest = {};
     if (manifest.prerenderRoutes.length > 0) {
-        const timeout = Prerender.Build.getTimeout();
         const concurrency = Prerender.Build.getConcurrency();
-        // track the extra prerender files we write for preview
-        const artifactManifest = {};
-        // keep in-flight artifact writes bounded so result handling does not block on one route at a time
         const pendingWrites = new Set();
-        logger.info('[prerender]', `prerendering ${manifest.prerenderRoutes.length} routes (timeout: ${timeout}ms, concurrency: ${concurrency})...`);
-        // load the built server entry and render each prerendered route through it
+        logger.info('[prerender]', `prerendering ${manifest.prerenderRoutes.length} routes (concurrency: ${concurrency})...`);
         const rscEntry = path.join(rscDir, 'index.js');
         const { default: app } = await import(/* @vite-ignore */ rscEntry);
         async function enqueueWrite(task) {
@@ -65,9 +38,8 @@ export async function build() {
                 await Promise.race(pendingWrites);
             }
         }
-        // run prerender through the built app so build output uses the same path as preview
         for await (const result of Prerender.Build.run(app, manifest.prerenderRoutes, {
-            timeout,
+            base: manifest.base,
             concurrency,
             origin: manifest.url,
         })) {
@@ -85,7 +57,6 @@ export async function build() {
             await enqueueWrite(async () => {
                 try {
                     if (artifact.mode === 'ppr') {
-                        // for ppr save the shell now and keep the postponed state for later
                         await fs.mkdir(artifactDir, { recursive: true });
                         const writes = [
                             Bun.write(path.join(artifactDir, 'prelude.html'), artifact.html),
@@ -120,9 +91,7 @@ export async function build() {
                         logger.info('[prerender]', `${route} (ppr)`);
                         return;
                     }
-                    // full prerender still keeps metadata so preview knows to serve saved html
                     await fs.mkdir(artifactDir, { recursive: true });
-                    const fullPrerenderFilename = Prerender.Artifact.FULL_PRERENDER_FILENAME;
                     await Promise.all([
                         Bun.write(path.join(artifactDir, 'metadata.json'), JSON.stringify({
                             schema: artifact.schema,
@@ -130,7 +99,7 @@ export async function build() {
                             createdAt: artifact.createdAt,
                             mode: artifact.mode,
                         })),
-                        Bun.write(Prerender.Artifact.getFilePath(outDir, route, fullPrerenderFilename), artifact.html),
+                        Bun.write(Prerender.Artifact.getFilePath(outDir, route, Prerender.Artifact.FULL_PRERENDER_FILENAME), artifact.html),
                     ]);
                     artifactManifest[route] = {
                         mode: artifact.mode,
@@ -144,13 +113,13 @@ export async function build() {
             });
         }
         await Promise.all(pendingWrites);
-        // write one manifest for the saved prerender files after all routes finish
-        await fs.mkdir(artifactRoot, { recursive: true });
-        await Bun.write(Prerender.Artifact.getManifestPath(outDir), JSON.stringify({
-            routes: artifactManifest,
-        }));
     }
-    // sitemap
+    await fs.mkdir(artifactRoot, { recursive: true });
+    const runtimeManifest = {
+        artifacts: artifactManifest,
+        publicFiles: manifest.publicFiles,
+    };
+    await Bun.write(Solas.Runtime.getManifestPath(outDir), JSON.stringify(runtimeManifest));
     if (manifest.sitemapRoutes.length > 0 && manifest.url) {
         const origin = manifest.url.replace(/\/$/, '');
         const urls = manifest.sitemapRoutes
@@ -165,10 +134,8 @@ export async function build() {
         await Bun.write(path.join(outDir, 'sitemap.xml'), sitemap);
         logger.info('[sitemap]', `generated ${manifest.sitemapRoutes.length} urls`);
     }
-    // precompress
     if (manifest.precompress) {
         logger.info('[precompress]', 'compressing assets...');
-        // compress after prerender so generated html and json are included too
         for await (const { input, compressed } of Compress.run(outDir, {
             filter: f => /\.(js|css|html|svg|json|txt)$/.test(f),
         })) {
@@ -176,8 +143,6 @@ export async function build() {
             logger.info('[precompress]', `${path.basename(input)}.br`);
         }
     }
-    // cleanup
-    // this file is only needed while the build command is running
     await fs.unlink(manifestPath).catch(() => { });
     logger.info('[build]', 'done');
 }

package/dist/internal/prerender.d.ts

@@ -22,11 +22,6 @@ export declare namespace Prerender {
          * based on the output directory specified in the configuration
          */
         function getRootPath(outDir: string): string;
-        /**
-         * Get the file system path for the prerender artifact manifest, which
-         * contains metadata about all prerendered routes and their artifacts
-         */
-        function getManifestPath(outDir: string): string;
         /**
          * Get the file system path for storing prerender artifacts for a given route
          */
@@ -39,10 +34,6 @@ export declare namespace Prerender {
          * File name used for saved full-prerender html inside each route artifact directory
          */
         const FULL_PRERENDER_FILENAME = "prerendered.html";
-        /**
-         * Load the prerender artifact manifest for faster runtime route mode checks
-         */
-        function loadManifest(outDir: string): Promise<Manifest | null>;
         /**
          * Load the postponed state for a given route from the file system, if it exists
          */
@@ -95,11 +86,6 @@ export declare namespace Prerender {
         function isPostponed(error: unknown): boolean;
     }
     namespace Build {
-        /**
-         * Get the prerender timeout value from the environment variable, or return the default
-         * if it's not set or invalid
-         */
-        function getTimeout(): number;
         /**
          * Get the prerender concurrency value from the environment variable, or return the default
          * if it's not set or invalid
@@ -128,8 +114,8 @@ export declare namespace Prerender {
         function get(app: {
             fetch: (req: Request) => Promise<Response>;
         }, route: string, opts: {
-            timeout: number;
             origin?: string;
+            base?: string;
         }): Promise<{
             route: string;
             status: number;
@@ -140,16 +126,15 @@ export declare namespace Prerender {
             artifact: any;
         }>;
         /**
-         * Run the prerendering process for a list of routes, with a specified concurrency limit and timeout for
-         * each route, by calling the 'get' function for each route and yielding the results as they
-         * become available
+         * Run the prerendering process for a list of routes with a specified concurrency limit,
+         * by calling the 'get' function for each route and yielding the results as they become available
          */
         function run(app: {
             fetch: (req: Request) => Promise<Response>;
         }, routes: string[], opts: {
-            timeout: number;
             concurrency?: number;
             origin?: string;
+            base?: string;
         }): AsyncGenerator<Result, void, unknown>;
     }
 }