@jk2908/solas 0.8.3 → 0.9.1

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.9.1
+
+- Trimmed the install section of the README.
+
+## 0.9.0
+
+### Features
+
+- Added a `headers` config option to add response headers to every response Solas serves, for security headers (CSP, HSTS, and so on). Pass an object, or a function for per-request values.
+- Solas now writes a `<link rel="canonical">` into each document's head, built from the resolved `url` origin and the request path. A route can override it by declaring its own canonical link in `metadata`.
+- When `sitemap` is enabled, Solas also generates a `robots.txt` pointing at the sitemap, unless the app ships its own.
+
+### Fixes
+
+- Middleware now runs for fully prerendered routes. The prerender shortcut used to run before routing, so `+middleware.ts` was skipped on static routes.
+- `url` and `VITE_APP_URL` are validated with the rest of the config (collected with the other errors) instead of throwing on invalid values.
+- Generated `maps.ts` now separates its static imports from its dynamic exports with a blank line.
+- The generated `sitemap.xml` and `robots.txt` are now served by the Node server as well as Cloudflare (the Node server returned 404 for them before).
+
 ## 0.8.3
 
 ### Changed

package/README.md

@@ -13,8 +13,6 @@ npm install @jk2908/solas react react-dom react-server-dom-webpack vite@^8
 npm install -D @vitejs/plugin-react@^6 typescript
 ```
 
-Use Vite's built-in TypeScript path resolution (`resolve.tsconfigPaths: true`) rather than `vite-tsconfig-paths`, which is not compatible with Rolldown's handling of the `file://` runtime imports the RSC plugin emits.
-
 ## Use
 
 Create a Vite config that registers Solas.
@@ -261,6 +259,8 @@ export default defineConfig({
 })
 ```
 
+Beyond sitemap URLs, the resolved origin is used to write a `<link rel="canonical">` into each document's head (unless a route declares its own canonical link in `metadata`).
+
 ### `precompress`
 
 Use `precompress` to control whether Solas writes compressed browser-served build assets (like `.js`, `.css`, etc.).
@@ -449,6 +449,33 @@ export default defineConfig({
 
 Only add origins you completely trust.
 
+### `headers`
+
+Use `headers` to add response headers to every response Solas serves: documents, RSC payloads, endpoints, and static assets. This is where security headers belong.
+
+```ts
+solas({
+	headers: {
+		'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
+		'X-Content-Type-Options': 'nosniff',
+		'Referrer-Policy': 'strict-origin-when-cross-origin',
+		'Content-Security-Policy': "default-src 'self'",
+	},
+})
+```
+
+Pass a function to vary the headers per request, for example a per-request CSP nonce:
+
+```ts
+solas({
+	headers: req => ({
+		'Content-Security-Policy': `default-src 'self'; script-src 'nonce-${nonce(req)}'`,
+	}),
+})
+```
+
+The function can be async. Configured headers win over any header Solas sets.
+
 ### `sitemap`
 
 Use `sitemap` to generate a `sitemap.xml` at build time.
@@ -495,7 +522,7 @@ sitemap: {
 }
 ```
 
-The sitemap is written to the build output directory as `sitemap.xml` after prerendering and before precompression.
+The sitemap is written to the build output directory as `sitemap.xml` after prerendering and before precompression, and served at `/sitemap.xml`. When enabled, Solas also writes a `robots.txt` (served at `/robots.txt`) that points at the sitemap, unless a `robots.txt` is provided in the public directory.
 
 ### `logger.level`
 

package/dist/adapters/cloudflare/vite.js

@@ -48,13 +48,12 @@ async function findAssetDirs(root, found = []) {
  *   renders RSC otherwise
  * - `dist/.solas/**` (runtime manifest + ppr artifacts) at `<prefix>`, read back
  *   through the `ASSETS` binding
- * - `dist/sitemap.xml` at the asset root, so `/sitemap.xml` is served
+ * - `dist/sitemap.xml` and `dist/robots.txt` at the asset root
  */
 async function copyOutput(cwd) {
     const outDir = path.join(cwd, Config.OUT_DIR);
     const artifactSource = path.join(outDir, Config.GENERATED_DIR);
     const staticSource = path.join(outDir, 'static');
-    const sitemapSource = path.join(outDir, 'sitemap.xml');
     const assetDirs = await findAssetDirs(path.join(cwd, '.cloudflare', 'output'));
     // Cloudflare compresses at the edge, so the Worker must serve uncompressed
     // bytes. Keeping a `.br`/`.gz` sibling makes the assets binding hand the
@@ -76,9 +75,13 @@ async function copyOutput(cwd) {
                 filter: skipPrecompressed,
             });
         }
-        // the sitemap is generated at the output root; serve it at the asset root
-        if (await pathExists(sitemapSource)) {
-            await fs.copyFile(sitemapSource, path.join(assetDir, 'sitemap.xml'));
+        // robots.txt and the sitemap are generated at the output root; serve them
+        // at the asset root
+        for (const file of ['sitemap.xml', 'robots.txt']) {
+            const source = path.join(outDir, file);
+            if (await pathExists(source)) {
+                await fs.copyFile(source, path.join(assetDir, file));
+            }
         }
     }
 }

package/dist/config.d.ts

@@ -16,9 +16,4 @@ export declare const LOG_LEVELS: readonly ["debug", "info", "warn", "error", "fa
 export declare const PRERENDER_MODES: readonly ["full", "ppr", false];
 export declare const TRAILING_SLASH_MODES: readonly ["always", "never", "ignore"];
 export declare const RUNTIME_MANIFEST = "runtime-manifest.json";
-/**
- * Validate the plugin configuration object, throwing an error if invalid.
- * @param input - The unvalidated configuration object.
- * @returns The typed and validated configuration object.
- */
-export declare function validate(input: unknown): PluginConfig;
+export declare function validate(input: unknown, envUrl?: string): PluginConfig;

package/dist/config.js

@@ -17,6 +17,7 @@ export const TRAILING_SLASH_MODES = ['always', 'never', 'ignore'];
 export const RUNTIME_MANIFEST = 'runtime-manifest.json';
 const CONFIG_KEYS = new Set([
     'adapter',
+    'headers',
     'logger',
     'metadata',
     'precompress',
@@ -32,7 +33,22 @@ const LOGGER_KEYS = new Set(['level']);
  * @param input - The unvalidated configuration object.
  * @returns The typed and validated configuration object.
  */
-export function validate(input) {
+function validateOrigin(value, label, errors) {
+    if (typeof value !== 'string') {
+        errors.push(`${label} must be a string`);
+        return;
+    }
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+            errors.push(`${label} must use http:// or https://`);
+        }
+    }
+    catch {
+        errors.push(`${label} must be a valid URL`);
+    }
+}
+export function validate(input, envUrl) {
     if (input === undefined)
         return {};
     const errors = [];
@@ -45,20 +61,10 @@ export function validate(input) {
         }
     }
     if ('url' in input && input.url !== undefined) {
-        if (typeof input.url !== 'string') {
-            errors.push('url must be a string');
-        }
-        else {
-            try {
-                const url = new URL(input.url);
-                if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-                    errors.push('url must use http:// or https://');
-                }
-            }
-            catch {
-                errors.push('url must be a valid URL');
-            }
-        }
+        validateOrigin(input.url, 'url', errors);
+    }
+    if (envUrl !== undefined && envUrl.length > 0) {
+        validateOrigin(envUrl, 'VITE_APP_URL', errors);
     }
     if ('adapter' in input && input.adapter !== undefined) {
         const adapter = input.adapter;
@@ -73,6 +79,11 @@ export function validate(input) {
             errors.push('precompress must be a boolean');
         }
     }
+    if ('headers' in input && input.headers !== undefined) {
+        if (typeof input.headers !== 'function' && !isRecord(input.headers)) {
+            errors.push('headers must be an object or a function that returns one');
+        }
+    }
     if ('trustedOrigins' in input && input.trustedOrigins !== undefined) {
         if (!Array.isArray(input.trustedOrigins)) {
             errors.push('trustedOrigins must be an array of origins');

package/dist/index.js

@@ -23,32 +23,22 @@ const DEFAULT_CONFIG = {
     trailingSlash: 'never',
 };
 /**
- * Validate a configured url and return its canonical origin (scheme and host,
- * without a trailing slash or path). Throws when it is not a http(s) origin.
+ * Parse a validated url into its canonical origin (scheme and host, without a
+ * trailing slash or path).
  */
-function resolveOrigin(value) {
+function normaliseOrigin(value) {
     if (!value)
         return undefined;
-    let url;
-    try {
-        url = new URL(value);
-    }
-    catch {
-        throw new Error(`[solas] Invalid url: "${value}"`);
-    }
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-        throw new Error(`[solas] url must use http:// or https://: "${value}"`);
-    }
-    return url.origin;
+    return new URL(value).origin;
 }
 function solas(c) {
-    const validatedConfig = Config.validate(c);
+    const envUrl = process.env.VITE_APP_URL?.toString();
+    const validatedConfig = Config.validate(c, envUrl);
     const config = {
         ...DEFAULT_CONFIG,
         ...validatedConfig,
     };
-    const envUrl = process.env.VITE_APP_URL?.toString();
-    let resolvedUrl = resolveOrigin(c?.url) ?? resolveOrigin(envUrl);
+    let resolvedUrl = normaliseOrigin(c?.url) ?? normaliseOrigin(envUrl);
     if (config.logger?.level)
         Logger.defaultLevel = config.logger.level;
     const logger = new Logger();

package/dist/internal/build.js

@@ -3,7 +3,7 @@ import path from 'node:path';
 import { hash } from '../utils/hash.js';
 import { Logger } from '../utils/logger.js';
 import * as Config from '../config.js';
-import { normalisePathname } from './http-router/utils.js';
+import { normaliseTrailingSlash } from './http-router/utils.js';
 import * as Prerender from './prerender.js';
 const HTTP_VERBS = ['GET', 'HEAD', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'];
 // short prefixes used to namespace entry ids by kind.
@@ -476,19 +476,19 @@ export class Finder {
                 // expand using the page's exported static params
                 if (shouldPrerender) {
                     if (!isDynamic && !isWildcard) {
-                        prerenderRoutes.add(normalisePathname(route, trailingSlash));
+                        prerenderRoutes.add(normaliseTrailingSlash(route, trailingSlash));
                     }
                     else if (pagePath) {
                         const staticParams = await Prerender.getStaticParams(pagePath, this.buildContext);
                         for (const r of Prerender.getDynamicRouteList(route, params, staticParams)) {
-                            prerenderRoutes.add(normalisePathname(r, trailingSlash));
+                            prerenderRoutes.add(normaliseTrailingSlash(r, trailingSlash));
                         }
                     }
                 }
                 // track all concrete routes regardless of prerender mode
                 // so the sitemap can include ssr-only pages too
                 if (!isDynamic && !isWildcard) {
-                    knownRoutes.add(normalisePathname(route, trailingSlash));
+                    knownRoutes.add(normaliseTrailingSlash(route, trailingSlash));
                 }
                 const entry = {
                     __id: entryId,

package/dist/internal/codegen/maps.js

@@ -64,7 +64,9 @@ export function writeMaps(imports, modules) {
             return `${toStringLiteral(moduleId)}: {}`;
         return `${toStringLiteral(moduleId)}: {\n${parts.map(part => indent(part, 1)).join(',\n')}\n}`;
     });
-    const importLines = [...statics, ...dynamics].join('\n');
+    const importLines = [statics.join('\n'), dynamics.join('\n')]
+        .filter(Boolean)
+        .join('\n\n');
     const entries = map.map(entry => indent(entry, 1)).join(',\n');
     return source `
 		${AUTOGEN_MSG}

package/dist/internal/env/browser.js

@@ -29,7 +29,7 @@ export async function browser() {
         // immediately during render, without waiting for an effect to run
         payloadSetter.current = setPayloadInTransition;
         return (_jsx(RedirectBoundary, { children: _jsxs(BrowserRouterProvider, { setPayload: setPayloadInTransition, isNavigating: isPending, url: p.url, children: [
-                    _jsx(ErrorBoundary, { fallback: null, children: _jsx(Suspense, { fallback: null, children: _jsx(Head, { metadata: p.metadata }) }) }), p.root] }) }));
+                    _jsx(ErrorBoundary, { fallback: null, children: _jsx(Suspense, { fallback: null, children: _jsx(Head, { metadata: p.metadata, url: p.url }) }) }), p.root] }) }));
     }
     setServerCallback(async (id, args) => {
         const url = new URL(window.location.href);

package/dist/internal/env/rsc.js

@@ -6,7 +6,7 @@ import * as Config from '../../config.js';
 import * as RuntimeManifest from '../../manifest.js';
 import { createHttpRouter } from '../http-router/create-http-router.js';
 import { HttpRouter } from '../http-router/router.js';
-import { normalisePathname } from '../http-router/utils.js';
+import { normaliseTrailingSlash } from '../http-router/utils.js';
 import { Metadata } from '../metadata.js';
 import { HttpException, isHttpException, toHttpException, toHttpExceptionLike, } from '../navigation/http-exception.js';
 import { isRedirect, toRedirect } from '../navigation/redirect.js';
@@ -202,7 +202,7 @@ export function createHandler(config, manifest, importMap, options = {}) {
         }
         const mod = await import.meta.viteRsc.loadModule('ssr', 'index');
         const pathname = new URL(req.url).pathname;
-        const lookupPath = normalisePathname(pathname, prerenderPathMode);
+        const lookupPath = normaliseTrailingSlash(pathname, prerenderPathMode);
         const runtimePpr = !import.meta.env.DEV && ppr;
         async function tryErrorRecovery(err) {
             if (isRedirect(err)) {
@@ -335,81 +335,104 @@ export function createHandler(config, manifest, importMap, options = {}) {
             throw err;
         }
     }
-    const httpRouter = createHttpRouter(config, manifest, importMap, createResponse);
+    /**
+     * Serve the saved HTML for a fully prerendered route. Runs as the route
+     * handler, after middleware, so middleware applies to static routes too. It
+     * returns null for anything else (a route without a saved prerender, an RSC
+     * navigation, or a request without an HTML accept header), so the caller
+     * falls back to rendering.
+     */
+    async function serveFullPrerender(req) {
+        if (import.meta.env.DEV)
+            return null;
+        if (!(req.headers.get('accept') ?? '').includes('text/html'))
+            return null;
+        if (req.headers.get(`x-${Config.SLUG}-prerender-artifact`) === '1')
+            return null;
+        if (!runtimeManifest)
+            return null;
+        const routedPath = stripBasePath(new URL(req.url).pathname, BASE_PATH);
+        if (routedPath == null)
+            return null;
+        const lookupPath = normaliseTrailingSlash(routedPath, prerenderPathMode);
+        if (runtimeManifest.artifacts[lookupPath]?.mode !== 'full')
+            return null;
+        const res = await HttpRouter.serveStatic(assets, {
+            namespace: 'static',
+            path: Prerender.staticRoutePath(lookupPath, prerenderPathMode),
+        }, req, config.precompress, {
+            // fully prerendered routes are immutable per build, so allow them
+            // to be cached and revalidated instead of forcing no-store
+            'Cache-Control': 'public, max-age=0, must-revalidate',
+            'Content-Type': 'text/html; charset=utf-8',
+        });
+        return res.status === 404 ? null : res;
+    }
+    const httpRouter = createHttpRouter(config, manifest, importMap, createResponse, serveFullPrerender);
+    /**
+     * Add the configured `headers` to a response. Clones the response so
+     * immutable ones (redirects, cached assets) can still be augmented.
+     */
+    async function withHeaders(res, req) {
+        if (!config.headers)
+            return res;
+        const entries = typeof config.headers === 'function' ? await config.headers(req) : config.headers;
+        const headers = new Headers(res.headers);
+        for (const [key, value] of Object.entries(entries))
+            headers.set(key, value);
+        return new Response(res.body, {
+            status: res.status,
+            statusText: res.statusText,
+            headers,
+        });
+    }
+    async function dispatch(req) {
+        const url = new URL(req.url);
+        const method = req.method.toUpperCase();
+        // fast path
+        if (method !== 'GET' && method !== 'HEAD')
+            return httpRouter.fetch(req);
+        const routedPath = stripBasePath(url.pathname, BASE_PATH);
+        const canonicalPath = routedPath == null
+            ? null
+            : config.trailingSlash === 'ignore'
+                ? routedPath
+                : normaliseTrailingSlash(routedPath, config.trailingSlash);
+        const canonicalPathname = canonicalPath == null ? null : applyBasePath(canonicalPath, BASE_PATH);
+        if (canonicalPathname != null &&
+            (method === 'GET' || method === 'HEAD') &&
+            config.trailingSlash !== 'ignore' &&
+            canonicalPathname !== url.pathname) {
+            url.pathname = canonicalPathname;
+            return Response.redirect(url.toString(), 308);
+        }
+        // block the bare /_solas namespace; only concrete solas asset files
+        // under /_solas/* are valid
+        if (routedPath === SOLAS_ASSETS_URL_ROOT) {
+            return new Response('Forbidden', { status: 403 });
+        }
+        if (routedPath?.startsWith(`${SOLAS_ASSETS_URL_ROOT}/`)) {
+            const asset = toClientAsset(`${Config.ASSETS_DIR}/${routedPath.slice(`${SOLAS_ASSETS_URL_ROOT}/`.length)}`);
+            // pass through bad-request or forbidden responses from path resolution
+            if (asset instanceof Response)
+                return asset;
+            return HttpRouter.serveStatic(assets, asset, req, config.precompress, {
+                'Cache-Control': 'public, immutable, max-age=31536000',
+            });
+        }
+        if (routedPath && runtimeManifest?.publicFiles.has(routedPath)) {
+            const asset = toClientAsset(routedPath.slice(1));
+            // pass through bad-request or forbidden responses from path resolution
+            if (asset instanceof Response)
+                return asset;
+            return HttpRouter.serveStatic(assets, asset, req, config.precompress);
+        }
+        return httpRouter.fetch(req);
+    }
     // vite-plugin-rsc entrypoint
     return {
         async fetch(req) {
-            const url = new URL(req.url);
-            const method = req.method.toUpperCase();
-            // fast path
-            if (method !== 'GET' && method !== 'HEAD')
-                return httpRouter.fetch(req);
-            const accept = req.headers.get('accept') ?? '';
-            const routedPath = stripBasePath(url.pathname, BASE_PATH);
-            const canonicalPath = routedPath == null
-                ? null
-                : config.trailingSlash === 'ignore'
-                    ? routedPath
-                    : normalisePathname(routedPath, config.trailingSlash);
-            const canonicalPathname = canonicalPath == null ? null : applyBasePath(canonicalPath, BASE_PATH);
-            if (canonicalPathname != null &&
-                (method === 'GET' || method === 'HEAD') &&
-                config.trailingSlash !== 'ignore' &&
-                canonicalPathname !== url.pathname) {
-                url.pathname = canonicalPathname;
-                return Response.redirect(url.toString(), 308);
-            }
-            // block the bare /_solas namespace; only concrete solas asset files
-            // under /_solas/* are valid
-            if (routedPath === SOLAS_ASSETS_URL_ROOT) {
-                return new Response('Forbidden', { status: 403 });
-            }
-            if (routedPath?.startsWith(`${SOLAS_ASSETS_URL_ROOT}/`)) {
-                const asset = toClientAsset(`${Config.ASSETS_DIR}/${routedPath.slice(`${SOLAS_ASSETS_URL_ROOT}/`.length)}`);
-                // pass through bad-request or forbidden responses from path resolution
-                if (asset instanceof Response)
-                    return asset;
-                return HttpRouter.serveStatic(assets, asset, req, config.precompress, {
-                    'Cache-Control': 'public, immutable, max-age=31536000',
-                });
-            }
-            if (routedPath && runtimeManifest?.publicFiles.has(routedPath)) {
-                const asset = toClientAsset(routedPath.slice(1));
-                // pass through bad-request or forbidden responses from path resolution
-                if (asset instanceof Response)
-                    return asset;
-                return HttpRouter.serveStatic(assets, asset, req, config.precompress);
-            }
-            // fully prerendered html can be served straight from disk for normal
-            // document requests, but build-time artifact requests must bypass
-            // this shortcut so they still render fresh output
-            if (canonicalPath != null &&
-                !import.meta.env.DEV &&
-                accept.includes('text/html') &&
-                req.headers.get(`x-${Config.SLUG}-prerender-artifact`) !== '1') {
-                // turn the request path into the normal route shape we use for artifact lookups
-                const lookupPath = normalisePathname(canonicalPath, prerenderPathMode);
-                // only full prerender routes have a saved html file we can serve directly
-                const staticAsset = runtimeManifest?.artifacts[lookupPath]?.mode === 'full'
-                    ? {
-                        namespace: 'static',
-                        path: Prerender.staticRoutePath(lookupPath, prerenderPathMode),
-                    }
-                    : null;
-                if (staticAsset) {
-                    const res = await HttpRouter.serveStatic(assets, staticAsset, req, config.precompress, {
-                        // fully prerendered routes are immutable per build, so allow them
-                        // to be cached and revalidated instead of forcing no-store
-                        'Cache-Control': 'public, max-age=0, must-revalidate',
-                        'Content-Type': 'text/html; charset=utf-8',
-                    });
-                    // only a missing prerendered file should fall back to normal request handling
-                    // any other static-file response should be returned as-is
-                    if (res.status !== 404)
-                        return res;
-                }
-            }
-            return httpRouter.fetch(req);
+            return withHeaders(await dispatch(req), req);
         },
     };
 }

package/dist/internal/env/ssr.js

@@ -16,7 +16,7 @@ const logger = new Logger();
 function A({ payloadPromise }) {
     const payload = use(payloadPromise);
     return (_jsx(RedirectBoundary, { children: _jsxs(BrowserRouterProvider, { url: payload.url, children: [
-                _jsx(ErrorBoundary, { fallback: null, children: _jsx(Suspense, { fallback: null, children: _jsx(Head, { metadata: payload.metadata }) }) }), payload.root] }) }));
+                _jsx(ErrorBoundary, { fallback: null, children: _jsx(Suspense, { fallback: null, children: _jsx(Head, { metadata: payload.metadata, url: payload.url }) }) }), payload.root] }) }));
 }
 /**
  * SSR handler - returns a ReadableStream response for HTML requests.

package/dist/internal/http-router/create-http-router.d.ts

@@ -3,4 +3,4 @@ import { HttpRouter } from './router.js';
 /**
  * Create the HTTP router from the generated manifest and import map.
  */
-export declare function createHttpRouter(config: Pick<PluginConfig, 'trailingSlash' | 'trustedOrigins' | 'url'>, manifest: Manifest, importMap: ImportMap, rsc: (req: SolasRequest) => Response | Promise<Response>): HttpRouter;
+export declare function createHttpRouter(config: Pick<PluginConfig, 'trailingSlash' | 'trustedOrigins' | 'url'>, manifest: Manifest, importMap: ImportMap, rsc: (req: SolasRequest) => Response | Promise<Response>, serveFullPrerender?: (req: Request) => Promise<Response | null>): HttpRouter;

package/dist/internal/http-router/create-http-router.js

@@ -46,7 +46,7 @@ function mergeMiddlewares(left, right) {
 /**
  * Create the HTTP router from the generated manifest and import map.
  */
-export function createHttpRouter(config, manifest, importMap, rsc) {
+export function createHttpRouter(config, manifest, importMap, rsc, serveFullPrerender) {
     const router = new HttpRouter({
         trailingSlash: config.trailingSlash,
         csrf: {
@@ -58,7 +58,7 @@ export function createHttpRouter(config, manifest, importMap, rsc) {
         if (!Array.isArray(group)) {
             if ('paths' in group) {
                 // plain page routes always hand off to the RSC request pipeline
-                router.add(group.__path, group.method.toUpperCase(), req => rsc(req), group.__params, resolveMiddlewares(group, importMap));
+                router.add(group.__path, group.method.toUpperCase(), async req => (await serveFullPrerender?.(req)) ?? rsc(req), group.__params, resolveMiddlewares(group, importMap));
                 continue;
             }
             const endpoint = importMap[group.__id]?.endpoint;
@@ -83,7 +83,7 @@ export function createHttpRouter(config, manifest, importMap, rsc) {
         router.add(page.__path, 'GET', async req => {
             const accept = req.headers.get('accept') ?? '';
             if (accept.includes('text/html') || accept.includes('text/x-component')) {
-                return rsc(req);
+                return (await serveFullPrerender?.(req)) ?? rsc(req);
             }
             if (!endpoint) {
                 throw new Error(`Missing unified endpoint handler for ${page.__path}`);

package/dist/internal/http-router/router.js

@@ -4,7 +4,7 @@ import * as Config from '../../config.js';
 import { HttpException } from '../navigation/http-exception.js';
 import { maybeAction } from '../server/actions.js';
 import { enforce } from '../server/csrf.js';
-import { getAlternatePathname, normalisePathname, toPathPattern } from './utils.js';
+import { getAlternatePathname, normaliseTrailingSlash, toPathPattern } from './utils.js';
 const BASE_PATH = normaliseBasePath(import.meta.env.BASE_URL);
 /**
  * Handle routing and matching for server requests.
@@ -54,7 +54,7 @@ export class HttpRouter {
         // normalise static routes up front so trailingSlash matching
         // uses the same pathname shape
         const routePath = !path.includes(':') && !path.includes('*')
-            ? normalisePathname(path, this.opts.trailingSlash ?? 'never')
+            ? normaliseTrailingSlash(path, this.opts.trailingSlash ?? 'never')
             : path;
         const segments = HttpRouter.#split(routePath);
         const tokens = [];
@@ -170,7 +170,7 @@ export class HttpRouter {
             ? null
             : trailingSlash === 'ignore'
                 ? routedPath
-                : normalisePathname(routedPath, trailingSlash);
+                : normaliseTrailingSlash(routedPath, trailingSlash);
         let match = null;
         let action = false;
         try {

package/dist/internal/http-router/utils.d.ts

@@ -14,7 +14,7 @@ export declare function toPathPattern(route: string, paramNames?: string[]): {
 /**
  * Apply the configured trailing-slash policy to a pathname.
  */
-export declare function normalisePathname(pathname: string, trailingSlash?: PluginConfig['trailingSlash']): string;
+export declare function normaliseTrailingSlash(pathname: string, trailingSlash?: PluginConfig['trailingSlash']): string;
 /**
  * Return the other pathname shape for a non-root route. For use within
  * trailingSlash logic to easily switch between shapes.

package/dist/internal/http-router/utils.js

@@ -42,14 +42,15 @@ export function toPathPattern(route, paramNames = []) {
 /**
  * Apply the configured trailing-slash policy to a pathname.
  */
-export function normalisePathname(pathname, trailingSlash = 'never') {
+export function normaliseTrailingSlash(pathname, trailingSlash = 'never') {
     if (pathname === '/')
         return pathname;
     // ignore mode keeps the incoming pathname shape as-is
     if (trailingSlash === 'ignore')
         return pathname;
-    if (trailingSlash === 'always')
+    if (trailingSlash === 'always') {
         return pathname.endsWith('/') ? pathname : `${pathname}/`;
+    }
     return pathname.endsWith('/') ? pathname.slice(0, -1) : pathname;
 }
 /**

package/dist/internal/postbuild.js

@@ -115,11 +115,10 @@ export async function postbuild(cwd = process.cwd()) {
         await Promise.all(pendingWrites);
     }
     await fs.mkdir(artifactRoot, { recursive: true });
-    const runtimeManifest = {
-        artifacts: artfifactManifest,
-        publicFiles: manifest.publicFiles,
-    };
-    await fs.writeFile(Manifest.getManifestPath(outDir), JSON.stringify(runtimeManifest));
+    // generated files served at the root: written to the output root (for the
+    // asset layer) and into the client output (for the Node server), then listed
+    // as public files so every runtime serves them
+    const generatedPublicFiles = [];
     if (manifest.sitemapRoutes.length > 0 && manifest.url) {
         const origin = manifest.url.replace(/\/$/, '');
         const urls = manifest.sitemapRoutes
@@ -131,9 +130,30 @@ export async function postbuild(cwd = process.cwd()) {
             urls,
             '</urlset>',
         ].join('\n');
-        await fs.writeFile(path.join(outDir, 'sitemap.xml'), sitemap);
+        // point robots.txt at the sitemap, unless the app ships its own
+        const robots = manifest.publicFiles.some(file => file.replace(/^\//, '') === 'robots.txt')
+            ? null
+            : ['User-agent: *', 'Allow: /', '', `Sitemap: ${origin}/sitemap.xml`, ''].join('\n');
+        const clientDir = path.join(outDir, 'client');
+        await fs.mkdir(clientDir, { recursive: true });
+        const writes = [
+            fs.writeFile(path.join(outDir, 'sitemap.xml'), sitemap),
+            fs.writeFile(path.join(clientDir, 'sitemap.xml'), sitemap),
+        ];
+        generatedPublicFiles.push('/sitemap.xml');
         logger.info('[sitemap]', `generated ${manifest.sitemapRoutes.length} urls`);
+        if (robots) {
+            writes.push(fs.writeFile(path.join(outDir, 'robots.txt'), robots), fs.writeFile(path.join(clientDir, 'robots.txt'), robots));
+            generatedPublicFiles.push('/robots.txt');
+            logger.info('[robots]', 'generated robots.txt');
+        }
+        await Promise.all(writes);
     }
+    const runtimeManifest = {
+        artifacts: artfifactManifest,
+        publicFiles: [...manifest.publicFiles, ...generatedPublicFiles],
+    };
+    await fs.writeFile(Manifest.getManifestPath(outDir), JSON.stringify(runtimeManifest));
     if (manifest.precompress) {
         logger.info('[precompress]', 'compressing assets...');
         for await (const { input, compressed } of Compress.run(outDir, {

package/dist/internal/render/head.d.ts

@@ -2,6 +2,9 @@ import { type Metadata as Collection } from '../metadata.js';
 /**
  * Renders title, meta, and link tags based on the provided metadata payload.
  */
-export declare function Head({ metadata: m }: {
+export declare function Head({ metadata: m, url }: {
     metadata?: Collection.Item | Promise<Collection.Item>;
+    url?: {
+        pathname: string;
+    };
 }): import("react/jsx-runtime").JSX.Element | null;

package/dist/internal/render/head.js

@@ -32,12 +32,18 @@ function toSafeUsable(metadata) {
 /**
  * Renders title, meta, and link tags based on the provided metadata payload.
  */
-export function Head({ metadata: m, }) {
+export function Head({ metadata: m, url, }) {
     if (!m)
         return null;
     const metadata = use(toSafeUsable(m));
+    // canonical url from the resolved origin and the request path, unless the
+    // route already declares one of its own
+    const origin = import.meta.env.VITE_APP_URL;
+    const canonical = origin && url && !metadata.link?.some(link => link.rel === 'canonical')
+        ? new URL(url.pathname, origin).toString()
+        : null;
     return (_jsxs(_Fragment, { children: [
-            _jsx("meta", { name: "generator", content: Config.NAME }), toContent(metadata.title) !== undefined && (_jsx("title", { children: toContent(metadata.title) })), metadata.meta?.map(meta => {
+            _jsx("meta", { name: "generator", content: Config.NAME }), canonical && _jsx("link", { rel: "canonical", href: canonical }), toContent(metadata.title) !== undefined && (_jsx("title", { children: toContent(metadata.title) })), metadata.meta?.map(meta => {
                 if ('charSet' in meta) {
                     return _jsx("meta", { charSet: meta.charSet }, meta.charSet);
                 }

package/dist/manifest.d.ts

@@ -5,4 +5,7 @@ export type Manifest = {
     publicFiles: ReadonlySet<string>;
 };
 export declare function getManifestPath(outDir: string): string;
-export declare function loadManifest(assets?: Assets): Promise<Manifest | null>;
+export declare function loadManifest(assets?: Assets): Promise<{
+    artifacts: Prerender.ArtifactManifest;
+    publicFiles: Set<string>;
+} | null>;

package/dist/types.d.ts

@@ -11,6 +11,13 @@ import * as Config from './config.js';
 import * as Build from './internal/build.js';
 export type LogLevel = (typeof Config.LOG_LEVELS)[number];
 export type Origin = `http://${string}` | `https://${string}`;
+/**
+ * Response headers to add to every response Solas serves. A function form
+ * receives the request, for headers that depend on it (for example a
+ * per-request CSP nonce).
+ */
+export type HeaderEntries = Record<string, string>;
+export type HeadersInput = HeaderEntries | ((req: Request) => HeaderEntries | Promise<HeaderEntries>);
 /**
  * A platform deployment adapter. Solas registers `plugins` alongside its own,
  * so adapters are configured here instead of being spread into the Vite plugins
@@ -26,6 +33,7 @@ type PluginConfigBase = {
     metadata?: Metadata.Item;
     trailingSlash?: (typeof Config.TRAILING_SLASH_MODES)[number];
     trustedOrigins?: readonly string[];
+    headers?: HeadersInput;
     adapter?: Adapter;
     readonly logger?: {
         level?: LogLevel;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@jk2908/solas",
-	"version": "0.8.3",
+	"version": "0.9.1",
 	"description": "A Vite + React meta-framework exploring streaming, Server Components, and partial prerendering. Designed for simplicity and lightness",
 	"keywords": [
 		"framework",