@junejs/server 0.2.0 → 0.2.1

package/dist/{adapter-DcZ-W1-7.d.ts → adapter-D0UnYBuN.d.ts}

@@ -29,6 +29,7 @@ type AdapterEmitContext = {
   plan: ResourcePlan;
   defaultName: string;
   publicFiles?: string[];
+  binaryImports?: string[];
 };
 interface JuneAdapter {
   readonly name: string;
@@ -45,6 +46,7 @@ interface JuneAdapter {
   emit(ctx: AdapterEmitContext): Promise<void>;
 }
 declare function hasDurableBinding(text: string, file: string, binding: string, className: string): boolean;
+declare function hasLoaderRule(text: string, file: string, ext: string): boolean | undefined;
 declare function workers(opts?: {
   name?: string;
   domain?: string;
@@ -59,4 +61,4 @@ declare function deno(opts?: {
 }): JuneAdapter;
 declare function staticSite(): JuneAdapter;
 //#endregion
-export { ResourcePlan as a, staticSite as c, JuneAdapter as i, vercel as l, AdapterEmitContext as n, deno as o, AdapterEntry as r, hasDurableBinding as s, AdapterCapabilities as t, workers as u };
+export { ResourcePlan as a, hasLoaderRule as c, workers as d, JuneAdapter as i, staticSite as l, AdapterEmitContext as n, deno as o, AdapterEntry as r, hasDurableBinding as s, AdapterCapabilities as t, vercel as u };

package/dist/adapter.d.ts

@@ -1,2 +1,2 @@
-import { a as ResourcePlan, c as staticSite, i as JuneAdapter, l as vercel, n as AdapterEmitContext, o as deno, r as AdapterEntry, s as hasDurableBinding, t as AdapterCapabilities, u as workers } from "./adapter-DcZ-W1-7.js";
-export { AdapterCapabilities, AdapterEmitContext, AdapterEntry, JuneAdapter, ResourcePlan, deno, hasDurableBinding, staticSite, vercel, workers };
+import { a as ResourcePlan, c as hasLoaderRule, d as workers, i as JuneAdapter, l as staticSite, n as AdapterEmitContext, o as deno, r as AdapterEntry, s as hasDurableBinding, t as AdapterCapabilities, u as vercel } from "./adapter-D0UnYBuN.js";
+export { AdapterCapabilities, AdapterEmitContext, AdapterEntry, JuneAdapter, ResourcePlan, deno, hasDurableBinding, hasLoaderRule, staticSite, vercel, workers };

package/dist/adapter.js

@@ -5,15 +5,7 @@ import { basename, dirname, join } from "node:path";
 //#region src/adapter.ts
 function hasDurableBinding(text, file, binding, className) {
 	if (file.endsWith(".toml")) {
-		const lines = text.split("\n").map((line) => {
-			let inString = false;
-			for (let i = 0; i < line.length; i++) {
-				const ch = line[i];
-				if (ch === "\"" && line[i - 1] !== "\\") inString = !inString;
-				else if (ch === "#" && !inString) return line.slice(0, i);
-			}
-			return line;
-		});
+		const lines = stripTomlComments(text).split("\n");
 		let inBindings = false;
 		let name;
 		let cls;
@@ -38,6 +30,39 @@ function hasDurableBinding(text, file, binding, className) {
 		return text.includes(className);
 	}
 }
+function hasLoaderRule(text, file, ext) {
+	const names = (glob) => new RegExp(`\\.(${ext}|\\{[^}]*\\b${ext}\\b[^}]*\\})$`, "i").test(glob);
+	if (file.endsWith(".toml")) {
+		const body = stripTomlComments(text);
+		let inRules = false;
+		for (const line of body.split("\n")) {
+			const t = line.trim();
+			if (t.startsWith("[")) {
+				inRules = /^\[\[\s*rules\s*\]\]$/.test(t);
+				continue;
+			}
+			const globs = inRules ? t.match(/^globs\s*=\s*\[(.*)\]/) : null;
+			if (globs && [...globs[1].matchAll(/"([^"]*)"/g)].some((m) => names(m[1]))) return true;
+		}
+		return false;
+	}
+	try {
+		return (JSON.parse(stripJsonc(text)).rules ?? []).some((r) => (r.globs ?? []).some(names));
+	} catch {
+		return;
+	}
+}
+function stripTomlComments(text) {
+	return text.split("\n").map((line) => {
+		let inString = false;
+		for (let i = 0; i < line.length; i++) {
+			const ch = line[i];
+			if (ch === "\"" && line[i - 1] !== "\\") inString = !inString;
+			else if (ch === "#" && !inString) return line.slice(0, i);
+		}
+		return line;
+	}).join("\n");
+}
 function workers(opts) {
 	return {
 		name: "workers",
@@ -61,7 +86,8 @@ function workers(opts) {
 				wrap: (pipelineVar) => `export default withAssets(${pipelineVar}, { link: ${JSON.stringify(linkHeader)} });`
 			};
 		},
-		async emit({ appRoot, outDir, hasAssets, config, plan, defaultName }) {
+		async emit({ appRoot, outDir, hasAssets, config, plan, defaultName, binaryImports }) {
+			const dataExts = (binaryImports ?? []).filter((e) => e !== "wasm");
 			const own = ["wrangler.toml", "wrangler.jsonc"].map((f) => join(appRoot, f)).find(existsSync);
 			if (own) {
 				if (plan.agent) {
@@ -71,6 +97,19 @@ function workers(opts) {
 						console.warn(`[june build] durable agent built, but ${basename(own)} doesn't bind it — add:\n${snippet}`);
 					}
 				}
+				const text = dataExts.length ? await readFile(own, "utf8") : "";
+				const found = dataExts.map((ext) => [ext, hasLoaderRule(text, own, ext)]);
+				const unloaded = found.filter(([, has]) => has === false).map(([ext]) => ext);
+				const unknown = found.filter(([, has]) => has === void 0).map(([ext]) => ext);
+				if (unknown.length) {
+					const globs = unknown.map((e) => `"**/*.${e}"`).join(", ");
+					console.warn(`[june build] the worker imports ${unknown.map((e) => `.${e}`).join(", ")} files, and ${basename(own)} couldn't be parsed to check for a rule that loads them — make sure it has one, or the deploy fails with "No loader is configured":\n"rules": [{ "type": "Data", "globs": [${globs}], "fallthrough": true }]`);
+				}
+				if (unloaded.length) {
+					const globs = unloaded.map((e) => `"**/*.${e}"`).join(", ");
+					const snippet = own.endsWith(".toml") ? `[[rules]]\ntype = "Data"\nglobs = [${globs}]\nfallthrough = true` : `"rules": [{ "type": "Data", "globs": [${globs}], "fallthrough": true }]`;
+					console.warn(`[june build] the worker imports ${unloaded.map((e) => `.${e}`).join(", ")} files, but ${basename(own)} has no rule to load them (the deploy will fail with "No loader is configured") — add:\n${snippet}`);
+				}
 				return;
 			}
 			const deployCfg = config.deploy;
@@ -99,6 +138,11 @@ function workers(opts) {
 						new_sqlite_classes: [plan.agent.className]
 					}]
 				} : {},
+				...dataExts.length ? { rules: [{
+					type: "Data",
+					globs: dataExts.map((e) => `**/*.${e}`),
+					fallthrough: true
+				}] } : {},
 				...opts?.domain ?? deployCfg?.domain ? { routes: [{
 					pattern: opts?.domain ?? deployCfg?.domain,
 					custom_domain: true
@@ -265,4 +309,4 @@ function staticSite() {
 	};
 }
 //#endregion
-export { deno, hasDurableBinding, staticSite, vercel, workers };
+export { deno, hasDurableBinding, hasLoaderRule, staticSite, vercel, workers };

package/dist/assets.d.ts

@@ -0,0 +1,23 @@
+//#region src/assets.d.ts
+export type AssetRef = {
+  name: string;
+  sha256: string;
+  size: number;
+  urls: string[];
+};
+export type AssetCacheOptions = {
+  dir: string;
+  offline?: boolean;
+  urls?: (ref: AssetRef) => string[];
+  fetch?: typeof fetch;
+};
+export interface AssetCache {
+  (ref: AssetRef): Promise<Uint8Array>;
+  cached(ref: AssetRef): Promise<boolean>;
+  egress(refs: AssetRef[]): Promise<{
+    host: string;
+    sends: "nothing";
+  }[]>;
+}
+export declare function assetCache(opts: AssetCacheOptions): AssetCache;
+//#endregion

package/dist/assets.js

@@ -0,0 +1,123 @@
+import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+//#region src/assets.ts
+const STALE_TEMP_MS = 36e5;
+const TEMP_PREFIX = ".june-tmp-";
+function assetCache(opts) {
+	const fetcher = opts.fetch ?? fetch;
+	const urlsFor = opts.urls ?? ((ref) => ref.urls);
+	const inflight = /* @__PURE__ */ new Map();
+	let swept;
+	const pathOf = (ref) => join(opts.dir, safeName(ref.name));
+	async function readMatching(ref) {
+		const path = pathOf(ref);
+		let info;
+		try {
+			info = await stat(path);
+		} catch (err) {
+			if (err.code === "ENOENT") return void 0;
+			throw err;
+		}
+		if (!info.isFile()) throw new Error(`${path} is in the way of ${ref.name}: it isn't a file`);
+		if (info.size !== ref.size) return void 0;
+		const bytes = new Uint8Array(await readFile(path));
+		return await sha256(bytes) === ref.sha256 ? bytes : void 0;
+	}
+	async function get(ref) {
+		pathOf(ref);
+		const hit = await readMatching(ref);
+		if (hit) return hit;
+		if (opts.offline) {
+			const state = await stat(pathOf(ref)).then(() => true, () => false) ? `in ${opts.dir} but doesn't match` : `not in ${opts.dir}`;
+			throw new Error(`${ref.name} is ${state}, and this cache is offline: copy the file with sha256 ${ref.sha256} (${ref.size} bytes) to ${pathOf(ref)} — it is at ${ref.urls.join(" or ")}`);
+		}
+		await (swept ??= sweepTemps(opts.dir).catch(() => {}));
+		const bytes = await download(ref, urlsFor(ref), fetcher);
+		await mkdir(opts.dir, { recursive: true });
+		const temp = join(opts.dir, `${TEMP_PREFIX}${crypto.randomUUID()}-${safeName(ref.name)}`);
+		try {
+			await writeFile(temp, bytes);
+			await rename(temp, pathOf(ref));
+		} catch (err) {
+			await rm(temp, { force: true }).catch(() => {});
+			throw err;
+		}
+		return bytes;
+	}
+	const cache = ((ref) => {
+		const key = `${ref.name}\0${ref.sha256}\0${ref.size}`;
+		const running = inflight.get(key);
+		if (running) return running;
+		const p = get(ref).finally(() => inflight.delete(key));
+		inflight.set(key, p);
+		return p;
+	});
+	cache.cached = async (ref) => await readMatching(ref) !== void 0;
+	cache.egress = async (refs) => {
+		if (opts.offline) return [];
+		const missing = (await Promise.all(refs.map(async (r) => await cache.cached(r) ? [] : urlsFor(r)))).flat();
+		return [...new Set(missing.map((u) => new URL(u).host))].map((host) => ({
+			host,
+			sends: "nothing"
+		}));
+	};
+	return cache;
+}
+async function download(ref, urls, fetcher) {
+	const failures = [];
+	for (const url of urls) try {
+		const res = await fetcher(url);
+		if (!res.ok) throw new Error(`HTTP ${res.status}`);
+		const declared = Number(res.headers.get("content-length") ?? NaN);
+		if (declared > ref.size) throw new Error(`${declared} bytes declared, expected ${ref.size}`);
+		const bytes = await readCapped(res, ref.size);
+		const digest = await sha256(bytes);
+		if (bytes.length !== ref.size || digest !== ref.sha256) throw new Error(`got ${bytes.length} bytes with sha256 ${digest}, expected ${ref.size} with ${ref.sha256}`);
+		return bytes;
+	} catch (err) {
+		failures.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	throw new Error(`${ref.name} could not be fetched (${failures.join("; ") || "no URLs"}). To run without the network, copy the file into the cache directory and pass offline: true`);
+}
+async function readCapped(res, size) {
+	if (!res.body) return new Uint8Array(await res.arrayBuffer());
+	const out = new Uint8Array(size + 1);
+	let length = 0;
+	const reader = res.body.getReader();
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		if (length + value.length >= out.length) {
+			out.set(value.subarray(0, out.length - length), length);
+			length = out.length;
+			await reader.cancel();
+			break;
+		}
+		out.set(value, length);
+		length += value.length;
+	}
+	return out.subarray(0, length);
+}
+async function sha256(bytes) {
+	const digest = await crypto.subtle.digest("SHA-256", bytes);
+	return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function safeName(name) {
+	if (!name || name === "." || name === ".." || /[\\/]/.test(name) || name.startsWith(TEMP_PREFIX)) throw new Error(`unsafe asset name: ${JSON.stringify(name)}`);
+	return name;
+}
+async function sweepTemps(dir) {
+	let names;
+	try {
+		names = await readdir(dir);
+	} catch {
+		return;
+	}
+	const now = Date.now();
+	await Promise.all(names.filter((n) => n.startsWith(TEMP_PREFIX)).map(async (n) => {
+		const s = await stat(join(dir, n)).catch(() => void 0);
+		if (s && now - s.mtimeMs > STALE_TEMP_MS) await rm(join(dir, n), { force: true });
+	}));
+}
+//#endregion
+export { assetCache };

package/dist/build.d.ts

@@ -1,6 +1,6 @@
 import { a as scanAppRoutes, o as scanRoutes, t as RouteEntry } from "./route-scan-BMbBzPIB.js";
 import { t as generateContent } from "./content-freeze-CyiW2fRK.js";
-import { i as workerName, n as normalizeBase, r as resolveDeployAdapter, t as freezeConfig } from "./config-freeze-CyXvNqi2.js";
+import { i as workerName, n as normalizeBase, r as resolveDeployAdapter, t as freezeConfig } from "./config-freeze-r5p-vTWv.js";
 import { n as buildManifest } from "./manifest-CwTT1zVs.js";
 //#region src/build.d.ts
 export type BuildResult = {

package/dist/build.js

@@ -243,6 +243,7 @@ ${doClass}`;
 	const entryFile = join(genDir, "worker-entry.tsx");
 	await writeFile(entryFile, entry);
 	const { rolldown } = await import("rolldown");
+	const binaryImports = /* @__PURE__ */ new Set();
 	const bundle = await rolldown({
 		input: entryFile,
 		cwd: appRoot,
@@ -255,7 +256,11 @@ ${doClass}`;
 		external: (id) => {
 			if (isBunSpecifier(id)) return true;
 			if (id.startsWith("cloudflare:")) return true;
-			if (/\.(wasm|ttf|otf|woff2?|png|jpe?g|avif|webp)$/.test(id)) return true;
+			const binary = /\.(wasm|ttf|otf|woff2?|png|jpe?g|avif|webp)$/i.exec(id);
+			if (binary) {
+				binaryImports.add(binary[1].toLowerCase());
+				return true;
+			}
 			return [...adapter.buildExternal ?? [], ...options.external ?? frozen.buildExternal].some((e) => id === e || id.startsWith(`${e}/`));
 		},
 		resolve: { conditionNames: adapter.conditions }
@@ -421,7 +426,8 @@ ${doClass}`;
 		config: fullConfig,
 		plan,
 		defaultName,
-		publicFiles
+		publicFiles,
+		binaryImports: [...binaryImports].sort()
 	});
 	if (plan.db) console.log(`  ↳ d1 binding "${plan.db.binding}" emitted — set database_id in wrangler.jsonc (wrangler d1 create ${plan.db.databaseName})`);
 	if (plan.agent) console.log(`  ↳ durable agent mounted (${plan.agent.className} → env.${plan.agent.binding}; chat at ${frozen.agent.runtime.chat.path})`);

package/dist/{config-freeze-CyXvNqi2.d.ts → config-freeze-r5p-vTWv.d.ts}

@@ -1,4 +1,4 @@
-import { i as JuneAdapter } from "./adapter-DcZ-W1-7.js";
+import { i as JuneAdapter } from "./adapter-D0UnYBuN.js";
 import { n as WorkerManifest } from "./worker-2qbQjj2c.js";
 import { JuneConfig } from "@junejs/core/config";
 import { DocumentConfig } from "@junejs/core/document";

package/dist/config-freeze.d.ts

@@ -1,2 +1,2 @@
-import { i as workerName, n as normalizeBase, r as resolveDeployAdapter, t as freezeConfig } from "./config-freeze-CyXvNqi2.js";
+import { i as workerName, n as normalizeBase, r as resolveDeployAdapter, t as freezeConfig } from "./config-freeze-r5p-vTWv.js";
 export { freezeConfig, normalizeBase, resolveDeployAdapter, workerName };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { a as ResourcePlan, c as staticSite, i as JuneAdapter, l as vercel, n as AdapterEmitContext, o as deno, r as AdapterEntry, t as AdapterCapabilities, u as workers } from "./adapter-DcZ-W1-7.js";
+import { a as ResourcePlan, d as workers, i as JuneAdapter, l as staticSite, n as AdapterEmitContext, o as deno, r as AdapterEntry, t as AdapterCapabilities, u as vercel } from "./adapter-D0UnYBuN.js";
 import { AGENT_MODULE_FILE, AgentDirScan, emitAgentModule, findAgentDir, generateAgentModule, scanAgentDir } from "./agent-compile.js";
 import { CreateAppOptions, JuneApp, createApp } from "./app.js";
 import { R2Bucket, localBlob, r2 } from "./blob.js";
@@ -6,7 +6,7 @@ import { o as scanRoutes } from "./route-scan-BMbBzPIB.js";
 import { t as generateContent } from "./content-freeze-CyiW2fRK.js";
 import { a as Pipeline, d as createPipeline, n as LayoutComponent, o as PipelineConfig, s as Resolved, u as RouteResolver } from "./pipeline-BHUjBO0G.js";
 import { n as WorkerManifest, r as createWorker } from "./worker-2qbQjj2c.js";
-import { t as freezeConfig } from "./config-freeze-CyXvNqi2.js";
+import { t as freezeConfig } from "./config-freeze-r5p-vTWv.js";
 import { n as buildManifest } from "./manifest-CwTT1zVs.js";
 import { BuildResult, juneBuild } from "./build.js";
 import { loadJuneConfig } from "./config-loader.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@junejs/server",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "June host adapters + dev server. Host-coupled; depends on the pure @junejs/core contract layer.",
   "type": "module",
   "license": "MIT",
@@ -60,6 +60,12 @@
       "types": "./dist/blob.d.ts",
       "default": "./dist/blob.js"
     },
+    "./assets": {
+      "source": "./src/assets.ts",
+      "bun": "./src/assets.ts",
+      "types": "./dist/assets.d.ts",
+      "default": "./dist/assets.js"
+    },
     "./resources": {
       "source": "./src/resources.ts",
       "bun": "./src/resources.ts",
@@ -132,7 +138,7 @@
     "build": "tsdown"
   },
   "dependencies": {
-    "@junejs/db": "^0.2.0",
+    "@junejs/db": "^0.2.1",
     "@momiji-rs/sparkdown": "^0.0.4",
     "@resvg/resvg-wasm": "^2.6.2",
     "lightningcss": "^1.27.0",
@@ -140,7 +146,7 @@
     "rolldown": "^1.1.0"
   },
   "peerDependencies": {
-    "@junejs/core": "^0.2.0",
+    "@junejs/core": "^0.2.1",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "react-server-dom-webpack": "19.3.0",

package/src/adapter.ts

@@ -62,6 +62,9 @@ export type AdapterEmitContext = {
   // copied into outDir/assets. Adapters that build a separate static tier (vercel)
   // place these there; whole-assets targets (workers/static/deno) ignore it.
   publicFiles?: string[];
+  // Extensions (lowercase, no dot: "wasm", "otf") of the binary files the worker bundle
+  // imports and leaves external for the platform's bundler to load.
+  binaryImports?: string[];
 };
 
 export interface JuneAdapter {
@@ -97,16 +100,7 @@ export interface JuneAdapter {
 // (advisory) warning, never a suppressed one. Pure — unit-tested directly.
 export function hasDurableBinding(text: string, file: string, binding: string, className: string): boolean {
   if (file.endsWith(".toml")) {
-    // Strip comments: '#' to end of line, unless inside a double-quoted string.
-    const lines = text.split("\n").map((line) => {
-      let inString = false;
-      for (let i = 0; i < line.length; i++) {
-        const ch = line[i];
-        if (ch === '"' && line[i - 1] !== "\\") inString = !inString;
-        else if (ch === "#" && !inString) return line.slice(0, i);
-      }
-      return line;
-    });
+    const lines = stripTomlComments(text).split("\n");
     let inBindings = false;
     let name: string | undefined;
     let cls: string | undefined;
@@ -133,6 +127,52 @@ export function hasDurableBinding(text: string, file: string, binding: string, c
   }
 }
 
+// Does an app-owned wrangler config give `.ext` files a loader? Any rule with a glob ending in
+// the extension (`**/*.otf`, `**/*.{otf,ttf}`) counts, whatever its type. The warning this
+// feeds is advisory, so a glob it can't read may draw a spurious warning, never suppress one;
+// comments are stripped first, so a commented-out rule doesn't count. undefined: the JSONC
+// couldn't be parsed, so the answer is unknown. Pure — unit-tested.
+export function hasLoaderRule(text: string, file: string, ext: string): boolean | undefined {
+  const names = (glob: string) => new RegExp(`\\.(${ext}|\\{[^}]*\\b${ext}\\b[^}]*\\})$`, "i").test(glob);
+  if (file.endsWith(".toml")) {
+    // The globs = [...] arrays of [[rules]] tables, with '#' comments removed.
+    const body = stripTomlComments(text);
+    let inRules = false;
+    for (const line of body.split("\n")) {
+      const t = line.trim();
+      if (t.startsWith("[")) {
+        inRules = /^\[\[\s*rules\s*\]\]$/.test(t);
+        continue;
+      }
+      const globs = inRules ? t.match(/^globs\s*=\s*\[(.*)\]/) : null;
+      if (globs && [...globs[1]!.matchAll(/"([^"]*)"/g)].some((m) => names(m[1]!))) return true;
+    }
+    return false;
+  }
+  try {
+    const parsed = JSON.parse(stripJsonc(text)) as { rules?: { globs?: string[] }[] };
+    return (parsed.rules ?? []).some((r) => (r.globs ?? []).some(names));
+  } catch {
+    return undefined; // unparsable — the caller warns that it couldn't check, never crashes the build
+  }
+}
+
+// '#' to end of line, unless inside a double-quoted string.
+function stripTomlComments(text: string): string {
+  return text
+    .split("\n")
+    .map((line) => {
+      let inString = false;
+      for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (ch === '"' && line[i - 1] !== "\\") inString = !inString;
+        else if (ch === "#" && !inString) return line.slice(0, i);
+      }
+      return line;
+    })
+    .join("\n");
+}
+
 // The built-in default. Reproduces exactly what build.ts emitted inline:
 // withAssets(pipeline) as the entry, and a wrangler.jsonc with the assets
 // binding (run_worker_first) + optional custom domain.
@@ -154,7 +194,13 @@ export function workers(opts?: { name?: string; domain?: string }): JuneAdapter
       };
     },
 
-    async emit({ appRoot, outDir, hasAssets, config, plan, defaultName }) {
+    async emit({ appRoot, outDir, hasAssets, config, plan, defaultName, binaryImports }) {
+      // Wrangler loads .wasm by default (CompiledWasm) and has no loader for the other
+      // binaries build.ts leaves external, so a font package's .otf failed the deploy with
+      // "No loader is configured" (#379). Each one the bundle imports gets a Data rule: the
+      // module is the file's bytes, which is what a font or image package's workerd entry
+      // expects.
+      const dataExts = (binaryImports ?? []).filter((e) => e !== "wasm");
       // An app that manages its own wrangler config wins — don't overwrite it.
       // But a durable agent NEEDS its DO binding: warn when the app-owned config
       // doesn't BIND the generated class under the name createWorker reads
@@ -173,6 +219,21 @@ export function workers(opts?: { name?: string; domain?: string }): JuneAdapter
             console.warn(`[june build] durable agent built, but ${basename(own)} doesn't bind it — add:\n${snippet}`);
           }
         }
+        const text = dataExts.length ? await readFile(own, "utf8") : "";
+        const found = dataExts.map((ext) => [ext, hasLoaderRule(text, own, ext)] as const);
+        const unloaded = found.filter(([, has]) => has === false).map(([ext]) => ext);
+        const unknown = found.filter(([, has]) => has === undefined).map(([ext]) => ext);
+        if (unknown.length) {
+          const globs = unknown.map((e) => `"**/*.${e}"`).join(", ");
+          console.warn(`[june build] the worker imports ${unknown.map((e) => `.${e}`).join(", ")} files, and ${basename(own)} couldn't be parsed to check for a rule that loads them — make sure it has one, or the deploy fails with "No loader is configured":\n"rules": [{ "type": "Data", "globs": [${globs}], "fallthrough": true }]`);
+        }
+        if (unloaded.length) {
+          const globs = unloaded.map((e) => `"**/*.${e}"`).join(", ");
+          const snippet = own.endsWith(".toml")
+            ? `[[rules]]\ntype = "Data"\nglobs = [${globs}]\nfallthrough = true`
+            : `"rules": [{ "type": "Data", "globs": [${globs}], "fallthrough": true }]`;
+          console.warn(`[june build] the worker imports ${unloaded.map((e) => `.${e}`).join(", ")} files, but ${basename(own)} has no rule to load them (the deploy will fail with "No loader is configured") — add:\n${snippet}`);
+        }
         return;
       }
       const deployCfg = config.deploy;
@@ -214,6 +275,9 @@ export function workers(opts?: { name?: string; domain?: string }): JuneAdapter
                   migrations: [{ tag: "v1", new_sqlite_classes: [plan.agent.className] }],
                 }
               : {}),
+            // Binary files the bundle imports that wrangler has no default loader for.
+            // fallthrough: without it wrangler drops its own default Data rule (**/*.bin).
+            ...(dataExts.length ? { rules: [{ type: "Data", globs: dataExts.map((e) => `**/*.${e}`), fallthrough: true }] } : {}),
             // config deploy.domain → a Workers custom domain; without it the
             // regenerated file would silently drop a hand-attached domain.
             ...(opts?.domain ?? deployCfg?.domain

package/src/assets.ts

@@ -0,0 +1,200 @@
+// assetCache — a loader for the large files an `unbundled` entry leaves out of a build (#383):
+// the PDF engine, a CJK font. Given a directory the app owns (a data volume), it serves each
+// file from there and fetches it the first time, so a single binary doesn't carry 40 MiB it
+// may never use:
+//
+//   import { assetCache } from "@junejs/server/assets";
+//   const load = assetCache({ dir: "/data/june-assets" });
+//   typstWasmRenderer({ load, fonts: [notoSansTC({ load })] });
+//
+// What it guarantees, so it can sit under a production app:
+//   • a file is returned only when its size and SHA-256 match the ref — on disk or downloaded;
+//     a stale or corrupt file is replaced, never used (the packages check again regardless);
+//   • a download stops at the ref's size, so a wrong URL can't fill the disk;
+//   • the file lands by rename from a temp file in the same directory, so a crash leaves no
+//     half-written file under the real name;
+//   • one download per file per cache, however many renders ask at once (share one `load`;
+//     two caches over the same dir each download, and the rename keeps that safe);
+//   • `offline: true` never touches the network: for hosts without egress, the files are
+//     copied in beforehand (`dir/<name>`, e.g. dir/typst.wasm), and a missing one is an error
+//     that says so.
+//
+// The request is a fixed URL: no document data leaves. `egress(refs)` says which hosts a
+// call would still contact, for a setup check.
+//
+// AssetRef is the shape @junejs/pdf-typst-wasm defines; it is repeated here, so the server
+// depends on no PDF package.
+
+import { mkdir, readdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+export type AssetRef = { name: string; sha256: string; size: number; urls: string[] };
+
+export type AssetCacheOptions = {
+  // Where the files live: one per ref, at dir/<name>.
+  dir: string;
+  // Never download: serve what is in `dir`, and fail naming the file to copy in when it's
+  // missing or doesn't match.
+  offline?: boolean;
+  // Where to fetch a ref from, in order (default: ref.urls) — a mirror the app controls.
+  urls?: (ref: AssetRef) => string[];
+  // How to fetch (default: global fetch).
+  fetch?: typeof fetch;
+};
+
+export interface AssetCache {
+  // The file's bytes, from `dir` or downloaded into it; always matching the ref.
+  (ref: AssetRef): Promise<Uint8Array>;
+  // Whether `dir` already holds a file matching the ref.
+  cached(ref: AssetRef): Promise<boolean>;
+  // The hosts a call for these refs would contact: [] when all are cached, or when offline.
+  egress(refs: AssetRef[]): Promise<{ host: string; sends: "nothing" }[]>;
+}
+
+// A temp file older than this is a crashed download; younger ones may be another process's.
+const STALE_TEMP_MS = 60 * 60 * 1000;
+// Temp files carry this prefix, and no asset may: the sweep removes nothing else.
+const TEMP_PREFIX = ".june-tmp-";
+
+export function assetCache(opts: AssetCacheOptions): AssetCache {
+  const fetcher = opts.fetch ?? fetch;
+  const urlsFor = opts.urls ?? ((ref: AssetRef) => ref.urls);
+  const inflight = new Map<string, Promise<Uint8Array>>();
+  let swept: Promise<void> | undefined;
+
+  const pathOf = (ref: AssetRef) => join(opts.dir, safeName(ref.name));
+
+  // The file at dir/<name> when it matches the ref; undefined when it's missing or doesn't.
+  // Sized first, so a large wrong file is never read; a read error other than "missing" (a
+  // directory in its place, no permission) is the caller's problem, not a cache miss.
+  async function readMatching(ref: AssetRef): Promise<Uint8Array | undefined> {
+    const path = pathOf(ref);
+    let info: Awaited<ReturnType<typeof stat>>;
+    try {
+      info = await stat(path);
+    } catch (err) {
+      if ((err as { code?: string }).code === "ENOENT") return undefined;
+      throw err;
+    }
+    if (!info.isFile()) throw new Error(`${path} is in the way of ${ref.name}: it isn't a file`);
+    if (info.size !== ref.size) return undefined;
+    const bytes = new Uint8Array(await readFile(path));
+    return (await sha256(bytes)) === ref.sha256 ? bytes : undefined;
+  }
+
+  async function get(ref: AssetRef): Promise<Uint8Array> {
+    pathOf(ref); // an unsafe name fails here, before any read or fetch
+    const hit = await readMatching(ref);
+    if (hit) return hit;
+    if (opts.offline) {
+      const there = await stat(pathOf(ref)).then(() => true, () => false);
+      const state = there ? `in ${opts.dir} but doesn't match` : `not in ${opts.dir}`;
+      throw new Error(
+        `${ref.name} is ${state}, and this cache is offline: ` +
+          `copy the file with sha256 ${ref.sha256} (${ref.size} bytes) to ${pathOf(ref)} — it is at ${ref.urls.join(" or ")}`,
+      );
+    }
+    // Housekeeping, best effort: a temp it can't remove must not fail this download or any later.
+    await (swept ??= sweepTemps(opts.dir).catch(() => {}));
+    const bytes = await download(ref, urlsFor(ref), fetcher);
+    await mkdir(opts.dir, { recursive: true });
+    const temp = join(opts.dir, `${TEMP_PREFIX}${crypto.randomUUID()}-${safeName(ref.name)}`);
+    try {
+      await writeFile(temp, bytes);
+      await rename(temp, pathOf(ref)); // atomic on one filesystem: never a half-written file
+    } catch (err) {
+      await rm(temp, { force: true }).catch(() => {}); // don't leave it for the next sweep
+      throw err;
+    }
+    return bytes;
+  }
+
+  // Keyed by the ref's whole identity (name, content, size): only identical refs share a
+  // download, so each call gets bytes that match its own ref.
+  const cache = ((ref: AssetRef) => {
+    const key = `${ref.name}\0${ref.sha256}\0${ref.size}`;
+    const running = inflight.get(key);
+    if (running) return running;
+    const p = get(ref).finally(() => inflight.delete(key));
+    inflight.set(key, p);
+    return p;
+  }) as AssetCache;
+  cache.cached = async (ref) => (await readMatching(ref)) !== undefined;
+  cache.egress = async (refs) => {
+    if (opts.offline) return [];
+    const missing = (await Promise.all(refs.map(async (r) => ((await cache.cached(r)) ? [] : urlsFor(r))))).flat();
+    return [...new Set(missing.map((u) => new URL(u).host))].map((host) => ({ host, sends: "nothing" as const }));
+  };
+  return cache;
+}
+
+// Each URL in turn; the first whose bytes match wins. The error lists every attempt.
+async function download(ref: AssetRef, urls: string[], fetcher: typeof fetch): Promise<Uint8Array> {
+  const failures: string[] = [];
+  for (const url of urls) {
+    try {
+      const res = await fetcher(url);
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      const declared = Number(res.headers.get("content-length") ?? NaN);
+      if (declared > ref.size) throw new Error(`${declared} bytes declared, expected ${ref.size}`);
+      const bytes = await readCapped(res, ref.size);
+      const digest = await sha256(bytes);
+      if (bytes.length !== ref.size || digest !== ref.sha256) throw new Error(`got ${bytes.length} bytes with sha256 ${digest}, expected ${ref.size} with ${ref.sha256}`);
+      return bytes;
+    } catch (err) {
+      failures.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  throw new Error(`${ref.name} could not be fetched (${failures.join("; ") || "no URLs"}). To run without the network, copy the file into the cache directory and pass offline: true`);
+}
+
+// The body, cut off one byte past the expected size: enough to know it's wrong, never more.
+async function readCapped(res: Response, size: number): Promise<Uint8Array> {
+  if (!res.body) return new Uint8Array(await res.arrayBuffer());
+  const out = new Uint8Array(size + 1);
+  let length = 0;
+  const reader = res.body.getReader();
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (length + value.length >= out.length) {
+      out.set(value.subarray(0, out.length - length), length);
+      length = out.length;
+      await reader.cancel();
+      break;
+    }
+    out.set(value, length);
+    length += value.length;
+  }
+  return out.subarray(0, length);
+}
+
+async function sha256(bytes: Uint8Array): Promise<string> {
+  const digest = await crypto.subtle.digest("SHA-256", bytes as Uint8Array<ArrayBuffer>);
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+// A ref's name becomes a file name: one path segment, nothing that climbs out of `dir`.
+function safeName(name: string): string {
+  if (!name || name === "." || name === ".." || /[\\/]/.test(name) || name.startsWith(TEMP_PREFIX)) throw new Error(`unsafe asset name: ${JSON.stringify(name)}`);
+  return name;
+}
+
+// Temp files a crashed download left behind; ones still young may belong to another process.
+async function sweepTemps(dir: string): Promise<void> {
+  let names: string[];
+  try {
+    names = await readdir(dir);
+  } catch {
+    return;
+  }
+  const now = Date.now();
+  await Promise.all(
+    names
+      .filter((n) => n.startsWith(TEMP_PREFIX))
+      .map(async (n) => {
+        const s = await stat(join(dir, n)).catch(() => undefined);
+        if (s && now - s.mtimeMs > STALE_TEMP_MS) await rm(join(dir, n), { force: true });
+      }),
+  );
+}

package/src/build.ts

@@ -460,6 +460,9 @@ ${doClass}`;
 
   // ---- bundle (Rolldown; self-contained ESM for workerd) -------------------
   const { rolldown } = await import("rolldown");
+  // Extensions of the binary files the graph imports and leaves to the platform's bundler
+  // (below): the adapter needs them to give each a loader (workers() → wrangler rules, #379).
+  const binaryImports = new Set<string>();
   const bundle = await rolldown({
     input: entryFile,
     cwd: appRoot,
@@ -483,8 +486,13 @@ ${doClass}`;
       if (isBunSpecifier(id)) return true;
       // workerd runtime modules (the durable-agent entry imports cloudflare:workers).
       if (id.startsWith("cloudflare:")) return true;
-      // Binary assets stay external — wrangler's CompiledWasm/Data rules own them.
-      if (/\.(wasm|ttf|otf|woff2?|png|jpe?g|avif|webp)$/.test(id)) return true;
+      // Binary assets stay external — the platform's bundler loads them (wrangler: a
+      // CompiledWasm or Data rule, which workers() emits for what is recorded here).
+      const binary = /\.(wasm|ttf|otf|woff2?|png|jpe?g|avif|webp)$/i.exec(id);
+      if (binary) {
+        binaryImports.add(binary[1]!.toLowerCase());
+        return true;
+      }
       // Merge: adapter.buildExternal (target-specific, e.g. workers-og for the
       // Workers adapter) + config build.external (user additions). User config
       // wins additions but can never REMOVE the adapter's own required externals.
@@ -754,7 +762,7 @@ ${doClass}`;
     // and the class the generated entry exports.
     ...(agentModule ? { agent: { binding: "AGENT", className: "JuneAgentDO" } } : {}),
   };
-  await adapter.emit({ appRoot, outDir, hasAssets, linkHeader, config: fullConfig, plan, defaultName, publicFiles });
+  await adapter.emit({ appRoot, outDir, hasAssets, linkHeader, config: fullConfig, plan, defaultName, publicFiles, binaryImports: [...binaryImports].sort() });
   if (plan.db) {
     console.log(
       `  ↳ d1 binding "${plan.db.binding}" emitted — set database_id in wrangler.jsonc (wrangler d1 create ${plan.db.databaseName})`,