@lovrozagar/flare 0.1.1 → 0.2.0

package/src/server-handler/index.ts

@@ -33,11 +33,13 @@ import { mergePreloads, resolveRoutePreloads, type ViteManifest } from "../modul
 import { dispatchMount, type MountConfig, matchMount } from "../mount/index.ts";
 import { setRewrite } from "../navigation/index.ts";
 import {
+	createErrorNDJSONResponse,
 	createNDJSONResponse,
 	createRedirectNDJSONResponse,
 	createStreamingNDJSONResponse,
+	followAbortSignal,
 } from "../ndjson-server/index.ts";
-import { extractNonce, NONCE_PLACEHOLDER, replaceNonce } from "../prerender/index.ts";
+import { extractNonce, NONCE_PLACEHOLDER, replaceNonce, tagsFromSurrogateKey } from "../prerender/index.ts";
 import { createRevalidateFn } from "../revalidation/index.ts";
 import { composeRewrites, executeRewriteInput, type LocationRewrite, rewriteBasePath } from "../rewrite/index.ts";
 import type { CacheConfig, ResponseHeaders } from "../route-builder/types.ts";
@@ -66,8 +68,32 @@ import {
 	serverLog,
 	setFormActionContext,
 } from "@lovrozagar/flare/server-context";
-import { formDataToObject, handleServerFnRequest } from "../server-fn/index.ts";
-import { applyResponseHeaders, mergeResponseHeaders, renderToStream, type SSRConfig } from "../ssr/index.tsx";
+import {
+	FORM_FN_FIELD,
+	HEADER_DATA,
+	HEADER_FLAG,
+	HEADER_ISR,
+	HEADER_PRERENDER,
+	HEADER_PREFETCH,
+	HEADER_STALE,
+	INTERNAL_PATH_PREFIX,
+	isServerFnPathname,
+	serverFnPath,
+} from "../protocol.ts";
+import {
+	formDataToObject,
+	handleServerFnRequest,
+	readLimitedBody,
+	SERVER_FN_MAX_BODY_BYTES,
+} from "../server-fn/index.ts";
+import { sameOriginRedirectPath } from "../url/index.ts";
+import {
+	applyResponseHeaders,
+	deriveStatus,
+	mergeResponseHeaders,
+	renderToStream,
+	type SSRConfig,
+} from "../ssr/index.tsx";
 import type { StaticEntryData } from "../store/index.ts";
 import { noopTracer } from "../tracing/noop.ts";
 import { buildServerTimingHeader, createTimingTracer, type TimingTracer } from "../tracing/timing.ts";
@@ -152,7 +178,7 @@ const CSP_DEFAULTS: Record<string, string[] | boolean> = {
 	"upgrade-insecure-requests": true,
 };
 
-export function buildCspHeader(nonce: string, overrides?: CspDirectives, isDev?: boolean): string {
+export function buildCspHeader(nonce: string, overrides?: CspDirectives, isDev?: boolean, url?: string): string {
 	const directives: Record<string, string[] | boolean> = {};
 
 	for (const [key, value] of Object.entries(CSP_DEFAULTS)) {
@@ -167,6 +193,10 @@ export function buildCspHeader(nonce: string, overrides?: CspDirectives, isDev?:
 		scriptSrc.push("'unsafe-inline'", "'unsafe-eval'");
 	}
 
+	if (isDev || (url !== undefined && url.startsWith("http:"))) {
+		directives["upgrade-insecure-requests"] = false;
+	}
+
 	if (overrides) {
 		for (const [key, value] of Object.entries(overrides)) {
 			if (value === undefined) continue;
@@ -205,6 +235,8 @@ const SKIP_STATIC_HEADERS = new Set([
 	"content-encoding",
 	"content-length",
 	"keep-alive",
+	"set-cookie",
+	"set-cookie2",
 	"transfer-encoding",
 ]);
 
@@ -358,15 +390,15 @@ function addSecurityHeaders(response: Response, secHeaders: Record<string, strin
 		}
 	}
 
-	/* Ensure Vary includes x-d — merge with any existing Vary from cdn.vary config */
+	/* Ensure Vary includes flare-data — merge with any existing Vary from cdn.vary config */
 	const existing = headers.get("Vary");
 	if (existing) {
 		const parts = existing.split(",").map((v) => v.trim());
-		if (!parts.some((v) => v.toLowerCase() === "x-d")) {
-			headers.set("Vary", `x-d, ${existing}`);
+		if (!parts.some((v) => v.toLowerCase() === HEADER_DATA)) {
+			headers.set("Vary", `${HEADER_DATA}, ${existing}`);
 		}
 	} else {
-		headers.set("Vary", "x-d");
+		headers.set("Vary", HEADER_DATA);
 	}
 
 	return new Response(response.body, {
@@ -544,9 +576,11 @@ async function handleRevalidateRequest<TEnv>(
 		return jsonResponse({ error: "Unauthorized" }, 401);
 	}
 
+	const limited = await readLimitedBody(request, SERVER_FN_MAX_BODY_BYTES);
+	if ("error" in limited) return limited.error;
 	let body: Record<string, unknown>;
 	try {
-		body = (await request.json()) as Record<string, unknown>;
+		body = JSON.parse(new TextDecoder().decode(limited.bytes)) as Record<string, unknown>;
 	} catch {
 		return jsonResponse({ error: "Invalid JSON body" }, 400);
 	}
@@ -626,18 +660,22 @@ async function handleSitemapSubmitRequest<TEnv>(
 	let urls: string[] | undefined;
 	if (request.method === "POST") {
 		try {
-			const body = (await request.json()) as Record<string, unknown>;
-			if (Array.isArray(body.urls)) {
-				const allowedOrigin = new URL(sitemapConfig.sitemapUrl).origin;
-				urls = body.urls
-					.filter((u): u is string => typeof u === "string")
-					.filter((u) => {
-						try {
-							return new URL(u).origin === allowedOrigin;
-						} catch {
-							return false;
-						}
-					});
+			const limited = await readLimitedBody(request, SERVER_FN_MAX_BODY_BYTES);
+			if ("error" in limited) return limited.error;
+			if (limited.bytes.byteLength > 0) {
+				const body = JSON.parse(new TextDecoder().decode(limited.bytes)) as Record<string, unknown>;
+				if (Array.isArray(body.urls)) {
+					const allowedOrigin = new URL(sitemapConfig.sitemapUrl).origin;
+					urls = body.urls
+						.filter((u): u is string => typeof u === "string")
+						.filter((u) => {
+							try {
+								return new URL(u).origin === allowedOrigin;
+							} catch {
+								return false;
+							}
+						});
+				}
 			}
 		} catch {
 			/* no body or invalid JSON — fine, sitemap-only submission */
@@ -718,6 +756,29 @@ function collectDynamicRoutes(node: import("../router-primitives").TreeNode): Ro
 	return results;
 }
 
+function expandLocaleParam(
+	virtualPath: string,
+	current: Record<string, string | string[]>[],
+	locale: { locales: readonly string[]; paramName?: string } | undefined,
+): Record<string, string | string[]>[] {
+	if (!locale?.locales.length || current.length === 0) return current;
+	const name = locale.paramName ?? "locale";
+	if (!virtualPath.includes(`[${name}]`)) return current;
+	if (current.every((p) => p[name] != null && p[name] !== "")) return current;
+
+	const out: Record<string, string | string[]>[] = [];
+	for (const parent of current) {
+		if (parent[name] != null && parent[name] !== "") {
+			out.push(parent);
+			continue;
+		}
+		for (const loc of locale.locales) {
+			out.push({ ...parent, [name]: loc });
+		}
+	}
+	return out;
+}
+
 async function buildGetStaticParams(router: MarkedRouterConfig): Promise<StaticParamsMap> {
 	const dynamicRoutes = collectDynamicRoutes(router.routeTree);
 	if (dynamicRoutes.length === 0) return new Map();
@@ -785,6 +846,8 @@ async function buildGetStaticParams(router: MarkedRouterConfig): Promise<StaticP
 				currentParams = nextParams;
 			}
 
+			currentParams = expandLocaleParam(route.x, currentParams, router.locale);
+
 			if (currentParams.length > 0 && Object.keys(currentParams[0] ?? {}).length > 0) {
 				resultMap.set(route.x, currentParams);
 			}
@@ -869,6 +932,7 @@ export function createServerHandler<
 		async fetch(request: Request, env: TEnv): Promise<Response> {
 			const nonce = generateNonce();
 			const abortController = new AbortController();
+			followAbortSignal(abortController, request.signal);
 			const url = new URL(request.url);
 
 			const matchedMount = matchMount(mounts, url.pathname);
@@ -889,7 +953,7 @@ export function createServerHandler<
 				config.csp && !resolvedSecCfg?.["Content-Security-Policy"]
 					? { ...resolvedSecCfg, "Content-Security-Policy": config.csp }
 					: resolvedSecCfg;
-			const secHeaders = buildSecurityHeaders({ config: mergedSecCfg, isDev, nonce });
+			const secHeaders = buildSecurityHeaders({ config: mergedSecCfg, isDev, nonce, url: request.url });
 			const tracer = resolveTracer(config.tracing);
 
 			let resolvedStore = typeof config.cache?.store === "function" ? config.cache.store(env) : config.cache?.store;
@@ -921,9 +985,9 @@ export function createServerHandler<
 						let requestType: RequestType = "page";
 						if (matchedMount) {
 							requestType = "mount";
-						} else if (url.pathname.startsWith("/_fn/")) {
+						} else if (isServerFnPathname(url.pathname)) {
 							requestType = "server-fn";
-						} else if (url.pathname.startsWith("/_flare/")) {
+						} else if (url.pathname.startsWith(INTERNAL_PATH_PREFIX)) {
 							requestType = "internal";
 						}
 
@@ -980,32 +1044,41 @@ export function createServerHandler<
 									})
 							: undefined;
 
-						if (url.pathname.startsWith("/_fn/")) {
+						if (isServerFnPathname(url.pathname)) {
 							const fns = serverFns;
 							let response = await handleServerFnRequest(request, env, fns, serverFnAuthFn);
 							response = await applyResponseHandlers(response, responseHandlers);
 							return addSecurityHeaders(response, secHeaders);
 						}
 
-						/* PE POST: no-JS <Form> submits to page URL with __flare_fn hidden field */
+						/* PE POST: no-JS <Form> submits to page URL with flare_fn hidden field */
 						if (
 							request.method === "POST" &&
-							!url.pathname.startsWith("/_fn/") &&
-							!url.pathname.startsWith("/_flare/")
+							!isServerFnPathname(url.pathname) &&
+							!url.pathname.startsWith(INTERNAL_PATH_PREFIX)
 						) {
 							const ct = request.headers.get("content-type") ?? "";
 							if (ct.includes("form")) {
 								let formData: FormData;
 								try {
-									formData = await request.formData();
+									const limited = await readLimitedBody(request, SERVER_FN_MAX_BODY_BYTES);
+									if ("error" in limited) {
+										return addSecurityHeaders(limited.error, secHeaders);
+									}
+									const formRequest = new Request(request.url, {
+										body: limited.bytes,
+										headers: { "content-type": ct },
+										method: "POST",
+									});
+									formData = await formRequest.formData();
 								} catch {
 									return addSecurityHeaders(new Response("Bad Request", { status: 400 }), secHeaders);
 								}
-								const flareFnId = formData.get("__flare_fn");
+								const flareFnId = formData.get(FORM_FN_FIELD);
 								if (typeof flareFnId === "string" && serverFns.has(flareFnId)) {
 									const reg = serverFns.get(flareFnId);
 									if (reg) {
-										const fnUrl = `${url.origin}/_fn/${reg.id}/${reg.name}`;
+										const fnUrl = `${url.origin}${serverFnPath(reg.id, reg.name)}`;
 										/* Forward headers but drop Content-Type so the runtime
 										 * auto-sets the correct multipart boundary for FormData body. */
 										const forwardHeaders = new Headers(request.headers);
@@ -1018,14 +1091,17 @@ export function createServerHandler<
 										try {
 											const fnResponse = await handleServerFnRequest(fnRequest, env, serverFns, serverFnAuthFn);
 											if (fnResponse.ok) {
-												return new Response(null, {
-													headers: { Location: url.pathname + url.search },
-													status: 303,
-												});
+												return addSecurityHeaders(
+													new Response(null, {
+														headers: { Location: sameOriginRedirectPath(url) },
+														status: 303,
+													}),
+													secHeaders,
+												);
 											}
 											/* CSRF rejection — hard 403, not a form error */
 											if (fnResponse.status === 403) {
-												return fnResponse;
+												return addSecurityHeaders(fnResponse, secHeaders);
 											}
 											/* Validation/auth error — store context for SSR re-render */
 											const body: unknown = await fnResponse.json().catch(() => null);
@@ -1141,7 +1217,7 @@ export function createServerHandler<
 									const resolvedHead = pipelineResult.matches.findLast((m) => m.headConfig)?.headConfig ?? {};
 
 									const fuzzyLogs = enableServerLogs ? getServerLogs() : undefined;
-									if (request.headers.get("x-d") === "1") {
+									if (request.headers.get(HEADER_DATA) === HEADER_FLAG) {
 										const ndjson = createNDJSONResponse({
 											deferContexts: pipelineResult.deferContexts,
 											matches: pipelineResult.matches,
@@ -1192,7 +1268,7 @@ export function createServerHandler<
 									return addSecurityHeaders(response, secHeaders);
 								}
 							}
-							if (request.headers.get("x-d") === "1") {
+							if (request.headers.get(HEADER_DATA) === HEADER_FLAG) {
 								let data404 = unmatchedNdjson404();
 								data404 = await applyResponseHandlers(data404, responseHandlers);
 								return addSecurityHeaders(data404, secHeaders);
@@ -1200,17 +1276,24 @@ export function createServerHandler<
 							return fallbackHtmlResponse(FALLBACK_404, 404, secHeaders);
 						}
 
-						const isDataRequest = request.headers.get("x-d") === "1";
+						const isDataRequest = request.headers.get(HEADER_DATA) === HEADER_FLAG;
 
 						/* ── ISR / Static Store serving ─────────────────────── */
 						const staticMeta = match.route.o.static;
-						const isISRBgRequest = request.headers.get("x-isr-bg") === "1";
-						const isPrerenderRequest = request.headers.get("x-flare-prerender") === "1";
+						const isISRBgRequest = request.headers.get(HEADER_ISR) === HEADER_FLAG;
+						const isPrerenderRequest = request.headers.get(HEADER_PRERENDER) === HEADER_FLAG;
 						/* Skip the store on prerender: loadPrerenderArtifacts() rehydrates
 						   the previous build's HTML into the same in-memory store the
 						   prerender plugin then fetch()es, which would freeze stale
 						   client hashes into the new artifacts. */
-						if (staticMeta && resolvedStore && !isISRBgRequest && !isPrerenderRequest) {
+						if (
+							staticMeta &&
+							match.route.o.authenticate !== true &&
+							match.route.o.authorize !== true &&
+							resolvedStore &&
+							!isISRBgRequest &&
+							!isPrerenderRequest
+						) {
 							const storeKey = `static:${url.pathname}`;
 							const entry = await resolvedStore.get(storeKey);
 
@@ -1223,14 +1306,14 @@ export function createServerHandler<
 									isrRevalidate !== undefined &&
 									Date.now() - entry.storedAt > isrRevalidate * 1000;
 
-								if (isStale && !request.headers.get("x-isr-bg") && !isrInFlight.has(storeKey)) {
+								if (isStale && !request.headers.get(HEADER_ISR) && !isrInFlight.has(storeKey)) {
 									isrInFlight.add(storeKey);
 									const revalidatePromise = (async () => {
 										try {
 											const reRenderResponse = await withTimeout(
 												handler.fetch(
 													new Request(request.url, {
-														headers: { "x-isr-bg": "1" },
+														headers: { [HEADER_ISR]: HEADER_FLAG },
 														method: "GET",
 													}),
 													env,
@@ -1241,7 +1324,7 @@ export function createServerHandler<
 											const dataResponse = await withTimeout(
 												handler.fetch(
 													new Request(request.url, {
-														headers: { "x-d": "1", "x-isr-bg": "1" },
+														headers: { [HEADER_DATA]: HEADER_FLAG, [HEADER_ISR]: HEADER_FLAG },
 														method: "GET",
 													}),
 													env,
@@ -1264,8 +1347,7 @@ export function createServerHandler<
 											}
 
 											/* Extract fresh tags from re-render response */
-											const surrogateKey = headers["surrogate-key"];
-											const freshTags = surrogateKey ? surrogateKey.split(" ").filter(Boolean) : entry.tags;
+											const freshTags = tagsFromSurrogateKey(headers) ?? entry.tags;
 
 											const etag = await computeEtag(storedHtml);
 											await resolvedStore.set(storeKey, {
@@ -1331,11 +1413,11 @@ export function createServerHandler<
 							}
 
 							/* Cache miss — dynamicParams: false → 404, otherwise SSR.
-							 * Prerender fetches set x-flare-prerender so listed slugs can
+							 * Prerender fetches set flare-prerender so listed slugs can
 							 * be generated at build time before the store is populated. */
 							if (staticMeta.mode === "isr") {
 								const dynamicParams = staticMeta.dynamicParams ?? true;
-								if (dynamicParams === false && request.headers.get("x-flare-prerender") !== "1") {
+								if (dynamicParams === false && request.headers.get(HEADER_PRERENDER) !== HEADER_FLAG) {
 									const missResponse = fallbackHtmlResponse(FALLBACK_404, 404, secHeaders);
 									if (config.cache?.headers !== false) {
 										missResponse.headers.set(FLARE_CACHE_HEADER, "MISS");
@@ -1347,9 +1429,9 @@ export function createServerHandler<
 							}
 						}
 
-						const isPrefetch = request.headers.get("x-p") === "1";
+						const isPrefetch = request.headers.get(HEADER_PREFETCH) === HEADER_FLAG;
 						const MAX_STALE_IDS = 100;
-						const staleMatchIds = (request.headers.get("x-m")?.split(",") ?? []).slice(0, MAX_STALE_IDS);
+						const staleMatchIds = (request.headers.get(HEADER_STALE)?.split(",") ?? []).slice(0, MAX_STALE_IDS);
 
 						const cause = isPrefetch ? "prefetch" : ("enter" as const);
 
@@ -1478,18 +1560,22 @@ export function createServerHandler<
 								}
 							}
 
+							const ndjsonStatus = deriveStatus(pipelineResult.matches);
 							if (hasDeferreds) {
 								response = createStreamingNDJSONResponse({
+									abortController,
 									deferContexts: pipelineResult.deferContexts,
 									matches: pipelineResult.matches,
 									queryClient: pageQC?.queryClient,
 									serverLogs: logsForTransport,
+									status: ndjsonStatus,
 								});
 							} else {
 								response = createNDJSONResponse({
 									deferContexts: pipelineResult.deferContexts,
 									matches: pipelineResult.matches,
 									serverLogs: logsForTransport,
+									status: ndjsonStatus,
 								});
 							}
 
@@ -1531,10 +1617,17 @@ export function createServerHandler<
 
 						/*
 						 * ISR on-demand: populate store after first SSR miss.
-						 * Skip if x-isr-bg header present (prevents recursion from
+						 * Skip if flare-isr header present (prevents recursion from
 						 * the background re-render itself triggering another populate).
 						 */
-						if (staticMeta?.mode === "isr" && resolvedStore && !isDataRequest && !request.headers.get("x-isr-bg")) {
+						if (
+							staticMeta?.mode === "isr" &&
+							match.route.o.authenticate !== true &&
+							match.route.o.authorize !== true &&
+							resolvedStore &&
+							!isDataRequest &&
+							!request.headers.get(HEADER_ISR)
+						) {
 							const isrStoreKey = `static:${url.pathname}`;
 							if (!isrInFlight.has(isrStoreKey)) {
 								isrInFlight.add(isrStoreKey);
@@ -1543,7 +1636,7 @@ export function createServerHandler<
 										const htmlRes = await withTimeout(
 											handler.fetch(
 												new Request(request.url, {
-													headers: { "x-isr-bg": "1" },
+													headers: { [HEADER_ISR]: HEADER_FLAG },
 													method: "GET",
 												}),
 												env,
@@ -1554,7 +1647,7 @@ export function createServerHandler<
 										const dataRes = await withTimeout(
 											handler.fetch(
 												new Request(request.url, {
-													headers: { "x-d": "1", "x-isr-bg": "1" },
+													headers: { [HEADER_DATA]: HEADER_FLAG, [HEADER_ISR]: HEADER_FLAG },
 													method: "GET",
 												}),
 												env,
@@ -1581,6 +1674,7 @@ export function createServerHandler<
 										await resolvedStore.set(isrStoreKey, {
 											data: { etag, headers: resHeaders, html: storedHtml, ndjson: ndjsonBody },
 											storedAt: Date.now(),
+											tags: tagsFromSurrogateKey(resHeaders),
 										});
 									} catch (e) {
 										logError("isr", `background ISR population failed for ${isrStoreKey}`, e);
@@ -1599,6 +1693,11 @@ export function createServerHandler<
 							if (redirectCount > MAX_REDIRECTS) {
 								return fallbackHtmlResponse(FALLBACK_500, 500, secHeaders);
 							}
+							/* Preloader `throw redirect()` never lands in match.error — same NDJSON
+							   as loader redirects so fetch() does not follow a raw 3xx. */
+							if (request.headers.get(HEADER_DATA) === HEADER_FLAG) {
+								return addSecurityHeaders(createRedirectNDJSONResponse(e), secHeaders);
+							}
 							return new Response(null, {
 								headers: { Location: e.url },
 								status: e.status,
@@ -1606,14 +1705,23 @@ export function createServerHandler<
 						}
 
 						if (isUnauthenticatedError(e)) {
+							if (request.headers.get(HEADER_DATA) === HEADER_FLAG) {
+								return addSecurityHeaders(createErrorNDJSONResponse(e), secHeaders);
+							}
 							return fallbackHtmlResponse(FALLBACK_401, 401, secHeaders);
 						}
 
 						if (isUnauthorizedError(e)) {
+							if (request.headers.get(HEADER_DATA) === HEADER_FLAG) {
+								return addSecurityHeaders(createErrorNDJSONResponse(e), secHeaders);
+							}
 							return fallbackHtmlResponse(FALLBACK_403, 403, secHeaders);
 						}
 
 						if (isNotFoundError(e)) {
+							if (request.headers.get(HEADER_DATA) === HEADER_FLAG) {
+								return addSecurityHeaders(createErrorNDJSONResponse(e), secHeaders);
+							}
 							return fallbackHtmlResponse(FALLBACK_404, 404, secHeaders);
 						}
 
@@ -1630,7 +1738,7 @@ export function createServerHandler<
 						logError("handler", "unhandled request error", e);
 						const html = isDev ? buildDevErrorHtml(e) : FALLBACK_500;
 						const errResponse = fallbackHtmlResponse(html, 500, secHeaders);
-						if (request.headers.get("x-isr-bg") !== "1" && config.cache?.headers !== false) {
+						if (request.headers.get(HEADER_ISR) !== HEADER_FLAG && config.cache?.headers !== false) {
 							errResponse.headers.set(FLARE_RENDER_HEADER, "SSR");
 						}
 						return errResponse;

package/src/server-handler/types.ts

@@ -18,6 +18,8 @@ export interface CspDirectives {
 	"object-src"?: string[];
 	"script-src"?: string[];
 	"style-src"?: string[];
+	"style-src-attr"?: string[];
+	"style-src-elem"?: string[];
 	"block-all-mixed-content"?: boolean;
 	"upgrade-insecure-requests"?: boolean;
 	"worker-src"?: string[];

package/src/service-worker/template.ts

@@ -1,3 +1,5 @@
+import { HEADER_DATA, INTERNAL_PATH_PREFIX } from "../protocol.ts";
+
 export interface SwTemplateConfig {
 	/** URL prefix for cache-first asset matching. Defaults to `"/assets"`. */
 	assetsBase?: string;
@@ -53,7 +55,6 @@ self.addEventListener("install", function (event) {
 self.addEventListener("activate", function (event) {
 	event.waitUntil(
 		Promise.all([
-			self.registration.navigationPreload && self.registration.navigationPreload.enable(),
 			caches.keys().then(function (names) {
 				return Promise.all(
 					names.filter(function (n) {
@@ -84,10 +85,9 @@ self.addEventListener("fetch", function (event) {
 	/* Only handle same-origin */
 	if (url.origin !== self.location.origin) return
 
-	/* Passthrough: NDJSON (x-d header), server functions, keepalive */
-	if (event.request.headers.has("x-d")) return
-	if (url.pathname.startsWith("/_fn/")) return
-	if (url.pathname === "/_flare/keepalive") return
+	/* Passthrough: NDJSON (flare-data header), Flare internals */
+	if (event.request.headers.has(${JSON.stringify(HEADER_DATA)})) return
+	if (url.pathname.startsWith(${JSON.stringify(INTERNAL_PATH_PREFIX)})) return
 
 	/* Cache-first for hashed assets under the configured assetsBase */
 	if (url.pathname.startsWith(${JSON.stringify(`${assetsBase}/`)})) {
@@ -111,43 +111,11 @@ self.addEventListener("fetch", function (event) {
 		return
 	}
 
-	/* Network-first for navigations */
-	if (event.request.mode === "navigate") {
-		event.respondWith(
-			(function () {
-				var preload = event.preloadResponse || Promise.resolve(undefined)
-				return preload.then(function (preloaded) {
-					if (preloaded) return preloaded
-					return fetch(event.request)
-				}).then(function (response) {
-					if (response.ok) {
-						var clone = response.clone()
-						caches.open(RUNTIME_CACHE).then(function (cache) {
-							cache.put(event.request, clone).catch(function () {})
-							/* LRU eviction — batch delete to stay under limit */
-							cache.keys().then(function (keys) {
-								var i = 0
-								while (keys.length - i > SW_CONFIG.runtimeCacheMax) {
-									cache.delete(keys[i])
-									i++
-								}
-							})
-						}).catch(function () {})
-					}
-					return response
-				}).catch(function () {
-					return caches.match(event.request).then(function (cached) {
-						if (cached) return cached
-						if (SW_CONFIG.offlineFallback) {
-							return caches.match(SW_CONFIG.offlineFallback)
-						}
-						return undefined
-					})
-				})
-			})()
-		)
-		return
-	}
+	/* Do not intercept navigations. A SW fetch() either follows 3xx
+	   (document never sees Location / Set-Cookie) or returns a Response
+	   whose Set-Cookie the browser ignores — locale cookies stay stale
+	   (hr→fr still cookie=hr while the HTML is French). */
+	if (event.request.mode === "navigate") return
 })
 `;
 }

package/src/ssr/head-prefix.ts

@@ -35,7 +35,8 @@ export interface HeadPrefixOptions {
  */
 export function buildHeadPrefix(options: HeadPrefixOptions): string {
 	const escapedNonce = escapeAttr(options.nonce);
-	let prefix = `<meta name="csp-nonce" nonce="${escapedNonce}">`;
+	/* `content` is the JS-readable copy. Browsers hide `getAttribute("nonce")` after parse. */
+	let prefix = `<meta name="csp-nonce" nonce="${escapedNonce}" content="${escapedNonce}">`;
 	if (options.resolvedHead.meta?.viewport === undefined) {
 		prefix += `<meta name="viewport" content="width=device-width, initial-scale=1">`;
 	}

package/src/ssr/hoist-head-markers.ts

@@ -0,0 +1,25 @@
+/**
+ * Solid 2 hydratable `<head>` walks `head.firstChild` as `<!--$-->`.
+ * Vite (`/@vite/client`) and Flare headPrefix used to prepend nodes, so
+ * getNextMarker started on the wrong child and hydration threw
+ * `Cannot read properties of null (reading 'firstChild'|'nextSibling')`.
+ *
+ * Move the Solid `<!--$-->…<!--/-->` region to the start of `<head>`.
+ * Injected scripts/meta stay in `<head>` (still before `</head>` / body).
+ */
+export function hoistHydrationHeadMarkers(html: string): string {
+	const open = /<head[^>]*>/i.exec(html);
+	if (!open) return html;
+	const start = open.index + open[0].length;
+	const end = html.indexOf("</head>", start);
+	if (end === -1) return html;
+	const inner = html.slice(start, end);
+	const first = inner.indexOf("<!--$-->");
+	if (first <= 0) return html;
+	const last = inner.lastIndexOf("<!--/-->");
+	if (last === -1 || last < first) return html;
+	const closeAt = last + "<!--/-->".length;
+	const solid = inner.slice(first, closeAt);
+	const rest = inner.slice(0, first) + inner.slice(closeAt);
+	return html.slice(0, start) + solid + rest + html.slice(end);
+}