@nifrajs/web 3.3.0 → 4.0.0

package/dist/build.js

@@ -5,21 +5,30 @@
  * are Bun-specific and never on the request path (own subpath, like `@nifrajs/web/fs`); the *output*
  * runs on any runtime.
  */
-import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { cp, lstat, mkdir, realpath } from "node:fs/promises";
-import { dirname, join, basename as pathBasename, relative, resolve as resolvePath, sep, } from "node:path";
+import { dirname, join, basename as pathBasename, posix, relative, resolve as resolvePath, sep, } from "node:path";
 import { singleCopyPlugin as declaredSingleCopyPlugin, readSingleCopyDeclaration, } from "@nifrajs/core/single-copy";
 import { Glob } from "bun";
-import { aggregateSizeReport, detectNodeBuiltinsInClient, detectServerOnlyInClient, formatNodeBuiltinLeak, formatServerOnlyLeak, parseManifestClientEntry, parseManifestRouteStyles, parseManifestStyles, planBuildTarget, } from "./build-plan.js";
+import { aggregateSizeReport, detectNodeBuiltinsInClient, detectServerOnlyInClient, formatNodeBuiltinLeak, formatServerOnlyLeak, parseBuildTarget, parseManifestClientEntry, parseManifestCssLoading, parseManifestRouteStyles, parseManifestStyles, planBuildTarget, } from "./build-plan.js";
 import { sanitizeOutputNames } from "./chunk-names.js";
+import { normalizeCssCodeSplit, normalizeCssLoading } from "./css-contract.js";
 import { discoverRoutes } from "./fs.js";
 import { generateClientEntry, generateServerManifest } from "./index.js";
 import { dedupePolicyFor } from "./internal/identity-policy.js";
 import { assertDevelopmentProductionParity, assertIdentityParity, collectDevelopmentParityInput, } from "./internal/parity.js";
-import { generateServerFnStub, SERVER_FN_MODULE, SERVER_ONLY_MODULE, SERVER_ONLY_REPLACEMENT, serverFnNamespace, } from "./internal/server-boundary.js";
-// `buildTarget(static)` drives the SSG prerender engine directly (it's also re-exported below).
+import { privateEnvCheck } from "./internal/private-env.js";
+import { publicUrlPath } from "./internal/public-url.js";
+import { assertNoSecrets, buildEnvironment, emittedScanFiles, formatSecretFindings, graphScanInput, originName, publicScanFiles, scanForSecrets, textOf, } from "./internal/secret-scan.js";
+import { generateServerFnStub, SERVER_FN_MODULE, serverFnNamespace, } from "./internal/server-boundary.js";
+import { formatUnsupportedBuiltins, unsupportedBuiltins } from "./internal/target-compat.js";
+import { accountEmittedFiles, bunModuleSource, formatClientGraphVerdict, formatServerGraphVerdict, formatUnaccountedOutput, verifyClientGraph, verifyServerGraph, } from "./internal/zone-graph.js";
 import { fromBunMetafile } from "./module-graph.js";
+import { zoneGuardPlugin } from "./plugins/zone-guard.js";
+// `buildTarget(static)` drives the SSG prerender engine directly (it's also re-exported below).
 import { prerenderRoutes } from "./prerender.js";
+import { CONTENT_TYPES, IMMUTABLE, ONE_DAY } from "./public-dir.js";
+import { createZoneClassifier } from "./zones.js";
 export * from "./build-plan.js";
 const basename = (path) => pathBasename(path);
 // The lazy shape declares `const loaders`, the eager shape `const modules`. Anchored at a line start,
@@ -54,18 +63,6 @@ export function publicEnvDefines(prefix, env) {
     }
     return defines;
 }
-/**
- * Percent-encode one path segment exactly the way a browser encodes it into a request URL.
- *
- * NOT `encodeURIComponent`. That escapes the sub-delimiters `, @ + = & ; $`, which a browser sends raw -
- * so a file named `report,2026.csv` would be recorded as `/report%2C2026.csv` while the request arrives
- * as `/report,2026.csv`, the allowlist lookup misses, and the file 404s in production only. `encodeURI`
- * agrees with `URL.pathname` on every character except `?` and `#`, which terminate a path and so must
- * be escaped explicitly here.
- */
-function encodePathSegment(segment) {
-    return encodeURI(segment).replace(/[?#]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`);
-}
 /**
  * Cloudflare Pages rejects a `_routes.json` with more than 100 include+exclude rules combined, or any
  * single rule longer than 100 characters.
@@ -116,7 +113,7 @@ function collapsibleDirs(publicFiles, routePatterns) {
     return dirs;
 }
 /**
- * Build the cf-pages `_routes.json` rules for a set of copied public files, within Cloudflare's budget.
+ * Build the cloudflare `_routes.json` rules for a set of copied public files, within Cloudflare's budget.
  *
  * `exclude` is what Pages serves straight from the CDN instead of invoking the worker, so naming every
  * public file is ideal - and impossible past ~99 of them. A `public/` of icons, fonts and share images
@@ -200,7 +197,7 @@ export async function copyPublicDir(from, to) {
         const target = join(to, rel);
         await mkdir(join(target, ".."), { recursive: true });
         await cp(candidateReal, target);
-        copied.push(`/${rel.split(sep).map(encodePathSegment).join("/")}`);
+        copied.push(publicUrlPath(rel));
     }
     return copied.sort();
 }
@@ -213,11 +210,13 @@ export async function copyPublicDir(from, to) {
  * Pure: `source` + the discovered `manifest` in, new source out.
  */
 export function resyncServerManifestSource(source, manifest, routesPrefix) {
+    const cssLoading = parseManifestCssLoading(source);
     return generateServerManifest(manifest, {
         resolve: (file) => `${routesPrefix}${file}`,
         clientEntry: parseManifestClientEntry(source) ?? "",
         styles: parseManifestStyles(source),
         routeStyles: parseManifestRouteStyles(source),
+        ...(cssLoading !== undefined ? { cssLoading } : {}),
         lazy: MANIFEST_IS_LAZY.test(source),
     });
 }
@@ -264,6 +263,7 @@ export async function buildClient(options) {
     // layered after these in the `define` object). `Bun` may be absent under non-Bun typecheck - guard it.
     const buildEnv = (typeof Bun !== "undefined" ? Bun.env : undefined) ?? process.env;
     const publicDefines = publicEnvDefines(options.publicEnvPrefix ?? "PUBLIC_", buildEnv);
+    const privateEnv = privateEnvCheck(options.publicEnvPrefix ?? "PUBLIC_");
     // Keep the generated source beside the project, not inside `outDir`: module resolution starts at the
     // importing file, so an absolute `--out /tmp/deploy` must still resolve the app's dependencies.
     // A unique directory also avoids clobbering a user file or colliding with parallel builds.
@@ -281,6 +281,10 @@ export async function buildClient(options) {
             ...routeManifest.routes.map((r) => r.file),
             ...Object.values(routeManifest.layouts).map((l) => l.file),
             ...(routeManifest.notFound ? [routeManifest.notFound.file] : []),
+            // A nested `_404` is an entry only for its stylesheet: it renders on the server, unhydrated.
+            ...Object.values(routeManifest.notFounds ?? {}).map((page) => page.file),
+            // A `_loading` page is an entry for its stylesheet too: the bootstrap imports it lazily.
+            ...Object.values(routeManifest.loadings ?? {}).map((page) => page.file),
         ]),
     ].sort();
     // `metafile: true` asks Bun for the input/output graph - specifically `outputs[js].entryPoint`
@@ -288,12 +292,14 @@ export async function buildClient(options) {
     // entry→CSS link for per-route splitting: keyed by the unique source path, so it survives
     // same-basename collisions (`index.tsx` + `blog/index.tsx`) that a filename match can't. Not yet in
     // `@types/bun`'s `BuildConfig`, so spread it in (spread props skip the excess-property check).
-    const buildExtras = { metafile: true };
+    const buildExtras = { metafile: true, throw: false };
+    const classifier = createZoneClassifier({ appRoot: root, routesDir, generatedFiles: [entryFile] });
+    const refused = new Map();
+    // No `outdir`: the bundle stays in memory until the graph proves it holds browser code only.
     const result = await (async () => {
         try {
             return await Bun.build({
                 entrypoints: [entryFile, ...routeFiles.map(resolve)],
-                outdir: outDir,
                 target: "browser",
                 naming: "[name]-[hash].[ext]",
                 publicPath,
@@ -304,11 +310,16 @@ export async function buildClient(options) {
                 ...buildExtras,
                 minify: options.minify ?? true,
                 plugins: [
+                    // First, so it sees every file before another plugin's `onLoad` claims it.
+                    zoneGuardPlugin({
+                        appRoot: root,
+                        classifier,
+                        onDenied: (file, reason) => refused.set(file, reason),
+                    }),
                     ...declaredSingleCopyPlugins(root),
                     reactDedupePlugin(routesDir),
                     preactDedupePlugin(routesDir),
                     svelteDedupePlugin(routesDir),
-                    serverOnlyEmptyPlugin(),
                     serverFnStubPlugin(),
                     ...(options.plugins ?? []),
                 ],
@@ -316,10 +327,11 @@ export async function buildClient(options) {
                 // Replace `process.env.*` at compile time so an app module reading config off `process.env` doesn't
                 // hit a `process is not defined` crash in the browser. Bun does longest-match: NODE_ENV resolves to
                 // the build mode (React's prod/dev branch); each PUBLIC_* var resolves to its baked VALUE; every
-                // other `process.env.X` becomes undefined (the bare `process.env` → `({})` fallback - so secrets
-                // never leak). Callers can override any of these via `options.define` (layered last).
+                // other `process.env.X` becomes undefined (the bare `process.env` → `{}` fallback - so secrets
+                // never leak). Callers can override any of these via `options.define` (layered last). The value
+                // must be JSON: Bun inlines anything else (`({})`) as a string literal.
                 define: {
-                    "process.env": "({})",
+                    "process.env": "{}",
                     "process.env.NODE_ENV": JSON.stringify(mode),
                     ...publicDefines,
                     ...options.define,
@@ -330,36 +342,110 @@ export async function buildClient(options) {
             rmSync(entryDir, { recursive: true, force: true });
         }
     })();
+    const cwd = process.cwd();
+    const clientMeta = result.metafile;
     if (!result.success) {
+        // A refused file can be what broke the build (a backend module importing a server-only built-in),
+        // so the refusal is the error to show, not the bundler's symptom.
+        const verdict = refused.size > 0 && clientMeta !== undefined
+            ? formatClientGraphVerdict(verifyClientGraph(fromBunMetafile(clientMeta), {
+                classifier,
+                sourceOf: bunModuleSource(cwd),
+                privateEnv,
+                refused: new Set(refused.keys()),
+            }))
+            : undefined;
+        if (verdict !== undefined)
+            throw new Error(verdict);
+        if (refused.size > 0)
+            throw new Error(formatRefusedFiles(refused, root));
         throw new Error(`[nifra/web] client build failed:\n${result.logs.map((l) => String(l)).join("\n")}`);
     }
-    // #4: a `node:` builtin (e.g. `node:crypto`) pulled into a CLIENT chunk builds fine (Bun substitutes
-    // a browser polyfill) but breaks/leaks at runtime. Fail the build with a named, actionable error
-    // instead - caught at build time, not by a confused user in the browser. Graph-based (the metafile's
-    // per-output `inputs`), so it can't false-positive on a `"node:..."` string literal and survives
-    // minification. Only the client build runs this; the server build's `node:` imports are legitimate.
-    const clientMeta = result.metafile;
-    const clientGraph = fromBunMetafile(clientMeta);
+    const emitted = await Promise.all(result.outputs.map(async (out) => {
+        if (out.kind === "sourcemap")
+            return { name: out.path, kind: "map", text: await out.text() };
+        if (out.kind === "asset") {
+            if (out.path.endsWith(".css"))
+                return { name: out.path, kind: "css", text: await out.text() };
+            const text = textOf(new Uint8Array(await out.arrayBuffer()));
+            return { name: out.path, kind: "asset", ...(text === undefined ? {} : { text }) };
+        }
+        return { name: out.path, kind: "code", text: await out.text() };
+    }));
+    const clientGraph = withEmittedImports(fromBunMetafile(clientMeta), emitted, publicPath);
+    const verdict = verifyClientGraph(clientGraph, {
+        classifier,
+        sourceOf: bunModuleSource(cwd),
+        privateEnv,
+        refused: new Set(refused.keys()),
+    });
+    // Two independent records of one fact: a file the plugin refused that the graph never shows means the
+    // graph is missing evidence, and the build cannot prove anything else about it either.
+    const reported = new Set(verdict.leaks.map((leak) => resolvePath(root, leak.module)));
+    const unseen = [...refused.keys()].filter((file) => !reported.has(file));
+    const graphMessage = formatClientGraphVerdict(unseen.length === 0
+        ? verdict
+        : {
+            ...verdict,
+            gaps: [
+                ...verdict.gaps,
+                ...unseen.map((file) => `${file} was refused while loading but is missing from the graph`),
+            ],
+        });
+    if (graphMessage !== undefined)
+        throw new Error(graphMessage);
     // #4: a `node:` builtin (e.g. `node:crypto`) pulled into a CLIENT chunk builds fine (Bun substitutes a
     // browser polyfill) but breaks/leaks at runtime. Fail with the chain (entry → … → builtin), through the
     // SHARED formatter so the Vite pipeline's identical guard reads byte-for-byte the same.
     const nodeBuiltinLeak = formatNodeBuiltinLeak(detectNodeBuiltinsInClient(clientGraph));
     if (nodeBuiltinLeak !== undefined)
         throw new Error(nodeBuiltinLeak);
-    // §3.3/§5.1: a module that opted into the `server-only` marker yet reached a CLIENT chunk - catches
-    // pure-server logic (a secret, a server-only API call) carrying no `node:` import and not named
-    // `*.server`, so neither other guard fires. Same shared formatter as above.
+    // A module that imports the `backend-only` marker yet reached a client chunk: library code the zones
+    // cannot place on a side by path alone. Same shared formatter as the Vite pipeline.
     const serverOnlyLeak = formatServerOnlyLeak(detectServerOnlyInClient(clientGraph));
     if (serverOnlyLeak !== undefined)
         throw new Error(serverOnlyLeak);
+    const unaccounted = formatUnaccountedOutput(accountEmittedFiles(emitted, clientGraph, {
+        classifier,
+        sourceOf: bunModuleSource(cwd),
+        outDir: resolvePath(outDir),
+    }));
+    if (unaccounted !== undefined)
+        throw new Error(unaccounted);
+    const publicDir = options.publicDir === false ? undefined : (options.publicDir ?? "public");
+    const { sources, originsOf } = graphScanInput(clientGraph, bunModuleSource(cwd), classifier);
+    const secrets = formatSecretFindings(scanForSecrets({
+        sources,
+        artifacts: [
+            ...emitted.flatMap((file) => {
+                if (file.text === undefined)
+                    return [];
+                const name = file.name.replace(/^\.\//, "");
+                return emittedScanFiles(name, file.text, originsOf(name));
+            }),
+            ...(publicDir !== undefined && existsSync(publicDir)
+                ? publicScanFiles(publicDir, originName(root, resolvePath(publicDir)))
+                : []),
+        ],
+        env: buildEnv,
+        publicEnvPrefix: options.publicEnvPrefix ?? "PUBLIC_",
+        ...(options.secretExemptions ? { exemptions: options.secretExemptions } : {}),
+    }));
+    if (secrets !== undefined)
+        throw new Error(secrets);
+    const outputs = await Promise.all(result.outputs.map(async (out) => {
+        const path = join(outDir, out.path);
+        await Bun.write(path, out);
+        return { kind: out.kind, path };
+    }));
     // Rename any chunk whose basename isn't URL-safe (dynamic-route files become `[slug]-hash.js`) and
     // rewrite the references - otherwise the lazy import 404s and the route silently never hydrates.
-    const renamed = sanitizeOutputNames(result.outputs);
+    const renamed = sanitizeOutputNames(outputs);
     const toUrl = (path) => `${publicPath}${renamed.get(basename(path)) ?? basename(path)}`;
     // Entry-point outputs come back in entrypoint order: [bootstrap, ...routeFiles]. Map each route file
     // to its chunk URL by that order (guarded against drift), then a route's chunks = its layout chain +
     // own file.
-    const entryPoints = result.outputs.filter((o) => o.kind === "entry-point");
+    const entryPoints = outputs.filter((o) => o.kind === "entry-point");
     const bootstrap = entryPoints[0];
     if (bootstrap === undefined)
         throw new Error("[nifra/web] build produced no entry-point output");
@@ -397,7 +483,7 @@ export async function buildClient(options) {
     // per-route `cssBundle` outputs follow. Dropping those per-route outputs (the old `aggregate`-only
     // shape) left them in `manifest.assets` but not `css`, so a route-scoped stylesheet normalized to
     // `asset:css` and tripped the module-graph parity contract - a bundler-dependent divergence.
-    const cssAssets = result.outputs.filter((o) => o.kind === "asset" && o.path.endsWith(".css"));
+    const cssAssets = outputs.filter((o) => o.kind === "asset" && o.path.endsWith(".css"));
     const css = [
         ...cssAssets.filter((o) => cssNameOf(o.path) === bootstrapName),
         ...cssAssets.filter((o) => cssNameOf(o.path) !== bootstrapName),
@@ -408,7 +494,6 @@ export async function buildClient(options) {
     // same-basename collisions (`index.tsx` + `blog/index.tsx`) that a filename match can't. A page then
     // links only its layout chain + own CSS (deduped); an empty array means the page needs no CSS at all.
     // Absent (→ aggregate fallback) only if Bun emits no metafile/cssBundle - never silently incomplete.
-    const cwd = process.cwd();
     const cssByEntry = new Map();
     for (const out of Object.values(clientMeta?.outputs ?? {})) {
         if (out.entryPoint !== undefined && out.cssBundle !== undefined) {
@@ -428,22 +513,32 @@ export async function buildClient(options) {
     // SSR pages unstyled. Keep routeStyles absent until at least one authored route entry owns CSS.
     const routeCssEntries = [...cssByEntry.keys()].filter((entry) => entry !== resolvePath(entryFile));
     if (css.length > 0 && routeCssEntries.length > 0) {
+        // A `_loading` page can show on a navigation from ANY page, and a document links only its own
+        // route's stylesheets - so every page that can start a navigation carries the loading pages' too.
+        const loadingFiles = Object.values(routeManifest.loadings ?? {}).map((page) => page.file);
         for (const route of routeManifest.routes) {
             routeStyles[route.id] = stylesFor([
                 ...route.layoutIds.map((id) => routeManifest.layouts[id]?.file ?? ""),
                 route.file,
+                ...loadingFiles,
+            ]);
+        }
+        if (routeManifest.notFound) {
+            routeStyles._404 = stylesFor([routeManifest.notFound.file, ...loadingFiles]);
+        }
+        for (const [id, page] of Object.entries(routeManifest.notFounds ?? {})) {
+            routeStyles[id] = stylesFor([
+                ...page.layoutIds.map((layoutId) => routeManifest.layouts[layoutId]?.file ?? ""),
+                page.file,
             ]);
         }
-        if (routeManifest.notFound)
-            routeStyles._404 = stylesFor([routeManifest.notFound.file]);
     }
     // Copy `public/` into the output next to the hashed assets. A missing directory is normal (most
     // apps have none) and must not fail the build.
-    const publicDir = options.publicDir === false ? undefined : (options.publicDir ?? "public");
     const publicFiles = publicDir !== undefined && existsSync(publicDir) ? await copyPublicDir(publicDir, outDir) : [];
     const manifest = {
         entry: toUrl(bootstrap.path),
-        assets: result.outputs.map((o) => toUrl(o.path)),
+        assets: outputs.map((o) => toUrl(o.path)),
         routes,
         ...(publicFiles.length > 0 ? { publicFiles } : {}),
         ...(css.length > 0 ? { css } : {}),
@@ -540,12 +635,55 @@ const SVELTE_DEDUPE_PATTERN = dedupePolicyFor("svelte").bunPattern ?? /^svelte($
  * fixed subpath list), Svelte has many internal subpaths, so each matched import is resolved dynamically.
  * `svelte/compiler` (build-time only, not in the bundle) doesn't match the filter and is left alone. No-op
  * when Svelte isn't used / isn't resolvable from `from`.
+ *
+ * Svelte is NOT condition-agnostic, unlike React and Preact: its bare entry maps `browser` to the client
+ * runtime and `default` to the server one. `Bun.resolveSync` answers for the process running the build -
+ * a server runtime - so pinning its answer put the SERVER entry into a browser bundle, where `hydrate`
+ * throws and the page never becomes interactive. For a browser bundle the package is therefore pinned by
+ * DIRECTORY and its export map is read with the bundle's own conditions.
  */
 export const svelteDedupePlugin = (from) => ({
     name: "nifra-svelte-dedupe",
     setup(build) {
+        // Absent when the plugin runs as a runtime plugin rather than inside `Bun.build`; a build with no
+        // `target` is a browser build (Bun's default).
+        const config = build.config;
+        const browser = config !== undefined && (config.target ?? "browser") === "browser";
+        const conditions = new Set([
+            "browser",
+            "import",
+            ...(typeof config?.conditions === "string"
+                ? [config.conditions]
+                : (config?.conditions ?? [])),
+        ]);
+        // The pinned copy's export map, read once. `null` when Svelte is not resolvable from the app root.
+        let pinned;
+        const pin = () => {
+            if (pinned !== undefined)
+                return pinned;
+            try {
+                const manifest = Bun.resolveSync("svelte/package.json", from);
+                const map = JSON.parse(readFileSync(manifest, "utf8")).exports;
+                pinned =
+                    typeof map === "object" && map !== null
+                        ? { root: dirname(manifest), map: map }
+                        : null;
+            }
+            catch {
+                pinned = null;
+            }
+            return pinned;
+        };
         build.onResolve({ filter: SVELTE_DEDUPE_PATTERN }, (args) => {
             try {
+                if (browser) {
+                    const copy = pin();
+                    const target = copy === null
+                        ? undefined
+                        : exportTarget(copy.map[`.${args.path.slice("svelte".length)}`], conditions);
+                    if (copy !== null && target !== undefined)
+                        return { path: join(copy.root, target) };
+                }
                 return { path: Bun.resolveSync(args.path, from) };
             }
             catch {
@@ -554,6 +692,22 @@ export const svelteDedupePlugin = (from) => ({
         });
     },
 });
+/** Walk one `exports` entry the way a resolver does: the first key, in the package's own order, that is
+ * an active condition (or `default`) wins. */
+function exportTarget(entry, conditions) {
+    if (typeof entry === "string")
+        return entry;
+    if (typeof entry !== "object" || entry === null)
+        return undefined;
+    for (const [key, value] of Object.entries(entry)) {
+        if (key !== "default" && !conditions.has(key))
+            continue;
+        const target = exportTarget(value, conditions);
+        if (target !== undefined)
+            return target;
+    }
+    return undefined;
+}
 /**
  * The app's declared single-copy rule, applied to the bundle.
  *
@@ -568,32 +722,50 @@ export const svelteDedupePlugin = (from) => ({
  */
 const declaredSingleCopyPlugins = (root) => readSingleCopyDeclaration(root) === undefined ? [] : [declaredSingleCopyPlugin({ cwd: root })];
 /**
- * Remix-style `.server` convention for the CLIENT build. A module named `*.server.ts(x)` (`db.server.ts`,
- * `auth.server.ts`, …) is server-only - empty it in the browser bundle so its (possibly `node:` / native /
- * Capacitor) import subtree never reaches the client. The body is CJS-with-a-Proxy so any named OR default
- * import resolves to `undefined` rather than a "missing export" bundle error (verified), and the real
- * import subtree is gone. The complement to the node-builtin guard: when a server-only import is co-located
- * in a route file (so it can't be tree-shaken out and the guard fails loud), moving it into a `*.server`
- * module is the fix. CLIENT-only - buildServer keeps the real module, which runs server-side.
+ * Give each output chunk the specifiers its emitted code imports. Bun's metafile does not record them
+ * (its output `imports` stay empty even for an external the code keeps), so they are read from the code.
+ * A specifier under `publicPath` or relative to the chunk is mapped back to the output it names.
  */
-export const serverOnlyEmptyPlugin = () => ({
-    name: "nifra-server-only-empty",
-    setup(build) {
-        build.onLoad({ filter: SERVER_ONLY_MODULE }, () => ({
-            contents: SERVER_ONLY_REPLACEMENT,
-            loader: "js",
+function withEmittedImports(graph, emitted, publicPath) {
+    const scanner = new Bun.Transpiler({ loader: "js" });
+    const imports = new Map();
+    for (const file of emitted) {
+        if (file.kind !== "code" || file.text === undefined) {
+            imports.set(posix.normalize(file.name), []);
+            continue;
+        }
+        imports.set(posix.normalize(file.name), scanner.scanImports(file.text).map(({ path }) => {
+            if (publicPath !== undefined && path.startsWith(publicPath))
+                return path.slice(publicPath.length);
+            if (path.startsWith("./") || path.startsWith("../"))
+                return posix.join(posix.dirname(posix.normalize(file.name)), path);
+            return path;
         }));
-    },
-});
+    }
+    const chunks = {};
+    // A chunk with no emitted file keeps no `imports`, which the verifiers treat as missing evidence.
+    for (const [path, chunk] of Object.entries(graph.chunks)) {
+        const kept = imports.get(posix.normalize(path));
+        chunks[path] = kept === undefined ? chunk : { ...chunk, imports: kept };
+    }
+    return { ...graph, chunks };
+}
+/** Refusals the bundler stopped on before it produced a graph, so without import chains. */
+function formatRefusedFiles(refused, root) {
+    const lines = [...refused].map(([file, reason]) => {
+        const rel = relative(root, file).replaceAll("\\", "/");
+        return `  - ${rel.startsWith("..") ? file : rel}: ${reason}`;
+    });
+    return `[nifra/web] the browser build reached code that may not ship to a browser:\n${lines.join("\n")}`;
+}
+export { zoneGuardPlugin } from "./plugins/zone-guard.js";
 /**
  * Server functions in the CLIENT build: replace each `*.fn.ts` module with stubs that call the routes
  * the server mounted, so the function bodies - and everything they import - never reach a browser.
  *
- * The sibling of {@link serverOnlyEmptyPlugin}, and a deliberate contrast: a `*.server` module is
- * EMPTIED because nothing may call it from the client, while a `*.fn` module is REPLACED because the
- * client is supposed to call it, just over HTTP. The generation itself is in
- * `internal/server-boundary.ts` so the Vite pipeline emits identical stubs from the same code; two
- * hand-written copies would be a client that works in dev and 404s in production.
+ * The generation itself is in `internal/server-boundary.ts` so the Vite pipeline emits identical stubs
+ * from the same code; two hand-written copies would be a client that works in dev and 404s in
+ * production.
  *
  * CLIENT-only. The server build keeps the real module, which is what `serverFunctions()` mounts.
  */
@@ -634,7 +806,7 @@ const solidWebServerPlugin = (from) => ({
  * silently ships a broken worker.
  */
 export async function buildServer(options) {
-    const { routesDir, serverEntry, outDir, clientEntry, styles, routeStyles } = options;
+    const { routesDir, serverEntry, outDir, clientEntry, styles, routeStyles, cssLoading } = options;
     const entryDir = dirname(serverEntry);
     const manifestFile = options.manifestFile ?? "server-manifest.ts";
     // Default: import routes relative from the generated manifest (next to serverEntry) to routesDir.
@@ -650,11 +822,19 @@ export async function buildServer(options) {
     const edge = target === "browser";
     const conditions = options.conditions ?? (edge ? ["workerd", "edge-light", "browser"] : [target]);
     const manifest = discoverRoutes(routesDir);
-    writeFileSync(`${entryDir}/${manifestFile}`, generateServerManifest(manifest, { resolve, clientEntry, styles, routeStyles, lazy }));
+    writeFileSync(`${entryDir}/${manifestFile}`, generateServerManifest(manifest, {
+        resolve,
+        clientEntry,
+        styles,
+        routeStyles,
+        ...(cssLoading !== undefined ? { cssLoading } : {}),
+        lazy,
+    }));
     const result = await Bun.build({
         entrypoints: [serverEntry],
         outdir: outDir,
         target,
+        metafile: true,
         conditions: [...conditions],
         define: {
             ...(options.define ?? { "process.env.NODE_ENV": '"production"' }),
@@ -682,6 +862,38 @@ export async function buildServer(options) {
     if (!result.success) {
         throw new Error(`[nifra/web] server build failed:\n${result.logs.map((l) => String(l)).join("\n")}`);
     }
+    // Named as the metafile names outputs: relative to `outdir`.
+    const nameOf = (path) => relative(outDir, path).replaceAll("\\", "/");
+    const emitted = await Promise.all(result.outputs.map(async (out) => out.kind === "sourcemap" || out.kind === "asset"
+        ? { name: nameOf(out.path), kind: out.kind === "sourcemap" ? "map" : "asset" }
+        : { name: nameOf(out.path), kind: "code", text: await out.text() }));
+    const serverGraph = withEmittedImports(fromBunMetafile(result.metafile), emitted);
+    const appRoot = resolvePath(options.root ?? dirname(routesDir));
+    const classifier = createZoneClassifier({
+        appRoot,
+        routesDir,
+        generatedFiles: [
+            serverEntry,
+            join(entryDir, manifestFile),
+            ...(options.generatedFiles ?? []),
+        ].map((file) => resolvePath(file)),
+    });
+    const sourceOf = bunModuleSource(process.cwd());
+    const labelOf = (id) => {
+        const source = sourceOf(id);
+        return source.kind === "file" ? relative(appRoot, source.file).replaceAll("\\", "/") : id;
+    };
+    const refusal = formatServerGraphVerdict(verifyServerGraph(serverGraph, {
+        classifier,
+        sourceOf,
+        privateEnv: privateEnvCheck(options.publicEnvPrefix ?? "PUBLIC_"),
+    })) ?? formatUnsupportedBuiltins(unsupportedBuiltins(serverGraph, target, labelOf), target);
+    if (refusal !== undefined) {
+        // Bun wrote the bundle already; a refused build leaves nothing a deploy step could pick up.
+        for (const output of result.outputs)
+            rmSync(output.path, { force: true });
+        throw new Error(refusal);
+    }
     const entryOutput = result.outputs.find((o) => o.kind === "entry-point");
     if (entryOutput === undefined) {
         throw new Error("[nifra/web] server build produced no entry-point output");
@@ -696,12 +908,24 @@ export async function buildServer(options) {
 // The ONLY thing apps used to hand-write per target was the server entry (`_worker.ts`, `server-bun.ts`,
 // …) - so we GENERATE it here (per target) instead of asking each app to ship five near-identical files.
 // ===================================================================================================
+/** The `createWebApp` options a generated server entry can import from the app's framework module. */
+export const SERVER_ENTRY_OPTIONS = ["apiPrefix", "apiStrip", "mounts", "csp", "nonce"];
+/**
+ * The header each edge platform sets to the caller's address, replacing any value the client sent.
+ * That replacement is the whole trust: the same bundle served without the platform's edge in front
+ * (`wrangler pages dev`, a self-hosted workerd) hands the header straight from the client, which is
+ * why it is only believed on an explicit `clientIp: "platform"`.
+ */
+const PLATFORM_CLIENT_IP_HEADERS = {
+    cloudflare: "cf-connecting-ip",
+    vercel: "x-real-ip",
+};
 /**
  * Codegen the per-target **server entry** module (source text) for `buildServer` to bundle. It imports
  * the app's `adapter` (from `framework.ts`), the optional `backend` (from `backend.ts`), and the
  * generated `{ manifest, clientEntry }` (from `./server-manifest`), builds `createWebApp`, then wires
  * the right host:
- *   - `cf-pages` / `vercel`: `export default` the fetch handler (the platform serves /assets/* itself).
+ *   - `cloudflare` / `vercel`: `export default` the fetch handler (the platform serves /assets/* itself).
  *   - `deno`: same fetch-handler default, plus `Deno.serve` self-host when run directly.
  *   - `bun` / `node`: a self-hosting server that ALSO serves the client bundle from disk (those
  *     runtimes have a filesystem; the static `/assets/*` sit next to the entry).
@@ -710,7 +934,23 @@ export async function buildServer(options) {
  * string out) so the generation is unit-testable without a real build.
  */
 export function generateServerEntry(options) {
-    const { target, adapterImport, backendImport, useImport, title = "nifra", publicFiles = [], } = options;
+    const { target, adapterImport, backendImport, useImport, optionImports = {}, title = "nifra", publicFiles = [], clientIp, } = options;
+    if (clientIp !== undefined && clientIp !== "platform") {
+        throw new Error(`[nifra/web] generateServerEntry: clientIp must be "platform" or left out, got ${JSON.stringify(clientIp)}`);
+    }
+    const clientIpHeader = clientIp === "platform" ? PLATFORM_CLIENT_IP_HEADERS[target] : undefined;
+    // Identifiers come only from the fixed list, never from the caller's keys, so generated code names
+    // nothing the list does not.
+    const importedOptions = SERVER_ENTRY_OPTIONS.filter((name) => optionImports[name] !== undefined);
+    const optionModules = new Map();
+    for (const name of importedOptions) {
+        const from = optionImports[name];
+        const names = optionModules.get(from);
+        if (names === undefined)
+            optionModules.set(from, [name]);
+        else
+            names.push(name);
+    }
     if (target === "static") {
         throw new Error("[nifra/web] generateServerEntry: `static` has no server entry (SSG only)");
     }
@@ -720,18 +960,24 @@ export function generateServerEntry(options) {
     lines.push(`import { adapter } from ${JSON.stringify(adapterImport)}`);
     if (useImport !== undefined)
         lines.push(`import { use } from ${JSON.stringify(useImport)}`);
+    for (const [from, names] of optionModules) {
+        lines.push(`import { ${names.join(", ")} } from ${JSON.stringify(from)}`);
+    }
     if (backendImport !== undefined) {
         lines.push(`import { backend } from ${JSON.stringify(backendImport)}`);
     }
-    lines.push('import { clientEntry, manifest, styles, routeStyles } from "./server-manifest"');
-    // cf-pages/vercel/deno need the fetch-handler shape; bun/node call app.fetch directly.
-    const usesToFetch = target === "cf-pages" || target === "vercel" || target === "deno";
-    if (usesToFetch)
+    lines.push('import { clientEntry, cssLoading, manifest, styles, routeStyles } from "./server-manifest"');
+    // Cloudflare needs the fetch-handler shape; the others call app.fetch directly.
+    if (target === "cloudflare")
         lines.push('import { toFetchHandler } from "@nifrajs/core/server"');
     if (target === "node")
         lines.push('import { serve } from "@nifrajs/node"');
-    lines.push("", "const app = createWebApp({", "  adapter,", ...(useImport !== undefined ? ["  use,"] : []), "  manifest,", "  clientEntry,", "  styles,", "  routeStyles,", ...(backendImport !== undefined ? ["  api: inProcessClient(backend),"] : []), `  title: ${JSON.stringify(title)},`, "})", "");
-    if (target === "cf-pages") {
+    lines.push("", "const app = createWebApp({", "  adapter,", ...(useImport !== undefined ? ["  use,"] : []), ...importedOptions.map((name) => `  ${name},`), "  manifest,", "  clientEntry,", "  styles,", "  routeStyles,", "  cssLoading,", ...(backendImport !== undefined ? ["  api: inProcessClient(backend),"] : []), `  title: ${JSON.stringify(title)},`, 
+    // Core's own `{ header }` trust, so the mounted backend and every loader see the derived caller.
+    ...(clientIpHeader !== undefined
+        ? [`  server: { clientIp: { header: ${JSON.stringify(clientIpHeader)} } },`]
+        : []), "})", "");
+    if (target === "cloudflare") {
         // Cloudflare Pages advanced mode: `_routes.json` keeps static paths off the worker entirely, and
         // everything else falls through to this handler (SSR).
         //
@@ -747,20 +993,26 @@ export function generateServerEntry(options) {
         return `${lines.join("\n")}\n`;
     }
     // bun / node / deno self-host AND serve the client bundle from disk (it sits next to this entry).
-    lines.push("// The client bundle and public files live next to this entry; serve only manifest-approved paths.", 'const STATIC_ROOT = new URL("./", import.meta.url)', `const PUBLIC_FILES = new Set(${JSON.stringify(publicFiles)})`, "const staticPath = (pathname: string): string | undefined => {", "  if (PUBLIC_FILES.has(pathname)) return '.' + pathname", '  if (!pathname.startsWith("/assets/")) return undefined', '  const segments = pathname.slice(1).split("/")', "  // `.` and `..` match the character class, and the path is joined onto a base URL that resolves", "  // dot segments - so they are rejected explicitly rather than relying on the request URL having", "  // been normalized upstream.", "  const safe = (segment: string): boolean =>", '    segment !== "." && segment !== ".." && /^[A-Za-z0-9._-]+$/.test(segment)', "  return segments.every(safe) ? '.' + pathname : undefined", "}", 'const TYPES = { js: "text/javascript", css: "text/css", map: "application/json" }');
+    lines.push("// The client bundle and public files live next to this entry; serve only manifest-approved paths.", 'const STATIC_ROOT = new URL("./", import.meta.url)', `const PUBLIC_FILES = new Set(${JSON.stringify(publicFiles)})`, "const staticPath = (pathname: string): string | undefined => {", "  if (PUBLIC_FILES.has(pathname)) return '.' + pathname", '  if (!pathname.startsWith("/assets/")) return undefined', '  const segments = pathname.slice(1).split("/")', "  // `.` and `..` match the character class, and the path is joined onto a base URL that resolves", "  // dot segments - so they are rejected explicitly rather than relying on the request URL having", "  // been normalized upstream.", "  const safe = (segment: string): boolean =>", '    segment !== "." && segment !== ".." && /^[A-Za-z0-9._-]+$/.test(segment)', "  return segments.every(safe) ? '.' + pathname : undefined", "}", 
+    // The type table and cache policy `servePublicDir` uses. Without a known type, Bun answers a file
+    // as an `application/octet-stream` attachment, which a browser downloads instead of showing.
+    `const TYPES: Record<string, string> = ${JSON.stringify(CONTENT_TYPES)}`, "const staticHeaders = (pathname: string): Record<string, string> => ({", '  "content-type": TYPES[pathname.slice(pathname.lastIndexOf(".")).toLowerCase()] ?? "application/octet-stream",', `  "cache-control": pathname.startsWith("/assets/") ? ${JSON.stringify(IMMUTABLE)} : ${JSON.stringify(ONE_DAY)},`, '  "x-content-type-options": "nosniff",', "})");
+    // Bun.serve and Deno.serve delimit the body themselves, so its declared length is the transport
+    // frame - the guarantee core's own listen() and the Deno adapter mark (see markTrustedBodyFraming).
+    const markFramed = '(req as unknown as Record<symbol, unknown>)[Symbol.for("nifra.body.trustedFraming")] = true';
     if (target === "bun") {
-        lines.push("const server = Bun.serve({", "  port: Number(Bun.env.PORT ?? 3000),", "  async fetch(req) {", "    const { pathname } = new URL(req.url)", "    const filePath = staticPath(pathname)", "    if (filePath !== undefined) {", "      const file = Bun.file(new URL(filePath, STATIC_ROOT))", '      if (!(await file.exists())) return new Response("not found", { status: 404 })', '      const ext = pathname.slice(pathname.lastIndexOf(".") + 1)', '      return new Response(file, { headers: { "content-type": TYPES[ext] ?? "application/octet-stream" } })', "    }", "    return app.fetch(req)", "  },", "})", 
+        lines.push("const server = Bun.serve({", "  port: Number(Bun.env.PORT ?? 3000),", "  async fetch(req, server) {", "    const { pathname } = new URL(req.url)", "    const filePath = staticPath(pathname)", "    if (filePath !== undefined) {", "      const file = Bun.file(new URL(filePath, STATIC_ROOT))", '      if (!(await file.exists())) return new Response("not found", { status: 404 })', "      return new Response(file, { headers: staticHeaders(pathname) })", "    }", `    ${markFramed}`, "    // The socket peer, looked up only when something reads it (as core's own listen() does).", "    return app.fetch(req, { get clientIp() { return server.requestIP(req)?.address } })", "  },", "})", 
         // The `${...}` here is literal OUTPUT (a template in the GENERATED file), not a template in this
         // source - split so biome's noTemplateCurlyInString doesn't flag it; the emitted line is unchanged.
         `console.log(\`nifra (Bun) → http://localhost:$${"{server.port}"}\`)`);
         return `${lines.join("\n")}\n`;
     }
     if (target === "node") {
-        lines.push('import { readFile } from "node:fs/promises"', "await serve(", "  {", "    async fetch(req) {", "      const { pathname } = new URL(req.url)", "      const filePath = staticPath(pathname)", "      if (filePath !== undefined) {", "        try {", "          const body = await readFile(new URL(filePath, STATIC_ROOT))", '          const ext = pathname.slice(pathname.lastIndexOf(".") + 1)', '          return new Response(body, { headers: { "content-type": TYPES[ext] ?? "application/octet-stream" } })', "        } catch {", '          return new Response("not found", { status: 404 })', "        }", "      }", "      return app.fetch(req)", "    },", "  },", "  { port: Number(process.env.PORT ?? 3000) },", ")");
+        lines.push('import { readFile } from "node:fs/promises"', "await serve(", "  {", "    async fetch(req, platform) {", "      const { pathname } = new URL(req.url)", "      const filePath = staticPath(pathname)", "      if (filePath !== undefined) {", "        try {", "          const body = await readFile(new URL(filePath, STATIC_ROOT))", "          return new Response(body, { headers: staticHeaders(pathname) })", "        } catch {", '          return new Response("not found", { status: 404 })', "        }", "      }", "      return app.fetch(req, platform)", "    },", "  },", "  { port: Number(process.env.PORT ?? 3000) },", ")");
         return `${lines.join("\n")}\n`;
     }
     // deno
-    lines.push("const handler = toFetchHandler(app)", "// @ts-ignore - Deno global is present on the Deno runtime this output targets.", 'Deno.serve({ port: Number(Deno.env.get("PORT") ?? "3000") }, async (req) => {', "  const { pathname } = new URL(req.url)", "  const filePath = staticPath(pathname)", "  if (filePath !== undefined) {", "    try {", "      // @ts-ignore - Deno.readFile is present on the Deno runtime.", "      const body = await Deno.readFile(new URL(filePath, STATIC_ROOT))", '      const ext = pathname.slice(pathname.lastIndexOf(".") + 1)', '      return new Response(body, { headers: { "content-type": TYPES[ext] ?? "application/octet-stream" } })', "    } catch {", '      return new Response("not found", { status: 404 })', "    }", "  }", "  return handler.fetch(req)", "})");
+    lines.push("// @ts-ignore - Deno global is present on the Deno runtime this output targets.", 'Deno.serve({ port: Number(Deno.env.get("PORT") ?? "3000") }, async (req, info) => {', "  const { pathname } = new URL(req.url)", "  const filePath = staticPath(pathname)", "  if (filePath !== undefined) {", "    try {", "      // @ts-ignore - Deno.readFile is present on the Deno runtime.", "      const body = await Deno.readFile(new URL(filePath, STATIC_ROOT))", "      return new Response(body, { headers: staticHeaders(pathname) })", "    } catch {", '      return new Response("not found", { status: 404 })', "    }", "  }", `  ${markFramed}`, "  return app.fetch(req, { clientIp: info.remoteAddr.hostname })", "})");
     return `${lines.join("\n")}\n`;
 }
 /** Measure each emitted output file's raw + gzip size. Reads the file off disk and gzips it with
@@ -783,36 +1035,48 @@ async function measureOutputs(paths) {
  * `<outDir>/assets/*`, then per target:
  *   - `static`: prerenders opted-in routes (`prerenderRoutes`) to `<outDir>/<path>/index.html` (+
  *     `_data.json`); needs `prerenderApp`. No server.
- *   - `cf-pages`: a `_worker.js` (edge bundle) + a `_routes.json` excluding /assets/* from the worker.
- *   - `vercel`: a `.vercel/output`-shaped function isn't emitted here - `vercel` emits the bundled edge
- *     entry as `<outDir>/index.js` (the CLI's docs point at `vercel`'s Build Output wrapper). [see note]
+ *   - `cloudflare`: a `_worker.js` (edge bundle) + a `_routes.json` excluding /assets/* from the worker.
+ *   - `vercel`: Vercel's Build Output API v3 - `config.json`, the client bundle and public files under
+ *     `static/`, and the edge function at `functions/index.func/index.js`; `vercel deploy --prebuilt`
+ *     uploads it as it is when `outDir` is `.vercel/output`.
  *   - `deno`/`node`/`bun`: the self-hosting server bundle (`server.js`) next to the assets.
  * The server entry is GENERATED (`generateServerEntry`) and bundled (`buildServer`); the app supplies
  * only adapter/backend/routes. Returns the manifest + a size report. Throws on any build failure.
- *
- * Note: the heavier platform wrappers (`.vercel/output` v3 layout, wrangler ISR `find_additional_modules`)
- * remain app-owned scripts; this command targets the common single-bundle deploys. See the CLI docs.
  */
 /** The default (Bun) strategy - `buildClient`/`buildServer` from this module. */
 export const bunBundler = {
-    buildClient: (input) => buildClient({
-        routesDir: input.routesDir,
-        outDir: input.outDir,
-        clientModule: input.clientModule,
-        ...(input.plugins ? { plugins: input.plugins } : {}),
-        ...(input.conditions ? { conditions: input.conditions } : {}),
-        ...(input.define ? { define: input.define } : {}),
-        ...(input.publicDir !== undefined ? { publicDir: input.publicDir } : {}),
-        ...(input.publicEnvPrefix !== undefined ? { publicEnvPrefix: input.publicEnvPrefix } : {}),
-    }),
+    buildClient: (input) => {
+        const cssCodeSplit = normalizeCssCodeSplit(input.cssCodeSplit);
+        if (cssCodeSplit === false) {
+            throw new Error("[nifra/web] cssCodeSplit: false is a Vite-only production option. Use buildTargetVite or remove it for the native Bun build.");
+        }
+        return buildClient({
+            routesDir: input.routesDir,
+            outDir: input.outDir,
+            clientModule: input.clientModule,
+            ...(input.plugins ? { plugins: input.plugins } : {}),
+            ...(input.conditions ? { conditions: input.conditions } : {}),
+            ...(input.define ? { define: input.define } : {}),
+            ...(input.cssCodeSplit !== undefined ? { cssCodeSplit } : {}),
+            ...(input.publicDir !== undefined ? { publicDir: input.publicDir } : {}),
+            ...(input.publicEnvPrefix !== undefined ? { publicEnvPrefix: input.publicEnvPrefix } : {}),
+            ...(input.secretExemptions !== undefined ? { secretExemptions: input.secretExemptions } : {}),
+        });
+    },
     buildServer: (input) => buildServer({
         routesDir: input.routesDir,
         serverEntry: input.serverEntry,
         outDir: input.outDir,
         clientEntry: input.clientEntry,
         target: input.target,
+        ...(input.styles !== undefined ? { styles: input.styles } : {}),
+        ...(input.routeStyles !== undefined ? { routeStyles: input.routeStyles } : {}),
         ...(input.plugins ? { plugins: input.plugins } : {}),
         ...(input.define ? { define: input.define } : {}),
+        ...(input.cssLoading !== undefined ? { cssLoading: input.cssLoading } : {}),
+        ...(input.root !== undefined ? { root: input.root } : {}),
+        ...(input.generatedFiles !== undefined ? { generatedFiles: input.generatedFiles } : {}),
+        ...(input.publicEnvPrefix !== undefined ? { publicEnvPrefix: input.publicEnvPrefix } : {}),
     }),
 };
 /** Build a full deploy dir for `target` using the default Bun bundler. See {@link buildTargetWith}. */
@@ -827,14 +1091,17 @@ export async function buildTarget(target, options) {
  */
 export async function buildTargetWith(target, options, bundler) {
     const { routesDir, outDir, workDir } = options;
-    const targetPlan = planBuildTarget(target, outDir);
+    const requestedCssCodeSplit = options.cssCodeSplit === undefined ? undefined : normalizeCssCodeSplit(options.cssCodeSplit);
+    const requestedCssLoading = options.cssLoading === undefined ? undefined : normalizeCssLoading(options.cssLoading);
+    const targetPlan = planBuildTarget(parseBuildTarget(target), outDir);
     const { rmSync } = await import("node:fs");
     rmSync(outDir, { recursive: true, force: true });
     rmSync(workDir, { recursive: true, force: true });
-    const assetsDir = `${outDir}/assets`;
+    const staticRoot = targetPlan.staticDir === "" ? outDir : `${outDir}/${targetPlan.staticDir}`;
+    const assetsDir = `${staticRoot}/assets`;
     mkdirSync(assetsDir, { recursive: true });
     mkdirSync(workDir, { recursive: true });
-    // (1) Client bundle → <outDir>/assets/* (every target ships the same hashed client bundle).
+    // (1) Client bundle → <static root>/assets/* (every target ships the same hashed client bundle).
     let client = await bundler.buildClient({
         routesDir,
         outDir: assetsDir,
@@ -844,14 +1111,43 @@ export async function buildTargetWith(target, options, bundler) {
         define: { "process.env.NODE_ENV": '"production"', ...(options.define ?? {}) },
         publicDir: false,
         ...(options.publicEnvPrefix !== undefined ? { publicEnvPrefix: options.publicEnvPrefix } : {}),
+        ...(options.secretExemptions !== undefined
+            ? { secretExemptions: options.secretExemptions }
+            : {}),
+        ...(requestedCssCodeSplit !== undefined ? { cssCodeSplit: requestedCssCodeSplit } : {}),
+        ...(requestedCssLoading !== undefined ? { cssLoading: requestedCssLoading } : {}),
         root: resolvePath(dirname(routesDir)),
     });
+    // Bun's client builder has no CSS-loading field, but the server-side document policy is bundler
+    // independent. Carry the requested policy into the result so static prerender callbacks and the
+    // generated server entry see the same choice on both build strategies.
+    if (requestedCssLoading !== undefined && client.cssLoading !== requestedCssLoading) {
+        client = { ...client, cssLoading: requestedCssLoading };
+    }
     const publicDir = options.publicDir === false
         ? undefined
         : resolvePath(options.publicDir ?? join(dirname(routesDir), "public"));
-    const publicFiles = publicDir !== undefined && existsSync(publicDir) ? await copyPublicDir(publicDir, outDir) : [];
+    const secretScan = {
+        env: buildEnvironment(),
+        publicEnvPrefix: options.publicEnvPrefix ?? "PUBLIC_",
+        ...(options.secretExemptions !== undefined ? { exemptions: options.secretExemptions } : {}),
+    };
+    if (publicDir !== undefined && existsSync(publicDir)) {
+        assertNoSecrets({
+            ...secretScan,
+            artifacts: publicScanFiles(publicDir, originName(dirname(routesDir), publicDir)),
+        });
+    }
+    const publicFiles = publicDir !== undefined && existsSync(publicDir)
+        ? await copyPublicDir(publicDir, staticRoot)
+        : [];
     if (publicFiles.length > 0) {
         client = { ...client, publicFiles };
+    }
+    // `buildClient` writes its first manifest before the target orchestration knows the activation policy
+    // (the native Bun client builder has no CSS-loading option). Persist the target-level additions even
+    // when the app has no public/ files; otherwise the returned manifest and the deploy artifact disagree.
+    if (requestedCssLoading !== undefined || publicFiles.length > 0) {
         writeFileSync(`${assetsDir}/manifest.json`, JSON.stringify(client, null, 2));
     }
     if (targetPlan.kind === "static") {
@@ -867,6 +1163,7 @@ export async function buildTargetWith(target, options, bundler) {
             app,
             routes: manifest.routes,
             outDir,
+            secrets: secretScan,
         });
         if (result.prerendered.length === 0) {
             // A static build that renders nothing is almost always a misconfig (no `prerender = true` / no
@@ -892,9 +1189,11 @@ export async function buildTargetWith(target, options, bundler) {
         target,
         adapterImport: options.adapterImport,
         ...(options.useImport !== undefined ? { useImport: options.useImport } : {}),
+        ...(options.optionImports !== undefined ? { optionImports: options.optionImports } : {}),
         ...(options.backendImport !== undefined ? { backendImport: options.backendImport } : {}),
         ...(options.title !== undefined ? { title: options.title } : {}),
         ...(publicFiles.length > 0 ? { publicFiles } : {}),
+        ...(options.clientIp !== undefined ? { clientIp: options.clientIp } : {}),
     }));
     const { worker } = await bundler.buildServer({
         routesDir,
@@ -902,13 +1201,22 @@ export async function buildTargetWith(target, options, bundler) {
         outDir: `${workDir}/server`,
         clientEntry: client.entry,
         target: targetPlan.serverTarget,
+        ...(client.css !== undefined ? { styles: client.css } : {}),
+        ...(client.routeStyles !== undefined ? { routeStyles: client.routeStyles } : {}),
         ...(options.serverPlugins ? { plugins: options.serverPlugins } : {}),
         define: { "process.env.NODE_ENV": '"production"', ...(options.define ?? {}) },
+        ...(client.cssLoading !== undefined
+            ? { cssLoading: client.cssLoading }
+            : requestedCssLoading !== undefined
+                ? { cssLoading: requestedCssLoading }
+                : {}),
         root: resolvePath(dirname(routesDir)),
+        generatedFiles: [resolvePath(workDir, options.adapterImport)],
+        ...(options.publicEnvPrefix !== undefined ? { publicEnvPrefix: options.publicEnvPrefix } : {}),
     });
     // (3) Assemble the deploy dir for the target.
     const { cpSync } = await import("node:fs");
-    if (targetPlan.target === "cf-pages") {
+    if (targetPlan.target === "cloudflare") {
         cpSync(worker, `${outDir}/${targetPlan.outputFile}`);
         // The app's real patterns, so a directory is only collapsed into a glob once the route table
         // proves nothing can be served beneath it.
@@ -923,7 +1231,12 @@ export async function buildTargetWith(target, options, bundler) {
         }
     }
     else if (targetPlan.target === "vercel") {
+        const fn = dirname(`${outDir}/${targetPlan.outputFile}`);
+        mkdirSync(fn, { recursive: true });
         cpSync(worker, `${outDir}/${targetPlan.outputFile}`);
+        writeFileSync(`${fn}/.vc-config.json`, `${JSON.stringify({ runtime: "edge", entrypoint: "index.js" }, null, 2)}\n`);
+        // Files the build wrote are served first; every other path is the SSR function's.
+        writeFileSync(`${outDir}/config.json`, `${JSON.stringify({ version: 3, routes: [{ handle: "filesystem" }, { src: "/(.*)", dest: "/index" }] }, null, 2)}\n`);
     }
     else {
         cpSync(worker, `${outDir}/${targetPlan.outputFile}`);