@nifrajs/web 3.5.0 → 4.0.2

package/dist/plugins/vite-zone-guard.js

@@ -0,0 +1,208 @@
+/**
+ * The zone guard for Vite's dev server. A dev server serves source by URL, so the guard has to hold
+ * before any byte is sent, whatever the URL form:
+ *
+ * - a middleware ahead of Vite's own answers 403 for any request that maps to a file the browser may
+ *   not have: a direct path, `/@fs/`, `?raw`, `?url`, `?import`, a `.map`, a pre-bundled dependency;
+ * - `resolveId` refuses a browser import of backend code at the importer, so the overlay names the line
+ *   instead of the browser hitting a bare 403;
+ * - `transform` refuses whatever reaches the client environment by another route.
+ *
+ * The SSR environment loads the same files legitimately and is never checked here.
+ */
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { privateEnvDenial } from "../internal/private-env.js";
+import { browserDenial, createZoneClassifier, SERVER_PACKAGES, specifierPackage, } from "../zones.js";
+/** Zones whose code runs in a browser, so may read only public environment variables. */
+const BROWSER_CODE = new Set(["route-frontend", "frontend", "shared"]);
+const stripQuery = (id) => id.replace(/[?#].*$/, "");
+/** Query forms that hand a module's source, or a URL to it, to the browser untransformed. */
+const RAW_QUERY = /(?:^|&)(?:raw|url|inline)(?:[&=]|$)/;
+const isFile = (path) => {
+    try {
+        return statSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+};
+export function viteZoneGuard(options) {
+    const classifier = createZoneClassifier(options);
+    let root = resolve(options.appRoot);
+    const display = (file) => {
+        const rel = relative(classifier.appRoot, file).replaceAll("\\", "/");
+        return rel.startsWith("..") || isAbsolute(rel) ? file : rel;
+    };
+    const isClient = (context, ssr) => ssr !== true && (context.environment?.name ?? "client") === "client";
+    /** What a pre-bundled dependency file was built from, per Vite's `_metadata.json`. */
+    const depsSources = new Map();
+    const depSource = (file) => {
+        const dir = dirname(file);
+        const metadata = join(dir, "_metadata.json");
+        let mtime;
+        try {
+            mtime = statSync(metadata).mtimeMs;
+        }
+        catch {
+            return undefined;
+        }
+        let cached = depsSources.get(dir);
+        if (cached === undefined || cached.mtime !== mtime) {
+            const sources = new Map();
+            try {
+                const parsed = JSON.parse(readFileSync(metadata, "utf8"));
+                for (const dep of Object.values(parsed.optimized ?? {})) {
+                    if (dep.src !== undefined && dep.file !== undefined) {
+                        sources.set(resolve(dir, dep.file), resolve(dir, dep.src));
+                    }
+                }
+            }
+            catch {
+                // An unreadable metadata file maps nothing; the request then classifies as the cache file.
+            }
+            cached = { mtime, sources };
+            depsSources.set(dir, cached);
+        }
+        return cached.sources.get(file);
+    };
+    /** The file a request URL serves, or `undefined` when it names none (an app route, a Vite internal). */
+    const fileForUrl = (url) => {
+        let path;
+        try {
+            path = decodeURIComponent(stripQuery(url));
+        }
+        catch {
+            return undefined;
+        }
+        let file;
+        if (path.startsWith("/@fs/"))
+            file = path.slice("/@fs".length).replace(/^\/([a-zA-Z]:)/, "$1");
+        else if (path.startsWith("/@id/")) {
+            const id = path.slice("/@id/".length);
+            if (!isAbsolute(id))
+                return undefined;
+            file = id;
+        }
+        else if (path.startsWith("/@"))
+            return undefined;
+        else
+            file = join(root, path);
+        for (const candidate of [file, file.replace(/\.map$/, "")]) {
+            // One spelling per file: Vite names it `C:/app/x.ts` on Windows, `join` names it `C:\app\x.ts`.
+            if (isFile(candidate))
+                return resolve(candidate);
+        }
+        return undefined;
+    };
+    const middleware = (req, res, next) => {
+        const url = req.url ?? "/";
+        const file = fileForUrl(url);
+        if (file === undefined)
+            return next();
+        const source = file.replaceAll("\\", "/").includes("/node_modules/.vite/")
+            ? (depSource(file) ?? file)
+            : file;
+        const classification = classifier.classify(source);
+        let reason = browserDenial(classification);
+        const query = url.includes("?") ? url.slice(url.indexOf("?") + 1) : "";
+        if (reason === undefined && classification.zone === "fn" && RAW_QUERY.test(query)) {
+            reason = "a server-function module reaches the browser only as its generated stub";
+        }
+        if (reason === undefined)
+            return next();
+        res.statusCode = 403;
+        res.setHeader("content-type", "text/plain; charset=utf-8");
+        res.setHeader("cache-control", "no-store");
+        res.end(`[nifra] ${display(source)} may not reach the browser: ${reason}\n`);
+    };
+    const refusals = new Map();
+    const refuse = (context, file, reason, importer) => {
+        const message = `[nifra/web] ${display(file)} may not reach the browser${importer === undefined ? "" : ` (imported by ${display(importer)})`}: ${reason}`;
+        refusals.set(resolve(importer ?? file), message);
+        return context.error(new Error(message));
+    };
+    /** A bare specifier's package, classified through its manifest so a workspace link is first-party. */
+    const packageClassification = (name, importer) => {
+        let dir = dirname(importer);
+        for (;;) {
+            const manifest = join(dir, "node_modules", name, "package.json");
+            if (existsSync(manifest))
+                return classifier.classify(manifest);
+            const parent = dirname(dir);
+            if (parent === dir)
+                return { zone: "library", packageName: name };
+            dir = parent;
+        }
+    };
+    return {
+        name: "nifra:zone-guard",
+        enforce: "pre",
+        refusalFor(url) {
+            const file = fileForUrl(url);
+            return file === undefined ? undefined : refusals.get(file);
+        },
+        fileForUrl,
+        // A pre-bundled copy would serve a server package under `.vite/deps/` instead of its own path.
+        config: () => ({ optimizeDeps: { exclude: [...SERVER_PACKAGES] } }),
+        configResolved(config) {
+            root = config.root;
+        },
+        configureServer(server) {
+            // Registered directly (not in a returned post hook), so it runs ahead of Vite's own middlewares.
+            server.middlewares.use(middleware);
+        },
+        async resolveId(source, importer, resolveOptions) {
+            if (importer === undefined || resolveOptions?.scan === true)
+                return null;
+            if (!isClient(this, resolveOptions?.ssr))
+                return null;
+            const importerFile = stripQuery(importer);
+            if (!isAbsolute(importerFile))
+                return null;
+            if (source.startsWith(".")) {
+                const target = resolve(dirname(importerFile), stripQuery(source));
+                if (isFile(target)) {
+                    const reason = browserDenial(classifier.classify(target));
+                    if (reason !== undefined)
+                        refuse(this, target, reason, importerFile);
+                }
+                return null;
+            }
+            const name = specifierPackage(source);
+            if (name !== undefined) {
+                const reason = browserDenial(packageClassification(name, importerFile), source);
+                if (reason !== undefined)
+                    refuse(this, source, reason, importerFile);
+            }
+            // An alias, a tsconfig path or a package export: what the specifier resolves to decides.
+            const resolved = await this.resolve(source, importer, { ...resolveOptions, skipSelf: true });
+            const target = resolved === null || resolved.external ? undefined : stripQuery(resolved.id);
+            if (target !== undefined && isAbsolute(target) && isFile(target)) {
+                const reason = browserDenial(classifier.classify(target), source);
+                if (reason !== undefined)
+                    refuse(this, target, reason, importerFile);
+            }
+            return null;
+        },
+        transform(code, id, transformOptions) {
+            if (!isClient(this, transformOptions?.ssr))
+                return null;
+            const file = stripQuery(id);
+            if (!isAbsolute(file) || !isFile(file))
+                return null;
+            // A fresh transform re-resolves every import, so an earlier refusal is stale until it recurs.
+            refusals.delete(resolve(file));
+            const classification = classifier.classify(file);
+            // A `pre` transform sees the file as written, so the env check reads the source the author wrote.
+            const reason = browserDenial(classification) ??
+                (BROWSER_CODE.has(classification.zone) && id === file
+                    ? privateEnvDenial(file, code, options.publicEnvPrefix ?? "PUBLIC_")
+                    : undefined);
+            if (reason !== undefined)
+                refuse(this, file, reason);
+            return null;
+        },
+    };
+}
+//# sourceMappingURL=vite-zone-guard.js.map

package/dist/plugins/vite-zone-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vite-zone-guard.js","sourceRoot":"","sources":["../../src/plugins/vite-zone-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAE5D,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,EACL,aAAa,EAEb,oBAAoB,EACpB,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAA;AAapB,yFAAyF;AACzF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,CAAC,gBAAgB,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAA;AA4C9E,MAAM,UAAU,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;AACpE,6FAA6F;AAC7F,MAAM,SAAS,GAAG,qCAAqC,CAAA;AAEvD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAW,EAAE;IACvC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAChD,IAAI,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACnC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE;QACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACpE,OAAO,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA;IAC7D,CAAC,CAAA;IACD,MAAM,QAAQ,GAAG,CAAC,OAAsB,EAAE,GAAwB,EAAW,EAAE,CAC7E,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,IAAI,QAAQ,CAAC,KAAK,QAAQ,CAAA;IAEtE,sFAAsF;IACtF,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2D,CAAA;IACtF,MAAM,SAAS,GAAG,CAAC,IAAY,EAAsB,EAAE;QACrD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;QAC5C,IAAI,KAAa,CAAA;QACjB,IAAI,CAAC;YACH,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAA;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;YACzC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAEvD,CAAA;gBACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;oBACxD,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBACpD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;oBAC5D,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,2FAA2F;YAC7F,CAAC;YACD,MAAM,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;YAC3B,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAC9B,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC,CAAA;IAED,wGAAwG;IACxG,MAAM,UAAU,GAAG,CAAC,GAAW,EAAsB,EAAE;QACrD,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,IAAY,CAAA;QAChB,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;aACzF,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAAE,OAAO,SAAS,CAAA;YACrC,IAAI,GAAG,EAAE,CAAA;QACX,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAA;;YAC7C,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC5B,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;YAC3D,gGAAgG;YAChG,IAAI,MAAM,CAAC,SAAS,CAAC;gBAAE,OAAO,OAAO,CAAC,SAAS,CAAC,CAAA;QAClD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;IAED,MAAM,UAAU,GAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;QAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAA;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YACxE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;YAC3B,CAAC,CAAC,IAAI,CAAA;QACR,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAClD,IAAI,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACtE,IAAI,MAAM,KAAK,SAAS,IAAI,cAAc,CAAC,IAAI,KAAK,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClF,MAAM,GAAG,yEAAyE,CAAA;QACpF,CAAC;QACD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAA;QACvC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;QACpB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAA;QAC1D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;QAC1C,GAAG,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,MAAM,CAAC,+BAA+B,MAAM,IAAI,CAAC,CAAA;IAC9E,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC1C,MAAM,MAAM,GAAG,CACb,OAAsB,EACtB,IAAY,EACZ,MAAc,EACd,QAAiB,EACV,EAAE;QACT,MAAM,OAAO,GAAG,eAAe,OAAO,CAAC,IAAI,CAAC,6BAA6B,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,OAAO,CAAC,QAAQ,CAAC,GAAG,KAAK,MAAM,EAAE,CAAA;QACzJ,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;QAChD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;IAC1C,CAAC,CAAA;IAED,sGAAsG;IACtG,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAkB,EAAE;QAC/E,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC3B,SAAS,CAAC;YACR,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;YAChE,IAAI,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;YAC3B,IAAI,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;YACjE,GAAG,GAAG,MAAM,CAAA;QACd,CAAC;IACH,CAAC,CAAA;IAED,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,KAAK;QACd,UAAU,CAAC,GAAG;YACZ,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;YAC5B,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC5D,CAAC;QACD,UAAU;QACV,+FAA+F;QAC/F,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE,EAAE,CAAC;QACnE,cAAc,CAAC,MAAM;YACnB,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QACpB,CAAC;QACD,eAAe,CAAC,MAAM;YACpB,iGAAiG;YACjG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACpC,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc;YAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,cAAc,EAAE,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YACxE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YACrD,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;YACzC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC1C,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;gBACjE,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnB,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;oBACzD,IAAI,MAAM,KAAK,SAAS;wBAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;gBACtE,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,aAAa,CAAC,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAA;gBAC/E,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;YACtE,CAAC;YACD,yFAAyF;YACzF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;YAC5F,MAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YAC3F,IAAI,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjE,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;gBACjE,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;YACtE,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,gBAAgB;YAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YACvD,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;YAC3B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAA;YACnD,8FAA8F;YAC9F,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;YAC9B,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YAChD,kGAAkG;YAClG,MAAM,MAAM,GACV,aAAa,CAAC,cAAc,CAAC;gBAC7B,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI;oBACnD,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,eAAe,IAAI,SAAS,CAAC;oBACpE,CAAC,CAAC,SAAS,CAAC,CAAA;YAChB,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;YACpD,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/plugins/zone-guard.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The zone guard for Bun's bundler: every file the browser bundle loads is classified, and one that may
+ * not reach a browser stops the build (or the dev request) before its code is bundled.
+ *
+ * The client build runs it in `record` mode and reports every refusal together with its import chain,
+ * read from the finished graph; the dev server runs it in `throw` mode, where there is no finished graph
+ * and the refusal must stop the response.
+ */
+import type { BunPlugin } from "bun";
+import { type ZoneClassifier } from "../zones.js";
+export interface ZoneGuardOptions {
+    /** The app root: the directory holding `routes/`, `frontend/`, `backend/` and `shared/`. */
+    readonly appRoot: string;
+    /** The routes directory (default `<appRoot>/routes`). */
+    readonly routesDir?: string;
+    /** The build's own generated entry modules. */
+    readonly generatedFiles?: readonly string[];
+    /** Collect refusals instead of throwing; the caller reports them with chains after the build. */
+    readonly onDenied?: (file: string, reason: string) => void;
+    /** Share a classifier with post-build verification. */
+    readonly classifier?: ZoneClassifier;
+    /** The public-env prefix browser code may read (default `"PUBLIC_"`). Checked here only in throw
+     * mode; a build checks the finished graph instead. */
+    readonly publicEnvPrefix?: string;
+}
+export declare function zoneGuardPlugin(options: ZoneGuardOptions): BunPlugin;
+//# sourceMappingURL=zone-guard.d.ts.map

package/dist/plugins/zone-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zone-guard.d.ts","sourceRoot":"","sources":["../../src/plugins/zone-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,KAAK,CAAA;AAEpC,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,aAAa,CAAA;AAuBpB,MAAM,WAAW,gBAAgB;IAC/B,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;IAC1D,uDAAuD;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAA;IACpC;0DACsD;IACtD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAClC;AAKD,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CA0DpE"}

package/dist/plugins/zone-guard.js

@@ -0,0 +1,80 @@
+/**
+ * The zone guard for Bun's bundler: every file the browser bundle loads is classified, and one that may
+ * not reach a browser stops the build (or the dev request) before its code is bundled.
+ *
+ * The client build runs it in `record` mode and reports every refusal together with its import chain,
+ * read from the finished graph; the dev server runs it in `throw` mode, where there is no finished graph
+ * and the refusal must stop the response.
+ */
+import { statSync } from "node:fs";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { privateEnvDenial } from "../internal/private-env.js";
+import { BACKEND_ONLY_MARKER, browserDenial, createZoneClassifier, } from "../zones.js";
+const SOURCE_EXTENSIONS = "[cm]?[jt]sx?|svelte|vue|mdx|astro|css|scss|sass|less|json|jsonc|toml|ya?ml|txt|md";
+/** Source files Bun loads through a loader that tolerates a declining `onLoad`. Every other file
+ * (images, fonts, wasm, and a `.pem` or `.sql` imported `with { type: "text" }`) goes through
+ * `onResolve`: a file-loader asset panics Bun 1.4 on a declining `onLoad`. */
+const SOURCE_FILE = new RegExp(`\\.(?:${SOURCE_EXTENSIONS})$`);
+const ZONE_SUFFIXES = "frontend|backend|shared|fn";
+/**
+ * A relative or absolute import whose last segment has an extension, other than a source file. A zone
+ * suffix is no extension: `"./calendar.shared"` imports `calendar.shared.ts`.
+ * Source files are excluded by the FILTER, not declined by the handler: on Bun's dev server a filter
+ * match alone changes how the import resolves, even when the handler declines (see
+ * `internal/dev-reserved.ts`), and a source file is the onLoad hook's to judge anyway.
+ */
+const NON_SOURCE_PATH = new RegExp(`^(?:\\.|\\/|[A-Za-z]:[\\\\/])(?![^?#]*\\.(?:${SOURCE_EXTENSIONS}|${ZONE_SUFFIXES})(?:[?#]|$)).*\\.[^./\\\\?#]+(?:[?#].*)?$`);
+const isFile = (path) => statSync(path, { throwIfNoEntry: false })?.isFile() ?? false;
+/** Zones whose code runs in a browser, so may read only public environment variables. */
+const BROWSER_CODE = new Set(["route-frontend", "frontend", "shared"]);
+export function zoneGuardPlugin(options) {
+    const classifier = options.classifier ?? createZoneClassifier(options);
+    const display = (file) => {
+        const rel = relative(classifier.appRoot, file).replaceAll("\\", "/");
+        return rel.startsWith("..") || isAbsolute(rel) ? file : rel;
+    };
+    const refuse = (file, reason, importer) => {
+        if (options.onDenied !== undefined) {
+            options.onDenied(file, reason);
+            return undefined;
+        }
+        const via = importer === undefined || importer === "" ? "" : ` (imported by ${display(importer)})`;
+        throw new Error(`[nifra/web] ${display(file)} may not reach the browser${via}: ${reason}`);
+    };
+    return {
+        name: "nifra-zone-guard",
+        setup(build) {
+            build.onLoad({ filter: SOURCE_FILE }, async (args) => {
+                if (args.namespace !== "file")
+                    return undefined;
+                const classification = classifier.classify(args.path);
+                let reason = browserDenial(classification);
+                if (reason === undefined &&
+                    options.onDenied === undefined &&
+                    BROWSER_CODE.has(classification.zone)) {
+                    const source = await Bun.file(args.path).text();
+                    reason = privateEnvDenial(args.path, source, options.publicEnvPrefix ?? "PUBLIC_");
+                }
+                return reason === undefined ? undefined : refuse(args.path, reason);
+            });
+            build.onResolve({ filter: NON_SOURCE_PATH }, (args) => {
+                // An entry point (a dev server's HTML page) is the build's own choice, not an import.
+                if (args.importer === "")
+                    return undefined;
+                const file = resolve(dirname(args.importer), args.path.replace(/[?#].*$/, ""));
+                // No such file means an extensionless import of a dotted source name (`./date.utils`): Bun resolves
+                // it to the source file, which onLoad judges. Judging the bare path would refuse a file never loaded.
+                if (!isFile(file))
+                    return undefined;
+                const reason = browserDenial(classifier.classify(file));
+                return reason === undefined ? undefined : refuse(file, reason, args.importer);
+            });
+            // In record mode the finished graph reports these, with chains; only the dev server needs them here.
+            if (options.onDenied !== undefined)
+                return;
+            build.onResolve({ filter: /^(?:node|bun):/ }, (args) => refuse(args.path, "Node and Bun built-ins run on the server only; use them in a route's backend half or under backend/", args.importer));
+            build.onResolve({ filter: new RegExp(`^${BACKEND_ONLY_MARKER.replaceAll("/", "\\/")}$`) }, (args) => refuse(args.importer, `it imports "${BACKEND_ONLY_MARKER}", which marks it backend-only`));
+        },
+    };
+}
+//# sourceMappingURL=zone-guard.js.map

package/dist/plugins/zone-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zone-guard.js","sourceRoot":"","sources":["../../src/plugins/zone-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAElE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,oBAAoB,GAErB,MAAM,aAAa,CAAA;AAEpB,MAAM,iBAAiB,GACrB,mFAAmF,CAAA;AACrF;;8EAE8E;AAC9E,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,SAAS,iBAAiB,IAAI,CAAC,CAAA;AAC9D,MAAM,aAAa,GAAG,4BAA4B,CAAA;AAClD;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,+CAA+C,iBAAiB,IAAI,aAAa,2CAA2C,CAC7H,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAW,EAAE,CACvC,QAAQ,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,KAAK,CAAA;AAkB9D,yFAAyF;AACzF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,CAAC,gBAAgB,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAA;AAE9E,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAA;IACtE,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE;QACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACpE,OAAO,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA;IAC7D,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,QAAiB,EAAa,EAAE;QAC5E,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAC9B,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,GAAG,GACP,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAA;QACxF,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,CAAC,IAAI,CAAC,6BAA6B,GAAG,KAAK,MAAM,EAAE,CAAC,CAAA;IAC5F,CAAC,CAAA;IACD,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,KAAK,CAAC,KAAK;YACT,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACnD,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM;oBAAE,OAAO,SAAS,CAAA;gBAC/C,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACrD,IAAI,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,CAAA;gBAC1C,IACE,MAAM,KAAK,SAAS;oBACpB,OAAO,CAAC,QAAQ,KAAK,SAAS;oBAC9B,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,EACrC,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;oBAC/C,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,eAAe,IAAI,SAAS,CAAC,CAAA;gBACpF,CAAC;gBACD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YACrE,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;gBACpD,sFAAsF;gBACtF,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE;oBAAE,OAAO,SAAS,CAAA;gBAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAA;gBAC9E,oGAAoG;gBACpG,sGAAsG;gBACtG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBAAE,OAAO,SAAS,CAAA;gBACnC,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;gBACvD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC/E,CAAC,CAAC,CAAA;YACF,qGAAqG;YACrG,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;gBAAE,OAAM;YAC1C,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CACrD,MAAM,CACJ,IAAI,CAAC,IAAI,EACT,qGAAqG,EACrG,IAAI,CAAC,QAAQ,CACd,CACF,CAAA;YACD,KAAK,CAAC,SAAS,CACb,EAAE,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,mBAAmB,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EACzE,CAAC,IAAI,EAAE,EAAE,CACP,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,mBAAmB,gCAAgC,CAAC,CAC5F,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/prerender.d.ts

@@ -1,3 +1,4 @@
+import { type SecretExemption } from "./internal/secret-scan.js";
 import { type RouteEntry } from "./manifest.js";
 /** Minimal app surface the driver needs - just a fetch handler (a built `createWebApp`). */
 export interface PrerenderApp {
@@ -15,6 +16,15 @@ export interface PrerenderOptions {
     /** Origin for the synthetic request URL. Default `http://localhost`. Only the path is meaningful;
      * loaders see this as `request.url`, so set it if a loader builds absolute URLs from the origin. */
     readonly origin?: string;
+    /** The secret scan every page and `_data.json` passes before it is written: what looks like a
+     * credential, or the value of a non-public build environment variable, fails the prerender. */
+    readonly secrets?: {
+        /** Default: the build environment (`Bun.env`, else `process.env`). */
+        readonly env?: Readonly<Record<string, string | undefined>>;
+        /** Default `"PUBLIC_"`. */
+        readonly publicEnvPrefix?: string;
+        readonly exemptions?: readonly SecretExemption[];
+    };
 }
 export interface PrerenderEntry {
     /** The route pattern that was prerendered (e.g. `/`, `/about`). */

package/dist/prerender.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prerender.d.ts","sourceRoot":"","sources":["../src/prerender.ts"],"names":[],"mappings":"AAYA,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AAGjE,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClD;AAED,MAAM,WAAW,gBAAgB;IAC/B;4EACwE;IACxE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAA;IAC1B;oGACgG;IAChG,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAA;IACtC,kGAAkG;IAClG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;wGACoG;IACpG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;mGAC+F;IAC/F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC/E;8FAC0F;IAC1F,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAA;CAC5D;AAUD,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED;+FAC+F;AAC/F,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnD;AAOD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA8FzF;AAED;oFACoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,4BAA4B;IAC3C;uGACmG;IACnG,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,oGAAoG;IACpG,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,4BAA4B,GACpC,qBAAqB,CAOvB"}
+{"version":3,"file":"prerender.d.ts","sourceRoot":"","sources":["../src/prerender.ts"],"names":[],"mappings":"AAYA,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAA;AACnG,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AAGjE,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClD;AAED,MAAM,WAAW,gBAAgB;IAC/B;4EACwE;IACxE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAA;IAC1B;oGACgG;IAChG,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAA;IACtC,kGAAkG;IAClG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;wGACoG;IACpG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB;mGAC+F;IAC/F,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,sEAAsE;QACtE,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;QAC3D,2BAA2B;QAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;QACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;KACjD,CAAA;CACF;AAED,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;mGAC+F;IAC/F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC/E;8FAC0F;IAC1F,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAA;CAC5D;AAUD,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGnD;AAOD;+FAC+F;AAC/F,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnD;AAOD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA6HzF;AAED;oFACoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,4BAA4B;IAC3C;uGACmG;IACnG,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,oGAAoG;IACpG,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,4BAA4B,GACpC,qBAAqB,CAOvB"}

package/dist/prerender.js

@@ -10,8 +10,9 @@
  */
 import { mkdirSync, writeFileSync } from "node:fs";
 import { dirname, resolve, sep } from "node:path";
+import { assertNoSecrets, buildEnvironment } from "./internal/secret-scan.js";
 import { fillRoutePattern } from "./manifest.js";
-import { DATA_HEADER } from "./router.js";
+import { DATA_HEADER, PRERENDERED_GLOBAL, PRERENDERED_LIST_PATH } from "./router.js";
 /** Strip trailing `/` runs by index scan - an unanchored-start `/\/+$/` replace backtracks
  * quadratically on a long slash run, and route patterns are input here. */
 function trimTrailingSlashes(path) {
@@ -25,6 +26,8 @@ export function htmlFileFor(pattern) {
     const trimmed = trimTrailingSlashes(pattern.replace(/^\/+/, ""));
     return trimmed === "" ? "index.html" : `${trimmed}/index.html`;
 }
+// The handover of a page whose prerendered set is served as a list rather than inlined.
+const PRERENDERED_LIST_URL = new RegExp(`"${PRERENDERED_GLOBAL}":"(${PRERENDERED_LIST_PATH.replaceAll(".", "\\.")}\\?v=[0-9a-f]+)"`);
 /** The static loader-data file next to a route's `index.html`: `/` → `_data.json`, `/a/b` →
  * `a/b/_data.json`. The client fetches it on soft-nav into a prerendered route (no worker). */
 export function dataFileFor(pattern) {
@@ -47,8 +50,16 @@ export async function prerenderRoutes(options) {
     const skipped = [];
     const fallbacks = {};
     const outRoot = resolve(options.outDir);
+    let listUrl;
+    const secretScan = {
+        env: options.secrets?.env ?? buildEnvironment(),
+        publicEnvPrefix: options.secrets?.publicEnvPrefix ?? "PUBLIC_",
+        ...(options.secrets?.exemptions ? { exemptions: options.secrets.exemptions } : {}),
+    };
+    const assertClean = (name, text) => assertNoSecrets({ ...secretScan, artifacts: [{ name, text }] });
     // Render one concrete path → drain the streamed document to bytes → write its index.html. Shared by
-    // static (one path) and dynamic (one path per getStaticPaths entry) routes; never throws.
+    // static (one path) and dynamic (one path per getStaticPaths entry) routes. A failed render is a skip;
+    // a credential in the output fails the whole prerender.
     const renderPath = async (path) => {
         const res = await options.app.fetch(new Request(`${origin}${path}`));
         if (!res.ok) {
@@ -57,12 +68,14 @@ export async function prerenderRoutes(options) {
             return;
         }
         const html = await res.text();
+        listUrl ??= PRERENDERED_LIST_URL.exec(html)?.[1];
         const file = htmlFileFor(path);
         const abs = outputPath(outRoot, file);
         if (abs === undefined) {
             skipped.push({ path, reason: "unsafe output path" });
             return;
         }
+        assertClean(file, html);
         mkdirSync(dirname(abs), { recursive: true });
         writeFileSync(abs, html);
         // Also emit the loader data as a static `_data.json` next to it, so a client soft-nav into this
@@ -80,7 +93,9 @@ export async function prerenderRoutes(options) {
                 dataFile = undefined;
             }
             else {
-                writeFileSync(dataAbs, await dataRes.text());
+                const data = await dataRes.text();
+                assertClean(dataFile, data);
+                writeFileSync(dataAbs, data);
             }
         }
         else {
@@ -125,6 +140,23 @@ export async function prerenderRoutes(options) {
         }
         await renderPath(route.pattern);
     }
+    // A set too large to inline is handed over as the URL of a list the app serves; the static output
+    // has to carry the file those pages fetch.
+    if (listUrl !== undefined) {
+        const listRes = await options.app.fetch(new Request(`${origin}${listUrl}`));
+        const listFile = PRERENDERED_LIST_PATH.slice(1);
+        const listAbs = outputPath(outRoot, listFile);
+        if (listRes.ok && listAbs !== undefined) {
+            const text = await listRes.text();
+            assertClean(listFile, text);
+            mkdirSync(dirname(listAbs), { recursive: true });
+            writeFileSync(listAbs, text);
+        }
+        else {
+            await listRes.body?.cancel();
+            skipped.push({ path: PRERENDERED_LIST_PATH, reason: `list returned HTTP ${listRes.status}` });
+        }
+    }
     return { prerendered, skipped, fallbacks };
 }
 /**

package/dist/prerender.js.map

@@ -1 +1 @@
-{"version":3,"file":"prerender.js","sourceRoot":"","sources":["../src/prerender.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAmB,MAAM,eAAe,CAAA;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAyCzC;2EAC2E;AAC3E,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAA;IACrB,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,GAAG,EAAE,CAAA;IAClE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AAC3B,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;IAChE,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,aAAa,CAAA;AAChE,CAAC;AAED;+FAC+F;AAC/F,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,YAAY,CAAC,CAAA;AACnE,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,IAAY,EAAsB,EAAE;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC/B,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1E,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAyB;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAA;IACnD,MAAM,WAAW,GAAqB,EAAE,CAAA;IACxC,MAAM,OAAO,GAAuC,EAAE,CAAA;IACtD,MAAM,SAAS,GAAkC,EAAE,CAAA;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAEvC,oGAAoG;IACpG,0FAA0F;IAC1F,MAAM,UAAU,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QACvD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC,CAAA;QACpE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,6FAA6F;YAC7F,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YACpE,OAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACrC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAA;YACpD,OAAM;QACR,CAAC;QACD,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5C,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAExB,gGAAgG;QAChG,gGAAgG;QAChG,8FAA8F;QAC9F,8CAA8C;QAC9C,IAAI,QAA4B,CAAA;QAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CACrC,IAAI,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CACrE,CAAA;QACD,IACE,OAAO,CAAC,EAAE;YACV,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAC7E,CAAC;YACD,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YAC5B,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC7C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;gBAC5B,QAAQ,GAAG,SAAS,CAAA;YACtB,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;YAC9C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA,CAAC,uDAAuD;QACtF,CAAC;QAED,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IACzF,CAAC,CAAA;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC,CAAA;YACzF,SAAQ;QACV,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAE9B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,iEAAiE;YACjE,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC,CAAA;gBACrF,SAAQ;YACV,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAA;YAC9D,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAA;YACnC,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBAC/B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBACjE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACvB,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,KAAK,CAAC,OAAO;wBACnB,MAAM,EAAE,oCAAoC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBACjE,CAAC,CAAA;oBACF,SAAQ;gBACV,CAAC;gBACD,MAAM,UAAU,CAAC,IAAI,CAAC,CAAA;YACxB,CAAC;YACD,SAAQ;QACV,CAAC;QAED,8BAA8B;QAC9B,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,KAAK,CAAC,OAAO;gBACnB,MAAM,EAAE,gDAAgD;aACzD,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACjC,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;AAC5C,CAAC;AAkBD;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAqC;IAErC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IAC3D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,2BAA2B;QAC9C,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA,CAAC,WAAW;IACpG,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAA;AACjD,CAAC"}
+{"version":3,"file":"prerender.js","sourceRoot":"","sources":["../src/prerender.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAwB,MAAM,2BAA2B,CAAA;AACnG,OAAO,EAAE,gBAAgB,EAAmB,MAAM,eAAe,CAAA;AACjE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAkDpF;2EAC2E;AAC3E,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAA;IACrB,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,GAAG,EAAE,CAAA;IAClE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AAC3B,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;IAChE,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,aAAa,CAAA;AAChE,CAAC;AAED,wFAAwF;AACxF,MAAM,oBAAoB,GAAG,IAAI,MAAM,CACrC,IAAI,kBAAkB,OAAO,qBAAqB,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,kBAAkB,CAC5F,CAAA;AAED;+FAC+F;AAC/F,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,YAAY,CAAC,CAAA;AACnE,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,IAAY,EAAsB,EAAE;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC/B,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1E,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAyB;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAA;IACnD,MAAM,WAAW,GAAqB,EAAE,CAAA;IACxC,MAAM,OAAO,GAAuC,EAAE,CAAA;IACtD,MAAM,SAAS,GAAkC,EAAE,CAAA;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC,IAAI,OAA2B,CAAA;IAE/B,MAAM,UAAU,GAAG;QACjB,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,gBAAgB,EAAE;QAC/C,eAAe,EAAE,OAAO,CAAC,OAAO,EAAE,eAAe,IAAI,SAAS;QAC9D,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAA;IACD,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,IAAY,EAAQ,EAAE,CACvD,eAAe,CAAC,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;IAEjE,oGAAoG;IACpG,uGAAuG;IACvG,wDAAwD;IACxD,MAAM,UAAU,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QACvD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC,CAAA;QACpE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,6FAA6F;YAC7F,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YACpE,OAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,OAAO,KAAK,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAChD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACrC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAA;YACpD,OAAM;QACR,CAAC;QACD,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACvB,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5C,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAExB,gGAAgG;QAChG,gGAAgG;QAChG,8FAA8F;QAC9F,8CAA8C;QAC9C,IAAI,QAA4B,CAAA;QAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CACrC,IAAI,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CACrE,CAAA;QACD,IACE,OAAO,CAAC,EAAE;YACV,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAC7E,CAAC;YACD,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YAC5B,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC7C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;gBAC5B,QAAQ,GAAG,SAAS,CAAA;YACtB,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;gBACjC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;gBAC3B,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA,CAAC,uDAAuD;QACtF,CAAC;QAED,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IACzF,CAAC,CAAA;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC,CAAA;YACzF,SAAQ;QACV,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAE9B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,iEAAiE;YACjE,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC,CAAA;gBACrF,SAAQ;YACV,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAA;YAC9D,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAA;YACnC,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBAC/B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBACjE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACvB,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,KAAK,CAAC,OAAO;wBACnB,MAAM,EAAE,oCAAoC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBACjE,CAAC,CAAA;oBACF,SAAQ;gBACV,CAAC;gBACD,MAAM,UAAU,CAAC,IAAI,CAAC,CAAA;YACxB,CAAC;YACD,SAAQ;QACV,CAAC;QAED,8BAA8B;QAC9B,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,KAAK,CAAC,OAAO;gBACnB,MAAM,EAAE,gDAAgD;aACzD,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACjC,CAAC;IAED,kGAAkG;IAClG,2CAA2C;IAC3C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC,CAAC,CAAA;QAC3E,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC7C,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;YACjC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YAC3B,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAChD,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAC9B,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;YAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,sBAAsB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAC/F,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;AAC5C,CAAC;AAkBD;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAqC;IAErC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IAC3D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,2BAA2B;QAC9C,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA,CAAC,WAAW;IACpG,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAA;AACjD,CAAC"}

package/dist/public-dir.d.ts

@@ -15,6 +15,15 @@ export interface ServePublicDirOptions {
     /** Optional encoded URL-path allowlist. When present, route misses avoid a filesystem probe. */
     readonly files?: ReadonlySet<string>;
 }
+export declare const IMMUTABLE = "public, max-age=31536000, immutable";
+export declare const ONE_DAY = "public, max-age=86400";
+/**
+ * Media types by extension. A table rather than `Bun.file(path).type`: this handler also runs on the
+ * Node and Deno adapters, where `Bun` does not exist and every hit would throw. Unknown extensions
+ * (and extensionless files such as ACME tokens) are served as `application/octet-stream`, which
+ * together with `nosniff` keeps the browser from guessing a more dangerous type.
+ */
+export declare const CONTENT_TYPES: Readonly<Record<string, string>>;
 /**
  * Resolve a URL pathname to an absolute path **confined** to `root`, or `undefined` if it escapes.
  *

package/dist/public-dir.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-dir.d.ts","sourceRoot":"","sources":["../src/public-dir.ts"],"names":[],"mappings":"AAqBA;4FAC4F;AAC5F,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,oGAAoG;IACpG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAA;IAC/B,gGAAgG;IAChG,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACrC;AAkCD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAapF;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,qBAAqB,GAC7B,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAqGrD"}
+{"version":3,"file":"public-dir.d.ts","sourceRoot":"","sources":["../src/public-dir.ts"],"names":[],"mappings":"AAqBA;4FAC4F;AAC5F,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,oGAAoG;IACpG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAA;IAC/B,gGAAgG;IAChG,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACrC;AAED,eAAO,MAAM,SAAS,wCAAwC,CAAA;AAC9D,eAAO,MAAM,OAAO,0BAA0B,CAAA;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAuC1D,CAAA;AA2CD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAapF;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,qBAAqB,GAC7B,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAuGrD"}

package/dist/public-dir.js

@@ -14,12 +14,70 @@
  */
 import { constants as FS } from "node:fs";
 import { open, realpath } from "node:fs/promises";
-import { normalize, resolve, sep } from "node:path";
+import { extname, normalize, resolve, sep } from "node:path";
 import { Readable } from "node:stream";
 import { parseByteRange } from "@nifrajs/core/range";
 import { pathnameOf } from "@nifrajs/core/server";
-const IMMUTABLE = "public, max-age=31536000, immutable";
-const ONE_DAY = "public, max-age=86400";
+export const IMMUTABLE = "public, max-age=31536000, immutable";
+export const ONE_DAY = "public, max-age=86400";
+/**
+ * Media types by extension. A table rather than `Bun.file(path).type`: this handler also runs on the
+ * Node and Deno adapters, where `Bun` does not exist and every hit would throw. Unknown extensions
+ * (and extensionless files such as ACME tokens) are served as `application/octet-stream`, which
+ * together with `nosniff` keeps the browser from guessing a more dangerous type.
+ */
+export const CONTENT_TYPES = {
+    ".html": "text/html; charset=utf-8",
+    ".htm": "text/html; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
+    ".cjs": "text/javascript; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".map": "application/json; charset=utf-8",
+    ".webmanifest": "application/manifest+json",
+    ".txt": "text/plain; charset=utf-8",
+    ".md": "text/markdown; charset=utf-8",
+    ".csv": "text/csv; charset=utf-8",
+    ".xml": "application/xml",
+    ".rss": "application/rss+xml",
+    ".atom": "application/atom+xml",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".avif": "image/avif",
+    ".ico": "image/x-icon",
+    ".bmp": "image/bmp",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+    ".ttf": "font/ttf",
+    ".otf": "font/otf",
+    ".wasm": "application/wasm",
+    ".pdf": "application/pdf",
+    ".zip": "application/zip",
+    ".mp4": "video/mp4",
+    ".webm": "video/webm",
+    ".ogg": "audio/ogg",
+    ".mp3": "audio/mpeg",
+    ".wav": "audio/wav",
+    ".m4a": "audio/mp4",
+    ".vtt": "text/vtt; charset=utf-8",
+};
+/**
+ * Whether a confined path crosses a dot-segment other than `.well-known`. The build copies `public/`
+ * with dotfiles included, so an editor or VCS artifact (`.env`, `.git/`, `.DS_Store`) dropped there
+ * would otherwise be downloadable. Checked on the resolved path, so `%2e` encodings are covered.
+ */
+function isHiddenPath(root, abs) {
+    for (const segment of abs.slice(root.length + 1).split(sep)) {
+        if (segment.startsWith(".") && segment !== ".well-known")
+            return true;
+    }
+    return false;
+}
 /** HTTP dates carry second precision; comparing raw milliseconds makes every file look stale. */
 function seconds(time) {
     return Math.floor(time / 1000);
@@ -101,7 +159,7 @@ export function servePublicDir(options) {
         if (options.files !== undefined && !options.files.has(pathname))
             return undefined;
         const abs = resolvePublicPath(root, pathname);
-        if (abs === undefined)
+        if (abs === undefined || isHiddenPath(root, abs))
             return undefined;
         const [resolvedRoot, resolvedFile] = await Promise.all([
             rootReal,
@@ -123,17 +181,17 @@ export function servePublicDir(options) {
             if (!stat.isFile())
                 return undefined;
             const size = stat.size;
-            const file = Bun.file(resolvedFile);
             const headers = new Headers({
                 "cache-control": pathname.startsWith(hashedPrefix) ? hashed : assets,
                 // Advertised unconditionally: a client that never sees `accept-ranges` will not attempt a seek,
                 // so a video or audio file under `public/` is scrubbable only once this header is present.
                 "accept-ranges": "bytes",
+                // Never let a client sniff a served file into a more dangerous type (an upload-like `.txt`
+                // rendered as HTML, say). The declared type below is authoritative.
+                "x-content-type-options": "nosniff",
+                // Set explicitly rather than inferred from the body, so HEAD (a null body) carries it too.
+                "content-type": CONTENT_TYPES[extname(resolvedFile).toLowerCase()] ?? "application/octet-stream",
             });
-            // `new Response(file)` used to infer the media type, which meant HEAD - built from a null body -
-            // silently lost it. Setting it here is what makes the two methods agree.
-            if (file.type !== "")
-                headers.set("content-type", file.type);
             const lastModified = Number.isFinite(stat.mtimeMs) && stat.mtimeMs > 0 ? stat.mtimeMs : undefined;
             if (lastModified !== undefined) {
                 headers.set("last-modified", new Date(lastModified).toUTCString());