@nifrajs/web 4.0.0 → 5.0.0

package/src/llms-txt.ts

@@ -3,9 +3,12 @@ import {
   reflectedRoutesFromEvidence,
   snapshotProjectEvidence,
 } from "@nifrajs/core/evidence"
+import { type BackendEvidenceProvider, NIFRA_BACKEND_EVIDENCE } from "@nifrajs/core/mount"
 import { compileRoutePattern, type RoutePatternSegment } from "@nifrajs/core/pattern"
 
 const IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/
+const RESERVED_CLIENT_SEGMENT = /^(?:get|post|put|patch|delete|head|options)$/i
+const RESERVED_EXACT_SEGMENTS = new Set(["subscribe", "ws", "index", "then"])
 
 /** The subset of JSON Schema fields {@link tsTypeOf} reads to render a TypeScript type string. */
 interface JsonSchemaNode {
@@ -93,7 +96,13 @@ function clientCall(method: string, path: string, schema: unknown): string {
   if (segs.length === 0) chain += ".index"
   else
     for (const seg of segs) {
-      chain += paramCall(seg) ?? (IDENT.test(seg) ? `.${seg}` : `[${JSON.stringify(seg)}]`)
+      chain +=
+        paramCall(seg) ??
+        (RESERVED_CLIENT_SEGMENT.test(seg) || RESERVED_EXACT_SEGMENTS.has(seg)
+          ? `(${JSON.stringify(seg)})`
+          : IDENT.test(seg)
+            ? `.${seg}`
+            : `[${JSON.stringify(seg)}]`)
     }
   const isBodyVerb = verb === "post" || verb === "put" || verb === "patch"
   let call: string
@@ -101,12 +110,27 @@ function clientCall(method: string, path: string, schema: unknown): string {
     const bodyArg = s?.body ? "body" : s?.query ? "undefined" : ""
     const opts = s?.query ? (bodyArg ? ", { query }" : "{ query }") : ""
     call = `.${verb}(${bodyArg}${opts})`
+  } else if (verb === "delete") {
+    const fields = [...(s?.body ? ["body"] : []), ...(s?.query ? ["query"] : [])]
+    call = `.delete(${fields.length === 0 ? "" : `{ ${fields.join(", ")} }`})`
   } else {
     call = `.${verb}(${s?.query ? "{ query }" : ""})`
   }
   return `await ${chain}${call}`
 }
 
+async function backendEvidence(backend: unknown): Promise<ProjectEvidenceSnapshot> {
+  if (backend !== null && (typeof backend === "object" || typeof backend === "function")) {
+    // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: Object/function check allows reading the optional symbol-keyed provider without touching the client path proxy.
+    const provider = (backend as { readonly [NIFRA_BACKEND_EVIDENCE]?: unknown })[
+      NIFRA_BACKEND_EVIDENCE
+    ]
+    // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: A callable at NIFRA_BACKEND_EVIDENCE implements the framework's trusted evidence-provider seam.
+    if (typeof provider === "function") return (provider as BackendEvidenceProvider).call(backend)
+  }
+  return snapshotProjectEvidence(backend)
+}
+
 /** Read the project's `AGENTS.md`, or `""` if there isn't one (or we're on an edge runtime with no
  * filesystem). Never throws - a missing file just means no guidelines section. */
 async function readAgentsMd(): Promise<string> {
@@ -134,6 +158,8 @@ export async function generateLlmsTxt(
     readonly includeLocalGuidelines?: boolean
     /** Reuse the project's canonical route-evidence pass when one is already available. */
     readonly evidence?: ProjectEvidenceSnapshot
+    /** The mount prefix a visitor's URL carries but the backend's own routes do not (`apiStrip`). */
+    readonly apiPathPrefix?: string
   } = {},
 ): Promise<string> {
   let output = ""
@@ -160,14 +186,17 @@ export async function generateLlmsTxt(
   // 3. API Routes
   output += `## API Routes\n\n`
   const apiRoutes = reflectedRoutesFromEvidence(
-    options.evidence ?? snapshotProjectEvidence(backend),
+    options.evidence ?? (await backendEvidence(backend)),
   )
 
   if (apiRoutes.length === 0) {
     output += `No API routes registered.\n`
   } else {
+    const prefix = options.apiPathPrefix ?? ""
     for (const route of apiRoutes) {
-      output += `- **${route.method}** \`${route.path}\`\n`
+      // The stripped backend's root is the bare prefix, as the mount matches it.
+      const path = prefix !== "" && route.path === "/" ? prefix : prefix + route.path
+      output += `- **${route.method}** \`${path}\`\n`
       if (full) {
         output += `  - Client Call: \`${clientCall(route.method, route.path, route.schema)}\`\n`
         const s = route.schema

package/src/manifest.ts

@@ -5,7 +5,12 @@
  * portable (no fs, no DOM) and fully unit-testable. Edge deploys pre-build the manifest.
  */
 import { routePatternOverlap } from "@nifrajs/core"
-import { paramConstraint } from "@nifrajs/core/pattern"
+import {
+  type CompiledRoutePattern,
+  compareRoutePatternSpecificity,
+  compileRoutePattern,
+  paramConstraint,
+} from "@nifrajs/core/pattern"
 import type { CookieOptions, ResponseResult, StandardSchemaV1 } from "@nifrajs/core/server"
 import type { BoundaryDescriptor, BoundaryRegistration } from "./boundary.ts"
 import { guardChannel, outputGuard } from "./internal/output-guard.ts"
@@ -266,13 +271,24 @@ export interface Meta {
 }
 
 /**
- * Args for a route's `meta` function: the loader's `data` + the route `params` + the request `origin`.
- * `meta()` runs in BOTH SSR and client navigation, so it has **no `request`/`process.env`/server access** -
- * `origin` is the only server-resolved fact it gets (so you needn't thread `siteUrl` through loader data
- * for absolute `og:url`/`canonical`/`og:image` URLs). See {@link origin}.
+ * Args for a route's or layout's `meta` function: its own loader's `data` + the page's `pageData` + the
+ * route `params` + the request `origin`. `meta()` runs in BOTH SSR and client navigation, so it has
+ * **no `request`/`process.env`/server access** - `origin` is the only server-resolved fact it gets (so you
+ * needn't thread `siteUrl` through loader data for absolute `og:url`/`canonical`/`og:image` URLs). See
+ * {@link origin}.
  */
 export interface MetaArgs<Data = unknown> {
+  /**
+   * The loader data of the module that exports this `meta`: the page's for a page, the layout's own for a
+   * layout (`null` when the layout has no loader), the same value its component receives. A layout that
+   * loads the locale sets `lang` from here, so a soft navigation keeps it.
+   */
   readonly data: Data
+  /**
+   * The page's loader data, for a layout's `meta` that builds on the page (a title template). In a page's
+   * own `meta` it is the same value as {@link data}. Always set by the framework.
+   */
+  readonly pageData?: unknown
   readonly params: Record<string, string>
   /** The resolved document CSP nonce, when this render uses per-request nonce protection. */
   readonly nonce?: string
@@ -318,6 +334,8 @@ export type GetStaticPaths = () => StaticPaths | Promise<StaticPaths>
 export interface RouteModule {
   readonly default: unknown
   readonly loader?: Loader
+  /** Layout loader that must run before actions and is not retained across the action's render. */
+  readonly gate?: boolean
   readonly action?: Action
   /**
    * Backend half only: the schema of what {@link loader} sends to the browser. Required whenever the
@@ -379,6 +397,14 @@ export interface RouteModule {
    * the module on the server and in the browser, so it must be the same value on both.
    */
   readonly handle?: unknown
+  /**
+   * On a root status page (`_404.tsx`, `_<status>.tsx`) or an `_error.tsx`. By default (`true`) the
+   * page renders inside the layouts above it with their loader data and `meta`, as a nested `_404`
+   * renders. When those layouts cannot render it - a loader throws, a gate or the middleware refuses -
+   * a root status page renders alone and an `_error` inside its layouts without their data, with the
+   * same status. `false` always renders them that way, and runs no layout loader for them.
+   */
+  readonly inLayouts?: boolean
   /**
    * Opt a **static** route (no `:param`/`*`) into build-time prerendering (SSG): `prerenderRoutes`
    * (from `@nifrajs/web/build`) renders it to a static `index.html` at build. The loader runs at build
@@ -993,6 +1019,9 @@ const ancestorDirs = (file: string): string[] => {
  * turns a path into a lazy module loader. Pure - no fs. Throws at boot (the loud-and-early
  * RouteConfigError ethos) on duplicate patterns. `_layout`/`_404`/`_error`/`_loading`/`_middleware`
  * files are special; other `_`-prefixed files are ignored (private/colocated, never routed).
+ * A page pairs with its `.backend.*` half only when both are in `files`, so a hand-written list that
+ * omits the half serves the page without its loader and guards; `discoverRoutes` from
+ * `@nifrajs/web/fs` scans a routes dir and never does.
  */
 export function buildManifest(
   files: readonly string[],
@@ -1109,6 +1138,7 @@ export function buildManifest(
 
   const byPattern = new Map<string, string>()
   const routes: RouteEntry[] = []
+  const shapes: { file: string; pattern: string; shape: CompiledRoutePattern }[] = []
   for (const file of routeFiles) {
     const dirs = ancestorDirs(file)
     const layoutDirsForFile = dirs.filter((dir) => layoutDirs.has(dir))
@@ -1132,14 +1162,20 @@ export function buildManifest(
           `[nifra/web] duplicate route: "${file}" and "${existing}" both map to "${pattern}"`,
         )
       }
-      for (const previous of routes) {
+      // A path two shapes share goes to the more specific one (static > mixed > param > wildcard,
+      // segment by segment - the router's own order), and each keeps paths of its own, so
+      // `users/me.tsx` beside `users/[id].tsx` is ordinary. Only one shape twice is ambiguous.
+      const shape = compileRoutePattern(pattern)
+      for (const previous of shapes) {
+        if (compareRoutePatternSpecificity(previous.shape, shape) !== 0) continue
         const witness = routePatternOverlap(previous.pattern, pattern)
         if (witness !== undefined) {
           throw new Error(
-            `[nifra/web] overlapping routes: "${previous.file}" (${previous.pattern}) and "${file}" (${pattern}) both match "${witness}"; make the patterns disjoint or remove one route`,
+            `[nifra/web] overlapping routes: "${previous.file}" (${previous.pattern}) and "${file}" (${pattern}) both match "${witness}" with the same shape, so one of them could never be served; make the patterns disjoint or remove one route`,
           )
         }
       }
+      shapes.push({ file, pattern, shape })
       byPattern.set(pattern, file)
       routes.push({
         id,

package/src/open-resolved.ts

@@ -0,0 +1,64 @@
+import { constants as FS } from "node:fs"
+import { type FileHandle, open, readlink, realpath, stat } from "node:fs/promises"
+
+// Darwin's open(2) flag refusing a symlink in ANY component; `O_NOFOLLOW` covers only the last one.
+const O_NOFOLLOW_ANY = 0x20000000
+// Deno's node:fs rejects flags it does not know with EINVAL; the first refusal turns the flag off.
+let noFollowAny: boolean | undefined
+
+/**
+ * Open a name `realpath` already resolved, refusing it when any component became a symlink since.
+ * A local writer inside the served tree can swap an intermediate directory for a link after the
+ * containment check; `O_NOFOLLOW` alone would follow it. Darwin refuses such a path in the kernel;
+ * Linux reads back the name the descriptor holds. Elsewhere, Windows included, no file API can open
+ * without following a middle link or name an open descriptor's path, so the check in
+ * {@link opensAt} is a platform limit: it narrows the race to repeated swaps but cannot close it.
+ */
+export async function openResolved(realFile: string): Promise<FileHandle> {
+  // Read per open, not at load: this module can sit in a client bundle graph, where `process` is
+  // undefined.
+  if (noFollowAny ?? process.platform === "darwin") {
+    try {
+      return await open(realFile, FS.O_RDONLY | O_NOFOLLOW_ANY)
+    } catch (error) {
+      if (!(error instanceof Error && "code" in error && error.code === "EINVAL")) throw error
+      noFollowAny = false
+    }
+  }
+  const handle = await open(realFile, FS.O_RDONLY | FS.O_NOFOLLOW)
+  try {
+    if (await opensAt(handle, realFile)) return handle
+  } catch {}
+  await handle.close()
+  throw Object.assign(new Error(`${realFile} moved while it was opened`), { code: "ELOOP" })
+}
+
+/** Whether `handle` is the file at `realFile` with no symlink in its path. */
+export async function opensAt(
+  handle: Pick<FileHandle, "fd" | "stat">,
+  realFile: string,
+): Promise<boolean> {
+  try {
+    return (await readlink(`/proc/self/fd/${handle.fd}`)) === realFile
+  } catch {
+    return sameFileAt(handle, realFile)
+  }
+}
+
+/**
+ * {@link opensAt} where no descriptor's path can be read. Exported for its test, which runs it on
+ * every host.
+ */
+export async function sameFileAt(
+  handle: Pick<FileHandle, "stat">,
+  realFile: string,
+): Promise<boolean> {
+  // One step after another, so passing takes a swap back and a swap again between steps: the name
+  // resolves to itself, then to the opened file, then to itself again. Identities are compared as
+  // bigints because a Windows file index can exceed 2^53.
+  if ((await realpath(realFile)) !== realFile) return false
+  const opened = await handle.stat({ bigint: true })
+  const named = await stat(realFile, { bigint: true })
+  if (opened.dev !== named.dev || opened.ino !== named.ino) return false
+  return (await realpath(realFile)) === realFile
+}

package/src/plugins/kit.ts

@@ -4,7 +4,7 @@
  * CSS→client-bundle wiring, the deterministic hash, or the optional-peer guard. Internal to
  * `@nifrajs/web` (imported by the sibling plugin modules); not a public subpath.
  */
-import { existsSync } from "node:fs"
+import { existsSync, readFileSync } from "node:fs"
 import { dirname, join, relative } from "node:path"
 import { fileURLToPath, pathToFileURL } from "node:url"
 import type { BunPlugin } from "bun"
@@ -23,7 +23,7 @@ export type PluginBuilder = Parameters<BunPlugin["setup"]>[0]
  */
 export { rewriteSsrImports } from "../dev-ssr-graph.ts"
 
-const packageRootCache = new Map<string, string>()
+const packageCache = new Map<string, PackageOf>()
 
 /**
  * Convert a plugin/runtime path into a path the host filesystem can open.
@@ -57,14 +57,31 @@ export function portablePath(path: string): string {
   return normalizeFilePath(path).replaceAll("\\", "/")
 }
 
-/** The nearest ancestor directory of `startDir` that holds a `package.json` (the file's package root),
- * cached. Falls back to `startDir` if none is found, so it never throws. */
-function packageRootOf(startDir: string): string {
-  const cached = packageRootCache.get(startDir)
+interface PackageOf {
+  readonly root: string
+  readonly name: string
+}
+
+/** The nearest ancestor directory of `startDir` that holds a `package.json` (the file's package root)
+ * and that package's `name` (`""` when it has none), cached. Falls back to `startDir` if none is found,
+ * so it never throws. */
+function packageOf(startDir: string): PackageOf {
+  const cached = packageCache.get(startDir)
   if (cached !== undefined) return cached
   let dir = startDir
+  let name = ""
   for (;;) {
-    if (existsSync(join(dir, "package.json"))) break
+    const manifest = join(dir, "package.json")
+    if (existsSync(manifest)) {
+      try {
+        const parsed: unknown = JSON.parse(readFileSync(manifest, "utf8"))
+        if (typeof parsed === "object" && parsed !== null && "name" in parsed)
+          name = typeof parsed.name === "string" ? parsed.name : ""
+      } catch {
+        // An unreadable manifest still marks the package root; the name is only a disambiguator.
+      }
+      break
+    }
     const parent = dirname(dir)
     if (parent === dir) {
       dir = startDir // reached the filesystem root with no package.json - anchor on the file's own dir
@@ -72,8 +89,9 @@ function packageRootOf(startDir: string): string {
     }
     dir = parent
   }
-  packageRootCache.set(startDir, dir)
-  return dir
+  const found = { root: dir, name }
+  packageCache.set(startDir, found)
+  return found
 }
 
 /**
@@ -84,11 +102,13 @@ function packageRootOf(startDir: string): string {
  * different machines or from different cwds - derive the SAME relative path for a given file, so their
  * scoped class maps always agree. (Hashing the absolute path would differ across CI/host; a
  * cwd-relative path would silently desync if the SSR server started from a non-project-root cwd.)
+ * The package's `name` leads the path, so `src/Card.vue` in two workspace packages hashes apart.
  */
 export function reproduciblePath(absolutePath: string): string {
   const filePath = normalizeFilePath(absolutePath)
-  const root = packageRootOf(dirname(filePath))
-  return relative(root, filePath).replaceAll("\\", "/")
+  const { root, name } = packageOf(dirname(filePath))
+  const path = relative(root, filePath).replaceAll("\\", "/")
+  return name === "" ? path : `${name}/${path}`
 }
 
 /**

package/src/plugins/vite-leak-guard.ts

@@ -251,6 +251,7 @@ function secretLeak(
       artifacts,
       env: options.secrets?.env ?? process.env,
       publicEnvPrefix: options.publicEnvPrefix ?? "PUBLIC_",
+      // biome-ignore lint/plugin/noConditionalEmptyObjectSpread: Explicitly configured secret-scan exemptions preserve their absence by default.
       ...(options.secrets?.exemptions ? { exemptions: options.secrets.exemptions } : {}),
     }),
   )
@@ -260,7 +261,7 @@ function secretLeak(
 export type ServerZoneGuardOptions = Pick<
   LeakGuardOptions,
   "appRoot" | "routesDir" | "generatedFiles" | "publicEnvPrefix"
->
+> & { readonly componentModules?: ReadonlySet<string> }
 
 /**
  * The server build's half of the zone rules, with the same checks and message as nifra's Bun server
@@ -285,6 +286,9 @@ export function viteServerZoneGuard(options: ServerZoneGuardOptions = {}): LeakG
           classifier,
           sourceOf: rollupModuleSource,
           privateEnv: privateEnvCheck(options.publicEnvPrefix ?? "PUBLIC_"),
+          ...(options.componentModules === undefined
+            ? {}
+            : { componentModules: options.componentModules }),
         }),
       )
       if (leak === undefined) return

package/src/plugins/zone-guard.ts

@@ -7,6 +7,7 @@
  * and the refusal must stop the response.
  */
 
+import { statSync } from "node:fs"
 import { dirname, isAbsolute, relative, resolve } from "node:path"
 import type { BunPlugin } from "bun"
 import { privateEnvDenial } from "../internal/private-env.ts"
@@ -23,16 +24,21 @@ const SOURCE_EXTENSIONS =
  * (images, fonts, wasm, and a `.pem` or `.sql` imported `with { type: "text" }`) goes through
  * `onResolve`: a file-loader asset panics Bun 1.4 on a declining `onLoad`. */
 const SOURCE_FILE = new RegExp(`\\.(?:${SOURCE_EXTENSIONS})$`)
+const ZONE_SUFFIXES = "frontend|backend|shared|fn"
 /**
- * A relative or absolute import whose last segment has an extension, other than a source file.
+ * A relative or absolute import whose last segment has an extension, other than a source file. A zone
+ * suffix is no extension: `"./calendar.shared"` imports `calendar.shared.ts`.
  * Source files are excluded by the FILTER, not declined by the handler: on Bun's dev server a filter
  * match alone changes how the import resolves, even when the handler declines (see
  * `internal/dev-reserved.ts`), and a source file is the onLoad hook's to judge anyway.
  */
 const NON_SOURCE_PATH = new RegExp(
-  `^(?:\\.|\\/|[A-Za-z]:[\\\\/])(?![^?#]*\\.(?:${SOURCE_EXTENSIONS})(?:[?#]|$)).*\\.[^./\\\\?#]+(?:[?#].*)?$`,
+  `^(?:\\.|\\/|[A-Za-z]:[\\\\/])(?![^?#]*\\.(?:${SOURCE_EXTENSIONS}|${ZONE_SUFFIXES})(?:[?#]|$)).*\\.[^./\\\\?#]+(?:[?#].*)?$`,
 )
 
+const isFile = (path: string): boolean =>
+  statSync(path, { throwIfNoEntry: false })?.isFile() ?? false
+
 export interface ZoneGuardOptions {
   /** The app root: the directory holding `routes/`, `frontend/`, `backend/` and `shared/`. */
   readonly appRoot: string
@@ -88,6 +94,9 @@ export function zoneGuardPlugin(options: ZoneGuardOptions): BunPlugin {
         // An entry point (a dev server's HTML page) is the build's own choice, not an import.
         if (args.importer === "") return undefined
         const file = resolve(dirname(args.importer), args.path.replace(/[?#].*$/, ""))
+        // No such file means an extensionless import of a dotted source name (`./date.utils`): Bun resolves
+        // it to the source file, which onLoad judges. Judging the bare path would refuse a file never loaded.
+        if (!isFile(file)) return undefined
         const reason = browserDenial(classifier.classify(file))
         return reason === undefined ? undefined : refuse(file, reason, args.importer)
       })

package/src/public-dir.ts

@@ -12,12 +12,12 @@
  * Distinct from `publicPath` in `build.ts`, which is the URL prefix for content-hashed bundle chunks.
  * The names collide and the concepts do not: `publicPath` never covers user-authored files.
  */
-import { constants as FS } from "node:fs"
-import { open, realpath } from "node:fs/promises"
+import { realpath } from "node:fs/promises"
 import { extname, normalize, resolve, sep } from "node:path"
 import { Readable } from "node:stream"
 import { parseByteRange } from "@nifrajs/core/range"
 import { pathnameOf } from "@nifrajs/core/server"
+import { openResolved } from "./open-resolved.ts"
 
 /** How long each subtree may be cached. Content-hashed bundle output can be immutable; a
  * user-authored file keeps its name across deploys, so it gets a day and a revalidation. */
@@ -31,8 +31,15 @@ export interface PublicDirCache {
 export interface ServePublicDirOptions {
   /** Absolute path of the directory to serve. */
   readonly dir: string
-  /** URL prefix whose files are content-hashed and may be cached immutably (default `"/assets/"`). */
+  /** URL prefix whose files are content-hashed and may be cached immutably (default `"/assets/"`).
+   * Ignored when `hashedFiles` is set. */
   readonly hashedPrefix?: string
+  /**
+   * Encoded URL paths of the content-hashed files, such as a build manifest's `assets`. When set, only
+   * these are cached immutably and every other file gets the `assets` policy, so a user-authored file
+   * that happens to sit under the hashed prefix still revalidates.
+   */
+  readonly hashedFiles?: ReadonlySet<string>
   readonly cache?: PublicDirCache
   /** Optional encoded URL-path allowlist. When present, route misses avoid a filesystem probe. */
   readonly files?: ReadonlySet<string>
@@ -166,6 +173,7 @@ export function servePublicDir(
   const root = resolve(options.dir)
   const rootReal = realpath(root).catch(() => undefined)
   const hashedPrefix = options.hashedPrefix ?? "/assets/"
+  const hashedFiles = options.hashedFiles
   const hashed = options.cache?.hashed ?? IMMUTABLE
   const assets = options.cache?.assets ?? ONE_DAY
 
@@ -192,16 +200,27 @@ export function servePublicDir(
     }
     // Open the canonical path once and stream from that descriptor. Reopening the pathname after
     // realpath containment checks would let a writable public tree swap a symlink between validation
-    // and the actual read. O_NOFOLLOW also rejects a final-component symlink if one appears before
-    // the open; the descriptor then pins the bytes for the lifetime of the response.
-    let handle: Awaited<ReturnType<typeof open>> | undefined
+    // and the actual read. openResolved also refuses the name once any component of it became a
+    // symlink; the descriptor then pins the bytes for the lifetime of the response.
+    let handle: Awaited<ReturnType<typeof openResolved>> | undefined
     try {
-      handle = await open(resolvedFile, FS.O_RDONLY | FS.O_NOFOLLOW)
+      try {
+        handle = await openResolved(resolvedFile)
+      } catch {
+        // A name refused or gone since realpath falls through, as a failed realpath does.
+        return undefined
+      }
       const stat = await handle.stat()
       if (!stat.isFile()) return undefined
       const size = stat.size
       const headers = new Headers({
-        "cache-control": pathname.startsWith(hashedPrefix) ? hashed : assets,
+        "cache-control": (
+          hashedFiles === undefined
+            ? pathname.startsWith(hashedPrefix)
+            : hashedFiles.has(pathname)
+        )
+          ? hashed
+          : assets,
         // Advertised unconditionally: a client that never sees `accept-ranges` will not attempt a seek,
         // so a video or audio file under `public/` is scrubbable only once this header is present.
         "accept-ranges": "bytes",