@nifrajs/web 5.1.0 → 5.3.0

package/src/internal/page-execution.ts

@@ -34,7 +34,7 @@ import type {
   ShouldRevalidate,
 } from "../manifest.ts"
 import type { NonceResolver } from "../nonce.ts"
-import type { MatchChain, RenderAdapter } from "../render-seam.ts"
+import type { MatchChain, PageLocale, PageLocales, RenderAdapter } from "../render-seam.ts"
 import {
   createMatcher,
   DATA_HEADER,
@@ -46,6 +46,7 @@ import {
 } from "../router.ts"
 import { searchOf, searchOfChain } from "../search.ts"
 import { mergeHeads, resolveChainMeta } from "./head-merge.ts"
+import { prepareModules } from "./module-preparation.ts"
 import {
   EMPTY_RETAIN,
   type HeadersLike,
@@ -54,9 +55,12 @@ import {
   isStatusSignal,
   type LoadedLayoutModules,
   layoutErrorId,
+  notFound,
   type RenderAssemblyCache,
   type RenderedPage,
+  type RenderPageOptions,
   type RevalidateResult,
+  redirect,
   renderPageResult,
   STATUS_SIGNAL,
   STATUS_TEXT,
@@ -65,7 +69,7 @@ import {
   tagLayoutError,
   withDuplicateInstanceHint,
 } from "./render-document.ts"
-import { urlPartsFor } from "./request-url.ts"
+import { originFor, urlPartsFor } from "./request-url.ts"
 import {
   ACTION_SCOPE,
   type CoreResponseControls,
@@ -179,6 +183,24 @@ function appTarget(location: string, requestUrl: string): string {
     : target.pathname + target.search + target.hash
 }
 
+/** The app's locale routing, as page execution reads it. */
+export interface PageI18n {
+  readonly locales: PageLocales
+  /** The served locale key a `pathname + search` is in. */
+  localeOf(path: string): string
+  /** The answer for a `[lang]` / `[[lang]]` segment's value (`undefined` when an optional one is
+   * absent), as `@nifrajs/i18n/routing`'s `matchSegment` gives it. */
+  matchSegment(
+    value: string | undefined,
+    pathname: string,
+  ):
+    | { readonly kind: "ok" | "not-found" }
+    | { readonly kind: "redirect"; readonly location: string }
+}
+
+// The route directories whose first segment names the locale.
+const LOCALE_SEGMENTS: ReadonlySet<string> = new Set(["[lang]", "[[lang]]"])
+
 export interface PageExecutionOptions<Env = unknown> {
   readonly serverComponents?: import("../server-components/types.ts").ServerComponentRuntime
   readonly rerenderOwnerGET?: (
@@ -187,6 +209,7 @@ export interface PageExecutionOptions<Env = unknown> {
   ) => Promise<Response>
   readonly adapter: RenderAdapter
   readonly manifest: Manifest
+  readonly cacheRouteModules?: boolean
   readonly clientEntry: string
   readonly title?: string
   readonly api?: unknown
@@ -198,6 +221,10 @@ export interface PageExecutionOptions<Env = unknown> {
   readonly prerenderedPaths?: readonly string[]
   /** Where pages fetch {@link prerenderedPaths} from when the list is too large to inline. */
   readonly prerenderedListUrl?: string
+  /** Locale key -> copy chunk URL, from a build that split copy tables by locale. */
+  readonly copyChunks?: Readonly<Record<string, string>>
+  /** The app's locale routing: each document's locale, and the check on a `[lang]` segment. */
+  readonly i18n?: PageI18n
   readonly staticFallbacks?: Readonly<Record<string, "ssr" | "404">>
   readonly staticBoundaryCache?: StaticBoundaryCache
   /** Per-request CSP nonce for framework-owned executable document scripts. */
@@ -272,6 +299,12 @@ type LayoutChain = {
  */
 type LayoutChainSource = (page: RouteModule, count: number) => Promise<LayoutChain | undefined>
 
+/** A document's render input, filled in field by field. */
+type DocumentInput = { -readonly [K in keyof RenderPageOptions]: RenderPageOptions[K] } & {
+  readonly clientEntry: string
+  readonly hydrate: boolean
+}
+
 /**
  * Own the page request program behind one private seam.
  *
@@ -285,6 +318,11 @@ export function createPageRequestExecutor<Env = unknown>(
   options: PageExecutionOptions<Env>,
 ): PageRequestExecutor<Env> {
   const { adapter, manifest, clientEntry, api } = options
+  const cacheModules =
+    options.cacheRouteModules ??
+    (typeof process !== "undefined" && process.env?.NODE_ENV === "production")
+  const loadModule = prepareModules(cacheModules)
+  const preparedLayouts = new WeakMap<RouteEntry, LoadedLayoutModules>()
   // The action result is request-local; a browser cannot manufacture this handoff.
   const progressiveActionData = new WeakMap<Request, unknown>()
   // Bound once per render, so every loader, action and boundary in that render shares one view of the
@@ -301,6 +339,24 @@ export function createPageRequestExecutor<Env = unknown>(
     options.prerenderedListUrl === undefined
       ? { prerenderedPaths: options.prerenderedPaths ?? [] }
       : { prerenderedListUrl: options.prerenderedListUrl }
+  const copyOption = options.copyChunks === undefined ? {} : { copyChunks: options.copyChunks }
+  const appDocumentOptions = { ...prerenderedHandover, ...copyOption, ...cspOption, ...titleOption }
+  const { i18n } = options
+  const pageLocales = new Map(i18n?.locales.locales.map((locale) => [locale.key, locale]))
+  /** The request's locale for a document, with the served locales the client names locales from. */
+  const localeOption = (req: Request): { locale?: PageLocale; locales?: PageLocales } => {
+    if (i18n === undefined) return {}
+    const locale = pageLocales.get(i18n.localeOf(pathOf(req)))
+    return locale === undefined ? { locales: i18n.locales } : { locale, locales: i18n.locales }
+  }
+  /** Whether a route sits under a `[lang]` or `[[lang]]` directory, which the locale routing checks. */
+  const localeGuarded = (route: RouteEntry): boolean => {
+    if (i18n === undefined) return false
+    for (const segment of route.id.split("/")) {
+      if (!(segment.startsWith("(") && segment.endsWith(")"))) return LOCALE_SEGMENTS.has(segment)
+    }
+    return false
+  }
   const matchManifestRoute = createMatcher(
     manifest.routes.map((route) => ({ routeId: route.id, pattern: route.pattern })),
   )
@@ -379,8 +435,10 @@ export function createPageRequestExecutor<Env = unknown>(
   // Load a route's layout modules once for the current execution. The render path needs each whole
   // module for its component + meta, while the data path also needs loader/gate/boundary declarations.
   const loadLayoutModules = async (route: RouteEntry): Promise<LoadedLayoutModules> => {
+    const known = cacheModules ? preparedLayouts.get(route) : undefined
+    if (known !== undefined) return known
     const modules = await Promise.all(
-      route.layoutIds.map((id) => (manifest.layouts[id] as LayoutEntry).load()),
+      route.layoutIds.map((id) => loadModule(manifest.layouts[id] as LayoutEntry)),
     )
     for (let i = 0; i < modules.length; i++) {
       if ((modules[i] as { action?: unknown }).action === undefined) continue
@@ -389,6 +447,7 @@ export function createPageRequestExecutor<Env = unknown>(
         `[nifra/web] "${(manifest.layouts[id] as LayoutEntry).file}" exports an \`action\`, but layouts do not run one - only route files do. Move the mutation into the route that submits to it.`,
       )
     }
+    if (cacheModules) preparedLayouts.set(route, modules)
     return modules
   }
 
@@ -553,6 +612,21 @@ export function createPageRequestExecutor<Env = unknown>(
     ctx: LoaderContext,
     controls: PageResponseControls,
   ): Promise<void> => {
+    if (i18n !== undefined && localeGuarded(route)) {
+      // Before any app middleware, as a root `_middleware` would run: an unserved locale, or a page
+      // missing from it, never reaches the app's code.
+      const match = i18n.matchSegment(ctx.params.lang, pathOf(ctx.request))
+      if (match.kind === "redirect") {
+        throw tagLayoutError(redirect(match.location, { status: 308 }), "_layout")
+      }
+      if (match.kind === "not-found") {
+        try {
+          notFound()
+        } catch (signal) {
+          throw tagLayoutError(signal, "_layout")
+        }
+      }
+    }
     const ids = route.middlewareIds ?? []
     for (let i = 0; i < ids.length; i++) {
       const id = ids[i] as string
@@ -560,7 +634,7 @@ export function createPageRequestExecutor<Env = unknown>(
       const dirTag = `${id.slice(0, id.length - "_middleware".length)}_layout`
       let outcome: unknown
       try {
-        const middleware = (await entry.load()).default
+        const middleware = (await loadModule(entry)).default
         // A `_layout.backend.ts` that exports no middleware is a layout data module, nothing more.
         if (middleware === undefined) continue
         if (typeof middleware !== "function") {
@@ -718,14 +792,6 @@ export function createPageRequestExecutor<Env = unknown>(
     return undefined
   }
 
-  const originOf = (req: Request): string => {
-    try {
-      return new URL(req.url).origin
-    } catch {
-      return ""
-    }
-  }
-
   const pathOf = (req: Request): string => {
     try {
       const parts = urlPartsFor(req)
@@ -738,8 +804,8 @@ export function createPageRequestExecutor<Env = unknown>(
   /** What a status or error page's `meta` receives: no route params, and its own data. */
   const statusMetaArgs = (req: Request, data: unknown, nonce: string | undefined): MetaArgs =>
     nonce === undefined
-      ? { data, pageData: data, params: {}, origin: originOf(req) }
-      : { data, pageData: data, params: {}, origin: originOf(req), nonce }
+      ? { data, pageData: data, params: {}, origin: originFor(req) }
+      : { data, pageData: data, params: {}, origin: originFor(req), nonce }
 
   const renderError = async (
     req: Request,
@@ -776,6 +842,7 @@ export function createPageRequestExecutor<Env = unknown>(
         chain: components,
         data,
         ...(wrapped === undefined ? {} : { head: wrapped.head }),
+        ...localeOption(req),
         clientEntry,
         routeId: errorId,
         status: 500,
@@ -939,6 +1006,8 @@ export function createPageRequestExecutor<Env = unknown>(
       // The build keys stylesheets by route, so a page inside the root layout links the whole-app one.
       ...(chain === undefined ? stylesOf(routeId) : stylesFrom(options.styles)),
       ...prerenderedHandover,
+      ...copyOption,
+      ...localeOption(req),
       ...titleOption,
     }
     if (chain === undefined) return renderPageResult(statusPage)
@@ -1062,13 +1131,15 @@ export function createPageRequestExecutor<Env = unknown>(
         data,
         pageData: data,
         params,
-        origin: originOf(req),
+        origin: originFor(req),
         ...(nonce === undefined ? {} : { nonce }),
       },
       serverLeafOf(route, mod),
     )
     try {
-      return await renderPageResult({
+      // Optional fields are assigned, not spread in: a conditional spread per field cost every
+      // document request about 1us on Bun.
+      const page: DocumentInput = {
         adapter,
         chain,
         data,
@@ -1079,36 +1150,32 @@ export function createPageRequestExecutor<Env = unknown>(
         path: pathOf(req),
         search: searchChainOf(layoutModules, mod, req),
         matchChain: matchChainOf(route.layoutIds, layoutModules, route.id, mod),
-        ...(serverComponents === undefined ? {} : { serverComponents }),
-        ...(progressiveActionData.has(req) ? { actionData: progressiveActionData.get(req) } : {}),
         hydrate: mod.hydrate !== false,
-        ...(layoutData !== undefined ? { layoutData } : {}),
-        ...(boundaryStates !== undefined ? { boundaries: boundaryStates } : {}),
         ...preloadOf(route.id),
         ...stylesOf(route.id),
-        ...prerenderedHandover,
-        ...(responseHeaders === undefined ? {} : { headers: responseHeaders }),
-        // A response that sets a cookie is one visitor's: it never advertises ISR freshness.
-        ...(mod.revalidate !== undefined && !personalized && options.cacheChannel?.enabled === true
-          ? { revalidate: mod.revalidate }
-          : {}),
-        ...(mod.revalidateTags !== undefined &&
-        !personalized &&
-        options.cacheChannel?.enabled === true
-          ? {
-              revalidateTags: routeTags(
-                mod.revalidateTags,
-                { params, url: new URL(req.url) },
-                route.id,
-              ),
-            }
-          : {}),
-        ...(mod.islandScripts !== undefined ? { islandScripts: mod.islandScripts } : {}),
-        ...(nonce === undefined ? {} : { nonce }),
-        ...cspOption,
-        ...titleOption,
-        ...(assemblyCache === undefined ? {} : { assemblyCache }),
-      })
+        ...appDocumentOptions,
+        ...localeOption(req),
+      }
+      if (serverComponents !== undefined) page.serverComponents = serverComponents
+      if (progressiveActionData.has(req)) page.actionData = progressiveActionData.get(req)
+      if (layoutData !== undefined) page.layoutData = layoutData
+      if (boundaryStates !== undefined) page.boundaries = boundaryStates
+      if (responseHeaders !== undefined) page.headers = responseHeaders
+      // A response that sets a cookie is one visitor's: it never advertises ISR freshness.
+      if (!personalized && options.cacheChannel?.enabled === true) {
+        if (mod.revalidate !== undefined) page.revalidate = mod.revalidate
+        if (mod.revalidateTags !== undefined) {
+          page.revalidateTags = routeTags(
+            mod.revalidateTags,
+            { params, url: new URL(req.url) },
+            route.id,
+          )
+        }
+      }
+      if (mod.islandScripts !== undefined) page.islandScripts = mod.islandScripts
+      if (nonce !== undefined) page.nonce = nonce
+      if (assemblyCache !== undefined) page.assemblyCache = assemblyCache
+      return await renderPageResult(page)
     } catch (err) {
       if (isStatusSignal(err)) return renderStatusSignal(req, env, err, personalized, settled)
       if (isControlFlow(err)) throw err
@@ -1191,7 +1258,7 @@ export function createPageRequestExecutor<Env = unknown>(
       data: null,
       pageData: null,
       params,
-      origin: originOf(req),
+      origin: originFor(req),
       ...(nonce === undefined ? {} : { nonce }),
     })
     let headers: Headers | undefined
@@ -1213,6 +1280,7 @@ export function createPageRequestExecutor<Env = unknown>(
       matchChain: matchChainOf(page.layoutIds, layoutModules, id, mod),
       status: 404,
       hydrate: false,
+      ...localeOption(req),
       ...(layoutData !== undefined ? { layoutData } : {}),
       ...stylesOf(id),
       ...(headers === undefined ? {} : { headers }),
@@ -1304,12 +1372,14 @@ export function createPageRequestExecutor<Env = unknown>(
   return {
     get: (route) => {
       const is404Fallback = options.staticFallbacks?.[route.pattern] === "404"
-      let assemblySlot: RenderAssemblyCache | undefined
+      // One shell per locale: `<html lang>` is in it, and one route serves every locale.
+      let assemblySlots = new Map<string, RenderAssemblyCache>()
       let assemblySlotMod: unknown
       let assemblySlotLayouts: LoadedLayoutModules | undefined
       const assemblyCacheFor = (
         mod: RouteModule,
         layouts: LoadedLayoutModules,
+        req: Request,
       ): RenderAssemblyCache | undefined => {
         if (typeof mod.meta === "function") return undefined
         for (const layout of layouts) if (typeof layout.meta === "function") return undefined
@@ -1318,11 +1388,17 @@ export function createPageRequestExecutor<Env = unknown>(
           assemblySlotLayouts.length === layouts.length &&
           assemblySlotLayouts.every((layout, index) => layout === layouts[index])
         if (assemblySlotMod !== mod || !layoutsUnchanged) {
-          assemblySlot = {}
+          assemblySlots = new Map()
           assemblySlotMod = mod
           assemblySlotLayouts = layouts
         }
-        return assemblySlot
+        const key = i18n === undefined ? "" : i18n.localeOf(pathOf(req))
+        let slot = assemblySlots.get(key)
+        if (slot === undefined) {
+          slot = {}
+          assemblySlots.set(key, slot)
+        }
+        return slot
       }
 
       return withResponseControls(async (c, controls) => {
@@ -1340,7 +1416,8 @@ export function createPageRequestExecutor<Env = unknown>(
         if (!componentOwner && is404Fallback && !prerenderedSet.has(urlPartsFor(c.req).pathname)) {
           return renderNotFound(c, controls)
         }
-        const mod = await route.load()
+        const loaded = loadModule(route)
+        const mod = cacheModules && !(loaded instanceof Promise) ? loaded : await loaded
         const draft = await draftFlag(c.req)
         // Unpublished content is the editor's alone: whatever cache-control a loader sets, no cache keeps it.
         if (draft) controls.personalize()
@@ -1364,7 +1441,9 @@ export function createPageRequestExecutor<Env = unknown>(
             search: loaderSearch(mod.searchSchema, c.req),
             set: controls.scope(PAGE_SCOPE),
           }
-          if (route.middlewareIds !== undefined) await runMiddleware(route, ctx, controls)
+          if (route.middlewareIds !== undefined || localeGuarded(route)) {
+            await runMiddleware(route, ctx, controls)
+          }
           run = await runLayoutChain(
             route,
             ctx,
@@ -1510,7 +1589,7 @@ export function createPageRequestExecutor<Env = unknown>(
           layoutModules ?? (await loadLayoutModules(route)),
           layoutRetained,
           boundaryStates,
-          layoutModules === undefined ? undefined : assemblyCacheFor(mod, layoutModules),
+          layoutModules === undefined ? undefined : assemblyCacheFor(mod, layoutModules, c.req),
           responseHeaders,
           controls.personalized,
           componentState,
@@ -1520,7 +1599,8 @@ export function createPageRequestExecutor<Env = unknown>(
 
     post: (route) =>
       withResponseControls(async (c, controls) => {
-        const mod = await route.load()
+        const loaded = loadModule(route)
+        const mod = cacheModules && !(loaded instanceof Promise) ? loaded : await loaded
         const draft = await draftFlag(c.req)
         if (draft) controls.personalize()
         if (mod.action === undefined) {
@@ -1569,7 +1649,9 @@ export function createPageRequestExecutor<Env = unknown>(
         let gated: GatedLayouts
         let result: unknown
         try {
-          if (route.middlewareIds !== undefined) await runMiddleware(route, actionContext, controls)
+          if (route.middlewareIds !== undefined || localeGuarded(route)) {
+            await runMiddleware(route, actionContext, controls)
+          }
           gated = await runLayoutGates(route, actionContext, controls)
           result = await mod.action(actionContext)
         } catch (err) {
@@ -1736,7 +1818,7 @@ export function createPageRequestExecutor<Env = unknown>(
             data,
             pageData: data,
             params: c.params,
-            origin: originOf(c.req),
+            origin: originFor(c.req),
             ...(nonce === undefined ? {} : { nonce }),
           },
           serverLeafOf(route, mod),
@@ -1758,6 +1840,8 @@ export function createPageRequestExecutor<Env = unknown>(
           ...preloadOf(route.id),
           ...stylesOf(route.id),
           ...prerenderedHandover,
+          ...copyOption,
+          ...localeOption(c.req),
           ...(responseHeaders === undefined ? {} : { headers: responseHeaders }),
           ...(nonce === undefined ? {} : { nonce }),
           ...cspOption,

package/src/internal/parity.ts

@@ -20,7 +20,7 @@ import { discoverRoutes } from "../fs.ts"
 import { codeUnitOrder } from "./code-unit-order.ts"
 import { withoutComments } from "./html-spans.ts"
 import { isIdentitySensitivePackage } from "./identity-policy.ts"
-import { publicUrlPath } from "./public-url.ts"
+import { isHiddenPublicPath, publicUrlPath } from "./public-url.ts"
 
 const DEPENDENCY_FIELDS = [
   "dependencies",
@@ -1077,6 +1077,7 @@ const publicFilesUnder = (publicDir: string | false | undefined): readonly strin
   const files: string[] = []
   const walk = (current: string): void => {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
+      if (isHiddenPublicPath(entry.name)) continue // the build skips it too
       const path = join(current, entry.name)
       if (entry.isDirectory()) walk(path)
       else if (entry.isFile()) files.push(publicUrlPath(relative(root, path)))

package/src/internal/prerendered-pages.ts

@@ -0,0 +1,124 @@
+import { pathnameOf } from "@nifrajs/core/server"
+import { isDraftEnabled } from "../draft.ts"
+import { DATA_HEADER } from "../router.ts"
+
+/**
+ * Pages a self-hosted build prerendered, which `createWebApp` answers from their file instead of
+ * rendering them. The file is served from inside the app, after `use` middleware, so a gate in front of
+ * the pages still runs.
+ */
+export interface PrerenderedPages {
+  /** Each servable path, spelled as a request URL spells it, mapped to the document headers its
+   * build-time render answered with (a prerender entry's `serveHeaders`). */
+  readonly pages: Readonly<Record<string, Readonly<Record<string, string>>>>
+  /** The page's HTML, or `undefined` to render it on demand instead. */
+  read(pathname: string): Promise<string | undefined>
+}
+
+// The document headers a render produces from the route alone, so the build-time value is the value
+// every request would get. Loader headers are left out: a prerendered page is a static file.
+const REPLAYED = [
+  "content-language",
+  "content-security-policy",
+  "content-security-policy-report-only",
+]
+// Vary values a file still answers correctly: compression is negotiated by the host, and a data request
+// never reaches the file.
+const STATIC_VARY = new Set(["accept-encoding", DATA_HEADER])
+
+/**
+ * The headers a self-hosted server replays with a prerendered page, or `undefined` when its build-time
+ * render was specific to that request and the page must keep rendering on demand: it set a cookie, was
+ * marked private or no-store (a nonce page always is), or varied on a request header.
+ */
+export function prerenderedDocumentHeaders(
+  status: number,
+  headers: Headers,
+): Record<string, string> | undefined {
+  if (status !== 200 || headers.has("set-cookie")) return undefined
+  const cacheControl = (headers.get("cache-control") ?? "").toLowerCase()
+  if (/\b(?:private|no-store)\b/.test(cacheControl)) return undefined
+  for (const name of (headers.get("vary") ?? "").split(",")) {
+    const trimmed = name.trim().toLowerCase()
+    if (trimmed !== "" && !STATIC_VARY.has(trimmed)) return undefined
+  }
+  const replayed: Record<string, string> = {}
+  for (const name of REPLAYED) {
+    const value = headers.get(name)
+    if (value !== null) replayed[name] = value
+  }
+  return replayed
+}
+
+/** One page a self-hosting build prerendered: its file and the headers it is served with. */
+export interface ServerPrerenderedPage {
+  readonly file: string
+  readonly headers: Readonly<Record<string, string>>
+}
+
+/**
+ * The prerendered pages a server may answer from their file, keyed by the pathname of the request that
+ * rendered them. Left out: a render specific to its request, and two paths written to one file (`/x`
+ * and `//x`, or `/A` and `/a` on a case-insensitive disk), where only the last render is on disk.
+ */
+export function servablePrerenderedPages(
+  entries: readonly {
+    readonly path: string
+    readonly file: string
+    readonly serveHeaders?: Readonly<Record<string, string>>
+  }[],
+): Record<string, ServerPrerenderedPage> {
+  const writes = new Map<string, number>()
+  for (const { file } of entries) {
+    writes.set(file.toLowerCase(), (writes.get(file.toLowerCase()) ?? 0) + 1)
+  }
+  const pages: Record<string, ServerPrerenderedPage> = {}
+  for (const { path, file, serveHeaders } of entries) {
+    if (serveHeaders === undefined || writes.get(file.toLowerCase()) !== 1) continue
+    // Concatenated as prerenderRoutes requested it: `new URL("//x", base)` would read a host.
+    pages[new URL(`http://localhost${path}`).pathname] = { file, headers: serveHeaders }
+  }
+  return pages
+}
+
+/**
+ * Wrap a page route's GET handler so a plain document request for a prerendered path is answered from
+ * its file. Anything a file cannot answer the way a render would renders on demand: a query string, a
+ * navigation data or component request, a draft-mode visitor, or a file the reader cannot return.
+ */
+export function servePrerenderedPages(
+  prerendered: PrerenderedPages,
+  draftSecret: string | undefined,
+): <C extends { readonly req: Request }, R>(
+  render: (c: C) => Promise<R>,
+) => (c: C) => Promise<R | Response> {
+  const pages = new Map(Object.entries(prerendered.pages))
+  return (render) => async (c) => {
+    const req = c.req
+    const pathname = pathnameOf(req.url)
+    const headers = pages.get(pathname)
+    if (
+      headers === undefined ||
+      req.url.includes("?") ||
+      req.headers.has(DATA_HEADER) ||
+      req.headers.has("x-nifra-component") ||
+      (draftSecret !== undefined && (await isDraftEnabled(req, draftSecret)))
+    ) {
+      return render(c)
+    }
+    const html = await prerendered.read(pathname)
+    if (html === undefined) return render(c)
+    if (req.method !== "HEAD") {
+      return new Response(html, {
+        headers: { ...headers, "content-type": "text/html; charset=utf-8" },
+      })
+    }
+    return new Response(null, {
+      headers: {
+        ...headers,
+        "content-type": "text/html; charset=utf-8",
+        "content-length": String(new TextEncoder().encode(html).byteLength),
+      },
+    })
+  }
+}

package/src/internal/public-url.ts

@@ -20,3 +20,16 @@ function encodePathSegment(segment: string): string {
 export function publicUrlPath(rel: string): string {
   return `/${rel.split(sep).map(encodePathSegment).join("/")}`
 }
+
+/**
+ * Whether a path under the public directory crosses a dot-segment other than `.well-known`. Serving,
+ * the build copy and the parity listing all apply it, so an editor or VCS artifact left in `public/`
+ * (`.env`, `.git/`, `.DS_Store`) is neither served in development nor shipped by a build. Both
+ * separators split: a request path uses `/`, a relative file path the OS separator.
+ */
+export function isHiddenPublicPath(rel: string): boolean {
+  for (const segment of rel.split(/[\\/]/)) {
+    if (segment.startsWith(".") && segment !== ".well-known") return true
+  }
+  return false
+}