@nifrajs/web 5.1.0 → 5.3.0

package/dist/build.js

@@ -12,22 +12,25 @@ import { cp, lstat, mkdir, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, join, basename as pathBasename, posix, relative, resolve as resolvePath, sep, } from "node:path";
 import { singleCopyPlugin as declaredSingleCopyPlugin, readSingleCopyDeclaration, } from "@nifrajs/core/single-copy";
 import { Glob } from "bun";
-import { aggregateSizeReport, detectNodeBuiltinsInClient, detectServerOnlyInClient, formatNodeBuiltinLeak, formatServerOnlyLeak, parseBuildTarget, parseManifestClientEntry, parseManifestCssLoading, parseManifestRouteStyles, parseManifestStyles, planBuildTarget, } from "./build-plan.js";
+import { aggregateSizeReport, detectNodeBuiltinsInClient, detectServerOnlyInClient, formatNodeBuiltinLeak, formatServerOnlyLeak, parseBuildTarget, parseManifestClientEntry, parseManifestCopyChunks, parseManifestCssLoading, parseManifestRouteStyles, parseManifestStyles, planBuildTarget, } from "./build-plan.js";
 import { sanitizeOutputNames } from "./chunk-names.js";
 import { normalizeCssCodeSplit, normalizeCssLoading } from "./css-contract.js";
 import { discoverRoutes } from "./fs.js";
 import { generateClientEntry, generateServerManifest } from "./index.js";
+import { loadCopySplit } from "./internal/copy-split.js";
 import { assertDisposableDir } from "./internal/disposable-dir.js";
 import { entryChunks } from "./internal/entry-chunks.js";
 import { dedupePolicyFor } from "./internal/identity-policy.js";
 import { assertDevelopmentProductionParity, assertIdentityParity, collectDevelopmentParityInput, } from "./internal/parity.js";
+import { servablePrerenderedPages, } from "./internal/prerendered-pages.js";
 import { privateEnvCheck } from "./internal/private-env.js";
-import { publicUrlPath } from "./internal/public-url.js";
-import { assertNoSecrets, buildEnvironment, emittedScanFiles, formatSecretFindings, graphScanInput, originName, publicScanFiles, scanForSecrets, textOf, } from "./internal/secret-scan.js";
+import { isHiddenPublicPath, publicUrlPath } from "./internal/public-url.js";
+import { assertNoSecrets, buildEnvironment, emittedScanFiles, formatSecretFindings, graphScanInput, originName, publicScanFiles, SecretScanError, scanForSecrets, textOf, } from "./internal/secret-scan.js";
 import { generateServerFnStub, SERVER_FN_MODULE, serverFnNamespace, } from "./internal/server-boundary.js";
 import { formatUnsupportedBuiltins, unsupportedBuiltins } from "./internal/target-compat.js";
 import { accountEmittedFiles, bunModuleSource, formatClientGraphVerdict, formatServerGraphVerdict, formatUnaccountedOutput, verifyClientGraph, verifyServerGraph, } from "./internal/zone-graph.js";
 import { fromBunMetafile } from "./module-graph.js";
+import { assertNoImportGlob, importGlobPlugin } from "./plugins/import-glob.js";
 import { zoneGuardPlugin } from "./plugins/zone-guard.js";
 // `buildTarget(static)` drives the SSG prerender engine directly (it's also re-exported below).
 import { prerenderRoutes } from "./prerender.js";
@@ -164,7 +167,9 @@ routePatterns) {
 }
 /** The built asset map - the server reads `entry` for the client script + serves `assets`. */
 /**
- * Copy `from` into `to`, returning the URL paths copied (sorted).
+ * Copy `from` into `to`, returning the URL paths copied (sorted). Hidden entries other than
+ * `.well-known` are skipped, as development never serves them: every target ships this list, and a
+ * CDN-hosted one serves whatever was copied.
  *
  * Lives here, not beside `servePublicDir`, because it is BUILD-time: it reaches for `Bun.Glob` and
  * `node:fs`, and `public-dir.ts` is reachable from the client bundle graph through the package
@@ -175,6 +180,8 @@ export async function copyPublicDir(from, to) {
     const sourceReal = await realpath(source);
     const copied = [];
     for await (const rel of new Glob("**/*").scan({ cwd: source, dot: true, onlyFiles: false })) {
+        if (isHiddenPublicPath(rel))
+            continue;
         const candidate = join(source, rel);
         const candidateStat = await lstat(candidate);
         if (candidateStat.isSymbolicLink()) {
@@ -203,12 +210,14 @@ export async function copyPublicDir(from, to) {
  */
 export function resyncServerManifestSource(source, manifest, routesPrefix) {
     const cssLoading = parseManifestCssLoading(source);
+    const copyChunks = parseManifestCopyChunks(source);
     return generateServerManifest(manifest, {
         resolve: (file) => `${routesPrefix}${file}`,
         clientEntry: parseManifestClientEntry(source) ?? "",
         styles: parseManifestStyles(source),
         routeStyles: parseManifestRouteStyles(source),
         ...(cssLoading !== undefined ? { cssLoading } : {}),
+        ...(copyChunks !== undefined ? { copyChunks } : {}),
         lazy: MANIFEST_IS_LAZY.test(source),
     });
 }
@@ -249,6 +258,9 @@ export async function buildClient(options) {
     // The bootstrap's filename is `_nifra`-namespaced (not `entry.ts`) so its `[name]` can't collide with
     // a user route named `entry.tsx` when the CSS mapping below excludes the bootstrap's aggregate CSS.
     const mode = options.minify === false ? "development" : "production";
+    const copySplit = (options.copySplit ?? mode === "production")
+        ? await loadCopySplit(root, { skip: [outDir] })
+        : undefined;
     // PUBLIC_*-prefixed env → client define (Vite/Next convention). Sourced from the build env (`Bun.env`,
     // falling back to `process.env`). Only prefixed vars are baked in; unprefixed secrets stay undefined
     // in the client via the bare `process.env` → `({})` define below. Caller's `options.define` wins (it's
@@ -263,7 +275,11 @@ export async function buildClient(options) {
     const entryFile = `${entryDir}/_nifra-entry.ts`;
     // A client bundle has no Node `process`; provide a minimal one so a stray bare `process` reference in
     // an app module doesn't crash hydration (`process.env.*` reads are handled at compile time by `define`).
-    writeFileSync(entryFile, `globalThis.process ??= { env: {} };\n${generateClientEntry(routeManifest, { clientModule, resolve })}`);
+    writeFileSync(entryFile, `globalThis.process ??= { env: {} };\n${generateClientEntry(routeManifest, {
+        clientModule,
+        resolve,
+        copyChunks: copySplit !== undefined,
+    })}`);
     // Every unique route/layout/`_404` file (sorted, stable), as ADDITIONAL entrypoints - Bun emits a
     // named chunk per file that the bootstrap's lazy `import()` dedupes to (verified), so the manifest
     // can map each route to its chunk URLs for matched-route preload. `resolve(file)` is the same
@@ -314,6 +330,10 @@ export async function buildClient(options) {
                     svelteDedupePlugin(routesDir),
                     serverFnStubPlugin(),
                     ...(options.plugins ?? []),
+                    // Before the copy split: it claims a module that calls the glob and reads it through the split.
+                    importGlobPlugin({ root }),
+                    // Last: it rewrites a module no other plugin claims, and the ones that do read through it.
+                    ...(copySplit === undefined ? [] : [copySplit.plugin]),
                 ],
                 ...(options.conditions ? { conditions: [...options.conditions] } : {}),
                 // Replace `process.env.*` at compile time so an app module reading config off `process.env` doesn't
@@ -364,6 +384,7 @@ export async function buildClient(options) {
         }
         return { name: out.path, kind: "code", text: await out.text() };
     }));
+    assertNoImportGlob(emitted.flatMap((file) => file.kind === "code" ? [[relative(cwd, file.name), file.text ?? ""]] : []));
     const clientGraph = withEmittedImports(fromBunMetafile(clientMeta), emitted, publicPath);
     const verdict = verifyClientGraph(clientGraph, {
         classifier,
@@ -405,6 +426,7 @@ export async function buildClient(options) {
     if (unaccounted !== undefined)
         throw new Error(unaccounted);
     const publicDir = options.publicDir === false ? undefined : (options.publicDir ?? "public");
+    const copy = copySplit?.chunks(publicPath);
     const { sources, originsOf } = graphScanInput(clientGraph, bunModuleSource(cwd), classifier);
     const secrets = formatSecretFindings(scanForSecrets({
         sources,
@@ -415,6 +437,7 @@ export async function buildClient(options) {
                 const name = file.name.replace(/^\.\//, "");
                 return emittedScanFiles(name, file.text, originsOf(name));
             }),
+            ...(copy?.files ?? []).flatMap((file) => emittedScanFiles(file.name, file.text)),
             ...(publicDir !== undefined && existsSync(publicDir)
                 ? publicScanFiles(publicDir, originName(root, resolvePath(publicDir)))
                 : []),
@@ -430,6 +453,8 @@ export async function buildClient(options) {
         await Bun.write(path, out);
         return { kind: out.kind, path };
     }));
+    for (const file of copy?.files ?? [])
+        writeFileSync(join(outDir, file.name), file.text);
     // Rename any chunk whose basename isn't URL-safe (dynamic-route files become `[slug]-hash.js`) and
     // rewrite the references - otherwise the lazy import 404s and the route silently never hydrates.
     const renamed = sanitizeOutputNames(outputs);
@@ -553,13 +578,15 @@ export async function buildClient(options) {
     // Copy `public/` into the output next to the hashed assets. A missing directory is normal (most
     // apps have none) and must not fail the build.
     const publicFiles = publicDir !== undefined && existsSync(publicDir) ? await copyPublicDir(publicDir, outDir) : [];
+    const copyChunks = copy?.urls ?? {};
     const manifest = {
         entry: entryUrl,
-        assets: outputs.map((o) => toUrl(o.path)),
+        assets: [...outputs.map((o) => toUrl(o.path)), ...Object.values(copyChunks)],
         routes,
         ...(publicFiles.length > 0 ? { publicFiles } : {}),
         ...(css.length > 0 ? { css } : {}),
         ...(Object.keys(routeStyles).length > 0 ? { routeStyles } : {}),
+        ...(Object.keys(copyChunks).length > 0 ? { copyChunks } : {}),
     };
     assertDevelopmentProductionParity(collectDevelopmentParityInput(routesDir, publicDir), manifest);
     writeFileSync(`${outDir}/manifest.json`, JSON.stringify(manifest, null, 2));
@@ -788,6 +815,7 @@ function formatRefusedFiles(refused, root) {
     });
     return `[nifra/web] the browser build reached code that may not ship to a browser:\n${lines.join("\n")}`;
 }
+export { importGlobPlugin } from "./plugins/import-glob.js";
 export { zoneGuardPlugin } from "./plugins/zone-guard.js";
 /**
  * Server functions in the CLIENT build: replace each `*.fn.ts` module with stubs that call the routes
@@ -858,6 +886,7 @@ export async function buildServer(options) {
         styles,
         routeStyles,
         ...(cssLoading !== undefined ? { cssLoading } : {}),
+        ...(options.copyChunks !== undefined ? { copyChunks: options.copyChunks } : {}),
         lazy,
     }));
     const result = await Bun.build({
@@ -887,6 +916,7 @@ export async function buildServer(options) {
             reactDedupePlugin(entryDir),
             preactDedupePlugin(entryDir),
             ...(options.plugins ?? []),
+            importGlobPlugin({ root: resolvePath(options.root ?? dirname(routesDir)) }),
         ],
     });
     if (!result.success) {
@@ -939,7 +969,14 @@ export async function buildServer(options) {
 // …) - so we GENERATE it here (per target) instead of asking each app to ship five near-identical files.
 // ===================================================================================================
 /** The `createWebApp` options a generated server entry can import from the app's framework module. */
-export const SERVER_ENTRY_OPTIONS = ["apiPrefix", "apiStrip", "mounts", "csp", "nonce"];
+export const SERVER_ENTRY_OPTIONS = [
+    "apiPrefix",
+    "apiStrip",
+    "mounts",
+    "csp",
+    "nonce",
+    "i18n",
+];
 /**
  * The header each edge platform sets to the caller's address, replacing any value the client sent.
  * That replacement is the whole trust: the same bundle served without the platform's edge in front
@@ -950,6 +987,8 @@ const PLATFORM_CLIENT_IP_HEADERS = {
     cloudflare: "cf-connecting-ip",
     vercel: "x-real-ip",
 };
+/** Where a self-hosting build writes its prerendered pages, beside `server.js`. */
+const PRERENDERED_DIR = "_prerendered";
 /**
  * Codegen the per-target **server entry** module (source text) for `buildServer` to bundle. It imports
  * the app's `adapter` (from `framework.ts`), the optional `backend` (from `backend.ts`), and the
@@ -984,7 +1023,20 @@ export function generateServerEntry(options) {
     if (target === "static") {
         throw new Error("[nifra/web] generateServerEntry: `static` has no server entry (SSG only)");
     }
-    const lines = ['import { createWebApp } from "@nifrajs/web"'];
+    // Bun and Node serve the client bundle through `servePublicDir`. Deno bundles for the browser
+    // condition, where `node:fs` is a stub, so its entry runs the same checks on Deno's own file API.
+    const nodeFs = target === "bun" || target === "node";
+    const prerendered = Object.entries(options.prerenderedPages ?? {});
+    if (prerendered.length > 0 && !nodeFs) {
+        throw new Error(`[nifra/web] generateServerEntry: prerendered pages are served by the bun and node targets, not ${target}`);
+    }
+    const lines = [
+        !nodeFs
+            ? 'import { createWebApp } from "@nifrajs/web"'
+            : prerendered.length > 0
+                ? 'import { createWebApp, prerenderedPageReader, servePublicDir } from "@nifrajs/web"'
+                : 'import { createWebApp, servePublicDir } from "@nifrajs/web"',
+    ];
     if (backendImport !== undefined)
         lines.push('import { inProcessClient } from "@nifrajs/client"');
     lines.push(`import { adapter } from ${JSON.stringify(adapterImport)}`);
@@ -996,13 +1048,24 @@ export function generateServerEntry(options) {
     if (backendImport !== undefined) {
         lines.push(`import { backend } from ${JSON.stringify(backendImport)}`);
     }
-    lines.push('import { clientEntry, cssLoading, manifest, styles, routeStyles } from "./server-manifest"');
+    lines.push(options.copyChunks === true
+        ? 'import { clientEntry, copyChunks, cssLoading, manifest, styles, routeStyles } from "./server-manifest"'
+        : 'import { clientEntry, cssLoading, manifest, styles, routeStyles } from "./server-manifest"');
     // Cloudflare needs the fetch-handler shape; the others call app.fetch directly.
     if (target === "cloudflare")
         lines.push('import { toFetchHandler } from "@nifrajs/core/server"');
     if (target === "node")
         lines.push('import { serve } from "@nifrajs/node"');
-    lines.push("", "const app = createWebApp({", "  adapter,", ...(useImport !== undefined ? ["  use,"] : []), ...importedOptions.map((name) => `  ${name},`), "  manifest,", "  clientEntry,", "  styles,", "  routeStyles,", "  cssLoading,", ...(backendImport !== undefined ? ["  api: inProcessClient(backend),"] : []), `  title: ${JSON.stringify(title)},`, 
+    if (nodeFs)
+        lines.push('import { fileURLToPath } from "node:url"');
+    if (target === "deno")
+        lines.push('import { parseByteRange } from "@nifrajs/core/range"');
+    if (prerendered.length > 0) {
+        const headers = Object.fromEntries(prerendered.map(([path, page]) => [path, page.headers]));
+        const files = Object.fromEntries(prerendered.map(([path, page]) => [path, page.file]));
+        lines.push("", `// The pages the build prerendered into ${PRERENDERED_DIR}/, answered from their file after \`use\`.`, "const prerenderedPages = {", `  pages: ${JSON.stringify(headers)},`, "  read: prerenderedPageReader({", `    dir: fileURLToPath(new URL(${JSON.stringify(`./${PRERENDERED_DIR}/`)}, import.meta.url)),`, `    files: ${JSON.stringify(files)},`, "  }),", "}");
+    }
+    lines.push("", "const app = createWebApp({", "  adapter,", ...(useImport !== undefined ? ["  use,"] : []), ...(prerendered.length > 0 ? ["  prerenderedPages,"] : []), ...importedOptions.map((name) => `  ${name},`), "  manifest,", "  clientEntry,", "  styles,", "  routeStyles,", "  cssLoading,", ...(options.copyChunks === true ? ["  copyChunks,"] : []), ...(backendImport !== undefined ? ["  api: inProcessClient(backend),"] : []), `  title: ${JSON.stringify(title)},`, 
     // Core's own `{ header }` trust, so the mounted backend and every loader see the derived caller.
     ...(clientIpHeader !== undefined
         ? [`  server: { clientIp: { header: ${JSON.stringify(clientIpHeader)} } },`]
@@ -1026,27 +1089,132 @@ export function generateServerEntry(options) {
     lines.push("// The client bundle and public files live next to this entry; serve only manifest-approved paths.", 'const STATIC_ROOT = new URL("./", import.meta.url)', `const PUBLIC_FILES = new Set(${JSON.stringify(publicFiles)})`, ...(hashedFiles !== undefined
         ? [`const HASHED_FILES = new Set(${JSON.stringify(hashedFiles)})`]
         : []), "const staticPath = (pathname: string): string | undefined => {", "  if (PUBLIC_FILES.has(pathname)) return '.' + pathname", '  if (!pathname.startsWith("/assets/")) return undefined', '  const segments = pathname.slice(1).split("/")', "  // `.` and `..` match the character class, and the path is joined onto a base URL that resolves", "  // dot segments - so they are rejected explicitly rather than relying on the request URL having", "  // been normalized upstream.", "  const safe = (segment: string): boolean =>", '    segment !== "." && segment !== ".." && /^[A-Za-z0-9._-]+$/.test(segment)', "  return segments.every(safe) ? '.' + pathname : undefined", "}", 
-    // The type table and cache policy `servePublicDir` uses. Without a known type, Bun answers a file
-    // as an `application/octet-stream` attachment, which a browser downloads instead of showing.
-    `const TYPES: Record<string, string> = ${JSON.stringify(CONTENT_TYPES)}`, "const staticHeaders = (pathname: string): Record<string, string> => ({", '  "content-type": TYPES[pathname.slice(pathname.lastIndexOf(".")).toLowerCase()] ?? "application/octet-stream",', `  "cache-control": ${hashedFiles !== undefined ? "HASHED_FILES.has(pathname)" : 'pathname.startsWith("/assets/")'} ? ${JSON.stringify(IMMUTABLE)} : ${JSON.stringify(ONE_DAY)},`, '  "x-content-type-options": "nosniff",', "})");
+    // The handler `nifra dev` serves public/ with: its type table, nosniff and cache policy, HEAD
+    // answered without reading the file, byte ranges and conditional requests, and a descriptor opened
+    // only once the real path is inside the root, so a link planted in the deployed tree cannot reach
+    // a file outside it.
+    ...(nodeFs
+        ? [
+            "const serveStatic = servePublicDir({",
+            "  dir: fileURLToPath(STATIC_ROOT),",
+            ...(hashedFiles !== undefined ? ["  hashedFiles: HASHED_FILES,"] : []),
+            "})",
+            "const staticResponse = async (req: Request): Promise<Response> =>",
+            '  (await serveStatic(req)) ?? new Response("not found", { status: 404 })',
+        ]
+        : denoStaticResponse(hashedFiles !== undefined)));
     // Bun.serve and Deno.serve delimit the body themselves, so its declared length is the transport
     // frame - the guarantee core's own listen() and the Deno adapter mark (see markTrustedBodyFraming).
     const markFramed = '(req as unknown as Record<symbol, unknown>)[Symbol.for("nifra.body.trustedFraming")] = true';
     if (target === "bun") {
-        lines.push("const server = Bun.serve({", "  port: Number(Bun.env.PORT ?? 3000),", "  async fetch(req, server) {", "    const { pathname } = new URL(req.url)", "    const filePath = staticPath(pathname)", "    if (filePath !== undefined) {", "      const file = Bun.file(new URL(filePath, STATIC_ROOT))", '      if (!(await file.exists())) return new Response("not found", { status: 404 })', "      return new Response(file, { headers: staticHeaders(pathname) })", "    }", `    ${markFramed}`, "    // The socket peer, looked up only when something reads it (as core's own listen() does).", "    return app.fetch(req, { get clientIp() { return server.requestIP(req)?.address } })", "  },", "})", 
+        lines.push("const server = Bun.serve({", "  port: Number(Bun.env.PORT ?? 3000),", "  async fetch(req, server) {", "    const { pathname } = new URL(req.url)", 
+        // Braced: the next emitted line opens with `(`, which would otherwise call the returned value.
+        "    if (staticPath(pathname) !== undefined) {", "      return staticResponse(req)", "    }", `    ${markFramed}`, "    // The socket peer, looked up only when something reads it (as core's own listen() does).", "    return app.fetch(req, { get clientIp() { return server.requestIP(req)?.address } })", "  },", "})", 
         // The `${...}` here is literal OUTPUT (a template in the GENERATED file), not a template in this
         // source - split so biome's noTemplateCurlyInString doesn't flag it; the emitted line is unchanged.
         `console.log(\`nifra (Bun) → http://localhost:$${"{server.port}"}\`)`);
         return `${lines.join("\n")}\n`;
     }
     if (target === "node") {
-        lines.push('import { readFile } from "node:fs/promises"', "await serve(", "  {", "    async fetch(req, platform) {", "      const { pathname } = new URL(req.url)", "      const filePath = staticPath(pathname)", "      if (filePath !== undefined) {", "        try {", "          const body = await readFile(new URL(filePath, STATIC_ROOT))", "          return new Response(body, { headers: staticHeaders(pathname) })", "        } catch {", '          return new Response("not found", { status: 404 })', "        }", "      }", "      return app.fetch(req, platform)", "    },", "  },", "  { port: Number(process.env.PORT ?? 3000) },", ")");
+        lines.push("await serve(", "  {", "    async fetch(req, platform) {", "      const { pathname } = new URL(req.url)", "      if (staticPath(pathname) !== undefined) return staticResponse(req)", "      return app.fetch(req, platform)", "    },", "  },", "  { port: Number(process.env.PORT ?? 3000) },", ")");
         return `${lines.join("\n")}\n`;
     }
     // deno
-    lines.push("// @ts-ignore - Deno global is present on the Deno runtime this output targets.", 'Deno.serve({ port: Number(Deno.env.get("PORT") ?? "3000") }, async (req, info) => {', "  const { pathname } = new URL(req.url)", "  const filePath = staticPath(pathname)", "  if (filePath !== undefined) {", "    try {", "      // @ts-ignore - Deno.readFile is present on the Deno runtime.", "      const body = await Deno.readFile(new URL(filePath, STATIC_ROOT))", "      return new Response(body, { headers: staticHeaders(pathname) })", "    } catch {", '      return new Response("not found", { status: 404 })', "    }", "  }", `  ${markFramed}`, "  return app.fetch(req, { clientIp: info.remoteAddr.hostname })", "})");
+    lines.push("// @ts-ignore - Deno global is present on the Deno runtime this output targets.", 'Deno.serve({ port: Number(Deno.env.get("PORT") ?? "3000") }, async (req, info) => {', "  const { pathname } = new URL(req.url)", "  const filePath = staticPath(pathname)", "  if (filePath !== undefined) {", "    return staticResponse(req, filePath, pathname)", "  }", `  ${markFramed}`, "  return app.fetch(req, { clientIp: info.remoteAddr.hostname })", "})");
     return `${lines.join("\n")}\n`;
 }
+/**
+ * The Deno entry's static handler: `servePublicDir`'s checks on Deno's file API. The real path must sit
+ * inside the root and cross no hidden segment, and the opened file must still be the one that path
+ * names, so a link planted in the deployed tree cannot reach a file outside it or a `.env` inside it.
+ * HEAD answers from `stat` without reading; one byte range is served from a seek, several as the
+ * whole file.
+ */
+function denoStaticResponse(hashed) {
+    return [
+        `const TYPES: Record<string, string> = ${JSON.stringify(CONTENT_TYPES)}`,
+        "const staticHeaders = (pathname: string): Record<string, string> => ({",
+        '  "content-type": TYPES[pathname.slice(pathname.lastIndexOf(".")).toLowerCase()] ?? "application/octet-stream",',
+        `  "cache-control": ${hashed ? "HASHED_FILES.has(pathname)" : 'pathname.startsWith("/assets/")'} ? ${JSON.stringify(IMMUTABLE)} : ${JSON.stringify(ONE_DAY)},`,
+        '  "x-content-type-options": "nosniff",',
+        '  "accept-ranges": "bytes",',
+        "})",
+        "// @ts-ignore - Deno global is present on the Deno runtime this output targets.",
+        "const STATIC_REAL: string = await Deno.realPath(STATIC_ROOT)",
+        "const hiddenSegment = (rel: string): boolean =>",
+        '  rel.split(/[\\\\/]/).some((segment) => segment.startsWith(".") && segment !== ".well-known")',
+        "const staticResponse = async (req: Request, filePath: string, pathname: string): Promise<Response> => {",
+        '  const missing = () => new Response("not found", { status: 404 })',
+        '  if (req.method !== "GET" && req.method !== "HEAD") return missing()',
+        "  let file, info",
+        "  try {",
+        "    // @ts-ignore - Deno global is present on the Deno runtime this output targets.",
+        "    const real: string = await Deno.realPath(new URL(filePath, STATIC_ROOT))",
+        '    if (!real.startsWith(STATIC_REAL + (STATIC_REAL.includes("\\\\") ? "\\\\" : "/"))) return missing()',
+        "    if (hiddenSegment(real.slice(STATIC_REAL.length + 1))) return missing()",
+        "    // @ts-ignore - Deno global is present on the Deno runtime this output targets.",
+        "    file = await Deno.open(real)",
+        "    // Deno.open follows links, so a directory swapped for one after the check above redirects it.",
+        "    // The opened file must be the one at `real`, which must still resolve to itself.",
+        "    const opened = await file.stat()",
+        "    // @ts-ignore - Deno global is present on the Deno runtime this output targets.",
+        "    const named = await Deno.stat(real)",
+        "    // @ts-ignore - Deno global is present on the Deno runtime this output targets.",
+        "    if (opened.dev !== named.dev || opened.ino !== named.ino || (await Deno.realPath(real)) !== real) {",
+        "      file.close()",
+        "      return missing()",
+        "    }",
+        "    info = opened",
+        "  } catch {",
+        "    file?.close()",
+        "    return missing()",
+        "  }",
+        "  const size: number = info.size",
+        "  const headers = new Headers(staticHeaders(pathname))",
+        '  const range = req.method === "GET" ? parseByteRange(req.headers.get("range"), size) : { kind: "none" as const }',
+        '  if (!info.isFile || req.method === "HEAD" || range.kind === "unsatisfiable") {',
+        "    file.close()",
+        "    if (!info.isFile) return missing()",
+        '    if (range.kind !== "unsatisfiable") {',
+        '      headers.set("content-length", String(size))',
+        "      return new Response(null, { headers })",
+        "    }",
+        '    headers.delete("content-type")',
+        '    headers.set("content-range", "bytes */" + size)',
+        "    return new Response(null, { status: 416, headers })",
+        "  }",
+        '  if (range.kind === "satisfiable" && range.ranges.length === 1) {',
+        "    const { start, end } = range.ranges[0]!",
+        "    // @ts-ignore - Deno global is present on the Deno runtime this output targets.",
+        "    await file.seek(start, Deno.SeekMode.Start)",
+        "    let left = end - start + 1",
+        '    headers.set("content-range", "bytes " + start + "-" + end + "/" + size)',
+        '    headers.set("content-length", String(left))',
+        "    const body = new ReadableStream<Uint8Array>({",
+        "      async pull(controller) {",
+        "        const chunk = new Uint8Array(Math.min(left, 65_536))",
+        "        const read: number | null = await file.read(chunk)",
+        "        if (read === null || read === 0) {",
+        "          file.close()",
+        "          controller.close()",
+        "          return",
+        "        }",
+        "        controller.enqueue(chunk.subarray(0, read))",
+        "        left -= read",
+        "        if (left <= 0) {",
+        "          file.close()",
+        "          controller.close()",
+        "        }",
+        "      },",
+        "      cancel: () => file.close(),",
+        "    })",
+        "    return new Response(body, { status: 206, headers })",
+        "  }",
+        '  headers.set("content-length", String(size))',
+        "  return new Response(file.readable, { headers })",
+        "}",
+    ];
+}
 /** Measure each emitted output file's raw + gzip size. Reads the file off disk and gzips it with
  * `Bun.gzipSync` (the over-the-wire weight). Async only because it reads files; the aggregation is the
  * pure {@link aggregateSizeReport}. */
@@ -1103,6 +1271,7 @@ export const bunBundler = {
         target: input.target,
         ...(input.styles !== undefined ? { styles: input.styles } : {}),
         ...(input.routeStyles !== undefined ? { routeStyles: input.routeStyles } : {}),
+        ...(input.copyChunks !== undefined ? { copyChunks: input.copyChunks } : {}),
         ...(input.plugins ? { plugins: input.plugins } : {}),
         ...(input.define ? { define: input.define } : {}),
         ...(input.cssLoading !== undefined ? { cssLoading: input.cssLoading } : {}),
@@ -1126,6 +1295,36 @@ function assertNoPublicCollision(plan, publicFiles, outDir) {
             `build's own output in ${outDir}. Rename or move them out of the public directory.`);
     }
 }
+/** Prerender a self-hosting build's opted-in routes into `dir` and return the pages its server may
+ * answer from their file: those whose render was not specific to its request. */
+async function prerenderForServer(prerenderApp, client, routesDir, dir, publicFiles, secrets) {
+    const owned = `/${PRERENDERED_DIR}/`;
+    const clashes = publicFiles.filter((file) => file.toLowerCase().startsWith(owned));
+    if (clashes.length > 0) {
+        throw new Error(`[nifra/web] public file(s) ${clashes.join(", ")} sit under ${owned}, where the build writes its ` +
+            "prerendered pages. Rename or move them out of the public directory.");
+    }
+    let result;
+    try {
+        result = await prerenderRoutes({
+            app: await prerenderApp(client),
+            routes: discoverRoutes(routesDir).routes,
+            outDir: dir,
+            secrets,
+        });
+    }
+    catch (error) {
+        // Prerendering loads every route module at build time, which a server build never needed before:
+        // one that cannot load there (a connection opened on import, an env var only production sets) costs
+        // the speedup, not the build. A secret in a page still fails it.
+        if (error instanceof SecretScanError)
+            throw error;
+        rmSync(dir, { recursive: true, force: true });
+        console.warn(`[nifra/web] prerendering failed, so the server renders every page on demand: ${error instanceof Error ? error.message : String(error)}`);
+        return {};
+    }
+    return servablePrerenderedPages(result.prerendered);
+}
 /** Build a full deploy dir for `target` using the default Bun bundler. See {@link buildTargetWith}. */
 export async function buildTarget(target, options) {
     return buildTargetWith(target, options, bunBundler);
@@ -1208,6 +1407,12 @@ export async function buildTargetWith(target, options, bundler) {
     if (requestedCssLoading !== undefined || publicFiles.length > 0) {
         writeFileSync(`${assetsDir}/manifest.json`, JSON.stringify(client, null, 2));
     }
+    // A self-hosting server answers its prerendered pages from their file. The static target is all
+    // prerendered pages; the edge targets keep rendering them on demand.
+    const prerenderedPages = options.prerenderApp !== undefined &&
+        (targetPlan.target === "bun" || targetPlan.target === "node")
+        ? await prerenderForServer(options.prerenderApp, client, routesDir, `${staticRoot}/${PRERENDERED_DIR}`, publicFiles, secretScan)
+        : undefined;
     if (targetPlan.kind === "static") {
         if (options.prerenderApp === undefined) {
             throw new Error("[nifra/web] buildTarget(static) requires `prerenderApp` (a factory `(client) => createWebApp`)");
@@ -1253,6 +1458,8 @@ export async function buildTargetWith(target, options, bundler) {
         ...(publicFiles.length > 0 ? { publicFiles } : {}),
         hashedFiles: client.assets,
         ...(options.clientIp !== undefined ? { clientIp: options.clientIp } : {}),
+        ...(client.copyChunks !== undefined ? { copyChunks: true } : {}),
+        ...(prerenderedPages !== undefined ? { prerenderedPages } : {}),
     }));
     const { worker } = await bundler.buildServer({
         routesDir,
@@ -1262,6 +1469,7 @@ export async function buildTargetWith(target, options, bundler) {
         target: targetPlan.serverTarget,
         ...(client.css !== undefined ? { styles: client.css } : {}),
         ...(client.routeStyles !== undefined ? { routeStyles: client.routeStyles } : {}),
+        ...(client.copyChunks !== undefined ? { copyChunks: client.copyChunks } : {}),
         ...(options.serverPlugins ? { plugins: options.serverPlugins } : {}),
         define: { "process.env.NODE_ENV": '"production"', ...(options.define ?? {}) },
         ...(client.cssLoading !== undefined