@nifrajs/web 5.3.0 → 5.4.0

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # @nifrajs/web
 
+## 5.4.0
+
+### Patch Changes
+
+- e7d43ca: On Bun, `servePublicDir` now sends `content-length` for files up to 1 MiB, whole or ranged. This covers the Bun server entry and `nifra dev`. `Bun.serve` drops the declared length of a stream body and sends it chunked, so these files used to arrive with no length: no download progress, and caches and proxies could not size them. They are now read whole through the already-open file, as files up to 256 KiB already were, which serves a 1 MiB file about a third faster. Files above 1 MiB still stream, and Bun still sends them chunked. Node and Deno keep a stream's length and are unchanged.
+- 5183c00: The server entry `buildTarget` generates for `deno` now answers static files with the validators the Bun and Node entries send:
+  
+  - an `etag` and `last-modified`, and a `304` with no body for a current copy, HEAD included.
+  - `Range` honored only when `If-Range` is absent or names the file's current validator; anything else gets the whole file.
+  - a link is typed by the file it resolves to, as on Bun and Node.
+  
+  `@nifrajs/core/static-file` holds the comparisons `servePublicDir`, the Deno entry and `@nifrajs/node`'s `static` reader now share.
+- e589893: The server entry `buildTarget` generates for `node` now passes the app itself to `@nifrajs/node`'s `serve` and serves files with the adapter's own reader. The entry needs the `@nifrajs/node` of the same release, so a `node` build with an older one installed stops before bundling, names both versions and leaves the last deploy dir in place. A 5.3 adapter used to build cleanly and then throw when the server started. It used to wrap `app.fetch` in a plain `{ fetch }` handler. That wrapper hid the node-direct lane, so every page built an undici `Request` and drained a `Response`, and every file went through one too. The entry mounts `/assets` and, at the root, only the `public/` files the build copied, with the same type, cache, range, HEAD and hidden-file answers the Bun entry gives.
+  
+  `serve`'s `static` option on `@nifrajs/node`:
+  
+  - takes an array of mounts; a path goes to the first mount that takes it, by its prefix and, when set, its `files`.
+  - `files` lists the only URL paths a mount serves; any other path passes to the next mount, then the app, without that mount touching the disk.
+  - `cacheControl` sets `cache-control` for files not served immutable.
+  - types files from the same table as `servePublicDir`, so `.pdf`, `.mp4`, `.xml`, `.csv` and other common types are no longer sent as `application/octet-stream`; a link is typed by the file it resolves to.
+  - serves `/.well-known` by default, as `servePublicDir` does, and refuses a visible name that links to a dotfile.
+  - answers a link that leaves the directory with `404`, the same as a missing file, instead of `403`.
+  - sends files up to 256 KiB, and HEAD, `304` and `416` answers, in one write with no `Response` or stream.
+  
+  `@nifrajs/core/static-file` exports `CONTENT_TYPES`, `contentTypeOf` and `isHiddenPath`, which both readers now use.
+- 02ac072: Static files on Bun and Deno evaluate `If-None-Match` before `If-Modified-Since`, including the wildcard condition for an existing file. A stale entity tag can no longer produce a `304` from its accompanying date.
+- 529f8d2: Static files are tagged by their content on every self-hosting entry: `servePublicDir` (the Bun entry and `nifra dev`), `@nifrajs/node`'s `static` reader and the generated Deno entry. Each sends a strong `ETag` of 128 bits of the file's SHA-256, the same for the same bytes on every instance and runtime. A replacement that keeps a file's size and modification time (`cp -p`, `rsync -a`, tar, a container image layer, SOURCE_DATE_EPOCH, the Nix store's 1 s) is no longer answered with a `304` for the old copy, and a resumed download is no longer spliced from two versions. The Node reader's `"<mtime>-<size>"` tag is gone; the Bun and Deno entries send a tag for the first time.
+  
+  - A tag is remembered per process for the file version it was read from (device, inode, size, mtime and ctime), so a known file costs no extra read. The first request for a file reads it once, and a file within the buffered size is then served from those bytes. Concurrent first requests share one read. A file changed in the last 2 s is read again until its ctime settles. A file over 256 MiB (`CONTENT_TAG_MAX`) is tagged by that identity instead: still strong, but different on each instance.
+  - `Last-Modified` is sent only while the file's mtime is the time of its own last change (within 1 s of its ctime). A file whose mtime a copy or build set, such as every file in a container image, is sent without it, so `If-Modified-Since` cannot validate it.
+  - An `If-Range` date no longer keeps a range for a file with a strong tag; a client resumes by the tag. On Node a configured strong `ETag` likewise sends the whole file for a date, while a configured weak one still lets a configured `Last-Modified` resume by its exact date.
+  - `@nifrajs/core/static-file` exports `contentTags`, `CONTENT_TAG_MAX`, `lastModifiedOf` and `isNotModified`, the `If-None-Match` and `If-Modified-Since` check all three readers share. `ifRangeAllowsPartial` now takes the file's tag.
+- Updated dependencies [5183c00]
+- Updated dependencies [01b97ec]
+- Updated dependencies [e589893]
+- Updated dependencies [ff66db6]
+- Updated dependencies [529f8d2]
+  - @nifrajs/core@5.4.0
+  - @nifrajs/island-trigger@5.4.0
+
 ## 5.3.0
 
 ### Minor Changes

package/dist/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAyB3D,OAAO,EAAE,KAAK,SAAS,EAAQ,MAAM,KAAK,CAAA;AAC1C,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,WAAW,EAEhB,KAAK,OAAO,EAaZ,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,KAAK,cAAc,EAA8C,MAAM,mBAAmB,CAAA;AAEnG,OAAO,EAAuB,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAUxE,OAAO,EACL,KAAK,qBAAqB,EAE3B,MAAM,iCAAiC,CAAA;AAGxC,OAAO,EAQL,KAAK,eAAe,EAIrB,MAAM,2BAA2B,CAAA;AAyBlC,cAAc,iBAAiB,CAAA;AA+B/B,YAAY,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AAE5E,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAG5E,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,EACjC,qBAAqB,EACrB,WAAW,EACX,WAAW,EACX,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,eAAe,GAChB,MAAM,gBAAgB,CAAA;AAEvB,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,gGAAgG;IAChG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IAC3C,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,qFAAqF;IACrF,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,oGAAoG;IACpG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;IACnC;;;;;;;;uCAQmC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IACtD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAC7B;AAiBD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,mGAAmG;IACnG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AA2DD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,SAAS,MAAM,EAAE;AAC9B;;;;GAIG;AACH,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,oBAAoB,CAgCtB;AAED,8FAA8F;AAC9F;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsB/E;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,EACtD,YAAY,EAAE,MAAM,GACnB,MAAM,CAYR;AAED;;;;;;GAMG;AACH;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC,CAmYrF;AAED,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;kHAC8G;IAC9G,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;0FACsF;IACtF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;oEAEgE;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;IAC/C,0GAA0G;IAC1G,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,SAAS,CAAA;IAC9E,sGAAsG;IACtG,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAClE,oGAAoG;IACpG,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAA;IACpC;gFAC4E;IAC5E,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IAC3C;wFACoF;IACpF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;gEAC4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC;kCAC8B;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC;+FAC2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB;;;;6BAIyB;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,KAAK,CAAA;IAC5C;;;;2GAIuG;IACvG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IACvB,iGAAiG;IACjG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB;gGAC4F;IAC5F,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;8CAC0C;IAC1C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAClC;AA+BD,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,KAAG,SAc/C,CAAA;AAcF,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,SAchD,CAAA;AAGF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,SAgDhD,CAAA;AAuFF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAEzD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,QAAO,SAWpC,CAAA;AAqBF;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAiHnF;AAWD,sGAAsG;AACtG,eAAO,MAAM,oBAAoB,sEAOvB,CAAA;AACV,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAA;AACrE,oFAAoF;AACpF,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;AAE3F;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAA;AAgB5C;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAC3C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,mGAAmG;IACnG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;mDAC+C;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;0BACsB;IACtB,QAAQ,CAAC,aAAa,CAAC,EAAE,wBAAwB,CAAA;IACjD,mDAAmD;IACnD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,gFAAgF;IAChF,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC;kGAC8F;IAC9F,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,yGAAyG;IACzG,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IACvC,+FAA+F;IAC/F,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B;oFACgF;IAChF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAA;CAC5E,GAAG,MAAM,CAkOT;AA+GD,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;wEAEoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;2FACuF;IACvF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,uGAAuG;IACvG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,sGAAsG;IACtG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;oCAEgC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;8GAC0G;IAC1G,QAAQ,CAAC,aAAa,CAAC,EAAE,wBAAwB,CAAA;IACjD;;;;;;4DAMwD;IACxD,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC/F,iEAAiE;IACjE,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IAC7C,oDAAoD;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IAC7C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,gFAAgF;IAChF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;IACnC,4FAA4F;IAC5F,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,oGAAoG;IACpG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IACtD;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAA;IACpC,yDAAyD;IACzD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB;+FAC2F;IAC3F,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CACxC;AAED,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClD;AAED,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,sCAAsC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB;kCAC8B;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,iFAAiF;AACjF,eAAO,MAAM,UAAU,EAAE,OAsCxB,CAAA;AAgED,uGAAuG;AACvG,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAE5B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CA8N5B"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AA0B3D,OAAO,EAAE,KAAK,SAAS,EAAQ,MAAM,KAAK,CAAA;AAC1C,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,WAAW,EAEhB,KAAK,OAAO,EAaZ,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,KAAK,cAAc,EAA8C,MAAM,mBAAmB,CAAA;AAEnG,OAAO,EAAuB,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAWxE,OAAO,EACL,KAAK,qBAAqB,EAE3B,MAAM,iCAAiC,CAAA;AAGxC,OAAO,EAQL,KAAK,eAAe,EAIrB,MAAM,2BAA2B,CAAA;AAyBlC,cAAc,iBAAiB,CAAA;AA+B/B,YAAY,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AAE5E,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAG5E,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,EACjC,qBAAqB,EACrB,WAAW,EACX,WAAW,EACX,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,eAAe,GAChB,MAAM,gBAAgB,CAAA;AAEvB,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,gGAAgG;IAChG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IAC3C,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,qFAAqF;IACrF,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,oGAAoG;IACpG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;IACnC;;;;;;;;uCAQmC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IACtD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAC7B;AAiBD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,mGAAmG;IACnG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AA2DD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,SAAS,MAAM,EAAE;AAC9B;;;;GAIG;AACH,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,oBAAoB,CAgCtB;AAED,8FAA8F;AAC9F;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsB/E;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,EACtD,YAAY,EAAE,MAAM,GACnB,MAAM,CAYR;AAED;;;;;;GAMG;AACH;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC,CAmYrF;AAED,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;kHAC8G;IAC9G,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;0FACsF;IACtF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;oEAEgE;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;IAC/C,0GAA0G;IAC1G,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,SAAS,CAAA;IAC9E,sGAAsG;IACtG,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAClE,oGAAoG;IACpG,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAA;IACpC;gFAC4E;IAC5E,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IAC3C;wFACoF;IACpF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;gEAC4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACvC;kCAC8B;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC;+FAC2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB;;;;6BAIyB;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,KAAK,CAAA;IAC5C;;;;2GAIuG;IACvG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IACvB,iGAAiG;IACjG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB;gGAC4F;IAC5F,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;8CAC0C;IAC1C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAClC;AA+BD,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,KAAG,SAc/C,CAAA;AAcF,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,SAchD,CAAA;AAGF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,SAgDhD,CAAA;AAuFF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAEzD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,QAAO,SAWpC,CAAA;AAqBF;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAiHnF;AAWD,sGAAsG;AACtG,eAAO,MAAM,oBAAoB,sEAOvB,CAAA;AACV,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAA;AACrE,oFAAoF;AACpF,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;AAE3F;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAA;AAgB5C;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAC3C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,mGAAmG;IACnG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;mDAC+C;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;0BACsB;IACtB,QAAQ,CAAC,aAAa,CAAC,EAAE,wBAAwB,CAAA;IACjD,mDAAmD;IACnD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,gFAAgF;IAChF,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC;kGAC8F;IAC9F,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,yGAAyG;IACzG,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IACvC,+FAA+F;IAC/F,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B;oFACgF;IAChF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAA;CAC5E,GAAG,MAAM,CAkPT;AAkLD,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;wEAEoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;2FACuF;IACvF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,uGAAuG;IACvG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,sGAAsG;IACtG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;oCAEgC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;8GAC0G;IAC1G,QAAQ,CAAC,aAAa,CAAC,EAAE,wBAAwB,CAAA;IACjD;;;;;;4DAMwD;IACxD,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC/F,iEAAiE;IACjE,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IAC7C,oDAAoD;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IAC7C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,gFAAgF;IAChF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;IACnC,4FAA4F;IAC5F,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,oGAAoG;IACpG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IACtD;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAA;IACpC,yDAAyD;IACzD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB;+FAC2F;IAC3F,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CACxC;AAED,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClD;AAED,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,sCAAsC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB;kCAC8B;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,iFAAiF;AACjF,eAAO,MAAM,UAAU,EAAE,OAsCxB,CAAA;AAgED,uGAAuG;AACvG,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAE5B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CAmO5B"}

package/dist/build.js

@@ -11,6 +11,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync
 import { cp, lstat, mkdir, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, join, basename as pathBasename, posix, relative, resolve as resolvePath, sep, } from "node:path";
 import { singleCopyPlugin as declaredSingleCopyPlugin, readSingleCopyDeclaration, } from "@nifrajs/core/single-copy";
+import { isHiddenPath } from "@nifrajs/core/static-file";
 import { Glob } from "bun";
 import { aggregateSizeReport, detectNodeBuiltinsInClient, detectServerOnlyInClient, formatNodeBuiltinLeak, formatServerOnlyLeak, parseBuildTarget, parseManifestClientEntry, parseManifestCopyChunks, parseManifestCssLoading, parseManifestRouteStyles, parseManifestStyles, planBuildTarget, } from "./build-plan.js";
 import { sanitizeOutputNames } from "./chunk-names.js";
@@ -21,10 +22,11 @@ import { loadCopySplit } from "./internal/copy-split.js";
 import { assertDisposableDir } from "./internal/disposable-dir.js";
 import { entryChunks } from "./internal/entry-chunks.js";
 import { dedupePolicyFor } from "./internal/identity-policy.js";
+import { nodeAdapterRefusal } from "./internal/node-adapter.js";
 import { assertDevelopmentProductionParity, assertIdentityParity, collectDevelopmentParityInput, } from "./internal/parity.js";
 import { servablePrerenderedPages, } from "./internal/prerendered-pages.js";
 import { privateEnvCheck } from "./internal/private-env.js";
-import { isHiddenPublicPath, publicUrlPath } from "./internal/public-url.js";
+import { publicUrlPath } from "./internal/public-url.js";
 import { assertNoSecrets, buildEnvironment, emittedScanFiles, formatSecretFindings, graphScanInput, originName, publicScanFiles, SecretScanError, scanForSecrets, textOf, } from "./internal/secret-scan.js";
 import { generateServerFnStub, SERVER_FN_MODULE, serverFnNamespace, } from "./internal/server-boundary.js";
 import { formatUnsupportedBuiltins, unsupportedBuiltins } from "./internal/target-compat.js";
@@ -34,7 +36,7 @@ import { assertNoImportGlob, importGlobPlugin } from "./plugins/import-glob.js";
 import { zoneGuardPlugin } from "./plugins/zone-guard.js";
 // `buildTarget(static)` drives the SSG prerender engine directly (it's also re-exported below).
 import { prerenderRoutes } from "./prerender.js";
-import { CONTENT_TYPES, IMMUTABLE, ONE_DAY } from "./public-dir.js";
+import { IMMUTABLE, ONE_DAY } from "./public-dir.js";
 import { createZoneClassifier } from "./zones.js";
 export * from "./build-plan.js";
 const basename = (path) => pathBasename(path);
@@ -180,7 +182,7 @@ export async function copyPublicDir(from, to) {
     const sourceReal = await realpath(source);
     const copied = [];
     for await (const rel of new Glob("**/*").scan({ cwd: source, dot: true, onlyFiles: false })) {
-        if (isHiddenPublicPath(rel))
+        if (isHiddenPath(rel))
             continue;
         const candidate = join(source, rel);
         const candidateStat = await lstat(candidate);
@@ -1023,20 +1025,20 @@ export function generateServerEntry(options) {
     if (target === "static") {
         throw new Error("[nifra/web] generateServerEntry: `static` has no server entry (SSG only)");
     }
-    // Bun and Node serve the client bundle through `servePublicDir`. Deno bundles for the browser
-    // condition, where `node:fs` is a stub, so its entry runs the same checks on Deno's own file API.
+    // Bun serves the client bundle through `servePublicDir` and Node through @nifrajs/node's own reader,
+    // both on core's static-file policy. Deno bundles for the browser condition, where `node:fs` is a
+    // stub, so its entry runs the same checks on Deno's own file API.
     const nodeFs = target === "bun" || target === "node";
     const prerendered = Object.entries(options.prerenderedPages ?? {});
     if (prerendered.length > 0 && !nodeFs) {
         throw new Error(`[nifra/web] generateServerEntry: prerendered pages are served by the bun and node targets, not ${target}`);
     }
-    const lines = [
-        !nodeFs
-            ? 'import { createWebApp } from "@nifrajs/web"'
-            : prerendered.length > 0
-                ? 'import { createWebApp, prerenderedPageReader, servePublicDir } from "@nifrajs/web"'
-                : 'import { createWebApp, servePublicDir } from "@nifrajs/web"',
-    ];
+    const webImports = ["createWebApp"];
+    if (prerendered.length > 0)
+        webImports.push("prerenderedPageReader");
+    if (target === "bun")
+        webImports.push("servePublicDir");
+    const lines = [`import { ${webImports.join(", ")} } from "@nifrajs/web"`];
     if (backendImport !== undefined)
         lines.push('import { inProcessClient } from "@nifrajs/client"');
     lines.push(`import { adapter } from ${JSON.stringify(adapterImport)}`);
@@ -1058,8 +1060,9 @@ export function generateServerEntry(options) {
         lines.push('import { serve } from "@nifrajs/node"');
     if (nodeFs)
         lines.push('import { fileURLToPath } from "node:url"');
-    if (target === "deno")
-        lines.push('import { parseByteRange } from "@nifrajs/core/range"');
+    if (target === "deno") {
+        lines.push('import { parseByteRange } from "@nifrajs/core/range"', 'import { contentTags, contentTypeOf, ifRangeAllowsPartial, isHiddenPath, isNotModified, lastModifiedOf } from "@nifrajs/core/static-file"', 'import { createHash } from "node:crypto"');
+    }
     if (prerendered.length > 0) {
         const headers = Object.fromEntries(prerendered.map(([path, page]) => [path, page.headers]));
         const files = Object.fromEntries(prerendered.map(([path, page]) => [path, page.file]));
@@ -1088,12 +1091,19 @@ export function generateServerEntry(options) {
     // bun / node / deno self-host AND serve the client bundle from disk (it sits next to this entry).
     lines.push("// The client bundle and public files live next to this entry; serve only manifest-approved paths.", 'const STATIC_ROOT = new URL("./", import.meta.url)', `const PUBLIC_FILES = new Set(${JSON.stringify(publicFiles)})`, ...(hashedFiles !== undefined
         ? [`const HASHED_FILES = new Set(${JSON.stringify(hashedFiles)})`]
-        : []), "const staticPath = (pathname: string): string | undefined => {", "  if (PUBLIC_FILES.has(pathname)) return '.' + pathname", '  if (!pathname.startsWith("/assets/")) return undefined', '  const segments = pathname.slice(1).split("/")', "  // `.` and `..` match the character class, and the path is joined onto a base URL that resolves", "  // dot segments - so they are rejected explicitly rather than relying on the request URL having", "  // been normalized upstream.", "  const safe = (segment: string): boolean =>", '    segment !== "." && segment !== ".." && /^[A-Za-z0-9._-]+$/.test(segment)', "  return segments.every(safe) ? '.' + pathname : undefined", "}", 
-    // The handler `nifra dev` serves public/ with: its type table, nosniff and cache policy, HEAD
-    // answered without reading the file, byte ranges and conditional requests, and a descriptor opened
-    // only once the real path is inside the root, so a link planted in the deployed tree cannot reach
-    // a file outside it.
-    ...(nodeFs
+        : []));
+    if (target === "node") {
+        // The app itself with the adapter's own reader, not a `{ fetch }` wrapper around app.fetch: the
+        // wrapper hid the node-direct lane, so every page built an undici Request and drained a Response,
+        // and every file went through one too. The root mount serves only the files the build listed.
+        lines.push("await serve(app, {", "  port: Number(process.env.PORT ?? 3000),", "  static: [", "    {", '      dir: fileURLToPath(new URL("./assets/", import.meta.url)),', '      prefix: "/assets",', ...(hashedFiles !== undefined ? ["      hashedFiles: HASHED_FILES,"] : []), `      cacheControl: ${JSON.stringify(ONE_DAY)},`, "    },", "    {", "      dir: fileURLToPath(STATIC_ROOT),", '      prefix: "/",', "      files: PUBLIC_FILES,", "      immutable: false,", `      cacheControl: ${JSON.stringify(ONE_DAY)},`, "    },", "  ],", "})");
+        return `${lines.join("\n")}\n`;
+    }
+    lines.push("const staticPath = (pathname: string): string | undefined => {", "  if (PUBLIC_FILES.has(pathname)) return '.' + pathname", '  if (!pathname.startsWith("/assets/")) return undefined', '  const segments = pathname.slice(1).split("/")', "  // `.` and `..` match the character class, and the path is joined onto a base URL that resolves", "  // dot segments - so they are rejected explicitly rather than relying on the request URL having", "  // been normalized upstream.", "  const safe = (segment: string): boolean =>", '    segment !== "." && segment !== ".." && /^[A-Za-z0-9._-]+$/.test(segment)', "  return segments.every(safe) ? '.' + pathname : undefined", "}", 
+    // The handler `nifra dev` serves public/ with: its type table, nosniff and cache policy, content
+    // tags, byte ranges and conditional requests, and a descriptor opened only once the real path is
+    // inside the root, so a link planted in the deployed tree cannot reach a file outside it.
+    ...(target === "bun"
         ? [
             "const serveStatic = servePublicDir({",
             "  dir: fileURLToPath(STATIC_ROOT),",
@@ -1115,43 +1125,44 @@ export function generateServerEntry(options) {
         `console.log(\`nifra (Bun) → http://localhost:$${"{server.port}"}\`)`);
         return `${lines.join("\n")}\n`;
     }
-    if (target === "node") {
-        lines.push("await serve(", "  {", "    async fetch(req, platform) {", "      const { pathname } = new URL(req.url)", "      if (staticPath(pathname) !== undefined) return staticResponse(req)", "      return app.fetch(req, platform)", "    },", "  },", "  { port: Number(process.env.PORT ?? 3000) },", ")");
-        return `${lines.join("\n")}\n`;
-    }
     // deno
     lines.push("// @ts-ignore - Deno global is present on the Deno runtime this output targets.", 'Deno.serve({ port: Number(Deno.env.get("PORT") ?? "3000") }, async (req, info) => {', "  const { pathname } = new URL(req.url)", "  const filePath = staticPath(pathname)", "  if (filePath !== undefined) {", "    return staticResponse(req, filePath, pathname)", "  }", `  ${markFramed}`, "  return app.fetch(req, { clientIp: info.remoteAddr.hostname })", "})");
     return `${lines.join("\n")}\n`;
 }
 /**
- * The Deno entry's static handler: `servePublicDir`'s checks on Deno's file API. The real path must sit
- * inside the root and cross no hidden segment, and the opened file must still be the one that path
- * names, so a link planted in the deployed tree cannot reach a file outside it or a `.env` inside it.
- * HEAD answers from `stat` without reading; one byte range is served from a seek, several as the
- * whole file.
+ * The Deno entry's static handler: `servePublicDir`'s checks and answers on Deno's file API. The real
+ * path must sit inside the root and cross no hidden segment, and the opened file must still be the one
+ * that path names, so a link planted in the deployed tree cannot reach a file outside it or a `.env`
+ * inside it. The file is typed by its real path, tagged by its content and dated only by an mtime its
+ * own last write set, through the same policy as servePublicDir: a current cached copy is a 304, and a
+ * range survives only an `If-Range` naming that tag. A file is read once to tag it, and one small
+ * enough is then served from those bytes; otherwise one byte range is served from a seek, several as
+ * the whole file.
  */
 function denoStaticResponse(hashed) {
     return [
-        `const TYPES: Record<string, string> = ${JSON.stringify(CONTENT_TYPES)}`,
-        "const staticHeaders = (pathname: string): Record<string, string> => ({",
-        '  "content-type": TYPES[pathname.slice(pathname.lastIndexOf(".")).toLowerCase()] ?? "application/octet-stream",',
+        "const staticHeaders = (pathname: string, file: string): Record<string, string> => ({",
+        '  "content-type": contentTypeOf(file),',
         `  "cache-control": ${hashed ? "HASHED_FILES.has(pathname)" : 'pathname.startsWith("/assets/")'} ? ${JSON.stringify(IMMUTABLE)} : ${JSON.stringify(ONE_DAY)},`,
         '  "x-content-type-options": "nosniff",',
         '  "accept-ranges": "bytes",',
         "})",
         "// @ts-ignore - Deno global is present on the Deno runtime this output targets.",
         "const STATIC_REAL: string = await Deno.realPath(STATIC_ROOT)",
-        "const hiddenSegment = (rel: string): boolean =>",
-        '  rel.split(/[\\\\/]/).some((segment) => segment.startsWith(".") && segment !== ".well-known")',
+        "// One per process: the tag of a file is remembered by its real path.",
+        "const STATIC_TAGS = contentTags(createHash)",
+        "// Up to this many bytes are read whole to tag a file, and the response is then served from them.",
+        "const STATIC_INLINE_MAX = 256 * 1024",
         "const staticResponse = async (req: Request, filePath: string, pathname: string): Promise<Response> => {",
         '  const missing = () => new Response("not found", { status: 404 })',
         '  if (req.method !== "GET" && req.method !== "HEAD") return missing()',
         "  let file, info",
+        '  let real = ""',
         "  try {",
         "    // @ts-ignore - Deno global is present on the Deno runtime this output targets.",
-        "    const real: string = await Deno.realPath(new URL(filePath, STATIC_ROOT))",
+        "    real = await Deno.realPath(new URL(filePath, STATIC_ROOT))",
         '    if (!real.startsWith(STATIC_REAL + (STATIC_REAL.includes("\\\\") ? "\\\\" : "/"))) return missing()',
-        "    if (hiddenSegment(real.slice(STATIC_REAL.length + 1))) return missing()",
+        "    if (isHiddenPath(real.slice(STATIC_REAL.length + 1))) return missing()",
         "    // @ts-ignore - Deno global is present on the Deno runtime this output targets.",
         "    file = await Deno.open(real)",
         "    // Deno.open follows links, so a directory swapped for one after the check above redirects it.",
@@ -1169,12 +1180,61 @@ function denoStaticResponse(hashed) {
         "    file?.close()",
         "    return missing()",
         "  }",
+        "  if (!info.isFile) {",
+        "    file.close()",
+        "    return missing()",
+        "  }",
         "  const size: number = info.size",
-        "  const headers = new Headers(staticHeaders(pathname))",
-        '  const range = req.method === "GET" ? parseByteRange(req.headers.get("range"), size) : { kind: "none" as const }',
-        '  if (!info.isFile || req.method === "HEAD" || range.kind === "unsatisfiable") {',
+        "  const headers = new Headers(staticHeaders(pathname, real))",
+        "  // Deno reports a field the platform does not keep as null; NaN never matches a remembered version.",
+        "  const version = {",
+        "    dev: info.dev,",
+        "    ino: info.ino ?? Number.NaN,",
+        "    size,",
+        "    mtimeMs: info.mtime?.getTime() ?? Number.NaN,",
+        "    ctimeMs: info.ctime?.getTime() ?? Number.NaN,",
+        "  }",
+        "  let whole: Uint8Array<ArrayBuffer> | undefined",
+        "  let moved = false",
+        "  let etag: string | undefined",
+        "  try {",
+        "    etag = STATIC_TAGS.cached(real, version)",
+        "    if (etag === undefined && size <= STATIC_INLINE_MAX) {",
+        "      whole = new Uint8Array(size)",
+        "      let filled = 0",
+        "      while (filled < size) {",
+        "        const read: number | null = await file.read(whole.subarray(filled))",
+        "        if (read === null || read === 0) break",
+        "        filled += read",
+        "      }",
+        "      if (filled < size) whole = whole.subarray(0, filled)",
+        "      etag = STATIC_TAGS.ofBytes(real, version, whole)",
+        "    }",
+        "    etag ??= await STATIC_TAGS.ofFile(real, version, async (bytes: Uint8Array, position: number) => {",
+        "      moved = true",
+        "      // @ts-ignore - Deno global is present on the Deno runtime this output targets.",
+        "      await file.seek(position, Deno.SeekMode.Start)",
+        "      return (await file.read(bytes)) ?? 0",
+        "    })",
+        "  } catch {",
+        "    file.close()",
+        "    return missing()",
+        "  }",
+        '  if (etag !== undefined) headers.set("etag", etag)',
+        "  const lastModified = lastModifiedOf(version)",
+        '  if (lastModified !== undefined) headers.set("last-modified", new Date(lastModified).toUTCString())',
+        '  if (isNotModified(req.headers.get("if-none-match"), req.headers.get("if-modified-since"), etag, lastModified)) {',
+        "    file.close()",
+        '    headers.delete("content-type")',
+        "    return new Response(null, { status: 304, headers })",
+        "  }",
+        '  const rangeHeader = req.method === "GET" ? req.headers.get("range") : null',
+        "  const range =",
+        '    rangeHeader !== null && ifRangeAllowsPartial(req.headers.get("if-range"), etag, lastModified)',
+        "      ? parseByteRange(rangeHeader, size)",
+        '      : { kind: "none" as const }',
+        '  if (req.method === "HEAD" || range.kind === "unsatisfiable") {',
         "    file.close()",
-        "    if (!info.isFile) return missing()",
         '    if (range.kind !== "unsatisfiable") {',
         '      headers.set("content-length", String(size))',
         "      return new Response(null, { headers })",
@@ -1185,10 +1245,16 @@ function denoStaticResponse(hashed) {
         "  }",
         '  if (range.kind === "satisfiable" && range.ranges.length === 1) {',
         "    const { start, end } = range.ranges[0]!",
+        '    headers.set("content-range", "bytes " + start + "-" + end + "/" + size)',
+        "    if (whole !== undefined) {",
+        "      file.close()",
+        "      const part = whole.subarray(start, end + 1)",
+        '      headers.set("content-length", String(part.byteLength))',
+        "      return new Response(part, { status: 206, headers })",
+        "    }",
         "    // @ts-ignore - Deno global is present on the Deno runtime this output targets.",
         "    await file.seek(start, Deno.SeekMode.Start)",
         "    let left = end - start + 1",
-        '    headers.set("content-range", "bytes " + start + "-" + end + "/" + size)',
         '    headers.set("content-length", String(left))',
         "    const body = new ReadableStream<Uint8Array>({",
         "      async pull(controller) {",
@@ -1210,6 +1276,13 @@ function denoStaticResponse(hashed) {
         "    })",
         "    return new Response(body, { status: 206, headers })",
         "  }",
+        "  if (whole !== undefined) {",
+        "    file.close()",
+        '    headers.set("content-length", String(whole.byteLength))',
+        "    return new Response(whole, { headers })",
+        "  }",
+        "  // @ts-ignore - Deno global is present on the Deno runtime this output targets.",
+        "  if (moved) await file.seek(0, Deno.SeekMode.Start)",
         '  headers.set("content-length", String(size))',
         "  return new Response(file.readable, { headers })",
         "}",
@@ -1350,6 +1423,12 @@ export async function buildTargetWith(target, options, bundler) {
     ];
     assertDisposableDir("outDir", outDir, sources);
     assertDisposableDir("workDir", workDir, sources);
+    // Before anything is cleared, so a refused build leaves the last deploy dir in place.
+    if (targetPlan.target === "node") {
+        const refusal = nodeAdapterRefusal(workDir);
+        if (refusal !== undefined)
+            throw new Error(refusal);
+    }
     const { rmSync } = await import("node:fs");
     rmSync(outDir, { recursive: true, force: true });
     rmSync(workDir, { recursive: true, force: true });