@nifrajs/web 5.3.0 → 5.5.0

package/src/build.ts

@@ -1,3 +1,4 @@
+import { formatBuildLog } from "./diagnostic.ts"
 import { publicEnvDefines } from "./internal/public-env.ts"
 
 export { publicEnvDefines } from "./internal/public-env.ts"
@@ -25,6 +26,7 @@ import {
   singleCopyPlugin as declaredSingleCopyPlugin,
   readSingleCopyDeclaration,
 } from "@nifrajs/core/single-copy"
+import { isHiddenPath } from "@nifrajs/core/static-file"
 import { type BunPlugin, Glob } from "bun"
 import {
   aggregateSizeReport,
@@ -32,12 +34,14 @@ import {
   type BuildTarget,
   type BuildTargetPlan,
   type Bundler,
+  buildAssetPaths,
   type ChunkSize,
   detectNodeBuiltinsInClient,
   detectServerOnlyInClient,
   formatNodeBuiltinLeak,
   formatServerOnlyLeak,
   parseBuildTarget,
+  parseManifestBuildAssets,
   parseManifestClientEntry,
   parseManifestCopyChunks,
   parseManifestCssLoading,
@@ -51,10 +55,12 @@ import { sanitizeOutputNames } from "./chunk-names.ts"
 import { type CssLoadingMode, normalizeCssCodeSplit, normalizeCssLoading } from "./css-contract.ts"
 import { discoverRoutes } from "./fs.ts"
 import { generateClientEntry, generateServerManifest } from "./index.ts"
+import { missingClientEntry } from "./internal/codegen.ts"
 import { loadCopySplit } from "./internal/copy-split.ts"
 import { assertDisposableDir } from "./internal/disposable-dir.ts"
 import { entryChunks } from "./internal/entry-chunks.ts"
 import { dedupePolicyFor } from "./internal/identity-policy.ts"
+import { nodeAdapterRefusal } from "./internal/node-adapter.ts"
 import {
   assertDevelopmentProductionParity,
   assertIdentityParity,
@@ -65,7 +71,7 @@ import {
   servablePrerenderedPages,
 } from "./internal/prerendered-pages.ts"
 import { privateEnvCheck } from "./internal/private-env.ts"
-import { isHiddenPublicPath, publicUrlPath } from "./internal/public-url.ts"
+import { publicUrlPath } from "./internal/public-url.ts"
 import {
   assertNoSecrets,
   buildEnvironment,
@@ -100,7 +106,7 @@ import { assertNoImportGlob, importGlobPlugin } from "./plugins/import-glob.ts"
 import { zoneGuardPlugin } from "./plugins/zone-guard.ts"
 // `buildTarget(static)` drives the SSG prerender engine directly (it's also re-exported below).
 import { type PrerenderOptions, prerenderRoutes } from "./prerender.ts"
-import { CONTENT_TYPES, IMMUTABLE, ONE_DAY } from "./public-dir.ts"
+import { IMMUTABLE, ONE_DAY } from "./public-dir.ts"
 import { createZoneClassifier } from "./zones.ts"
 
 export * from "./build-plan.ts"
@@ -360,7 +366,7 @@ export async function copyPublicDir(from: string, to: string): Promise<string[]>
   const sourceReal = await realpath(source)
   const copied: string[] = []
   for await (const rel of new Glob("**/*").scan({ cwd: source, dot: true, onlyFiles: false })) {
-    if (isHiddenPublicPath(rel)) continue
+    if (isHiddenPath(rel)) continue
     const candidate = join(source, rel)
     const candidateStat = await lstat(candidate)
     if (candidateStat.isSymbolicLink()) {
@@ -394,6 +400,7 @@ export function resyncServerManifestSource(
 ): string {
   const cssLoading = parseManifestCssLoading(source)
   const copyChunks = parseManifestCopyChunks(source)
+  const buildAssets = parseManifestBuildAssets(source)
   return generateServerManifest(manifest, {
     resolve: (file) => `${routesPrefix}${file}`,
     clientEntry: parseManifestClientEntry(source) ?? "",
@@ -401,6 +408,7 @@ export function resyncServerManifestSource(
     routeStyles: parseManifestRouteStyles(source),
     ...(cssLoading !== undefined ? { cssLoading } : {}),
     ...(copyChunks !== undefined ? { copyChunks } : {}),
+    ...(buildAssets !== undefined ? { buildAssets } : {}),
     lazy: MANIFEST_IS_LAZY.test(source),
   })
 }
@@ -567,7 +575,7 @@ export async function buildClient(options: BuildClientOptions): Promise<BuildMan
     if (verdict !== undefined) throw new Error(verdict)
     if (refused.size > 0) throw new Error(formatRefusedFiles(refused, root))
     throw new Error(
-      `[nifra/web] client build failed:\n${result.logs.map((l) => String(l)).join("\n")}`,
+      `[nifra/web] client build failed:\n${result.logs.map((l) => formatBuildLog(l, root)).join("\n")}`,
     )
   }
 
@@ -814,9 +822,16 @@ export interface BuildServerOptions {
   readonly serverEntry: string
   /** Output directory for the bundled worker (absolute path). */
   readonly outDir: string
+  /**
+   * The manifest `buildClient` returned. Supplies {@link clientEntry}, {@link styles},
+   * {@link routeStyles}, {@link copyChunks} and {@link buildAssets} at once, so none can be forgotten
+   * (a forgotten `styles` ships unstyled pages); an option given explicitly still wins.
+   */
+  readonly client?: BuildManifest
   /** The content-hashed client entry URL (from `buildClient`'s manifest) - **baked** into the generated
-   * server manifest, since a disk-less worker can't read `manifest.json` at runtime. */
-  readonly clientEntry: string
+   * server manifest, since a disk-less worker can't read `manifest.json` at runtime. Required unless
+   * {@link client} is given. */
+  readonly clientEntry?: string
   /** The app's aggregate stylesheet URLs (`buildClient`'s `BuildManifest.css`) - baked into the generated
    * manifest so the server entry hands them to `createWebApp` (→ `<link rel="stylesheet">`). Omit ⇒ no CSS
    * link (the built SSR page would otherwise render unstyled). */
@@ -825,6 +840,12 @@ export interface BuildServerOptions {
   readonly routeStyles?: Readonly<Record<string, readonly string[]>> | undefined
   /** Copy chunk URLs by locale (`buildClient`'s `BuildManifest.copyChunks`) - baked as `copyChunks`. */
   readonly copyChunks?: Readonly<Record<string, string>> | undefined
+  /**
+   * Every file the build emitted, by request path (`buildClient`'s `assets` plus its `publicFiles`):
+   * baked as `buildAssets` and `isBuildAsset(pathname)` for a host policy or a hand-written static
+   * handler. Defaults from {@link client}; without either, the manifest exports neither name.
+   */
+  readonly buildAssets?: readonly string[] | undefined
   /** How framework-owned stylesheet links should activate before hydration (default `"blocking"`). */
   readonly cssLoading?: CssLoadingMode
   /** Route/layout file → import specifier in the generated manifest (default: a relative path from the
@@ -1096,6 +1117,12 @@ function formatRefusedFiles(refused: ReadonlyMap<string, string>, root: string):
   return `[nifra/web] the browser build reached code that may not ship to a browser:\n${lines.join("\n")}`
 }
 
+export {
+  checkHostReach,
+  type HostReachOptions,
+  type HostReachReport,
+  type HostReachResult,
+} from "./host-reach.ts"
 export { importGlobPlugin } from "./plugins/import-glob.ts"
 export { zoneGuardPlugin } from "./plugins/zone-guard.ts"
 
@@ -1151,7 +1178,26 @@ const solidWebServerPlugin = (from: string): BunPlugin => ({
  * silently ships a broken worker.
  */
 export async function buildServer(options: BuildServerOptions): Promise<ServerBuild> {
-  const { routesDir, serverEntry, outDir, clientEntry, styles, routeStyles, cssLoading } = options
+  const { routesDir, serverEntry, outDir, client } = options
+  if (
+    client !== undefined &&
+    (typeof client !== "object" ||
+      client === null ||
+      typeof client.entry !== "string" ||
+      !Array.isArray(client.assets))
+  ) {
+    throw new TypeError(
+      "[nifra/web] buildServer `client` must be the manifest buildClient returned ({ entry, assets, ... })",
+    )
+  }
+  const clientEntry = options.clientEntry ?? client?.entry
+  if (clientEntry === undefined) throw missingClientEntry(clientEntry)
+  const styles = options.styles ?? client?.css
+  const routeStyles = options.routeStyles ?? client?.routeStyles
+  const copyChunks = options.copyChunks ?? client?.copyChunks
+  const cssLoading = options.cssLoading ?? client?.cssLoading
+  const buildAssets =
+    options.buildAssets ?? (client === undefined ? undefined : buildAssetPaths(client))
   const entryDir = dirname(serverEntry)
   const manifestFile = options.manifestFile ?? "server-manifest.ts"
   // Default: import routes relative from the generated manifest (next to serverEntry) to routesDir.
@@ -1176,7 +1222,8 @@ export async function buildServer(options: BuildServerOptions): Promise<ServerBu
       styles,
       routeStyles,
       ...(cssLoading !== undefined ? { cssLoading } : {}),
-      ...(options.copyChunks !== undefined ? { copyChunks: options.copyChunks } : {}),
+      ...(copyChunks !== undefined ? { copyChunks } : {}),
+      ...(buildAssets !== undefined ? { buildAssets } : {}),
       lazy,
     }),
   )
@@ -1212,8 +1259,9 @@ export async function buildServer(options: BuildServerOptions): Promise<ServerBu
     ],
   })
   if (!result.success) {
+    const root = resolvePath(options.root ?? dirname(routesDir))
     throw new Error(
-      `[nifra/web] server build failed:\n${result.logs.map((l) => String(l)).join("\n")}`,
+      `[nifra/web] server build failed:\n${result.logs.map((l) => formatBuildLog(l, root)).join("\n")}`,
     )
   }
   // Named as the metafile names outputs: relative to `outdir`.
@@ -1282,6 +1330,7 @@ export const SERVER_ENTRY_OPTIONS = [
   "csp",
   "nonce",
   "i18n",
+  "hostPolicy",
 ] as const
 export type ServerEntryOption = (typeof SERVER_ENTRY_OPTIONS)[number]
 /** Each importable option mapped to the specifier of the module that exports it. */
@@ -1306,6 +1355,13 @@ const PLATFORM_CLIENT_IP_HEADERS: Readonly<Partial<Record<BuildTarget, string>>>
   vercel: "x-real-ip",
 }
 
+// A static path a host's policy refuses is not answered from disk: it falls through to the app, whose
+// own copy of the policy refuses it the same way it refuses a page.
+const HOST_ALLOWS_STATIC =
+  ' && hostPolicy.allows(request.headers.get("host") ?? "", pathname, buildAssets)'
+const NODE_STATIC_ALLOW =
+  "      allow: (host: string, pathname: string) => hostPolicy.allows(host, pathname, buildAssets),"
+
 /** Where a self-hosting build writes its prerendered pages, beside `server.js`. */
 const PRERENDERED_DIR = "_prerendered"
 
@@ -1379,8 +1435,9 @@ export function generateServerEntry(options: {
   if (target === "static") {
     throw new Error("[nifra/web] generateServerEntry: `static` has no server entry (SSG only)")
   }
-  // Bun and Node serve the client bundle through `servePublicDir`. Deno bundles for the browser
-  // condition, where `node:fs` is a stub, so its entry runs the same checks on Deno's own file API.
+  // Bun serves the client bundle through `servePublicDir` and Node through @nifrajs/node's own reader,
+  // both on core's static-file policy. Deno bundles for the browser condition, where `node:fs` is a
+  // stub, so its entry runs the same checks on Deno's own file API.
   const nodeFs = target === "bun" || target === "node"
   const prerendered = Object.entries(options.prerenderedPages ?? {})
   if (prerendered.length > 0 && !nodeFs) {
@@ -1388,13 +1445,10 @@ export function generateServerEntry(options: {
       `[nifra/web] generateServerEntry: prerendered pages are served by the bun and node targets, not ${target}`,
     )
   }
-  const lines: string[] = [
-    !nodeFs
-      ? 'import { createWebApp } from "@nifrajs/web"'
-      : prerendered.length > 0
-        ? 'import { createWebApp, prerenderedPageReader, servePublicDir } from "@nifrajs/web"'
-        : 'import { createWebApp, servePublicDir } from "@nifrajs/web"',
-  ]
+  const webImports = ["createWebApp"]
+  if (prerendered.length > 0) webImports.push("prerenderedPageReader")
+  if (target === "bun") webImports.push("servePublicDir")
+  const lines: string[] = [`import { ${webImports.join(", ")} } from "@nifrajs/web"`]
   if (backendImport !== undefined) lines.push('import { inProcessClient } from "@nifrajs/client"')
   lines.push(`import { adapter } from ${JSON.stringify(adapterImport)}`)
   if (useImport !== undefined) lines.push(`import { use } from ${JSON.stringify(useImport)}`)
@@ -1404,16 +1458,29 @@ export function generateServerEntry(options: {
   if (backendImport !== undefined) {
     lines.push(`import { backend } from ${JSON.stringify(backendImport)}`)
   }
-  lines.push(
-    options.copyChunks === true
-      ? 'import { clientEntry, copyChunks, cssLoading, manifest, styles, routeStyles } from "./server-manifest"'
-      : 'import { clientEntry, cssLoading, manifest, styles, routeStyles } from "./server-manifest"',
-  )
+  // A host policy is checked before the static files too, which takes the build's own file set.
+  const hostPolicy = importedOptions.includes("hostPolicy")
+  const manifestImports = [
+    ...(hostPolicy ? ["buildAssets"] : []),
+    "clientEntry",
+    ...(options.copyChunks === true ? ["copyChunks"] : []),
+    "cssLoading",
+    "manifest",
+    "styles",
+    "routeStyles",
+  ]
+  lines.push(`import { ${manifestImports.join(", ")} } from "./server-manifest"`)
   // Cloudflare needs the fetch-handler shape; the others call app.fetch directly.
   if (target === "cloudflare") lines.push('import { toFetchHandler } from "@nifrajs/core/server"')
   if (target === "node") lines.push('import { serve } from "@nifrajs/node"')
   if (nodeFs) lines.push('import { fileURLToPath } from "node:url"')
-  if (target === "deno") lines.push('import { parseByteRange } from "@nifrajs/core/range"')
+  if (target === "deno") {
+    lines.push(
+      'import { parseByteRange } from "@nifrajs/core/range"',
+      'import { CONTENT_SNAPSHOT_MAX, contentTags, contentTypeOf, ifRangeAllowsPartial, isHiddenPath, isNotModified, lastModifiedOf, streamedLastModifiedOf } from "@nifrajs/core/static-file"',
+      'import { createHash } from "node:crypto"',
+    )
+  }
   if (prerendered.length > 0) {
     const headers = Object.fromEntries(prerendered.map(([path, page]) => [path, page.headers]))
     const files = Object.fromEntries(prerendered.map(([path, page]) => [path, page.file]))
@@ -1436,6 +1503,7 @@ export function generateServerEntry(options: {
     ...(useImport !== undefined ? ["  use,"] : []),
     ...(prerendered.length > 0 ? ["  prerenderedPages,"] : []),
     ...importedOptions.map((name) => `  ${name},`),
+    ...(hostPolicy ? ["  buildAssets,"] : []),
     "  manifest,",
     "  clientEntry,",
     "  styles,",
@@ -1468,7 +1536,7 @@ export function generateServerEntry(options: {
       "  fetch(request: Request, env: Assets, ctx: ExecutionContext) {",
       "    const { pathname } = new URL(request.url)",
       "    // Only the build's own outputs: the hashed bundle prefix and the files it copied.",
-      '    if (env?.ASSETS !== undefined && (pathname.startsWith("/assets/") || PUBLIC_FILES.has(pathname))) {',
+      `    if (env?.ASSETS !== undefined && (pathname.startsWith("/assets/") || PUBLIC_FILES.has(pathname))${hostPolicy ? HOST_ALLOWS_STATIC : ""}) {`,
       "      return env.ASSETS.fetch(request)",
       "    }",
       "    return handler.fetch(request, env as never, ctx)",
@@ -1494,6 +1562,36 @@ export function generateServerEntry(options: {
     ...(hashedFiles !== undefined
       ? [`const HASHED_FILES = new Set(${JSON.stringify(hashedFiles)})`]
       : []),
+  )
+  if (target === "node") {
+    // The app itself with the adapter's own reader, not a `{ fetch }` wrapper around app.fetch: the
+    // wrapper hid the node-direct lane, so every page built an undici Request and drained a Response,
+    // and every file went through one too. The root mount serves only the files the build listed.
+    lines.push(
+      "await serve(app, {",
+      "  port: Number(process.env.PORT ?? 3000),",
+      "  static: [",
+      "    {",
+      '      dir: fileURLToPath(new URL("./assets/", import.meta.url)),',
+      '      prefix: "/assets",',
+      ...(hashedFiles !== undefined ? ["      hashedFiles: HASHED_FILES,"] : []),
+      `      cacheControl: ${JSON.stringify(ONE_DAY)},`,
+      ...(hostPolicy ? [NODE_STATIC_ALLOW] : []),
+      "    },",
+      "    {",
+      "      dir: fileURLToPath(STATIC_ROOT),",
+      '      prefix: "/",',
+      "      files: PUBLIC_FILES,",
+      "      immutable: false,",
+      `      cacheControl: ${JSON.stringify(ONE_DAY)},`,
+      ...(hostPolicy ? [NODE_STATIC_ALLOW] : []),
+      "    },",
+      "  ],",
+      "})",
+    )
+    return `${lines.join("\n")}\n`
+  }
+  lines.push(
     "const staticPath = (pathname: string): string | undefined => {",
     "  if (PUBLIC_FILES.has(pathname)) return '.' + pathname",
     '  if (!pathname.startsWith("/assets/")) return undefined',
@@ -1505,11 +1603,10 @@ export function generateServerEntry(options: {
     '    segment !== "." && segment !== ".." && /^[A-Za-z0-9._-]+$/.test(segment)',
     "  return segments.every(safe) ? '.' + pathname : undefined",
     "}",
-    // The handler `nifra dev` serves public/ with: its type table, nosniff and cache policy, HEAD
-    // answered without reading the file, byte ranges and conditional requests, and a descriptor opened
-    // only once the real path is inside the root, so a link planted in the deployed tree cannot reach
-    // a file outside it.
-    ...(nodeFs
+    // The handler `nifra dev` serves public/ with: its type table, nosniff and cache policy, content
+    // tags, byte ranges and conditional requests, and a descriptor opened only once the real path is
+    // inside the root, so a link planted in the deployed tree cannot reach a file outside it.
+    ...(target === "bun"
       ? [
           "const serveStatic = servePublicDir({",
           "  dir: fileURLToPath(STATIC_ROOT),",
@@ -1531,7 +1628,7 @@ export function generateServerEntry(options: {
       "  async fetch(req, server) {",
       "    const { pathname } = new URL(req.url)",
       // Braced: the next emitted line opens with `(`, which would otherwise call the returned value.
-      "    if (staticPath(pathname) !== undefined) {",
+      `    if (staticPath(pathname) !== undefined${hostPolicy ? HOST_ALLOWS_STATIC.replaceAll("request", "req") : ""}) {`,
       "      return staticResponse(req)",
       "    }",
       `    ${markFramed}`,
@@ -1545,28 +1642,13 @@ export function generateServerEntry(options: {
     )
     return `${lines.join("\n")}\n`
   }
-  if (target === "node") {
-    lines.push(
-      "await serve(",
-      "  {",
-      "    async fetch(req, platform) {",
-      "      const { pathname } = new URL(req.url)",
-      "      if (staticPath(pathname) !== undefined) return staticResponse(req)",
-      "      return app.fetch(req, platform)",
-      "    },",
-      "  },",
-      "  { port: Number(process.env.PORT ?? 3000) },",
-      ")",
-    )
-    return `${lines.join("\n")}\n`
-  }
   // deno
   lines.push(
     "// @ts-ignore - Deno global is present on the Deno runtime this output targets.",
     'Deno.serve({ port: Number(Deno.env.get("PORT") ?? "3000") }, async (req, info) => {',
     "  const { pathname } = new URL(req.url)",
     "  const filePath = staticPath(pathname)",
-    "  if (filePath !== undefined) {",
+    `  if (filePath !== undefined${hostPolicy ? HOST_ALLOWS_STATIC.replaceAll("request", "req") : ""}) {`,
     "    return staticResponse(req, filePath, pathname)",
     "  }",
     `  ${markFramed}`,
@@ -1577,34 +1659,40 @@ export function generateServerEntry(options: {
 }
 
 /**
- * The Deno entry's static handler: `servePublicDir`'s checks on Deno's file API. The real path must sit
- * inside the root and cross no hidden segment, and the opened file must still be the one that path
- * names, so a link planted in the deployed tree cannot reach a file outside it or a `.env` inside it.
- * HEAD answers from `stat` without reading; one byte range is served from a seek, several as the
- * whole file.
+ * The Deno entry's static handler: `servePublicDir`'s checks and answers on Deno's file API. The real
+ * path must sit inside the root and cross no hidden segment, and the opened file must still be the one
+ * that path names, so a link planted in the deployed tree cannot reach a file outside it or a `.env`
+ * inside it. The file is typed by its real path, tagged by its content and dated only by an mtime its
+ * own last write set, through the same policy as servePublicDir: a current cached copy is a 304, and a
+ * range survives only an `If-Range` naming that tag. A file is read once to tag it, and one small
+ * enough is then served from those bytes; otherwise one byte range is served from a seek, several as
+ * the whole file.
  */
 function denoStaticResponse(hashed: boolean): string[] {
   return [
-    `const TYPES: Record<string, string> = ${JSON.stringify(CONTENT_TYPES)}`,
-    "const staticHeaders = (pathname: string): Record<string, string> => ({",
-    '  "content-type": TYPES[pathname.slice(pathname.lastIndexOf(".")).toLowerCase()] ?? "application/octet-stream",',
+    "const staticHeaders = (pathname: string, file: string): Record<string, string> => ({",
+    '  "content-type": contentTypeOf(file),',
     `  "cache-control": ${hashed ? "HASHED_FILES.has(pathname)" : 'pathname.startsWith("/assets/")'} ? ${JSON.stringify(IMMUTABLE)} : ${JSON.stringify(ONE_DAY)},`,
     '  "x-content-type-options": "nosniff",',
     '  "accept-ranges": "bytes",',
     "})",
     "// @ts-ignore - Deno global is present on the Deno runtime this output targets.",
     "const STATIC_REAL: string = await Deno.realPath(STATIC_ROOT)",
-    "const hiddenSegment = (rel: string): boolean =>",
-    '  rel.split(/[\\\\/]/).some((segment) => segment.startsWith(".") && segment !== ".well-known")',
+    "// One per process: the tag of a file is remembered by its real path.",
+    "// A stat costs Deno more than hashing a snapshot of up to 24 KiB, so only a larger one is restatted.",
+    "const STATIC_TAGS = contentTags(createHash, { rehashMax: 24 * 1024 })",
+    "// Up to this many bytes are read whole to tag a file, and the response is then served from them.",
+    "const STATIC_INLINE_MAX = CONTENT_SNAPSHOT_MAX",
     "const staticResponse = async (req: Request, filePath: string, pathname: string): Promise<Response> => {",
     '  const missing = () => new Response("not found", { status: 404 })',
     '  if (req.method !== "GET" && req.method !== "HEAD") return missing()',
     "  let file, info",
+    '  let real = ""',
     "  try {",
     "    // @ts-ignore - Deno global is present on the Deno runtime this output targets.",
-    "    const real: string = await Deno.realPath(new URL(filePath, STATIC_ROOT))",
+    "    real = await Deno.realPath(new URL(filePath, STATIC_ROOT))",
     '    if (!real.startsWith(STATIC_REAL + (STATIC_REAL.includes("\\\\") ? "\\\\" : "/"))) return missing()',
-    "    if (hiddenSegment(real.slice(STATIC_REAL.length + 1))) return missing()",
+    "    if (isHiddenPath(real.slice(STATIC_REAL.length + 1))) return missing()",
     "    // @ts-ignore - Deno global is present on the Deno runtime this output targets.",
     "    file = await Deno.open(real)",
     "    // Deno.open follows links, so a directory swapped for one after the check above redirects it.",
@@ -1622,12 +1710,60 @@ function denoStaticResponse(hashed: boolean): string[] {
     "    file?.close()",
     "    return missing()",
     "  }",
+    "  if (!info.isFile) {",
+    "    file.close()",
+    "    return missing()",
+    "  }",
     "  const size: number = info.size",
-    "  const headers = new Headers(staticHeaders(pathname))",
-    '  const range = req.method === "GET" ? parseByteRange(req.headers.get("range"), size) : { kind: "none" as const }',
-    '  if (!info.isFile || req.method === "HEAD" || range.kind === "unsatisfiable") {',
+    "  const headers = new Headers(staticHeaders(pathname, real))",
+    "  // Deno reports a field the platform does not keep as null; NaN never matches a remembered version.",
+    "  const versionOf = (stat: { dev: number; ino: number | null; size: number; mtime: Date | null; ctime: Date | null }) => ({",
+    "    dev: stat.dev,",
+    "    ino: stat.ino ?? Number.NaN,",
+    "    size: stat.size,",
+    "    mtimeMs: stat.mtime?.getTime() ?? Number.NaN,",
+    "    ctimeMs: stat.ctime?.getTime() ?? Number.NaN,",
+    "  })",
+    "  const version = versionOf(info)",
+    "  const snapshot = size <= STATIC_INLINE_MAX",
+    "  const lastModified = snapshot ? lastModifiedOf(version) : streamedLastModifiedOf(version)",
+    '  const ifNoneMatch = req.headers.get("if-none-match")',
+    '  const ifModifiedSince = req.headers.get("if-modified-since")',
+    "  let whole: Uint8Array<ArrayBuffer> | undefined",
+    "  // A HEAD or a 304 sends none of the file, so the tag remembered for this settled version",
+    "  // answers it from the stat alone: a write since that tag would show in the stat.",
+    "  let etag: string | undefined = snapshot ? STATIC_TAGS.cached(real, version) : undefined",
+    "  try {",
+    '    if (snapshot && (etag === undefined || !(req.method === "HEAD" || isNotModified(ifNoneMatch, ifModifiedSince, etag, lastModified)))) {',
+    "      whole = new Uint8Array(size)",
+    "      let filled = 0",
+    "      while (filled < size) {",
+    "        const read: number | null = await file.read(whole.subarray(filled))",
+    "        if (read === null || read === 0) break",
+    "        filled += read",
+    "      }",
+    "      if (filled < size) whole = whole.subarray(0, filled)",
+    "      etag = await STATIC_TAGS.ofSnapshot(real, version, whole, async () => versionOf(await file.stat()))",
+    "    }",
+    "  } catch {",
+    "    file.close()",
+    "    return missing()",
+    "  }",
+    '  if (etag !== undefined) headers.set("etag", etag)',
+    '  if (lastModified !== undefined) headers.set("last-modified", new Date(lastModified).toUTCString())',
+    "  if (isNotModified(ifNoneMatch, ifModifiedSince, etag, lastModified)) {",
+    "    file.close()",
+    '    headers.delete("content-type")',
+    "    return new Response(null, { status: 304, headers })",
+    "  }",
+    '  const rangeHeader = req.method === "GET" ? req.headers.get("range") : null',
+    "  const range =",
+    "  // A streamed body's date is weak: a write during the stream must never splice two versions.",
+    '    rangeHeader !== null && ifRangeAllowsPartial(req.headers.get("if-range"), etag, snapshot ? lastModified : undefined)',
+    "      ? parseByteRange(rangeHeader, size)",
+    '      : { kind: "none" as const }',
+    '  if (req.method === "HEAD" || range.kind === "unsatisfiable") {',
     "    file.close()",
-    "    if (!info.isFile) return missing()",
     '    if (range.kind !== "unsatisfiable") {',
     '      headers.set("content-length", String(size))',
     "      return new Response(null, { headers })",
@@ -1638,10 +1774,16 @@ function denoStaticResponse(hashed: boolean): string[] {
     "  }",
     '  if (range.kind === "satisfiable" && range.ranges.length === 1) {',
     "    const { start, end } = range.ranges[0]!",
+    '    headers.set("content-range", "bytes " + start + "-" + end + "/" + size)',
+    "    if (whole !== undefined) {",
+    "      file.close()",
+    "      const part = whole.subarray(start, end + 1)",
+    '      headers.set("content-length", String(part.byteLength))',
+    "      return new Response(part, { status: 206, headers })",
+    "    }",
     "    // @ts-ignore - Deno global is present on the Deno runtime this output targets.",
     "    await file.seek(start, Deno.SeekMode.Start)",
     "    let left = end - start + 1",
-    '    headers.set("content-range", "bytes " + start + "-" + end + "/" + size)',
     '    headers.set("content-length", String(left))',
     "    const body = new ReadableStream<Uint8Array>({",
     "      async pull(controller) {",
@@ -1663,6 +1805,11 @@ function denoStaticResponse(hashed: boolean): string[] {
     "    })",
     "    return new Response(body, { status: 206, headers })",
     "  }",
+    "  if (whole !== undefined) {",
+    "    file.close()",
+    '    headers.set("content-length", String(whole.byteLength))',
+    "    return new Response(whole, { headers })",
+    "  }",
     '  headers.set("content-length", String(size))',
     "  return new Response(file.readable, { headers })",
     "}",
@@ -1814,6 +1961,7 @@ export const bunBundler: Bundler = {
       ...(input.styles !== undefined ? { styles: input.styles } : {}),
       ...(input.routeStyles !== undefined ? { routeStyles: input.routeStyles } : {}),
       ...(input.copyChunks !== undefined ? { copyChunks: input.copyChunks } : {}),
+      ...(input.buildAssets !== undefined ? { buildAssets: input.buildAssets } : {}),
       ...(input.plugins ? { plugins: input.plugins as BunPlugin[] } : {}),
       ...(input.define ? { define: input.define } : {}),
       ...(input.cssLoading !== undefined ? { cssLoading: input.cssLoading } : {}),
@@ -1924,6 +2072,11 @@ export async function buildTargetWith(
   ]
   assertDisposableDir("outDir", outDir, sources)
   assertDisposableDir("workDir", workDir, sources)
+  // Before anything is cleared, so a refused build leaves the last deploy dir in place.
+  if (targetPlan.target === "node") {
+    const refusal = nodeAdapterRefusal(workDir)
+    if (refusal !== undefined) throw new Error(refusal)
+  }
   const { rmSync } = await import("node:fs")
   rmSync(outDir, { recursive: true, force: true })
   rmSync(workDir, { recursive: true, force: true })
@@ -2067,6 +2220,7 @@ export async function buildTargetWith(
     ...(client.css !== undefined ? { styles: client.css } : {}),
     ...(client.routeStyles !== undefined ? { routeStyles: client.routeStyles } : {}),
     ...(client.copyChunks !== undefined ? { copyChunks: client.copyChunks } : {}),
+    buildAssets: buildAssetPaths(client),
     ...(options.serverPlugins ? { plugins: options.serverPlugins } : {}),
     define: { "process.env.NODE_ENV": '"production"', ...(options.define ?? {}) },
     ...(client.cssLoading !== undefined
@@ -2085,10 +2239,16 @@ export async function buildTargetWith(
     cpSync(worker, `${outDir}/${targetPlan.outputFile}`)
     // The app's real patterns, so a directory is only collapsed into a glob once the route table
     // proves nothing can be served beneath it.
-    const rules = cloudflareRouteRules(
-      publicFiles,
-      discoverRoutes(routesDir).routes.map((route) => route.pattern),
-    )
+    // A host policy must see every file request, which Pages answers from the CDN before the worker
+    // when the path is excluded, so with one nothing is: each file costs an invocation, and the
+    // worker serves the allowed ones from ASSETS.
+    const rules =
+      options.optionImports?.hostPolicy === undefined
+        ? cloudflareRouteRules(
+            publicFiles,
+            discoverRoutes(routesDir).routes.map((route) => route.pattern),
+          )
+        : { include: ["/*"], exclude: [], omitted: [] }
     writeFileSync(
       `${outDir}/_routes.json`,
       `${JSON.stringify({ version: 1, include: rules.include, exclude: rules.exclude }, null, 2)}\n`,

package/src/deferred.ts

@@ -47,6 +47,20 @@ function isDeferred(value: unknown): value is Deferred<unknown> {
   )
 }
 
+/** `target[key] = value` runs the prototype setter for a `__proto__` key; define it as data instead. */
+function setOwn(target: Record<string, unknown>, key: string, value: unknown): void {
+  if (key === "__proto__") {
+    Object.defineProperty(target, key, {
+      value,
+      enumerable: true,
+      writable: true,
+      configurable: true,
+    })
+  } else {
+    target[key] = value
+  }
+}
+
 /**
  * Split a loader (or action) result into the **component-facing** data (deferred values carry their
  * assigned `id` + promise, for `<Await>`) and the **client-serializable** data (deferred values
@@ -113,8 +127,8 @@ export function prepareDeferred(
         const r = split(v)
         if (r === undefined) {
           if (fc !== undefined && cl !== undefined) {
-            fc[k] = v
-            cl[k] = v
+            setOwn(fc, k, v)
+            setOwn(cl, k, v)
           }
           continue
         }
@@ -125,12 +139,12 @@ export function prepareDeferred(
             if (!Object.hasOwn(input, prev)) continue
             if (prev === k) break
             const prevValue = input[prev]
-            fc[prev] = prevValue
-            cl[prev] = prevValue
+            setOwn(fc, prev, prevValue)
+            setOwn(cl, prev, prevValue)
           }
         }
-        fc[k] = r.fc
-        cl[k] = r.cl
+        setOwn(fc, k, r.fc)
+        setOwn(cl, k, r.cl)
       }
       return fc === undefined || cl === undefined ? undefined : { fc, cl }
     }