@nifrajs/web 5.3.0 → 5.5.0

package/dist/build.js

@@ -1,3 +1,4 @@
+import { formatBuildLog } from "./diagnostic.js";
 import { publicEnvDefines } from "./internal/public-env.js";
 export { publicEnvDefines } from "./internal/public-env.js";
 /**
@@ -11,20 +12,23 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync
 import { cp, lstat, mkdir, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, join, basename as pathBasename, posix, relative, resolve as resolvePath, sep, } from "node:path";
 import { singleCopyPlugin as declaredSingleCopyPlugin, readSingleCopyDeclaration, } from "@nifrajs/core/single-copy";
+import { isHiddenPath } from "@nifrajs/core/static-file";
 import { Glob } from "bun";
-import { aggregateSizeReport, detectNodeBuiltinsInClient, detectServerOnlyInClient, formatNodeBuiltinLeak, formatServerOnlyLeak, parseBuildTarget, parseManifestClientEntry, parseManifestCopyChunks, parseManifestCssLoading, parseManifestRouteStyles, parseManifestStyles, planBuildTarget, } from "./build-plan.js";
+import { aggregateSizeReport, buildAssetPaths, detectNodeBuiltinsInClient, detectServerOnlyInClient, formatNodeBuiltinLeak, formatServerOnlyLeak, parseBuildTarget, parseManifestBuildAssets, parseManifestClientEntry, parseManifestCopyChunks, parseManifestCssLoading, parseManifestRouteStyles, parseManifestStyles, planBuildTarget, } from "./build-plan.js";
 import { sanitizeOutputNames } from "./chunk-names.js";
 import { normalizeCssCodeSplit, normalizeCssLoading } from "./css-contract.js";
 import { discoverRoutes } from "./fs.js";
 import { generateClientEntry, generateServerManifest } from "./index.js";
+import { missingClientEntry } from "./internal/codegen.js";
 import { loadCopySplit } from "./internal/copy-split.js";
 import { assertDisposableDir } from "./internal/disposable-dir.js";
 import { entryChunks } from "./internal/entry-chunks.js";
 import { dedupePolicyFor } from "./internal/identity-policy.js";
+import { nodeAdapterRefusal } from "./internal/node-adapter.js";
 import { assertDevelopmentProductionParity, assertIdentityParity, collectDevelopmentParityInput, } from "./internal/parity.js";
 import { servablePrerenderedPages, } from "./internal/prerendered-pages.js";
 import { privateEnvCheck } from "./internal/private-env.js";
-import { isHiddenPublicPath, publicUrlPath } from "./internal/public-url.js";
+import { publicUrlPath } from "./internal/public-url.js";
 import { assertNoSecrets, buildEnvironment, emittedScanFiles, formatSecretFindings, graphScanInput, originName, publicScanFiles, SecretScanError, scanForSecrets, textOf, } from "./internal/secret-scan.js";
 import { generateServerFnStub, SERVER_FN_MODULE, serverFnNamespace, } from "./internal/server-boundary.js";
 import { formatUnsupportedBuiltins, unsupportedBuiltins } from "./internal/target-compat.js";
@@ -34,7 +38,7 @@ import { assertNoImportGlob, importGlobPlugin } from "./plugins/import-glob.js";
 import { zoneGuardPlugin } from "./plugins/zone-guard.js";
 // `buildTarget(static)` drives the SSG prerender engine directly (it's also re-exported below).
 import { prerenderRoutes } from "./prerender.js";
-import { CONTENT_TYPES, IMMUTABLE, ONE_DAY } from "./public-dir.js";
+import { IMMUTABLE, ONE_DAY } from "./public-dir.js";
 import { createZoneClassifier } from "./zones.js";
 export * from "./build-plan.js";
 const basename = (path) => pathBasename(path);
@@ -180,7 +184,7 @@ export async function copyPublicDir(from, to) {
     const sourceReal = await realpath(source);
     const copied = [];
     for await (const rel of new Glob("**/*").scan({ cwd: source, dot: true, onlyFiles: false })) {
-        if (isHiddenPublicPath(rel))
+        if (isHiddenPath(rel))
             continue;
         const candidate = join(source, rel);
         const candidateStat = await lstat(candidate);
@@ -211,6 +215,7 @@ export async function copyPublicDir(from, to) {
 export function resyncServerManifestSource(source, manifest, routesPrefix) {
     const cssLoading = parseManifestCssLoading(source);
     const copyChunks = parseManifestCopyChunks(source);
+    const buildAssets = parseManifestBuildAssets(source);
     return generateServerManifest(manifest, {
         resolve: (file) => `${routesPrefix}${file}`,
         clientEntry: parseManifestClientEntry(source) ?? "",
@@ -218,6 +223,7 @@ export function resyncServerManifestSource(source, manifest, routesPrefix) {
         routeStyles: parseManifestRouteStyles(source),
         ...(cssLoading !== undefined ? { cssLoading } : {}),
         ...(copyChunks !== undefined ? { copyChunks } : {}),
+        ...(buildAssets !== undefined ? { buildAssets } : {}),
         lazy: MANIFEST_IS_LAZY.test(source),
     });
 }
@@ -371,7 +377,7 @@ export async function buildClient(options) {
             throw new Error(verdict);
         if (refused.size > 0)
             throw new Error(formatRefusedFiles(refused, root));
-        throw new Error(`[nifra/web] client build failed:\n${result.logs.map((l) => String(l)).join("\n")}`);
+        throw new Error(`[nifra/web] client build failed:\n${result.logs.map((l) => formatBuildLog(l, root)).join("\n")}`);
     }
     const emitted = await Promise.all(result.outputs.map(async (out) => {
         if (out.kind === "sourcemap")
@@ -815,6 +821,7 @@ function formatRefusedFiles(refused, root) {
     });
     return `[nifra/web] the browser build reached code that may not ship to a browser:\n${lines.join("\n")}`;
 }
+export { checkHostReach, } from "./host-reach.js";
 export { importGlobPlugin } from "./plugins/import-glob.js";
 export { zoneGuardPlugin } from "./plugins/zone-guard.js";
 /**
@@ -864,7 +871,22 @@ const solidWebServerPlugin = (from) => ({
  * silently ships a broken worker.
  */
 export async function buildServer(options) {
-    const { routesDir, serverEntry, outDir, clientEntry, styles, routeStyles, cssLoading } = options;
+    const { routesDir, serverEntry, outDir, client } = options;
+    if (client !== undefined &&
+        (typeof client !== "object" ||
+            client === null ||
+            typeof client.entry !== "string" ||
+            !Array.isArray(client.assets))) {
+        throw new TypeError("[nifra/web] buildServer `client` must be the manifest buildClient returned ({ entry, assets, ... })");
+    }
+    const clientEntry = options.clientEntry ?? client?.entry;
+    if (clientEntry === undefined)
+        throw missingClientEntry(clientEntry);
+    const styles = options.styles ?? client?.css;
+    const routeStyles = options.routeStyles ?? client?.routeStyles;
+    const copyChunks = options.copyChunks ?? client?.copyChunks;
+    const cssLoading = options.cssLoading ?? client?.cssLoading;
+    const buildAssets = options.buildAssets ?? (client === undefined ? undefined : buildAssetPaths(client));
     const entryDir = dirname(serverEntry);
     const manifestFile = options.manifestFile ?? "server-manifest.ts";
     // Default: import routes relative from the generated manifest (next to serverEntry) to routesDir.
@@ -886,7 +908,8 @@ export async function buildServer(options) {
         styles,
         routeStyles,
         ...(cssLoading !== undefined ? { cssLoading } : {}),
-        ...(options.copyChunks !== undefined ? { copyChunks: options.copyChunks } : {}),
+        ...(copyChunks !== undefined ? { copyChunks } : {}),
+        ...(buildAssets !== undefined ? { buildAssets } : {}),
         lazy,
     }));
     const result = await Bun.build({
@@ -920,7 +943,8 @@ export async function buildServer(options) {
         ],
     });
     if (!result.success) {
-        throw new Error(`[nifra/web] server build failed:\n${result.logs.map((l) => String(l)).join("\n")}`);
+        const root = resolvePath(options.root ?? dirname(routesDir));
+        throw new Error(`[nifra/web] server build failed:\n${result.logs.map((l) => formatBuildLog(l, root)).join("\n")}`);
     }
     // Named as the metafile names outputs: relative to `outdir`.
     const nameOf = (path) => relative(outDir, path).replaceAll("\\", "/");
@@ -976,6 +1000,7 @@ export const SERVER_ENTRY_OPTIONS = [
     "csp",
     "nonce",
     "i18n",
+    "hostPolicy",
 ];
 /**
  * The header each edge platform sets to the caller's address, replacing any value the client sent.
@@ -987,6 +1012,10 @@ const PLATFORM_CLIENT_IP_HEADERS = {
     cloudflare: "cf-connecting-ip",
     vercel: "x-real-ip",
 };
+// A static path a host's policy refuses is not answered from disk: it falls through to the app, whose
+// own copy of the policy refuses it the same way it refuses a page.
+const HOST_ALLOWS_STATIC = ' && hostPolicy.allows(request.headers.get("host") ?? "", pathname, buildAssets)';
+const NODE_STATIC_ALLOW = "      allow: (host: string, pathname: string) => hostPolicy.allows(host, pathname, buildAssets),";
 /** Where a self-hosting build writes its prerendered pages, beside `server.js`. */
 const PRERENDERED_DIR = "_prerendered";
 /**
@@ -1023,20 +1052,20 @@ export function generateServerEntry(options) {
     if (target === "static") {
         throw new Error("[nifra/web] generateServerEntry: `static` has no server entry (SSG only)");
     }
-    // Bun and Node serve the client bundle through `servePublicDir`. Deno bundles for the browser
-    // condition, where `node:fs` is a stub, so its entry runs the same checks on Deno's own file API.
+    // Bun serves the client bundle through `servePublicDir` and Node through @nifrajs/node's own reader,
+    // both on core's static-file policy. Deno bundles for the browser condition, where `node:fs` is a
+    // stub, so its entry runs the same checks on Deno's own file API.
     const nodeFs = target === "bun" || target === "node";
     const prerendered = Object.entries(options.prerenderedPages ?? {});
     if (prerendered.length > 0 && !nodeFs) {
         throw new Error(`[nifra/web] generateServerEntry: prerendered pages are served by the bun and node targets, not ${target}`);
     }
-    const lines = [
-        !nodeFs
-            ? 'import { createWebApp } from "@nifrajs/web"'
-            : prerendered.length > 0
-                ? 'import { createWebApp, prerenderedPageReader, servePublicDir } from "@nifrajs/web"'
-                : 'import { createWebApp, servePublicDir } from "@nifrajs/web"',
-    ];
+    const webImports = ["createWebApp"];
+    if (prerendered.length > 0)
+        webImports.push("prerenderedPageReader");
+    if (target === "bun")
+        webImports.push("servePublicDir");
+    const lines = [`import { ${webImports.join(", ")} } from "@nifrajs/web"`];
     if (backendImport !== undefined)
         lines.push('import { inProcessClient } from "@nifrajs/client"');
     lines.push(`import { adapter } from ${JSON.stringify(adapterImport)}`);
@@ -1048,9 +1077,18 @@ export function generateServerEntry(options) {
     if (backendImport !== undefined) {
         lines.push(`import { backend } from ${JSON.stringify(backendImport)}`);
     }
-    lines.push(options.copyChunks === true
-        ? 'import { clientEntry, copyChunks, cssLoading, manifest, styles, routeStyles } from "./server-manifest"'
-        : 'import { clientEntry, cssLoading, manifest, styles, routeStyles } from "./server-manifest"');
+    // A host policy is checked before the static files too, which takes the build's own file set.
+    const hostPolicy = importedOptions.includes("hostPolicy");
+    const manifestImports = [
+        ...(hostPolicy ? ["buildAssets"] : []),
+        "clientEntry",
+        ...(options.copyChunks === true ? ["copyChunks"] : []),
+        "cssLoading",
+        "manifest",
+        "styles",
+        "routeStyles",
+    ];
+    lines.push(`import { ${manifestImports.join(", ")} } from "./server-manifest"`);
     // Cloudflare needs the fetch-handler shape; the others call app.fetch directly.
     if (target === "cloudflare")
         lines.push('import { toFetchHandler } from "@nifrajs/core/server"');
@@ -1058,14 +1096,15 @@ export function generateServerEntry(options) {
         lines.push('import { serve } from "@nifrajs/node"');
     if (nodeFs)
         lines.push('import { fileURLToPath } from "node:url"');
-    if (target === "deno")
-        lines.push('import { parseByteRange } from "@nifrajs/core/range"');
+    if (target === "deno") {
+        lines.push('import { parseByteRange } from "@nifrajs/core/range"', 'import { CONTENT_SNAPSHOT_MAX, contentTags, contentTypeOf, ifRangeAllowsPartial, isHiddenPath, isNotModified, lastModifiedOf, streamedLastModifiedOf } from "@nifrajs/core/static-file"', 'import { createHash } from "node:crypto"');
+    }
     if (prerendered.length > 0) {
         const headers = Object.fromEntries(prerendered.map(([path, page]) => [path, page.headers]));
         const files = Object.fromEntries(prerendered.map(([path, page]) => [path, page.file]));
         lines.push("", `// The pages the build prerendered into ${PRERENDERED_DIR}/, answered from their file after \`use\`.`, "const prerenderedPages = {", `  pages: ${JSON.stringify(headers)},`, "  read: prerenderedPageReader({", `    dir: fileURLToPath(new URL(${JSON.stringify(`./${PRERENDERED_DIR}/`)}, import.meta.url)),`, `    files: ${JSON.stringify(files)},`, "  }),", "}");
     }
-    lines.push("", "const app = createWebApp({", "  adapter,", ...(useImport !== undefined ? ["  use,"] : []), ...(prerendered.length > 0 ? ["  prerenderedPages,"] : []), ...importedOptions.map((name) => `  ${name},`), "  manifest,", "  clientEntry,", "  styles,", "  routeStyles,", "  cssLoading,", ...(options.copyChunks === true ? ["  copyChunks,"] : []), ...(backendImport !== undefined ? ["  api: inProcessClient(backend),"] : []), `  title: ${JSON.stringify(title)},`, 
+    lines.push("", "const app = createWebApp({", "  adapter,", ...(useImport !== undefined ? ["  use,"] : []), ...(prerendered.length > 0 ? ["  prerenderedPages,"] : []), ...importedOptions.map((name) => `  ${name},`), ...(hostPolicy ? ["  buildAssets,"] : []), "  manifest,", "  clientEntry,", "  styles,", "  routeStyles,", "  cssLoading,", ...(options.copyChunks === true ? ["  copyChunks,"] : []), ...(backendImport !== undefined ? ["  api: inProcessClient(backend),"] : []), `  title: ${JSON.stringify(title)},`, 
     // Core's own `{ header }` trust, so the mounted backend and every loader see the derived caller.
     ...(clientIpHeader !== undefined
         ? [`  server: { clientIp: { header: ${JSON.stringify(clientIpHeader)} } },`]
@@ -1078,7 +1117,7 @@ export function generateServerEntry(options) {
         // rules - so a static request CAN arrive here. Serve it from the ASSETS binding instead of letting
         // the router 404 it, which makes correctness independent of how much of the list fit: the exclude
         // list decides only how many static requests skip the worker, never which files exist.
-        lines.push(`const PUBLIC_FILES = new Set(${JSON.stringify(publicFiles)})`, "const handler = toFetchHandler(app)", "type Assets = { readonly ASSETS?: { fetch(request: Request): Promise<Response> } }", "export default {", "  fetch(request: Request, env: Assets, ctx: ExecutionContext) {", "    const { pathname } = new URL(request.url)", "    // Only the build's own outputs: the hashed bundle prefix and the files it copied.", '    if (env?.ASSETS !== undefined && (pathname.startsWith("/assets/") || PUBLIC_FILES.has(pathname))) {', "      return env.ASSETS.fetch(request)", "    }", "    return handler.fetch(request, env as never, ctx)", "  },", "}");
+        lines.push(`const PUBLIC_FILES = new Set(${JSON.stringify(publicFiles)})`, "const handler = toFetchHandler(app)", "type Assets = { readonly ASSETS?: { fetch(request: Request): Promise<Response> } }", "export default {", "  fetch(request: Request, env: Assets, ctx: ExecutionContext) {", "    const { pathname } = new URL(request.url)", "    // Only the build's own outputs: the hashed bundle prefix and the files it copied.", `    if (env?.ASSETS !== undefined && (pathname.startsWith("/assets/") || PUBLIC_FILES.has(pathname))${hostPolicy ? HOST_ALLOWS_STATIC : ""}) {`, "      return env.ASSETS.fetch(request)", "    }", "    return handler.fetch(request, env as never, ctx)", "  },", "}");
         return `${lines.join("\n")}\n`;
     }
     if (target === "vercel") {
@@ -1088,12 +1127,19 @@ export function generateServerEntry(options) {
     // bun / node / deno self-host AND serve the client bundle from disk (it sits next to this entry).
     lines.push("// The client bundle and public files live next to this entry; serve only manifest-approved paths.", 'const STATIC_ROOT = new URL("./", import.meta.url)', `const PUBLIC_FILES = new Set(${JSON.stringify(publicFiles)})`, ...(hashedFiles !== undefined
         ? [`const HASHED_FILES = new Set(${JSON.stringify(hashedFiles)})`]
-        : []), "const staticPath = (pathname: string): string | undefined => {", "  if (PUBLIC_FILES.has(pathname)) return '.' + pathname", '  if (!pathname.startsWith("/assets/")) return undefined', '  const segments = pathname.slice(1).split("/")', "  // `.` and `..` match the character class, and the path is joined onto a base URL that resolves", "  // dot segments - so they are rejected explicitly rather than relying on the request URL having", "  // been normalized upstream.", "  const safe = (segment: string): boolean =>", '    segment !== "." && segment !== ".." && /^[A-Za-z0-9._-]+$/.test(segment)', "  return segments.every(safe) ? '.' + pathname : undefined", "}", 
-    // The handler `nifra dev` serves public/ with: its type table, nosniff and cache policy, HEAD
-    // answered without reading the file, byte ranges and conditional requests, and a descriptor opened
-    // only once the real path is inside the root, so a link planted in the deployed tree cannot reach
-    // a file outside it.
-    ...(nodeFs
+        : []));
+    if (target === "node") {
+        // The app itself with the adapter's own reader, not a `{ fetch }` wrapper around app.fetch: the
+        // wrapper hid the node-direct lane, so every page built an undici Request and drained a Response,
+        // and every file went through one too. The root mount serves only the files the build listed.
+        lines.push("await serve(app, {", "  port: Number(process.env.PORT ?? 3000),", "  static: [", "    {", '      dir: fileURLToPath(new URL("./assets/", import.meta.url)),', '      prefix: "/assets",', ...(hashedFiles !== undefined ? ["      hashedFiles: HASHED_FILES,"] : []), `      cacheControl: ${JSON.stringify(ONE_DAY)},`, ...(hostPolicy ? [NODE_STATIC_ALLOW] : []), "    },", "    {", "      dir: fileURLToPath(STATIC_ROOT),", '      prefix: "/",', "      files: PUBLIC_FILES,", "      immutable: false,", `      cacheControl: ${JSON.stringify(ONE_DAY)},`, ...(hostPolicy ? [NODE_STATIC_ALLOW] : []), "    },", "  ],", "})");
+        return `${lines.join("\n")}\n`;
+    }
+    lines.push("const staticPath = (pathname: string): string | undefined => {", "  if (PUBLIC_FILES.has(pathname)) return '.' + pathname", '  if (!pathname.startsWith("/assets/")) return undefined', '  const segments = pathname.slice(1).split("/")', "  // `.` and `..` match the character class, and the path is joined onto a base URL that resolves", "  // dot segments - so they are rejected explicitly rather than relying on the request URL having", "  // been normalized upstream.", "  const safe = (segment: string): boolean =>", '    segment !== "." && segment !== ".." && /^[A-Za-z0-9._-]+$/.test(segment)', "  return segments.every(safe) ? '.' + pathname : undefined", "}", 
+    // The handler `nifra dev` serves public/ with: its type table, nosniff and cache policy, content
+    // tags, byte ranges and conditional requests, and a descriptor opened only once the real path is
+    // inside the root, so a link planted in the deployed tree cannot reach a file outside it.
+    ...(target === "bun"
         ? [
             "const serveStatic = servePublicDir({",
             "  dir: fileURLToPath(STATIC_ROOT),",
@@ -1109,49 +1155,51 @@ export function generateServerEntry(options) {
     if (target === "bun") {
         lines.push("const server = Bun.serve({", "  port: Number(Bun.env.PORT ?? 3000),", "  async fetch(req, server) {", "    const { pathname } = new URL(req.url)", 
         // Braced: the next emitted line opens with `(`, which would otherwise call the returned value.
-        "    if (staticPath(pathname) !== undefined) {", "      return staticResponse(req)", "    }", `    ${markFramed}`, "    // The socket peer, looked up only when something reads it (as core's own listen() does).", "    return app.fetch(req, { get clientIp() { return server.requestIP(req)?.address } })", "  },", "})", 
+        `    if (staticPath(pathname) !== undefined${hostPolicy ? HOST_ALLOWS_STATIC.replaceAll("request", "req") : ""}) {`, "      return staticResponse(req)", "    }", `    ${markFramed}`, "    // The socket peer, looked up only when something reads it (as core's own listen() does).", "    return app.fetch(req, { get clientIp() { return server.requestIP(req)?.address } })", "  },", "})", 
         // The `${...}` here is literal OUTPUT (a template in the GENERATED file), not a template in this
         // source - split so biome's noTemplateCurlyInString doesn't flag it; the emitted line is unchanged.
         `console.log(\`nifra (Bun) → http://localhost:$${"{server.port}"}\`)`);
         return `${lines.join("\n")}\n`;
     }
-    if (target === "node") {
-        lines.push("await serve(", "  {", "    async fetch(req, platform) {", "      const { pathname } = new URL(req.url)", "      if (staticPath(pathname) !== undefined) return staticResponse(req)", "      return app.fetch(req, platform)", "    },", "  },", "  { port: Number(process.env.PORT ?? 3000) },", ")");
-        return `${lines.join("\n")}\n`;
-    }
     // deno
-    lines.push("// @ts-ignore - Deno global is present on the Deno runtime this output targets.", 'Deno.serve({ port: Number(Deno.env.get("PORT") ?? "3000") }, async (req, info) => {', "  const { pathname } = new URL(req.url)", "  const filePath = staticPath(pathname)", "  if (filePath !== undefined) {", "    return staticResponse(req, filePath, pathname)", "  }", `  ${markFramed}`, "  return app.fetch(req, { clientIp: info.remoteAddr.hostname })", "})");
+    lines.push("// @ts-ignore - Deno global is present on the Deno runtime this output targets.", 'Deno.serve({ port: Number(Deno.env.get("PORT") ?? "3000") }, async (req, info) => {', "  const { pathname } = new URL(req.url)", "  const filePath = staticPath(pathname)", `  if (filePath !== undefined${hostPolicy ? HOST_ALLOWS_STATIC.replaceAll("request", "req") : ""}) {`, "    return staticResponse(req, filePath, pathname)", "  }", `  ${markFramed}`, "  return app.fetch(req, { clientIp: info.remoteAddr.hostname })", "})");
     return `${lines.join("\n")}\n`;
 }
 /**
- * The Deno entry's static handler: `servePublicDir`'s checks on Deno's file API. The real path must sit
- * inside the root and cross no hidden segment, and the opened file must still be the one that path
- * names, so a link planted in the deployed tree cannot reach a file outside it or a `.env` inside it.
- * HEAD answers from `stat` without reading; one byte range is served from a seek, several as the
- * whole file.
+ * The Deno entry's static handler: `servePublicDir`'s checks and answers on Deno's file API. The real
+ * path must sit inside the root and cross no hidden segment, and the opened file must still be the one
+ * that path names, so a link planted in the deployed tree cannot reach a file outside it or a `.env`
+ * inside it. The file is typed by its real path, tagged by its content and dated only by an mtime its
+ * own last write set, through the same policy as servePublicDir: a current cached copy is a 304, and a
+ * range survives only an `If-Range` naming that tag. A file is read once to tag it, and one small
+ * enough is then served from those bytes; otherwise one byte range is served from a seek, several as
+ * the whole file.
  */
 function denoStaticResponse(hashed) {
     return [
-        `const TYPES: Record<string, string> = ${JSON.stringify(CONTENT_TYPES)}`,
-        "const staticHeaders = (pathname: string): Record<string, string> => ({",
-        '  "content-type": TYPES[pathname.slice(pathname.lastIndexOf(".")).toLowerCase()] ?? "application/octet-stream",',
+        "const staticHeaders = (pathname: string, file: string): Record<string, string> => ({",
+        '  "content-type": contentTypeOf(file),',
         `  "cache-control": ${hashed ? "HASHED_FILES.has(pathname)" : 'pathname.startsWith("/assets/")'} ? ${JSON.stringify(IMMUTABLE)} : ${JSON.stringify(ONE_DAY)},`,
         '  "x-content-type-options": "nosniff",',
         '  "accept-ranges": "bytes",',
         "})",
         "// @ts-ignore - Deno global is present on the Deno runtime this output targets.",
         "const STATIC_REAL: string = await Deno.realPath(STATIC_ROOT)",
-        "const hiddenSegment = (rel: string): boolean =>",
-        '  rel.split(/[\\\\/]/).some((segment) => segment.startsWith(".") && segment !== ".well-known")',
+        "// One per process: the tag of a file is remembered by its real path.",
+        "// A stat costs Deno more than hashing a snapshot of up to 24 KiB, so only a larger one is restatted.",
+        "const STATIC_TAGS = contentTags(createHash, { rehashMax: 24 * 1024 })",
+        "// Up to this many bytes are read whole to tag a file, and the response is then served from them.",
+        "const STATIC_INLINE_MAX = CONTENT_SNAPSHOT_MAX",
         "const staticResponse = async (req: Request, filePath: string, pathname: string): Promise<Response> => {",
         '  const missing = () => new Response("not found", { status: 404 })',
         '  if (req.method !== "GET" && req.method !== "HEAD") return missing()',
         "  let file, info",
+        '  let real = ""',
         "  try {",
         "    // @ts-ignore - Deno global is present on the Deno runtime this output targets.",
-        "    const real: string = await Deno.realPath(new URL(filePath, STATIC_ROOT))",
+        "    real = await Deno.realPath(new URL(filePath, STATIC_ROOT))",
         '    if (!real.startsWith(STATIC_REAL + (STATIC_REAL.includes("\\\\") ? "\\\\" : "/"))) return missing()',
-        "    if (hiddenSegment(real.slice(STATIC_REAL.length + 1))) return missing()",
+        "    if (isHiddenPath(real.slice(STATIC_REAL.length + 1))) return missing()",
         "    // @ts-ignore - Deno global is present on the Deno runtime this output targets.",
         "    file = await Deno.open(real)",
         "    // Deno.open follows links, so a directory swapped for one after the check above redirects it.",
@@ -1169,12 +1217,60 @@ function denoStaticResponse(hashed) {
         "    file?.close()",
         "    return missing()",
         "  }",
+        "  if (!info.isFile) {",
+        "    file.close()",
+        "    return missing()",
+        "  }",
         "  const size: number = info.size",
-        "  const headers = new Headers(staticHeaders(pathname))",
-        '  const range = req.method === "GET" ? parseByteRange(req.headers.get("range"), size) : { kind: "none" as const }',
-        '  if (!info.isFile || req.method === "HEAD" || range.kind === "unsatisfiable") {',
+        "  const headers = new Headers(staticHeaders(pathname, real))",
+        "  // Deno reports a field the platform does not keep as null; NaN never matches a remembered version.",
+        "  const versionOf = (stat: { dev: number; ino: number | null; size: number; mtime: Date | null; ctime: Date | null }) => ({",
+        "    dev: stat.dev,",
+        "    ino: stat.ino ?? Number.NaN,",
+        "    size: stat.size,",
+        "    mtimeMs: stat.mtime?.getTime() ?? Number.NaN,",
+        "    ctimeMs: stat.ctime?.getTime() ?? Number.NaN,",
+        "  })",
+        "  const version = versionOf(info)",
+        "  const snapshot = size <= STATIC_INLINE_MAX",
+        "  const lastModified = snapshot ? lastModifiedOf(version) : streamedLastModifiedOf(version)",
+        '  const ifNoneMatch = req.headers.get("if-none-match")',
+        '  const ifModifiedSince = req.headers.get("if-modified-since")',
+        "  let whole: Uint8Array<ArrayBuffer> | undefined",
+        "  // A HEAD or a 304 sends none of the file, so the tag remembered for this settled version",
+        "  // answers it from the stat alone: a write since that tag would show in the stat.",
+        "  let etag: string | undefined = snapshot ? STATIC_TAGS.cached(real, version) : undefined",
+        "  try {",
+        '    if (snapshot && (etag === undefined || !(req.method === "HEAD" || isNotModified(ifNoneMatch, ifModifiedSince, etag, lastModified)))) {',
+        "      whole = new Uint8Array(size)",
+        "      let filled = 0",
+        "      while (filled < size) {",
+        "        const read: number | null = await file.read(whole.subarray(filled))",
+        "        if (read === null || read === 0) break",
+        "        filled += read",
+        "      }",
+        "      if (filled < size) whole = whole.subarray(0, filled)",
+        "      etag = await STATIC_TAGS.ofSnapshot(real, version, whole, async () => versionOf(await file.stat()))",
+        "    }",
+        "  } catch {",
+        "    file.close()",
+        "    return missing()",
+        "  }",
+        '  if (etag !== undefined) headers.set("etag", etag)',
+        '  if (lastModified !== undefined) headers.set("last-modified", new Date(lastModified).toUTCString())',
+        "  if (isNotModified(ifNoneMatch, ifModifiedSince, etag, lastModified)) {",
+        "    file.close()",
+        '    headers.delete("content-type")',
+        "    return new Response(null, { status: 304, headers })",
+        "  }",
+        '  const rangeHeader = req.method === "GET" ? req.headers.get("range") : null',
+        "  const range =",
+        "  // A streamed body's date is weak: a write during the stream must never splice two versions.",
+        '    rangeHeader !== null && ifRangeAllowsPartial(req.headers.get("if-range"), etag, snapshot ? lastModified : undefined)',
+        "      ? parseByteRange(rangeHeader, size)",
+        '      : { kind: "none" as const }',
+        '  if (req.method === "HEAD" || range.kind === "unsatisfiable") {',
         "    file.close()",
-        "    if (!info.isFile) return missing()",
         '    if (range.kind !== "unsatisfiable") {',
         '      headers.set("content-length", String(size))',
         "      return new Response(null, { headers })",
@@ -1185,10 +1281,16 @@ function denoStaticResponse(hashed) {
         "  }",
         '  if (range.kind === "satisfiable" && range.ranges.length === 1) {',
         "    const { start, end } = range.ranges[0]!",
+        '    headers.set("content-range", "bytes " + start + "-" + end + "/" + size)',
+        "    if (whole !== undefined) {",
+        "      file.close()",
+        "      const part = whole.subarray(start, end + 1)",
+        '      headers.set("content-length", String(part.byteLength))',
+        "      return new Response(part, { status: 206, headers })",
+        "    }",
         "    // @ts-ignore - Deno global is present on the Deno runtime this output targets.",
         "    await file.seek(start, Deno.SeekMode.Start)",
         "    let left = end - start + 1",
-        '    headers.set("content-range", "bytes " + start + "-" + end + "/" + size)',
         '    headers.set("content-length", String(left))',
         "    const body = new ReadableStream<Uint8Array>({",
         "      async pull(controller) {",
@@ -1210,6 +1312,11 @@ function denoStaticResponse(hashed) {
         "    })",
         "    return new Response(body, { status: 206, headers })",
         "  }",
+        "  if (whole !== undefined) {",
+        "    file.close()",
+        '    headers.set("content-length", String(whole.byteLength))',
+        "    return new Response(whole, { headers })",
+        "  }",
         '  headers.set("content-length", String(size))',
         "  return new Response(file.readable, { headers })",
         "}",
@@ -1272,6 +1379,7 @@ export const bunBundler = {
         ...(input.styles !== undefined ? { styles: input.styles } : {}),
         ...(input.routeStyles !== undefined ? { routeStyles: input.routeStyles } : {}),
         ...(input.copyChunks !== undefined ? { copyChunks: input.copyChunks } : {}),
+        ...(input.buildAssets !== undefined ? { buildAssets: input.buildAssets } : {}),
         ...(input.plugins ? { plugins: input.plugins } : {}),
         ...(input.define ? { define: input.define } : {}),
         ...(input.cssLoading !== undefined ? { cssLoading: input.cssLoading } : {}),
@@ -1350,6 +1458,12 @@ export async function buildTargetWith(target, options, bundler) {
     ];
     assertDisposableDir("outDir", outDir, sources);
     assertDisposableDir("workDir", workDir, sources);
+    // Before anything is cleared, so a refused build leaves the last deploy dir in place.
+    if (targetPlan.target === "node") {
+        const refusal = nodeAdapterRefusal(workDir);
+        if (refusal !== undefined)
+            throw new Error(refusal);
+    }
     const { rmSync } = await import("node:fs");
     rmSync(outDir, { recursive: true, force: true });
     rmSync(workDir, { recursive: true, force: true });
@@ -1470,6 +1584,7 @@ export async function buildTargetWith(target, options, bundler) {
         ...(client.css !== undefined ? { styles: client.css } : {}),
         ...(client.routeStyles !== undefined ? { routeStyles: client.routeStyles } : {}),
         ...(client.copyChunks !== undefined ? { copyChunks: client.copyChunks } : {}),
+        buildAssets: buildAssetPaths(client),
         ...(options.serverPlugins ? { plugins: options.serverPlugins } : {}),
         define: { "process.env.NODE_ENV": '"production"', ...(options.define ?? {}) },
         ...(client.cssLoading !== undefined
@@ -1487,7 +1602,12 @@ export async function buildTargetWith(target, options, bundler) {
         cpSync(worker, `${outDir}/${targetPlan.outputFile}`);
         // The app's real patterns, so a directory is only collapsed into a glob once the route table
         // proves nothing can be served beneath it.
-        const rules = cloudflareRouteRules(publicFiles, discoverRoutes(routesDir).routes.map((route) => route.pattern));
+        // A host policy must see every file request, which Pages answers from the CDN before the worker
+        // when the path is excluded, so with one nothing is: each file costs an invocation, and the
+        // worker serves the allowed ones from ASSETS.
+        const rules = options.optionImports?.hostPolicy === undefined
+            ? cloudflareRouteRules(publicFiles, discoverRoutes(routesDir).routes.map((route) => route.pattern))
+            : { include: ["/*"], exclude: [], omitted: [] };
         writeFileSync(`${outDir}/_routes.json`, `${JSON.stringify({ version: 1, include: rules.include, exclude: rules.exclude }, null, 2)}\n`);
         // Never cap silently: an omitted file still serves (the worker's ASSETS fallback), but it costs a
         // worker invocation, and that trade should be visible rather than inferred from a latency graph.