@polardbx/pxbaas 0.0.0-stage → 0.1.0-beta.10

package/templates/webapp/react-vite-hono/frontend/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "pxbaas-react-vite-hono-template",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "tsc -b && vite build",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "react": "18.3.1",
+    "react-dom": "18.3.1",
+    "react-router-dom": "6.28.0"
+  },
+  "devDependencies": {
+    "@types/react": "18.3.12",
+    "@types/react-dom": "18.3.1",
+    "@vitejs/plugin-react": "4.3.4",
+    "typescript": "5.6.3",
+    "vite": "5.4.21"
+  }
+}

package/templates/webapp/react-vite-hono/frontend/src/App.tsx

@@ -0,0 +1,47 @@
+import { useState } from 'react';
+import { Link, Route, Routes } from 'react-router-dom';
+
+function Home() {
+  const [result, setResult] = useState('Not checked');
+
+  async function checkApi() {
+    const response = await fetch('./api/health');
+    const body = await response.json();
+    setResult(body.ok ? 'Backend is ready' : 'Backend returned an error');
+  }
+
+  return (
+    <section>
+      <p className="eyebrow">PolarDB-X BaaS</p>
+      <h1>{{APP_NAME}}</h1>
+      <p>React and Hono are served together from one stable App mount.</p>
+      <div className="actions">
+        <button type="button" onClick={checkApi}>Check API</button>
+        <Link className="button secondary" to="/about">About</Link>
+      </div>
+      <output aria-live="polite">{result}</output>
+    </section>
+  );
+}
+
+function About() {
+  return (
+    <section>
+      <p className="eyebrow">Route</p>
+      <h1>HashRouter works</h1>
+      <p>The backend is available through the mount-relative ./api path.</p>
+      <Link className="button" to="/">Back home</Link>
+    </section>
+  );
+}
+
+export default function App() {
+  return (
+    <main>
+      <Routes>
+        <Route path="/" element={<Home />} />
+        <Route path="/about" element={<About />} />
+      </Routes>
+    </main>
+  );
+}

package/templates/webapp/react-vite-hono/frontend/src/main.tsx

@@ -0,0 +1,13 @@
+import React from 'react';
+import ReactDOM from 'react-dom/client';
+import { HashRouter } from 'react-router-dom';
+import App from './App';
+import './style.css';
+
+ReactDOM.createRoot(document.getElementById('root')!).render(
+  <React.StrictMode>
+    <HashRouter>
+      <App />
+    </HashRouter>
+  </React.StrictMode>,
+);

package/templates/webapp/react-vite-hono/frontend/src/style.css

@@ -0,0 +1,66 @@
+:root {
+  color: #17212b;
+  background: #f4f7fa;
+  font-family: Inter, ui-sans-serif, system-ui, sans-serif;
+}
+
+* {
+  box-sizing: border-box;
+}
+
+body {
+  min-width: 320px;
+  min-height: 100vh;
+  margin: 0;
+  display: grid;
+  place-items: center;
+}
+
+main {
+  width: min(42rem, calc(100vw - 3rem));
+}
+
+section {
+  padding: 3rem;
+  border: 1px solid #d7e0e8;
+  border-radius: 1rem;
+  background: #fff;
+  box-shadow: 0 1rem 3rem rgb(23 33 43 / 10%);
+}
+
+.eyebrow {
+  color: #087f5b;
+  font-weight: 700;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+}
+
+.actions {
+  display: flex;
+  gap: 0.75rem;
+  margin-top: 1rem;
+}
+
+button,
+.button {
+  display: inline-block;
+  padding: 0.7rem 1rem;
+  border: 0;
+  border-radius: 0.5rem;
+  color: #fff;
+  background: #087f5b;
+  font: inherit;
+  text-decoration: none;
+  cursor: pointer;
+}
+
+.secondary {
+  color: #087f5b;
+  background: #e6fcf5;
+}
+
+output {
+  display: block;
+  min-height: 1.5rem;
+  margin-top: 1rem;
+}

package/templates/webapp/react-vite-hono/frontend/tsconfig.json

@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "useDefineForClassFields": true,
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "allowJs": false,
+    "skipLibCheck": true,
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "strict": true,
+    "forceConsistentCasingInFileNames": true,
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "jsx": "react-jsx"
+  },
+  "include": ["src", "vite.config.ts"]
+}

package/templates/webapp/react-vite-hono/frontend/vite.config.ts

@@ -0,0 +1,10 @@
+import { defineConfig } from 'vite';
+import react from '@vitejs/plugin-react';
+
+export default defineConfig({
+  base: './',
+  plugins: [react()],
+  build: {
+    sourcemap: false,
+  },
+});

package/templates/webapp/spa/index.ts

@@ -0,0 +1,119 @@
+// {{APP_NAME}} — self-contained single-file Edge Function (SPA + built-in JSON API).
+//
+// Spec: follow the `pxbaas-app-spec` skill — `pxbaas app deploy` lints this file against it.
+//
+// Deploy with:  pxbaas app deploy {{SLUG}}
+// Share URL:    {endpoint}/functions/v1/{{SLUG}}        (browser opens directly; deployed with verify_jwt=false)
+// Built-in API: {endpoint}/functions/v1/{{SLUG}}?action=time
+//
+// Guardrails baked into this template (do NOT break them):
+//  - All assets are inline (no external CSS/JS, no root-absolute paths like "/x"),
+//    so nothing escapes the /functions/v1/ prefix onto Studio.
+//  - Dynamic calls use RELATIVE URLs (location.pathname + "?action=...") so the
+//    request returns through Kong -> proxy -> sandbox on the same path.
+//  - Reflected input is HTML-escaped (public URL => injection-safe).
+//  - CORS headers are set for browser calls.
+
+function corsHeaders(): Record<string, string> {
+  return {
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": "POST, GET, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, apikey, X-Tenant-Id",
+  };
+}
+
+function esc(s: string): string {
+  return s
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+}
+
+function pageHtml(serverIso: string): string {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>{{APP_NAME}}</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { font-family: -apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+         max-width: 720px; margin: 40px auto; padding: 0 20px; line-height: 1.6; }
+  .card { border: 1px solid #ddd; border-radius: 12px; padding: 16px 20px; margin: 16px 0; }
+  code, pre { background: #f4f4f5; padding: 2px 6px; border-radius: 4px; word-break: break-all; }
+  pre { padding: 12px; overflow: auto; }
+  button { font-size: 15px; padding: 8px 16px; border-radius: 8px; border: 1px solid #ccc; cursor: pointer; }
+  .big { font-size: 32px; font-weight: 700; }
+  .muted { color: #888; font-size: 13px; }
+</style>
+</head>
+<body>
+  <h1>{{APP_NAME}}</h1>
+  <p class="muted">Served by a Deno Edge Function inside the BaaS sandbox (text/html), reverse-proxied via Kong <code>/functions/v1/</code>.</p>
+
+  <div class="card">
+    <div class="muted">Share URL (send to anyone; opens directly in a browser)</div>
+    <code id="url">loading…</code>
+    <div class="muted" style="margin-top:8px">Server-rendered time (proves dynamic SSR): ${esc(serverIso)}</div>
+  </div>
+
+  <div class="card">
+    <div>① Client-side counter (inline JS)</div>
+    <div class="big" id="count">0</div>
+    <button onclick="inc()">+1</button>
+  </div>
+
+  <div class="card">
+    <div>② Call the built-in backend API (relative path → same function)</div>
+    <button onclick="ping()">GET ?action=time</button>
+    <pre id="api" class="muted">Click to fetch server time</pre>
+  </div>
+
+<script>
+  document.getElementById("url").textContent = location.origin + location.pathname;
+  let n = 0;
+  function inc() { n++; document.getElementById("count").textContent = n; }
+  async function ping() {
+    const el = document.getElementById("api");
+    el.textContent = "loading…";
+    try {
+      const r = await fetch(location.pathname + "?action=time", { headers: { "Accept": "application/json" } });
+      el.textContent = JSON.stringify(await r.json(), null, 2);
+    } catch (e) { el.textContent = "error: " + e; }
+  }
+</script>
+</body>
+</html>`;
+}
+
+function json(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json", ...corsHeaders() },
+  });
+}
+
+Deno.serve((req: Request) => {
+  const url = new URL(req.url);
+
+  if (req.method === "OPTIONS") {
+    return new Response(null, { status: 204, headers: corsHeaders() });
+  }
+
+  // Built-in JSON API — extend with your own actions here.
+  const action = url.searchParams.get("action");
+  if (action === "time") {
+    return json({ ok: true, now: new Date().toISOString() });
+  }
+  if (action) {
+    return json({ ok: false, error: `unknown action: ${action}` }, 400);
+  }
+
+  // Default: serve the single-page app.
+  return new Response(pageHtml(new Date().toISOString()), {
+    status: 200,
+    headers: { "Content-Type": "text/html; charset=utf-8", ...corsHeaders() },
+  });
+});

package/templates/webapp/ssr-auth/backend/index.ts

@@ -0,0 +1,133 @@
+// {{APP_NAME}} — SSR webapp with proxy-injected session (方案 C).
+//
+// Spec: follow the `pxbaas-app-spec` skill and `references/ssr-session.md`.
+// The proxy validates a per-mount scoped session cookie and injects the
+// authenticated identity as TRUSTED headers; this worker never reads cookies,
+// never issues Set-Cookie, and never puts tokens in URLs. Header names come
+// from `capabilities.sessionHeaders` (the only source of truth).
+//
+// Deploy with:  pxbaas app deploy {{SLUG}}
+// SSR page:     {app-url}/api/page?page=...   (worker returns text/html)
+// Login:        POST {app-url}/_session/login  (proxy sets the scoped cookie)
+// Logout:       POST {app-url}/_session/logout (proxy clears it)
+
+// Trusted identity headers (proxy-injected; client-supplied values are stripped).
+const HDR_USER_ID = "x-app-user-id";
+const HDR_USER_TOKEN = "x-app-user-token";
+const HDR_USER_EMAIL = "x-app-user-email";
+
+function cors(): Record<string, string> {
+  return {
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, apikey, X-Tenant-Id",
+  };
+}
+function esc(s: unknown): string {
+  return String(s == null ? "" : s)
+    .split("&").join("&amp;")
+    .split("<").join("&lt;")
+    .split(">").join("&gt;")
+    .split('"').join("&quot;");
+}
+function html(body: string, status = 200): Response {
+  return new Response(body, {
+    status,
+    headers: { "Content-Type": "text/html; charset=utf-8", ...cors() },
+  });
+}
+function json(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json; charset=utf-8", ...cors() },
+  });
+}
+
+// Server-side data access. Uses the injected user token (per-user RLS) when
+// present, else the anon key for public reads. Data-plane base contract
+// (edge-runtime app-env.ts, MR #30497903): the platform injects
+// SUPABASE_INTERNAL_URL (the only sandbox-reachable base, DX-12 derived
+// platform-side) and SUPABASE_ANON_KEY. SUPABASE_URL is render-only and MUST NOT
+// be used for fetch. Empty base when the sandbox image predates the injection.
+function base(): string {
+  return (Deno.env.get("SUPABASE_INTERNAL_URL") || "").replace(/\/+$/, "");
+}
+function anon(): string {
+  return Deno.env.get("SUPABASE_ANON_KEY") || "";
+}
+async function restGet(table: string, query: string, userToken?: string | null) {
+  const r = await fetch(`${base()}/rest/v1/${table}?${query}`, {
+    headers: {
+      apikey: anon(),
+      Authorization: "Bearer " + (userToken || anon()),
+      "Content-Type": "application/json",
+    },
+  });
+  if (!r.ok) throw new Error(`REST ${r.status}`);
+  return await r.json();
+}
+
+interface Who {
+  userId: string | null;
+  token: string | null;
+  email: string | null;
+}
+function who(req: Request): Who {
+  // Absent headers = anonymous (graceful degradation on instances without the
+  // capability, and on the /functions/v1 entry which has no injected headers).
+  return {
+    userId: req.headers.get(HDR_USER_ID),
+    token: req.headers.get(HDR_USER_TOKEN),
+    email: req.headers.get(HDR_USER_EMAIL),
+  };
+}
+
+function pageShell(title: string, inner: string, w: Who): string {
+  const nav = w.userId
+    ? `<a href="?page=index">Home</a> <a href="?page=me">My area</a> <span>· ${esc(w.email)}</span>
+       <form method="post" action="./_session/logout" style="display:inline"><button type="submit">Sign out</button></form>`
+    : `<a href="?page=index">Home</a>
+       <form method="post" action="./_session/login" style="display:inline">
+         <input name="email" type="email" placeholder="email" required>
+         <input name="password" type="password" placeholder="password" required>
+         <button type="submit">Sign in</button>
+       </form>`;
+  return `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${esc(title)}</title>
+<style>body{font:16px/1.6 system-ui,sans-serif;max-width:860px;margin:24px auto;padding:0 20px}
+header{display:flex;gap:14px;align-items:center;flex-wrap:wrap;border-bottom:1px solid #eee;padding-bottom:10px}
+header form{margin-left:auto;display:flex;gap:6px}input{padding:6px 8px}</style></head>
+<body><header><strong>🧩 {{APP_NAME}}</strong>${nav}</header><main>${inner}</main></body></html>`;
+}
+
+Deno.serve(async (req: Request): Promise<Response> => {
+  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: cors() });
+  const url = new URL(req.url);
+  const action = url.searchParams.get("action");
+  if (action === "health" || action === "time") return json({ ok: true, now: new Date().toISOString() });
+
+  const w = who(req);
+  const page = url.searchParams.get("page") || "index";
+
+  try {
+    if (page === "me") {
+      if (!w.userId) {
+        return html(pageShell("Sign in", `<p>Sign in above; the proxy sets a per-mount cookie and
+          injects your identity as trusted headers on the next request.</p>`, w));
+      }
+      // Authenticated SSR: fetch the user's own rows server-side (RLS enforced).
+      const rows = await restGet("<table>", "select=*&limit=50", w.token);
+      const list = (rows as Array<Record<string, unknown>>)
+        .map((r) => `<li>${esc(JSON.stringify(r))}</li>`).join("");
+      return html(pageShell("My area", `<h1>My area (SSR, as ${esc(w.email)})</h1><ul>${list}</ul>`, w));
+    }
+    // Public SSR page.
+    const rows = await restGet("<table>", "select=*&limit=50");
+    const list = (rows as Array<Record<string, unknown>>)
+      .map((r) => `<li>${esc(JSON.stringify(r))}</li>`).join("");
+    return html(pageShell("{{APP_NAME}}", `<h1>{{APP_NAME}} (SSR)</h1><ul>${list}</ul>`, w));
+  } catch (e) {
+    return html(pageShell("Error", `<p>SSR error: ${esc(String((e as Error)?.message || e))}</p>`, w), 500);
+  }
+});

package/templates/webapp/ssr-auth/frontend/dist/index.html

@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>{{APP_NAME}} — entering</title>
+<meta http-equiv="refresh" content="0; url=./api/page?page=index">
+<style>body{font:16px/1.6 system-ui,sans-serif;color:#6b7280;text-align:center;padding-top:60px}a{color:#5b6cff}</style>
+</head>
+<body>
+  <p>Entering {{APP_NAME}} (server-side rendered)…</p>
+  <p><a href="./api/page?page=index">Continue</a></p>
+  <script>location.replace("./api/page?page=index");</script>
+</body>
+</html>

package/templates/webapp/ssr-blog/README.md

@@ -0,0 +1,111 @@
+# {{APP_NAME}} — 全站 SSR + 平台会话注入参考模板（Deno，零 npm 依赖）
+
+**形态**：**整站服务端渲染**。worker 经实例内网基址读 MySQL（`posts_ssr`），用字符串模板直出整页 HTML（列表 / 文章 / 博主 / 登录 / 注册 / 管理 / 资料），浏览器不做客户端取数。
+**会话模型**：`proxy-injected`（方案 C）——登录由平台的 per-mount 会话端点完成，proxy 校验 HttpOnly cookie 后向 worker 注入 `X-App-User-Id / X-App-User-Token / X-App-User-Email / X-App-Session-Gen`；worker **只读注入头**，不读 cookie、不签发 cookie、不把 token 放进 URL、不做本地验签。
+
+> 前置能力：`pxbaas app capabilities --json` 需报 `sessionMode: "proxy-injected-header"`、`persistentSession: true`。若实例不支持，登录页会明确提示而不是静默降级。
+
+## 目录
+
+```
+{{APP_NAME}}/
+├── app.json                 # schemaVersion 2；fallback=worker；ssrProbePath=/posts；backend.session=proxy-injected
+├── backend/index.ts         # 单文件自包含 worker（零 npm 依赖 → 冷启动仅数秒，无 SSR 探针风险）
+├── frontend/dist/index.html # 静态入口壳，meta refresh 到 ./api/page?page=index
+├── db/schema.sql            # 幂等数据层：posts_ssr + 5 条 RLS + 3 篇种子
+└── README.md
+```
+
+## 部署前必须做的一件事：填 DEPLOY CONFIG
+
+`backend/index.ts` 顶部两个常量默认为空；留空时 worker 明确报错而不是猜测（刻意设计：绝不回落到任何真实实例，避免静默读写别人的数据）。
+
+```ts
+const INTERNAL_BASE = "";   // 目标实例内网基址：把公网 host 的 http./https. 中缀去掉
+const ANON_KEY = "";        // 单租户=实例 anon；多租户=该租户 anon（自带 tenant_id claim）
+```
+
+`/api/page?action=diag` 会回报 `configReady` 与实际生效的基址，用于部署后自检。
+
+## 会话链路（为什么长这样）
+
+`/apps/{mount}/api/*` 走 `TRUSTED_INTERNAL` 凭据策略，proxy 会剥掉客户端的
+`authorization / cookie / apikey / x-api-key`，因此：
+
+- **不能**靠透传浏览器 Authorization（worker 拿不到）；
+- **不能**自己读 cookie（拿到的只可能是 proxy 共享 jar 的串味残留，会造成"退出无效/身份串号"）；
+- **不能**把 token 放 URL（泄漏到历史/日志/Referer，且被 spec-lint 的 `session-no-url-token` 判为 blocker）。
+
+唯一正确来源是注入头：
+
+```ts
+const token = req.headers.get("x-app-user-token") || "";
+const sub   = req.headers.get("x-app-user-id") || "";
+const email = req.headers.get("x-app-user-email") || "";
+```
+
+登录 / 注册 / 退出因此都在页面脚本里打平台端点（相对当前页 `/apps/{m}/api/page` 用 `../`）：
+
+| 动作 | 端点 | 说明 |
+|---|---|---|
+| 登录 | `POST ../_session/login` `{email,password}` | proxy 校验租户 GoTrue → 下发 `Set-Cookie: pxbaas-app-session; Path=/apps/{m}/; HttpOnly; SameSite=Lax` |
+| 注册 | `POST ?page=signup`（worker 建号）→ 再 `POST ../_session/login` | 建号与建会话分两步，避免把密码写进任何服务端渲染的 HTML |
+| 退出 | `POST ../_session/logout` | 由平台清除 cookie；worker 无权也无需清 |
+
+> 用 curl 复验时不会执行 JS：退出需直接打 `POST /apps/{m}/_session/logout`。
+> 在容器内以 `Host: 127.0.0.1:8000` 打 `/apps/*` 会得到 `APP_HOST_REJECTED`（预期），验证请从公网侧发起。
+
+## 数据层
+
+```bash
+sed 's/__SCHEMA__/public/g' db/schema.sql          # 单租户
+sed 's/__SCHEMA__/tenant_acme/g' db/schema.sql     # 多租户
+```
+
+RLS 元数据写**中心库** `supabase._mysqlrest_rls_*`，`table_schema` = 上面的 `__SCHEMA__`；写错静默失效。
+
+## 部署
+
+```bash
+pxbaas app deploy {{APP_NAME}} --dir .      # appName 必须与 app.json 的 name 一致
+```
+
+走 curl Management API 时用显式嵌套 `filename=frontend/dist/index.html`、`filename=backend/index.ts`。
+本模板零 npm 依赖，冷启动仅数秒，**不需要**预热即可通过 publish。
+
+## 验收清单
+
+| # | 检查 | 期望 |
+|---|---|---|
+| 1 | `GET /apps/{m}/` | 200 静态壳，`meta refresh` 到 `./posts` |
+| 2 | `GET /apps/{m}/posts` | 200 `text/html`，种子文章服务端渲染，含 `data-ssr="v1"` |
+| 3 | `GET /apps/{m}/api/posts` 与 `/api/page?page=index` | 均 200 且出数据（`/api` 形态 + 旧 query 兼容） |
+| 3b | `GET /apps/{m}/api/page?action=diag` | `configReady:true`，基址为**内网**域名 |
+| 4 | 匿名 `GET /apps/{m}/admin` | 跳转 `login`（未识别身份） |
+| 5 | `POST /apps/{m}/_session/login` | 200 + `Set-Cookie pxbaas-app-session; Path=/apps/{m}/; HttpOnly` |
+| 6 | **只带 cookie**（无 sid、无 Authorization）`GET /apps/{m}/admin` | 已登录 SSR：显示邮箱、"写作管理"，且页面**不含任何 `sid=`** |
+| 7 | 带 cookie 发文（`author_id`=自己 / 他人） | 201 且落库 author_id==sub / **403 PGRST302** |
+| 8 | `POST /apps/{m}/_session/logout` 后 `GET /apps/{m}/admin` | 回匿名 |
+| 9 | 客户端伪造 `X-App-User-Id/Email` | 被剥离，worker 看不到 |
+| 10 | 双用户交替请求 | 各自只见自己（无串味） |
+
+## 路由（路径形态，三种派发形式均兼容）
+
+| 路径 | 页面 |
+|---|---|
+| `/apps/{m}/` | 静态壳，`meta refresh` 到 `./posts` |
+| `/apps/{m}/posts` | 广场（SSR 列表，按作者分组，每组最新 2 篇 + "共 N 篇"） |
+| `/apps/{m}/post/{id}` | 文章详情（SSR） |
+| `/apps/{m}/blogger/{authorId}` | 博主主页（SSR） |
+| `/apps/{m}/login` `/signup` `/admin` `/profile` `/logout` | 登录 / 注册 / 写作管理 / 资料 / 退出 |
+| `/apps/{m}/api/<同上>` | 同一套路由的 `/api` 派发形态（等价） |
+| `/apps/{m}/api/page?action=health\|diag` | 健康探针与部署自检（`configReady` / 基址可达性） |
+
+worker 会同时兼容三种派发形态，因此同一份产物在任意入口都正确：
+1. **静态未命中回落**：收到完整路径 `/apps/{m}/post/1`；
+2. **`/api` 派发（strip 后）**：收到候选前缀形式 `/app_<uuid>_r_<rev>/posts`（既无 `api` 段也无 mount 段）；
+3. **legacy 函数入口**：`/functions/v1/{slug}/posts`。
+
+实现要点：先剔除候选前缀与 `api` 标记，再从第一个**已知路由名**起截取 tail；链接前缀 `base` 在有 `X-App-Mount-Id` 时取挂载根 `/apps/{m}/`（与页面深度、派发形态无关），否则从真实路径回推。旧 `?page=index|article&id=…` 查询形态**仍兼容**（便于历史链接与 curl 复验）。
+
+> 曾踩的坑：形态 2 的路径里既没有 `api` 段也没有 mount 段，按"有 api 段/含 mount id"推导 tail 会只剩 `["1"]`，导致 `/post/1` 落到 404 兜底页。判据是打印 worker 实际收到的 `pathname`（`?action=diag` 或临时日志），不要凭浏览器 URL 推断。