@pracht/core 0.7.0 → 0.8.0

package/dist/prerender-D3E2H96p.mjs

@@ -0,0 +1,648 @@
+import { a as matchApiRoute, c as resolveApp, n as buildPathFromSegments, o as matchAppRoute } from "./app-BvC1uQG5.mjs";
+import { _ as applyDefaultSecurityHeaders, b as withDefaultSecurityHeaders, c as mergeDocumentHeaders, d as runMiddlewareChain, f as resolveDataFunctions, g as appendVaryHeader, h as resolveRegistryModule, l as mergeHeadMetadata, m as resolvePageJsUrls, p as resolvePageCssUrls, v as applyHeaders, x as withRouteResponseHeaders, y as applySecurityAndRouteHeaders } from "./types-idmK5omD.mjs";
+import { f as HYDRATION_STATE_ELEMENT_ID, h as SAFE_METHODS, m as ROUTE_STATE_REQUEST_HEADER, o as buildRouteStateUrl } from "./prefetch-cache-DzP2Bj9H.mjs";
+import { a as buildRuntimeDiagnostics, c as normalizeRouteError, l as shouldExposeServerErrors, o as createSerializedRouteError, s as deserializeRouteError, t as PrachtRuntimeProvider } from "./runtime-context-B5pREhcM.mjs";
+import { h } from "preact";
+//#region src/runtime-html.ts
+function escapeHtml(str) {
+	return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function serializeJsonForHtml(value) {
+	return escapeScriptText(JSON.stringify(value) ?? "null");
+}
+function escapeScriptText(value) {
+	return value.replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+const SAFE_ATTRIBUTE_NAME_RE = /^[A-Za-z_:][A-Za-z0-9:._-]*$/;
+const GLOBAL_HEAD_ATTRIBUTE_PREFIXES = ["data-", "aria-"];
+const META_ATTRIBUTES = new Set([
+	"charset",
+	"content",
+	"http-equiv",
+	"itemprop",
+	"media",
+	"name",
+	"property"
+]);
+const LINK_ATTRIBUTES = new Set([
+	"as",
+	"blocking",
+	"color",
+	"crossorigin",
+	"disabled",
+	"fetchpriority",
+	"href",
+	"hreflang",
+	"imagesizes",
+	"imagesrcset",
+	"integrity",
+	"media",
+	"referrerpolicy",
+	"rel",
+	"sizes",
+	"title",
+	"type"
+]);
+const SCRIPT_ATTRIBUTES = new Set([
+	"async",
+	"blocking",
+	"class",
+	"crossorigin",
+	"defer",
+	"fetchpriority",
+	"id",
+	"integrity",
+	"nomodule",
+	"nonce",
+	"referrerpolicy",
+	"src",
+	"type"
+]);
+function renderAttributes(attributes, allowedAttributes) {
+	return Object.entries(attributes).filter(([key, value]) => isAllowedHeadAttribute(key, value, allowedAttributes)).map(([key, value]) => `${key}="${escapeHtml(value ?? "")}"`).join(" ");
+}
+function isAllowedHeadAttribute(key, value, allowedAttributes) {
+	if (key === "children" || typeof value === "undefined" || !SAFE_ATTRIBUTE_NAME_RE.test(key)) return false;
+	const normalized = key.toLowerCase();
+	if (normalized.startsWith("on")) return false;
+	return allowedAttributes.has(normalized) || GLOBAL_HEAD_ATTRIBUTE_PREFIXES.some((prefix) => normalized.startsWith(prefix));
+}
+function buildHtmlDocument(options) {
+	const { head, body, hydrationState, clientEntryUrl, cssUrls = [], modulePreloadUrls = [], routeStatePreloadUrl } = options;
+	const titleTag = head.title ? `<title>${escapeHtml(head.title)}</title>` : "";
+	const metaTags = (head.meta ?? []).map((m) => renderAttributes(m, META_ATTRIBUTES)).filter(Boolean).map((attrs) => `<meta ${attrs}>`).join("\n    ");
+	const linkTags = (head.link ?? []).map((l) => renderAttributes(l, LINK_ATTRIBUTES)).filter(Boolean).map((attrs) => `<link ${attrs}>`).join("\n    ");
+	const scriptTags = (head.script ?? []).map((script) => {
+		const attrs = renderAttributes(script, SCRIPT_ATTRIBUTES);
+		const children = script.children ? escapeScriptText(script.children) : "";
+		return attrs ? `<script ${attrs}>${children}<\/script>` : `<script>${children}<\/script>`;
+	}).join("\n    ");
+	const cssTags = cssUrls.map((url) => `<link rel="stylesheet" href="${escapeHtml(url)}">`).join("\n    ");
+	const modulePreloadTags = modulePreloadUrls.map((url) => `<link rel="modulepreload" href="${escapeHtml(url)}">`).join("\n    ");
+	const routeStatePreloadTag = routeStatePreloadUrl ? `<link rel="preload" as="fetch" href="${escapeHtml(routeStatePreloadUrl)}" crossorigin="anonymous">` : "";
+	const stateScript = `<script id="${HYDRATION_STATE_ELEMENT_ID}" type="application/json">${serializeJsonForHtml(hydrationState)}<\/script>`;
+	const entryScript = clientEntryUrl ? `<script type="module" src="${escapeHtml(clientEntryUrl)}"><\/script>` : "";
+	return `<!DOCTYPE html>
+<html${head.lang ? ` lang="${escapeHtml(head.lang)}"` : ""}>
+  <head>
+    <meta charset="utf-8">
+    ${titleTag}
+    ${metaTags}
+    ${linkTags}
+    ${scriptTags}
+    ${cssTags}
+    ${modulePreloadTags}
+    ${routeStatePreloadTag}
+  </head>
+  <body>
+    <div id="pracht-root">${body}</div>
+    ${stateScript}
+    ${entryScript}
+  </body>
+</html>`;
+}
+function htmlResponse(html, status = 200, initHeaders) {
+	const headers = new Headers({ "content-type": "text/html; charset=utf-8" });
+	if (initHeaders) applyHeaders(headers, initHeaders);
+	applySecurityAndRouteHeaders(headers, { isRouteStateRequest: false });
+	return new Response(html, {
+		status,
+		headers
+	});
+}
+//#endregion
+//#region src/runtime-response.ts
+let _renderToStringAsync;
+async function getRenderToStringAsync() {
+	if (_renderToStringAsync) return _renderToStringAsync;
+	_renderToStringAsync = (await import("preact-render-to-string")).renderToStringAsync;
+	return _renderToStringAsync;
+}
+function jsonErrorResponse(routeError, options) {
+	const headers = applySecurityAndRouteHeaders(new Headers({ "content-type": "application/json; charset=utf-8" }), options.isRouteStateRequest ? { isRouteStateRequest: true } : void 0);
+	return new Response(JSON.stringify({ error: routeError }), {
+		status: routeError.status,
+		headers
+	});
+}
+function jsonRedirectResponse(location, options) {
+	const headers = new Headers(options.headers);
+	headers.set("content-type", "application/json; charset=utf-8");
+	return withRouteResponseHeaders(new Response(JSON.stringify({ redirect: location }), {
+		status: 200,
+		headers
+	}), { isRouteStateRequest: options.isRouteStateRequest });
+}
+function normalizePageResponse(response, options) {
+	if (options.isRouteStateRequest && response.status >= 300 && response.status < 400) {
+		const location = response.headers.get("location");
+		if (location) return jsonRedirectResponse(location, {
+			headers: response.headers,
+			isRouteStateRequest: true
+		});
+	}
+	return withRouteResponseHeaders(response, options);
+}
+function renderApiErrorResponse(options) {
+	const exposeDetails = shouldExposeServerErrors(options.options);
+	const routeError = normalizeRouteError(options.error, { exposeDetails });
+	const routeErrorWithDiagnostics = exposeDetails ? {
+		...routeError,
+		diagnostics: buildRuntimeDiagnostics({
+			middlewareFiles: options.middlewareFiles,
+			phase: options.phase,
+			route: options.route,
+			status: routeError.status
+		})
+	} : routeError;
+	if (exposeDetails) return jsonErrorResponse(routeErrorWithDiagnostics, { isRouteStateRequest: false });
+	const message = routeErrorWithDiagnostics.status >= 500 ? "Internal Server Error" : routeErrorWithDiagnostics.message;
+	return withDefaultSecurityHeaders(new Response(message, {
+		status: routeErrorWithDiagnostics.status,
+		headers: { "content-type": "text/plain; charset=utf-8" }
+	}));
+}
+async function renderRouteErrorResponse(options) {
+	const exposeDetails = shouldExposeServerErrors(options.options);
+	const routeError = normalizeRouteError(options.error, { exposeDetails });
+	const routeErrorWithDiagnostics = exposeDetails ? {
+		...routeError,
+		diagnostics: buildRuntimeDiagnostics({
+			loaderFile: options.loaderFile,
+			middlewareFiles: options.routeArgs.route.middlewareFiles,
+			phase: options.phase,
+			route: options.routeArgs.route,
+			shellFile: options.shellFile,
+			status: routeError.status
+		})
+	} : routeError;
+	if (options.isRouteStateRequest) return jsonErrorResponse(routeErrorWithDiagnostics, { isRouteStateRequest: true });
+	const shellModule = options.shellModule ?? (options.shellFile ? await resolveRegistryModule(options.options.registry?.shellModules, options.shellFile) : void 0);
+	const ErrorBoundary = options.routeModule?.ErrorBoundary ?? shellModule?.ErrorBoundary;
+	if (!ErrorBoundary) {
+		const message = routeErrorWithDiagnostics.status >= 500 && !exposeDetails ? "Internal Server Error" : routeErrorWithDiagnostics.message;
+		const diagnostics = exposeDetails && routeErrorWithDiagnostics.diagnostics ? `\n\n${JSON.stringify(routeErrorWithDiagnostics.diagnostics, null, 2)}` : "";
+		return withDefaultSecurityHeaders(new Response(`${message}${diagnostics}`, {
+			status: routeErrorWithDiagnostics.status,
+			headers: { "content-type": "text/plain; charset=utf-8" }
+		}));
+	}
+	const head = shellModule?.head ? await shellModule.head(options.routeArgs) : {};
+	const documentHeaders = await mergeDocumentHeaders(shellModule, void 0, options.routeArgs, void 0);
+	const cssUrls = resolvePageCssUrls(options.options.cssManifest, options.shellFile, options.routeArgs.route.file);
+	const modulePreloadUrls = resolvePageJsUrls(options.options.jsManifest, options.shellFile, options.routeArgs.route.file);
+	const renderToString = await getRenderToStringAsync();
+	const Boundary = ErrorBoundary;
+	const Shell = shellModule?.Shell;
+	const errorValue = deserializeRouteError(routeErrorWithDiagnostics);
+	const componentTree = Shell ? h(Shell, null, h(Boundary, { error: errorValue })) : h(Boundary, { error: errorValue });
+	return htmlResponse(buildHtmlDocument({
+		head,
+		body: await renderToString(h(PrachtRuntimeProvider, {
+			data: null,
+			routeId: options.routeId,
+			routes: options.routes,
+			url: options.requestPath
+		}, componentTree)),
+		hydrationState: {
+			url: options.requestPath,
+			routeId: options.routeId,
+			data: null,
+			error: routeErrorWithDiagnostics
+		},
+		clientEntryUrl: options.options.clientEntryUrl,
+		cssUrls,
+		modulePreloadUrls
+	}), routeErrorWithDiagnostics.status, documentHeaders);
+}
+//#endregion
+//#region src/runtime-negotiation.ts
+const MARKDOWN_MEDIA_TYPE = "text/markdown";
+function parseAccept(header) {
+	if (!header) return [];
+	const entries = [];
+	for (const raw of header.split(",")) {
+		const parts = raw.trim().split(";");
+		const type = parts.shift()?.trim().toLowerCase();
+		if (!type) continue;
+		let quality = 1;
+		for (const param of parts) {
+			const [key, value] = param.split("=").map((p) => p.trim());
+			if (key === "q" && value != null) {
+				const parsed = Number.parseFloat(value);
+				if (!Number.isNaN(parsed)) quality = parsed;
+			}
+		}
+		entries.push({
+			type,
+			quality
+		});
+	}
+	return entries;
+}
+function prefersMarkdown(accept) {
+	const entries = parseAccept(accept);
+	if (!entries.length) return false;
+	const md = entries.find((e) => e.type === MARKDOWN_MEDIA_TYPE);
+	if (!md || md.quality === 0) return false;
+	const html = entries.find((e) => e.type === "text/html");
+	if (!html) return true;
+	return md.quality >= html.quality;
+}
+function markdownResponse(source) {
+	const headers = new Headers({
+		"content-type": "text/markdown; charset=utf-8",
+		"cache-control": "public, max-age=0, must-revalidate"
+	});
+	appendVaryHeader(headers, "Accept");
+	applyDefaultSecurityHeaders(headers);
+	return new Response(source, {
+		status: 200,
+		headers
+	});
+}
+//#endregion
+//#region src/runtime.ts
+const SAME_ORIGIN_FETCH_SITE = "same-origin";
+/**
+* Stricter variant of first-party detection used for CSRF protection on
+* state-changing API requests. It rejects any browser signal that points
+* outside this exact origin — a cross-origin form POST will send `Origin`
+* from the attacker, and `Sec-Fetch-Site: same-site` is not enough because
+* sibling subdomains can be attacker-controlled. Requests with no browser
+* provenance headers are treated as non-browser callers.
+*/
+function isSameOriginMutation(request, url) {
+	const site = request.headers.get("sec-fetch-site");
+	if (site && site !== SAME_ORIGIN_FETCH_SITE) return false;
+	const origin = request.headers.get("origin");
+	if (origin) try {
+		return new URL(origin).origin === url.origin;
+	} catch {
+		return false;
+	}
+	if (site === SAME_ORIGIN_FETCH_SITE) return true;
+	const referer = request.headers.get("referer");
+	if (referer) try {
+		return new URL(referer).origin === url.origin;
+	} catch {
+		return false;
+	}
+	return true;
+}
+/**
+* Heuristic "this request came from our own page" check. Used to gate
+* the `_data=1` query-param form of the route-state endpoint, which is
+* otherwise reachable via any cross-origin `<a href>` / redirect.
+*
+* Accepts a request as first-party when:
+*   - Sec-Fetch-Site is `same-origin` (modern browsers),
+*   - OR Sec-Fetch-Site is absent AND the Origin header matches the
+*     request URL's origin (older clients that still send Origin),
+*   - OR Sec-Fetch-Site/Origin are absent AND Referer matches the request
+*     URL's origin,
+*   - OR no Origin/Sec-Fetch-Site/Referer is present (non-browser clients like
+*     curl — CSRF is not the threat model there; blocking would break
+*     tests and CLIs).
+*/
+function isFirstPartyFetch(request) {
+	const site = request.headers.get("sec-fetch-site");
+	if (site && site !== SAME_ORIGIN_FETCH_SITE) return false;
+	const origin = request.headers.get("origin");
+	if (origin) try {
+		return new URL(origin).origin === new URL(request.url).origin;
+	} catch {
+		return false;
+	}
+	if (site === SAME_ORIGIN_FETCH_SITE) return true;
+	const referer = request.headers.get("referer");
+	if (referer) try {
+		return new URL(referer).origin === new URL(request.url).origin;
+	} catch {
+		return false;
+	}
+	return true;
+}
+async function handlePrachtRequest(options) {
+	const url = new URL(options.request.url);
+	const hasDataParam = url.searchParams.get("_data") === "1";
+	if (hasDataParam) url.searchParams.delete("_data");
+	const requestPath = getRequestPath(url);
+	const registry = options.registry ?? {};
+	const resolvedApp = getResolvedApp(options.app);
+	const headerSignalsRouteState = options.request.headers.get(ROUTE_STATE_REQUEST_HEADER) === "1";
+	const dataParamIsFirstParty = hasDataParam && isFirstPartyFetch(options.request);
+	const isRouteStateRequest = headerSignalsRouteState || dataParamIsFirstParty;
+	const exposeDiagnostics = shouldExposeServerErrors(options);
+	if (options.apiRoutes?.length) {
+		const apiMatch = matchApiRoute(options.apiRoutes, url.pathname);
+		if (apiMatch) {
+			const apiMiddlewareFiles = (options.app.api.middleware ?? []).flatMap((name) => {
+				const middlewareFile = options.app.middleware[name];
+				return middlewareFile ? [middlewareFile] : [];
+			});
+			let currentPhase = "middleware";
+			if ((options.app.api.requireSameOrigin ?? true) && !SAFE_METHODS.has(options.request.method) && !isSameOriginMutation(options.request, url)) return withDefaultSecurityHeaders(new Response("Cross-origin request blocked", {
+				status: 403,
+				headers: { "content-type": "text/plain; charset=utf-8" }
+			}));
+			const requestSignal = AbortSignal.timeout(3e4);
+			const apiContext = options.context ?? {};
+			const apiTerminal = async () => {
+				currentPhase = "api";
+				const apiModule = await resolveRegistryModule(registry.apiModules, apiMatch.route.file);
+				if (!apiModule) throw new Error("API route module not found");
+				const handler = apiModule[options.request.method.toUpperCase()] ?? apiModule.default;
+				if (!handler) return new Response("Method not allowed", {
+					status: 405,
+					headers: { "content-type": "text/plain; charset=utf-8" }
+				});
+				return handler({
+					request: options.request,
+					params: apiMatch.params,
+					context: apiContext,
+					signal: requestSignal,
+					url,
+					route: apiMatch.route
+				});
+			};
+			try {
+				return withDefaultSecurityHeaders(await runMiddlewareChain({
+					context: apiContext,
+					middlewareFiles: apiMiddlewareFiles,
+					params: apiMatch.params,
+					registry,
+					request: options.request,
+					route: apiMatch.route,
+					signal: requestSignal,
+					url,
+					terminal: apiTerminal
+				}));
+			} catch (error) {
+				return renderApiErrorResponse({
+					error,
+					middlewareFiles: apiMiddlewareFiles,
+					options,
+					phase: currentPhase,
+					route: apiMatch.route
+				});
+			}
+		}
+	}
+	const match = matchAppRoute(resolvedApp, url.pathname);
+	if (!match) {
+		if (isRouteStateRequest) return jsonErrorResponse(createSerializedRouteError("Not found", 404, {
+			diagnostics: exposeDiagnostics ? buildRuntimeDiagnostics({
+				phase: "match",
+				status: 404
+			}) : void 0,
+			name: "Error"
+		}), { isRouteStateRequest: true });
+		return withDefaultSecurityHeaders(new Response("Not found", {
+			status: 404,
+			headers: { "content-type": "text/plain; charset=utf-8" }
+		}));
+	}
+	if (!SAFE_METHODS.has(options.request.method)) {
+		if (isRouteStateRequest) return jsonErrorResponse(createSerializedRouteError("Method not allowed", 405, {
+			diagnostics: exposeDiagnostics ? buildRuntimeDiagnostics({
+				middlewareFiles: match.route.middlewareFiles,
+				phase: "action",
+				route: match.route,
+				shellFile: match.route.shellFile,
+				status: 405
+			}) : void 0,
+			name: "Error"
+		}), { isRouteStateRequest: true });
+		return withRouteResponseHeaders(new Response("Method not allowed", {
+			status: 405,
+			headers: { "content-type": "text/plain; charset=utf-8" }
+		}), { isRouteStateRequest });
+	}
+	const requestSignal = AbortSignal.timeout(3e4);
+	const pageContext = options.context ?? {};
+	const routeArgs = {
+		request: options.request,
+		params: match.params,
+		context: pageContext,
+		signal: requestSignal,
+		url,
+		route: match.route
+	};
+	let routeModule;
+	let shellModule;
+	let loaderFile;
+	let currentPhase = "middleware";
+	try {
+		const routeModulePromise = resolveRegistryModule(registry.routeModules, match.route.file);
+		const shellModulePromise = match.route.shellFile ? resolveRegistryModule(registry.shellModules, match.route.shellFile) : Promise.resolve(void 0);
+		const dataFunctionsPromise = routeModulePromise.then((mod) => resolveDataFunctions(match.route, mod, registry));
+		routeModulePromise.catch(() => {});
+		shellModulePromise.catch(() => {});
+		dataFunctionsPromise.catch(() => {});
+		const pageTerminal = async () => {
+			currentPhase = "render";
+			routeModule = await routeModulePromise;
+			if (!routeModule) throw new Error("Route module not found");
+			if (!isRouteStateRequest && typeof routeModule.markdown === "string" && prefersMarkdown(options.request.headers.get("accept"))) return markdownResponse(routeModule.markdown);
+			currentPhase = "loader";
+			const { loader, loaderFile: resolvedLoaderFile } = await dataFunctionsPromise;
+			loaderFile = resolvedLoaderFile;
+			const loaderResult = loader ? await loader(routeArgs) : void 0;
+			if (loaderResult instanceof Response) return loaderResult;
+			const data = loaderResult;
+			if (isRouteStateRequest) return Response.json({ data });
+			currentPhase = "render";
+			shellModule = await shellModulePromise;
+			const [head, documentHeaders] = await Promise.all([mergeHeadMetadata(shellModule, routeModule, routeArgs, data), mergeDocumentHeaders(shellModule, routeModule, routeArgs, data)]);
+			const cssUrls = resolvePageCssUrls(options.cssManifest, match.route.shellFile, match.route.file);
+			const modulePreloadUrls = resolvePageJsUrls(options.jsManifest, match.route.shellFile, match.route.file);
+			if (match.route.render === "spa") {
+				let body = "";
+				const Shell = shellModule?.Shell;
+				const Loading = shellModule?.Loading;
+				const loadingTree = Shell != null ? h(Shell, null, Loading ? h(Loading, null) : null) : Loading ? h(Loading, null) : null;
+				if (loadingTree) {
+					const tree = h(PrachtRuntimeProvider, {
+						data: null,
+						params: match.params,
+						routeId: match.route.id ?? "",
+						routes: resolvedApp.routes,
+						url: requestPath
+					}, loadingTree);
+					body = await (await getRenderToStringAsync())(tree);
+				}
+				return htmlResponse(buildHtmlDocument({
+					head,
+					body,
+					hydrationState: {
+						url: requestPath,
+						routeId: match.route.id ?? "",
+						data: null,
+						error: null,
+						pending: true
+					},
+					clientEntryUrl: options.clientEntryUrl,
+					cssUrls,
+					modulePreloadUrls,
+					routeStatePreloadUrl: loader ? buildRouteStateUrl(requestPath) : void 0
+				}), 200, documentHeaders);
+			}
+			const DefaultComponent = typeof routeModule.default === "function" ? routeModule.default : void 0;
+			const Component = routeModule.Component ?? DefaultComponent;
+			if (!Component) throw new Error("Route has no Component or default export");
+			const Shell = shellModule?.Shell;
+			const Comp = Component;
+			const componentProps = {
+				data,
+				params: match.params
+			};
+			const componentTree = Shell ? h(Shell, null, h(Comp, componentProps)) : h(Comp, componentProps);
+			const tree = h(PrachtRuntimeProvider, {
+				data,
+				params: match.params,
+				routeId: match.route.id ?? "",
+				routes: resolvedApp.routes,
+				url: requestPath
+			}, componentTree);
+			return htmlResponse(buildHtmlDocument({
+				head,
+				body: await (await getRenderToStringAsync())(tree),
+				hydrationState: {
+					url: requestPath,
+					routeId: match.route.id ?? "",
+					data,
+					error: null
+				},
+				clientEntryUrl: options.clientEntryUrl,
+				cssUrls,
+				modulePreloadUrls
+			}), 200, documentHeaders);
+		};
+		return normalizePageResponse(await runMiddlewareChain({
+			context: pageContext,
+			middlewareFiles: match.route.middlewareFiles,
+			params: match.params,
+			registry,
+			request: options.request,
+			route: match.route,
+			signal: requestSignal,
+			url,
+			terminal: pageTerminal
+		}), { isRouteStateRequest });
+	} catch (error) {
+		return renderRouteErrorResponse({
+			error,
+			isRouteStateRequest,
+			loaderFile,
+			options,
+			phase: currentPhase,
+			routeArgs,
+			routeId: match.route.id ?? "",
+			routeModule,
+			routes: resolvedApp.routes,
+			shellFile: match.route.shellFile,
+			shellModule,
+			requestPath
+		});
+	}
+}
+function getRequestPath(url) {
+	return `${url.pathname}${url.search}`;
+}
+function getResolvedApp(app) {
+	const routes = app.routes;
+	if (routes.length === 0 || isHrefRouteDefinition(routes[0])) return app;
+	return resolveApp(app);
+}
+function isHrefRouteDefinition(value) {
+	return Boolean(value && typeof value === "object" && "path" in value && "segments" in value && Array.isArray(value.segments));
+}
+//#endregion
+//#region src/prerender.ts
+const DANGEROUS_PRERENDER_HEADER_NAMES = new Set([
+	"authorization",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"set-cookie",
+	"www-authenticate"
+]);
+const SECRET_SHAPED_PRERENDER_HEADER_RE = /^x-.*(?:api[-_]?key|client[-_]?secret|credential|jwt[-_]?secret|password|private[-_]?key|refresh[-_]?token|secret|session[-_]?secret|token|webhook[-_]?secret)(?:$|[-_])/i;
+async function prerenderApp(options) {
+	const resolved = resolveApp(options.app);
+	const results = [];
+	const isgManifest = {};
+	const work = [];
+	for (const route of resolved.routes) {
+		if (route.render !== "ssg" && route.render !== "isg") continue;
+		const paths = await collectSSGPaths(route, options.registry);
+		for (const pathname of paths) work.push({
+			pathname,
+			render: route.render,
+			revalidate: route.revalidate
+		});
+	}
+	const concurrency = options.concurrency ?? 10;
+	if (!Number.isInteger(concurrency) || concurrency <= 0) throw new Error("prerenderApp({ concurrency }) expects a positive integer.");
+	for (let i = 0; i < work.length; i += concurrency) {
+		const batch = work.slice(i, i + concurrency);
+		const batchResults = await Promise.all(batch.map(async (item) => {
+			const url = new URL(item.pathname, "http://localhost");
+			const request = new Request(url, { method: "GET" });
+			const response = await handlePrachtRequest({
+				app: options.app,
+				request,
+				registry: options.registry,
+				clientEntryUrl: options.clientEntryUrl,
+				cssManifest: options.cssManifest,
+				jsManifest: options.jsManifest
+			});
+			if (response.status !== 200) {
+				console.warn(`  Warning: ${item.render.toUpperCase()} route "${item.pathname}" returned status ${response.status}, skipping.`);
+				return null;
+			}
+			assertSafePrerenderHeaders(response.headers, item);
+			const html = await response.text();
+			return {
+				headers: Object.fromEntries(response.headers),
+				html,
+				item
+			};
+		}));
+		for (const result of batchResults) {
+			if (!result) continue;
+			results.push({
+				path: result.item.pathname,
+				html: result.html,
+				headers: result.headers
+			});
+			if (result.item.render === "isg" && result.item.revalidate) isgManifest[result.item.pathname] = { revalidate: result.item.revalidate };
+		}
+	}
+	if (options.withISGManifest) return {
+		pages: results,
+		isgManifest
+	};
+	return results;
+}
+function assertSafePrerenderHeaders(headers, item) {
+	const dangerous = [...headers.keys()].filter(isDangerousPrerenderHeader);
+	if (dangerous.length === 0) return;
+	const names = dangerous.map((name) => `"${name}"`).join(", ");
+	throw new Error(`Refusing to prerender ${item.render.toUpperCase()} route "${item.pathname}" because its document headers include ${names}. SSG/ISG document headers are serialized into public static output and replayed for every visitor. Move cookies/authentication headers to API routes, loaders, middleware responses, or SSR-only routes.`);
+}
+function isDangerousPrerenderHeader(name) {
+	const normalized = name.toLowerCase();
+	return DANGEROUS_PRERENDER_HEADER_NAMES.has(normalized) || SECRET_SHAPED_PRERENDER_HEADER_RE.test(normalized);
+}
+async function collectSSGPaths(route, registry) {
+	if (!route.segments.some((s) => s.type === "param" || s.type === "catchall")) return [route.path];
+	const routeModule = await resolveRegistryModule(registry?.routeModules, route.file);
+	if (!routeModule?.getStaticPaths) {
+		console.warn(`  Warning: SSG route "${route.path}" has dynamic segments but no getStaticPaths() export, skipping.`);
+		return [];
+	}
+	return (await routeModule.getStaticPaths()).map((params) => buildPathFromSegments(route.segments, params));
+}
+//#endregion
+export { handlePrachtRequest as n, prerenderApp as t };