@reckona/mreact-router 0.0.201 → 0.0.202

package/src/adapters/cloudflare.ts

@@ -38,6 +38,7 @@ import { routeSecurityHeaders } from "../security-headers.js";
 import type { AppRouterPrerenderStore } from "../serve.js";
 import { emitRouterDevtoolsEvent } from "./devtools.js";
 import { escapeHtmlAttribute, escapeHtmlText } from "@reckona/mreact-shared/html-escape";
+import { isCurrentPrerenderedRoute } from "../prerender-entry.js";
 
 /** Re-exports build manifest contracts used by Cloudflare handlers. */
 export type {
@@ -470,7 +471,38 @@ export function createCloudflareRouteModuleRenderer<Env = unknown>(
     if (middlewareResult.type === "response") {
       return middlewareResult.response;
     }
-    request = middlewareResult.request;
+
+    if (middlewareResult.request !== request) {
+      // The route was matched against the pre-middleware URL, so a rewrite has
+      // to re-match: otherwise the rewritten path would still render the module
+      // the visitor asked for, which is the module a rewrite is often used to
+      // keep them away from. The built runtime re-matches the same way.
+      request = middlewareResult.request;
+      const rematched = matchCloudflareRoute(
+        sortedCloudflareRoutes(context.serverManifest),
+        new URL(request.url).pathname,
+      );
+
+      if (rematched === undefined) {
+        return new Response("Not Found", { status: 404 });
+      }
+
+      context = { ...context, params: rematched.params, route: rematched.route };
+    }
+
+    // Middleware apps skip the prerendered fast path in `handleCloudflareRequest`
+    // so that access gates run first, so the stored HTML is resolved here
+    // instead, against the post-middleware path.
+    const prerendered = prerenderedResponse(
+      context.serverManifest.prerenderedRoutes,
+      normalizeRoutePath(new URL(request.url).pathname),
+      request.method,
+      isCloudflareNavigationRequest(request),
+    );
+
+    if (prerendered !== undefined) {
+      return prerendered;
+    }
 
     if (context.route.kind !== "server" && isCloudflareNavigationRequest(request)) {
       return cloudflareDocumentReloadNavigationResponse();
@@ -1193,12 +1225,18 @@ async function handleCloudflareRequest<Env>(
     return assetResponse;
   }
 
-  const staticResponse = prerenderedResponse(
-    options.serverManifest.prerenderedRoutes,
-    normalizeRoutePath(url.pathname),
-    request.method,
-    isCloudflareNavigationRequest(request),
-  );
+  // Prerendered HTML may only short-circuit `render` when the app has no
+  // middleware. Middleware runs inside `render`, so serving stored HTML here
+  // would bypass auth, geo blocking and maintenance gates for exactly the
+  // routes they are most often used to protect.
+  const staticResponse = builtServerManifestHasMiddleware(options.serverManifest)
+    ? undefined
+    : prerenderedResponse(
+        options.serverManifest.prerenderedRoutes,
+        normalizeRoutePath(url.pathname),
+        request.method,
+        isCloudflareNavigationRequest(request),
+      );
 
   if (staticResponse !== undefined) {
     emitRouterDevtoolsEvent({
@@ -1319,6 +1357,23 @@ function cacheControlHasDirective(cacheControl: string | null, directive: string
   return cacheControl.split(",").some((part) => part.trim().toLowerCase() === normalizedDirective);
 }
 
+// `serverManifest.files` is keyed on paths relative to the project root, so a
+// default `src/app` project stores the middleware as "src/app/middleware.ts".
+// This mirrors `hasMiddleware` in built-runtime.ts, which resolves the same two
+// names against the routes directory.
+function builtServerManifestHasMiddleware(manifest: {
+  files: Record<string, string>;
+  routesDir?: string | undefined;
+}): boolean {
+  const routesDir = (manifest.routesDir ?? "").replaceAll("\\", "/").replace(/\/+$/, "");
+  const prefix = routesDir === "" ? "" : `${routesDir}/`;
+
+  return (
+    manifest.files[`${prefix}middleware.ts`] !== undefined ||
+    manifest.files[`${prefix}middleware.mreact.ts`] !== undefined
+  );
+}
+
 function prerenderedResponse(
   prerenderedRoutes: Record<string, BuiltPrerenderedRoute> | undefined,
   path: string,
@@ -1331,7 +1386,7 @@ function prerenderedResponse(
 
   const prerendered = prerenderedRoutes?.[path];
 
-  if (prerendered === undefined) {
+  if (!isCurrentPrerenderedRoute(prerendered)) {
     return undefined;
   }
 
@@ -1351,7 +1406,7 @@ function cloudflareRouteRequiresModule(route: AppRoute, manifest: BuiltServerMan
     route.kind === "server" ||
     (route.kind === "page" &&
       (route.segments.some((segment) => segment.kind !== "static") ||
-        manifest.prerenderedRoutes?.[route.path] === undefined))
+        !isCurrentPrerenderedRoute(manifest.prerenderedRoutes?.[route.path])))
   );
 }
 
@@ -1368,6 +1423,23 @@ function normalizeCloudflareRouteModulePath(path: string): string {
   return withoutPrefix.replace(/\.(?:mjs|js|ts|tsx)$/, "");
 }
 
+// The manifest is the same object across requests, so a rewrite-heavy app pays
+// for the specificity sort once rather than on every rewritten request.
+const sortedRoutesByManifest = new WeakMap<BuiltServerManifest, readonly AppRoute[]>();
+
+function sortedCloudflareRoutes(manifest: BuiltServerManifest): readonly AppRoute[] {
+  const cached = sortedRoutesByManifest.get(manifest);
+
+  if (cached !== undefined) {
+    return cached;
+  }
+
+  const sorted = [...manifest.routes].sort(compareCloudflareRoutes);
+  sortedRoutesByManifest.set(manifest, sorted);
+
+  return sorted;
+}
+
 function matchCloudflareRoute(
   routes: readonly AppRoute[],
   pathname: string,

package/src/adapters/node.ts

@@ -14,6 +14,7 @@ import {
 } from "../logger.js";
 import type { AppRouterResponseHook } from "../render.js";
 import type { RouterInstrumentation } from "../trace.js";
+import { resolveNodeRequestProtocol } from "../node-server.js";
 
 /** Re-exports cache contracts used by Node handlers. */
 export type { AppRouterCache, AppRouterCacheEntry } from "../cache.js";
@@ -92,6 +93,13 @@ export interface NodeRequestHandlerOptions {
   routeCache?: AppRouterCache | undefined;
   serverActions?: AppRouterServerActionOptions | undefined;
   sinkStrategy?: ResponseSinkStrategy | undefined;
+  /**
+   * Trusts the first `X-Forwarded-Proto` value when the socket is not TLS.
+   *
+   * Defaults to `false`. Enable only behind a proxy that overwrites the header
+   * and prevents untrusted clients from reaching the Node listener directly.
+   */
+  trustForwardedProto?: boolean | undefined;
 }
 
 /**
@@ -126,7 +134,12 @@ export function createNodeRequestHandler(options: NodeRequestHandlerOptions): No
         hostPolicy: options.hostPolicy,
         rawHost: incoming.headers.host,
       });
-      const request = nodeRequestToWebRequest(incoming, `http://${host}`);
+      const protocol = resolveNodeRequestProtocol({
+        encrypted: (incoming.socket as { encrypted?: boolean }).encrypted === true,
+        forwardedProto: incoming.headers["x-forwarded-proto"],
+        trustForwardedProto: options.trustForwardedProto,
+      });
+      const request = nodeRequestToWebRequest(incoming, `${protocol}://${host}`);
       const logFields = requestLogFields(request, "node");
       emitRouterLog(options.logger, "info", {
         ...logFields,

package/src/adapters/static.ts

@@ -1,6 +1,7 @@
 import { cp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, join, resolve, sep } from "node:path";
 import type { BuiltPrerenderedRoute, BuiltServerManifest } from "../build.js";
+import { isCurrentPrerenderedRoute } from "../prerender-entry.js";
 
 /**
  * Configures static export from a built app-router output directory.
@@ -32,17 +33,29 @@ export async function exportStaticApp(options: StaticExportOptions): Promise<Sta
   ) as { publicAssets?: readonly string[] };
   const prerenderedRoutes = manifest.prerenderedRoutes ?? {};
   const routes = [...(options.paths ?? Object.keys(prerenderedRoutes))].sort();
-
-  await rm(options.exportDir, { force: true, recursive: true });
-  await mkdir(options.exportDir, { recursive: true });
-
-  for (const route of routes) {
+  const entries = routes.map((route): readonly [string, BuiltPrerenderedRoute] => {
+    routeToHtmlFile(options.exportDir, route);
     const entry = prerenderedRoutes[route];
 
     if (entry === undefined) {
       throw new Error(`Cannot export non-prerendered route: ${route}`);
     }
 
+    if (!isCurrentPrerenderedRoute(entry)) {
+      throw new Error(`Cannot export invalid prerendered route: ${route}`);
+    }
+
+    if (entry.status < 200 || entry.status >= 300) {
+      throw new Error(`Cannot export route ${route} with status ${entry.status}.`);
+    }
+
+    return [route, entry];
+  });
+
+  await rm(options.exportDir, { force: true, recursive: true });
+  await mkdir(options.exportDir, { recursive: true });
+
+  for (const [route, entry] of entries) {
     await writePrerenderedRoute(options.exportDir, route, entry);
   }
 

package/src/build.ts

@@ -70,7 +70,11 @@ import {
 import type { ModuleMetadata } from "@reckona/mreact-compiler";
 import type { RouteCachePolicy } from "./cache.js";
 import { routeCachePolicyFromSource } from "./cache.js";
-import { bundleMiddlewareModuleCode, renderAppRequest } from "./render.js";
+import {
+  bundleMiddlewareModuleCode,
+  renderAppRequest,
+  type RenderAppRequestRuntimeOptions,
+} from "./render.js";
 import { createAppRouterImportPolicyPlugin, type AppRouterImportPolicy } from "./import-policy.js";
 import {
   hasGenerateStaticParamsExport,
@@ -78,6 +82,7 @@ import {
   hasPrerenderExport,
   isStreamRouteSource,
   routeClosureMayUseAwaitBoundary,
+  routeClosureMayUseRequestInput,
   stripRouteBuildExports,
   stripRouteClientOnlyExports,
   stripRouteClientSource,
@@ -97,6 +102,10 @@ import { collectRouteCssFilesFromSources, collectSpecialBoundaryFiles } from "./
 import { existingRouteShellCandidates } from "./route-shells.js";
 import { sourceModuleCandidates } from "./source-modules.js";
 import { collectBuildInferredServerActions } from "./server-action-inference.js";
+import {
+  isVisitorDependentResponse,
+  PRERENDERED_ROUTE_SCHEMA_VERSION,
+} from "./prerender-entry.js";
 import { prepareRouteServerActionPlaceholders } from "./actions.js";
 import { viteDefineCacheKey, vitePluginsCacheKey } from "./vite-plugin-cache-key.js";
 import { workspacePackageFile } from "./workspace-packages.js";
@@ -368,6 +377,7 @@ export interface BuiltRouteSourceAnalysisSummary {
   routePath: string;
   sourceHash: string;
   streamRoute: boolean;
+  usesRequestInput?: boolean | undefined;
   usesRuntimeCacheControl: boolean;
 }
 
@@ -393,6 +403,7 @@ interface BuildRouteSourceAnalysis extends BuildSourceAnalysis {
   route: AppRoute & { kind: "page" };
   routeCode: string;
   streamRoute: boolean;
+  usesRequestInput: boolean;
 }
 
 interface BuildSourceAnalysisScope {
@@ -412,6 +423,8 @@ export interface BuiltServerModuleOutput {
 export interface BuiltPrerenderedRoute {
   headers: Record<string, string>;
   html: string;
+  /** Identifies entries that satisfy the complete current prerender contract. */
+  schemaVersion?: 2 | undefined;
   status: number;
 }
 
@@ -1384,6 +1397,14 @@ async function analyzeBuildRouteSources(options: {
             projectRoot: options.projectRoot,
             source,
           }),
+          usesRequestInput: await buildRouteUsesRequestInput({
+            file,
+            files: options.files,
+            project: options.project,
+            projectRoot: options.projectRoot,
+            routeFile: route.file,
+            source,
+          }),
         },
       ] as const;
     },
@@ -1411,6 +1432,39 @@ async function analyzeBuildRouteSources(options: {
   };
 }
 
+async function buildRouteUsesRequestInput(options: {
+  file: string;
+  files: Record<string, string>;
+  project: ResolvedAppRouterProject;
+  projectRoot: string;
+  routeFile: string;
+  source: string;
+}): Promise<boolean> {
+  const shells = await existingRouteShellCandidates(
+    options.project.routesDir,
+    options.routeFile,
+    async (shellFile) =>
+      options.files[relative(options.projectRoot, shellFile).split(sep).join("/")] !== undefined,
+  );
+  const sources = [
+    { file: options.file, source: options.source },
+    ...shells.flatMap((shell) => {
+      const file = relative(options.projectRoot, shell.file).split(sep).join("/");
+      const source = options.files[file];
+      return source === undefined ? [] : [{ file, source }];
+    }),
+  ];
+
+  return sources.some((entry) =>
+    routeClosureMayUseRequestInput({
+      filename: entry.file,
+      files: options.files,
+      projectRoot: options.projectRoot,
+      source: entry.source,
+    })
+  );
+}
+
 function analyzeBuildSource(source: string, filename: string): BuildSourceAnalysis {
   const cachePolicy = routeCachePolicyFromSource(source);
   const sourceHash = hashText(source);
@@ -2564,7 +2618,10 @@ async function prerenderStaticRoutes(options: {
 
       const entries: Array<[string, BuiltPrerenderedRoute]> = [];
       for (const pathname of await prerenderPathsForRoute(route, analysis, options.vitePlugins)) {
-        const response = await renderAppRequest({
+        const renderSignals = {
+          headerDependent: () => true,
+        };
+        const renderOptions = {
           appDir: options.appDir,
           assetBaseUrl: options.assetBaseUrl,
           clientScripts,
@@ -2573,10 +2630,18 @@ async function prerenderStaticRoutes(options: {
           importPolicy,
           navigationScripts,
           request: new Request(`http://mreact.local${pathname}`),
+          renderSignals,
           serverModuleCacheVersion,
           serverModules: serverModuleMap,
           vitePlugins: options.vitePlugins,
-        });
+        } satisfies RenderAppRequestRuntimeOptions;
+        const response = await renderAppRequest(renderOptions);
+        const html = await response.text();
+
+        if (renderSignals.headerDependent() || isVisitorDependentResponse(response)) {
+          continue;
+        }
+
         const headers: Record<string, string> = {};
 
         response.headers.forEach((value, key) => {
@@ -2586,7 +2651,8 @@ async function prerenderStaticRoutes(options: {
           pathname,
           {
             headers,
-            html: await response.text(),
+            html,
+            schemaVersion: PRERENDERED_ROUTE_SCHEMA_VERSION,
             status: response.status,
           },
         ]);
@@ -3141,6 +3207,7 @@ function builtRouteSourceAnalysisSummary(options: {
     routePath: options.analysis.route.path,
     sourceHash: options.analysis.sourceHash,
     streamRoute: options.analysis.streamRoute,
+    usesRequestInput: options.analysis.usesRequestInput,
     usesRuntimeCacheControl: options.analysis.usesRuntimeCacheControl,
   };
 }

package/src/built-runtime.ts

@@ -25,7 +25,7 @@ export interface BuiltRuntime extends BuiltServerModuleArtifactRuntime {
   projectRoot: string;
   publicAssetBaseUrl?: string | undefined;
   prerenderableRoutes: ReadonlySet<string>;
-  prerenderLocks: Map<string, Promise<Response>>;
+  prerenderLocks: Map<string, Promise<{ response: Response; shareable: boolean }>>;
   prerenderedRoutes: Map<string, BuiltPrerenderedRoute>;
   routeMatcher: RouteMatcher;
   routes: readonly AppRoute[];
@@ -78,7 +78,7 @@ export async function materializeBuiltRuntime(options: {
   }));
   const prerenderedRoutes = new Map(Object.entries(serverManifest.prerenderedRoutes ?? {}));
   const prerenderableRoutes = new Set(prerenderedRoutes.keys());
-  const prerenderLocks = new Map<string, Promise<Response>>();
+  const prerenderLocks = new Map<string, Promise<{ response: Response; shareable: boolean }>>();
   const serverModules = new Map<string, BuiltServerModuleArtifact>(
     Object.entries(serverManifest.serverModules ?? {}).map(([file, artifact]) => [
       join(appDir, file),

package/src/cache.ts

@@ -24,8 +24,31 @@ export interface AppRouterCacheEntry {
   body: string;
   cacheControl: string;
   expiresAt: number;
+  /**
+   * Response headers to replay on a cache hit.
+   *
+   * Metadata-derived security headers such as `content-security-policy`,
+   * `x-frame-options` and `x-content-type-options` live here, so that turning a
+   * route into a cached one does not quietly drop them.
+   */
+  headers?: Record<string, string> | undefined;
   path: string;
+  /**
+   * Identifies entries that preserve the complete current cache contract.
+   *
+   * Missing markers are treated as cache misses so HTML written by older
+   * runtimes, or custom serializers that drop new security fields, is never
+   * replayed under the current security rules.
+   */
+  schemaVersion?: 2 | undefined;
   status: number;
+  /**
+   * Strict-Transport-Security value to replay to secure requests only.
+   *
+   * It is kept out of `headers` because it depends on the scheme of the
+   * request that produced the entry, which the cache key does not cover.
+   */
+  strictTransportSecurity?: string | undefined;
 }
 
 /**
@@ -277,16 +300,29 @@ export function cachedRouteResponse(options: {
     const now = options.now ?? Date.now();
     const cached = await cache.get(options.key, now);
 
-    if (cached === undefined || cached.expiresAt <= now) {
+    if (
+      cached === undefined ||
+      cached.expiresAt <= now ||
+      cached.schemaVersion !== ROUTE_CACHE_ENTRY_SCHEMA_VERSION ||
+      !isStringRecord(cached.headers)
+    ) {
       return undefined;
     }
 
+    const headers = new Headers(cached.headers ?? {});
+    headers.set("cache-control", cached.cacheControl);
+    if (!headers.has("content-type")) {
+      headers.set("content-type", "text/html; charset=utf-8");
+    }
+    headers.set("x-mreact-cache", "HIT");
+    // Replayed against the scheme of the request being served, not the one
+    // that produced the entry.
+    if (cached.strictTransportSecurity !== undefined && isSecureRequest(options.request)) {
+      headers.set(HSTS_HEADER, cached.strictTransportSecurity);
+    }
+
     return new Response(cached.body, {
-      headers: {
-        "cache-control": cached.cacheControl,
-        "content-type": "text/html; charset=utf-8",
-        "x-mreact-cache": "HIT",
-      },
+      headers,
       status: cached.status,
     });
   });
@@ -294,18 +330,35 @@ export function cachedRouteResponse(options: {
 
 export async function cacheRouteResponse(options: {
   cache?: AppRouterCache | undefined;
+  headerDependent?: boolean | undefined;
   key: string;
   now?: number;
   path: string;
   policy: RouteCachePolicy | undefined;
   request?: Request | undefined;
   response: Response;
+  /** Configured Strict-Transport-Security value, independent of this request's scheme. */
+  strictTransportSecurity?: string | undefined;
 }): Promise<Response> {
   if (options.policy === undefined) {
     return options.response;
   }
 
   if (options.policy.revalidateSeconds === 0) {
+    // No entry is stored here, but cacheControl({ maxAge }) still emits a bare
+    // max-age that a shared cache may store, so a header dependent render has
+    // to opt out of that too. Directives that already keep the response out of
+    // shared caches are left exactly as the application asked for them.
+    const sharedCacheMayStore = !/(^|,)\s*(private|no-store)\s*(,|$)/.test(
+      options.policy.cacheControl,
+    );
+
+    if (options.headerDependent === true && sharedCacheMayStore) {
+      options.response.headers.set("cache-control", "private, no-store");
+      options.response.headers.set("x-mreact-cache", "DYNAMIC");
+      return options.response;
+    }
+
     options.response.headers.set("cache-control", options.policy.cacheControl);
     return options.response;
   }
@@ -315,7 +368,12 @@ export async function cacheRouteResponse(options: {
   const status = options.response.status;
   const contentType = options.response.headers.get("content-type") ?? "text/html; charset=utf-8";
 
+  // A render that read a request header only produced HTML that is correct for
+  // that header value. The cache key covers the path and query alone, so the
+  // entry cannot be shared; the response is marked uncacheable for downstream
+  // shared caches too, which are keyed the same way.
   if (
+    options.headerDependent === true ||
     requestCarriesCredentials(options.request) ||
     options.response.headers.has("set-cookie")
   ) {
@@ -324,6 +382,9 @@ export async function cacheRouteResponse(options: {
     if (!headers.has("content-type")) {
       headers.set("content-type", contentType);
     }
+    if (options.headerDependent === true) {
+      headers.set("x-mreact-cache", "DYNAMIC");
+    }
 
     return new Response(body, {
       headers,
@@ -331,24 +392,69 @@ export async function cacheRouteResponse(options: {
     });
   }
 
+  // Metadata-derived security headers are part of the rendered response, so
+  // they are stored with it and replayed on a hit rather than dropped by the
+  // rebuilt cache response. Strict-Transport-Security is kept apart because it
+  // is derived from the scheme of whichever request missed and the key does not
+  // cover the scheme: it is replayed only to requests that are themselves
+  // secure, instead of pinning one visitor's scheme onto the entry.
+  const storedHeaders: Record<string, string> = {};
+  options.response.headers.forEach((value, key) => {
+    if (key !== "cache-control" && key !== "x-mreact-cache" && key !== HSTS_HEADER) {
+      storedHeaders[key] = value;
+    }
+  });
+  // Taken from the route's configuration rather than from this response, whose
+  // HSTS header is present only when this particular request was secure. Using
+  // the response would let one plain request pin an entry that withholds HSTS
+  // from every later secure visitor.
+  const hsts = options.strictTransportSecurity;
+
   await (options.cache ?? cacheState.memoryCache).set(options.key, {
     body,
     cacheControl,
     expiresAt: (options.now ?? Date.now()) + options.policy.revalidateSeconds * 1000,
+    headers: storedHeaders,
+    ...(hsts === undefined ? {} : { strictTransportSecurity: hsts }),
     path: normalizeRevalidationPath(options.path),
+    schemaVersion: ROUTE_CACHE_ENTRY_SCHEMA_VERSION,
     status,
   });
 
+  const headers = new Headers(storedHeaders);
+  headers.set("cache-control", cacheControl);
+  if (!headers.has("content-type")) {
+    headers.set("content-type", contentType);
+  }
+  headers.set("x-mreact-cache", "MISS");
+  if (hsts !== undefined && isSecureRequest(options.request)) {
+    headers.set(HSTS_HEADER, hsts);
+  }
+
   return new Response(body, {
-    headers: {
-      "cache-control": cacheControl,
-      "content-type": contentType,
-      "x-mreact-cache": "MISS",
-    },
+    headers,
     status,
   });
 }
 
+const HSTS_HEADER = "strict-transport-security";
+const ROUTE_CACHE_ENTRY_SCHEMA_VERSION = 2;
+
+function isStringRecord(value: unknown): value is Record<string, string> {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    !Array.isArray(value) &&
+    Object.values(value).every((entry) => typeof entry === "string")
+  );
+}
+
+function isSecureRequest(request: Request | undefined): boolean {
+  // `Request.url` is always absolute, so this avoids parsing a URL on the
+  // cache-hit hot path.
+  return request?.url.startsWith("https://") === true;
+}
+
 function requestCarriesCredentials(request: Request | undefined): boolean {
   if (request === undefined) {
     return false;

package/src/cli-options.ts

@@ -28,6 +28,7 @@ export interface ParsedCliArguments {
   routeArg?: string | undefined;
   skipRuntimeDependencyCheck?: boolean | undefined;
   target?: CliBuildTarget | undefined;
+  trustForwardedProto?: boolean | undefined;
   worker?: string | undefined;
 }
 
@@ -103,6 +104,14 @@ export function parseCliArguments(argv: readonly string[]): ParsedCliArguments {
       continue;
     }
 
+    if (value === "--trust-forwarded-proto") {
+      if (command !== "start") {
+        throw new Error("--trust-forwarded-proto is only supported by the start command");
+      }
+      parsed.trustForwardedProto = true;
+      continue;
+    }
+
     if (value.startsWith("--allowed-hosts=")) {
       parsed.allowedHosts = parseCliAllowedHosts(value.slice("--allowed-hosts=".length));
       continue;
@@ -330,6 +339,8 @@ export function formatCliHelp(command?: string | undefined): string {
       "      Control Host header trust for request origin reconstruction.",
       "  --allowed-hosts <host[,host...]>",
       "      Exact Host header allow-list for public deployments.",
+      "  --trust-forwarded-proto",
+      "      Trust the first X-Forwarded-Proto value. Enable only when a trusted proxy overwrites the header and the Node port is not publicly reachable.",
       "  --log=requests  Print request summaries.",
       "  -h, --help      Show this help message.",
       "",
@@ -339,6 +350,8 @@ export function formatCliHelp(command?: string | undefined): string {
       "                  Host header trust policy when --host-policy is not set.",
       "  MREACT_ROUTER_ALLOWED_HOSTS",
       "                  Comma-separated Host header allow-list when --allowed-hosts is not set.",
+      "  MREACT_ROUTER_TRUST_FORWARDED_PROTO",
+      "                  Set to 1 to trust X-Forwarded-Proto when the flag is not set.",
       "  PORT            TCP port. Default: 3001.",
     ].join("\n");
   }
@@ -480,6 +493,17 @@ export function resolveCliAllowedHosts(
   return envValue === undefined || envValue === "" ? undefined : parseCliAllowedHosts(envValue);
 }
 
+export function resolveCliTrustForwardedProto(
+  flagValue: boolean | undefined,
+  env: { MREACT_ROUTER_TRUST_FORWARDED_PROTO?: string | undefined },
+): boolean {
+  if (flagValue !== undefined) {
+    return flagValue;
+  }
+
+  return env.MREACT_ROUTER_TRUST_FORWARDED_PROTO === "1";
+}
+
 export function createCliRequestLogger(): AppRouterLogger {
   return {
     error(event) {

package/src/cli.ts

@@ -25,6 +25,7 @@ import {
   resolveCliHost,
   resolveCliHostPolicy,
   resolveCliRequestLogMode,
+  resolveCliTrustForwardedProto,
 } from "./cli-options.js";
 import { startDevServer } from "./dev-server.js";
 import { startServer } from "./serve.js";
@@ -169,6 +170,10 @@ if (parsed !== undefined) {
           logger,
           outDir: resolve(routeArg ?? ".mreact"),
           port: Number(process.env.PORT ?? 3001),
+          trustForwardedProto: resolveCliTrustForwardedProto(
+            parsed.trustForwardedProto,
+            process.env,
+          ),
         });
         console.log(`mreact app router serving built output at ${server.url}`);
       } else {