@rivetjs/router 0.0.0-stage → 0.1.0-alpha.0

package/adapters/static.js

@@ -0,0 +1,231 @@
+// Static adapter: prerender resumable pages (static routes + `entries()`) through the app handler,
+// with `_data.json` beside each page for client navigation and a CSR shell for the rest.
+import { createHash } from "node:crypto";
+import { mkdir, readFile, readdir, rm, rmdir, writeFile } from "node:fs/promises";
+import { dirname, join, resolve, sep } from "node:path";
+import { DATA_PARAM } from "../shared/data.js";
+import { loadServer } from "../server/module.js";
+import { hashPolicy, inlineSources } from "../shared/csp-hash.js";
+import { normalizeBase } from "../shared/base.js";
+import { slashPath } from "../shared/slash.js";
+/** Fill a router pattern with params (`:name` encoded, `*name` encoded per segment). */
+export function fillPattern(pattern, params) {
+    const out = pattern.replace(/([:*])([A-Za-z_$][\w$]*)/g, (_, kind, name) => {
+        const value = params[name];
+        if (value === undefined || value === "")
+            throw new Error(`Missing param "${name}" for ${pattern}`);
+        return kind === "*" ? value.split("/").map(encodeURIComponent).join("/") : encodeURIComponent(value);
+    });
+    return out.replace(/\/+$/, "") || "/";
+}
+/**
+ * Add a CSP `<meta>` to a static page: its inline scripts allowed by SHA-256 hash, script files from
+ * its own origin, no plugins, no `<base>`. (`'strict-dynamic'` would not do: browsers pass a nonce's
+ * trust on to `import()`, but not a hash's, and the resume loader imports its chunks.) Pages without
+ * `<head>` or without inline scripts (and no `options.directives`) are returned unchanged. The `<meta>` goes after a
+ * leading `<meta charset>` and `<meta name="viewport">` (the charset must stay in the first 1024 bytes, first).
+ * `options.directives` merge in (`cspPolicy`): e.g. `{ "script-src": "'wasm-unsafe-eval'", "worker-src": "'self' blob:" }`;
+ * header-only directives (`frame-ancestors`, `report-uri`, `report-to`, `sandbox`) throw.
+ */
+export function hashCSP(html, options) {
+    const sha = (text) => `'sha256-${createHash("sha256").update(text, "utf8").digest("base64")}'`;
+    // Inline `<style>` elements (inlined stylesheets, head styles): hashed into a `style-src` / `style-src-elem` the options set.
+    const found = inlineSources(html, !!options?.directives);
+    const head = /<head\b[^>]*>/i.exec(html);
+    const extra = options?.directives !== undefined && Object.keys(options.directives).length > 0;
+    if ((!found.scripts.length && !extra) || !head)
+        return html;
+    const policy = hashPolicy(found.scripts.map(sha), found.origins, found.styles.map(sha), options, true);
+    // After a leading charset / viewport meta (in that order), before everything else.
+    const lead = /^(?:\s*<meta\s+charset\b[^>]*>)?(?:\s*<meta\s+name\s*=\s*["']?viewport\b[^>]*>)?/i.exec(html.slice(head.index + head[0].length));
+    const at = head.index + head[0].length + lead[0].length;
+    return html.slice(0, at) + `<meta http-equiv="Content-Security-Policy" content="${policy}">` + html.slice(at);
+}
+/** Synthetic request origin when `origin` is unset. */
+const PLACEHOLDER = "http://localhost";
+const STATE = /<script type="rivet\/state"[^>]*>[^<]*/g;
+// The placeholder origin as JSON / HTML text holds it (`http://localhost/…`, `http://localhost"`; `:port` is another origin).
+const PLACEHELD = /http:(?:\\?\/){2}localhost(?![\w.:-])/;
+const placeholder = (text) => PLACEHELD.test(text);
+const ambiguous = (url, where, text) => {
+    const at = PLACEHELD.exec(text).index;
+    return `Prerender ${url}: the ${where} holds the placeholder origin http://localhost (a URL string built from the request URL: …${text.slice(Math.max(0, at - 40), at + 60)}…); pass prerender({ origin }) / prerenderBuild({ origin }) with the site's origin`;
+};
+// `<script src>` / `<link rel=modulepreload href>` (attribute order as rendered: rel before href).
+const SCRIPT_URL = /<(script\b[^>]*?\ssrc|link\b[^>]*?\srel="?modulepreload"?[^>]*?\shref)="([^"]+)"/g;
+/** Delete the client build's scripts outside the referenced ones' import closure, and every `*.deps.js` module. */
+async function prune(outDir, base, scripts) {
+    let manifest;
+    try {
+        manifest = JSON.parse(await readFile(join(resolve(outDir), ".vite/manifest.json"), "utf8"));
+    }
+    catch {
+        return [];
+    }
+    const byFile = new Map(Object.values(manifest).map((chunk) => [chunk.file, chunk]));
+    const keep = new Set();
+    const visit = (file) => {
+        const chunk = file === undefined ? undefined : byFile.get(file);
+        if (!chunk || keep.has(chunk.file))
+            return;
+        keep.add(chunk.file);
+        for (const key of [...(chunk.imports ?? []), ...(chunk.dynamicImports ?? [])])
+            visit(manifest[key]?.file);
+    };
+    for (const src of scripts) {
+        if (!src.startsWith("/") || src.startsWith("//"))
+            continue;
+        const path = base && src.startsWith(base + "/") ? src.slice(base.length) : src;
+        visit(path.slice(1).split(/[?#]/)[0]);
+    }
+    const drop = [...byFile.keys()].filter((file) => file.endsWith(".js") && !keep.has(file));
+    // The loader's deps modules (`<chunk>.deps.js`): only resumed pages import them.
+    const deps = (await readdir(resolve(outDir), { recursive: true })).map((file) => file.split(sep).join("/")).filter((file) => file.endsWith(".deps.js"));
+    const out = [...new Set([...drop, ...deps])].sort();
+    await Promise.all(out.map((file) => rm(resolve(outDir, file), { force: true })));
+    // Directories left empty (`assets/`).
+    for (const dir of new Set(out.map((file) => dirname(resolve(outDir, file)))))
+        if (dir !== resolve(outDir))
+            await rmdir(dir).catch(() => undefined);
+    return out;
+}
+/** Output file for a URL path, kept inside outDir. */
+function target(outDir, path, file) {
+    const root = resolve(outDir);
+    const decoded = decodeURIComponent(path);
+    const out = resolve(root, "." + decoded, file);
+    if (out !== root && !out.startsWith(root + sep))
+        throw new Error(`Prerender path escapes outDir: ${path}`);
+    return out;
+}
+async function write(path, body) {
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, body);
+}
+/**
+ * Prerender every eligible route. Non-prerenderable routes with server modules are errors, and so are two
+ * pages whose paths differ only in letter case (checked before the second one is written).
+ */
+export async function prerender(options) {
+    const { handler, routes, outDir, trailingSlash = "ignore" } = options;
+    const origin = options.origin ?? PLACEHOLDER;
+    // Directive mistakes throw before any page is rendered.
+    if (options.csp)
+        hashCSP("<head><script></script>", options.csp);
+    const base = normalizeBase(options.base);
+    // Output paths: the URL path below the base.
+    const local = (path) => (base && (path === base || path.startsWith(base + "/")) ? path.slice(base.length) || "/" : path);
+    // Some prerendered page resumes (state script): client navigation may run, so pages get `_data.json` files.
+    let resumes = false;
+    const html = async (response, url) => {
+        const text = await response.text();
+        const states = text.match(STATE);
+        if (states)
+            resumes = true;
+        if (options.prune)
+            for (const [, , src] of text.matchAll(SCRIPT_URL))
+                scripts.add(src);
+        const held = origin === PLACEHOLDER ? states?.find(placeholder) : undefined;
+        if (held)
+            throw new Error(ambiguous(url, "resume state", held));
+        return options.csp === false ? text : hashCSP(text, options.csp);
+    };
+    const report = { pages: [], fallback: [], resumes: false };
+    // Script URLs the pages reference (`prune`).
+    const scripts = new Set();
+    const done = new Set();
+    // Prerendered page paths (their `_data.json` files are written after every page rendered).
+    const written = [];
+    // Output paths folded to lower case → the page that took it.
+    const files = new Map();
+    const render = async (path, data) => {
+        const url = new URL(path, origin);
+        if (data)
+            url.searchParams.set(DATA_PARAM, "data");
+        return handler(new Request(url, { headers: { accept: data ? "application/json" : "text/html" } }));
+    };
+    for (const route of routes) {
+        if (!route.page)
+            continue;
+        const module = await loadServer(route.server);
+        const dynamic = /[:*]/.test(route.pattern);
+        const enabled = module?.prerender ?? (!dynamic || module?.entries !== undefined);
+        if (!enabled) {
+            // Layout loaders/guards run per request too: the CSR shell would skip them.
+            const layouts = await Promise.all(route.layouts.map(loadServer));
+            if ([module, ...layouts].some((m) => m?.load || m?.guard))
+                throw new Error(`Route ${route.id} needs a server (serverLoad/serverGuard on it or a layout, without prerender); use the node adapter or add serverEntries()`);
+            if (!report.fallback.includes(route.id))
+                report.fallback.push(route.id);
+            continue;
+        }
+        const sets = dynamic ? [...((await module?.entries?.()) ?? [])] : [{}];
+        for (const params of sets) {
+            const path = fillPattern(route.pattern, params);
+            if (done.has(path))
+                continue;
+            done.add(path);
+            // One file on case-insensitive file systems (macOS, Windows) and hosts: the later page would overwrite the earlier.
+            const folded = decodeURIComponent(local(path)).toLowerCase();
+            const clash = files.get(folded);
+            if (clash !== undefined)
+                throw new Error(`Prerender paths ${clash} and ${path} (${route.id}) differ only in letter case: one output file on case-insensitive file systems`);
+            files.set(folded, path);
+            // The canonical URL (`trailingSlash`): the other form would answer 308.
+            const url = slashPath(path, trailingSlash);
+            const page = await render(url, false);
+            if (page.status !== 200)
+                throw new Error(`Prerender ${url} (${route.id}) returned ${page.status}`);
+            const at = local(path);
+            await write(trailingSlash === "never" && at !== "/" ? target(outDir, at + ".html", "") : target(outDir, at, "index.html"), await html(page, url));
+            report.pages.push(url);
+            written.push(path);
+        }
+    }
+    const missing = await render(base + "/__rivet_not_found__", false);
+    if (missing.status === 404)
+        await write(join(resolve(outDir), "404.html"), await html(missing, "404.html"));
+    // `_data.json` serves client navigation only: none when no page resumes (zero-JS sites: links load documents)
+    // and no CSR shell route navigates. (Per page they stay: any resumed page's router may navigate to any route.)
+    if (resumes || report.fallback.length)
+        for (const path of written) {
+            const url = slashPath(path, trailingSlash);
+            const data = await render(url, true);
+            const body = new Uint8Array(await data.arrayBuffer());
+            const text = origin === PLACEHOLDER ? new TextDecoder().decode(body) : "";
+            if (placeholder(text))
+                throw new Error(ambiguous(url, "_data.json", text));
+            await write(target(outDir, local(path), "_data.json"), body);
+        }
+    report.resumes = resumes;
+    if (options.prune && !resumes && !report.fallback.length) {
+        const pruned = await prune(outDir, base, scripts);
+        if (pruned.length)
+            report.pruned = pruned;
+    }
+    if (report.fallback.length) {
+        if (!options.shell)
+            throw new Error(`Routes ${report.fallback.join(", ")} need a CSR shell (options.shell)`);
+        await write(join(resolve(outDir), "200.html"), await options.shell());
+    }
+    return report;
+}
+/**
+ * Prerender a production build (`vite build` + `vite build --ssr`, router `mode: "static"`) into its
+ * client directory, so `<dist>/client` is the deployable site.
+ */
+export async function prerenderBuild(options = {}) {
+    const { loadBuild } = await import("./build.js");
+    const { entry, handler, client } = await loadBuild(options.dist ?? "dist", options.preload ? { preload: options.preload } : {}, options.locales ? { locales: options.locales } : {});
+    return prerender({
+        handler,
+        routes: entry.routes,
+        outDir: client,
+        ...(entry.base ? { base: entry.base } : {}),
+        ...(entry.trailingSlash ? { trailingSlash: entry.trailingSlash } : {}),
+        ...(options.origin ? { origin: options.origin } : {}),
+        ...(options.shell ? { shell: options.shell } : {}),
+        ...(options.csp !== undefined ? { csp: options.csp } : {}),
+        prune: options.prune ?? true,
+    });
+}

package/adapters/target-build.d.ts

@@ -0,0 +1,92 @@
+import type { Plugin, UserConfig } from "vite";
+import type { FetchOptions } from "./fetch.js";
+import type { CSPOptions } from "../shared/csp.js";
+/** Options every target shares: build-time defaults serialized into the generated entry. */
+interface TargetOptions extends Pick<FetchOptions, "origin" | "maxBody" | "stream" | "headers"> {
+    /** Build-time CSP (serialized into the entry): `false` or `{ trustedTypes, directives }`; a policy function goes to `create({ csp })`. */
+    readonly csp?: false | CSPOptions;
+    /** i18n: per-locale client builds (`client/<locale>/`, see `loadBuild`). */
+    readonly locales?: readonly string[];
+}
+/** `"fetch"`: `dist/server/fetch.js` (`export default { fetch }`) for any web-standard runtime. */
+export interface FetchAdapterOptions extends TargetOptions {
+    readonly name: "fetch";
+}
+/**
+ * Vercel, Build Output API v3 (https://vercel.com/docs/build-output-api/v3): `.vercel/output/`
+ * with `config.json`, `static/` (client files + prerendered pages) and one function.
+ */
+export interface VercelAdapterOptions extends TargetOptions {
+    readonly name: "vercel";
+    /**
+     * `"nodejs"` (default; Vercel's recommendation): a Node.js function running the node adapter's
+     * listener (direct page bodies, no web-stream reads). `"edge"`: an Edge Runtime function (fetch adapter).
+     */
+    readonly runtime?: "nodejs" | "edge";
+    /** Node.js major for `runtime: "nodejs"` (`.vc-config.json` `runtime: "nodejs<major>.x"`); default 24. */
+    readonly nodeVersion?: 20 | 22 | 24;
+    /** Function regions (`.vc-config.json` `regions`). */
+    readonly regions?: readonly string[];
+    /** Node.js function limits (`.vc-config.json` `maxDuration` seconds, `memory` MB). */
+    readonly maxDuration?: number;
+    readonly memory?: number;
+    /**
+     * Incremental Static Regeneration for routes that `export const prerender = true` (Node.js runtime
+     * only): instead of build-time files, prerender functions cached by Vercel's CDN and regenerated
+     * after `expiration` seconds (`false`: never). Cached pages share one CSP nonce: see the deploy guide.
+     */
+    readonly isr?: {
+        readonly expiration: number | false;
+    };
+    /** Brotli/gzip in the Node.js function (default true; see `@rivetjs/router/vercel`). */
+    readonly compress?: boolean;
+}
+/**
+ * Netlify, Frameworks API (https://docs.netlify.com/build/frameworks/frameworks-api/): a
+ * Functions v2 function (or an Edge Function) in `.netlify/v1/`, `config.json` headers, and the
+ * publish directory `dist/netlify` (client files + prerendered pages).
+ */
+export interface NetlifyAdapterOptions extends TargetOptions {
+    readonly name: "netlify";
+    /** Render in an Edge Function (Deno, at the edge) instead of a Node.js function. */
+    readonly edge?: boolean;
+}
+/**
+ * Cloudflare Workers with static assets (https://developers.cloudflare.com/workers/static-assets/):
+ * `dist/cloudflare/wrangler.json` (+ `.wrangler/deploy/config.json` pointing Wrangler at it) and the
+ * assets directory `dist/cloudflare/static`.
+ */
+export interface CloudflareAdapterOptions extends TargetOptions {
+    readonly name: "cloudflare";
+    /**
+     * Extra Wrangler configuration merged into the generated `wrangler.json` (bindings, `routes`,
+     * `vars`, …). A `wrangler.json` / `wrangler.jsonc` in the project root is merged first.
+     */
+    readonly wrangler?: Readonly<Record<string, unknown>>;
+}
+/** Bun: `bun dist/server/bun.js` serves `dist/client` and the app with `Bun.serve`. */
+export interface BunAdapterOptions extends TargetOptions {
+    readonly name: "bun";
+}
+/** Deno: `deno run -A dist/server/deno.js` serves `dist/client` and the app with `Deno.serve`. */
+export interface DenoAdapterOptions extends TargetOptions {
+    readonly name: "deno";
+}
+export type AdapterOptions = FetchAdapterOptions | VercelAdapterOptions | NetlifyAdapterOptions | CloudflareAdapterOptions | BunAdapterOptions | DenoAdapterOptions;
+export type AdapterName = AdapterOptions["name"];
+/** Generated entry file name (`dist/server/<file>.js`) per target. */
+export declare const ENTRY_FILE: Readonly<Record<AdapterName, string>>;
+/** `rivetRouter({ adapter })` value → options (a bare name = defaults). */
+export declare function adapterOptions(adapter: AdapterName | AdapterOptions | undefined): AdapterOptions | undefined;
+/** SSR build config: both `entry.server` and the target's entry; dependencies bundled (functions and edge runtimes get no node_modules). */
+export declare function targetBuildConfig(options: AdapterOptions, entry: string, outDir: string): UserConfig;
+/** Build facts the plugin needs from the router plugin. */
+export interface TargetContext {
+    /** Generated `entry.server.tsx`. */
+    serverEntry(): string;
+    /** Router `mode` (`server` / `static`). */
+    mode(): "server" | "static" | "csr";
+}
+/** Plugin generating the target entry and, for platform targets, packaging the build after it is written. */
+export declare function targetEntryPlugin(options: AdapterOptions, context: TargetContext): Plugin;
+export {};

package/adapters/target-build.js

@@ -0,0 +1,118 @@
+// Build side of the deploy targets (`rivetRouter({ adapter })`): the server build gets a second
+// entry, a generated module that imports the server entry, inlines the client build's manifests
+// (read here, at build time, so the bundle needs no file system at run time) and hands both to the
+// target's runtime module (`fetch.ts`, `vercel.ts`, `netlify.ts`, …). Platform targets then package
+// the build into the layout their platform deploys (`pack.ts`, after the server bundle is written).
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { readManifests } from "./build.js";
+import { normalizeBase } from "../shared/base.js";
+/** Generated entry file name (`dist/server/<file>.js`) per target. */
+export const ENTRY_FILE = {
+    fetch: "fetch",
+    vercel: "vercel",
+    netlify: "netlify",
+    cloudflare: "worker",
+    bun: "bun",
+    deno: "deno",
+};
+/** Options that only shape the build output (never serialized into the entry). */
+const BUILD_ONLY = new Set(["name", "locales", "runtime", "nodeVersion", "regions", "maxDuration", "memory", "edge", "wrangler"]);
+const TARGET = "\0rivet-target-entry";
+// Paths in this form (`new URL("./x.js", import.meta.url)`) are rewritten to `.js` by the package build.
+const runtimes = {
+    fetch: fileURLToPath(new URL("./fetch.js", import.meta.url)),
+    vercel: fileURLToPath(new URL("./vercel.js", import.meta.url)),
+    vercelEdge: fileURLToPath(new URL("./vercel-edge.js", import.meta.url)),
+    netlify: fileURLToPath(new URL("./netlify.js", import.meta.url)),
+    cloudflare: fileURLToPath(new URL("./cloudflare.js", import.meta.url)),
+    bun: fileURLToPath(new URL("./bun.js", import.meta.url)),
+    deno: fileURLToPath(new URL("./deno.js", import.meta.url)),
+};
+/** `rivetRouter({ adapter })` value → options (a bare name = defaults). */
+export function adapterOptions(adapter) {
+    if (adapter === undefined)
+        return undefined;
+    const options = typeof adapter === "string" ? { name: adapter } : adapter;
+    if (!(options.name in ENTRY_FILE))
+        throw new Error(`rivetRouter: unknown adapter "${String(options.name)}" (${Object.keys(ENTRY_FILE).join(", ")})`);
+    if (options.name === "vercel" && options.isr && options.runtime === "edge")
+        throw new Error('rivetRouter: adapter "vercel": isr needs runtime "nodejs"');
+    return options;
+}
+/** SSR build config: both `entry.server` and the target's entry; dependencies bundled (functions and edge runtimes get no node_modules). */
+export function targetBuildConfig(options, entry, outDir) {
+    return {
+        ssr: { noExternal: true },
+        build: { ssr: true, outDir, copyPublicDir: false, rollupOptions: { input: { "entry.server": entry, [ENTRY_FILE[options.name]]: TARGET } } },
+    };
+}
+/** Runtime module and the generated entry's tail per target. */
+function runtimeOf(options) {
+    const created = ["export const create = (options = {}) => createTarget(entry, build, { ...defaults, ...options });", "export default create();"];
+    switch (options.name) {
+        case "fetch":
+            return { path: runtimes.fetch, name: "createFetch", tail: created };
+        case "vercel":
+            return { path: options.runtime === "edge" ? runtimes.vercelEdge : runtimes.vercel, name: "create", tail: created };
+        case "netlify":
+            return { path: runtimes.netlify, name: "create", tail: created };
+        case "cloudflare":
+            return { path: runtimes.cloudflare, name: "create", tail: created };
+        case "bun":
+        case "deno":
+            // Runs when started directly (`bun dist/server/bun.js`); importing it (a custom server) does not listen.
+            return {
+                path: runtimes[options.name],
+                name: "start",
+                tail: [
+                    'const client = "../client/";',
+                    "export const start = (options = {}) => createTarget(entry, build, { client: new URL(client, import.meta.url), ...defaults, ...options });",
+                    "if (import.meta.main) start();",
+                ],
+            };
+    }
+}
+/** Plugin generating the target entry and, for platform targets, packaging the build after it is written. */
+export function targetEntryPlugin(options, context) {
+    let root = "";
+    let outDir = "";
+    let base = "";
+    return {
+        name: "vite-plugin-rivet-target",
+        applyToEnvironment: (environment) => environment.config.consumer === "server",
+        configResolved(config) {
+            root = config.root;
+            outDir = resolve(config.root, config.build.outDir);
+            base = normalizeBase(config.base);
+        },
+        resolveId: (id) => (id === TARGET ? id : null),
+        async load(id) {
+            if (id !== TARGET)
+                return null;
+            const { locales } = options;
+            const defaults = Object.fromEntries(Object.entries(options).filter(([key]) => !BUILD_ONLY.has(key)));
+            const manifests = await readManifests(resolve(outDir, ".."), { ...(locales?.length ? { locales } : {}), base }).catch((error) => {
+                throw new Error(`rivetRouter({ adapter: "${options.name}" }): build the client first (vite build, then vite build --ssr): ${error.message}`);
+            });
+            const json = (value) => `JSON.parse(${JSON.stringify(JSON.stringify(value))})`;
+            const runtime = runtimeOf(options);
+            return [
+                `import * as entry from ${JSON.stringify(context.serverEntry())};`,
+                `import { ${runtime.name} as createTarget } from ${JSON.stringify(runtime.path)};`,
+                `const build = ${json(manifests)};`,
+                `const defaults = ${JSON.stringify(defaults)};`,
+                "/** Runtime options (`onError`, `address`, `csp` function, …) over the build-time defaults. */",
+                ...runtime.tail,
+                "",
+            ].join("\n");
+        },
+        async closeBundle() {
+            // `vite build --ssr` only (the client build has no target entry), platform targets only.
+            if (this.environment?.config.consumer !== "server" || !["vercel", "netlify", "cloudflare"].includes(options.name))
+                return;
+            const { pack } = await import("./pack.js");
+            await pack(options, { root, dist: resolve(outDir, ".."), server: outDir, base, mode: context.mode() === "static" ? "static" : "server" });
+        },
+    };
+}

package/adapters/vercel-edge.d.ts

@@ -0,0 +1,7 @@
+import type { GeneratedEntry } from "../server/app.js";
+import type { BuildManifests } from "./assemble.js";
+import { type FetchOptions } from "./fetch.js";
+export type VercelEdgeOptions = Omit<FetchOptions, "serveAssets">;
+/** Edge function handler: `context` (`waitUntil`) reaches loaders as `event.platform.ctx`. */
+export type VercelEdgeHandler = (request: Request, context?: unknown) => Promise<Response>;
+export declare function create(entry: GeneratedEntry, build: BuildManifests, options?: VercelEdgeOptions): VercelEdgeHandler;

package/adapters/vercel-edge.js

@@ -0,0 +1,9 @@
+import { createFetch } from "./fetch.js";
+export function create(entry, build, options = {}) {
+    const app = createFetch(entry, build, {
+        // Vercel sets `X-Real-IP` / `X-Forwarded-For` to the client address (not client-controlled).
+        address: (request) => request.headers.get("x-real-ip") ?? undefined,
+        ...options,
+    });
+    return (request, context) => app.fetch(request, undefined, context);
+}

package/adapters/vercel.d.ts

@@ -0,0 +1,33 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { GeneratedEntry } from "../server/app.js";
+import type { ErrorInfo } from "../server/handler.js";
+import type { BodyLimit } from "../server/security.js";
+import type { AppConfig } from "../server/app.js";
+import { type BuildManifests } from "./assemble.js";
+export interface VercelOptions {
+    /** Fixed public origin; default: the request's `Host` + `X-Forwarded-Proto` (Vercel's proxy sets both). */
+    origin?: string;
+    maxBody?: BodyLimit;
+    stream?: {
+        deadline?: number;
+    };
+    /** Extra headers on every response; defaults add nosniff + referrer policy. */
+    headers?: Record<string, string>;
+    onError?: (error: unknown, request?: Request, info?: ErrorInfo) => void;
+    resolveLocale?: (request: Request) => string | undefined | Promise<string | undefined>;
+    csp?: AppConfig["csp"];
+    /** Preload planner (`createApp` `preload`): `background` byte budget of idle-time visible prefetch, `lean` (nothing before an interaction); per page when a function. */
+    preload?: AppConfig["preload"];
+    /**
+     * Brotli/gzip in the function (default true, as the node adapter). Vercel's CDN documents its
+     * automatic compression by MIME allowlist (https://vercel.com/docs/compression), which does not list
+     * `text/html`; an encoded response passes through as is.
+     */
+    compress?: boolean;
+    /** Set when the build has ISR pages: their prerender functions get the page path as `__rivet_path`. */
+    isr?: unknown;
+}
+/** `/_isr/a?__rivet_path=%2Fa&x=1` → `/a?x=1` (the ISR route's rewrite, undone). */
+export declare function isrURL(url: string): string;
+/** The function's request listener over a server entry and its inlined client manifests. */
+export declare function create(entry: GeneratedEntry, build: BuildManifests, options?: VercelOptions): (req: IncomingMessage, res: ServerResponse) => void;

package/adapters/vercel.js

@@ -0,0 +1,45 @@
+import { assemble } from "./assemble.js";
+import { createListener } from "./node.js";
+const ISR_PATH = "__rivet_path";
+/** `/_isr/a?__rivet_path=%2Fa&x=1` → `/a?x=1` (the ISR route's rewrite, undone). */
+export function isrURL(url) {
+    const at = url.indexOf("?");
+    if (at < 0)
+        return url;
+    const query = new URLSearchParams(url.slice(at + 1));
+    const path = query.get(ISR_PATH);
+    if (path === null || !path.startsWith("/") || path.startsWith("//"))
+        return url;
+    query.delete(ISR_PATH);
+    const rest = query.toString();
+    return path + (rest ? "?" + rest : "");
+}
+/** The function's request listener over a server entry and its inlined client manifests. */
+export function create(entry, build, options = {}) {
+    const handler = assemble(entry, build, {
+        ...(options.stream ? { stream: options.stream } : {}),
+        ...(options.onError ? { onError: options.onError } : {}),
+        ...(options.maxBody !== undefined ? { maxBody: options.maxBody } : {}),
+        ...(options.csp !== undefined ? { csp: options.csp } : {}),
+        ...(options.preload ? { preload: options.preload } : {}),
+        ...(options.resolveLocale ? { resolveLocale: options.resolveLocale } : {}),
+    }, "vercel entry");
+    const { listener } = createListener({
+        handler,
+        // Only Vercel's proxy reaches the function: its `X-Forwarded-Proto` / `-Host` / `-For` (one hop) are the client's.
+        trustProxy: 1,
+        // A function instance has no idle phase worth shrinking the heap for.
+        idleMemory: false,
+        ...(options.compress === false ? { compress: false } : {}),
+        ...(options.origin ? { origin: options.origin } : {}),
+        ...(options.headers ? { headers: options.headers } : {}),
+        ...(options.onError ? { onError: options.onError } : {}),
+    });
+    if (!options.isr)
+        return listener;
+    return (req, res) => {
+        if (req.url?.includes(ISR_PATH))
+            req.url = isrURL(req.url);
+        listener(req, res);
+    };
+}

package/build/codegen.d.ts

@@ -0,0 +1,84 @@
+import type { RouteTable } from "./routes.js";
+import type { TransitionOptions } from "../client/transitions.js";
+import type { TrailingSlash } from "../shared/slash.js";
+import type { DocumentPrefetch, PrefetchEagerness } from "../shared/prefetch.js";
+export interface CodegenOptions {
+    /** Routes directory relative to the project root, posix (e.g. `src/routes`). */
+    routesDir: string;
+    /** Output directory relative to the project root, posix (default `.rivet`). */
+    outDir?: string;
+    /** Root-relative module whose default export is the `DocumentShell`; re-exported by the server entry. */
+    document?: string;
+    /**
+     * `server` (default): client navigation uses the data endpoint. `static`: prerendered `_data.json`
+     * files. `csr`: no server; pages mount in the browser without loader data (`.server.ts` is an error).
+     */
+    mode?: "server" | "static" | "csr";
+    /**
+     * `components`: component head (`@rivetjs/kit`): layouts and pages render under their `HeadLevel`,
+     * client navigation applies route heads, and the server entry hands the request's head sink to the
+     * app (the handler holds the document start until the shell rendered).
+     */
+    head?: "components";
+    /** Route transitions + pending UI (`@rivetjs/router/transitions`, loaded on first navigation intent). */
+    transitions?: boolean | TransitionOptions;
+    /** Route announcer (a live region given each new page's title after client navigation). Default true. */
+    announce?: boolean;
+    /** URL base path (`/app`, Vite's `base`): route patterns of the generated files carry it (types do not). */
+    base?: string;
+    /**
+     * The app reads search params (`useSearchParams()` / `SearchParams`): the server entry provides the
+     * request's and the resume entry the browser's. Off: none of it ships (the Vite plugin detects it).
+     */
+    searchParams?: boolean;
+    /**
+     * The app calls `navigate()` / `invalidate()` / `revalidate()` / `setSearchParams()` (or uses
+     * `@rivetjs/forms`): the App serves them (`rivet:go` listener, `data-rivet-go` on the routes element).
+     * Off: no listener, no resume state; calls load the document.
+     */
+    navigate?: boolean;
+    /**
+     * The app uses `@rivetjs/forms` (implies `navigate`): every router handler first installs the router brand
+     * (`_brand(_go)`, `Symbol.for("rivet.router")`) forms reach the router through. Off: no brand, no `_go`.
+     */
+    forms?: boolean;
+    /** The app reads `useParams()`: pages and persisted layouts render under the params context. */
+    params?: boolean;
+    /** The app renders `<Link active>`: the App re-marks active links after each client navigation (`_markActive`). */
+    activeLinks?: boolean;
+    /**
+     * Document prefetch (`@rivetjs/router/prefetch`): the server entry wraps the document shell so every
+     * page's head carries the Speculation Rules + inline fallback; a string is also the default for unmarked links.
+     */
+    prefetch?: boolean | DocumentPrefetch;
+    /** Speculation Rules eagerness when `prefetch` is on (absent: `moderate`). */
+    prefetchEagerness?: PrefetchEagerness;
+    /** `false`: no route-path RegExp in the prefetch rules (only reload / external links take part). */
+    prefetchPaths?: boolean;
+    /** `"never"` / `"always"`: the server entry exports the policy (page requests in the other form answer 308). */
+    trailingSlash?: TrailingSlash;
+    /** `rivetRouter({ preload: { background } })`: the server entry exports it (the app's default background budget). */
+    preloadBackground?: number;
+    /** `rivetRouter({ routeRules })`: the server entry exports them (JSON data). */
+    routeRules?: Readonly<Record<string, unknown>>;
+    /**
+     * `rivetRouter({ clientRouter })`: `false` marks the App's router listeners `standalone: false` (alone
+     * they do not make a page resumable: inert pages ship zero JS). Default: `false` in `static` mode.
+     */
+    clientRouter?: boolean;
+}
+export interface Generated {
+    /** File name (relative to outDir) → contents. */
+    readonly files: Readonly<Record<string, string>>;
+    /** Root-relative modules that must compile in resume mode (generated app + route components). */
+    readonly resumeModules: readonly string[];
+}
+/**
+ * RegExp source (no anchors, no leading `/`) over `URL.pathname.slice(1)` that matches every path one
+ * of `patterns` (route patterns: static segments, `:param`, terminal `*splat`; one optional trailing
+ * slash) matches. Shared prefixes are factored (a trie), so the source stays small for large apps.
+ * Valid in `u` / `v` mode and as a URLPattern regexp group (`/(source)`); `""`: only `/` matches.
+ */
+export declare function routePathRegExp(patterns: readonly string[]): string;
+/** Generate the app, server entry, route table and route types for a scanned table. */
+export declare function generate(table: RouteTable, options: CodegenOptions): Generated;