@rshono/core 1.0.0-rc.0 → 1.0.0-rc.10

package/dist/runtime/server.js

@@ -1,24 +1,27 @@
 /**
  * `@rshono/core/server` — the request-scoped surface, for use inside server components
- * and `'use server'` action modules: {@link getContext} for the URL, cookies,
- * params, env and middleware variables, the {@link redirect} and {@link notFound}
- * control-flow helpers, and {@link onServerError} for reporting the errors the
- * framework catches.
+ * and `'use server'` action modules: `getRequestContext()` for the URL, cookies,
+ * params, env and middleware variables, the `redirect()` and `notFound()`
+ * control-flow helpers, and `onServerError()` for reporting the errors the
+ * framework catches. Plus `publicUrl(c)`, for middleware in `src/server.ts`, which
+ * is handed Hono's `c` rather than a request context.
  *
  * Server-only. Importing this from a `'use client'` module is a mistake — those
  * run in the browser (and are SSR'd without a bound context). Read what you need
  * on the server and pass it down as props, or use `useNavigation()` from
  * `@rshono/core/client` for URL data.
  *
- * A barrel rather than `./context.js` itself, which is where all of this is
- * implemented: that module also exports the plumbing the framework's own entry
- * points need (`runWithContext`, `readParams`, `publicUrl`, `reportServerError`),
- * and pointing the `./server` subpath straight at it published every one of them —
- * `@internal` in the docs, but present in a consumer's autocomplete and pinned by
- * semver all the same. They stay reachable by relative import, which is the only
- * way the framework itself ever reaches them.
+ * @see {@link https://www.rshono.com/docs/api#rshonocoreserver | Docs — `@rshono/core/server`}
  *
  * @packageDocumentation
  */
-export { getContext, notFound, onServerError, redirect, } from './context.js';
+// A barrel rather than pointing the `./server` subpath straight at `./context.js`, where all of this
+// is implemented: that module also exports the framework's own plumbing (`runWithContext`,
+// `readParams`, `reportServerError`), and exposing it would put every one of those in a consumer's
+// autocomplete and under semver. They stay reachable by relative import.
+export { getRequestContext, notFound, onServerError, 
+// For middleware, which is handed Hono's `c` and so has no request context to read a URL from.
+// Hono's own middleware all resolve the origin from `c.req.url`, which is the internal address
+// behind a proxy — this is what `trustProxy` means to them.
+publicUrl, redirect, } from './context.js';
 //# sourceMappingURL=server.js.map

package/dist/runtime/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/runtime/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,UAAU,EACV,QAAQ,EACR,aAAa,EACb,QAAQ,GAST,MAAM,cAAc,CAAC","sourcesContent":["/**\n * `@rshono/core/server` — the request-scoped surface, for use inside server components\n * and `'use server'` action modules: {@link getContext} for the URL, cookies,\n * params, env and middleware variables, the {@link redirect} and {@link notFound}\n * control-flow helpers, and {@link onServerError} for reporting the errors the\n * framework catches.\n *\n * Server-only. Importing this from a `'use client'` module is a mistake — those\n * run in the browser (and are SSR'd without a bound context). Read what you need\n * on the server and pass it down as props, or use `useNavigation()` from\n * `@rshono/core/client` for URL data.\n *\n * A barrel rather than `./context.js` itself, which is where all of this is\n * implemented: that module also exports the plumbing the framework's own entry\n * points need (`runWithContext`, `readParams`, `publicUrl`, `reportServerError`),\n * and pointing the `./server` subpath straight at it published every one of them —\n * `@internal` in the docs, but present in a consumer's autocomplete and pinned by\n * semver all the same. They stay reachable by relative import, which is the only\n * way the framework itself ever reaches them.\n *\n * @packageDocumentation\n */\n\nexport {\n  getContext,\n  notFound,\n  onServerError,\n  redirect,\n  // A type, not a value: `Ctx` is handed to you by `getContext()` or the `ctx` page\n  // prop — one instance per request — and is never constructed by application code.\n  type Ctx,\n  type EnvVars,\n  type RedirectStatus,\n  type ServerErrorContext,\n  type ServerErrorHandler,\n  type ServerErrorSource,\n} from './context.js';\n"]}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/runtime/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,qGAAqG;AACrG,2FAA2F;AAC3F,mGAAmG;AACnG,yEAAyE;AACzE,OAAO,EACL,iBAAiB,EACjB,QAAQ,EACR,aAAa;AACb,+FAA+F;AAC/F,+FAA+F;AAC/F,4DAA4D;AAC5D,SAAS,EACT,QAAQ,GAST,MAAM,cAAc,CAAC","sourcesContent":["/**\n * `@rshono/core/server` — the request-scoped surface, for use inside server components\n * and `'use server'` action modules: `getRequestContext()` for the URL, cookies,\n * params, env and middleware variables, the `redirect()` and `notFound()`\n * control-flow helpers, and `onServerError()` for reporting the errors the\n * framework catches. Plus `publicUrl(c)`, for middleware in `src/server.ts`, which\n * is handed Hono's `c` rather than a request context.\n *\n * Server-only. Importing this from a `'use client'` module is a mistake — those\n * run in the browser (and are SSR'd without a bound context). Read what you need\n * on the server and pass it down as props, or use `useNavigation()` from\n * `@rshono/core/client` for URL data.\n *\n * @see {@link https://www.rshono.com/docs/api#rshonocoreserver | Docs — `@rshono/core/server`}\n *\n * @packageDocumentation\n */\n\n// A barrel rather than pointing the `./server` subpath straight at `./context.js`, where all of this\n// is implemented: that module also exports the framework's own plumbing (`runWithContext`,\n// `readParams`, `reportServerError`), and exposing it would put every one of those in a consumer's\n// autocomplete and under semver. They stay reachable by relative import.\nexport {\n  getRequestContext,\n  notFound,\n  onServerError,\n  // For middleware, which is handed Hono's `c` and so has no request context to read a URL from.\n  // Hono's own middleware all resolve the origin from `c.req.url`, which is the internal address\n  // behind a proxy — this is what `trustProxy` means to them.\n  publicUrl,\n  redirect,\n  type EnvVars,\n  type RedirectStatus,\n  // A type, not a value: `RequestContext` is handed to you by `getRequestContext()` or the `ctx` page\n  // prop — one instance per request — and is never constructed by application code.\n  type RequestContext,\n  type ServerErrorContext,\n  type ServerErrorHandler,\n  type ServerErrorSource,\n} from './context.js';\n"]}

package/dist/server/headers.d.ts

@@ -1,15 +1,15 @@
 /**
- * Small header utilities shared by the response-header defaults, the compressor and the
- * prerendered-page cache. Kept apart from any one of them because getting `Vary` and `ETag`
- * comparison subtly wrong is exactly the kind of thing that only shows up behind a CDN.
+ * Small header utilities shared by the response-header defaults and the prerendered-page cache. Kept
+ * apart from both because getting `Vary` and `ETag` comparison subtly wrong is exactly the kind of
+ * thing that only shows up behind a CDN.
  */
 /**
  * Adds `value` to the `Vary` header without discarding what is already there.
  *
- * `Vary` is a list, and two different concerns write to it here — content negotiation on `Accept`
- * (HTML document vs flight payload) and `Accept-Encoding` from the compressor. A plain `set` from
- * whichever ran last would drop the other, and a cache would then happily serve one variant in
- * place of the other. `*` is left alone: it already means "never reuse this".
+ * `Vary` is a list, and the framework's own entry (`Accept` — an HTML document or a flight payload from
+ * one URL) is not necessarily the only one: a route, a middleware or a proxy may have added its own.
+ * A plain `set` would drop the others, and a cache would then serve one variant in place of another.
+ * `*` is left alone: it already means "never reuse this".
  */
 export declare function appendVary(headers: Headers, value: string): void;
 /**
@@ -17,8 +17,8 @@ export declare function appendVary(headers: Headers, value: string): void;
  * exact body and should be answered with a 304.
  *
  * The header carries a *list*, and each entry may be weak (`W/"…"`). The weak prefix is ignored on
- * both sides because the compressor rewrites a strong tag to a weak one when it changes the bytes
- * on the wire — the representation is still the same one the client cached.
+ * both sides: a proxy or CDN that gzips on the way out changes the bytes without changing the
+ * representation, and is entitled to weaken the validator when it does.
  */
 export declare function etagMatches(ifNoneMatch: string | undefined, etag: string): boolean;
 //# sourceMappingURL=headers.d.ts.map

package/dist/server/headers.js

@@ -1,15 +1,15 @@
 /**
- * Small header utilities shared by the response-header defaults, the compressor and the
- * prerendered-page cache. Kept apart from any one of them because getting `Vary` and `ETag`
- * comparison subtly wrong is exactly the kind of thing that only shows up behind a CDN.
+ * Small header utilities shared by the response-header defaults and the prerendered-page cache. Kept
+ * apart from both because getting `Vary` and `ETag` comparison subtly wrong is exactly the kind of
+ * thing that only shows up behind a CDN.
  */
 /**
  * Adds `value` to the `Vary` header without discarding what is already there.
  *
- * `Vary` is a list, and two different concerns write to it here — content negotiation on `Accept`
- * (HTML document vs flight payload) and `Accept-Encoding` from the compressor. A plain `set` from
- * whichever ran last would drop the other, and a cache would then happily serve one variant in
- * place of the other. `*` is left alone: it already means "never reuse this".
+ * `Vary` is a list, and the framework's own entry (`Accept` — an HTML document or a flight payload from
+ * one URL) is not necessarily the only one: a route, a middleware or a proxy may have added its own.
+ * A plain `set` would drop the others, and a cache would then serve one variant in place of another.
+ * `*` is left alone: it already means "never reuse this".
  */
 export function appendVary(headers, value) {
     const existing = headers.get('vary');
@@ -28,8 +28,8 @@ export function appendVary(headers, value) {
  * exact body and should be answered with a 304.
  *
  * The header carries a *list*, and each entry may be weak (`W/"…"`). The weak prefix is ignored on
- * both sides because the compressor rewrites a strong tag to a weak one when it changes the bytes
- * on the wire — the representation is still the same one the client cached.
+ * both sides: a proxy or CDN that gzips on the way out changes the bytes without changing the
+ * representation, and is entitled to weaken the validator when it does.
  */
 export function etagMatches(ifNoneMatch, etag) {
     if (!ifNoneMatch)

package/dist/server/headers.js.map

@@ -1 +1 @@
-{"version":3,"file":"headers.js","sourceRoot":"","sources":["../../src/server/headers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,OAAgB,EAAE,KAAa;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO;IACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACxG,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,QAAQ,KAAK,KAAK,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,WAA+B,EAAE,IAAY;IACvE,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3C,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,MAAM,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Small header utilities shared by the response-header defaults, the compressor and the\n * prerendered-page cache. Kept apart from any one of them because getting `Vary` and `ETag`\n * comparison subtly wrong is exactly the kind of thing that only shows up behind a CDN.\n */\n\n/**\n * Adds `value` to the `Vary` header without discarding what is already there.\n *\n * `Vary` is a list, and two different concerns write to it here — content negotiation on `Accept`\n * (HTML document vs flight payload) and `Accept-Encoding` from the compressor. A plain `set` from\n * whichever ran last would drop the other, and a cache would then happily serve one variant in\n * place of the other. `*` is left alone: it already means \"never reuse this\".\n */\nexport function appendVary(headers: Headers, value: string): void {\n  const existing = headers.get('vary');\n  if (existing === null) {\n    headers.set('vary', value);\n    return;\n  }\n  if (existing.trim() === '*') return;\n  const already = existing.split(',').some((entry) => entry.trim().toLowerCase() === value.toLowerCase());\n  if (!already) headers.set('vary', `${existing}, ${value}`);\n}\n\n/**\n * True when an `If-None-Match` request header matches `etag`, i.e. the client already holds this\n * exact body and should be answered with a 304.\n *\n * The header carries a *list*, and each entry may be weak (`W/\"…\"`). The weak prefix is ignored on\n * both sides because the compressor rewrites a strong tag to a weak one when it changes the bytes\n * on the wire — the representation is still the same one the client cached.\n */\nexport function etagMatches(ifNoneMatch: string | undefined, etag: string): boolean {\n  if (!ifNoneMatch) return false;\n  const normalize = (value: string) => value.trim().replace(/^W\\//, '');\n  const wanted = normalize(etag);\n  return ifNoneMatch.split(',').some((entry) => {\n    const candidate = normalize(entry);\n    return candidate === '*' || candidate === wanted;\n  });\n}\n"]}
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../../src/server/headers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,OAAgB,EAAE,KAAa;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO;IACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACxG,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,QAAQ,KAAK,KAAK,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,WAA+B,EAAE,IAAY;IACvE,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3C,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,MAAM,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Small header utilities shared by the response-header defaults and the prerendered-page cache. Kept\n * apart from both because getting `Vary` and `ETag` comparison subtly wrong is exactly the kind of\n * thing that only shows up behind a CDN.\n */\n\n/**\n * Adds `value` to the `Vary` header without discarding what is already there.\n *\n * `Vary` is a list, and the framework's own entry (`Accept` — an HTML document or a flight payload from\n * one URL) is not necessarily the only one: a route, a middleware or a proxy may have added its own.\n * A plain `set` would drop the others, and a cache would then serve one variant in place of another.\n * `*` is left alone: it already means \"never reuse this\".\n */\nexport function appendVary(headers: Headers, value: string): void {\n  const existing = headers.get('vary');\n  if (existing === null) {\n    headers.set('vary', value);\n    return;\n  }\n  if (existing.trim() === '*') return;\n  const already = existing.split(',').some((entry) => entry.trim().toLowerCase() === value.toLowerCase());\n  if (!already) headers.set('vary', `${existing}, ${value}`);\n}\n\n/**\n * True when an `If-None-Match` request header matches `etag`, i.e. the client already holds this\n * exact body and should be answered with a 304.\n *\n * The header carries a *list*, and each entry may be weak (`W/\"…\"`). The weak prefix is ignored on\n * both sides: a proxy or CDN that gzips on the way out changes the bytes without changing the\n * representation, and is entitled to weaken the validator when it does.\n */\nexport function etagMatches(ifNoneMatch: string | undefined, etag: string): boolean {\n  if (!ifNoneMatch) return false;\n  const normalize = (value: string) => value.trim().replace(/^W\\//, '');\n  const wanted = normalize(etag);\n  return ifNoneMatch.split(',').some((entry) => {\n    const candidate = normalize(entry);\n    return candidate === '*' || candidate === wanted;\n  });\n}\n"]}

package/dist/server/load-config.d.ts

@@ -1,7 +1,7 @@
-import type { RSHonoConfig } from '../config.js';
+import type { RshonoConfig } from '../config.js';
 /**
  * Load the project config, or `{}` if none exists. Scans `rshono.config.{ts,js,mjs}` at
  * {@link rootDir} unless an explicit {@link configPath} is given (resolved relative to `cwd`).
  */
-export declare function loadConfig(rootDir: string, configPath?: string): Promise<RSHonoConfig>;
+export declare function loadConfig(rootDir: string, configPath?: string): Promise<RshonoConfig>;
 //# sourceMappingURL=load-config.d.ts.map

package/dist/server/load-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"load-config.d.ts","sourceRoot":"","sources":["../../src/server/load-config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAmBjD;;;GAGG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAe5F"}
+{"version":3,"file":"load-config.d.ts","sourceRoot":"","sources":["../../src/server/load-config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAmBjD;;;GAGG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA6B5F"}

package/dist/server/load-config.js

@@ -5,17 +5,16 @@ const CONFIG_FILES = ['rshono.config.ts', 'rshono.config.js', 'rshono.config.mjs
 /**
  * Imports the config module.
  *
- * A `.js`/`.mjs` config is a plain dynamic import. A `.ts` one can't be — the CLI itself runs as
- * compiled JavaScript, so nothing in the process understands TypeScript by default. `tsx`'s
- * programmatic API is loaded for that case only, which keeps it off the startup path of every
- * other command instead of paying for a TypeScript loader the whole CLI doesn't need.
+ * A `.ts` config needs no loader of its own: Node strips types natively from 22.18 on, which is what
+ * the package's `engines` floor is for. That replaced a `tsx` dependency whose only job was these two
+ * lines — and `tsx` bundles esbuild, so it was the largest thing in the install.
+ *
+ * The one thing native stripping will not do is resolve a `.js` specifier to a `.ts` file, so a config
+ * that imports a sibling module has to name it with its real extension. {@link loadConfig} turns the
+ * resulting resolution failure into that advice rather than letting a raw `ERR_MODULE_NOT_FOUND` out.
  */
-async function importConfig(file) {
-    const href = pathToFileURL(file).href;
-    if (!/\.[cm]?ts$/.test(file))
-        return import(href);
-    const { tsImport } = await import('tsx/esm/api');
-    return tsImport(href, import.meta.url);
+function importConfig(file) {
+    return import(pathToFileURL(file).href);
 }
 /**
  * Load the project config, or `{}` if none exists. Scans `rshono.config.{ts,js,mjs}` at
@@ -32,7 +31,19 @@ export async function loadConfig(rootDir, configPath) {
     if (!existsSync(file)) {
         throw new Error(`[rshono] config file not found: ${file}`);
     }
-    const mod = await importConfig(file);
+    let mod;
+    try {
+        mod = await importConfig(file);
+    }
+    catch (error) {
+        // The one failure mode native type stripping has that a TypeScript-aware loader does not.
+        if (/\.[cm]?ts$/.test(file) && error?.code === 'ERR_MODULE_NOT_FOUND') {
+            throw new Error(`[rshono] ${file} imports a module Node could not resolve: ${error.message}\n` +
+                '  A .ts config is loaded by Node itself, which does not rewrite a .js specifier to the .ts file ' +
+                'beside it. Import it by its real extension, or move the config to rshono.config.mjs.', { cause: error });
+        }
+        throw error;
+    }
     if (!mod.default) {
         throw new Error(`[rshono] ${file} must \`export default\` a config object (use \`defineConfig({ … })\`).`);
     }

package/dist/server/load-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"load-config.js","sourceRoot":"","sources":["../../src/server/load-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,MAAM,YAAY,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;AAEnF;;;;;;;GAOG;AACH,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACtC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAwC,CAAC;IACzF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACjD,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,GAAG,CAAwC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAe,EAAE,UAAmB;IACnE,MAAM,IAAI,GAAG,UAAU;QACrB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;YACtB,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC;QACtC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,yEAAyE,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC","sourcesContent":["import { existsSync } from 'node:fs';\nimport { isAbsolute, join, resolve } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport type { RSHonoConfig } from '../config.js';\n\nconst CONFIG_FILES = ['rshono.config.ts', 'rshono.config.js', 'rshono.config.mjs'];\n\n/**\n * Imports the config module.\n *\n * A `.js`/`.mjs` config is a plain dynamic import. A `.ts` one can't be — the CLI itself runs as\n * compiled JavaScript, so nothing in the process understands TypeScript by default. `tsx`'s\n * programmatic API is loaded for that case only, which keeps it off the startup path of every\n * other command instead of paying for a TypeScript loader the whole CLI doesn't need.\n */\nasync function importConfig(file: string): Promise<{ default?: RSHonoConfig }> {\n  const href = pathToFileURL(file).href;\n  if (!/\\.[cm]?ts$/.test(file)) return import(href) as Promise<{ default?: RSHonoConfig }>;\n  const { tsImport } = await import('tsx/esm/api');\n  return tsImport(href, import.meta.url) as Promise<{ default?: RSHonoConfig }>;\n}\n\n/**\n * Load the project config, or `{}` if none exists. Scans `rshono.config.{ts,js,mjs}` at\n * {@link rootDir} unless an explicit {@link configPath} is given (resolved relative to `cwd`).\n */\nexport async function loadConfig(rootDir: string, configPath?: string): Promise<RSHonoConfig> {\n  const file = configPath\n    ? isAbsolute(configPath)\n      ? configPath\n      : resolve(process.cwd(), configPath)\n    : CONFIG_FILES.map((f) => join(rootDir, f)).find(existsSync);\n  if (!file) return {};\n  if (!existsSync(file)) {\n    throw new Error(`[rshono] config file not found: ${file}`);\n  }\n  const mod = await importConfig(file);\n  if (!mod.default) {\n    throw new Error(`[rshono] ${file} must \\`export default\\` a config object (use \\`defineConfig({ … })\\`).`);\n  }\n  return mod.default;\n}\n"]}
+{"version":3,"file":"load-config.js","sourceRoot":"","sources":["../../src/server/load-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,MAAM,YAAY,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;AAEnF;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAwC,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAe,EAAE,UAAmB;IACnE,MAAM,IAAI,GAAG,UAAU;QACrB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;YACtB,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC;QACtC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,GAA+B,CAAC;IACpC,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0FAA0F;QAC1F,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAK,KAAkC,EAAE,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACpG,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,6CAA8C,KAAe,CAAC,OAAO,IAAI;gBACvF,kGAAkG;gBAClG,sFAAsF,EACxF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,yEAAyE,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC","sourcesContent":["import { existsSync } from 'node:fs';\nimport { isAbsolute, join, resolve } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport type { RshonoConfig } from '../config.js';\n\nconst CONFIG_FILES = ['rshono.config.ts', 'rshono.config.js', 'rshono.config.mjs'];\n\n/**\n * Imports the config module.\n *\n * A `.ts` config needs no loader of its own: Node strips types natively from 22.18 on, which is what\n * the package's `engines` floor is for. That replaced a `tsx` dependency whose only job was these two\n * lines — and `tsx` bundles esbuild, so it was the largest thing in the install.\n *\n * The one thing native stripping will not do is resolve a `.js` specifier to a `.ts` file, so a config\n * that imports a sibling module has to name it with its real extension. {@link loadConfig} turns the\n * resulting resolution failure into that advice rather than letting a raw `ERR_MODULE_NOT_FOUND` out.\n */\nfunction importConfig(file: string): Promise<{ default?: RshonoConfig }> {\n  return import(pathToFileURL(file).href) as Promise<{ default?: RshonoConfig }>;\n}\n\n/**\n * Load the project config, or `{}` if none exists. Scans `rshono.config.{ts,js,mjs}` at\n * {@link rootDir} unless an explicit {@link configPath} is given (resolved relative to `cwd`).\n */\nexport async function loadConfig(rootDir: string, configPath?: string): Promise<RshonoConfig> {\n  const file = configPath\n    ? isAbsolute(configPath)\n      ? configPath\n      : resolve(process.cwd(), configPath)\n    : CONFIG_FILES.map((f) => join(rootDir, f)).find(existsSync);\n  if (!file) return {};\n  if (!existsSync(file)) {\n    throw new Error(`[rshono] config file not found: ${file}`);\n  }\n  let mod: { default?: RshonoConfig };\n  try {\n    mod = await importConfig(file);\n  } catch (error) {\n    // The one failure mode native type stripping has that a TypeScript-aware loader does not.\n    if (/\\.[cm]?ts$/.test(file) && (error as { code?: string } | null)?.code === 'ERR_MODULE_NOT_FOUND') {\n      throw new Error(\n        `[rshono] ${file} imports a module Node could not resolve: ${(error as Error).message}\\n` +\n          '  A .ts config is loaded by Node itself, which does not rewrite a .js specifier to the .ts file ' +\n          'beside it. Import it by its real extension, or move the config to rshono.config.mjs.',\n        { cause: error },\n      );\n    }\n    throw error;\n  }\n  if (!mod.default) {\n    throw new Error(`[rshono] ${file} must \\`export default\\` a config object (use \\`defineConfig({ … })\\`).`);\n  }\n  return mod.default;\n}\n"]}

package/dist/server/prerendered.d.ts

@@ -7,11 +7,9 @@
  * it from the fs module would drag `node:fs` and `node:crypto` into a bundle that has neither.
  */
 /**
- * The two representations of a page, prerendered side by side.
- *
- * A hard load wants the HTML document; a soft navigation asks the same URL for a flight payload.
- * Writing only the HTML meant every in-app click re-rendered a page that was already built, so the
- * prerender only ever paid off for cold loads and crawlers.
+ * The two representations of a page, prerendered side by side: a hard load wants the HTML document, a
+ * soft navigation asks the same URL for a flight payload. Without both, every in-app click would
+ * re-render a page that was already built.
  */
 export type PrerenderVariant = 'html' | 'flight';
 export declare const VARIANTS: {
@@ -42,25 +40,55 @@ export declare function ssgFilePath(routePath: string, variant?: PrerenderVarian
  * fall back on, so `..` has to be refused here or not at all.
  */
 export declare function prerenderedRelPath(requestPath: string, variant: PrerenderVariant): string | null;
+/**
+ * A bounded, insertion-ordered cache of prerendered pages.
+ *
+ * Bounded so a site with thousands of prerendered pages keeps a working set rather than the whole
+ * build in memory. Only *hits* are ever stored: caching misses would let anyone mint entries by
+ * requesting paths that don't exist. The files are written at build time and never change while the
+ * server is up, so an entry never needs invalidating.
+ */
+export declare function createPageCache(max?: number): {
+    get(key: string): PrerenderedPage | undefined;
+    set(key: string, page: PrerenderedPage): void;
+};
+/**
+ * A weak `ETag` for a page body — see {@link PrerenderedPage.etag} for why weak.
+ *
+ * Web Crypto rather than `node:crypto`, so the one implementation serves both a Node server and
+ * `workerd`.
+ */
+export declare function weakEtag(body: Uint8Array<ArrayBuffer>): Promise<string>;
+/**
+ * Assembles a {@link PrerenderedPage} from a body just read out of the build.
+ *
+ * `storeEtag` is the validator the store supplied, where it has one — it already describes these
+ * exact bytes, so it is preferred over hashing them again, and only weakened.
+ */
+export declare function toPrerenderedPage(body: Uint8Array<ArrayBuffer>, storeEtag?: string | null): Promise<PrerenderedPage>;
 /** A prerendered page, ready to serve: its body and a validator derived from those exact bytes. */
 export interface PrerenderedPage {
-    /** The document or the flight payload, depending on which {@link PrerenderVariant} was read. */
-    body: string;
     /**
-     * `Content-Length` for {@link body}, in bytes rather than characters.
+     * The document or the flight payload, depending on which {@link PrerenderVariant} was read.
      *
-     * Served with the response because Hono sets no length for an in-memory body, and without one the
-     * compressor cannot tell a 300-byte page from a 300 KB one — so it gzips both, including the ones
-     * where the framing costs more than it saves.
+     * Bytes rather than a string, because this is a *cache* entry served verbatim to every request that
+     * hits it — held as a string, each of those would pay a fresh UTF-8 encode of the whole page on the
+     * way out. Read once, encoded never.
+     */
+    body: Uint8Array<ArrayBuffer>;
+    /**
+     * `Content-Length` for {@link body}, in bytes rather than characters. Served explicitly because
+     * Hono sets no length for an in-memory body, and a proxy or CDN in front is entitled to make
+     * decisions with it — whether gzipping this response is worth the framing, most obviously.
      */
     contentLength: string;
     /**
      * `ETag` for the page, so a revalidating client can be answered with a 304 instead of the body.
      *
-     * Deliberately **weak**. The bytes on the wire depend on whether the client took gzip, and a
-     * strong validator would have to differ between those two — so the 200 and the 304 that
-     * revalidates it would disagree, and a cache would treat them as different pages. A weak tag
-     * says "the same representation", which is exactly what is true across content codings.
+     * Deliberately **weak**. The bytes on the wire depend on whether something in front re-encoded
+     * them, and a strong validator would have to differ per coding — so the 200 and the 304 that
+     * revalidates it could disagree, and a cache would treat them as different pages. A weak tag says
+     * "the same representation", which is what stays true across content codings.
      */
     etag: string;
 }

package/dist/server/prerendered.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prerendered.d.ts","sourceRoot":"","sources":["../../src/server/prerendered.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEjD,eAAO,MAAM,QAAQ;;iBACX,IAAI,EAAE,YAAY;iBAAE,MAAM,EAAE,WAAW;iBAAE,WAAW,EAAE,WAAW;;;iBAC/D,IAAI,EAAE,WAAW;iBAAE,MAAM,EAAE,kBAAkB;iBAAE,WAAW,EAAE,kBAAkB;;CACU,CAAC;AAErG;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAyB,GAAG,MAAM,GAAG,IAAI,CAKhG;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAGhG;AAED,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;CACd"}
+{"version":3,"file":"prerendered.d.ts","sourceRoot":"","sources":["../../src/server/prerendered.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEjD,eAAO,MAAM,QAAQ;;iBACX,IAAI,EAAE,YAAY;iBAAE,MAAM,EAAE,WAAW;iBAAE,WAAW,EAAE,WAAW;;;iBAC/D,IAAI,EAAE,WAAW;iBAAE,MAAM,EAAE,kBAAkB;iBAAE,WAAW,EAAE,kBAAkB;;CACU,CAAC;AAErG;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAyB,GAAG,MAAM,GAAG,IAAI,CAKhG;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAGhG;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,SAAM,GAAG;IAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAC;IAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAU3I;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAO7E;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC,CAM1H;AAED,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC9B;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;CACd"}

package/dist/server/prerendered.js

@@ -36,4 +36,51 @@ export function prerenderedRelPath(requestPath, variant) {
         return null;
     return ssgFilePath(requestPath, variant);
 }
+/**
+ * A bounded, insertion-ordered cache of prerendered pages.
+ *
+ * Bounded so a site with thousands of prerendered pages keeps a working set rather than the whole
+ * build in memory. Only *hits* are ever stored: caching misses would let anyone mint entries by
+ * requesting paths that don't exist. The files are written at build time and never change while the
+ * server is up, so an entry never needs invalidating.
+ */
+export function createPageCache(max = 128) {
+    const pages = new Map();
+    return {
+        get: (key) => pages.get(key),
+        set(key, page) {
+            pages.set(key, page);
+            // Insertion-ordered, so the first key is the oldest. One entry in means at most one out.
+            if (pages.size > max)
+                pages.delete(pages.keys().next().value);
+        },
+    };
+}
+/**
+ * A weak `ETag` for a page body — see {@link PrerenderedPage.etag} for why weak.
+ *
+ * Web Crypto rather than `node:crypto`, so the one implementation serves both a Node server and
+ * `workerd`.
+ */
+export async function weakEtag(body) {
+    const digest = await crypto.subtle.digest('SHA-256', body);
+    const base64url = btoa(String.fromCharCode(...new Uint8Array(digest)))
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+    return `W/"${base64url.slice(0, 22)}"`;
+}
+/**
+ * Assembles a {@link PrerenderedPage} from a body just read out of the build.
+ *
+ * `storeEtag` is the validator the store supplied, where it has one — it already describes these
+ * exact bytes, so it is preferred over hashing them again, and only weakened.
+ */
+export async function toPrerenderedPage(body, storeEtag) {
+    return {
+        body,
+        contentLength: String(body.byteLength),
+        etag: storeEtag ? storeEtag.replace(/^(?!W\/)/, 'W/') : await weakEtag(body),
+    };
+}
 //# sourceMappingURL=prerendered.js.map

package/dist/server/prerendered.js.map

@@ -1 +1 @@
-{"version":3,"file":"prerendered.js","sourceRoot":"","sources":["../../src/server/prerendered.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE;IAC3E,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,kBAAkB,EAAE;CACQ,CAAC;AAErG;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,OAAO,GAAqB,MAAM;IAC/E,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IACpC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,OAAyB;IAC/E,IAAI,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC","sourcesContent":["/**\n * Everything about a prerendered page that doesn't need a filesystem: where the build puts it, and\n * what it looks like once read back.\n *\n * Split out of `ssg.ts` — which owns the writing and the reading, both through `node:fs` — because a\n * deploy target without a filesystem reads the very same layout out of an asset store, and importing\n * it from the fs module would drag `node:fs` and `node:crypto` into a bundle that has neither.\n */\n\n/**\n * The two representations of a page, prerendered side by side.\n *\n * A hard load wants the HTML document; a soft navigation asks the same URL for a flight payload.\n * Writing only the HTML meant every in-app click re-rendered a page that was already built, so the\n * prerender only ever paid off for cold loads and crawlers.\n */\nexport type PrerenderVariant = 'html' | 'flight';\n\nexport const VARIANTS = {\n  html: { file: 'index.html', accept: 'text/html', contentType: 'text/html' },\n  flight: { file: 'index.rsc', accept: 'text/x-component', contentType: 'text/x-component' },\n} as const satisfies Record<PrerenderVariant, { file: string; accept: string; contentType: string }>;\n\n/**\n * Where a route's prerendered output lives, relative to the output root — or `null` for a path that\n * cannot be prerendered at all (one with a param or a wildcard left in it).\n *\n * Always `/`-separated, never the host's separator: the same string addresses a file on a filesystem\n * (`resolve()` and `join()` both accept forward slashes on Windows) and a key in an asset store,\n * where a backslash would simply be the wrong character.\n */\nexport function ssgFilePath(routePath: string, variant: PrerenderVariant = 'html'): string | null {\n  if (/[:*]/.test(routePath)) return null;\n  const trimmed = routePath.replace(/^\\/+|\\/+$/g, '');\n  const file = VARIANTS[variant].file;\n  return trimmed === '' ? file : `${trimmed}/${file}`;\n}\n\n/**\n * {@link ssgFilePath} for a path that came off a request, so traversal is a miss rather than a lookup.\n *\n * The first line of defence for every deploy target: a store addressed by key has no `resolve()` to\n * fall back on, so `..` has to be refused here or not at all.\n */\nexport function prerenderedRelPath(requestPath: string, variant: PrerenderVariant): string | null {\n  if (/(^|\\/)\\.\\.?(\\/|$)/.test(requestPath)) return null;\n  return ssgFilePath(requestPath, variant);\n}\n\n/** A prerendered page, ready to serve: its body and a validator derived from those exact bytes. */\nexport interface PrerenderedPage {\n  /** The document or the flight payload, depending on which {@link PrerenderVariant} was read. */\n  body: string;\n  /**\n   * `Content-Length` for {@link body}, in bytes rather than characters.\n   *\n   * Served with the response because Hono sets no length for an in-memory body, and without one the\n   * compressor cannot tell a 300-byte page from a 300 KB one — so it gzips both, including the ones\n   * where the framing costs more than it saves.\n   */\n  contentLength: string;\n  /**\n   * `ETag` for the page, so a revalidating client can be answered with a 304 instead of the body.\n   *\n   * Deliberately **weak**. The bytes on the wire depend on whether the client took gzip, and a\n   * strong validator would have to differ between those two — so the 200 and the 304 that\n   * revalidates it would disagree, and a cache would treat them as different pages. A weak tag\n   * says \"the same representation\", which is exactly what is true across content codings.\n   */\n  etag: string;\n}\n"]}
+{"version":3,"file":"prerendered.js","sourceRoot":"","sources":["../../src/server/prerendered.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE;IAC3E,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,kBAAkB,EAAE;CACQ,CAAC;AAErG;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,OAAO,GAAqB,MAAM;IAC/E,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IACpC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,OAAyB;IAC/E,IAAI,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,GAAG,GAAG,GAAG;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,OAAO;QACL,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;QAC5B,GAAG,CAAC,GAAG,EAAE,IAAI;YACX,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACrB,yFAAyF;YACzF,IAAI,KAAK,CAAC,IAAI,GAAG,GAAG;gBAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAA6B;IAC1D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;SACnE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,OAAO,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAA6B,EAAE,SAAyB;IAC9F,OAAO;QACL,IAAI;QACJ,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACtC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC;KAC7E,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Everything about a prerendered page that doesn't need a filesystem: where the build puts it, and\n * what it looks like once read back.\n *\n * Split out of `ssg.ts` — which owns the writing and the reading, both through `node:fs` — because a\n * deploy target without a filesystem reads the very same layout out of an asset store, and importing\n * it from the fs module would drag `node:fs` and `node:crypto` into a bundle that has neither.\n */\n\n/**\n * The two representations of a page, prerendered side by side: a hard load wants the HTML document, a\n * soft navigation asks the same URL for a flight payload. Without both, every in-app click would\n * re-render a page that was already built.\n */\nexport type PrerenderVariant = 'html' | 'flight';\n\nexport const VARIANTS = {\n  html: { file: 'index.html', accept: 'text/html', contentType: 'text/html' },\n  flight: { file: 'index.rsc', accept: 'text/x-component', contentType: 'text/x-component' },\n} as const satisfies Record<PrerenderVariant, { file: string; accept: string; contentType: string }>;\n\n/**\n * Where a route's prerendered output lives, relative to the output root — or `null` for a path that\n * cannot be prerendered at all (one with a param or a wildcard left in it).\n *\n * Always `/`-separated, never the host's separator: the same string addresses a file on a filesystem\n * (`resolve()` and `join()` both accept forward slashes on Windows) and a key in an asset store,\n * where a backslash would simply be the wrong character.\n */\nexport function ssgFilePath(routePath: string, variant: PrerenderVariant = 'html'): string | null {\n  if (/[:*]/.test(routePath)) return null;\n  const trimmed = routePath.replace(/^\\/+|\\/+$/g, '');\n  const file = VARIANTS[variant].file;\n  return trimmed === '' ? file : `${trimmed}/${file}`;\n}\n\n/**\n * {@link ssgFilePath} for a path that came off a request, so traversal is a miss rather than a lookup.\n *\n * The first line of defence for every deploy target: a store addressed by key has no `resolve()` to\n * fall back on, so `..` has to be refused here or not at all.\n */\nexport function prerenderedRelPath(requestPath: string, variant: PrerenderVariant): string | null {\n  if (/(^|\\/)\\.\\.?(\\/|$)/.test(requestPath)) return null;\n  return ssgFilePath(requestPath, variant);\n}\n\n/**\n * A bounded, insertion-ordered cache of prerendered pages.\n *\n * Bounded so a site with thousands of prerendered pages keeps a working set rather than the whole\n * build in memory. Only *hits* are ever stored: caching misses would let anyone mint entries by\n * requesting paths that don't exist. The files are written at build time and never change while the\n * server is up, so an entry never needs invalidating.\n */\nexport function createPageCache(max = 128): { get(key: string): PrerenderedPage | undefined; set(key: string, page: PrerenderedPage): void } {\n  const pages = new Map<string, PrerenderedPage>();\n  return {\n    get: (key) => pages.get(key),\n    set(key, page) {\n      pages.set(key, page);\n      // Insertion-ordered, so the first key is the oldest. One entry in means at most one out.\n      if (pages.size > max) pages.delete(pages.keys().next().value!);\n    },\n  };\n}\n\n/**\n * A weak `ETag` for a page body — see {@link PrerenderedPage.etag} for why weak.\n *\n * Web Crypto rather than `node:crypto`, so the one implementation serves both a Node server and\n * `workerd`.\n */\nexport async function weakEtag(body: Uint8Array<ArrayBuffer>): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', body);\n  const base64url = btoa(String.fromCharCode(...new Uint8Array(digest)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n  return `W/\"${base64url.slice(0, 22)}\"`;\n}\n\n/**\n * Assembles a {@link PrerenderedPage} from a body just read out of the build.\n *\n * `storeEtag` is the validator the store supplied, where it has one — it already describes these\n * exact bytes, so it is preferred over hashing them again, and only weakened.\n */\nexport async function toPrerenderedPage(body: Uint8Array<ArrayBuffer>, storeEtag?: string | null): Promise<PrerenderedPage> {\n  return {\n    body,\n    contentLength: String(body.byteLength),\n    etag: storeEtag ? storeEtag.replace(/^(?!W\\/)/, 'W/') : await weakEtag(body),\n  };\n}\n\n/** A prerendered page, ready to serve: its body and a validator derived from those exact bytes. */\nexport interface PrerenderedPage {\n  /**\n   * The document or the flight payload, depending on which {@link PrerenderVariant} was read.\n   *\n   * Bytes rather than a string, because this is a *cache* entry served verbatim to every request that\n   * hits it — held as a string, each of those would pay a fresh UTF-8 encode of the whole page on the\n   * way out. Read once, encoded never.\n   */\n  body: Uint8Array<ArrayBuffer>;\n  /**\n   * `Content-Length` for {@link body}, in bytes rather than characters. Served explicitly because\n   * Hono sets no length for an in-memory body, and a proxy or CDN in front is entitled to make\n   * decisions with it — whether gzipping this response is worth the framing, most obviously.\n   */\n  contentLength: string;\n  /**\n   * `ETag` for the page, so a revalidating client can be answered with a 304 instead of the body.\n   *\n   * Deliberately **weak**. The bytes on the wire depend on whether something in front re-encoded\n   * them, and a strong validator would have to differ per coding — so the 200 and the 304 that\n   * revalidates it could disagree, and a cache would treat them as different pages. A weak tag says\n   * \"the same representation\", which is what stays true across content codings.\n   */\n  etag: string;\n}\n"]}

package/dist/server/server-config.d.ts

@@ -1,11 +1,15 @@
-import type { RSHonoConfig } from '../config.js';
+import type { RshonoConfig } from '../config.js';
 /**
- * The framework settings the server bundle needs at request time, fully resolved
- * (defaults applied, `bodySizeLimit` parsed to bytes, origins normalized to hosts).
+ * The framework settings the server bundle needs at request time, fully resolved.
  *
  * The value is produced once by {@link resolveServerConfig} from `rshono.config.ts`
  * and compiled into the server bundle as the `__RSHONO_CONFIG__` literal (see
  * `builder/rspack-config.ts`) — there is no runtime env-var interface for these.
+ *
+ * Only two fields, because only two things here are decided by the *build*. The per-request
+ * security controls that used to live alongside them — the CSRF check, the CSP, the body cap — are
+ * Hono middleware an app registers in `src/server.ts`, where they can be configured per route and
+ * per environment instead of once per bundle.
  */
 export interface ServerConfig {
     /**
@@ -15,58 +19,28 @@ export interface ServerConfig {
      * produced the bundle, and a deploy target need not have a `process` to read it from.
      */
     isDev: boolean;
-    /** Deadline in ms for a single request (server action + flight + SSR). */
-    renderTimeoutMs: number;
     /** Honour `X-Forwarded-Host` / `-Proto` when resolving the browser-facing URL. Forced on in dev. */
     trustProxy: boolean;
-    /** Send a strict per-request-nonce Content-Security-Policy with every HTML document. */
-    cspEnabled: boolean;
-    /** The resolved CSP directives (built-in defaults with the user's merged over them), minus the nonce. */
-    cspDirectives: Record<string, string>;
-    /** CSRF origin check on server-action POSTs. */
-    checkOrigin: boolean;
-    /** Extra origins allowed to post server actions, normalized to lowercase `URL.host` values. */
-    allowedOrigins: string[];
-    /** Max request body in bytes before a 413; `0` disables the cap. */
-    maxBodyBytes: number;
-    /** Gzip compressible responses on the way out. */
-    compress: boolean;
-    /** Default listen port for `start` (overridden by `PORT`). */
-    port?: number;
-    /** Default bind address for `start` (overridden by `HOST`). */
-    host?: string;
 }
 /**
- * The single source of truth for the framework's built-in defaults.
+ * The framework's built-in defaults.
  *
- * `renderTimeoutMs` and `maxBodyBytes` are resolved here, into the bundle. `port` and `host` are not:
- * they stay env-overridable at runtime, so the default is applied where the address is resolved
- * (`deploy/listen.ts` for a server bundle, `cli/dev.ts` for the dev server) and this is what both read.
+ * `port` and `host` are not config fields at all — they come from `PORT` / `HOST` (or `--port`)
+ * wherever the address is resolved, `deploy/node/runtime.ts` for a server bundle and `cli/dev.ts`
+ * for the dev server, and this is what both fall back to.
  */
 export declare const SERVER_DEFAULTS: {
-    readonly renderTimeoutMs: 10000;
-    readonly maxBodyBytes: number;
     readonly port: 3000;
     readonly host: '0.0.0.0';
 };
 /**
- * The built-in {@link RSHonoConfig.csp} policy, keyed by directive so
- * {@link RSHonoConfig.cspDirectives} can override entries individually.
- *
- * `script-src` carries the per-request nonce, appended at request time (see `entry.rsc.tsx`).
- * `style-src` needs `'unsafe-inline'` because React writes inline styles.
- */
-export declare const CSP_DEFAULTS: Record<string, string>;
-/** Parse a {@link RSHonoConfig.bodySizeLimit} value into a byte count (`false`/`0` → `0`, disabling the cap). */
-export declare function parseByteSize(value: string | number | false | undefined): number | undefined;
-/**
- * Resolve the user's {@link RSHonoConfig} into the {@link ServerConfig} baked into the bundle.
+ * Resolve the user's {@link RshonoConfig} into the {@link ServerConfig} baked into the bundle.
  *
  * `isDev` is a build-time input rather than a config field because it decides one thing the user
  * shouldn't have to: `trustProxy` is forced on under `rshono dev`, where the framework's own proxy
  * is the only way in (it sets the forwarded headers itself and binds to localhost).
  */
-export declare function resolveServerConfig(config: RSHonoConfig, { isDev }: {
+export declare function resolveServerConfig(config: RshonoConfig, { isDev }: {
     isDev: boolean;
 }): ServerConfig;
 //# sourceMappingURL=server-config.d.ts.map

package/dist/server/server-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-config.d.ts","sourceRoot":"","sources":["../../src/server/server-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,KAAK,EAAE,OAAO,CAAC;IACf,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAC;IACxB,oGAAoG;IACpG,UAAU,EAAE,OAAO,CAAC;IACpB,wFAAwF;IACxF,UAAU,EAAE,OAAO,CAAC;IACpB,yGAAyG;IACzG,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gDAAgD;IAChD,WAAW,EAAE,OAAO,CAAC;IACrB,+FAA+F;IAC/F,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,QAAQ,EAAE,OAAO,CAAC;IAClB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe;aAC1B,eAAe,EAAE,KAAM;aACvB,YAAY;aACZ,IAAI,EAAE,IAAI;aACV,IAAI,EAAE,SAAS;CACP,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAY/C,CAAC;AAIF,iHAAiH;AACjH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAS5F;AA0BD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,YAAY,CAiBrG"}
+{"version":3,"file":"server-config.d.ts","sourceRoot":"","sources":["../../src/server/server-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,KAAK,EAAE,OAAO,CAAC;IACf,oGAAoG;IACpG,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe;aAC1B,IAAI,EAAE,IAAI;aACV,IAAI,EAAE,SAAS;CACP,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,YAAY,CAKrG"}

package/dist/server/server-config.js

@@ -1,73 +1,16 @@
 /**
- * The single source of truth for the framework's built-in defaults.
+ * The framework's built-in defaults.
  *
- * `renderTimeoutMs` and `maxBodyBytes` are resolved here, into the bundle. `port` and `host` are not:
- * they stay env-overridable at runtime, so the default is applied where the address is resolved
- * (`deploy/listen.ts` for a server bundle, `cli/dev.ts` for the dev server) and this is what both read.
+ * `port` and `host` are not config fields at all — they come from `PORT` / `HOST` (or `--port`)
+ * wherever the address is resolved, `deploy/node/runtime.ts` for a server bundle and `cli/dev.ts`
+ * for the dev server, and this is what both fall back to.
  */
 export const SERVER_DEFAULTS = {
-    renderTimeoutMs: 10_000,
-    maxBodyBytes: 1024 * 1024, // 1 MiB, matching Next.js's server-action body-size limit.
     port: 3000,
     host: '0.0.0.0',
 };
 /**
- * The built-in {@link RSHonoConfig.csp} policy, keyed by directive so
- * {@link RSHonoConfig.cspDirectives} can override entries individually.
- *
- * `script-src` carries the per-request nonce, appended at request time (see `entry.rsc.tsx`).
- * `style-src` needs `'unsafe-inline'` because React writes inline styles.
- */
-export const CSP_DEFAULTS = {
-    'default-src': "'self'",
-    'script-src': "'self'",
-    'style-src': "'self' 'unsafe-inline'",
-    'img-src': "'self' data:",
-    'connect-src': "'self'",
-    // Not covered by default-src, and each closes an injection route of its own: a stray <base>
-    // retargeting every relative URL, plugin content, framing (clickjacking), off-site form posts.
-    'base-uri': "'self'",
-    'object-src': "'none'",
-    'frame-ancestors': "'none'",
-    'form-action': "'self'",
-};
-const UNITS = { b: 1, kb: 1024, mb: 1024 ** 2, gb: 1024 ** 3 };
-/** Parse a {@link RSHonoConfig.bodySizeLimit} value into a byte count (`false`/`0` → `0`, disabling the cap). */
-export function parseByteSize(value) {
-    if (value === undefined)
-        return undefined;
-    if (value === false)
-        return 0;
-    if (typeof value === 'number')
-        return value;
-    const match = /^\s*(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)?\s*$/i.exec(value);
-    if (!match) {
-        throw new Error(`[rshono] invalid bodySizeLimit ${JSON.stringify(value)} — use e.g. '1mb', 1048576, or false.`);
-    }
-    return Math.floor(Number(match[1]) * UNITS[(match[2] ?? 'b').toLowerCase()]);
-}
-/**
- * Normalize a config `allowedOrigins` entry (full origin or bare host) to a lowercase `URL.host`,
- * ready for a direct comparison against a parsed `Origin` header's host.
- *
- * A bare `host:port` has to be retried against a base, because on its own `'localhost:4000'`
- * parses as the *scheme* `localhost:` with path `4000` — leaving an empty host that would
- * silently never match anything. Throws rather than passing a junk entry through, so a typo
- * fails the build instead of quietly disabling the allowlist entry it was meant to add.
- */
-function normalizeOrigin(entry) {
-    const host = URL.parse(entry)?.host || URL.parse(`http://${entry}`)?.host;
-    if (!host) {
-        throw new Error(`[rshono] invalid allowedOrigins entry ${JSON.stringify(entry)} — use a full origin ('https://admin.example.com') or a bare host ('localhost:4000').`);
-    }
-    return host.toLowerCase();
-}
-/** Drop directives the user blanked out, so `cspDirectives: { 'frame-ancestors': '' }` removes one. */
-function resolveCspDirectives(overrides) {
-    return Object.fromEntries(Object.entries({ ...CSP_DEFAULTS, ...overrides }).filter(([, value]) => value.trim() !== ''));
-}
-/**
- * Resolve the user's {@link RSHonoConfig} into the {@link ServerConfig} baked into the bundle.
+ * Resolve the user's {@link RshonoConfig} into the {@link ServerConfig} baked into the bundle.
  *
  * `isDev` is a build-time input rather than a config field because it decides one thing the user
  * shouldn't have to: `trustProxy` is forced on under `rshono dev`, where the framework's own proxy
@@ -76,19 +19,7 @@ function resolveCspDirectives(overrides) {
 export function resolveServerConfig(config, { isDev }) {
     return {
         isDev,
-        renderTimeoutMs: config.renderTimeout ?? SERVER_DEFAULTS.renderTimeoutMs,
         trustProxy: isDev || (config.trustProxy ?? false),
-        cspEnabled: config.csp ?? false,
-        cspDirectives: resolveCspDirectives(config.cspDirectives),
-        checkOrigin: config.checkOrigin ?? true,
-        allowedOrigins: (config.allowedOrigins ?? [])
-            .map((entry) => entry.trim())
-            .filter(Boolean)
-            .map(normalizeOrigin),
-        maxBodyBytes: parseByteSize(config.bodySizeLimit) ?? SERVER_DEFAULTS.maxBodyBytes,
-        compress: config.compress ?? true,
-        port: config.port,
-        host: config.host,
     };
 }
 //# sourceMappingURL=server-config.js.map