@rshono/core 1.0.0-rc.0

package/dist/runtime/server.js

@@ -0,0 +1,24 @@
+/**
+ * `@rshono/core/server` — the request-scoped surface, for use inside server components
+ * and `'use server'` action modules: {@link getContext} for the URL, cookies,
+ * params, env and middleware variables, the {@link redirect} and {@link notFound}
+ * control-flow helpers, and {@link onServerError} for reporting the errors the
+ * framework catches.
+ *
+ * Server-only. Importing this from a `'use client'` module is a mistake — those
+ * run in the browser (and are SSR'd without a bound context). Read what you need
+ * on the server and pass it down as props, or use `useNavigation()` from
+ * `@rshono/core/client` for URL data.
+ *
+ * A barrel rather than `./context.js` itself, which is where all of this is
+ * implemented: that module also exports the plumbing the framework's own entry
+ * points need (`runWithContext`, `readParams`, `publicUrl`, `reportServerError`),
+ * and pointing the `./server` subpath straight at it published every one of them —
+ * `@internal` in the docs, but present in a consumer's autocomplete and pinned by
+ * semver all the same. They stay reachable by relative import, which is the only
+ * way the framework itself ever reaches them.
+ *
+ * @packageDocumentation
+ */
+export { getContext, notFound, onServerError, redirect, } from './context.js';
+//# sourceMappingURL=server.js.map

package/dist/runtime/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/runtime/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,UAAU,EACV,QAAQ,EACR,aAAa,EACb,QAAQ,GAST,MAAM,cAAc,CAAC","sourcesContent":["/**\n * `@rshono/core/server` — the request-scoped surface, for use inside server components\n * and `'use server'` action modules: {@link getContext} for the URL, cookies,\n * params, env and middleware variables, the {@link redirect} and {@link notFound}\n * control-flow helpers, and {@link onServerError} for reporting the errors the\n * framework catches.\n *\n * Server-only. Importing this from a `'use client'` module is a mistake — those\n * run in the browser (and are SSR'd without a bound context). Read what you need\n * on the server and pass it down as props, or use `useNavigation()` from\n * `@rshono/core/client` for URL data.\n *\n * A barrel rather than `./context.js` itself, which is where all of this is\n * implemented: that module also exports the plumbing the framework's own entry\n * points need (`runWithContext`, `readParams`, `publicUrl`, `reportServerError`),\n * and pointing the `./server` subpath straight at it published every one of them —\n * `@internal` in the docs, but present in a consumer's autocomplete and pinned by\n * semver all the same. They stay reachable by relative import, which is the only\n * way the framework itself ever reaches them.\n *\n * @packageDocumentation\n */\n\nexport {\n  getContext,\n  notFound,\n  onServerError,\n  redirect,\n  // A type, not a value: `Ctx` is handed to you by `getContext()` or the `ctx` page\n  // prop — one instance per request — and is never constructed by application code.\n  type Ctx,\n  type EnvVars,\n  type RedirectStatus,\n  type ServerErrorContext,\n  type ServerErrorHandler,\n  type ServerErrorSource,\n} from './context.js';\n"]}

package/dist/server/compress.d.ts

@@ -0,0 +1,15 @@
+import type { MiddlewareHandler } from 'hono';
+/**
+ * Gzips compressible responses, **without breaking streaming**.
+ *
+ * The obvious implementation — the platform's `CompressionStream`, which Hono's own `compress`
+ * middleware uses — buffers: zlib holds bytes back until it has a full block, so a streamed SSR
+ * shell would sit in the compressor instead of reaching the browser. That defeats the entire point
+ * of streaming a page. Node's zlib with `Z_SYNC_FLUSH` instead ends every write at a byte boundary
+ * the client can decode immediately, so each chunk the renderer flushes is a chunk the browser
+ * receives, at the cost of a few bytes of framing per chunk.
+ *
+ * Registered as the outermost middleware so it sees the finished response, headers and all.
+ */
+export declare function compress(): MiddlewareHandler;
+//# sourceMappingURL=compress.d.ts.map

package/dist/server/compress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compress.d.ts","sourceRoot":"","sources":["../../src/server/compress.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AA0B9C;;;;;;;;;;;GAWG;AACH,wBAAgB,QAAQ,IAAI,iBAAiB,CAsC5C"}

package/dist/server/compress.js

@@ -0,0 +1,76 @@
+import { COMPRESSIBLE_CONTENT_TYPE_REGEX } from 'hono/utils/compress';
+import { Duplex } from 'node:stream';
+import { constants, createGzip } from 'node:zlib';
+import { appendVary } from './headers.js';
+/** Below this many uncompressed bytes the gzip framing costs more than it saves. Only applied when the length is known up front. */
+const COMPRESSION_THRESHOLD_BYTES = 1024;
+/** `Cache-Control: no-transform` is a proxy asking not to be re-encoded; honour it. */
+const NO_TRANSFORM = /(?:^|,)\s*no-transform\s*(?:,|$)/i;
+/** Every browser that sends `Accept-Encoding` at all accepts gzip, so one encoding covers the field. */
+function acceptsGzip(acceptEncoding) {
+    if (!acceptEncoding)
+        return false;
+    // No `q=` anywhere (what every real browser sends) means there is no refusal to look for.
+    if (!acceptEncoding.includes('q='))
+        return acceptEncoding.includes('gzip') || acceptEncoding.includes('*');
+    return acceptEncoding.split(',').some((entry) => {
+        const [name, ...params] = entry.trim().split(';');
+        if (name.toLowerCase() !== 'gzip' && name.trim() !== '*')
+            return false;
+        // `gzip;q=0` is an explicit refusal, not an offer.
+        const q = params.map((p) => p.trim()).find((p) => p.startsWith('q='));
+        return q === undefined || Number(q.slice(2)) > 0;
+    });
+}
+/**
+ * Gzips compressible responses, **without breaking streaming**.
+ *
+ * The obvious implementation — the platform's `CompressionStream`, which Hono's own `compress`
+ * middleware uses — buffers: zlib holds bytes back until it has a full block, so a streamed SSR
+ * shell would sit in the compressor instead of reaching the browser. That defeats the entire point
+ * of streaming a page. Node's zlib with `Z_SYNC_FLUSH` instead ends every write at a byte boundary
+ * the client can decode immediately, so each chunk the renderer flushes is a chunk the browser
+ * receives, at the cost of a few bytes of framing per chunk.
+ *
+ * Registered as the outermost middleware so it sees the finished response, headers and all.
+ */
+export function compress() {
+    return async (c, next) => {
+        await next();
+        const res = c.res;
+        if (c.req.method === 'HEAD')
+            return;
+        // 204/304 have no body to speak of; a 206 range is counted in *uncompressed* bytes.
+        if (res.status === 204 || res.status === 304 || res.status === 206)
+            return;
+        if (res.headers.has('content-encoding'))
+            return;
+        if (!COMPRESSIBLE_CONTENT_TYPE_REGEX.test(res.headers.get('content-type') ?? ''))
+            return;
+        if (NO_TRANSFORM.test(res.headers.get('cache-control') ?? ''))
+            return;
+        const contentLength = res.headers.get('content-length');
+        if (contentLength !== null && Number(contentLength) < COMPRESSION_THRESHOLD_BYTES)
+            return;
+        if (!acceptsGzip(c.req.header('accept-encoding')))
+            return;
+        // Read `.body` only once we know we're compressing: it is what makes @hono/node-server's
+        // lightweight Response materialize a real one, throwing away the [status, body, headers] tuple
+        // it would otherwise write straight to the socket. The guards above touch only `.status` and
+        // `.headers`, which leave that fast path intact for every response we decide to pass through.
+        const body = res.body;
+        if (!body)
+            return;
+        const gzip = Duplex.toWeb(createGzip({ flush: constants.Z_SYNC_FLUSH }));
+        c.res = new Response(body.pipeThrough(gzip), res);
+        c.res.headers.set('content-encoding', 'gzip');
+        c.res.headers.delete('content-length'); // no longer the length of what goes on the wire
+        appendVary(c.res.headers, 'Accept-Encoding');
+        // The bytes changed, so a strong validator no longer describes them — but it is still the same
+        // representation, which is exactly what a weak one means.
+        const etag = c.res.headers.get('etag');
+        if (etag && !etag.startsWith('W/'))
+            c.res.headers.set('etag', `W/${etag}`);
+    };
+}
+//# sourceMappingURL=compress.js.map

package/dist/server/compress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compress.js","sourceRoot":"","sources":["../../src/server/compress.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,oIAAoI;AACpI,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEzC,uFAAuF;AACvF,MAAM,YAAY,GAAG,mCAAmC,CAAC;AAEzD,wGAAwG;AACxG,SAAS,WAAW,CAAC,cAAkC;IACrD,IAAI,CAAC,cAAc;QAAE,OAAO,KAAK,CAAC;IAClC,0FAA0F;IAC1F,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3G,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9C,MAAM,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACvE,mDAAmD;QACnD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,QAAQ;IACtB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,EAAE,CAAC;QAEb,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO;QACpC,oFAAoF;QACpF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO;QAC3E,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAAE,OAAO;QAChD,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO;QACzF,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO;QAEtE,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,aAAa,KAAK,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,GAAG,2BAA2B;YAAE,OAAO;QAC1F,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAAE,OAAO;QAE1D,yFAAyF;QACzF,+FAA+F;QAC/F,6FAA6F;QAC7F,8FAA8F;QAC9F,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAGtE,CAAC;QAEF,CAAC,CAAC,GAAG,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,gDAAgD;QACxF,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAE7C,+FAA+F;QAC/F,0DAA0D;QAC1D,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { MiddlewareHandler } from 'hono';\nimport { COMPRESSIBLE_CONTENT_TYPE_REGEX } from 'hono/utils/compress';\nimport { Duplex } from 'node:stream';\nimport { constants, createGzip } from 'node:zlib';\nimport { appendVary } from './headers.js';\n\n/** Below this many uncompressed bytes the gzip framing costs more than it saves. Only applied when the length is known up front. */\nconst COMPRESSION_THRESHOLD_BYTES = 1024;\n\n/** `Cache-Control: no-transform` is a proxy asking not to be re-encoded; honour it. */\nconst NO_TRANSFORM = /(?:^|,)\\s*no-transform\\s*(?:,|$)/i;\n\n/** Every browser that sends `Accept-Encoding` at all accepts gzip, so one encoding covers the field. */\nfunction acceptsGzip(acceptEncoding: string | undefined): boolean {\n  if (!acceptEncoding) return false;\n  // No `q=` anywhere (what every real browser sends) means there is no refusal to look for.\n  if (!acceptEncoding.includes('q=')) return acceptEncoding.includes('gzip') || acceptEncoding.includes('*');\n  return acceptEncoding.split(',').some((entry) => {\n    const [name, ...params] = entry.trim().split(';');\n    if (name.toLowerCase() !== 'gzip' && name.trim() !== '*') return false;\n    // `gzip;q=0` is an explicit refusal, not an offer.\n    const q = params.map((p) => p.trim()).find((p) => p.startsWith('q='));\n    return q === undefined || Number(q.slice(2)) > 0;\n  });\n}\n\n/**\n * Gzips compressible responses, **without breaking streaming**.\n *\n * The obvious implementation — the platform's `CompressionStream`, which Hono's own `compress`\n * middleware uses — buffers: zlib holds bytes back until it has a full block, so a streamed SSR\n * shell would sit in the compressor instead of reaching the browser. That defeats the entire point\n * of streaming a page. Node's zlib with `Z_SYNC_FLUSH` instead ends every write at a byte boundary\n * the client can decode immediately, so each chunk the renderer flushes is a chunk the browser\n * receives, at the cost of a few bytes of framing per chunk.\n *\n * Registered as the outermost middleware so it sees the finished response, headers and all.\n */\nexport function compress(): MiddlewareHandler {\n  return async (c, next) => {\n    await next();\n\n    const res = c.res;\n    if (c.req.method === 'HEAD') return;\n    // 204/304 have no body to speak of; a 206 range is counted in *uncompressed* bytes.\n    if (res.status === 204 || res.status === 304 || res.status === 206) return;\n    if (res.headers.has('content-encoding')) return;\n    if (!COMPRESSIBLE_CONTENT_TYPE_REGEX.test(res.headers.get('content-type') ?? '')) return;\n    if (NO_TRANSFORM.test(res.headers.get('cache-control') ?? '')) return;\n\n    const contentLength = res.headers.get('content-length');\n    if (contentLength !== null && Number(contentLength) < COMPRESSION_THRESHOLD_BYTES) return;\n    if (!acceptsGzip(c.req.header('accept-encoding'))) return;\n\n    // Read `.body` only once we know we're compressing: it is what makes @hono/node-server's\n    // lightweight Response materialize a real one, throwing away the [status, body, headers] tuple\n    // it would otherwise write straight to the socket. The guards above touch only `.status` and\n    // `.headers`, which leave that fast path intact for every response we decide to pass through.\n    const body = res.body;\n    if (!body) return;\n\n    const gzip = Duplex.toWeb(createGzip({ flush: constants.Z_SYNC_FLUSH })) as unknown as {\n      readable: ReadableStream<Uint8Array>;\n      writable: WritableStream<Uint8Array>;\n    };\n\n    c.res = new Response(body.pipeThrough(gzip), res);\n    c.res.headers.set('content-encoding', 'gzip');\n    c.res.headers.delete('content-length'); // no longer the length of what goes on the wire\n    appendVary(c.res.headers, 'Accept-Encoding');\n\n    // The bytes changed, so a strong validator no longer describes them — but it is still the same\n    // representation, which is exactly what a weak one means.\n    const etag = c.res.headers.get('etag');\n    if (etag && !etag.startsWith('W/')) c.res.headers.set('etag', `W/${etag}`);\n  };\n}\n"]}

package/dist/server/headers.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Small header utilities shared by the response-header defaults, the compressor and the
+ * prerendered-page cache. Kept apart from any one of them because getting `Vary` and `ETag`
+ * comparison subtly wrong is exactly the kind of thing that only shows up behind a CDN.
+ */
+/**
+ * Adds `value` to the `Vary` header without discarding what is already there.
+ *
+ * `Vary` is a list, and two different concerns write to it here — content negotiation on `Accept`
+ * (HTML document vs flight payload) and `Accept-Encoding` from the compressor. A plain `set` from
+ * whichever ran last would drop the other, and a cache would then happily serve one variant in
+ * place of the other. `*` is left alone: it already means "never reuse this".
+ */
+export declare function appendVary(headers: Headers, value: string): void;
+/**
+ * True when an `If-None-Match` request header matches `etag`, i.e. the client already holds this
+ * exact body and should be answered with a 304.
+ *
+ * The header carries a *list*, and each entry may be weak (`W/"…"`). The weak prefix is ignored on
+ * both sides because the compressor rewrites a strong tag to a weak one when it changes the bytes
+ * on the wire — the representation is still the same one the client cached.
+ */
+export declare function etagMatches(ifNoneMatch: string | undefined, etag: string): boolean;
+//# sourceMappingURL=headers.d.ts.map

package/dist/server/headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../../src/server/headers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAShE;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAQlF"}

package/dist/server/headers.js

@@ -0,0 +1,44 @@
+/**
+ * Small header utilities shared by the response-header defaults, the compressor and the
+ * prerendered-page cache. Kept apart from any one of them because getting `Vary` and `ETag`
+ * comparison subtly wrong is exactly the kind of thing that only shows up behind a CDN.
+ */
+/**
+ * Adds `value` to the `Vary` header without discarding what is already there.
+ *
+ * `Vary` is a list, and two different concerns write to it here — content negotiation on `Accept`
+ * (HTML document vs flight payload) and `Accept-Encoding` from the compressor. A plain `set` from
+ * whichever ran last would drop the other, and a cache would then happily serve one variant in
+ * place of the other. `*` is left alone: it already means "never reuse this".
+ */
+export function appendVary(headers, value) {
+    const existing = headers.get('vary');
+    if (existing === null) {
+        headers.set('vary', value);
+        return;
+    }
+    if (existing.trim() === '*')
+        return;
+    const already = existing.split(',').some((entry) => entry.trim().toLowerCase() === value.toLowerCase());
+    if (!already)
+        headers.set('vary', `${existing}, ${value}`);
+}
+/**
+ * True when an `If-None-Match` request header matches `etag`, i.e. the client already holds this
+ * exact body and should be answered with a 304.
+ *
+ * The header carries a *list*, and each entry may be weak (`W/"…"`). The weak prefix is ignored on
+ * both sides because the compressor rewrites a strong tag to a weak one when it changes the bytes
+ * on the wire — the representation is still the same one the client cached.
+ */
+export function etagMatches(ifNoneMatch, etag) {
+    if (!ifNoneMatch)
+        return false;
+    const normalize = (value) => value.trim().replace(/^W\//, '');
+    const wanted = normalize(etag);
+    return ifNoneMatch.split(',').some((entry) => {
+        const candidate = normalize(entry);
+        return candidate === '*' || candidate === wanted;
+    });
+}
+//# sourceMappingURL=headers.js.map

package/dist/server/headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../../src/server/headers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,OAAgB,EAAE,KAAa;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO;IACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACxG,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,QAAQ,KAAK,KAAK,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,WAA+B,EAAE,IAAY;IACvE,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3C,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,MAAM,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Small header utilities shared by the response-header defaults, the compressor and the\n * prerendered-page cache. Kept apart from any one of them because getting `Vary` and `ETag`\n * comparison subtly wrong is exactly the kind of thing that only shows up behind a CDN.\n */\n\n/**\n * Adds `value` to the `Vary` header without discarding what is already there.\n *\n * `Vary` is a list, and two different concerns write to it here — content negotiation on `Accept`\n * (HTML document vs flight payload) and `Accept-Encoding` from the compressor. A plain `set` from\n * whichever ran last would drop the other, and a cache would then happily serve one variant in\n * place of the other. `*` is left alone: it already means \"never reuse this\".\n */\nexport function appendVary(headers: Headers, value: string): void {\n  const existing = headers.get('vary');\n  if (existing === null) {\n    headers.set('vary', value);\n    return;\n  }\n  if (existing.trim() === '*') return;\n  const already = existing.split(',').some((entry) => entry.trim().toLowerCase() === value.toLowerCase());\n  if (!already) headers.set('vary', `${existing}, ${value}`);\n}\n\n/**\n * True when an `If-None-Match` request header matches `etag`, i.e. the client already holds this\n * exact body and should be answered with a 304.\n *\n * The header carries a *list*, and each entry may be weak (`W/\"…\"`). The weak prefix is ignored on\n * both sides because the compressor rewrites a strong tag to a weak one when it changes the bytes\n * on the wire — the representation is still the same one the client cached.\n */\nexport function etagMatches(ifNoneMatch: string | undefined, etag: string): boolean {\n  if (!ifNoneMatch) return false;\n  const normalize = (value: string) => value.trim().replace(/^W\\//, '');\n  const wanted = normalize(etag);\n  return ifNoneMatch.split(',').some((entry) => {\n    const candidate = normalize(entry);\n    return candidate === '*' || candidate === wanted;\n  });\n}\n"]}

package/dist/server/load-config.d.ts

@@ -0,0 +1,7 @@
+import type { RSHonoConfig } from '../config.js';
+/**
+ * Load the project config, or `{}` if none exists. Scans `rshono.config.{ts,js,mjs}` at
+ * {@link rootDir} unless an explicit {@link configPath} is given (resolved relative to `cwd`).
+ */
+export declare function loadConfig(rootDir: string, configPath?: string): Promise<RSHonoConfig>;
+//# sourceMappingURL=load-config.d.ts.map

package/dist/server/load-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-config.d.ts","sourceRoot":"","sources":["../../src/server/load-config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAmBjD;;;GAGG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAe5F"}

package/dist/server/load-config.js

@@ -0,0 +1,41 @@
+import { existsSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+const CONFIG_FILES = ['rshono.config.ts', 'rshono.config.js', 'rshono.config.mjs'];
+/**
+ * Imports the config module.
+ *
+ * A `.js`/`.mjs` config is a plain dynamic import. A `.ts` one can't be — the CLI itself runs as
+ * compiled JavaScript, so nothing in the process understands TypeScript by default. `tsx`'s
+ * programmatic API is loaded for that case only, which keeps it off the startup path of every
+ * other command instead of paying for a TypeScript loader the whole CLI doesn't need.
+ */
+async function importConfig(file) {
+    const href = pathToFileURL(file).href;
+    if (!/\.[cm]?ts$/.test(file))
+        return import(href);
+    const { tsImport } = await import('tsx/esm/api');
+    return tsImport(href, import.meta.url);
+}
+/**
+ * Load the project config, or `{}` if none exists. Scans `rshono.config.{ts,js,mjs}` at
+ * {@link rootDir} unless an explicit {@link configPath} is given (resolved relative to `cwd`).
+ */
+export async function loadConfig(rootDir, configPath) {
+    const file = configPath
+        ? isAbsolute(configPath)
+            ? configPath
+            : resolve(process.cwd(), configPath)
+        : CONFIG_FILES.map((f) => join(rootDir, f)).find(existsSync);
+    if (!file)
+        return {};
+    if (!existsSync(file)) {
+        throw new Error(`[rshono] config file not found: ${file}`);
+    }
+    const mod = await importConfig(file);
+    if (!mod.default) {
+        throw new Error(`[rshono] ${file} must \`export default\` a config object (use \`defineConfig({ … })\`).`);
+    }
+    return mod.default;
+}
+//# sourceMappingURL=load-config.js.map

package/dist/server/load-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-config.js","sourceRoot":"","sources":["../../src/server/load-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,MAAM,YAAY,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;AAEnF;;;;;;;GAOG;AACH,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACtC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAwC,CAAC;IACzF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACjD,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,GAAG,CAAwC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAe,EAAE,UAAmB;IACnE,MAAM,IAAI,GAAG,UAAU;QACrB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;YACtB,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC;QACtC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,yEAAyE,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC","sourcesContent":["import { existsSync } from 'node:fs';\nimport { isAbsolute, join, resolve } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport type { RSHonoConfig } from '../config.js';\n\nconst CONFIG_FILES = ['rshono.config.ts', 'rshono.config.js', 'rshono.config.mjs'];\n\n/**\n * Imports the config module.\n *\n * A `.js`/`.mjs` config is a plain dynamic import. A `.ts` one can't be — the CLI itself runs as\n * compiled JavaScript, so nothing in the process understands TypeScript by default. `tsx`'s\n * programmatic API is loaded for that case only, which keeps it off the startup path of every\n * other command instead of paying for a TypeScript loader the whole CLI doesn't need.\n */\nasync function importConfig(file: string): Promise<{ default?: RSHonoConfig }> {\n  const href = pathToFileURL(file).href;\n  if (!/\\.[cm]?ts$/.test(file)) return import(href) as Promise<{ default?: RSHonoConfig }>;\n  const { tsImport } = await import('tsx/esm/api');\n  return tsImport(href, import.meta.url) as Promise<{ default?: RSHonoConfig }>;\n}\n\n/**\n * Load the project config, or `{}` if none exists. Scans `rshono.config.{ts,js,mjs}` at\n * {@link rootDir} unless an explicit {@link configPath} is given (resolved relative to `cwd`).\n */\nexport async function loadConfig(rootDir: string, configPath?: string): Promise<RSHonoConfig> {\n  const file = configPath\n    ? isAbsolute(configPath)\n      ? configPath\n      : resolve(process.cwd(), configPath)\n    : CONFIG_FILES.map((f) => join(rootDir, f)).find(existsSync);\n  if (!file) return {};\n  if (!existsSync(file)) {\n    throw new Error(`[rshono] config file not found: ${file}`);\n  }\n  const mod = await importConfig(file);\n  if (!mod.default) {\n    throw new Error(`[rshono] ${file} must \\`export default\\` a config object (use \\`defineConfig({ … })\\`).`);\n  }\n  return mod.default;\n}\n"]}

package/dist/server/load-env.d.ts

@@ -0,0 +1,2 @@
+export declare function loadEnvFiles(rootDir: string): void;
+//# sourceMappingURL=load-env.d.ts.map

package/dist/server/load-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-env.d.ts","sourceRoot":"","sources":["../../src/server/load-env.ts"],"names":[],"mappings":"AAGA,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAKlD"}

package/dist/server/load-env.js

@@ -0,0 +1,10 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+export function loadEnvFiles(rootDir) {
+    for (const file of ['.env.local', '.env']) {
+        const envPath = join(rootDir, file);
+        if (existsSync(envPath))
+            process.loadEnvFile(envPath);
+    }
+}
+//# sourceMappingURL=load-env.js.map

package/dist/server/load-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-env.js","sourceRoot":"","sources":["../../src/server/load-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;AACH,CAAC","sourcesContent":["import { existsSync } from 'node:fs';\nimport { join } from 'node:path';\n\nexport function loadEnvFiles(rootDir: string): void {\n  for (const file of ['.env.local', '.env']) {\n    const envPath = join(rootDir, file);\n    if (existsSync(envPath)) process.loadEnvFile(envPath);\n  }\n}\n"]}

package/dist/server/prerendered.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Everything about a prerendered page that doesn't need a filesystem: where the build puts it, and
+ * what it looks like once read back.
+ *
+ * Split out of `ssg.ts` — which owns the writing and the reading, both through `node:fs` — because a
+ * deploy target without a filesystem reads the very same layout out of an asset store, and importing
+ * it from the fs module would drag `node:fs` and `node:crypto` into a bundle that has neither.
+ */
+/**
+ * The two representations of a page, prerendered side by side.
+ *
+ * A hard load wants the HTML document; a soft navigation asks the same URL for a flight payload.
+ * Writing only the HTML meant every in-app click re-rendered a page that was already built, so the
+ * prerender only ever paid off for cold loads and crawlers.
+ */
+export type PrerenderVariant = 'html' | 'flight';
+export declare const VARIANTS: {
+    readonly html: {
+        readonly file: 'index.html';
+        readonly accept: 'text/html';
+        readonly contentType: 'text/html';
+    };
+    readonly flight: {
+        readonly file: 'index.rsc';
+        readonly accept: 'text/x-component';
+        readonly contentType: 'text/x-component';
+    };
+};
+/**
+ * Where a route's prerendered output lives, relative to the output root — or `null` for a path that
+ * cannot be prerendered at all (one with a param or a wildcard left in it).
+ *
+ * Always `/`-separated, never the host's separator: the same string addresses a file on a filesystem
+ * (`resolve()` and `join()` both accept forward slashes on Windows) and a key in an asset store,
+ * where a backslash would simply be the wrong character.
+ */
+export declare function ssgFilePath(routePath: string, variant?: PrerenderVariant): string | null;
+/**
+ * {@link ssgFilePath} for a path that came off a request, so traversal is a miss rather than a lookup.
+ *
+ * The first line of defence for every deploy target: a store addressed by key has no `resolve()` to
+ * fall back on, so `..` has to be refused here or not at all.
+ */
+export declare function prerenderedRelPath(requestPath: string, variant: PrerenderVariant): string | null;
+/** A prerendered page, ready to serve: its body and a validator derived from those exact bytes. */
+export interface PrerenderedPage {
+    /** The document or the flight payload, depending on which {@link PrerenderVariant} was read. */
+    body: string;
+    /**
+     * `Content-Length` for {@link body}, in bytes rather than characters.
+     *
+     * Served with the response because Hono sets no length for an in-memory body, and without one the
+     * compressor cannot tell a 300-byte page from a 300 KB one — so it gzips both, including the ones
+     * where the framing costs more than it saves.
+     */
+    contentLength: string;
+    /**
+     * `ETag` for the page, so a revalidating client can be answered with a 304 instead of the body.
+     *
+     * Deliberately **weak**. The bytes on the wire depend on whether the client took gzip, and a
+     * strong validator would have to differ between those two — so the 200 and the 304 that
+     * revalidates it would disagree, and a cache would treat them as different pages. A weak tag
+     * says "the same representation", which is exactly what is true across content codings.
+     */
+    etag: string;
+}
+//# sourceMappingURL=prerendered.d.ts.map

package/dist/server/prerendered.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prerendered.d.ts","sourceRoot":"","sources":["../../src/server/prerendered.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEjD,eAAO,MAAM,QAAQ;;iBACX,IAAI,EAAE,YAAY;iBAAE,MAAM,EAAE,WAAW;iBAAE,WAAW,EAAE,WAAW;;;iBAC/D,IAAI,EAAE,WAAW;iBAAE,MAAM,EAAE,kBAAkB;iBAAE,WAAW,EAAE,kBAAkB;;CACU,CAAC;AAErG;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAyB,GAAG,MAAM,GAAG,IAAI,CAKhG;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAGhG;AAED,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;CACd"}

package/dist/server/prerendered.js

@@ -0,0 +1,39 @@
+/**
+ * Everything about a prerendered page that doesn't need a filesystem: where the build puts it, and
+ * what it looks like once read back.
+ *
+ * Split out of `ssg.ts` — which owns the writing and the reading, both through `node:fs` — because a
+ * deploy target without a filesystem reads the very same layout out of an asset store, and importing
+ * it from the fs module would drag `node:fs` and `node:crypto` into a bundle that has neither.
+ */
+export const VARIANTS = {
+    html: { file: 'index.html', accept: 'text/html', contentType: 'text/html' },
+    flight: { file: 'index.rsc', accept: 'text/x-component', contentType: 'text/x-component' },
+};
+/**
+ * Where a route's prerendered output lives, relative to the output root — or `null` for a path that
+ * cannot be prerendered at all (one with a param or a wildcard left in it).
+ *
+ * Always `/`-separated, never the host's separator: the same string addresses a file on a filesystem
+ * (`resolve()` and `join()` both accept forward slashes on Windows) and a key in an asset store,
+ * where a backslash would simply be the wrong character.
+ */
+export function ssgFilePath(routePath, variant = 'html') {
+    if (/[:*]/.test(routePath))
+        return null;
+    const trimmed = routePath.replace(/^\/+|\/+$/g, '');
+    const file = VARIANTS[variant].file;
+    return trimmed === '' ? file : `${trimmed}/${file}`;
+}
+/**
+ * {@link ssgFilePath} for a path that came off a request, so traversal is a miss rather than a lookup.
+ *
+ * The first line of defence for every deploy target: a store addressed by key has no `resolve()` to
+ * fall back on, so `..` has to be refused here or not at all.
+ */
+export function prerenderedRelPath(requestPath, variant) {
+    if (/(^|\/)\.\.?(\/|$)/.test(requestPath))
+        return null;
+    return ssgFilePath(requestPath, variant);
+}
+//# sourceMappingURL=prerendered.js.map

package/dist/server/prerendered.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prerendered.js","sourceRoot":"","sources":["../../src/server/prerendered.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE;IAC3E,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,kBAAkB,EAAE;CACQ,CAAC;AAErG;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,OAAO,GAAqB,MAAM;IAC/E,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IACpC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,OAAyB;IAC/E,IAAI,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC","sourcesContent":["/**\n * Everything about a prerendered page that doesn't need a filesystem: where the build puts it, and\n * what it looks like once read back.\n *\n * Split out of `ssg.ts` — which owns the writing and the reading, both through `node:fs` — because a\n * deploy target without a filesystem reads the very same layout out of an asset store, and importing\n * it from the fs module would drag `node:fs` and `node:crypto` into a bundle that has neither.\n */\n\n/**\n * The two representations of a page, prerendered side by side.\n *\n * A hard load wants the HTML document; a soft navigation asks the same URL for a flight payload.\n * Writing only the HTML meant every in-app click re-rendered a page that was already built, so the\n * prerender only ever paid off for cold loads and crawlers.\n */\nexport type PrerenderVariant = 'html' | 'flight';\n\nexport const VARIANTS = {\n  html: { file: 'index.html', accept: 'text/html', contentType: 'text/html' },\n  flight: { file: 'index.rsc', accept: 'text/x-component', contentType: 'text/x-component' },\n} as const satisfies Record<PrerenderVariant, { file: string; accept: string; contentType: string }>;\n\n/**\n * Where a route's prerendered output lives, relative to the output root — or `null` for a path that\n * cannot be prerendered at all (one with a param or a wildcard left in it).\n *\n * Always `/`-separated, never the host's separator: the same string addresses a file on a filesystem\n * (`resolve()` and `join()` both accept forward slashes on Windows) and a key in an asset store,\n * where a backslash would simply be the wrong character.\n */\nexport function ssgFilePath(routePath: string, variant: PrerenderVariant = 'html'): string | null {\n  if (/[:*]/.test(routePath)) return null;\n  const trimmed = routePath.replace(/^\\/+|\\/+$/g, '');\n  const file = VARIANTS[variant].file;\n  return trimmed === '' ? file : `${trimmed}/${file}`;\n}\n\n/**\n * {@link ssgFilePath} for a path that came off a request, so traversal is a miss rather than a lookup.\n *\n * The first line of defence for every deploy target: a store addressed by key has no `resolve()` to\n * fall back on, so `..` has to be refused here or not at all.\n */\nexport function prerenderedRelPath(requestPath: string, variant: PrerenderVariant): string | null {\n  if (/(^|\\/)\\.\\.?(\\/|$)/.test(requestPath)) return null;\n  return ssgFilePath(requestPath, variant);\n}\n\n/** A prerendered page, ready to serve: its body and a validator derived from those exact bytes. */\nexport interface PrerenderedPage {\n  /** The document or the flight payload, depending on which {@link PrerenderVariant} was read. */\n  body: string;\n  /**\n   * `Content-Length` for {@link body}, in bytes rather than characters.\n   *\n   * Served with the response because Hono sets no length for an in-memory body, and without one the\n   * compressor cannot tell a 300-byte page from a 300 KB one — so it gzips both, including the ones\n   * where the framing costs more than it saves.\n   */\n  contentLength: string;\n  /**\n   * `ETag` for the page, so a revalidating client can be answered with a 304 instead of the body.\n   *\n   * Deliberately **weak**. The bytes on the wire depend on whether the client took gzip, and a\n   * strong validator would have to differ between those two — so the 200 and the 304 that\n   * revalidates it would disagree, and a cache would treat them as different pages. A weak tag\n   * says \"the same representation\", which is exactly what is true across content codings.\n   */\n  etag: string;\n}\n"]}

package/dist/server/server-config.d.ts

@@ -0,0 +1,72 @@
+import type { RSHonoConfig } from '../config.js';
+/**
+ * The framework settings the server bundle needs at request time, fully resolved
+ * (defaults applied, `bodySizeLimit` parsed to bytes, origins normalized to hosts).
+ *
+ * The value is produced once by {@link resolveServerConfig} from `rshono.config.ts`
+ * and compiled into the server bundle as the `__RSHONO_CONFIG__` literal (see
+ * `builder/rspack-config.ts`) — there is no runtime env-var interface for these.
+ */
+export interface ServerConfig {
+    /**
+     * `true` when the bundle came from `rshono dev`.
+     *
+     * Baked in rather than read from `process.env.NODE_ENV` at runtime: it is decided by which command
+     * produced the bundle, and a deploy target need not have a `process` to read it from.
+     */
+    isDev: boolean;
+    /** Deadline in ms for a single request (server action + flight + SSR). */
+    renderTimeoutMs: number;
+    /** Honour `X-Forwarded-Host` / `-Proto` when resolving the browser-facing URL. Forced on in dev. */
+    trustProxy: boolean;
+    /** Send a strict per-request-nonce Content-Security-Policy with every HTML document. */
+    cspEnabled: boolean;
+    /** The resolved CSP directives (built-in defaults with the user's merged over them), minus the nonce. */
+    cspDirectives: Record<string, string>;
+    /** CSRF origin check on server-action POSTs. */
+    checkOrigin: boolean;
+    /** Extra origins allowed to post server actions, normalized to lowercase `URL.host` values. */
+    allowedOrigins: string[];
+    /** Max request body in bytes before a 413; `0` disables the cap. */
+    maxBodyBytes: number;
+    /** Gzip compressible responses on the way out. */
+    compress: boolean;
+    /** Default listen port for `start` (overridden by `PORT`). */
+    port?: number;
+    /** Default bind address for `start` (overridden by `HOST`). */
+    host?: string;
+}
+/**
+ * The single source of truth for the framework's built-in defaults.
+ *
+ * `renderTimeoutMs` and `maxBodyBytes` are resolved here, into the bundle. `port` and `host` are not:
+ * they stay env-overridable at runtime, so the default is applied where the address is resolved
+ * (`deploy/listen.ts` for a server bundle, `cli/dev.ts` for the dev server) and this is what both read.
+ */
+export declare const SERVER_DEFAULTS: {
+    readonly renderTimeoutMs: 10000;
+    readonly maxBodyBytes: number;
+    readonly port: 3000;
+    readonly host: '0.0.0.0';
+};
+/**
+ * The built-in {@link RSHonoConfig.csp} policy, keyed by directive so
+ * {@link RSHonoConfig.cspDirectives} can override entries individually.
+ *
+ * `script-src` carries the per-request nonce, appended at request time (see `entry.rsc.tsx`).
+ * `style-src` needs `'unsafe-inline'` because React writes inline styles.
+ */
+export declare const CSP_DEFAULTS: Record<string, string>;
+/** Parse a {@link RSHonoConfig.bodySizeLimit} value into a byte count (`false`/`0` → `0`, disabling the cap). */
+export declare function parseByteSize(value: string | number | false | undefined): number | undefined;
+/**
+ * Resolve the user's {@link RSHonoConfig} into the {@link ServerConfig} baked into the bundle.
+ *
+ * `isDev` is a build-time input rather than a config field because it decides one thing the user
+ * shouldn't have to: `trustProxy` is forced on under `rshono dev`, where the framework's own proxy
+ * is the only way in (it sets the forwarded headers itself and binds to localhost).
+ */
+export declare function resolveServerConfig(config: RSHonoConfig, { isDev }: {
+    isDev: boolean;
+}): ServerConfig;
+//# sourceMappingURL=server-config.d.ts.map

package/dist/server/server-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-config.d.ts","sourceRoot":"","sources":["../../src/server/server-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,KAAK,EAAE,OAAO,CAAC;IACf,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAC;IACxB,oGAAoG;IACpG,UAAU,EAAE,OAAO,CAAC;IACpB,wFAAwF;IACxF,UAAU,EAAE,OAAO,CAAC;IACpB,yGAAyG;IACzG,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gDAAgD;IAChD,WAAW,EAAE,OAAO,CAAC;IACrB,+FAA+F;IAC/F,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,QAAQ,EAAE,OAAO,CAAC;IAClB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe;aAC1B,eAAe,EAAE,KAAM;aACvB,YAAY;aACZ,IAAI,EAAE,IAAI;aACV,IAAI,EAAE,SAAS;CACP,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAY/C,CAAC;AAIF,iHAAiH;AACjH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAS5F;AA0BD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,YAAY,CAiBrG"}

package/dist/server/server-config.js

@@ -0,0 +1,94 @@
+/**
+ * The single source of truth for the framework's built-in defaults.
+ *
+ * `renderTimeoutMs` and `maxBodyBytes` are resolved here, into the bundle. `port` and `host` are not:
+ * they stay env-overridable at runtime, so the default is applied where the address is resolved
+ * (`deploy/listen.ts` for a server bundle, `cli/dev.ts` for the dev server) and this is what both read.
+ */
+export const SERVER_DEFAULTS = {
+    renderTimeoutMs: 10_000,
+    maxBodyBytes: 1024 * 1024, // 1 MiB, matching Next.js's server-action body-size limit.
+    port: 3000,
+    host: '0.0.0.0',
+};
+/**
+ * The built-in {@link RSHonoConfig.csp} policy, keyed by directive so
+ * {@link RSHonoConfig.cspDirectives} can override entries individually.
+ *
+ * `script-src` carries the per-request nonce, appended at request time (see `entry.rsc.tsx`).
+ * `style-src` needs `'unsafe-inline'` because React writes inline styles.
+ */
+export const CSP_DEFAULTS = {
+    'default-src': "'self'",
+    'script-src': "'self'",
+    'style-src': "'self' 'unsafe-inline'",
+    'img-src': "'self' data:",
+    'connect-src': "'self'",
+    // Not covered by default-src, and each closes an injection route of its own: a stray <base>
+    // retargeting every relative URL, plugin content, framing (clickjacking), off-site form posts.
+    'base-uri': "'self'",
+    'object-src': "'none'",
+    'frame-ancestors': "'none'",
+    'form-action': "'self'",
+};
+const UNITS = { b: 1, kb: 1024, mb: 1024 ** 2, gb: 1024 ** 3 };
+/** Parse a {@link RSHonoConfig.bodySizeLimit} value into a byte count (`false`/`0` → `0`, disabling the cap). */
+export function parseByteSize(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === false)
+        return 0;
+    if (typeof value === 'number')
+        return value;
+    const match = /^\s*(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)?\s*$/i.exec(value);
+    if (!match) {
+        throw new Error(`[rshono] invalid bodySizeLimit ${JSON.stringify(value)} — use e.g. '1mb', 1048576, or false.`);
+    }
+    return Math.floor(Number(match[1]) * UNITS[(match[2] ?? 'b').toLowerCase()]);
+}
+/**
+ * Normalize a config `allowedOrigins` entry (full origin or bare host) to a lowercase `URL.host`,
+ * ready for a direct comparison against a parsed `Origin` header's host.
+ *
+ * A bare `host:port` has to be retried against a base, because on its own `'localhost:4000'`
+ * parses as the *scheme* `localhost:` with path `4000` — leaving an empty host that would
+ * silently never match anything. Throws rather than passing a junk entry through, so a typo
+ * fails the build instead of quietly disabling the allowlist entry it was meant to add.
+ */
+function normalizeOrigin(entry) {
+    const host = URL.parse(entry)?.host || URL.parse(`http://${entry}`)?.host;
+    if (!host) {
+        throw new Error(`[rshono] invalid allowedOrigins entry ${JSON.stringify(entry)} — use a full origin ('https://admin.example.com') or a bare host ('localhost:4000').`);
+    }
+    return host.toLowerCase();
+}
+/** Drop directives the user blanked out, so `cspDirectives: { 'frame-ancestors': '' }` removes one. */
+function resolveCspDirectives(overrides) {
+    return Object.fromEntries(Object.entries({ ...CSP_DEFAULTS, ...overrides }).filter(([, value]) => value.trim() !== ''));
+}
+/**
+ * Resolve the user's {@link RSHonoConfig} into the {@link ServerConfig} baked into the bundle.
+ *
+ * `isDev` is a build-time input rather than a config field because it decides one thing the user
+ * shouldn't have to: `trustProxy` is forced on under `rshono dev`, where the framework's own proxy
+ * is the only way in (it sets the forwarded headers itself and binds to localhost).
+ */
+export function resolveServerConfig(config, { isDev }) {
+    return {
+        isDev,
+        renderTimeoutMs: config.renderTimeout ?? SERVER_DEFAULTS.renderTimeoutMs,
+        trustProxy: isDev || (config.trustProxy ?? false),
+        cspEnabled: config.csp ?? false,
+        cspDirectives: resolveCspDirectives(config.cspDirectives),
+        checkOrigin: config.checkOrigin ?? true,
+        allowedOrigins: (config.allowedOrigins ?? [])
+            .map((entry) => entry.trim())
+            .filter(Boolean)
+            .map(normalizeOrigin),
+        maxBodyBytes: parseByteSize(config.bodySizeLimit) ?? SERVER_DEFAULTS.maxBodyBytes,
+        compress: config.compress ?? true,
+        port: config.port,
+        host: config.host,
+    };
+}
+//# sourceMappingURL=server-config.js.map