@rshono/core 1.0.0-rc.0

package/dist/server/server-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-config.js","sourceRoot":"","sources":["../../src/server/server-config.ts"],"names":[],"mappings":"AAwCA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,eAAe,EAAE,MAAM;IACvB,YAAY,EAAE,IAAI,GAAG,IAAI,EAAE,2DAA2D;IACtF,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,SAAS;CACP,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAA2B;IAClD,aAAa,EAAE,QAAQ;IACvB,YAAY,EAAE,QAAQ;IACtB,WAAW,EAAE,wBAAwB;IACrC,SAAS,EAAE,cAAc;IACzB,aAAa,EAAE,QAAQ;IACvB,4FAA4F;IAC5F,+FAA+F;IAC/F,UAAU,EAAE,QAAQ;IACpB,YAAY,EAAE,QAAQ;IACtB,iBAAiB,EAAE,QAAQ;IAC3B,aAAa,EAAE,QAAQ;CACxB,CAAC;AAEF,MAAM,KAAK,GAA2B,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;AAEvF,iHAAiH;AACjH,MAAM,UAAU,aAAa,CAAC,KAA0C;IACtE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAG,0CAA0C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC;IAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,uFAAuF,CACtJ,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED,uGAAuG;AACvG,SAAS,oBAAoB,CAAC,SAA6C;IACzE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,EAAE,KAAK,EAAsB;IACrF,OAAO;QACL,KAAK;QACL,eAAe,EAAE,MAAM,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe;QACxE,UAAU,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC;QACjD,UAAU,EAAE,MAAM,CAAC,GAAG,IAAI,KAAK;QAC/B,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC;QACzD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;QACvC,cAAc,EAAE,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;aAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,eAAe,CAAC;QACvB,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,eAAe,CAAC,YAAY;QACjF,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;QACjC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;AACJ,CAAC","sourcesContent":["import type { RSHonoConfig } from '../config.js';\n\n/**\n * The framework settings the server bundle needs at request time, fully resolved\n * (defaults applied, `bodySizeLimit` parsed to bytes, origins normalized to hosts).\n *\n * The value is produced once by {@link resolveServerConfig} from `rshono.config.ts`\n * and compiled into the server bundle as the `__RSHONO_CONFIG__` literal (see\n * `builder/rspack-config.ts`) — there is no runtime env-var interface for these.\n */\nexport interface ServerConfig {\n  /**\n   * `true` when the bundle came from `rshono dev`.\n   *\n   * Baked in rather than read from `process.env.NODE_ENV` at runtime: it is decided by which command\n   * produced the bundle, and a deploy target need not have a `process` to read it from.\n   */\n  isDev: boolean;\n  /** Deadline in ms for a single request (server action + flight + SSR). */\n  renderTimeoutMs: number;\n  /** Honour `X-Forwarded-Host` / `-Proto` when resolving the browser-facing URL. Forced on in dev. */\n  trustProxy: boolean;\n  /** Send a strict per-request-nonce Content-Security-Policy with every HTML document. */\n  cspEnabled: boolean;\n  /** The resolved CSP directives (built-in defaults with the user's merged over them), minus the nonce. */\n  cspDirectives: Record<string, string>;\n  /** CSRF origin check on server-action POSTs. */\n  checkOrigin: boolean;\n  /** Extra origins allowed to post server actions, normalized to lowercase `URL.host` values. */\n  allowedOrigins: string[];\n  /** Max request body in bytes before a 413; `0` disables the cap. */\n  maxBodyBytes: number;\n  /** Gzip compressible responses on the way out. */\n  compress: boolean;\n  /** Default listen port for `start` (overridden by `PORT`). */\n  port?: number;\n  /** Default bind address for `start` (overridden by `HOST`). */\n  host?: string;\n}\n\n/**\n * The single source of truth for the framework's built-in defaults.\n *\n * `renderTimeoutMs` and `maxBodyBytes` are resolved here, into the bundle. `port` and `host` are not:\n * they stay env-overridable at runtime, so the default is applied where the address is resolved\n * (`deploy/listen.ts` for a server bundle, `cli/dev.ts` for the dev server) and this is what both read.\n */\nexport const SERVER_DEFAULTS = {\n  renderTimeoutMs: 10_000,\n  maxBodyBytes: 1024 * 1024, // 1 MiB, matching Next.js's server-action body-size limit.\n  port: 3000,\n  host: '0.0.0.0',\n} as const;\n\n/**\n * The built-in {@link RSHonoConfig.csp} policy, keyed by directive so\n * {@link RSHonoConfig.cspDirectives} can override entries individually.\n *\n * `script-src` carries the per-request nonce, appended at request time (see `entry.rsc.tsx`).\n * `style-src` needs `'unsafe-inline'` because React writes inline styles.\n */\nexport const CSP_DEFAULTS: Record<string, string> = {\n  'default-src': \"'self'\",\n  'script-src': \"'self'\",\n  'style-src': \"'self' 'unsafe-inline'\",\n  'img-src': \"'self' data:\",\n  'connect-src': \"'self'\",\n  // Not covered by default-src, and each closes an injection route of its own: a stray <base>\n  // retargeting every relative URL, plugin content, framing (clickjacking), off-site form posts.\n  'base-uri': \"'self'\",\n  'object-src': \"'none'\",\n  'frame-ancestors': \"'none'\",\n  'form-action': \"'self'\",\n};\n\nconst UNITS: Record<string, number> = { b: 1, kb: 1024, mb: 1024 ** 2, gb: 1024 ** 3 };\n\n/** Parse a {@link RSHonoConfig.bodySizeLimit} value into a byte count (`false`/`0` → `0`, disabling the cap). */\nexport function parseByteSize(value: string | number | false | undefined): number | undefined {\n  if (value === undefined) return undefined;\n  if (value === false) return 0;\n  if (typeof value === 'number') return value;\n  const match = /^\\s*(\\d+(?:\\.\\d+)?)\\s*(b|kb|mb|gb)?\\s*$/i.exec(value);\n  if (!match) {\n    throw new Error(`[rshono] invalid bodySizeLimit ${JSON.stringify(value)} — use e.g. '1mb', 1048576, or false.`);\n  }\n  return Math.floor(Number(match[1]) * UNITS[(match[2] ?? 'b').toLowerCase()]);\n}\n\n/**\n * Normalize a config `allowedOrigins` entry (full origin or bare host) to a lowercase `URL.host`,\n * ready for a direct comparison against a parsed `Origin` header's host.\n *\n * A bare `host:port` has to be retried against a base, because on its own `'localhost:4000'`\n * parses as the *scheme* `localhost:` with path `4000` — leaving an empty host that would\n * silently never match anything. Throws rather than passing a junk entry through, so a typo\n * fails the build instead of quietly disabling the allowlist entry it was meant to add.\n */\nfunction normalizeOrigin(entry: string): string {\n  const host = URL.parse(entry)?.host || URL.parse(`http://${entry}`)?.host;\n  if (!host) {\n    throw new Error(\n      `[rshono] invalid allowedOrigins entry ${JSON.stringify(entry)} — use a full origin ('https://admin.example.com') or a bare host ('localhost:4000').`,\n    );\n  }\n  return host.toLowerCase();\n}\n\n/** Drop directives the user blanked out, so `cspDirectives: { 'frame-ancestors': '' }` removes one. */\nfunction resolveCspDirectives(overrides: Record<string, string> | undefined): Record<string, string> {\n  return Object.fromEntries(Object.entries({ ...CSP_DEFAULTS, ...overrides }).filter(([, value]) => value.trim() !== ''));\n}\n\n/**\n * Resolve the user's {@link RSHonoConfig} into the {@link ServerConfig} baked into the bundle.\n *\n * `isDev` is a build-time input rather than a config field because it decides one thing the user\n * shouldn't have to: `trustProxy` is forced on under `rshono dev`, where the framework's own proxy\n * is the only way in (it sets the forwarded headers itself and binds to localhost).\n */\nexport function resolveServerConfig(config: RSHonoConfig, { isDev }: { isDev: boolean }): ServerConfig {\n  return {\n    isDev,\n    renderTimeoutMs: config.renderTimeout ?? SERVER_DEFAULTS.renderTimeoutMs,\n    trustProxy: isDev || (config.trustProxy ?? false),\n    cspEnabled: config.csp ?? false,\n    cspDirectives: resolveCspDirectives(config.cspDirectives),\n    checkOrigin: config.checkOrigin ?? true,\n    allowedOrigins: (config.allowedOrigins ?? [])\n      .map((entry) => entry.trim())\n      .filter(Boolean)\n      .map(normalizeOrigin),\n    maxBodyBytes: parseByteSize(config.bodySizeLimit) ?? SERVER_DEFAULTS.maxBodyBytes,\n    compress: config.compress ?? true,\n    port: config.port,\n    host: config.host,\n  };\n}\n"]}

package/dist/server/shutdown.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Registers `handler` for both `SIGINT` and `SIGTERM` — the two signals a process
+ * manager or `Ctrl-C` uses to ask for a graceful stop. Consolidates the shutdown
+ * wiring shared by the server bundle and the `start` launcher.
+ */
+export declare function onShutdown(handler: (signal: NodeJS.Signals) => void): void;
+//# sourceMappingURL=shutdown.d.ts.map

package/dist/server/shutdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shutdown.d.ts","sourceRoot":"","sources":["../../src/server/shutdown.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,GAAG,IAAI,CAI1E"}

package/dist/server/shutdown.js

@@ -0,0 +1,11 @@
+/**
+ * Registers `handler` for both `SIGINT` and `SIGTERM` — the two signals a process
+ * manager or `Ctrl-C` uses to ask for a graceful stop. Consolidates the shutdown
+ * wiring shared by the server bundle and the `start` launcher.
+ */
+export function onShutdown(handler) {
+    for (const signal of ['SIGINT', 'SIGTERM']) {
+        process.on(signal, () => handler(signal));
+    }
+}
+//# sourceMappingURL=shutdown.js.map

package/dist/server/shutdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shutdown.js","sourceRoot":"","sources":["../../src/server/shutdown.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAyC;IAClE,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;QACpD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC","sourcesContent":["/**\n * Registers `handler` for both `SIGINT` and `SIGTERM` — the two signals a process\n * manager or `Ctrl-C` uses to ask for a graceful stop. Consolidates the shutdown\n * wiring shared by the server bundle and the `start` launcher.\n */\nexport function onShutdown(handler: (signal: NodeJS.Signals) => void): void {\n  for (const signal of ['SIGINT', 'SIGTERM'] as const) {\n    process.on(signal, () => handler(signal));\n  }\n}\n"]}

package/dist/server/ssg.d.ts

@@ -0,0 +1,25 @@
+import { type Route } from '../router.js';
+import { type PrerenderedPage, type PrerenderVariant } from './prerendered.js';
+/**
+ * Resolve {@link RSHonoConfig.siteUrl} to the origin prerendering should render against.
+ *
+ * A path is rejected rather than dropped: `'https://example.com/docs'` almost certainly means the
+ * author expects a base path, and silently serving from the root would be a confusing way to find
+ * out that isn't supported.
+ */
+export declare function resolveSiteOrigin(siteUrl: string | undefined): string;
+export declare function readPrerendered(ssgDir: string, requestPath: string, variant?: PrerenderVariant): Promise<PrerenderedPage | null>;
+interface PrerenderOptions {
+    routes: readonly Route[];
+    fetch: (request: Request) => Response | Promise<Response>;
+    ssgDir: string;
+    /** {@link RSHonoConfig.siteUrl} — the origin absolute URLs in the output are built against. */
+    siteUrl?: string;
+}
+export interface PrerenderResult {
+    written: string[];
+    skipped: string[];
+}
+export declare function prerenderStaticRoutes(options: PrerenderOptions): Promise<PrerenderResult>;
+export {};
+//# sourceMappingURL=ssg.d.ts.map

package/dist/server/ssg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssg.d.ts","sourceRoot":"","sources":["../../src/server/ssg.ts"],"names":[],"mappings":"AAIA,OAAO,EAA+B,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAA6C,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAS1H;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAUrE;AAoCD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAyB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAgC9I;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IACzB,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAcD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA2D/F"}

package/dist/server/ssg.js

@@ -0,0 +1,160 @@
+import { createHash } from 'node:crypto';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { dirname, join, resolve, sep } from 'node:path';
+import { isPageRoute } from '../router.js';
+import { prerenderedRelPath, ssgFilePath, VARIANTS } from './prerendered.js';
+/**
+ * Stand-in origin for a build that didn't declare {@link RSHonoConfig.siteUrl}. Deliberately
+ * obviously-wrong rather than a guess: a page that bakes this into a canonical tag should be easy
+ * to spot, and the build warns when static routes are prerendered without a real origin.
+ */
+const DEFAULT_SSG_ORIGIN = 'http://localhost';
+/**
+ * Resolve {@link RSHonoConfig.siteUrl} to the origin prerendering should render against.
+ *
+ * A path is rejected rather than dropped: `'https://example.com/docs'` almost certainly means the
+ * author expects a base path, and silently serving from the root would be a confusing way to find
+ * out that isn't supported.
+ */
+export function resolveSiteOrigin(siteUrl) {
+    if (!siteUrl)
+        return DEFAULT_SSG_ORIGIN;
+    const parsed = URL.parse(siteUrl);
+    if (!parsed || (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')) {
+        throw new Error(`[rshono] invalid siteUrl ${JSON.stringify(siteUrl)} — use a full origin, e.g. 'https://example.com'.`);
+    }
+    if (parsed.pathname !== '/' || parsed.search || parsed.hash) {
+        throw new Error(`[rshono] siteUrl ${JSON.stringify(siteUrl)} must be a bare origin — a base path is not supported.`);
+    }
+    return parsed.origin;
+}
+function interpolatePath(pattern, params) {
+    return pattern
+        .split('/')
+        .map((segment) => {
+        if (!segment.startsWith(':')) {
+            if (segment.includes('*')) {
+                throw new Error(`Cannot prerender "${pattern}": wildcard segments are not supported by staticPaths.`);
+            }
+            return segment;
+        }
+        const name = segment.slice(1);
+        if (!/^\w+$/.test(name)) {
+            throw new Error(`Cannot prerender "${pattern}": optional/regex params are not supported by staticPaths.`);
+        }
+        const value = params[name];
+        if (value === undefined) {
+            throw new Error(`staticPaths for "${pattern}" returned a param set without "${name}".`);
+        }
+        return encodeURIComponent(value);
+    })
+        .join('/');
+}
+/**
+ * Prerendered pages, keyed by the request that produced them (see {@link readPrerendered}).
+ *
+ * Bounded so a site with thousands of prerendered pages keeps a working set rather than the whole
+ * build in memory. Only *hits* are cached: caching misses would let anyone mint entries by
+ * requesting paths that don't exist. The files are written at build time and never change while
+ * the server is up, so an entry never needs invalidating.
+ */
+const pageCache = new Map();
+const MAX_CACHED_PAGES = 128;
+export async function readPrerendered(ssgDir, requestPath, variant = 'html') {
+    // Keyed by what the request carried, not by the resolved filename, so a hit costs one Map lookup
+    // instead of re-deriving the path every time. Safe because only *hits* are cached: an entry
+    // exists only if this exact key already passed the checks below.
+    const key = `${ssgDir}\0${variant}\0${requestPath}`;
+    const cached = pageCache.get(key);
+    if (cached)
+        return cached;
+    const relPath = prerenderedRelPath(requestPath, variant);
+    if (relPath === null)
+        return null;
+    // Belt and braces: the shared guard already refused a traversal, and this proves the resolved file
+    // is under the root whatever else the path contained.
+    const root = resolve(ssgDir);
+    const file = resolve(root, relPath);
+    if (!file.startsWith(root + sep))
+        return null;
+    let body;
+    try {
+        body = await readFile(file, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const page = {
+        body,
+        contentLength: String(Buffer.byteLength(body)),
+        etag: `W/"${createHash('sha256').update(body).digest('base64url').slice(0, 22)}"`,
+    };
+    pageCache.set(key, page);
+    // Insertion-ordered, so the first key is the oldest. One entry in means at most one out.
+    if (pageCache.size > MAX_CACHED_PAGES)
+        pageCache.delete(pageCache.keys().next().value);
+    return page;
+}
+/** Renders one representation of a path, or `null` if the app didn't answer with it. */
+async function renderVariant(fetch, url, variant) {
+    const response = await fetch(new Request(url, { headers: { Accept: VARIANTS[variant].accept } }));
+    if (response.status !== 200)
+        return { status: response.status };
+    if (!(response.headers.get('Content-Type') ?? '').includes(VARIANTS[variant].contentType))
+        return null;
+    return { body: await response.text() };
+}
+export async function prerenderStaticRoutes(options) {
+    const { routes, fetch, ssgDir } = options;
+    const staticRoutes = routes.filter((r) => isPageRoute(r) && r.render === 'static');
+    const origin = resolveSiteOrigin(options.siteUrl);
+    if (staticRoutes.length > 0 && !options.siteUrl) {
+        console.warn(`  ⚠ No siteUrl in rshono.config — prerendered pages are built against ${DEFAULT_SSG_ORIGIN}, so any absolute URL\n` +
+            `    they derive from a page's \`url\` prop (canonical tags, og:url, absolute links) will point there.`);
+    }
+    const written = [];
+    const skipped = [];
+    for (const route of staticRoutes) {
+        let paths;
+        if (!/[:*]/.test(route.path)) {
+            paths = [route.path];
+        }
+        else {
+            if (!route.staticPaths) {
+                console.warn(`  ⚠ Static route "${route.path}" has params but no staticPaths — will SSR per request.`);
+                skipped.push(route.path);
+                continue;
+            }
+            paths = (await route.staticPaths()).map((params) => interpolatePath(route.path, params));
+        }
+        for (const path of paths) {
+            const document = await renderVariant(fetch, origin + path, 'html');
+            if (document === null || !('body' in document)) {
+                const rendered = document === null ? 'a non-HTML response' : `${document.status}`;
+                console.warn(`  ⚠ "${path}" rendered ${rendered} at build time — skipping, will SSR per request.`);
+                skipped.push(path);
+                continue;
+            }
+            const write = (variant, body) => {
+                const file = join(ssgDir, ssgFilePath(path, variant));
+                mkdirSync(dirname(file), { recursive: true });
+                writeFileSync(file, body);
+            };
+            write('html', document.body);
+            // The soft-navigation representation of the same page. Best-effort: if it doesn't come back
+            // cleanly the document is still valid on its own, and serving falls back to rendering flight
+            // per request — the behaviour before this was written at all.
+            const flight = await renderVariant(fetch, origin + path, 'flight');
+            if (flight !== null && 'body' in flight) {
+                write('flight', flight.body);
+            }
+            else {
+                console.warn(`  ⚠ "${path}" produced no flight payload — soft navigations to it will render per request.`);
+            }
+            written.push(path);
+        }
+    }
+    return { written, skipped };
+}
+//# sourceMappingURL=ssg.js.map

package/dist/server/ssg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssg.js","sourceRoot":"","sources":["../../src/server/ssg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,WAAW,EAA8B,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAA+C,MAAM,kBAAkB,CAAC;AAE1H;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,IAAI,CAAC,OAAO;QAAE,OAAO,kBAAkB,CAAC;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,MAA8B;IACtE,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,wDAAwD,CAAC,CAAC;YACxG,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,4DAA4D,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,mCAAmC,IAAI,IAAI,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;AACrD,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,WAAmB,EAAE,OAAO,GAAqB,MAAM;IAC3G,iGAAiG;IACjG,4FAA4F;IAC5F,iEAAiE;IACjE,MAAM,GAAG,GAAG,GAAG,MAAM,KAAK,OAAO,KAAK,WAAW,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,OAAO,GAAG,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,mGAAmG;IACnG,sDAAsD;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAoB;QAC5B,IAAI;QACJ,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,EAAE,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;KAClF,CAAC;IACF,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,yFAAyF;IACzF,IAAI,SAAS,CAAC,IAAI,GAAG,gBAAgB;QAAE,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAeD,wFAAwF;AACxF,KAAK,UAAU,aAAa,CAC1B,KAAgC,EAChC,GAAW,EACX,OAAyB;IAEzB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAClG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAChE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACvG,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAyB;IACnE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAkB,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CACV,yEAAyE,kBAAkB,yBAAyB;YAClH,uGAAuG,CAC1G,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,IAAI,yDAAyD,CAAC,CAAC;gBACvG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3F,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;YACnE,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,EAAE,CAAC;gBAC/C,MAAM,QAAQ,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAClF,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,cAAc,QAAQ,kDAAkD,CAAC,CAAC;gBACnG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,CAAC,OAAyB,EAAE,IAAY,EAAE,EAAE;gBACxD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,CAAE,CAAC,CAAC;gBACvD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5B,CAAC,CAAC;YACF,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YAE7B,4FAA4F;YAC5F,6FAA6F;YAC7F,8DAA8D;YAC9D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,CAAC,CAAC;YACnE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;gBACxC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,gFAAgF,CAAC,CAAC;YAC7G,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC","sourcesContent":["import { createHash } from 'node:crypto';\nimport { mkdirSync, writeFileSync } from 'node:fs';\nimport { readFile } from 'node:fs/promises';\nimport { dirname, join, resolve, sep } from 'node:path';\nimport { isPageRoute, type PageRoute, type Route } from '../router.js';\nimport { prerenderedRelPath, ssgFilePath, VARIANTS, type PrerenderedPage, type PrerenderVariant } from './prerendered.js';\n\n/**\n * Stand-in origin for a build that didn't declare {@link RSHonoConfig.siteUrl}. Deliberately\n * obviously-wrong rather than a guess: a page that bakes this into a canonical tag should be easy\n * to spot, and the build warns when static routes are prerendered without a real origin.\n */\nconst DEFAULT_SSG_ORIGIN = 'http://localhost';\n\n/**\n * Resolve {@link RSHonoConfig.siteUrl} to the origin prerendering should render against.\n *\n * A path is rejected rather than dropped: `'https://example.com/docs'` almost certainly means the\n * author expects a base path, and silently serving from the root would be a confusing way to find\n * out that isn't supported.\n */\nexport function resolveSiteOrigin(siteUrl: string | undefined): string {\n  if (!siteUrl) return DEFAULT_SSG_ORIGIN;\n  const parsed = URL.parse(siteUrl);\n  if (!parsed || (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')) {\n    throw new Error(`[rshono] invalid siteUrl ${JSON.stringify(siteUrl)} — use a full origin, e.g. 'https://example.com'.`);\n  }\n  if (parsed.pathname !== '/' || parsed.search || parsed.hash) {\n    throw new Error(`[rshono] siteUrl ${JSON.stringify(siteUrl)} must be a bare origin — a base path is not supported.`);\n  }\n  return parsed.origin;\n}\n\nfunction interpolatePath(pattern: string, params: Record<string, string>): string {\n  return pattern\n    .split('/')\n    .map((segment) => {\n      if (!segment.startsWith(':')) {\n        if (segment.includes('*')) {\n          throw new Error(`Cannot prerender \"${pattern}\": wildcard segments are not supported by staticPaths.`);\n        }\n        return segment;\n      }\n      const name = segment.slice(1);\n      if (!/^\\w+$/.test(name)) {\n        throw new Error(`Cannot prerender \"${pattern}\": optional/regex params are not supported by staticPaths.`);\n      }\n      const value = params[name];\n      if (value === undefined) {\n        throw new Error(`staticPaths for \"${pattern}\" returned a param set without \"${name}\".`);\n      }\n      return encodeURIComponent(value);\n    })\n    .join('/');\n}\n\n/**\n * Prerendered pages, keyed by the request that produced them (see {@link readPrerendered}).\n *\n * Bounded so a site with thousands of prerendered pages keeps a working set rather than the whole\n * build in memory. Only *hits* are cached: caching misses would let anyone mint entries by\n * requesting paths that don't exist. The files are written at build time and never change while\n * the server is up, so an entry never needs invalidating.\n */\nconst pageCache = new Map<string, PrerenderedPage>();\nconst MAX_CACHED_PAGES = 128;\n\nexport async function readPrerendered(ssgDir: string, requestPath: string, variant: PrerenderVariant = 'html'): Promise<PrerenderedPage | null> {\n  // Keyed by what the request carried, not by the resolved filename, so a hit costs one Map lookup\n  // instead of re-deriving the path every time. Safe because only *hits* are cached: an entry\n  // exists only if this exact key already passed the checks below.\n  const key = `${ssgDir}\\0${variant}\\0${requestPath}`;\n  const cached = pageCache.get(key);\n  if (cached) return cached;\n\n  const relPath = prerenderedRelPath(requestPath, variant);\n  if (relPath === null) return null;\n  // Belt and braces: the shared guard already refused a traversal, and this proves the resolved file\n  // is under the root whatever else the path contained.\n  const root = resolve(ssgDir);\n  const file = resolve(root, relPath);\n  if (!file.startsWith(root + sep)) return null;\n\n  let body: string;\n  try {\n    body = await readFile(file, 'utf8');\n  } catch {\n    return null;\n  }\n\n  const page: PrerenderedPage = {\n    body,\n    contentLength: String(Buffer.byteLength(body)),\n    etag: `W/\"${createHash('sha256').update(body).digest('base64url').slice(0, 22)}\"`,\n  };\n  pageCache.set(key, page);\n  // Insertion-ordered, so the first key is the oldest. One entry in means at most one out.\n  if (pageCache.size > MAX_CACHED_PAGES) pageCache.delete(pageCache.keys().next().value!);\n  return page;\n}\n\ninterface PrerenderOptions {\n  routes: readonly Route[];\n  fetch: (request: Request) => Response | Promise<Response>;\n  ssgDir: string;\n  /** {@link RSHonoConfig.siteUrl} — the origin absolute URLs in the output are built against. */\n  siteUrl?: string;\n}\n\nexport interface PrerenderResult {\n  written: string[];\n  skipped: string[];\n}\n\n/** Renders one representation of a path, or `null` if the app didn't answer with it. */\nasync function renderVariant(\n  fetch: PrerenderOptions['fetch'],\n  url: string,\n  variant: PrerenderVariant,\n): Promise<{ body: string } | { status: number } | null> {\n  const response = await fetch(new Request(url, { headers: { Accept: VARIANTS[variant].accept } }));\n  if (response.status !== 200) return { status: response.status };\n  if (!(response.headers.get('Content-Type') ?? '').includes(VARIANTS[variant].contentType)) return null;\n  return { body: await response.text() };\n}\n\nexport async function prerenderStaticRoutes(options: PrerenderOptions): Promise<PrerenderResult> {\n  const { routes, fetch, ssgDir } = options;\n  const staticRoutes = routes.filter((r): r is PageRoute => isPageRoute(r) && r.render === 'static');\n  const origin = resolveSiteOrigin(options.siteUrl);\n\n  if (staticRoutes.length > 0 && !options.siteUrl) {\n    console.warn(\n      `  ⚠ No siteUrl in rshono.config — prerendered pages are built against ${DEFAULT_SSG_ORIGIN}, so any absolute URL\\n` +\n        `    they derive from a page's \\`url\\` prop (canonical tags, og:url, absolute links) will point there.`,\n    );\n  }\n\n  const written: string[] = [];\n  const skipped: string[] = [];\n\n  for (const route of staticRoutes) {\n    let paths: string[];\n    if (!/[:*]/.test(route.path)) {\n      paths = [route.path];\n    } else {\n      if (!route.staticPaths) {\n        console.warn(`  ⚠ Static route \"${route.path}\" has params but no staticPaths — will SSR per request.`);\n        skipped.push(route.path);\n        continue;\n      }\n      paths = (await route.staticPaths()).map((params) => interpolatePath(route.path, params));\n    }\n\n    for (const path of paths) {\n      const document = await renderVariant(fetch, origin + path, 'html');\n      if (document === null || !('body' in document)) {\n        const rendered = document === null ? 'a non-HTML response' : `${document.status}`;\n        console.warn(`  ⚠ \"${path}\" rendered ${rendered} at build time — skipping, will SSR per request.`);\n        skipped.push(path);\n        continue;\n      }\n\n      const write = (variant: PrerenderVariant, body: string) => {\n        const file = join(ssgDir, ssgFilePath(path, variant)!);\n        mkdirSync(dirname(file), { recursive: true });\n        writeFileSync(file, body);\n      };\n      write('html', document.body);\n\n      // The soft-navigation representation of the same page. Best-effort: if it doesn't come back\n      // cleanly the document is still valid on its own, and serving falls back to rendering flight\n      // per request — the behaviour before this was written at all.\n      const flight = await renderVariant(fetch, origin + path, 'flight');\n      if (flight !== null && 'body' in flight) {\n        write('flight', flight.body);\n      } else {\n        console.warn(`  ⚠ \"${path}\" produced no flight payload — soft navigations to it will render per request.`);\n      }\n\n      written.push(path);\n    }\n  }\n\n  return { written, skipped };\n}\n"]}

package/dist/server/static.d.ts

@@ -0,0 +1,14 @@
+import type { MiddlewareHandler } from 'hono';
+import { Hono } from 'hono';
+interface StaticOptions {
+    /** Directory the files are read from. */
+    root: string;
+    /** Dev serves revalidated (`no-cache`); a build serves hashed files as immutable. */
+    isDev: boolean;
+}
+/** A sub-app serving the hashed client bundle, to be mounted at `/_static`. */
+export declare function createStaticAssetsApp(options: StaticOptions): Hono;
+/** Middleware serving the app's `public/` files verbatim at the web root, for paths no route claimed. */
+export declare function createPublicFallback({ root, isDev }: StaticOptions): MiddlewareHandler;
+export {};
+//# sourceMappingURL=static.d.ts.map

package/dist/server/static.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.d.ts","sourceRoot":"","sources":["../../src/server/static.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAe5B,UAAU,aAAa;IACrB,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CASlE;AAED,yGAAyG;AACzG,wBAAgB,oBAAoB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,aAAa,GAAG,iBAAiB,CAStF"}

package/dist/server/static.js

@@ -0,0 +1,30 @@
+import { serveStatic } from '@hono/node-server/serve-static';
+import { Hono } from 'hono';
+const CONTENT_HASHED = /\.[0-9a-f]{8,}\./;
+function cacheControl(isDev) {
+    return async (c, next) => {
+        await next();
+        if (c.res.status !== 200 && c.res.status !== 206)
+            return;
+        c.res.headers.set('Cache-Control', isDev ? 'no-cache' : CONTENT_HASHED.test(c.req.path) ? 'public, max-age=31536000, immutable' : 'public, max-age=300');
+    };
+}
+/** A sub-app serving the hashed client bundle, to be mounted at `/_static`. */
+export function createStaticAssetsApp(options) {
+    const { root, isDev } = options;
+    const app = new Hono();
+    app.on(['GET', 'HEAD'], '/*', cacheControl(isDev), serveStatic({ root, rewriteRequestPath: (path) => path.replace(/^\/_static/, '') }), (c) => c.text('Not Found', 404));
+    return app;
+}
+/** Middleware serving the app's `public/` files verbatim at the web root, for paths no route claimed. */
+export function createPublicFallback({ root, isDev }) {
+    const serve = serveStatic({ root });
+    return async (c, next) => {
+        const result = await serve(c, next);
+        if (result instanceof Response && (result.status === 200 || result.status === 206)) {
+            result.headers.set('Cache-Control', isDev ? 'no-cache' : 'public, max-age=300');
+        }
+        return result;
+    };
+}
+//# sourceMappingURL=static.js.map

package/dist/server/static.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.js","sourceRoot":"","sources":["../../src/server/static.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAE7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAE1C,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO;QACzD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CACf,eAAe,EACf,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,qBAAqB,CACrH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AASD,+EAA+E;AAC/E,MAAM,UAAU,qBAAqB,CAAC,OAAsB;IAC1D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAC5I,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CACzB,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,oBAAoB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAiB;IACjE,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,YAAY,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { serveStatic } from '@hono/node-server/serve-static';\nimport type { MiddlewareHandler } from 'hono';\nimport { Hono } from 'hono';\n\nconst CONTENT_HASHED = /\\.[0-9a-f]{8,}\\./;\n\nfunction cacheControl(isDev: boolean): MiddlewareHandler {\n  return async (c, next) => {\n    await next();\n    if (c.res.status !== 200 && c.res.status !== 206) return;\n    c.res.headers.set(\n      'Cache-Control',\n      isDev ? 'no-cache' : CONTENT_HASHED.test(c.req.path) ? 'public, max-age=31536000, immutable' : 'public, max-age=300',\n    );\n  };\n}\n\ninterface StaticOptions {\n  /** Directory the files are read from. */\n  root: string;\n  /** Dev serves revalidated (`no-cache`); a build serves hashed files as immutable. */\n  isDev: boolean;\n}\n\n/** A sub-app serving the hashed client bundle, to be mounted at `/_static`. */\nexport function createStaticAssetsApp(options: StaticOptions): Hono {\n  const { root, isDev } = options;\n  const app = new Hono();\n\n  app.on(['GET', 'HEAD'], '/*', cacheControl(isDev), serveStatic({ root, rewriteRequestPath: (path) => path.replace(/^\\/_static/, '') }), (c) =>\n    c.text('Not Found', 404),\n  );\n\n  return app;\n}\n\n/** Middleware serving the app's `public/` files verbatim at the web root, for paths no route claimed. */\nexport function createPublicFallback({ root, isDev }: StaticOptions): MiddlewareHandler {\n  const serve = serveStatic({ root });\n  return async (c, next) => {\n    const result = await serve(c, next);\n    if (result instanceof Response && (result.status === 200 || result.status === 206)) {\n      result.headers.set('Cache-Control', isDev ? 'no-cache' : 'public, max-age=300');\n    }\n    return result;\n  };\n}\n"]}

package/package.json

@@ -0,0 +1,86 @@
+{
+  "name": "@rshono/core",
+  "version": "1.0.0-rc.0",
+  "description": "Minimalist web framework — Hono + Rspack + React Server Components",
+  "author": "Lasse <lasse@lassetange.com> (https://www.lassetange.com)",
+  "license": "ISC",
+  "keywords": [
+    "react",
+    "react-server-components",
+    "rsc",
+    "hono",
+    "rspack",
+    "framework"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rshono/rshono.git",
+    "directory": "packages/core"
+  },
+  "bugs": {
+    "url": "https://github.com/rshono/rshono/issues"
+  },
+  "homepage": "https://github.com/rshono/rshono",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/runtime/server.d.ts",
+      "import": "./dist/runtime/server.js"
+    },
+    "./client": {
+      "types": "./dist/runtime/client.d.ts",
+      "import": "./dist/runtime/client.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "rshono": "./bin/rshono.mjs"
+  },
+  "files": [
+    "dist",
+    "bin"
+  ],
+  "engines": {
+    "node": ">=22.1.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && node scripts/copy-dist-assets.mjs",
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "dev": "tsc -p tsconfig.build.json --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "npm run build && node --test --test-concurrency=1 \"test/*.test.mjs\"",
+    "test:browser": "npm run build && playwright test",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "@hono/node-server": "^2.0.11",
+    "@rspack/core": "2.1.5",
+    "@rspack/plugin-react-refresh": "2.0.2",
+    "react-refresh": "0.18.0",
+    "react-server-dom-rspack": "0.0.2",
+    "rsc-html-stream": "^0.0.7",
+    "tsx": "^4.23.1"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.58.0",
+    "@types/node": "^26.1.1",
+    "@types/react": "^19.2.17",
+    "@types/react-dom": "^19.2.3",
+    "hono": "^4.12.31",
+    "react": "19.2.8",
+    "react-dom": "19.2.8",
+    "typescript": "^7.0.2"
+  },
+  "peerDependencies": {
+    "hono": "^4.8.0",
+    "react": "^19.1.0",
+    "react-dom": "^19.1.0"
+  }
+}