@rshono/core 1.0.0-rc.0

package/dist/cli/index.js

@@ -0,0 +1,77 @@
+import { createRequire } from 'node:module';
+import { parseArgs } from 'node:util';
+import { DEPLOY_TARGETS, resolveDeployPreset } from '../deploy/presets.js';
+import { loadConfig } from '../server/load-config.js';
+import { loadEnvFiles } from '../server/load-env.js';
+import { buildCommand } from './build.js';
+import { devCommand } from './dev.js';
+import { startCommand } from './start.js';
+const HELP = `rshono — Hono + Rspack + React Server Components
+
+Usage:
+  rshono dev     [--port 3000]   start the dev server
+  rshono build                   build for production (client + server + SSG)
+  rshono start   [--port 3000]   run the production build
+
+Options:
+  -p, --port <n>      port to listen on (default: PORT env or rshono.config.ts or 3000)
+  -c, --config <path> path to a config file (default: rshono.config.{ts,js,mjs})
+  -d, --deploy <name> platform to build for: ${DEPLOY_TARGETS.join(' | ')} (default: node)
+  -h, --help          show this help
+  -v, --version       print the version
+`;
+async function main() {
+    const { values, positionals } = parseArgs({
+        options: {
+            port: { type: 'string', short: 'p' },
+            config: { type: 'string', short: 'c' },
+            deploy: { type: 'string', short: 'd' },
+            help: { type: 'boolean', short: 'h' },
+            version: { type: 'boolean', short: 'v' },
+        },
+        allowPositionals: true,
+    });
+    if (values.version) {
+        const require = createRequire(import.meta.url);
+        console.log(require('@rshono/core/package.json').version);
+        return;
+    }
+    const command = positionals[0];
+    if (values.help || !command) {
+        console.log(HELP);
+        return;
+    }
+    const rootDir = process.cwd();
+    loadEnvFiles(rootDir);
+    const config = await loadConfig(rootDir, values.config);
+    const flagPort = values.port ? Number(values.port) : undefined;
+    if (values.port && Number.isNaN(flagPort)) {
+        console.error(`rshono: invalid --port "${values.port}"`);
+        process.exit(1);
+    }
+    // Precedence: --port flag > PORT env > rshono.config.ts > the command's built-in default.
+    const envPort = process.env.PORT ? Number(process.env.PORT) : undefined;
+    const port = flagPort ?? envPort ?? config.port;
+    const host = process.env.HOST ?? config.host;
+    switch (command) {
+        case 'dev':
+            return devCommand({ rootDir, port, config });
+        case 'build':
+            return buildCommand({
+                rootDir,
+                config,
+                preset: resolveDeployPreset({ flag: values.deploy, env: process.env.RSHONO_DEPLOY, config: config.deploy }),
+            });
+        case 'start':
+            return startCommand({ rootDir, port, host });
+        default:
+            console.error(`rshono: unknown command "${command}"\n`);
+            console.log(HELP);
+            process.exit(1);
+    }
+}
+main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,IAAI,GAAG;;;;;;;;;;+CAUkC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;;;CAGxE,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACxC,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACpC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACtC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACtC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACzC;QACD,gBAAgB,EAAE,IAAI;KACvB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9B,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,KAAK,CAAC,2BAA2B,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,0FAA0F;IAC1F,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,MAAM,IAAI,GAAG,QAAQ,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;IAE7C,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,KAAK;YACR,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/C,KAAK,OAAO;YACV,OAAO,YAAY,CAAC;gBAClB,OAAO;gBACP,MAAM;gBACN,MAAM,EAAE,mBAAmB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aAC5G,CAAC,CAAC;QACL,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C;YACE,OAAO,CAAC,KAAK,CAAC,4BAA4B,OAAO,KAAK,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC","sourcesContent":["import { createRequire } from 'node:module';\nimport { parseArgs } from 'node:util';\nimport { DEPLOY_TARGETS, resolveDeployPreset } from '../deploy/presets.js';\nimport { loadConfig } from '../server/load-config.js';\nimport { loadEnvFiles } from '../server/load-env.js';\nimport { buildCommand } from './build.js';\nimport { devCommand } from './dev.js';\nimport { startCommand } from './start.js';\n\nconst HELP = `rshono — Hono + Rspack + React Server Components\n\nUsage:\n  rshono dev     [--port 3000]   start the dev server\n  rshono build                   build for production (client + server + SSG)\n  rshono start   [--port 3000]   run the production build\n\nOptions:\n  -p, --port <n>      port to listen on (default: PORT env or rshono.config.ts or 3000)\n  -c, --config <path> path to a config file (default: rshono.config.{ts,js,mjs})\n  -d, --deploy <name> platform to build for: ${DEPLOY_TARGETS.join(' | ')} (default: node)\n  -h, --help          show this help\n  -v, --version       print the version\n`;\n\nasync function main(): Promise<void> {\n  const { values, positionals } = parseArgs({\n    options: {\n      port: { type: 'string', short: 'p' },\n      config: { type: 'string', short: 'c' },\n      deploy: { type: 'string', short: 'd' },\n      help: { type: 'boolean', short: 'h' },\n      version: { type: 'boolean', short: 'v' },\n    },\n    allowPositionals: true,\n  });\n\n  if (values.version) {\n    const require = createRequire(import.meta.url);\n    console.log(require('@rshono/core/package.json').version);\n    return;\n  }\n\n  const command = positionals[0];\n  if (values.help || !command) {\n    console.log(HELP);\n    return;\n  }\n\n  const rootDir = process.cwd();\n  loadEnvFiles(rootDir);\n  const config = await loadConfig(rootDir, values.config);\n\n  const flagPort = values.port ? Number(values.port) : undefined;\n  if (values.port && Number.isNaN(flagPort)) {\n    console.error(`rshono: invalid --port \"${values.port}\"`);\n    process.exit(1);\n  }\n  // Precedence: --port flag > PORT env > rshono.config.ts > the command's built-in default.\n  const envPort = process.env.PORT ? Number(process.env.PORT) : undefined;\n  const port = flagPort ?? envPort ?? config.port;\n  const host = process.env.HOST ?? config.host;\n\n  switch (command) {\n    case 'dev':\n      return devCommand({ rootDir, port, config });\n    case 'build':\n      return buildCommand({\n        rootDir,\n        config,\n        preset: resolveDeployPreset({ flag: values.deploy, env: process.env.RSHONO_DEPLOY, config: config.deploy }),\n      });\n    case 'start':\n      return startCommand({ rootDir, port, host });\n    default:\n      console.error(`rshono: unknown command \"${command}\"\\n`);\n      console.log(HELP);\n      process.exit(1);\n  }\n}\n\nmain().catch((error) => {\n  console.error(error);\n  process.exit(1);\n});\n"]}

package/dist/cli/start.d.ts

@@ -0,0 +1,8 @@
+interface StartOptions {
+    rootDir: string;
+    port?: number;
+    host?: string;
+}
+export declare function startCommand(options: StartOptions): Promise<void>;
+export {};
+//# sourceMappingURL=start.d.ts.map

package/dist/cli/start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../src/cli/start.ts"],"names":[],"mappings":"AAOA,UAAU,YAAY;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAiCvE"}

package/dist/cli/start.js

@@ -0,0 +1,39 @@
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { readBuildMarker } from '../deploy/build-marker.js';
+import { deployHintFor } from '../deploy/presets.js';
+import { onShutdown } from '../server/shutdown.js';
+export async function startCommand(options) {
+    const { rootDir, port, host } = options;
+    const distDir = join(rootDir, 'dist');
+    const mainPath = join(distDir, 'server', 'main.mjs');
+    if (!existsSync(mainPath)) {
+        console.error('rshono: no production build found — run `rshono build` first.');
+        process.exit(1);
+    }
+    // A bundle built for a hosting platform has no listener in it — its entry hands a `fetch` handler to
+    // whatever is running it. Starting one here would exit silently the moment the module finished
+    // evaluating, so say what happened and point at the command that does deploy it.
+    const target = readBuildMarker(distDir);
+    if (target !== null && target !== 'node') {
+        const hint = deployHintFor(target);
+        console.error(`rshono: this build targets ${target}, which \`rshono start\` cannot run${hint ? ` — ${hint}` : '.'}`);
+        console.error('  Rebuild for a server with `rshono build --deploy node` to run it here.');
+        process.exit(1);
+    }
+    const env = { ...process.env };
+    if (port !== undefined)
+        env.PORT = String(port);
+    if (host !== undefined)
+        env.HOST = host;
+    const child = spawn(process.execPath, ['--enable-source-maps', mainPath], {
+        stdio: 'inherit',
+        env,
+    });
+    onShutdown((signal) => child.kill(signal));
+    child.on('exit', (code, signal) => {
+        process.exit(signal ? 1 : (code ?? 1));
+    });
+}
+//# sourceMappingURL=start.js.map

package/dist/cli/start.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start.js","sourceRoot":"","sources":["../../src/cli/start.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAQnD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqB;IACtD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,qGAAqG;IACrG,+FAA+F;IAC/F,iFAAiF;IACjF,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,8BAA8B,MAAM,sCAAsC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACrH,OAAO,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS;QAAE,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,IAAI,KAAK,SAAS;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAExC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,sBAAsB,EAAE,QAAQ,CAAC,EAAE;QACxE,KAAK,EAAE,SAAS;QAChB,GAAG;KACJ,CAAC,CAAC;IAEH,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { spawn } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { readBuildMarker } from '../deploy/build-marker.js';\nimport { deployHintFor } from '../deploy/presets.js';\nimport { onShutdown } from '../server/shutdown.js';\n\ninterface StartOptions {\n  rootDir: string;\n  port?: number;\n  host?: string;\n}\n\nexport async function startCommand(options: StartOptions): Promise<void> {\n  const { rootDir, port, host } = options;\n  const distDir = join(rootDir, 'dist');\n  const mainPath = join(distDir, 'server', 'main.mjs');\n  if (!existsSync(mainPath)) {\n    console.error('rshono: no production build found — run `rshono build` first.');\n    process.exit(1);\n  }\n\n  // A bundle built for a hosting platform has no listener in it — its entry hands a `fetch` handler to\n  // whatever is running it. Starting one here would exit silently the moment the module finished\n  // evaluating, so say what happened and point at the command that does deploy it.\n  const target = readBuildMarker(distDir);\n  if (target !== null && target !== 'node') {\n    const hint = deployHintFor(target);\n    console.error(`rshono: this build targets ${target}, which \\`rshono start\\` cannot run${hint ? ` — ${hint}` : '.'}`);\n    console.error('  Rebuild for a server with `rshono build --deploy node` to run it here.');\n    process.exit(1);\n  }\n\n  const env = { ...process.env };\n  if (port !== undefined) env.PORT = String(port);\n  if (host !== undefined) env.HOST = host;\n\n  const child = spawn(process.execPath, ['--enable-source-maps', mainPath], {\n    stdio: 'inherit',\n    env,\n  });\n\n  onShutdown((signal) => child.kill(signal));\n  child.on('exit', (code, signal) => {\n    process.exit(signal ? 1 : (code ?? 1));\n  });\n}\n"]}

package/dist/config.d.ts

@@ -0,0 +1,121 @@
+import type { RspackOptions } from '@rspack/core';
+import type { DeployTarget } from './deploy/contract.js';
+/** Which of the two Rspack compilers the {@link RSHonoConfig.rspack} hook is being called for. */
+export interface RspackHookContext {
+    /** `true` for the server (`target: node`) bundle, `false` for the client (`target: web`) bundle. */
+    isServer: boolean;
+    /** `true` under `rshono dev`, `false` under `rshono build`. */
+    isDev: boolean;
+}
+/**
+ * Project configuration for rshono, default-exported from `rshono.config.ts` at the project root
+ * (`.js` / `.mjs` also work). Every field is optional; omit the file entirely to accept all defaults.
+ *
+ * @example
+ * ```ts
+ * import { defineConfig } from '@rshono/core';
+ *
+ * export default defineConfig({
+ *   csp: true,
+ *   bodySizeLimit: '4mb',
+ *   allowedOrigins: ['https://admin.example.com'],
+ * });
+ * ```
+ */
+export interface RSHonoConfig {
+    /**
+     * The hosting platform `rshono build` targets. Default `'node'` — a long-lived server process, for
+     * a VPS, a container or anywhere else you run `rshono start`.
+     *
+     * Overridden by the `--deploy` flag or the `RSHONO_DEPLOY` env var, so one config can still be
+     * built for more than one place. `rshono dev` ignores it entirely and always runs the Node dev
+     * server.
+     */
+    deploy?: DeployTarget;
+    /**
+     * The public origin the site is served from, e.g. `'https://example.com'`.
+     *
+     * Only used when prerendering `render: 'static'` routes. A prerendered page is one fixed file
+     * handed to everyone, so any absolute URL inside it has to be decided at build time — there is no
+     * request to read a `Host` from. That is what a page's `url` prop is, so without this a static
+     * page bakes in `http://localhost` wherever it builds a canonical tag, an absolute link or an
+     * `og:url`. Dynamic routes are unaffected: they resolve the URL per request.
+     *
+     * The origin is what's used; a path is rejected rather than silently dropped.
+     */
+    siteUrl?: string;
+    /** Default port for `dev` / `start`. Overridden by the `--port` flag or the `PORT` env var. Default `3000`. */
+    port?: number;
+    /** Bind address for `start`. Overridden by the `HOST` env var. Default `'0.0.0.0'`. */
+    host?: string;
+    /**
+     * Honour `X-Forwarded-Host` / `X-Forwarded-Proto` when resolving the browser-facing request
+     * URL (`getContext().url`, a page's `url` prop, and the origin the CSRF check compares against).
+     *
+     * **Off by default, and leave it off unless a proxy you control sets those headers**, because
+     * any client can send them: with it on and nothing stripping them at the edge, one request can
+     * point every absolute URL your app builds at an attacker's host (and poison a shared cache).
+     * Turn it on when you terminate TLS or rewrite `Host` at a reverse proxy / load balancer.
+     * Always `true` under `rshono dev`, where the framework's own proxy sets them and binds to
+     * localhost. Default `false`.
+     */
+    trustProxy?: boolean;
+    /**
+     * CSRF origin check on server-action POSTs — rejects a cross-origin request with 403.
+     * Turn off only behind a gateway that already enforces it. Default `true`.
+     */
+    checkOrigin?: boolean;
+    /**
+     * Extra origins allowed to post server actions, in addition to the app's own origin.
+     * Accepts full origins or bare hosts, e.g. `['https://admin.example.com', 'localhost:4000']`.
+     */
+    allowedOrigins?: string[];
+    /**
+     * Send a strict per-request-nonce `Content-Security-Policy` with every HTML document.
+     * While enabled, `render: 'static'` routes render per request (a prerendered file can't carry a
+     * per-request nonce). Default `false`.
+     */
+    csp?: boolean;
+    /**
+     * Directives merged over the built-in {@link csp} policy, which is deliberately strict
+     * (`default-src 'self'`, no framing, no plugins) and so blocks third-party images, fonts and
+     * API hosts until you widen it here. Set a directive to `''` to drop it entirely.
+     *
+     * The per-request nonce is always appended to `script-src`, whatever you put there.
+     * Ignored unless `csp` is `true`.
+     *
+     * @example
+     * ```ts
+     * cspDirectives: {
+     *   'img-src': "'self' data: https://images.example.com",
+     *   'font-src': "'self' https://fonts.gstatic.com",
+     *   'frame-ancestors': "'self'",
+     * }
+     * ```
+     */
+    cspDirectives?: Record<string, string>;
+    /**
+     * Max server-action request body before it's rejected with 413 — a memory-exhaustion guard.
+     * A number is bytes; a string carries a unit (`'512kb'`, `'4mb'`); `false` (or `0`) disables the cap.
+     * Default `'1mb'`.
+     */
+    bodySizeLimit?: string | number | false;
+    /** Deadline in milliseconds for a single page render (flight + SSR). Default `10000`. */
+    renderTimeout?: number;
+    /**
+     * Gzip compressible responses (HTML, flight payloads, JSON, CSS, JS). Streaming-safe — each
+     * chunk the renderer flushes is flushed on the wire too. Default `true`.
+     *
+     * Set `false` behind a proxy or CDN that already compresses, to avoid doing the work twice.
+     */
+    compress?: boolean;
+    /**
+     * Escape hatch: mutate the generated Rspack config just before it's compiled. Called once per
+     * compiler — inspect {@link RspackHookContext.isServer} to tell them apart. Mutate `config` in
+     * place and return nothing, or return a replacement.
+     */
+    rspack?: (config: RspackOptions, ctx: RspackHookContext) => RspackOptions | void;
+}
+/** Identity helper that types a config object — gives editor autocomplete without an explicit annotation. */
+export declare function defineConfig(config: RSHonoConfig): RSHonoConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,kGAAkG;AAClG,MAAM,WAAW,iBAAiB;IAChC,oGAAoG;IACpG,QAAQ,EAAE,OAAO,CAAC;IAClB,+DAA+D;IAC/D,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+GAA+G;IAC/G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;OAIG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;IACxC,yFAAyF;IACzF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,iBAAiB,KAAK,aAAa,GAAG,IAAI,CAAC;CAClF;AAED,6GAA6G;AAC7G,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAE/D"}

package/dist/config.js

@@ -0,0 +1,5 @@
+/** Identity helper that types a config object — gives editor autocomplete without an explicit annotation. */
+export function defineConfig(config) {
+    return config;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAyHA,6GAA6G;AAC7G,MAAM,UAAU,YAAY,CAAC,MAAoB;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { RspackOptions } from '@rspack/core';\nimport type { DeployTarget } from './deploy/contract.js';\n\n/** Which of the two Rspack compilers the {@link RSHonoConfig.rspack} hook is being called for. */\nexport interface RspackHookContext {\n  /** `true` for the server (`target: node`) bundle, `false` for the client (`target: web`) bundle. */\n  isServer: boolean;\n  /** `true` under `rshono dev`, `false` under `rshono build`. */\n  isDev: boolean;\n}\n\n/**\n * Project configuration for rshono, default-exported from `rshono.config.ts` at the project root\n * (`.js` / `.mjs` also work). Every field is optional; omit the file entirely to accept all defaults.\n *\n * @example\n * ```ts\n * import { defineConfig } from '@rshono/core';\n *\n * export default defineConfig({\n *   csp: true,\n *   bodySizeLimit: '4mb',\n *   allowedOrigins: ['https://admin.example.com'],\n * });\n * ```\n */\nexport interface RSHonoConfig {\n  /**\n   * The hosting platform `rshono build` targets. Default `'node'` — a long-lived server process, for\n   * a VPS, a container or anywhere else you run `rshono start`.\n   *\n   * Overridden by the `--deploy` flag or the `RSHONO_DEPLOY` env var, so one config can still be\n   * built for more than one place. `rshono dev` ignores it entirely and always runs the Node dev\n   * server.\n   */\n  deploy?: DeployTarget;\n  /**\n   * The public origin the site is served from, e.g. `'https://example.com'`.\n   *\n   * Only used when prerendering `render: 'static'` routes. A prerendered page is one fixed file\n   * handed to everyone, so any absolute URL inside it has to be decided at build time — there is no\n   * request to read a `Host` from. That is what a page's `url` prop is, so without this a static\n   * page bakes in `http://localhost` wherever it builds a canonical tag, an absolute link or an\n   * `og:url`. Dynamic routes are unaffected: they resolve the URL per request.\n   *\n   * The origin is what's used; a path is rejected rather than silently dropped.\n   */\n  siteUrl?: string;\n  /** Default port for `dev` / `start`. Overridden by the `--port` flag or the `PORT` env var. Default `3000`. */\n  port?: number;\n  /** Bind address for `start`. Overridden by the `HOST` env var. Default `'0.0.0.0'`. */\n  host?: string;\n  /**\n   * Honour `X-Forwarded-Host` / `X-Forwarded-Proto` when resolving the browser-facing request\n   * URL (`getContext().url`, a page's `url` prop, and the origin the CSRF check compares against).\n   *\n   * **Off by default, and leave it off unless a proxy you control sets those headers**, because\n   * any client can send them: with it on and nothing stripping them at the edge, one request can\n   * point every absolute URL your app builds at an attacker's host (and poison a shared cache).\n   * Turn it on when you terminate TLS or rewrite `Host` at a reverse proxy / load balancer.\n   * Always `true` under `rshono dev`, where the framework's own proxy sets them and binds to\n   * localhost. Default `false`.\n   */\n  trustProxy?: boolean;\n  /**\n   * CSRF origin check on server-action POSTs — rejects a cross-origin request with 403.\n   * Turn off only behind a gateway that already enforces it. Default `true`.\n   */\n  checkOrigin?: boolean;\n  /**\n   * Extra origins allowed to post server actions, in addition to the app's own origin.\n   * Accepts full origins or bare hosts, e.g. `['https://admin.example.com', 'localhost:4000']`.\n   */\n  allowedOrigins?: string[];\n  /**\n   * Send a strict per-request-nonce `Content-Security-Policy` with every HTML document.\n   * While enabled, `render: 'static'` routes render per request (a prerendered file can't carry a\n   * per-request nonce). Default `false`.\n   */\n  csp?: boolean;\n  /**\n   * Directives merged over the built-in {@link csp} policy, which is deliberately strict\n   * (`default-src 'self'`, no framing, no plugins) and so blocks third-party images, fonts and\n   * API hosts until you widen it here. Set a directive to `''` to drop it entirely.\n   *\n   * The per-request nonce is always appended to `script-src`, whatever you put there.\n   * Ignored unless `csp` is `true`.\n   *\n   * @example\n   * ```ts\n   * cspDirectives: {\n   *   'img-src': \"'self' data: https://images.example.com\",\n   *   'font-src': \"'self' https://fonts.gstatic.com\",\n   *   'frame-ancestors': \"'self'\",\n   * }\n   * ```\n   */\n  cspDirectives?: Record<string, string>;\n  /**\n   * Max server-action request body before it's rejected with 413 — a memory-exhaustion guard.\n   * A number is bytes; a string carries a unit (`'512kb'`, `'4mb'`); `false` (or `0`) disables the cap.\n   * Default `'1mb'`.\n   */\n  bodySizeLimit?: string | number | false;\n  /** Deadline in milliseconds for a single page render (flight + SSR). Default `10000`. */\n  renderTimeout?: number;\n  /**\n   * Gzip compressible responses (HTML, flight payloads, JSON, CSS, JS). Streaming-safe — each\n   * chunk the renderer flushes is flushed on the wire too. Default `true`.\n   *\n   * Set `false` behind a proxy or CDN that already compresses, to avoid doing the work twice.\n   */\n  compress?: boolean;\n  /**\n   * Escape hatch: mutate the generated Rspack config just before it's compiled. Called once per\n   * compiler — inspect {@link RspackHookContext.isServer} to tell them apart. Mutate `config` in\n   * place and return nothing, or return a replacement.\n   */\n  rspack?: (config: RspackOptions, ctx: RspackHookContext) => RspackOptions | void;\n}\n\n/** Identity helper that types a config object — gives editor autocomplete without an explicit annotation. */\nexport function defineConfig(config: RSHonoConfig): RSHonoConfig {\n  return config;\n}\n"]}

package/dist/deploy/aws-lambda/runtime.d.ts

@@ -0,0 +1,14 @@
+import type { DeployRuntime } from '../contract.js';
+/**
+ * AWS Lambda behind a Function URL, in streaming mode.
+ *
+ * `streamHandle` wraps the app with `awslambda.streamifyResponse`, which is the only way a Lambda can
+ * write a response progressively — and progressive is the whole point of a streamed SSR shell. It
+ * requires the Function URL's invoke mode to be `RESPONSE_STREAM`; the buffered `handle` would work
+ * anywhere but would hold every page until the last byte rendered.
+ *
+ * The filesystem capabilities are Node's: a Lambda unpacks the deployment package onto a read-only
+ * disk, so `dist/static`, `dist/public` and `dist/ssg` are read exactly as they are on a server.
+ */
+export declare const runtime: DeployRuntime;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/deploy/aws-lambda/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/deploy/aws-lambda/runtime.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,OAAO,EAAE,aASrB,CAAC"}

package/dist/deploy/aws-lambda/runtime.js

@@ -0,0 +1,24 @@
+import { streamHandle } from 'hono/aws-lambda';
+import { fileSystemRuntime } from '../filesystem.js';
+/**
+ * AWS Lambda behind a Function URL, in streaming mode.
+ *
+ * `streamHandle` wraps the app with `awslambda.streamifyResponse`, which is the only way a Lambda can
+ * write a response progressively — and progressive is the whole point of a streamed SSR shell. It
+ * requires the Function URL's invoke mode to be `RESPONSE_STREAM`; the buffered `handle` would work
+ * anywhere but would hold every page until the last byte rendered.
+ *
+ * The filesystem capabilities are Node's: a Lambda unpacks the deployment package onto a read-only
+ * disk, so `dist/static`, `dist/public` and `dist/ssg` are read exactly as they are on a server.
+ */
+export const runtime = {
+    ...fileSystemRuntime,
+    serveApp(app) {
+        // `awslambda` is a global the Lambda runtime injects, so it is absent when the build imports this
+        // bundle to prerender. Returning nothing then keeps that pass working; a real invocation has it.
+        if (typeof globalThis.awslambda === 'undefined')
+            return undefined;
+        return streamHandle(app);
+    },
+};
+//# sourceMappingURL=runtime.js.map

package/dist/deploy/aws-lambda/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/deploy/aws-lambda/runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,OAAO,GAAkB;IACpC,GAAG,iBAAiB;IAEpB,QAAQ,CAAC,GAAS;QAChB,kGAAkG;QAClG,iGAAiG;QACjG,IAAI,OAAQ,UAAsC,CAAC,SAAS,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC;QAC/F,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;CACF,CAAC","sourcesContent":["import type { Hono } from 'hono';\nimport { streamHandle } from 'hono/aws-lambda';\nimport type { DeployRuntime } from '../contract.js';\nimport { fileSystemRuntime } from '../filesystem.js';\n\n/**\n * AWS Lambda behind a Function URL, in streaming mode.\n *\n * `streamHandle` wraps the app with `awslambda.streamifyResponse`, which is the only way a Lambda can\n * write a response progressively — and progressive is the whole point of a streamed SSR shell. It\n * requires the Function URL's invoke mode to be `RESPONSE_STREAM`; the buffered `handle` would work\n * anywhere but would hold every page until the last byte rendered.\n *\n * The filesystem capabilities are Node's: a Lambda unpacks the deployment package onto a read-only\n * disk, so `dist/static`, `dist/public` and `dist/ssg` are read exactly as they are on a server.\n */\nexport const runtime: DeployRuntime = {\n  ...fileSystemRuntime,\n\n  serveApp(app: Hono): unknown {\n    // `awslambda` is a global the Lambda runtime injects, so it is absent when the build imports this\n    // bundle to prerender. Returning nothing then keeps that pass working; a real invocation has it.\n    if (typeof (globalThis as { awslambda?: unknown }).awslambda === 'undefined') return undefined;\n    return streamHandle(app);\n  },\n};\n"]}

package/dist/deploy/build-marker.d.ts

@@ -0,0 +1,15 @@
+import type { DeployTarget } from './contract.js';
+/** Records which platform a build was for, so `rshono start` can refuse one it cannot run. */
+export interface BuildMarker {
+    deploy: DeployTarget;
+}
+export declare function writeBuildMarker(distDir: string, deploy: DeployTarget): void;
+/**
+ * The target the build in `distDir` was produced for, or `null` when there is nothing to go on.
+ *
+ * A missing or unreadable marker is deliberately not an error: a build from an older rshono has none,
+ * and refusing to start one that would have worked is worse than the confusing failure this guards
+ * against.
+ */
+export declare function readBuildMarker(distDir: string): DeployTarget | null;
+//# sourceMappingURL=build-marker.d.ts.map

package/dist/deploy/build-marker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-marker.d.ts","sourceRoot":"","sources":["../../src/deploy/build-marker.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,8FAA8F;AAC9F,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,YAAY,CAAC;CACtB;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAE5E;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CASpE"}

package/dist/deploy/build-marker.js

@@ -0,0 +1,26 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+const MARKER_FILE = 'rshono-build.json';
+export function writeBuildMarker(distDir, deploy) {
+    writeFileSync(join(distDir, MARKER_FILE), `${JSON.stringify({ deploy }, null, 2)}\n`);
+}
+/**
+ * The target the build in `distDir` was produced for, or `null` when there is nothing to go on.
+ *
+ * A missing or unreadable marker is deliberately not an error: a build from an older rshono has none,
+ * and refusing to start one that would have worked is worse than the confusing failure this guards
+ * against.
+ */
+export function readBuildMarker(distDir) {
+    const file = join(distDir, MARKER_FILE);
+    if (!existsSync(file))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(file, 'utf8'));
+        return typeof parsed.deploy === 'string' ? parsed.deploy : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=build-marker.js.map

package/dist/deploy/build-marker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-marker.js","sourceRoot":"","sources":["../../src/deploy/build-marker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAQjC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,MAAoB;IACpE,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAwB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC9G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAyB,CAAC;QAC9E,OAAO,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,MAAuB,CAAC,CAAC,CAAC,IAAI,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { existsSync, readFileSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport type { DeployTarget } from './contract.js';\n\n/** Records which platform a build was for, so `rshono start` can refuse one it cannot run. */\nexport interface BuildMarker {\n  deploy: DeployTarget;\n}\n\nconst MARKER_FILE = 'rshono-build.json';\n\nexport function writeBuildMarker(distDir: string, deploy: DeployTarget): void {\n  writeFileSync(join(distDir, MARKER_FILE), `${JSON.stringify({ deploy } satisfies BuildMarker, null, 2)}\\n`);\n}\n\n/**\n * The target the build in `distDir` was produced for, or `null` when there is nothing to go on.\n *\n * A missing or unreadable marker is deliberately not an error: a build from an older rshono has none,\n * and refusing to start one that would have worked is worse than the confusing failure this guards\n * against.\n */\nexport function readBuildMarker(distDir: string): DeployTarget | null {\n  const file = join(distDir, MARKER_FILE);\n  if (!existsSync(file)) return null;\n  try {\n    const parsed = JSON.parse(readFileSync(file, 'utf8')) as Partial<BuildMarker>;\n    return typeof parsed.deploy === 'string' ? (parsed.deploy as DeployTarget) : null;\n  } catch {\n    return null;\n  }\n}\n"]}

package/dist/deploy/bun/runtime.d.ts

@@ -0,0 +1,11 @@
+import type { DeployRuntime } from '../contract.js';
+/**
+ * Bun: a long-lived process like Node, but the runtime — not the app — opens the socket. Bun reads
+ * `fetch`, `port` and `hostname` off the module's default export and serves it, so there is nothing to
+ * bind here and no server handle to close on shutdown.
+ *
+ * Everything else is Node's: Bun implements the `node:` APIs `server/` uses, so assets, gzip and
+ * `.env` loading are the same code.
+ */
+export declare const runtime: DeployRuntime;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/deploy/bun/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/deploy/bun/runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,EAAE,aAUrB,CAAC"}

package/dist/deploy/bun/runtime.js

@@ -0,0 +1,22 @@
+import { fileSystemRuntime } from '../filesystem.js';
+import { listenAddress, readyMessage } from '../listen.js';
+/**
+ * Bun: a long-lived process like Node, but the runtime — not the app — opens the socket. Bun reads
+ * `fetch`, `port` and `hostname` off the module's default export and serves it, so there is nothing to
+ * bind here and no server handle to close on shutdown.
+ *
+ * Everything else is Node's: Bun implements the `node:` APIs `server/` uses, so assets, gzip and
+ * `.env` loading are the same code.
+ */
+export const runtime = {
+    ...fileSystemRuntime,
+    serveApp(app) {
+        const address = listenAddress();
+        // The prerender pass imports this bundle; returning the export is inert either way, so unlike the
+        // Node preset there is nothing to suppress. Only the log line is worth skipping.
+        if (!process.env.RSHONO_PRERENDER)
+            console.log(readyMessage(address));
+        return { fetch: app.fetch, ...address };
+    },
+};
+//# sourceMappingURL=runtime.js.map

package/dist/deploy/bun/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/deploy/bun/runtime.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,OAAO,GAAkB;IACpC,GAAG,iBAAiB;IAEpB,QAAQ,CAAC,GAAS;QAChB,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;QAChC,kGAAkG;QAClG,iFAAiF;QACjF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB;YAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACtE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;IAC1C,CAAC;CACF,CAAC","sourcesContent":["import type { Hono } from 'hono';\nimport type { DeployRuntime } from '../contract.js';\nimport { fileSystemRuntime } from '../filesystem.js';\nimport { listenAddress, readyMessage } from '../listen.js';\n\n/**\n * Bun: a long-lived process like Node, but the runtime — not the app — opens the socket. Bun reads\n * `fetch`, `port` and `hostname` off the module's default export and serves it, so there is nothing to\n * bind here and no server handle to close on shutdown.\n *\n * Everything else is Node's: Bun implements the `node:` APIs `server/` uses, so assets, gzip and\n * `.env` loading are the same code.\n */\nexport const runtime: DeployRuntime = {\n  ...fileSystemRuntime,\n\n  serveApp(app: Hono): unknown {\n    const address = listenAddress();\n    // The prerender pass imports this bundle; returning the export is inert either way, so unlike the\n    // Node preset there is nothing to suppress. Only the log line is worth skipping.\n    if (!process.env.RSHONO_PRERENDER) console.log(readyMessage(address));\n    return { fetch: app.fetch, ...address };\n  },\n};\n"]}

package/dist/deploy/cloudflare/build.d.ts

@@ -0,0 +1,7 @@
+import type { DeployBuildContext } from '../presets.js';
+/**
+ * Arranges a Workers deployment: one assets directory holding everything the CDN should serve, and a
+ * `wrangler.jsonc` to deploy with if the project has no Wrangler config of its own.
+ */
+export declare function finalizeCloudflareBuild(ctx: DeployBuildContext): Promise<void>;
+//# sourceMappingURL=build.d.ts.map

package/dist/deploy/cloudflare/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/deploy/cloudflare/build.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAmDxD;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BpF"}

package/dist/deploy/cloudflare/build.js

@@ -0,0 +1,74 @@
+import { cpSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { rm } from 'node:fs/promises';
+import { basename, join } from 'node:path';
+/** Wrangler serves one directory, so the three kinds of asset the build produces are assembled into it. */
+const ASSETS_DIR = join('cloudflare', 'assets');
+const WRANGLER_FILES = ['wrangler.jsonc', 'wrangler.json', 'wrangler.toml'];
+/**
+ * Caching and crawler rules for the assembled tree, in the file Workers Assets reads them from.
+ *
+ * The hashed bundle is immutable by construction, which is the one thing the CDN cannot infer. The
+ * prerender tree is reachable under its own prefix (see `SSG_PREFIX` in `runtime.ts`) and holds a
+ * second copy of pages that already have real URLs, so it is marked `noindex` rather than left for a
+ * crawler to find twice.
+ */
+const HEADERS_FILE = `/_static/*
+  Cache-Control: public, max-age=31536000, immutable
+
+/__ssg/*
+  X-Robots-Tag: noindex
+`;
+/** A Wrangler worker name: lowercase, and only the characters it accepts. */
+function workerName(rootDir) {
+    const name = basename(rootDir)
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    return name || 'rshono-app';
+}
+function wranglerConfig(rootDir, today) {
+    return `${JSON.stringify({
+        $schema: 'node_modules/wrangler/config-schema.json',
+        name: workerName(rootDir),
+        main: 'dist/server/main.mjs',
+        compatibility_date: today,
+        // AsyncLocalStorage — how the framework binds the request context that `getContext()` reads.
+        compatibility_flags: ['nodejs_compat'],
+        assets: {
+            directory: `dist/${ASSETS_DIR.split(/[\\/]/).join('/')}`,
+            // Read by the worker for `public/` files and prerendered pages; the CDN still answers first.
+            binding: 'ASSETS',
+        },
+    }, null, 2)}\n`;
+}
+/**
+ * Arranges a Workers deployment: one assets directory holding everything the CDN should serve, and a
+ * `wrangler.jsonc` to deploy with if the project has no Wrangler config of its own.
+ */
+export async function finalizeCloudflareBuild(ctx) {
+    const assetsDir = join(ctx.distDir, ASSETS_DIR);
+    // Rebuilt from scratch, so a file deleted from `public/` or a route that stopped being static does
+    // not survive in the deployed tree.
+    await rm(assetsDir, { recursive: true, force: true });
+    mkdirSync(assetsDir, { recursive: true });
+    cpSync(ctx.staticDir, join(assetsDir, '_static'), { recursive: true });
+    if (ctx.publicDir)
+        cpSync(ctx.publicDir, assetsDir, { recursive: true });
+    if (existsSync(ctx.ssgDir))
+        cpSync(ctx.ssgDir, join(assetsDir, '__ssg'), { recursive: true });
+    const headersFile = join(assetsDir, '_headers');
+    if (existsSync(headersFile)) {
+        console.warn(`  ⚠ public/_headers is in the way of the generated one — /_static/* will not be marked immutable.`);
+    }
+    else {
+        writeFileSync(headersFile, HEADERS_FILE);
+    }
+    const existing = WRANGLER_FILES.find((file) => existsSync(join(ctx.rootDir, file)));
+    if (!existing) {
+        const today = new Date().toISOString().slice(0, 10);
+        writeFileSync(join(ctx.rootDir, 'wrangler.jsonc'), wranglerConfig(ctx.rootDir, today));
+        console.log('  • wrote wrangler.jsonc (yours now — edit freely, the build will not touch it again)');
+    }
+    console.log(`  • assembled ${join('dist', ASSETS_DIR)} for Workers Assets`);
+}
+//# sourceMappingURL=build.js.map

package/dist/deploy/cloudflare/build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../../src/deploy/cloudflare/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG3C,2GAA2G;AAC3G,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AAEhD,MAAM,cAAc,GAAG,CAAC,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG;;;;;CAKpB,CAAC;AAEF,6EAA6E;AAC7E,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC;SAC3B,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,IAAI,IAAI,YAAY,CAAC;AAC9B,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,KAAa;IACpD,OAAO,GAAG,IAAI,CAAC,SAAS,CACtB;QACE,OAAO,EAAE,0CAA0C;QACnD,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;QACzB,IAAI,EAAE,sBAAsB;QAC5B,kBAAkB,EAAE,KAAK;QACzB,6FAA6F;QAC7F,mBAAmB,EAAE,CAAC,eAAe,CAAC;QACtC,MAAM,EAAE;YACN,SAAS,EAAE,QAAQ,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACxD,6FAA6F;YAC7F,OAAO,EAAE,QAAQ;SAClB;KACF,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CAAC;AACR,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAAuB;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAChD,mGAAmG;IACnG,oCAAoC;IACpC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1C,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,IAAI,GAAG,CAAC,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9F,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,mGAAmG,CAAC,CAAC;IACpH,CAAC;SAAM,CAAC;QACN,aAAa,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAC;IACvG,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["import { cpSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';\nimport { rm } from 'node:fs/promises';\nimport { basename, join } from 'node:path';\nimport type { DeployBuildContext } from '../presets.js';\n\n/** Wrangler serves one directory, so the three kinds of asset the build produces are assembled into it. */\nconst ASSETS_DIR = join('cloudflare', 'assets');\n\nconst WRANGLER_FILES = ['wrangler.jsonc', 'wrangler.json', 'wrangler.toml'];\n\n/**\n * Caching and crawler rules for the assembled tree, in the file Workers Assets reads them from.\n *\n * The hashed bundle is immutable by construction, which is the one thing the CDN cannot infer. The\n * prerender tree is reachable under its own prefix (see `SSG_PREFIX` in `runtime.ts`) and holds a\n * second copy of pages that already have real URLs, so it is marked `noindex` rather than left for a\n * crawler to find twice.\n */\nconst HEADERS_FILE = `/_static/*\n  Cache-Control: public, max-age=31536000, immutable\n\n/__ssg/*\n  X-Robots-Tag: noindex\n`;\n\n/** A Wrangler worker name: lowercase, and only the characters it accepts. */\nfunction workerName(rootDir: string): string {\n  const name = basename(rootDir)\n    .toLowerCase()\n    .replace(/[^a-z0-9-]+/g, '-')\n    .replace(/^-+|-+$/g, '');\n  return name || 'rshono-app';\n}\n\nfunction wranglerConfig(rootDir: string, today: string): string {\n  return `${JSON.stringify(\n    {\n      $schema: 'node_modules/wrangler/config-schema.json',\n      name: workerName(rootDir),\n      main: 'dist/server/main.mjs',\n      compatibility_date: today,\n      // AsyncLocalStorage — how the framework binds the request context that `getContext()` reads.\n      compatibility_flags: ['nodejs_compat'],\n      assets: {\n        directory: `dist/${ASSETS_DIR.split(/[\\\\/]/).join('/')}`,\n        // Read by the worker for `public/` files and prerendered pages; the CDN still answers first.\n        binding: 'ASSETS',\n      },\n    },\n    null,\n    2,\n  )}\\n`;\n}\n\n/**\n * Arranges a Workers deployment: one assets directory holding everything the CDN should serve, and a\n * `wrangler.jsonc` to deploy with if the project has no Wrangler config of its own.\n */\nexport async function finalizeCloudflareBuild(ctx: DeployBuildContext): Promise<void> {\n  const assetsDir = join(ctx.distDir, ASSETS_DIR);\n  // Rebuilt from scratch, so a file deleted from `public/` or a route that stopped being static does\n  // not survive in the deployed tree.\n  await rm(assetsDir, { recursive: true, force: true });\n  mkdirSync(assetsDir, { recursive: true });\n\n  cpSync(ctx.staticDir, join(assetsDir, '_static'), { recursive: true });\n  if (ctx.publicDir) cpSync(ctx.publicDir, assetsDir, { recursive: true });\n  if (existsSync(ctx.ssgDir)) cpSync(ctx.ssgDir, join(assetsDir, '__ssg'), { recursive: true });\n\n  const headersFile = join(assetsDir, '_headers');\n  if (existsSync(headersFile)) {\n    console.warn(`  ⚠ public/_headers is in the way of the generated one — /_static/* will not be marked immutable.`);\n  } else {\n    writeFileSync(headersFile, HEADERS_FILE);\n  }\n\n  const existing = WRANGLER_FILES.find((file) => existsSync(join(ctx.rootDir, file)));\n  if (!existing) {\n    const today = new Date().toISOString().slice(0, 10);\n    writeFileSync(join(ctx.rootDir, 'wrangler.jsonc'), wranglerConfig(ctx.rootDir, today));\n    console.log('  • wrote wrangler.jsonc (yours now — edit freely, the build will not touch it again)');\n  }\n\n  console.log(`  • assembled ${join('dist', ASSETS_DIR)} for Workers Assets`);\n}\n"]}

package/dist/deploy/cloudflare/runtime.d.ts

@@ -0,0 +1,10 @@
+import type { DeployRuntime } from '../contract.js';
+/**
+ * Cloudflare Workers: the host owns the process, so there is nothing to listen on; the CDN owns the
+ * assets, so there is nothing to serve from disk; and there is no filesystem, so `.env` files and a
+ * streaming gzip are both out.
+ *
+ * What is left is the assets binding, which every read here goes through.
+ */
+export declare const runtime: DeployRuntime;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/deploy/cloudflare/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/deploy/cloudflare/runtime.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AA2EpD;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,EAAE,aA4DrB,CAAC"}