@rshono/core 1.0.0-rc.19 → 1.0.0-rc.20

package/README.md

@@ -35,7 +35,9 @@ rshono build   # production build: client + server bundles + prerendered pages
 rshono start   # run the production build
 ```
 
-`--port` / `PORT` and `HOST` set where it listens; `--config <path>` points `build` at another config file.
+`--port` / `PORT` sets the port for `dev` and `start`. **`HOST` applies to `start` only** — `dev` always binds
+`127.0.0.1`, because its source maps embed the original source of your `'use server'` modules, and it warns if
+you set one. `--config <path>` points `build` at another config file.
 
 ## Project layout
 
@@ -132,6 +134,12 @@ carries a fresh page payload, so server-rendered UI updates after a mutation.
 action. [Server actions docs](https://www.rshono.com/docs/pages#server-actions), and
 [how to use them](https://www.rshono.com/docs/usage).
 
+Rspack compiles an app's whole `'use server'` graph into **one** server module, and calling any action loads
+it — so a module that throws while it evaluates takes every action in the app with it, not just its own.
+Nothing on the server imports these modules until an action is called, which used to make that a green build
+followed by a 500 on the first click. `rshono build` now loads them and warns if one will not, and at run
+time a failure to load is reported as an action fault, not answered as a bad request.
+
 ## Full Hono underneath
 
 - `{ type: 'endpoint' }` routes export a Hono `handler` from a server module.
@@ -212,7 +220,9 @@ server.use(secureHeaders({ contentSecurityPolicy: { scriptSrc: ["'self'", NONCE]
 
 `create-rshono` scaffolds the first two. Under `rshono dev` the framework widens `script-src` with
 `'unsafe-eval'` for React Refresh — never in a build — so one policy serves both, and a route with a
-nonce in play falls back to rendering per request. Everything else Hono ships works the same way:
+nonce in play falls back to rendering its _document_ per request: fixed bytes cannot carry a fresh nonce.
+Its flight payload has no nonce to go stale and is still served from disk, so `rshono build` marks such a
+page `(flight only)` rather than counting it as fully prerendered. Everything else Hono ships works the same way:
 `cors`, `basicAuth`, `jwt`, `timeout`, `requestId`, `ipRestriction`. A middleware that rejects by
 throwing an `HTTPException` keeps its own status rather than becoming the 500 page.
 [Middleware docs](https://www.rshono.com/docs/hono#security-middleware) · [Hono](https://hono.dev/docs).
@@ -265,9 +275,21 @@ Every target streams, which is the bar a new one has to clear.
 - **Streaming is the fragile part of a serverless target, and it fails silently** — `supportsResponseStreaming`
   on Vercel, `streamifyResponse` plus a `RESPONSE_STREAM` Function URL on Lambda. Getting those right is what
   the presets are for.
+- **Most of what `vercel` and `aws-lambda` upload is the source map.** `dist/server/main.mjs.map` is roughly
+  three quarters of `dist/server`, and both targets take the whole directory — `vercel` copies it into the
+  function, the `aws-lambda` handoff is "zip `dist/`". That is deliberate: the map is what turns the
+  `onServerError` funnel from minified frames into real ones, and it is never served to anyone. But it is
+  upload weight rather than cold-start weight — nothing parses it unless a stack trace is being mapped — so
+  delete it from the package if size matters more to you than readable production traces.
 - **Prerendered pages are never CDN-served**: one URL answers with a document or a flight payload depending on
   the `RSC` request header, and a path-keyed CDN cannot choose. `/_static` and `public/` do go straight to the
   CDN.
+- **`public/` beats a route on `cloudflare` and `vercel`, and loses to it on `node` and `aws-lambda`.** Where
+  the app owns the whole surface, `public/` is mounted after every route and answers only what none of them
+  claimed. Where a CDN sits in front it is part of the static output, so the platform answers from it before
+  the app is invoked — the framework cannot reorder either one. So `public/index.html` beside a page route at
+  `/` serves the file on two targets and renders the page on the other two. `rshono build` warns when a
+  `public/` file lands on a route's path, on the targets where it matters.
 - **The serverless targets bundle your dependencies**; `node` bundles only the ones a `'use client'` component
   pulls in. A function is an uploaded directory with no `node_modules` to resolve against, so `vercel`,
   `aws-lambda` and `cloudflare` compile everything in. The cost is that a native addon — or a package that
@@ -311,10 +333,45 @@ Every target streams, which is the bar a new one has to clear.
   proof that reloading will not help. A visitor without JavaScript is left on the fallback under a 200, and a
   crawler indexes that 200 as a soft 404. The fix is app-side: decide in Hono
   middleware, or in the page component body above the boundary. `rshono dev` warns when it happens.
+
+  **On a soft navigation there is no shell to beat, so every `notFound()` degrades.** A flight fetch is
+  committed as `200 text/x-component` the moment the render hands its stream back — before anything has been
+  awaited — so a `notFound()` from the _first line_ of a page component is already too late to be a 404. It
+  rides the payload as a digest, and the client recovers by reloading the page for real (once per URL per
+  tab, then a plain "Page not found" panel). Every in-app click that lands on something missing therefore
+  costs an extra round trip and a full document parse. **`redirect()` is not affected** — the same digest
+  becomes a soft `push()` to the new location, which is what the navigation was going to be anyway. Prefer a
+  `redirect()` where either would do, and decide in Hono middleware where the status still has to be a real 404.
+
+  **A page that _throws_ lands in the same place: the flight response is a `200`.** A document request for it
+  is a 500 answered by your `error` page, but the payload's status was committed before the render failed, so
+  the error rides it as a row and the client runtime paints its error UI — which is the design working, and
+  is what makes a soft navigation onto a broken page recoverable rather than a blank tab. What it costs is
+  observability: **an uptime monitor or a CDN log watching for 5xx sees nothing** for a soft navigation, and
+  the ratio between the two statuses depends on how much of your traffic is in-app clicks. Count failures
+  through `onServerError()`, which fires for both. Buffering the payload to learn whether it failed is the one
+  fix that is not available: it would cost every page its streaming.
+
 - **A page route answers `GET`, `POST` and `HEAD`.** Every other method is a 404 rather than a 405: the
   `Allow` header a 405 owes the client means tracking the methods registered per path, which is state on a hot
   path for a distinction nothing acts on differently here. An endpoint route is the way to answer a `PUT`,
   `PATCH`, `DELETE` or `OPTIONS`.
+- **A page route refuses every cross-site form post**, not only one carrying a server action. A form post to
+  a page is how a `<form action={serverAction}>` reaches the server, and whether a given one holds an action
+  can only be known by reading the body — so the framework refuses on `Sec-Fetch-Site` and the request's
+  shape, before parsing, rather than buffering a body for anyone who asks. "Shape" is all three `enctype`
+  values a browser form can send — `application/x-www-form-urlencoded`, `multipart/form-data` and
+  `text/plain` — since what makes one forgeable from another site is the shape and not what is in it. The
+  cases this rules out are real ones: a **SAML ACS callback**, OIDC **`response_mode=form_post`**, and most
+  payment-gateway returns all arrive as a cross-site POST in exactly that shape. `csrf()`'s allowlist does
+  not widen it — this is the framework declining to run its own action mechanism, ahead of any app policy.
+  **Receive them on an `{ type: 'endpoint' }` route**, which calls your Hono handler directly and never
+  reaches the page renderer, then redirect to the page.
+- **`/_static` is reserved**, on every deploy target and under `rshono dev`: it is where the hashed client
+  bundle is served from, mounted ahead of the route table and answering its whole subtree. A route whose path
+  is `/_static` or sits below it is refused by name — it could never have answered a request. A parameterised
+  route that happens to overlap the prefix (`/:section/thing`) is left alone; it loses those paths and
+  answers the rest.
 - **A page's `ctx` prop is non-enumerable**, so `<Child {...props} />` hands a _server_ child
   `ctx: undefined` — silently, since a spread copies enumerables only, and the type still says it is there.
   It cannot be otherwise: an enumerable `ctx` would put `ctx.hono.env`, every binding and secret, into
@@ -329,6 +386,12 @@ Every target streams, which is the bar a new one has to clear.
   in — so `rshono dev` does not pick up an edit to either, and a rebuild that serves the old value looks like
   nothing happened. Restart it; it watches both and says so when one changes.
 - The dev proxy doesn't forward WebSocket upgrades to a custom sub-app; production is unaffected.
+- **`rshono dev` answers `/_static` itself, so your middleware does not run for an asset** — where a build
+  serves assets through the app and they carry HSTS, your CSP and everything else it sets. The dev front-end
+  owns the prefix on purpose: every request it proxies waits on the server rebuild, and the client bundle is
+  built by a separate compiler, so proxying assets would stall the browser's JS and CSS on a save that only
+  touched a server component. The cost is that a policy is developed against files it does not apply to;
+  check a header that has to be on an asset against `rshono build` and `rshono start`.
 - Dev source maps embed the original source of `'use server'` modules (dev binds 127.0.0.1 only, and
   production ships no client source maps).
 
@@ -354,6 +417,34 @@ Every target streams, which is the bar a new one has to clear.
 soft navigation, `useNavigation`, client-initiated actions, boundary fallbacks and the fatal overlay — the
 client runtime, which no amount of asserting on HTML can reach.
 
+`test:coverage` gates the build tooling, **not the request hot path** — worth knowing before reading anything
+into the number. Node measures what this process loads, and the modules that answer a request only ever run
+inside the bundled testbed in a child process: `entry.rsc`, `entry.client`, `entry.ssr`, `boundaries`,
+`navigation` and every `deploy/*/runtime` appear nowhere in the report, and `runtime/` in it means `context`,
+`control`, `flight-inject`, `hot-update`, `request` and `validate-entries` alone. Those absent modules are the
+most thoroughly tested code in the package — by the e2e suites above, over HTTP, which is the only way to test
+them at all. So the percentage covers the builder, the CLI, the deploy build steps and the pure runtime
+helpers; treat its floors as a ratchet on those, and never as a statement about the framework as a whole.
+
+The other half can be measured on demand, and is worth a look before a release. Every process the suite
+spawns writes its own V8 coverage if you ask for it, and the testbed's bundle carries a source map that
+reaches back into this package's `src/`, so the request path can be remapped onto the files it came from:
+
+```bash
+# from the repository root, so the testbed the coverage points into is under the working directory
+NODE_V8_COVERAGE=.coverage-e2e node --test packages/core/test/prod.test.mjs
+npx c8 report --temp-directory .coverage-e2e --reporter=text --all=false --exclude-after-remap \
+  --exclude='**/node_modules/**' --exclude='**/testbed/src/**' --exclude='**/webpack/**' \
+  --exclude='**/test/**' --exclude='**/drift-*/**' --exclude='**/*.css'
+```
+
+One suite at a time, because a full run builds the testbed several times over — production, dev, cloudflare,
+vercel — and each bundle is a separate path holding the same sources, which no total can add up. Last taken
+this way, the production e2e suite alone reached **97.4% of `entry.rsc.tsx`** (92.3% of its branches),
+**100% of `entry.ssr.tsx`, `navigation.tsx` and the node runtime**, and 88% of `boundaries.tsx` — the rest of
+which is its client half, and belongs to the browser suite. That is why the gate is left where it is rather
+than tightened: the code it cannot see is not the code that is thin.
+
 ## How it works
 
 Two coordinated Rspack compilers, using native RSC support (`rspack.experiments.rsc`):

package/dist/builder/env-shadow-loader.cjs

@@ -61,6 +61,29 @@ const MENTIONS_PROCESS = /\bprocess\b/;
  */
 const GLOBAL_PROCESS = /\b(?:globalThis|global|self)\s*(?:\?\.|\.)?\s*(?:process\b|\[\s*(['"`])process\1\s*\])/;
 
+/**
+ * A free `process.env.NODE_ENV` read — the one expression the prelude has to hand back to the optimiser —
+ * and the three places that same text can sit without being one.
+ *
+ * The last alternative is the target. The lookbehind rejects a member read off something else
+ * (`this.process.env.NODE_ENV`, `foo.process…`) and a longer identifier (`myprocess`); the trailing `\b`
+ * rejects `NODE_ENVIRONMENT`. That is the shape DefinePlugin substitutes, minus the ones it also declines —
+ * an optional chain and a computed key are left alone here exactly as they are left alone there.
+ *
+ * The alternatives ahead of it are what keeps this a substitution of *code*. DefinePlugin works on the parsed
+ * module and so cannot rewrite a string; this loader is text, and without them
+ * `throw new Error('set process.env.NODE_ENV')` would come out as `throw new Error('set "production"')`.
+ * Comments come first so an apostrophe in one (`// don't`) cannot open a string that swallows the code after
+ * it, then strings, then templates.
+ *
+ * It is a scanner, not a parser, and two things are outside it: a regex literal spelled with unescaped dots
+ * (`/process.env.NODE_ENV/`), and an interpolation inside a template, which is consumed with the template
+ * around it. The first is the residual risk and a strange thing to write; the second only declines a
+ * substitution that would have been valid, which costs bytes and changes nothing. Any position it gets wrong
+ * leaves the text exactly as a bare `.replace()` would have, so this can only improve on one.
+ */
+const NODE_ENV_SCAN = /\/\/[^\n]*|\/\*[\s\S]*?\*\/|(['"])(?:\\[\s\S]|(?!\1)[^\\\n])*\1|`(?:\\[\s\S]|[^\\`])*`|(?<![.$\w])process\.env\.NODE_ENV\b/g;
+
 /**
  * Shadows `process.env` with the PUBLIC_-only view inside SSR-layer modules, so a secret read from a
  * `'use client'` component renders empty on the server rather than leaking into the HTML stream — and SSR
@@ -74,7 +97,7 @@ module.exports = function envShadowLoader(source) {
   // Two steps rather than the regex alone: this loader sees every module in the bundle, and most of them do
   // not contain the substring at all, which `includes` settles far more cheaply than a scan for word breaks.
   if (!source.includes('process') || !MENTIONS_PROCESS.test(source)) return source;
-  const { prelude, layer, appSrcPrefix } = this.getOptions();
+  const { prelude, layer, appSrcPrefix, nodeEnv } = this.getOptions();
   if (!this._module) {
     throw new Error(
       "[rshono] env-shadow-loader could not read the module's layer (Rspack's `this._module` is unavailable). " +
@@ -96,6 +119,23 @@ module.exports = function envShadowLoader(source) {
     );
   }
 
+  // Hand `process.env.NODE_ENV` back to the optimiser before the prelude takes it away. DefinePlugin — the
+  // pass that erases `if (process.env.NODE_ENV === 'production')` and everything on the dead side of it —
+  // respects lexical scope, and the prelude below declares a module-scope `process`. So without this, every
+  // React entry wrapper in this layer stays a runtime branch and *both* halves are bundled: six development
+  // builds of react / react-dom / react-server-dom-rspack, about half of `dist/server/main.mjs`.
+  //
+  // Substituting is not a behaviour change. `NODE_ENV` is the one key of the prelude's own `env` literal that
+  // is not read from the host environment — it is this build's mode — so the value written here is the value
+  // the shadow would have returned anyway, and the shadow's security property is untouched.
+  //
+  // Textual, like the prelude insertion beside it, but not blindly so: {@link NODE_ENV_SCAN} walks the
+  // comments, strings and templates as well, and hands back everything that is not code untouched.
+  if (nodeEnv) {
+    const literal = JSON.stringify(nodeEnv);
+    source = source.replace(NODE_ENV_SCAN, (match) => (match.startsWith('process') ? literal : match));
+  }
+
   const prologue = source.match(DIRECTIVE_PROLOGUE)[0];
   return prologue + prelude + source.slice(prologue.length);
 };

package/dist/builder/page-entry-loader.cjs

@@ -1,5 +1,32 @@
 'use strict';
-const OPENS_WITH_DIRECTIVE = /^(?:\s|\/\/[^\n]*(?:\n|$)|\/\*[\s\S]*?\*\/)*(['"])use (?:client|server|server-entry)\1\s*(?:;|\n|$)/;
+
+/** Whitespace and comments — what may sit before or between directives without ending the prologue. */
+const TRIVIA = '(?:\\s|//[^\\n]*(?:\\n|$)|/\\*[\\s\\S]*?\\*/)*';
+/**
+ * A directive that is *not* one of the three the RSC compilers act on. `'use strict'` above all, which is
+ * what a transpiler and many a published component library put at the top of a module; `'use cache'` and
+ * whatever else React adds later fall here too, which is the point of writing this as "not those three"
+ * rather than as a list.
+ */
+const OTHER_DIRECTIVE = '([\'"])use (?!(?:client|server|server-entry)\\1)[a-z -]+\\1\\s*;?';
+/** One of the three. `\\2`, because {@link OTHER_DIRECTIVE} ahead of it owns group 1. */
+const RSC_DIRECTIVE = '([\'"])use (?:client|server|server-entry)\\2\\s*;?';
+
+/**
+ * Whether the module already declares one of the three RSC directives — anywhere in its directive prologue,
+ * which is the fix: this used to match only a directive that came *first*.
+ *
+ * A page opening `'use strict';` ahead of its `'use client';` therefore had `'use server-entry';` prepended,
+ * and the injected directive is the one the compiler then acts on. Measured against a real build: a page
+ * whose first line is `'use client'` fails with `assertPageModule`'s message, and the same page with
+ * `'use strict'` above it exits 0 and ships — so the one directive the framework relies on to refuse a client
+ * page was silently neutered, and the page failed inside React at request time instead.
+ *
+ * Structural rather than a substring test, so a comment that *mentions* `'use client'` — plausible at the top
+ * of a page that used to be one — is consumed as trivia rather than read as a directive. And the same shape
+ * as `env-shadow-loader.cjs`'s prologue match, which was widened for this exact class of module.
+ */
+const OPENS_WITH_DIRECTIVE = new RegExp(`^${TRIVIA}(?:${OTHER_DIRECTIVE}${TRIVIA})*${RSC_DIRECTIVE}`);
 
 module.exports = function pageEntryLoader(source) {
   if (OPENS_WITH_DIRECTIVE.test(source)) return source;

package/dist/builder/page-files.d.ts

@@ -1,2 +1 @@
 export declare function scanPageFiles(routesFile: string, srcDir: string, into: Set<string>): void;
-//# sourceMappingURL=page-files.d.ts.map

package/dist/builder/public-env.d.ts

@@ -6,4 +6,3 @@
  * hydrates.
  */
 export declare function publicEnv(isDev: boolean): Record<string, string>;
-//# sourceMappingURL=public-env.d.ts.map

package/dist/builder/react-versions.d.ts

@@ -10,4 +10,3 @@
  *   framework's.
  */
 export declare function checkReactVersions(rootDir: string): void;
-//# sourceMappingURL=react-versions.d.ts.map

package/dist/builder/rspack-config.d.ts

@@ -21,4 +21,3 @@ export interface RspackConfigOptions {
     onServerComponentChanges?: () => void;
 }
 export declare function createConfigs(options: RspackConfigOptions): [RspackOptions, RspackOptions];
-//# sourceMappingURL=rspack-config.d.ts.map

package/dist/builder/rspack-config.js

@@ -310,6 +310,10 @@ export function createConfigs(options) {
                             options: {
                                 prelude: `const process = Object.assign(Object.create(globalThis.process ?? Object.prototype), { env: ${JSON.stringify(publicEnv(isDev))} }); `,
                                 layer: Layers.ssr,
+                                // The prelude's binding hides `process.env.NODE_ENV` from DefinePlugin, which is what erases
+                                // React's `if (NODE_ENV === 'production')` wrappers. The loader substitutes it back so the
+                                // dead half still goes; without it the SSR layer ships both builds of every React package.
+                                nodeEnv: mode,
                                 // Only the app's own source is warned about when it reaches `process` through the global
                                 // object, which no prelude can shadow — a library feature-detecting `globalThis.process` is
                                 // doing nothing wrong and has no app secret to read. The separator is part of the prefix so

package/dist/builder/rspack-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"rspack-config.js","sourceRoot":"","sources":["../../src/builder/rspack-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAuD,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAGhE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,kGAAkG;AAClG,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACvD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AAElD,MAAM,gBAAgB,GAAG,wFAAwF,CAAC;AAElH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AACpC,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;AAErC;;;GAGG;AACH,MAAM,iBAAiB,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAEtD,+GAA+G;AAC/G,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QACrC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc;IACrB,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACxD,IAAI,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;QAChF,CAAC;IACH,CAAC;IACD,uFAAuF;IACvF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACjF,MAAM,YAAY,GAAG,CAAC,YAAY,CAAC,CAAC;AAEpC;;;;;;GAMG;AACH,SAAS,OAAO;IACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC/C,CAAC;AAYD,+GAA+G;AAC/G,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC;;;;;;;;GAQG;AACH,SAAS,QAAQ,CAAC,MAAc,EAAE,UAAkB;IAClD,IAAI,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/D,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjG,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oGAAoG;IACtG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAA4B;IACxD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,GAAG,OAAO,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;IAEnD,0GAA0G;IAC1G,2DAA2D;IAC3D,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE5B,MAAM,UAAU,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,iCAAiC,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/F,MAAM,cAAc,GAAG,aAAa,IAAI,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAC/F,2GAA2G;IAC3G,4GAA4G;IAC5G,sFAAsF;IACtF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CACV,yGAAyG;gBACvG,qGAAqG,CACxG,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YAC1C,wGAAwG;YACxG,wGAAwG;YACxG,yDAAyD;YACzD,OAAO,CAAC,IAAI,CACV,0GAA0G;gBACxG,qGAAqG;gBACrG,sGAAsG,CACzG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,CAAC,OAAiB,EAAe,EAAE,CAAC,CAAC;QACnD,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,mBAAmB;QAC5B,GAAG,EAAE;YACH,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE;gBACP,YAAY,EAAE,MAAM;gBACpB,GAAG,EAAE;oBACH,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;oBAClE,YAAY,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE;iBAC7C;gBACD,GAAG,EAAE,EAAE,OAAO,EAAE;gBAChB,iBAAiB,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE;aACnD;SACF;QACD,IAAI,EAAE,iBAAiB;KACxB,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG;QAClB,UAAU,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;QACnD,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;QACjD,OAAO,EAAE,cAAc,EAAE;KAC1B,CAAC;IAEF,uGAAuG;IACvG,yGAAyG;IACzG,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACzD,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,cAAc,EAAE,CAAC,GAAG,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IACzI,MAAM,iBAAiB,GAAG,CAAC,cAAc,EAAE,GAAG,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAExE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;IAC9E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC;IAE1C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,cAAc,GAAG;QACrB,KAAK,CAAC,QAAkB;YACtB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACnE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;YAC1D,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC;KACF,CAAC;IAEF,MAAM,YAAY,GAAkB;QAClC,IAAI,EAAE,QAAQ;QACd,IAAI;QACJ,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,OAAO;QAChB,wGAAwG;QACxG,kFAAkF;QAClF,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK;QACrC,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;QAC5B,MAAM,EAAE;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;YACrC,UAAU,EAAE,WAAW;YACvB,KAAK,EAAE,CAAC,KAAK;YACb,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,8BAA8B;YACnE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gCAAgC;YAC5E,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iCAAiC;YAC5E,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iCAAiC;YACjF,mBAAmB,EAAE,2BAA2B;SACjD;QACD,YAAY,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;SACtC;QACD,OAAO,EAAE;YACP,GAAG,WAAW;YACd,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;SACvB;QACD,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,sDAAsD,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;SAC9H;QACD,OAAO,EAAE;YACP,IAAI,YAAY,EAAE;YAClB,sBAAsB,CAAC,OAAO,CAAC;YAC/B,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,0BAA0B,EAAE,EAAE,IAAI,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F;QACD,WAAW,EAAE,KAAK;KACnB,CAAC;IAEF,MAAM,YAAY,GAAkB;QAClC,IAAI,EAAE,QAAQ;QACd,IAAI;QACJ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,OAAO;QAChB,wGAAwG;QACxG,sGAAsG;QACtG,oGAAoG;QACpG,yCAAyC;QACzC,OAAO,EAAE,YAAY;QACrB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,MAAM,EAAE;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;YACrC,uGAAuG;YACvG,iFAAiF;YACjF,KAAK,EAAE,CAAC,KAAK;YACb,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,QAAQ;YACtB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,mBAAmB;YAClC,UAAU,EAAE,WAAW;YACvB,mBAAmB,EAAE,2BAA2B;SACjD;QACD,YAAY,EAAE;YACZ,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;SAC/B;QACD,aAAa,EAAE,eAAe;QAC9B,SAAS,EAAE;YACT,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE;gBACrC,IACE,CAAC,OAAO;oBACR,aAAa,CAAC,OAAO,CAAC;oBACtB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;oBACxB,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;oBAC9B,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;oBAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;oBACrB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;oBAC9B,oGAAoG;oBACpG,sGAAsG;oBACtG,kGAAkG;oBAClG,6FAA6F;oBAC7F,qGAAqG;oBACrG,2BAA2B;oBAC3B,EAAE;oBACF,sGAAsG;oBACtG,qGAAqG;oBACrG,qGAAqG;oBACrG,oCAAoC;oBACpC,WAAW,EAAE,WAAW,KAAK,MAAM,CAAC,GAAG,EACvC,CAAC;oBACD,OAAO,QAAQ,EAAE,CAAC;gBACpB,CAAC;gBACD,QAAQ,CAAC,SAAS,EAAE,iBAAiB,OAAO,EAAE,CAAC,CAAC;YAClD,CAAC;SACF;QACD,OAAO,EAAE;YACP,GAAG,iBAAiB;YACpB,KAAK,EAAE;gBACL,iBAAiB,EAAE,UAAU;gBAC7B,qBAAqB,EAAE,cAAc;gBACrC,0FAA0F;gBAC1F,iBAAiB,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC3E,GAAG,EAAE,MAAM;aACZ;SACF;QACD,MAAM,EAAE;YACN,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;oBACnD,OAAO,EAAE,KAAK;oBACd,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,uBAAuB,CAAC,EAAE,CAAC;iBAC5E;gBACD;oBACE,kGAAkG;oBAClG,iGAAiG;oBACjG,+FAA+F;oBAC/F,+FAA+F;oBAC/F,mEAAmE;oBACnE,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,KAAK;oBACd,GAAG,EAAE;wBACH;4BACE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,uBAAuB,CAAC;4BAChE,+FAA+F;4BAC/F,0FAA0F;4BAC1F,0FAA0F;4BAC1F,yEAAyE;4BACzE,OAAO,EAAE;gCACP,OAAO,EAAE,+FAA+F,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO;gCAC/I,KAAK,EAAE,MAAM,CAAC,GAAG;gCACjB,yFAAyF;gCACzF,4FAA4F;gCAC5F,4FAA4F;gCAC5F,8DAA8D;gCAC9D,YAAY,EAAE,MAAM,GAAG,GAAG;6BAC3B;yBACF;qBACF;iBACF;gBACD,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,YAAY,CAAC,CAAC,CAAC;gBACpD,OAAO,EAAE;gBACT;oBACE,IAAI,EAAE,sDAAsD;oBAC5D,IAAI,EAAE,OAAO;oBACb,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;iBAC3B;gBACD,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE;gBACzC;oBACE,QAAQ,EAAE,QAAQ;oBAClB,KAAK,EAAE,MAAM,CAAC,GAAG;oBACjB,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE;iBAC/C;gBACD;oBACE,WAAW,EAAE,MAAM,CAAC,GAAG;oBACvB,OAAO,EAAE,QAAQ;oBACjB,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE;iBAC/C;aACF;SACF;QACD,OAAO,EAAE;YACP,cAAc;YACd,IAAI,YAAY,CAAC,EAAE,wBAAwB,EAAE,CAAC;YAC9C,4FAA4F;YAC5F,IAAI,MAAM,CAAC,YAAY,CAAC;gBACtB,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;aACnH,CAAC;SACH;QACD,WAAW,EAAE,KAAK;KACnB,CAAC;IAEF,yGAAyG;IACzG,MAAM,CAAC,eAAe,EAAE,CAAC,YAAY,CAAC,CAAC;IAEvC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACjC,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,UAAU,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,IAAI,YAAY;YACpE,UAAU,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,YAAY;SACpE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AACtC,CAAC","sourcesContent":["import { rspack, type Compiler, type RspackOptions, type RuleSetRule } from '@rspack/core';\nimport { ReactRefreshRspackPlugin } from '@rspack/plugin-react-refresh';\nimport { existsSync, readdirSync, readFileSync } from 'node:fs';\nimport { createRequire } from 'node:module';\nimport { basename, dirname, join, sep, win32 } from 'node:path';\nimport type { RshonoConfig } from '../config.js';\nimport type { DeployPreset } from '../deploy/presets.js';\nimport { resolveServerConfig } from '../server/server-config.js';\nimport { serverOnlyImportPlugin } from './server-only-imports.js';\nimport { scanPageFiles } from './page-files.js';\nimport { publicEnv } from './public-env.js';\nimport { checkReactVersions } from './react-versions.js';\n\n// This file lives in `dist/builder/`, so the entries and loaders below are the *built* framework.\nconst FRAMEWORK_DIST = join(import.meta.dirname, '..');\nconst FRAMEWORK_ROOT = join(FRAMEWORK_DIST, '..');\n\nconst BUNDLED_PACKAGES = /^(@rshono\\/core|react|react-dom|react-server-dom-rspack|hono|@hono\\/node-server)(\\/|$)/;\n\n/**\n * The directory a command writes its bundles to, relative to the project root — one per command, never\n * shared: a `rshono build` alongside a running `rshono dev` would `clean` away the route chunks that\n * server imports lazily, and Rspack's watch-mode emit never re-emits a file it believes it wrote.\n *\n * Both names are a single level under the root, which `deploy/filesystem.ts` relies on to derive the\n * project root from where the bundle ended up.\n */\nexport const BUILD_OUT_DIR = 'dist';\nexport const DEV_OUT_DIR = '.rshono';\n\n/**\n * Packages the app's source ends up importing without ever naming them: the RSC transform rewrites a\n * `'use client'` module, a page or an action into imports of the RSC runtime, resolved from the app's `src/`.\n */\nconst INJECTED_PACKAGES = ['react-server-dom-rspack'];\n\n/** The `node_modules` directory a resolved file sits in — `…/node_modules/pkg/index.js` → `…/node_modules`. */\nfunction enclosingNodeModules(file: string): string | undefined {\n  let dir = dirname(file);\n  while (basename(dir) !== 'node_modules') {\n    const parent = dirname(dir);\n    if (parent === dir) return undefined;\n    dir = parent;\n  }\n  return dir;\n}\n\n/**\n * Where packages are resolved from: the app's own `node_modules`, then the framework's — which is what makes\n * {@link INJECTED_PACKAGES} resolvable from app source under pnpm, where the framework's dependencies are\n * installed as siblings of `@rshono/core` rather than hoisted into the app's tree.\n *\n * Asking Node where the framework resolves the package finds it in any layout, and a search path rather than\n * an alias keeps the package's own `exports` conditions in play — the RSC layer, the SSR layer and each\n * deploy target need a different build of it.\n */\nfunction resolveModules(): string[] {\n  const require = createRequire(import.meta.url);\n  const dirs = new Set<string>();\n  for (const name of INJECTED_PACKAGES) {\n    try {\n      const dir = enclosingNodeModules(require.resolve(name));\n      if (dir) dirs.add(dir);\n    } catch {\n      // Left to the resolver to report against the request that actually needed it.\n    }\n  }\n  // A checkout or a vendored copy, where the framework has real dependencies of its own.\n  dirs.add(join(FRAMEWORK_ROOT, 'node_modules'));\n  return ['node_modules', ...dirs];\n}\n\n/**\n * Whether a request names a file rather than a package, and so belongs in the bundle.\n *\n * Rspack's RSC plugins ask for their proxies by absolute path, which on Windows carries a drive letter —\n * externalizing one emits an `import(\"D:\\\\…\")` Node rejects. `win32.isAbsolute` accepts the POSIX form too,\n * so it runs on every platform and the Windows shapes stay testable off Windows.\n */\nfunction isPathRequest(request: string): boolean {\n  return request.startsWith('.') || win32.isAbsolute(request);\n}\n\nconst BROWSER_TARGETS = ['last 2 versions', '> 0.2%', 'not dead', 'Firefox ESR'];\nconst NODE_TARGETS = ['node >= 22'];\n\n/**\n * Rspack's native CSS pipeline, which both compilers get. It parses *finished* CSS, so a stylesheet needing\n * PostCSS — Tailwind, most obviously — adds that loader through the {@link RshonoConfig.rspack} hook, which\n * keeps `postcss` a dependency of the apps that want one.\n *\n * A fresh object per compiler, so an app changing this rule does not silently change the other bundle's.\n */\nfunction cssRule(): RuleSetRule {\n  return { test: /\\.css$/i, type: 'css/auto' };\n}\n\nexport interface RspackConfigOptions {\n  rootDir: string;\n  isDev: boolean;\n  /** The project's resolved config — supplies the {@link RshonoConfig.rspack} hook and the runtime settings baked into the server bundle. */\n  config: RshonoConfig;\n  /** The platform being built for: decides the `@rshono/deploy` runtime and any server-compiler overrides. */\n  preset: DeployPreset;\n  onServerComponentChanges?: () => void;\n}\n\n/** Source files worth reading for {@link mentions} — the app's own code, whatever dialect it is written in. */\nconst SOURCE_FILE = /\\.[cm]?[jt]sx?$/;\n\n/**\n * Whether `identifier` appears anywhere in the app's own source. The whole tree rather than `src/server.ts`\n * alone, so middleware registered from a helper module counts.\n *\n * A textual scan on purpose. What is being answered is \"did the author think about this at all\", which is a\n * question a build warning is allowed to get wrong: the failure mode is a warning that is unwarranted, never a\n * build that fails or a behaviour that changes. Resolving it properly would mean reading the module graph, and\n * a middleware registered from a package outside `src/` would still slip past.\n */\nfunction mentions(srcDir: string, identifier: string): boolean {\n  try {\n    for (const entry of readdirSync(srcDir, { recursive: true, withFileTypes: true })) {\n      if (!entry.isFile() || !SOURCE_FILE.test(entry.name)) continue;\n      if (readFileSync(join(entry.parentPath, entry.name), 'utf8').includes(identifier)) return true;\n    }\n  } catch {\n    // An unreadable `src/` is not this function's to report: the build is about to fail on `routes.ts`.\n  }\n  return false;\n}\n\nexport function createConfigs(options: RspackConfigOptions): [RspackOptions, RspackOptions] {\n  const { rootDir, isDev, config, preset, onServerComponentChanges } = options;\n  const srcDir = join(rootDir, 'src');\n  const mode = isDev ? 'development' : 'production';\n  const outDir = isDev ? DEV_OUT_DIR : BUILD_OUT_DIR;\n\n  // Before anything is compiled: a react/react-dom split fails inside React at render time, and this is the\n  // one place that can say so with the two versions in hand.\n  checkReactVersions(rootDir);\n\n  const routesFile = ['routes.ts', 'routes.tsx'].map((f) => join(srcDir, f)).find(existsSync);\n  if (!routesFile) {\n    throw new Error(`[rshono] src/routes.ts not found in ${rootDir} — it is the one required file.`);\n  }\n  const serverAppFile = ['server.ts', 'server.tsx'].map((f) => join(srcDir, f)).find(existsSync);\n  const serverAppAlias = serverAppFile ?? join(FRAMEWORK_DIST, 'runtime', 'empty-server-app.js');\n  // Optional, and staying optional — but per-request security is Hono middleware registered there, so an app\n  // without one has opted out of all of it, which is worth hearing once rather than discovering. Builds only:\n  // `dev` would print it on every rebuild, and it is not news on a developer's machine.\n  if (!isDev) {\n    if (!serverAppFile) {\n      console.warn(\n        '  ⚠ No src/server.ts — this build has no CSRF check and no request body cap. Both are Hono middleware\\n' +\n          '    (`csrf()`, `bodyLimit()`); `npx @rshono/create` scaffolds a src/server.ts with them registered.',\n      );\n    } else if (!mentions(srcDir, 'bodyLimit')) {\n      // Having a src/server.ts is not the same as having the cap in it, and this half used to be warned about\n      // nowhere: every `'use server'` export is a public POST endpoint by design, and the action path buffers\n      // the whole body before it can decide anything about it.\n      console.warn(\n        \"  ⚠ No bodyLimit() anywhere in src/ — this build has no request body cap. Every 'use server' export is\\n\" +\n          '    a public POST endpoint, and the action path buffers whatever arrives before it can reject it.\\n' +\n          '    Add `server.use(bodyLimit({ maxSize: 1024 * 1024 }))` to src/server.ts (from `hono/body-limit`).',\n      );\n    }\n  }\n\n  const rscEntry = join(FRAMEWORK_DIST, 'runtime', 'entry.rsc.js');\n  const ssrEntry = join(FRAMEWORK_DIST, 'runtime', 'entry.ssr.js');\n  const clientEntry = join(FRAMEWORK_DIST, 'runtime', 'entry.client.js');\n\n  const swcRule = (targets: string[]): RuleSetRule => ({\n    test: /\\.[cm]?[jt]sx?$/,\n    exclude: /[\\\\/]core-js[\\\\/]/,\n    use: {\n      loader: 'builtin:swc-loader',\n      options: {\n        detectSyntax: 'auto',\n        jsc: {\n          transform: { react: { runtime: 'automatic', development: isDev } },\n          experimental: { keepImportAttributes: true },\n        },\n        env: { targets },\n        rspackExperiments: { reactServerComponents: true },\n      },\n    },\n    type: 'javascript/auto',\n  });\n\n  const resolveBase = {\n    extensions: ['.tsx', '.ts', '.jsx', '.js', '.json'],\n    extensionAlias: { '.js': ['.ts', '.tsx', '.js'] },\n    modules: resolveModules(),\n  };\n\n  // Ahead of whatever the Rspack target implies ('...'), which is what hands the server bundle the right\n  // build of React and the RSC runtime. Unset for Node, whose target already implies the `node` condition.\n  const runtimeConditions = preset.resolveConditions ?? [];\n  const serverResolveBase = runtimeConditions.length > 0 ? { ...resolveBase, conditionNames: [...runtimeConditions, '...'] } : resolveBase;\n  const rscConditionNames = ['react-server', ...runtimeConditions, '...'];\n\n  const { ServerPlugin, ClientPlugin } = rspack.experiments.rsc.createPlugins();\n  const { Layers } = rspack.experiments.rsc;\n\n  const pageFiles = new Set<string>();\n  scanPageFiles(routesFile, srcDir, pageFiles);\n  const pageScanPlugin = {\n    apply(compiler: Compiler) {\n      const refresh = () => scanPageFiles(routesFile, srcDir, pageFiles);\n      compiler.hooks.beforeRun.tap('rshono/page-scan', refresh);\n      compiler.hooks.watchRun.tap('rshono/page-scan', refresh);\n    },\n  };\n\n  const clientConfig: RspackOptions = {\n    name: 'client',\n    mode,\n    target: 'web',\n    context: rootDir,\n    // Never in a build: a client map is served from `/_static` like everything else beside it, and it would\n    // publish the original source of the app's own modules. Dev binds 127.0.0.1 only.\n    devtool: isDev ? 'source-map' : false,\n    entry: { main: clientEntry },\n    output: {\n      path: join(rootDir, outDir, 'static'),\n      publicPath: '/_static/',\n      clean: !isDev,\n      filename: isDev ? 'chunks/main.js' : 'chunks/main.[contenthash].js',\n      chunkFilename: isDev ? 'chunks/[name].js' : 'chunks/[name].[contenthash].js',\n      cssFilename: isDev ? 'chunks/[name].css' : 'chunks/[name].[contenthash].css',\n      cssChunkFilename: isDev ? 'chunks/[name].css' : 'chunks/[name].[contenthash].css',\n      assetModuleFilename: 'assets/[name].[hash][ext]',\n    },\n    optimization: {\n      moduleIds: isDev ? 'named' : 'hashed',\n    },\n    resolve: {\n      ...resolveBase,\n      alias: { '@': srcDir },\n    },\n    module: {\n      rules: [swcRule(BROWSER_TARGETS), cssRule(), { test: /\\.(png|jpe?g|gif|webp|avif|ico|svg|woff2?|ttf|otf)$/i, type: 'asset' }],\n    },\n    plugins: [\n      new ClientPlugin(),\n      serverOnlyImportPlugin(rootDir),\n      new rspack.DefinePlugin({ 'process.env': JSON.stringify(publicEnv(isDev)) }),\n      ...(isDev ? [new rspack.HotModuleReplacementPlugin(), new ReactRefreshRspackPlugin()] : []),\n    ],\n    performance: false,\n  };\n\n  const serverConfig: RspackOptions = {\n    name: 'server',\n    mode,\n    target: 'node',\n    context: rootDir,\n    // In a build too, unlike the client's: the bundle is minified, and without a map every stack trace that\n    // reaches `onServerError` — the error-tracker funnel — is unmappable minified frames. A server map is\n    // never served to anyone; `dist/server` is not on a public path, and the runtime enables Node's own\n    // mapping so no host has to pass a flag.\n    devtool: 'source-map',\n    entry: { main: rscEntry },\n    output: {\n      path: join(rootDir, outDir, 'server'),\n      // Off in dev: route chunks are imported lazily, so a superseded one on disk is harmless where deleting\n      // one mid-request is not. `rshono dev` empties the directory on startup instead.\n      clean: !isDev,\n      module: true,\n      chunkFormat: 'module',\n      chunkLoading: 'import',\n      library: { type: 'module' },\n      filename: 'main.mjs',\n      chunkFilename: 'chunks/[name].mjs',\n      publicPath: '/_static/',\n      assetModuleFilename: 'assets/[name].[hash][ext]',\n    },\n    optimization: {\n      minimize: isDev ? false : true,\n    },\n    externalsType: 'module-import',\n    externals: [\n      ({ request, contextInfo }, callback) => {\n        if (\n          !request ||\n          isPathRequest(request) ||\n          request.startsWith('@/') ||\n          request.startsWith('@rshono/') ||\n          request.startsWith('builtin:') ||\n          request.includes('!') ||\n          BUNDLED_PACKAGES.test(request) ||\n          // Anything reached from the SSR layer, which is where `'use client'` components are rendered on the\n          // server. It has to be *compiled* rather than imported by name, because the env-shadow loader is what\n          // keeps a secret out of SSR'd HTML and a loader cannot run on a module the bundle only names — an\n          // externalized third-party client component is loaded raw at request time and reads the real\n          // `process.env`. Widening the loader's rule to cover `node_modules` did not reach this: there was no\n          // module for it to run on.\n          //\n          // Free of the usual bundling trade-off, too. Every module in this layer is in the *browser* bundle as\n          // well, so it is already required to be bundleable — a native addon or a `__dirname` file read could\n          // not have been a client component in the first place. The RSC layer, where server-only dependencies\n          // live, keeps the externals policy.\n          contextInfo?.issuerLayer === Layers.ssr\n        ) {\n          return callback();\n        }\n        callback(undefined, `module-import ${request}`);\n      },\n    ],\n    resolve: {\n      ...serverResolveBase,\n      alias: {\n        '@rshono/routes$': routesFile,\n        '@rshono/server-app$': serverAppAlias,\n        // Split on '/' so a preset can declare a POSIX-looking path and still resolve on Windows.\n        '@rshono/deploy$': join(FRAMEWORK_DIST, ...preset.runtimeModule.split('/')),\n        '@': srcDir,\n      },\n    },\n    module: {\n      rules: [\n        {\n          test: (resource: string) => pageFiles.has(resource),\n          enforce: 'pre',\n          use: [{ loader: join(FRAMEWORK_DIST, 'builder', 'page-entry-loader.cjs') }],\n        },\n        {\n          // Deliberately not scoped to `srcDir`: a `'use client'` component from `node_modules` is SSR'd in\n          // the same layer, and scoping this to the app's own source left those rendering against the real\n          // `process.env` while the browser bundle saw the `PUBLIC_`-only view — a hydration mismatch on\n          // anything the host sets, and a leak for anything secret. The loader's own layer check is what\n          // decides; every other module gets one `includes('process')` scan.\n          test: /\\.[cm]?[tj]sx?$/,\n          enforce: 'pre',\n          use: [\n            {\n              loader: join(FRAMEWORK_DIST, 'builder', 'env-shadow-loader.cjs'),\n              // `Object.create` over the real `process`, not a bare `{ env }`: the prelude shadows the whole\n              // binding for that module, and `react-dom/server` is in this layer too — anything reading\n              // `process.nextTick` or `process.platform` has to still find it. Not a `{ __proto__: … }`\n              // literal, whose meaning would change if a minifier ever quoted the key.\n              options: {\n                prelude: `const process = Object.assign(Object.create(globalThis.process ?? Object.prototype), { env: ${JSON.stringify(publicEnv(isDev))} }); `,\n                layer: Layers.ssr,\n                // Only the app's own source is warned about when it reaches `process` through the global\n                // object, which no prelude can shadow — a library feature-detecting `globalThis.process` is\n                // doing nothing wrong and has no app secret to read. The separator is part of the prefix so\n                // a sibling directory named `src-old` is not mistaken for it.\n                appSrcPrefix: srcDir + sep,\n              },\n            },\n          ],\n        },\n        swcRule([...(preset.syntaxTargets ?? NODE_TARGETS)]),\n        cssRule(),\n        {\n          test: /\\.(png|jpe?g|gif|webp|avif|ico|svg|woff2?|ttf|otf)$/i,\n          type: 'asset',\n          generator: { emit: false },\n        },\n        { resource: ssrEntry, layer: Layers.ssr },\n        {\n          resource: rscEntry,\n          layer: Layers.rsc,\n          resolve: { conditionNames: rscConditionNames },\n        },\n        {\n          issuerLayer: Layers.rsc,\n          exclude: ssrEntry,\n          resolve: { conditionNames: rscConditionNames },\n        },\n      ],\n    },\n    plugins: [\n      pageScanPlugin,\n      new ServerPlugin({ onServerComponentChanges }),\n      // Bakes rshono.config.ts into the bundle, read back as `__RSHONO_CONFIG__` at request time.\n      new rspack.DefinePlugin({\n        __RSHONO_CONFIG__: JSON.stringify(resolveServerConfig(config, { isDev, outDir, envBindings: preset.envBindings })),\n      }),\n    ],\n    performance: false,\n  };\n\n  // The platform's overrides first, then the user's hook — so an app can adjust whatever a preset decided.\n  preset.configureServer?.(serverConfig);\n\n  const rspackHook = config.rspack;\n  if (rspackHook) {\n    return [\n      rspackHook(clientConfig, { isServer: false, isDev }) ?? clientConfig,\n      rspackHook(serverConfig, { isServer: true, isDev }) ?? serverConfig,\n    ];\n  }\n  return [clientConfig, serverConfig];\n}\n"]}
+{"version":3,"file":"rspack-config.js","sourceRoot":"","sources":["../../src/builder/rspack-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAuD,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAGhE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,kGAAkG;AAClG,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACvD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AAElD,MAAM,gBAAgB,GAAG,wFAAwF,CAAC;AAElH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AACpC,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;AAErC;;;GAGG;AACH,MAAM,iBAAiB,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAEtD,+GAA+G;AAC/G,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QACrC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc;IACrB,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACxD,IAAI,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;QAChF,CAAC;IACH,CAAC;IACD,uFAAuF;IACvF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACjF,MAAM,YAAY,GAAG,CAAC,YAAY,CAAC,CAAC;AAEpC;;;;;;GAMG;AACH,SAAS,OAAO;IACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC/C,CAAC;AAYD,+GAA+G;AAC/G,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC;;;;;;;;GAQG;AACH,SAAS,QAAQ,CAAC,MAAc,EAAE,UAAkB;IAClD,IAAI,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/D,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjG,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oGAAoG;IACtG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAA4B;IACxD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,GAAG,OAAO,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;IAEnD,0GAA0G;IAC1G,2DAA2D;IAC3D,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE5B,MAAM,UAAU,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,iCAAiC,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/F,MAAM,cAAc,GAAG,aAAa,IAAI,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAC/F,2GAA2G;IAC3G,4GAA4G;IAC5G,sFAAsF;IACtF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CACV,yGAAyG;gBACvG,qGAAqG,CACxG,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YAC1C,wGAAwG;YACxG,wGAAwG;YACxG,yDAAyD;YACzD,OAAO,CAAC,IAAI,CACV,0GAA0G;gBACxG,qGAAqG;gBACrG,sGAAsG,CACzG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,CAAC,OAAiB,EAAe,EAAE,CAAC,CAAC;QACnD,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,mBAAmB;QAC5B,GAAG,EAAE;YACH,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE;gBACP,YAAY,EAAE,MAAM;gBACpB,GAAG,EAAE;oBACH,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;oBAClE,YAAY,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE;iBAC7C;gBACD,GAAG,EAAE,EAAE,OAAO,EAAE;gBAChB,iBAAiB,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE;aACnD;SACF;QACD,IAAI,EAAE,iBAAiB;KACxB,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG;QAClB,UAAU,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;QACnD,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;QACjD,OAAO,EAAE,cAAc,EAAE;KAC1B,CAAC;IAEF,uGAAuG;IACvG,yGAAyG;IACzG,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACzD,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,cAAc,EAAE,CAAC,GAAG,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IACzI,MAAM,iBAAiB,GAAG,CAAC,cAAc,EAAE,GAAG,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAExE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;IAC9E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC;IAE1C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,cAAc,GAAG;QACrB,KAAK,CAAC,QAAkB;YACtB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACnE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;YAC1D,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC;KACF,CAAC;IAEF,MAAM,YAAY,GAAkB;QAClC,IAAI,EAAE,QAAQ;QACd,IAAI;QACJ,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,OAAO;QAChB,wGAAwG;QACxG,kFAAkF;QAClF,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK;QACrC,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;QAC5B,MAAM,EAAE;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;YACrC,UAAU,EAAE,WAAW;YACvB,KAAK,EAAE,CAAC,KAAK;YACb,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,8BAA8B;YACnE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gCAAgC;YAC5E,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iCAAiC;YAC5E,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iCAAiC;YACjF,mBAAmB,EAAE,2BAA2B;SACjD;QACD,YAAY,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;SACtC;QACD,OAAO,EAAE;YACP,GAAG,WAAW;YACd,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;SACvB;QACD,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,sDAAsD,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;SAC9H;QACD,OAAO,EAAE;YACP,IAAI,YAAY,EAAE;YAClB,sBAAsB,CAAC,OAAO,CAAC;YAC/B,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,0BAA0B,EAAE,EAAE,IAAI,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F;QACD,WAAW,EAAE,KAAK;KACnB,CAAC;IAEF,MAAM,YAAY,GAAkB;QAClC,IAAI,EAAE,QAAQ;QACd,IAAI;QACJ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,OAAO;QAChB,wGAAwG;QACxG,sGAAsG;QACtG,oGAAoG;QACpG,yCAAyC;QACzC,OAAO,EAAE,YAAY;QACrB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,MAAM,EAAE;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;YACrC,uGAAuG;YACvG,iFAAiF;YACjF,KAAK,EAAE,CAAC,KAAK;YACb,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,QAAQ;YACtB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,mBAAmB;YAClC,UAAU,EAAE,WAAW;YACvB,mBAAmB,EAAE,2BAA2B;SACjD;QACD,YAAY,EAAE;YACZ,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;SAC/B;QACD,aAAa,EAAE,eAAe;QAC9B,SAAS,EAAE;YACT,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE;gBACrC,IACE,CAAC,OAAO;oBACR,aAAa,CAAC,OAAO,CAAC;oBACtB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;oBACxB,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;oBAC9B,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;oBAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;oBACrB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;oBAC9B,oGAAoG;oBACpG,sGAAsG;oBACtG,kGAAkG;oBAClG,6FAA6F;oBAC7F,qGAAqG;oBACrG,2BAA2B;oBAC3B,EAAE;oBACF,sGAAsG;oBACtG,qGAAqG;oBACrG,qGAAqG;oBACrG,oCAAoC;oBACpC,WAAW,EAAE,WAAW,KAAK,MAAM,CAAC,GAAG,EACvC,CAAC;oBACD,OAAO,QAAQ,EAAE,CAAC;gBACpB,CAAC;gBACD,QAAQ,CAAC,SAAS,EAAE,iBAAiB,OAAO,EAAE,CAAC,CAAC;YAClD,CAAC;SACF;QACD,OAAO,EAAE;YACP,GAAG,iBAAiB;YACpB,KAAK,EAAE;gBACL,iBAAiB,EAAE,UAAU;gBAC7B,qBAAqB,EAAE,cAAc;gBACrC,0FAA0F;gBAC1F,iBAAiB,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC3E,GAAG,EAAE,MAAM;aACZ;SACF;QACD,MAAM,EAAE;YACN,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;oBACnD,OAAO,EAAE,KAAK;oBACd,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,uBAAuB,CAAC,EAAE,CAAC;iBAC5E;gBACD;oBACE,kGAAkG;oBAClG,iGAAiG;oBACjG,+FAA+F;oBAC/F,+FAA+F;oBAC/F,mEAAmE;oBACnE,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,KAAK;oBACd,GAAG,EAAE;wBACH;4BACE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,uBAAuB,CAAC;4BAChE,+FAA+F;4BAC/F,0FAA0F;4BAC1F,0FAA0F;4BAC1F,yEAAyE;4BACzE,OAAO,EAAE;gCACP,OAAO,EAAE,+FAA+F,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO;gCAC/I,KAAK,EAAE,MAAM,CAAC,GAAG;gCACjB,6FAA6F;gCAC7F,2FAA2F;gCAC3F,2FAA2F;gCAC3F,OAAO,EAAE,IAAI;gCACb,yFAAyF;gCACzF,4FAA4F;gCAC5F,4FAA4F;gCAC5F,8DAA8D;gCAC9D,YAAY,EAAE,MAAM,GAAG,GAAG;6BAC3B;yBACF;qBACF;iBACF;gBACD,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,YAAY,CAAC,CAAC,CAAC;gBACpD,OAAO,EAAE;gBACT;oBACE,IAAI,EAAE,sDAAsD;oBAC5D,IAAI,EAAE,OAAO;oBACb,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;iBAC3B;gBACD,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE;gBACzC;oBACE,QAAQ,EAAE,QAAQ;oBAClB,KAAK,EAAE,MAAM,CAAC,GAAG;oBACjB,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE;iBAC/C;gBACD;oBACE,WAAW,EAAE,MAAM,CAAC,GAAG;oBACvB,OAAO,EAAE,QAAQ;oBACjB,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE;iBAC/C;aACF;SACF;QACD,OAAO,EAAE;YACP,cAAc;YACd,IAAI,YAAY,CAAC,EAAE,wBAAwB,EAAE,CAAC;YAC9C,4FAA4F;YAC5F,IAAI,MAAM,CAAC,YAAY,CAAC;gBACtB,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;aACnH,CAAC;SACH;QACD,WAAW,EAAE,KAAK;KACnB,CAAC;IAEF,yGAAyG;IACzG,MAAM,CAAC,eAAe,EAAE,CAAC,YAAY,CAAC,CAAC;IAEvC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACjC,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,UAAU,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,IAAI,YAAY;YACpE,UAAU,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,YAAY;SACpE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AACtC,CAAC","sourcesContent":["import { rspack, type Compiler, type RspackOptions, type RuleSetRule } from '@rspack/core';\nimport { ReactRefreshRspackPlugin } from '@rspack/plugin-react-refresh';\nimport { existsSync, readdirSync, readFileSync } from 'node:fs';\nimport { createRequire } from 'node:module';\nimport { basename, dirname, join, sep, win32 } from 'node:path';\nimport type { RshonoConfig } from '../config.js';\nimport type { DeployPreset } from '../deploy/presets.js';\nimport { resolveServerConfig } from '../server/server-config.js';\nimport { serverOnlyImportPlugin } from './server-only-imports.js';\nimport { scanPageFiles } from './page-files.js';\nimport { publicEnv } from './public-env.js';\nimport { checkReactVersions } from './react-versions.js';\n\n// This file lives in `dist/builder/`, so the entries and loaders below are the *built* framework.\nconst FRAMEWORK_DIST = join(import.meta.dirname, '..');\nconst FRAMEWORK_ROOT = join(FRAMEWORK_DIST, '..');\n\nconst BUNDLED_PACKAGES = /^(@rshono\\/core|react|react-dom|react-server-dom-rspack|hono|@hono\\/node-server)(\\/|$)/;\n\n/**\n * The directory a command writes its bundles to, relative to the project root — one per command, never\n * shared: a `rshono build` alongside a running `rshono dev` would `clean` away the route chunks that\n * server imports lazily, and Rspack's watch-mode emit never re-emits a file it believes it wrote.\n *\n * Both names are a single level under the root, which `deploy/filesystem.ts` relies on to derive the\n * project root from where the bundle ended up.\n */\nexport const BUILD_OUT_DIR = 'dist';\nexport const DEV_OUT_DIR = '.rshono';\n\n/**\n * Packages the app's source ends up importing without ever naming them: the RSC transform rewrites a\n * `'use client'` module, a page or an action into imports of the RSC runtime, resolved from the app's `src/`.\n */\nconst INJECTED_PACKAGES = ['react-server-dom-rspack'];\n\n/** The `node_modules` directory a resolved file sits in — `…/node_modules/pkg/index.js` → `…/node_modules`. */\nfunction enclosingNodeModules(file: string): string | undefined {\n  let dir = dirname(file);\n  while (basename(dir) !== 'node_modules') {\n    const parent = dirname(dir);\n    if (parent === dir) return undefined;\n    dir = parent;\n  }\n  return dir;\n}\n\n/**\n * Where packages are resolved from: the app's own `node_modules`, then the framework's — which is what makes\n * {@link INJECTED_PACKAGES} resolvable from app source under pnpm, where the framework's dependencies are\n * installed as siblings of `@rshono/core` rather than hoisted into the app's tree.\n *\n * Asking Node where the framework resolves the package finds it in any layout, and a search path rather than\n * an alias keeps the package's own `exports` conditions in play — the RSC layer, the SSR layer and each\n * deploy target need a different build of it.\n */\nfunction resolveModules(): string[] {\n  const require = createRequire(import.meta.url);\n  const dirs = new Set<string>();\n  for (const name of INJECTED_PACKAGES) {\n    try {\n      const dir = enclosingNodeModules(require.resolve(name));\n      if (dir) dirs.add(dir);\n    } catch {\n      // Left to the resolver to report against the request that actually needed it.\n    }\n  }\n  // A checkout or a vendored copy, where the framework has real dependencies of its own.\n  dirs.add(join(FRAMEWORK_ROOT, 'node_modules'));\n  return ['node_modules', ...dirs];\n}\n\n/**\n * Whether a request names a file rather than a package, and so belongs in the bundle.\n *\n * Rspack's RSC plugins ask for their proxies by absolute path, which on Windows carries a drive letter —\n * externalizing one emits an `import(\"D:\\\\…\")` Node rejects. `win32.isAbsolute` accepts the POSIX form too,\n * so it runs on every platform and the Windows shapes stay testable off Windows.\n */\nfunction isPathRequest(request: string): boolean {\n  return request.startsWith('.') || win32.isAbsolute(request);\n}\n\nconst BROWSER_TARGETS = ['last 2 versions', '> 0.2%', 'not dead', 'Firefox ESR'];\nconst NODE_TARGETS = ['node >= 22'];\n\n/**\n * Rspack's native CSS pipeline, which both compilers get. It parses *finished* CSS, so a stylesheet needing\n * PostCSS — Tailwind, most obviously — adds that loader through the {@link RshonoConfig.rspack} hook, which\n * keeps `postcss` a dependency of the apps that want one.\n *\n * A fresh object per compiler, so an app changing this rule does not silently change the other bundle's.\n */\nfunction cssRule(): RuleSetRule {\n  return { test: /\\.css$/i, type: 'css/auto' };\n}\n\nexport interface RspackConfigOptions {\n  rootDir: string;\n  isDev: boolean;\n  /** The project's resolved config — supplies the {@link RshonoConfig.rspack} hook and the runtime settings baked into the server bundle. */\n  config: RshonoConfig;\n  /** The platform being built for: decides the `@rshono/deploy` runtime and any server-compiler overrides. */\n  preset: DeployPreset;\n  onServerComponentChanges?: () => void;\n}\n\n/** Source files worth reading for {@link mentions} — the app's own code, whatever dialect it is written in. */\nconst SOURCE_FILE = /\\.[cm]?[jt]sx?$/;\n\n/**\n * Whether `identifier` appears anywhere in the app's own source. The whole tree rather than `src/server.ts`\n * alone, so middleware registered from a helper module counts.\n *\n * A textual scan on purpose. What is being answered is \"did the author think about this at all\", which is a\n * question a build warning is allowed to get wrong: the failure mode is a warning that is unwarranted, never a\n * build that fails or a behaviour that changes. Resolving it properly would mean reading the module graph, and\n * a middleware registered from a package outside `src/` would still slip past.\n */\nfunction mentions(srcDir: string, identifier: string): boolean {\n  try {\n    for (const entry of readdirSync(srcDir, { recursive: true, withFileTypes: true })) {\n      if (!entry.isFile() || !SOURCE_FILE.test(entry.name)) continue;\n      if (readFileSync(join(entry.parentPath, entry.name), 'utf8').includes(identifier)) return true;\n    }\n  } catch {\n    // An unreadable `src/` is not this function's to report: the build is about to fail on `routes.ts`.\n  }\n  return false;\n}\n\nexport function createConfigs(options: RspackConfigOptions): [RspackOptions, RspackOptions] {\n  const { rootDir, isDev, config, preset, onServerComponentChanges } = options;\n  const srcDir = join(rootDir, 'src');\n  const mode = isDev ? 'development' : 'production';\n  const outDir = isDev ? DEV_OUT_DIR : BUILD_OUT_DIR;\n\n  // Before anything is compiled: a react/react-dom split fails inside React at render time, and this is the\n  // one place that can say so with the two versions in hand.\n  checkReactVersions(rootDir);\n\n  const routesFile = ['routes.ts', 'routes.tsx'].map((f) => join(srcDir, f)).find(existsSync);\n  if (!routesFile) {\n    throw new Error(`[rshono] src/routes.ts not found in ${rootDir} — it is the one required file.`);\n  }\n  const serverAppFile = ['server.ts', 'server.tsx'].map((f) => join(srcDir, f)).find(existsSync);\n  const serverAppAlias = serverAppFile ?? join(FRAMEWORK_DIST, 'runtime', 'empty-server-app.js');\n  // Optional, and staying optional — but per-request security is Hono middleware registered there, so an app\n  // without one has opted out of all of it, which is worth hearing once rather than discovering. Builds only:\n  // `dev` would print it on every rebuild, and it is not news on a developer's machine.\n  if (!isDev) {\n    if (!serverAppFile) {\n      console.warn(\n        '  ⚠ No src/server.ts — this build has no CSRF check and no request body cap. Both are Hono middleware\\n' +\n          '    (`csrf()`, `bodyLimit()`); `npx @rshono/create` scaffolds a src/server.ts with them registered.',\n      );\n    } else if (!mentions(srcDir, 'bodyLimit')) {\n      // Having a src/server.ts is not the same as having the cap in it, and this half used to be warned about\n      // nowhere: every `'use server'` export is a public POST endpoint by design, and the action path buffers\n      // the whole body before it can decide anything about it.\n      console.warn(\n        \"  ⚠ No bodyLimit() anywhere in src/ — this build has no request body cap. Every 'use server' export is\\n\" +\n          '    a public POST endpoint, and the action path buffers whatever arrives before it can reject it.\\n' +\n          '    Add `server.use(bodyLimit({ maxSize: 1024 * 1024 }))` to src/server.ts (from `hono/body-limit`).',\n      );\n    }\n  }\n\n  const rscEntry = join(FRAMEWORK_DIST, 'runtime', 'entry.rsc.js');\n  const ssrEntry = join(FRAMEWORK_DIST, 'runtime', 'entry.ssr.js');\n  const clientEntry = join(FRAMEWORK_DIST, 'runtime', 'entry.client.js');\n\n  const swcRule = (targets: string[]): RuleSetRule => ({\n    test: /\\.[cm]?[jt]sx?$/,\n    exclude: /[\\\\/]core-js[\\\\/]/,\n    use: {\n      loader: 'builtin:swc-loader',\n      options: {\n        detectSyntax: 'auto',\n        jsc: {\n          transform: { react: { runtime: 'automatic', development: isDev } },\n          experimental: { keepImportAttributes: true },\n        },\n        env: { targets },\n        rspackExperiments: { reactServerComponents: true },\n      },\n    },\n    type: 'javascript/auto',\n  });\n\n  const resolveBase = {\n    extensions: ['.tsx', '.ts', '.jsx', '.js', '.json'],\n    extensionAlias: { '.js': ['.ts', '.tsx', '.js'] },\n    modules: resolveModules(),\n  };\n\n  // Ahead of whatever the Rspack target implies ('...'), which is what hands the server bundle the right\n  // build of React and the RSC runtime. Unset for Node, whose target already implies the `node` condition.\n  const runtimeConditions = preset.resolveConditions ?? [];\n  const serverResolveBase = runtimeConditions.length > 0 ? { ...resolveBase, conditionNames: [...runtimeConditions, '...'] } : resolveBase;\n  const rscConditionNames = ['react-server', ...runtimeConditions, '...'];\n\n  const { ServerPlugin, ClientPlugin } = rspack.experiments.rsc.createPlugins();\n  const { Layers } = rspack.experiments.rsc;\n\n  const pageFiles = new Set<string>();\n  scanPageFiles(routesFile, srcDir, pageFiles);\n  const pageScanPlugin = {\n    apply(compiler: Compiler) {\n      const refresh = () => scanPageFiles(routesFile, srcDir, pageFiles);\n      compiler.hooks.beforeRun.tap('rshono/page-scan', refresh);\n      compiler.hooks.watchRun.tap('rshono/page-scan', refresh);\n    },\n  };\n\n  const clientConfig: RspackOptions = {\n    name: 'client',\n    mode,\n    target: 'web',\n    context: rootDir,\n    // Never in a build: a client map is served from `/_static` like everything else beside it, and it would\n    // publish the original source of the app's own modules. Dev binds 127.0.0.1 only.\n    devtool: isDev ? 'source-map' : false,\n    entry: { main: clientEntry },\n    output: {\n      path: join(rootDir, outDir, 'static'),\n      publicPath: '/_static/',\n      clean: !isDev,\n      filename: isDev ? 'chunks/main.js' : 'chunks/main.[contenthash].js',\n      chunkFilename: isDev ? 'chunks/[name].js' : 'chunks/[name].[contenthash].js',\n      cssFilename: isDev ? 'chunks/[name].css' : 'chunks/[name].[contenthash].css',\n      cssChunkFilename: isDev ? 'chunks/[name].css' : 'chunks/[name].[contenthash].css',\n      assetModuleFilename: 'assets/[name].[hash][ext]',\n    },\n    optimization: {\n      moduleIds: isDev ? 'named' : 'hashed',\n    },\n    resolve: {\n      ...resolveBase,\n      alias: { '@': srcDir },\n    },\n    module: {\n      rules: [swcRule(BROWSER_TARGETS), cssRule(), { test: /\\.(png|jpe?g|gif|webp|avif|ico|svg|woff2?|ttf|otf)$/i, type: 'asset' }],\n    },\n    plugins: [\n      new ClientPlugin(),\n      serverOnlyImportPlugin(rootDir),\n      new rspack.DefinePlugin({ 'process.env': JSON.stringify(publicEnv(isDev)) }),\n      ...(isDev ? [new rspack.HotModuleReplacementPlugin(), new ReactRefreshRspackPlugin()] : []),\n    ],\n    performance: false,\n  };\n\n  const serverConfig: RspackOptions = {\n    name: 'server',\n    mode,\n    target: 'node',\n    context: rootDir,\n    // In a build too, unlike the client's: the bundle is minified, and without a map every stack trace that\n    // reaches `onServerError` — the error-tracker funnel — is unmappable minified frames. A server map is\n    // never served to anyone; `dist/server` is not on a public path, and the runtime enables Node's own\n    // mapping so no host has to pass a flag.\n    devtool: 'source-map',\n    entry: { main: rscEntry },\n    output: {\n      path: join(rootDir, outDir, 'server'),\n      // Off in dev: route chunks are imported lazily, so a superseded one on disk is harmless where deleting\n      // one mid-request is not. `rshono dev` empties the directory on startup instead.\n      clean: !isDev,\n      module: true,\n      chunkFormat: 'module',\n      chunkLoading: 'import',\n      library: { type: 'module' },\n      filename: 'main.mjs',\n      chunkFilename: 'chunks/[name].mjs',\n      publicPath: '/_static/',\n      assetModuleFilename: 'assets/[name].[hash][ext]',\n    },\n    optimization: {\n      minimize: isDev ? false : true,\n    },\n    externalsType: 'module-import',\n    externals: [\n      ({ request, contextInfo }, callback) => {\n        if (\n          !request ||\n          isPathRequest(request) ||\n          request.startsWith('@/') ||\n          request.startsWith('@rshono/') ||\n          request.startsWith('builtin:') ||\n          request.includes('!') ||\n          BUNDLED_PACKAGES.test(request) ||\n          // Anything reached from the SSR layer, which is where `'use client'` components are rendered on the\n          // server. It has to be *compiled* rather than imported by name, because the env-shadow loader is what\n          // keeps a secret out of SSR'd HTML and a loader cannot run on a module the bundle only names — an\n          // externalized third-party client component is loaded raw at request time and reads the real\n          // `process.env`. Widening the loader's rule to cover `node_modules` did not reach this: there was no\n          // module for it to run on.\n          //\n          // Free of the usual bundling trade-off, too. Every module in this layer is in the *browser* bundle as\n          // well, so it is already required to be bundleable — a native addon or a `__dirname` file read could\n          // not have been a client component in the first place. The RSC layer, where server-only dependencies\n          // live, keeps the externals policy.\n          contextInfo?.issuerLayer === Layers.ssr\n        ) {\n          return callback();\n        }\n        callback(undefined, `module-import ${request}`);\n      },\n    ],\n    resolve: {\n      ...serverResolveBase,\n      alias: {\n        '@rshono/routes$': routesFile,\n        '@rshono/server-app$': serverAppAlias,\n        // Split on '/' so a preset can declare a POSIX-looking path and still resolve on Windows.\n        '@rshono/deploy$': join(FRAMEWORK_DIST, ...preset.runtimeModule.split('/')),\n        '@': srcDir,\n      },\n    },\n    module: {\n      rules: [\n        {\n          test: (resource: string) => pageFiles.has(resource),\n          enforce: 'pre',\n          use: [{ loader: join(FRAMEWORK_DIST, 'builder', 'page-entry-loader.cjs') }],\n        },\n        {\n          // Deliberately not scoped to `srcDir`: a `'use client'` component from `node_modules` is SSR'd in\n          // the same layer, and scoping this to the app's own source left those rendering against the real\n          // `process.env` while the browser bundle saw the `PUBLIC_`-only view — a hydration mismatch on\n          // anything the host sets, and a leak for anything secret. The loader's own layer check is what\n          // decides; every other module gets one `includes('process')` scan.\n          test: /\\.[cm]?[tj]sx?$/,\n          enforce: 'pre',\n          use: [\n            {\n              loader: join(FRAMEWORK_DIST, 'builder', 'env-shadow-loader.cjs'),\n              // `Object.create` over the real `process`, not a bare `{ env }`: the prelude shadows the whole\n              // binding for that module, and `react-dom/server` is in this layer too — anything reading\n              // `process.nextTick` or `process.platform` has to still find it. Not a `{ __proto__: … }`\n              // literal, whose meaning would change if a minifier ever quoted the key.\n              options: {\n                prelude: `const process = Object.assign(Object.create(globalThis.process ?? Object.prototype), { env: ${JSON.stringify(publicEnv(isDev))} }); `,\n                layer: Layers.ssr,\n                // The prelude's binding hides `process.env.NODE_ENV` from DefinePlugin, which is what erases\n                // React's `if (NODE_ENV === 'production')` wrappers. The loader substitutes it back so the\n                // dead half still goes; without it the SSR layer ships both builds of every React package.\n                nodeEnv: mode,\n                // Only the app's own source is warned about when it reaches `process` through the global\n                // object, which no prelude can shadow — a library feature-detecting `globalThis.process` is\n                // doing nothing wrong and has no app secret to read. The separator is part of the prefix so\n                // a sibling directory named `src-old` is not mistaken for it.\n                appSrcPrefix: srcDir + sep,\n              },\n            },\n          ],\n        },\n        swcRule([...(preset.syntaxTargets ?? NODE_TARGETS)]),\n        cssRule(),\n        {\n          test: /\\.(png|jpe?g|gif|webp|avif|ico|svg|woff2?|ttf|otf)$/i,\n          type: 'asset',\n          generator: { emit: false },\n        },\n        { resource: ssrEntry, layer: Layers.ssr },\n        {\n          resource: rscEntry,\n          layer: Layers.rsc,\n          resolve: { conditionNames: rscConditionNames },\n        },\n        {\n          issuerLayer: Layers.rsc,\n          exclude: ssrEntry,\n          resolve: { conditionNames: rscConditionNames },\n        },\n      ],\n    },\n    plugins: [\n      pageScanPlugin,\n      new ServerPlugin({ onServerComponentChanges }),\n      // Bakes rshono.config.ts into the bundle, read back as `__RSHONO_CONFIG__` at request time.\n      new rspack.DefinePlugin({\n        __RSHONO_CONFIG__: JSON.stringify(resolveServerConfig(config, { isDev, outDir, envBindings: preset.envBindings })),\n      }),\n    ],\n    performance: false,\n  };\n\n  // The platform's overrides first, then the user's hook — so an app can adjust whatever a preset decided.\n  preset.configureServer?.(serverConfig);\n\n  const rspackHook = config.rspack;\n  if (rspackHook) {\n    return [\n      rspackHook(clientConfig, { isServer: false, isDev }) ?? clientConfig,\n      rspackHook(serverConfig, { isServer: true, isDev }) ?? serverConfig,\n    ];\n  }\n  return [clientConfig, serverConfig];\n}\n"]}

package/dist/builder/server-only-imports.d.ts

@@ -30,4 +30,3 @@ import type { Compiler } from '@rspack/core';
 export declare function serverOnlyImportPlugin(rootDir: string): {
     apply(compiler: Compiler): void;
 };
-//# sourceMappingURL=server-only-imports.d.ts.map

package/dist/cli/build.d.ts

@@ -8,4 +8,3 @@ interface BuildOptions {
 }
 export declare function buildCommand(options: BuildOptions): Promise<void>;
 export {};
-//# sourceMappingURL=build.d.ts.map

package/dist/cli/build.js

@@ -6,26 +6,7 @@ import { pathToFileURL } from 'node:url';
 import { BUILD_OUT_DIR, createConfigs } from '../builder/rspack-config.js';
 import { writeBuildMarker } from '../deploy/build-marker.js';
 import { prerenderStaticRoutes } from '../server/ssg.js';
-/**
- * Runs one phase of the build that the app itself can fail.
- *
- * A `[rshono]` message was written for whoever is running the build, so it is printed as the one line it is;
- * anything else is a bug in the framework and keeps its stack. Everything the app can get wrong arrives this
- * way — the two entry modules, checked in the bundle's module scope; each route's own module; and a page that
- * throws while prerendering.
- */
-async function phase(run) {
-    try {
-        return await run();
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        if (!message.startsWith('[rshono]'))
-            throw error;
-        console.error(`\n  ✗ ${message}\n`);
-        process.exit(1);
-    }
-}
+import { exit } from './exit.js';
 function importServerBundle(distDir) {
     return import(pathToFileURL(join(distDir, 'server', 'main.mjs')).href);
 }
@@ -47,7 +28,7 @@ export async function buildCommand(options) {
     });
     if (stats.hasErrors()) {
         console.error(stats.toString({ preset: 'errors-warnings', colors: true }));
-        process.exit(1);
+        return exit(1);
     }
     // Printed rather than left to the summary below, which counts warnings without saying what they are —
     // and one of them is the env shadow reporting a read it cannot cover. See `env-shadow-loader.cjs`.
@@ -55,9 +36,17 @@ export async function buildCommand(options) {
         console.warn(stats.toString({ preset: 'errors-warnings', colors: true }));
     console.log(stats.toString({ preset: 'summary', colors: true }));
     const publicDir = join(rootDir, 'public');
-    let distPublicDir = null;
+    // From scratch, and unconditionally, like every other directory this build assembles. `cpSync` only
+    // adds, so a file deleted from `public/` used to survive in `dist/public` and go on being served by
+    // `rshono start` for good — and deleting `public/` outright left the whole of the old tree there, since
+    // the copy below is the only thing that touches it. The two CDN presets clear their own output but read
+    // *this* directory, so a stale file propagated into their assets as well, past a comment promising it
+    // could not.
+    const distPublicDir = join(distDir, 'public');
+    await rm(distPublicDir, { recursive: true, force: true });
+    let servedPublicDir = null;
     if (existsSync(publicDir)) {
-        distPublicDir = join(distDir, 'public');
+        servedPublicDir = distPublicDir;
         cpSync(publicDir, distPublicDir, { recursive: true });
         console.log('  • copied public/ into dist/public (served at /)');
     }
@@ -65,19 +54,33 @@ export async function buildCommand(options) {
     await rm(ssgDir, { recursive: true, force: true });
     process.env.RSHONO_PRERENDER = '1';
     // The bundle's module scope is where `src/routes.ts` and `src/server.ts` are validated.
-    const bundle = await phase(() => importServerBundle(distDir));
+    //
+    // This and the two stages below are what the *app* can fail — the two entry modules here, each route's own
+    // module next, and a page that throws while prerendering after that. Each raises a `[rshono]` message
+    // written for whoever is running the build, and `main().catch` in `cli/index.ts` is what prints it as the
+    // one line it is. These used to be wrapped in a `phase()` helper that did the same thing three times and
+    // nowhere else, which left `createConfigs` above — where a missing `src/routes.ts` is found — printing a
+    // raw `Error` object with framework frames in it.
+    const bundle = await importServerBundle(distDir);
     // Before anything is rendered: the checks here are the ones a route fails on *every* request, so a build
     // that skipped them would spend the prerender pass on a route it is about to refuse anyway. Without this
     // they ran on first request instead, which meant a page that could never work shipped behind a green build.
-    await phase(() => bundle.checkRouteModules());
-    const { written, skipped } = await phase(() => prerenderStaticRoutes({
+    await bundle.checkAppModules();
+    const { written, skipped, flightOnly } = await prerenderStaticRoutes({
         routes: bundle.routes,
         fetch: (request) => bundle.app.fetch(request),
         ssgDir,
         siteUrl: config.siteUrl,
-    }));
-    if (written.length > 0)
-        console.log(`  • prerendered ${written.length} static page(s): ${written.join(', ')}`);
+    });
+    if (written.length > 0) {
+        // Marked per page rather than counted separately, so the line answers the question a reader has about
+        // each name in it: is this page served from disk? A page under a CSP nonce is half of one — its flight
+        // payload is, its document is re-rendered per request — and saying "prerendered" alone would claim more
+        // than the build did. The warning above says why, once.
+        const nonced = new Set(flightOnly);
+        const label = (path) => (nonced.has(path) ? `${path} (flight only)` : path);
+        console.log(`  • prerendered ${written.length} static page(s): ${written.map(label).join(', ')}`);
+    }
     if (skipped.length > 0)
         console.log(`  • skipped ${skipped.length} (will SSR per request)`);
     // Before `finalize`, so a preset that copies `dist/` into a platform layout takes it along.
@@ -87,14 +90,13 @@ export async function buildCommand(options) {
         rootDir,
         distDir,
         staticDir: join(distDir, 'static'),
-        publicDir: distPublicDir,
+        publicDir: servedPublicDir,
         ssgDir,
+        routes: bundle.routes,
     });
     console.log(`  ✓ build complete — ${preset.deployHint}`);
-    // Rspack's worker pool can keep the loop alive after `close()`, so the exit is explicit — but a piped
-    // stdout is asynchronous, and exiting drops whatever has not drained. In CI that is exactly the lines
-    // saying what was built and where it went. A zero-length write's callback fires behind the real ones.
-    await new Promise((resolve) => process.stdout.write('', () => resolve()));
-    process.exit(0);
+    // Rspack's worker pool can keep the loop alive after `close()`, so the exit is explicit. {@link exit}
+    // drains first: in CI the tail is the lines saying what was built and where it went.
+    await exit(0);
 }
 //# sourceMappingURL=build.js.map

package/dist/cli/build.js.map

@@ -1 +1 @@
-{"version":3,"file":"build.js","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAmB,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAG7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAiBzD;;;;;;;GAOG;AACH,KAAK,UAAU,KAAK,CAAI,GAAqB;IAC3C,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,MAAM,KAAK,CAAC;QACjD,OAAO,CAAC,KAAK,CAAC,SAAS,OAAO,IAAI,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAA0B,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqB;IACtD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAE7C,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAEjC,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9D,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YAC3B,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE;gBAClB,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,CAAC,MAAO,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,sGAAsG;IACtG,mGAAmG;IACnG,IAAI,KAAK,CAAC,WAAW,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEjE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,GAAG,CAAC;IACnC,wFAAwF;IACxF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IAE9D,yGAAyG;IACzG,yGAAyG;IACzG,4GAA4G;IAC5G,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAE9C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAC5C,qBAAqB,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7C,MAAM;QACN,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CACH,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,OAAO,CAAC,MAAM,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/G,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,MAAM,yBAAyB,CAAC,CAAC;IAE5F,4FAA4F;IAC5F,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAEvC,iFAAiF;IACjF,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO;QACP,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;QAClC,SAAS,EAAE,aAAa;QACxB,MAAM;KACP,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAEzD,sGAAsG;IACtG,sGAAsG;IACtG,sGAAsG;IACtG,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC","sourcesContent":["import { rspack, type MultiStats } from '@rspack/core';\nimport type { Hono } from 'hono';\nimport { cpSync, existsSync } from 'node:fs';\nimport { rm } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport { BUILD_OUT_DIR, createConfigs } from '../builder/rspack-config.js';\nimport type { RshonoConfig } from '../config.js';\nimport { writeBuildMarker } from '../deploy/build-marker.js';\nimport type { DeployPreset } from '../deploy/presets.js';\nimport type { Route } from '../router.js';\nimport { prerenderStaticRoutes } from '../server/ssg.js';\n\ninterface BuildOptions {\n  rootDir: string;\n  config: RshonoConfig;\n  /** The platform to build for, already resolved from the flag, the environment and the config. */\n  preset: DeployPreset;\n}\n\n/** What `rshono build` uses the app's own server bundle for, once it has compiled it. */\ninterface ServerBundle {\n  app: Hono;\n  routes: readonly Route[];\n  /** Resolves every route's own module and checks it — see `assertRouteModules`. */\n  checkRouteModules: () => Promise<void>;\n}\n\n/**\n * Runs one phase of the build that the app itself can fail.\n *\n * A `[rshono]` message was written for whoever is running the build, so it is printed as the one line it is;\n * anything else is a bug in the framework and keeps its stack. Everything the app can get wrong arrives this\n * way — the two entry modules, checked in the bundle's module scope; each route's own module; and a page that\n * throws while prerendering.\n */\nasync function phase<T>(run: () => Promise<T>): Promise<T> {\n  try {\n    return await run();\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    if (!message.startsWith('[rshono]')) throw error;\n    console.error(`\\n  ✗ ${message}\\n`);\n    process.exit(1);\n  }\n}\n\nfunction importServerBundle(distDir: string): Promise<ServerBundle> {\n  return import(pathToFileURL(join(distDir, 'server', 'main.mjs')).href) as Promise<ServerBundle>;\n}\n\nexport async function buildCommand(options: BuildOptions): Promise<void> {\n  const { rootDir, config, preset } = options;\n  const distDir = join(rootDir, BUILD_OUT_DIR);\n\n  console.log('  • building client + server bundles…');\n  const configs = createConfigs({ rootDir, isDev: false, config, preset });\n  const compiler = rspack(configs);\n\n  const stats = await new Promise<MultiStats>((resolve, reject) => {\n    compiler.run((err, result) => {\n      compiler.close(() => {\n        if (err) reject(err);\n        else resolve(result!);\n      });\n    });\n  });\n\n  if (stats.hasErrors()) {\n    console.error(stats.toString({ preset: 'errors-warnings', colors: true }));\n    process.exit(1);\n  }\n  // Printed rather than left to the summary below, which counts warnings without saying what they are —\n  // and one of them is the env shadow reporting a read it cannot cover. See `env-shadow-loader.cjs`.\n  if (stats.hasWarnings()) console.warn(stats.toString({ preset: 'errors-warnings', colors: true }));\n  console.log(stats.toString({ preset: 'summary', colors: true }));\n\n  const publicDir = join(rootDir, 'public');\n  let distPublicDir: string | null = null;\n  if (existsSync(publicDir)) {\n    distPublicDir = join(distDir, 'public');\n    cpSync(publicDir, distPublicDir, { recursive: true });\n    console.log('  • copied public/ into dist/public (served at /)');\n  }\n\n  const ssgDir = join(distDir, 'ssg');\n  await rm(ssgDir, { recursive: true, force: true });\n  process.env.RSHONO_PRERENDER = '1';\n  // The bundle's module scope is where `src/routes.ts` and `src/server.ts` are validated.\n  const bundle = await phase(() => importServerBundle(distDir));\n\n  // Before anything is rendered: the checks here are the ones a route fails on *every* request, so a build\n  // that skipped them would spend the prerender pass on a route it is about to refuse anyway. Without this\n  // they ran on first request instead, which meant a page that could never work shipped behind a green build.\n  await phase(() => bundle.checkRouteModules());\n\n  const { written, skipped } = await phase(() =>\n    prerenderStaticRoutes({\n      routes: bundle.routes,\n      fetch: (request) => bundle.app.fetch(request),\n      ssgDir,\n      siteUrl: config.siteUrl,\n    }),\n  );\n  if (written.length > 0) console.log(`  • prerendered ${written.length} static page(s): ${written.join(', ')}`);\n  if (skipped.length > 0) console.log(`  • skipped ${skipped.length} (will SSR per request)`);\n\n  // Before `finalize`, so a preset that copies `dist/` into a platform layout takes it along.\n  writeBuildMarker(distDir, preset.name);\n\n  // Last, so a preset arranging its output finds every piece of the build on disk.\n  await preset.finalize?.({\n    rootDir,\n    distDir,\n    staticDir: join(distDir, 'static'),\n    publicDir: distPublicDir,\n    ssgDir,\n  });\n\n  console.log(`  ✓ build complete — ${preset.deployHint}`);\n\n  // Rspack's worker pool can keep the loop alive after `close()`, so the exit is explicit — but a piped\n  // stdout is asynchronous, and exiting drops whatever has not drained. In CI that is exactly the lines\n  // saying what was built and where it went. A zero-length write's callback fires behind the real ones.\n  await new Promise<void>((resolve) => process.stdout.write('', () => resolve()));\n  process.exit(0);\n}\n"]}
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAmB,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAG7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAiBjC,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAA0B,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqB;IACtD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAE7C,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAEjC,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9D,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YAC3B,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE;gBAClB,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,CAAC,MAAO,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,sGAAsG;IACtG,mGAAmG;IACnG,IAAI,KAAK,CAAC,WAAW,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEjE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1C,oGAAoG;IACpG,oGAAoG;IACpG,wGAAwG;IACxG,wGAAwG;IACxG,sGAAsG;IACtG,aAAa;IACb,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,eAAe,GAAG,aAAa,CAAC;QAChC,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,GAAG,CAAC;IACnC,wFAAwF;IACxF,EAAE;IACF,2GAA2G;IAC3G,sGAAsG;IACtG,0GAA0G;IAC1G,yGAAyG;IACzG,yGAAyG;IACzG,kDAAkD;IAClD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEjD,yGAAyG;IACzG,yGAAyG;IACzG,4GAA4G;IAC5G,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;IAE/B,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,qBAAqB,CAAC;QACnE,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7C,MAAM;QACN,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,sGAAsG;QACtG,uGAAuG;QACvG,wGAAwG;QACxG,wDAAwD;QACxD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpF,OAAO,CAAC,GAAG,CAAC,mBAAmB,OAAO,CAAC,MAAM,oBAAoB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,CAAC,MAAM,yBAAyB,CAAC,CAAC;IAE5F,4FAA4F;IAC5F,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAEvC,iFAAiF;IACjF,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO;QACP,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;QAClC,SAAS,EAAE,eAAe;QAC1B,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAEzD,sGAAsG;IACtG,qFAAqF;IACrF,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC","sourcesContent":["import { rspack, type MultiStats } from '@rspack/core';\nimport type { Hono } from 'hono';\nimport { cpSync, existsSync } from 'node:fs';\nimport { rm } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport { BUILD_OUT_DIR, createConfigs } from '../builder/rspack-config.js';\nimport type { RshonoConfig } from '../config.js';\nimport { writeBuildMarker } from '../deploy/build-marker.js';\nimport type { DeployPreset } from '../deploy/presets.js';\nimport type { Route } from '../router.js';\nimport { prerenderStaticRoutes } from '../server/ssg.js';\nimport { exit } from './exit.js';\n\ninterface BuildOptions {\n  rootDir: string;\n  config: RshonoConfig;\n  /** The platform to build for, already resolved from the flag, the environment and the config. */\n  preset: DeployPreset;\n}\n\n/** What `rshono build` uses the app's own server bundle for, once it has compiled it. */\ninterface ServerBundle {\n  app: Hono;\n  routes: readonly Route[];\n  /** Resolves every route's own module, and the app's server actions, and checks them — see `checkAppModules`. */\n  checkAppModules: () => Promise<void>;\n}\n\nfunction importServerBundle(distDir: string): Promise<ServerBundle> {\n  return import(pathToFileURL(join(distDir, 'server', 'main.mjs')).href) as Promise<ServerBundle>;\n}\n\nexport async function buildCommand(options: BuildOptions): Promise<void> {\n  const { rootDir, config, preset } = options;\n  const distDir = join(rootDir, BUILD_OUT_DIR);\n\n  console.log('  • building client + server bundles…');\n  const configs = createConfigs({ rootDir, isDev: false, config, preset });\n  const compiler = rspack(configs);\n\n  const stats = await new Promise<MultiStats>((resolve, reject) => {\n    compiler.run((err, result) => {\n      compiler.close(() => {\n        if (err) reject(err);\n        else resolve(result!);\n      });\n    });\n  });\n\n  if (stats.hasErrors()) {\n    console.error(stats.toString({ preset: 'errors-warnings', colors: true }));\n    return exit(1);\n  }\n  // Printed rather than left to the summary below, which counts warnings without saying what they are —\n  // and one of them is the env shadow reporting a read it cannot cover. See `env-shadow-loader.cjs`.\n  if (stats.hasWarnings()) console.warn(stats.toString({ preset: 'errors-warnings', colors: true }));\n  console.log(stats.toString({ preset: 'summary', colors: true }));\n\n  const publicDir = join(rootDir, 'public');\n  // From scratch, and unconditionally, like every other directory this build assembles. `cpSync` only\n  // adds, so a file deleted from `public/` used to survive in `dist/public` and go on being served by\n  // `rshono start` for good — and deleting `public/` outright left the whole of the old tree there, since\n  // the copy below is the only thing that touches it. The two CDN presets clear their own output but read\n  // *this* directory, so a stale file propagated into their assets as well, past a comment promising it\n  // could not.\n  const distPublicDir = join(distDir, 'public');\n  await rm(distPublicDir, { recursive: true, force: true });\n  let servedPublicDir: string | null = null;\n  if (existsSync(publicDir)) {\n    servedPublicDir = distPublicDir;\n    cpSync(publicDir, distPublicDir, { recursive: true });\n    console.log('  • copied public/ into dist/public (served at /)');\n  }\n\n  const ssgDir = join(distDir, 'ssg');\n  await rm(ssgDir, { recursive: true, force: true });\n  process.env.RSHONO_PRERENDER = '1';\n  // The bundle's module scope is where `src/routes.ts` and `src/server.ts` are validated.\n  //\n  // This and the two stages below are what the *app* can fail — the two entry modules here, each route's own\n  // module next, and a page that throws while prerendering after that. Each raises a `[rshono]` message\n  // written for whoever is running the build, and `main().catch` in `cli/index.ts` is what prints it as the\n  // one line it is. These used to be wrapped in a `phase()` helper that did the same thing three times and\n  // nowhere else, which left `createConfigs` above — where a missing `src/routes.ts` is found — printing a\n  // raw `Error` object with framework frames in it.\n  const bundle = await importServerBundle(distDir);\n\n  // Before anything is rendered: the checks here are the ones a route fails on *every* request, so a build\n  // that skipped them would spend the prerender pass on a route it is about to refuse anyway. Without this\n  // they ran on first request instead, which meant a page that could never work shipped behind a green build.\n  await bundle.checkAppModules();\n\n  const { written, skipped, flightOnly } = await prerenderStaticRoutes({\n    routes: bundle.routes,\n    fetch: (request) => bundle.app.fetch(request),\n    ssgDir,\n    siteUrl: config.siteUrl,\n  });\n  if (written.length > 0) {\n    // Marked per page rather than counted separately, so the line answers the question a reader has about\n    // each name in it: is this page served from disk? A page under a CSP nonce is half of one — its flight\n    // payload is, its document is re-rendered per request — and saying \"prerendered\" alone would claim more\n    // than the build did. The warning above says why, once.\n    const nonced = new Set(flightOnly);\n    const label = (path: string) => (nonced.has(path) ? `${path} (flight only)` : path);\n    console.log(`  • prerendered ${written.length} static page(s): ${written.map(label).join(', ')}`);\n  }\n  if (skipped.length > 0) console.log(`  • skipped ${skipped.length} (will SSR per request)`);\n\n  // Before `finalize`, so a preset that copies `dist/` into a platform layout takes it along.\n  writeBuildMarker(distDir, preset.name);\n\n  // Last, so a preset arranging its output finds every piece of the build on disk.\n  await preset.finalize?.({\n    rootDir,\n    distDir,\n    staticDir: join(distDir, 'static'),\n    publicDir: servedPublicDir,\n    ssgDir,\n    routes: bundle.routes,\n  });\n\n  console.log(`  ✓ build complete — ${preset.deployHint}`);\n\n  // Rspack's worker pool can keep the loop alive after `close()`, so the exit is explicit. {@link exit}\n  // drains first: in CI the tail is the lines saying what was built and where it went.\n  await exit(0);\n}\n"]}