@rshono/core 1.0.0-rc.19 → 1.0.0-rc.20

package/dist/deploy/cloudflare/runtime.js

@@ -1,3 +1,4 @@
+import { ASSET_MISS_CACHE_CONTROL } from '../../server/headers.js';
 import { createPageCache, ssgAssetPath, ssgFilePath, SSG_MANIFEST_FILE, toPrerenderedPage } from '../../server/prerendered.js';
 /**
  * Where `finalize` puts the prerendered pages inside the assets directory.
@@ -69,12 +70,33 @@ export const runtime = {
         // Normally dead — the CDN answers `/_static/*` before the worker is invoked — but keeps the deployment
         // correct, if slower, under an assets configuration that routes everything to the worker first.
         // `GET` covers `HEAD` — Hono dispatches one as the other. See `HTTPMethod`.
-        app.get('/_static/*', async (c, next) => {
+        //
+        // Terminal, like the filesystem mount's last handler, and this used to be `next()`: a miss walked the
+        // whole route table, then `mountPublicFallback`, and landed in `app.notFound` — which for anything asking
+        // for HTML is a full server render of the app's 404 page under a prefix no app can own. A browser asking
+        // for a real subresource sends `Accept: */*` and got the plain 404 either way, so what it cost was a
+        // render for a crawler, a probe, or a hand-typed URL. `RESERVED_PREFIX`'s doc in `validate-entries.ts`
+        // says the mount ends in a terminal 404 and the reserved-route check leans on it; on this target it did
+        // not. `null` — no assets binding at all — answers the same way: nothing else in the worker can serve
+        // this prefix, so falling through would only find a longer route to the same status.
+        app.get('/_static/*', async (c) => {
             const asset = await assetResponse(c, c.req.path, c.req.raw.headers);
-            return asset && asset.status !== 404 ? serveAsset(asset) : next();
+            if (asset && asset.status !== 404)
+                return serveAsset(asset);
+            return c.text('Not Found', 404, { 'cache-control': ASSET_MISS_CACHE_CONTROL });
         });
     },
     mountPublicFallback(app) {
+        // Live here and a no-op on `vercel`, which is the whole difference between the two CDN targets and is
+        // written up on {@link DeployRuntime.mountPublicFallback}. Normally dead for the same reason the
+        // `/_static` mount above is — the CDN answers first — but `public/` is in the *same* binding this can
+        // read, so an assets configuration that routes to the worker first keeps its files instead of losing
+        // them. Vercel has nothing equivalent: `public/` went into the static output and is not uploaded with
+        // the function, so there is nothing there for a mount to answer from.
+        //
+        // Registered after every route, so inside the worker a route still beats a `public/` file — the
+        // ordering the contract describes, reached on the one target whose CDN can be told to stand aside. At
+        // the CDN the file wins, which is what `publicRouteCollisions` warns about at build time.
         app.get('/*', async (c, next) => {
             // The prerender tree lives in the same store, but the app only serves it through `readPrerendered`.
             if (c.req.path.startsWith(`${SSG_PREFIX}/`))

package/dist/deploy/cloudflare/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/deploy/cloudflare/runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAwB,MAAM,6BAA6B,CAAC;AAGrJ;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,QAAQ,CAAC;AAO5B,SAAS,aAAa,CAAC,CAAU;IAC/B,MAAM,OAAO,GAAI,CAAC,CAAC,GAA8C,EAAE,MAAM,CAAC;IAC1E,OAAO,OAAO,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAAC,CAAU,EAAE,IAAY,EAAE,OAAiB;IACtE,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,0GAA0G;IAC1G,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,KAAe;IACjC,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,oGAAoG;AACpG,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;AAEpC,iGAAiG;AACjG,IAAI,UAA2D,CAAC;AAEhE;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,CAAU;IAC5B,UAAU,KAAK,aAAa,CAAC,CAAC,EAAE,GAAG,UAAU,IAAI,iBAAiB,EAAE,CAAC;SAClE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACpB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,QAAQ,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAyB,CAAC;QAC9D,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAkB;IACpC,QAAQ,CAAC,GAAS;QAChB,4FAA4F;QAC5F,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,iBAAiB,CAAC,GAAS;QACzB,uGAAuG;QACvG,gGAAgG;QAChG,4EAA4E;QAC5E,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACtC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpE,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB,CAAC,GAAS;QAC3B,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC9B,oGAAoG;YACpG,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpE,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,CAAU,EAAE,OAAO;QACvC,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAElC,MAAM,GAAG,GAAG,GAAG,OAAO,KAAK,OAAO,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAE9C,sGAAsG;QACtG,mFAAmF;QACnF,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,GAAG,UAAU,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAEhD,uFAAuF;QACvF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3G,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,uGAAuG;QACvG,kBAAkB;IACpB,CAAC;CACF,CAAC","sourcesContent":["import type { Context, Hono } from 'hono';\nimport { createPageCache, ssgAssetPath, ssgFilePath, SSG_MANIFEST_FILE, toPrerenderedPage, type PrerenderedPage } from '../../server/prerendered.js';\nimport type { DeployRuntime } from '../contract.js';\n\n/**\n * Where `finalize` puts the prerendered pages inside the assets directory.\n *\n * A prefix of its own, rather than the pages' real URLs, is what keeps every page URL reaching the worker: one\n * URL answers with a document or a flight payload on the `RSC` request header, and a path-keyed CDN cannot make that\n * choice. The tree is reachable here too, so `finalize` marks it `noindex` rather than leaving a crawler to\n * find the same page twice.\n */\nconst SSG_PREFIX = '/__ssg';\n\n/** The Workers Assets binding, as much of it as this file uses. */\ninterface AssetsBinding {\n  fetch(request: Request): Promise<Response>;\n}\n\nfunction assetsBinding(c: Context): AssetsBinding | null {\n  const binding = (c.env as { ASSETS?: AssetsBinding } | undefined)?.ASSETS;\n  return binding && typeof binding.fetch === 'function' ? binding : null;\n}\n\n/**\n * Asks the assets binding for one path, or `null` when there is no binding — which is how a caller tells \"this\n * deployment serves its assets some other way\" from \"that file is not there\".\n *\n * `headers` is forwarded only where the *client's* conditional and range requests should be answered by the\n * store: an `If-None-Match` on a page being fetched to serve would come back 304 with no body.\n */\nasync function assetResponse(c: Context, path: string, headers?: Headers): Promise<Response | null> {\n  const binding = assetsBinding(c);\n  if (!binding) return null;\n  // Resolved against the request so the lookup carries this deployment's own origin; only the path is used.\n  const url = new URL(path, c.req.url);\n  return binding.fetch(new Request(url, { method: 'GET', headers }));\n}\n\n/**\n * Hands an asset response back as the app's own. Rebuilt rather than returned as-is, because a `Response` from\n * `fetch` has immutable headers and the framework's outermost middleware writes to them on the way out.\n */\nfunction serveAsset(asset: Response): Response {\n  return new Response(asset.body, asset);\n}\n\n/** Prerendered pages, keyed by the path that produced them. Per isolate rather than per process. */\nconst pageCache = createPageCache();\n\n/** The store's own index of itself, fetched once per isolate — see {@link SSG_MANIFEST_FILE}. */\nlet storeIndex: Promise<ReadonlySet<string> | null> | undefined;\n\n/**\n * What the store holds, or `null` where there is no manifest to read — an older build, or a deployment with\n * no assets binding at all. `null` gates nothing, which is how it behaved before there was an index.\n *\n * Worth one fetch per isolate: without it every request for a path the build did not prerender spends a\n * subrequest asking the binding for a file that is not there, and misses are deliberately not cached.\n */\nfunction knownFiles(c: Context): Promise<ReadonlySet<string> | null> {\n  storeIndex ??= assetResponse(c, `${SSG_PREFIX}/${SSG_MANIFEST_FILE}`)\n    .then(async (asset) => {\n      if (!asset || asset.status !== 200) return null;\n      const manifest = (await asset.json()) as { files?: string[] };\n      return new Set(manifest.files ?? []);\n    })\n    .catch(() => null);\n  return storeIndex;\n}\n\n/**\n * Cloudflare Workers: the host owns the process, so there is nothing to listen on, and there is no filesystem,\n * so `.env` files are out. What is left is the assets binding, which every read here goes through.\n */\nexport const runtime: DeployRuntime = {\n  serveApp(app: Hono): unknown {\n    // `app.fetch` already takes `(request, env, ctx)`, which is why bindings arrive as `c.env`.\n    return { fetch: app.fetch };\n  },\n\n  mountStaticAssets(app: Hono): void {\n    // Normally dead — the CDN answers `/_static/*` before the worker is invoked — but keeps the deployment\n    // correct, if slower, under an assets configuration that routes everything to the worker first.\n    // `GET` covers `HEAD` — Hono dispatches one as the other. See `HTTPMethod`.\n    app.get('/_static/*', async (c, next) => {\n      const asset = await assetResponse(c, c.req.path, c.req.raw.headers);\n      return asset && asset.status !== 404 ? serveAsset(asset) : next();\n    });\n  },\n\n  mountPublicFallback(app: Hono): void {\n    app.get('/*', async (c, next) => {\n      // The prerender tree lives in the same store, but the app only serves it through `readPrerendered`.\n      if (c.req.path.startsWith(`${SSG_PREFIX}/`)) return next();\n      const asset = await assetResponse(c, c.req.path, c.req.raw.headers);\n      return asset && asset.status !== 404 ? serveAsset(asset) : next();\n    });\n  },\n\n  async readPrerendered(c: Context, variant): Promise<PrerenderedPage | null> {\n    const relPath = ssgFilePath(c.req.path, variant);\n    if (relPath === null) return null;\n\n    const key = `${variant}\\0${relPath}`;\n    const cached = pageCache.get(key);\n    if (cached) return cached;\n\n    const index = await knownFiles(c);\n    if (index && !index.has(relPath)) return null;\n\n    // Escaped on the way into the URL and decoded again by the store, so this lands on the file the build\n    // wrote under exactly `relPath` — a page whose slug holds a `#` or a `?` included.\n    const asset = await assetResponse(c, `${SSG_PREFIX}/${ssgAssetPath(relPath)}`);\n    if (!asset || asset.status !== 200) return null;\n\n    // The store's own validator where it has one — it already describes these exact bytes.\n    const page = await toPrerenderedPage(new Uint8Array(await asset.arrayBuffer()), asset.headers.get('etag'));\n    pageCache.set(key, page);\n    return page;\n  },\n\n  loadEnv(): void {\n    // Nothing to load: secrets and bindings arrive per request as `c.env`, which `getRequestContext().env`\n    // already merges.\n  },\n};\n"]}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/deploy/cloudflare/runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAwB,MAAM,6BAA6B,CAAC;AAGrJ;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,QAAQ,CAAC;AAO5B,SAAS,aAAa,CAAC,CAAU;IAC/B,MAAM,OAAO,GAAI,CAAC,CAAC,GAA8C,EAAE,MAAM,CAAC;IAC1E,OAAO,OAAO,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAAC,CAAU,EAAE,IAAY,EAAE,OAAiB;IACtE,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,0GAA0G;IAC1G,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,KAAe;IACjC,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,oGAAoG;AACpG,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;AAEpC,iGAAiG;AACjG,IAAI,UAA2D,CAAC;AAEhE;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,CAAU;IAC5B,UAAU,KAAK,aAAa,CAAC,CAAC,EAAE,GAAG,UAAU,IAAI,iBAAiB,EAAE,CAAC;SAClE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACpB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,QAAQ,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAyB,CAAC;QAC9D,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAkB;IACpC,QAAQ,CAAC,GAAS;QAChB,4FAA4F;QAC5F,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,iBAAiB,CAAC,GAAS;QACzB,uGAAuG;QACvG,gGAAgG;QAChG,4EAA4E;QAC5E,EAAE;QACF,sGAAsG;QACtG,0GAA0G;QAC1G,yGAAyG;QACzG,qGAAqG;QACrG,uGAAuG;QACvG,wGAAwG;QACxG,sGAAsG;QACtG,qFAAqF;QACrF,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpE,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;YAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,eAAe,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB,CAAC,GAAS;QAC3B,sGAAsG;QACtG,iGAAiG;QACjG,sGAAsG;QACtG,qGAAqG;QACrG,sGAAsG;QACtG,sEAAsE;QACtE,EAAE;QACF,gGAAgG;QAChG,sGAAsG;QACtG,0FAA0F;QAC1F,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC9B,oGAAoG;YACpG,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpE,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,CAAU,EAAE,OAAO;QACvC,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAElC,MAAM,GAAG,GAAG,GAAG,OAAO,KAAK,OAAO,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAE9C,sGAAsG;QACtG,mFAAmF;QACnF,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,GAAG,UAAU,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAEhD,uFAAuF;QACvF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3G,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,uGAAuG;QACvG,kBAAkB;IACpB,CAAC;CACF,CAAC","sourcesContent":["import type { Context, Hono } from 'hono';\nimport { ASSET_MISS_CACHE_CONTROL } from '../../server/headers.js';\nimport { createPageCache, ssgAssetPath, ssgFilePath, SSG_MANIFEST_FILE, toPrerenderedPage, type PrerenderedPage } from '../../server/prerendered.js';\nimport type { DeployRuntime } from '../contract.js';\n\n/**\n * Where `finalize` puts the prerendered pages inside the assets directory.\n *\n * A prefix of its own, rather than the pages' real URLs, is what keeps every page URL reaching the worker: one\n * URL answers with a document or a flight payload on the `RSC` request header, and a path-keyed CDN cannot make that\n * choice. The tree is reachable here too, so `finalize` marks it `noindex` rather than leaving a crawler to\n * find the same page twice.\n */\nconst SSG_PREFIX = '/__ssg';\n\n/** The Workers Assets binding, as much of it as this file uses. */\ninterface AssetsBinding {\n  fetch(request: Request): Promise<Response>;\n}\n\nfunction assetsBinding(c: Context): AssetsBinding | null {\n  const binding = (c.env as { ASSETS?: AssetsBinding } | undefined)?.ASSETS;\n  return binding && typeof binding.fetch === 'function' ? binding : null;\n}\n\n/**\n * Asks the assets binding for one path, or `null` when there is no binding — which is how a caller tells \"this\n * deployment serves its assets some other way\" from \"that file is not there\".\n *\n * `headers` is forwarded only where the *client's* conditional and range requests should be answered by the\n * store: an `If-None-Match` on a page being fetched to serve would come back 304 with no body.\n */\nasync function assetResponse(c: Context, path: string, headers?: Headers): Promise<Response | null> {\n  const binding = assetsBinding(c);\n  if (!binding) return null;\n  // Resolved against the request so the lookup carries this deployment's own origin; only the path is used.\n  const url = new URL(path, c.req.url);\n  return binding.fetch(new Request(url, { method: 'GET', headers }));\n}\n\n/**\n * Hands an asset response back as the app's own. Rebuilt rather than returned as-is, because a `Response` from\n * `fetch` has immutable headers and the framework's outermost middleware writes to them on the way out.\n */\nfunction serveAsset(asset: Response): Response {\n  return new Response(asset.body, asset);\n}\n\n/** Prerendered pages, keyed by the path that produced them. Per isolate rather than per process. */\nconst pageCache = createPageCache();\n\n/** The store's own index of itself, fetched once per isolate — see {@link SSG_MANIFEST_FILE}. */\nlet storeIndex: Promise<ReadonlySet<string> | null> | undefined;\n\n/**\n * What the store holds, or `null` where there is no manifest to read — an older build, or a deployment with\n * no assets binding at all. `null` gates nothing, which is how it behaved before there was an index.\n *\n * Worth one fetch per isolate: without it every request for a path the build did not prerender spends a\n * subrequest asking the binding for a file that is not there, and misses are deliberately not cached.\n */\nfunction knownFiles(c: Context): Promise<ReadonlySet<string> | null> {\n  storeIndex ??= assetResponse(c, `${SSG_PREFIX}/${SSG_MANIFEST_FILE}`)\n    .then(async (asset) => {\n      if (!asset || asset.status !== 200) return null;\n      const manifest = (await asset.json()) as { files?: string[] };\n      return new Set(manifest.files ?? []);\n    })\n    .catch(() => null);\n  return storeIndex;\n}\n\n/**\n * Cloudflare Workers: the host owns the process, so there is nothing to listen on, and there is no filesystem,\n * so `.env` files are out. What is left is the assets binding, which every read here goes through.\n */\nexport const runtime: DeployRuntime = {\n  serveApp(app: Hono): unknown {\n    // `app.fetch` already takes `(request, env, ctx)`, which is why bindings arrive as `c.env`.\n    return { fetch: app.fetch };\n  },\n\n  mountStaticAssets(app: Hono): void {\n    // Normally dead — the CDN answers `/_static/*` before the worker is invoked — but keeps the deployment\n    // correct, if slower, under an assets configuration that routes everything to the worker first.\n    // `GET` covers `HEAD` — Hono dispatches one as the other. See `HTTPMethod`.\n    //\n    // Terminal, like the filesystem mount's last handler, and this used to be `next()`: a miss walked the\n    // whole route table, then `mountPublicFallback`, and landed in `app.notFound` — which for anything asking\n    // for HTML is a full server render of the app's 404 page under a prefix no app can own. A browser asking\n    // for a real subresource sends `Accept: */*` and got the plain 404 either way, so what it cost was a\n    // render for a crawler, a probe, or a hand-typed URL. `RESERVED_PREFIX`'s doc in `validate-entries.ts`\n    // says the mount ends in a terminal 404 and the reserved-route check leans on it; on this target it did\n    // not. `null` — no assets binding at all — answers the same way: nothing else in the worker can serve\n    // this prefix, so falling through would only find a longer route to the same status.\n    app.get('/_static/*', async (c) => {\n      const asset = await assetResponse(c, c.req.path, c.req.raw.headers);\n      if (asset && asset.status !== 404) return serveAsset(asset);\n      return c.text('Not Found', 404, { 'cache-control': ASSET_MISS_CACHE_CONTROL });\n    });\n  },\n\n  mountPublicFallback(app: Hono): void {\n    // Live here and a no-op on `vercel`, which is the whole difference between the two CDN targets and is\n    // written up on {@link DeployRuntime.mountPublicFallback}. Normally dead for the same reason the\n    // `/_static` mount above is — the CDN answers first — but `public/` is in the *same* binding this can\n    // read, so an assets configuration that routes to the worker first keeps its files instead of losing\n    // them. Vercel has nothing equivalent: `public/` went into the static output and is not uploaded with\n    // the function, so there is nothing there for a mount to answer from.\n    //\n    // Registered after every route, so inside the worker a route still beats a `public/` file — the\n    // ordering the contract describes, reached on the one target whose CDN can be told to stand aside. At\n    // the CDN the file wins, which is what `publicRouteCollisions` warns about at build time.\n    app.get('/*', async (c, next) => {\n      // The prerender tree lives in the same store, but the app only serves it through `readPrerendered`.\n      if (c.req.path.startsWith(`${SSG_PREFIX}/`)) return next();\n      const asset = await assetResponse(c, c.req.path, c.req.raw.headers);\n      return asset && asset.status !== 404 ? serveAsset(asset) : next();\n    });\n  },\n\n  async readPrerendered(c: Context, variant): Promise<PrerenderedPage | null> {\n    const relPath = ssgFilePath(c.req.path, variant);\n    if (relPath === null) return null;\n\n    const key = `${variant}\\0${relPath}`;\n    const cached = pageCache.get(key);\n    if (cached) return cached;\n\n    const index = await knownFiles(c);\n    if (index && !index.has(relPath)) return null;\n\n    // Escaped on the way into the URL and decoded again by the store, so this lands on the file the build\n    // wrote under exactly `relPath` — a page whose slug holds a `#` or a `?` included.\n    const asset = await assetResponse(c, `${SSG_PREFIX}/${ssgAssetPath(relPath)}`);\n    if (!asset || asset.status !== 200) return null;\n\n    // The store's own validator where it has one — it already describes these exact bytes.\n    const page = await toPrerenderedPage(new Uint8Array(await asset.arrayBuffer()), asset.headers.get('etag'));\n    pageCache.set(key, page);\n    return page;\n  },\n\n  loadEnv(): void {\n    // Nothing to load: secrets and bindings arrive per request as `c.env`, which `getRequestContext().env`\n    // already merges.\n  },\n};\n"]}

package/dist/deploy/contract.d.ts

@@ -46,7 +46,26 @@ export interface DeployRuntime {
      * serves it.
      */
     mountStaticAssets(app: Hono): void;
-    /** Mounts `public/` at the web root, after every route, so it only answers paths no route claimed. */
+    /**
+     * Mounts `public/` at the web root, after every route, so it only answers paths no route claimed.
+     *
+     * **That ordering is only within the app**, which is the whole surface on `node` and `aws-lambda` and not
+     * on the two targets with a CDN in front. There `public/` is part of the static output and the platform
+     * answers from it *before* the app is invoked — `{ handle: 'filesystem' }` ahead of the function on
+     * Vercel, Workers Assets ahead of the worker on Cloudflare — so it is a CDN-first store rather than a
+     * fallback. `rshono build` warns about a `public/` file that lands on a route's path for exactly that
+     * reason; see `publicRouteCollisions`.
+     *
+     * The two targets do not answer that the same way, and the difference is worth having written down here
+     * rather than discovered in one of them. **Vercel implements this as a no-op**: nothing is uploaded with
+     * the function for it to read, so a mount could never answer. **Cloudflare implements it for real**,
+     * against the `ASSETS` binding — normally dead, since the CDN is checked first, but the binding is the
+     * same store either way and an assets configuration that routes to the worker first would otherwise lose
+     * `public/` entirely. That is the reason its `mountStaticAssets` is live too. So on Cloudflare a `public/`
+     * file is CDN-first *and*, inside the worker, a genuine fallback that a route still beats — which is the
+     * ordering this method's first line describes, reached by the one target whose CDN can be told to stand
+     * aside.
+     */
     mountPublicFallback(app: Hono): void;
     /**
      * Reads the page prerendered for `c.req.path`, or `null` when there is none — in which case the route
@@ -60,4 +79,3 @@ export interface DeployRuntime {
     /** Loads `.env` files where the platform has a filesystem. Env is bindings elsewhere. */
     loadEnv(): void;
 }
-//# sourceMappingURL=contract.d.ts.map

package/dist/deploy/contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../src/deploy/contract.ts"],"names":[],"mappings":"","sourcesContent":["import type { Context, Hono } from 'hono';\nimport type { PrerenderVariant, PrerenderedPage } from '../server/prerendered.js';\n\n/**\n * A hosting platform `rshono build` targets. Selected with `deploy` in `rshono.config.ts`, the\n * `--deploy` flag or the `RSHONO_DEPLOY` env var.\n *\n * - `'node'` (the default) — rshono binds the port and you run the build with `rshono start`. Covers a\n *   VPS, a container, a PaaS, and — through `node:` compatibility — Bun and Deno.\n * - `'cloudflare'` — a Worker; the entry exports `{ fetch }`.\n * - `'vercel'` — a Vercel function, plus the on-disk layout and config streaming needs there.\n * - `'aws-lambda'` — a streaming Lambda handler.\n *\n * There is one target per *handoff* — who opens the socket, and what shape a request arrives in — since\n * that is the part an app cannot arrange for itself. `rshono dev` always runs the `node` server.\n *\n * @example\n * ```ts\n * export default defineConfig({ deploy: 'cloudflare' });\n * ```\n *\n * @see {@link https://www.rshono.com/docs/deployment#the-targets | Docs — the targets}\n */\nexport type DeployTarget = 'node' | 'cloudflare' | 'vercel' | 'aws-lambda';\n\n/**\n * Everything the app server needs from the platform it runs on — the whole of what \"which platform is\n * this\" means at request time, since `runtime/entry.rsc.tsx` is written against this and nothing else.\n *\n * One preset implements it per target, and the build-time `@rshono/deploy` alias resolves to exactly\n * that module, so only the selected platform's code is ever in the bundle.\n */\nexport interface DeployRuntime {\n  /**\n   * Hands the app to the platform and returns whatever the entry module should `export default` there:\n   * nothing where rshono owns the process (this binds the port), otherwise the export the platform looks\n   * for — `{ fetch }` on Workers, a streaming handler on Lambda, and on Vercel a Node\n   * `(IncomingMessage, ServerResponse)` listener, which is what its `Nodejs` launcher calls.\n   *\n   * Note that a web `Request` is not the common currency here: two of the three targets are handed one by\n   * their platform, and Vercel is not, so converting is part of the handoff rather than something the\n   * request-handling code below can assume has already happened.\n   */\n  serveApp(app: Hono): unknown;\n  /**\n   * Mounts the hashed client bundle at `/_static` — after src/server.ts, so the app's own middleware covers an\n   * asset response too, and ahead of the page routes, which cannot claim that prefix. A no-op where a CDN\n   * serves it.\n   */\n  mountStaticAssets(app: Hono): void;\n  /** Mounts `public/` at the web root, after every route, so it only answers paths no route claimed. */\n  mountPublicFallback(app: Hono): void;\n  /**\n   * Reads the page prerendered for `c.req.path`, or `null` when there is none — in which case the route\n   * renders per request.\n   *\n   * Takes the whole {@link Context} because without a filesystem the store *is* a request-scoped\n   * binding (`c.env.ASSETS` on Workers). The path is untrusted either way, so an implementation treats\n   * traversal as a miss — see `ssgFilePath`, the one mapping from a path to the file that holds its page.\n   */\n  readPrerendered(c: Context, variant: PrerenderVariant): Promise<PrerenderedPage | null>;\n  /** Loads `.env` files where the platform has a filesystem. Env is bindings elsewhere. */\n  loadEnv(): void;\n}\n"]}
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../src/deploy/contract.ts"],"names":[],"mappings":"","sourcesContent":["import type { Context, Hono } from 'hono';\nimport type { PrerenderVariant, PrerenderedPage } from '../server/prerendered.js';\n\n/**\n * A hosting platform `rshono build` targets. Selected with `deploy` in `rshono.config.ts`, the\n * `--deploy` flag or the `RSHONO_DEPLOY` env var.\n *\n * - `'node'` (the default) — rshono binds the port and you run the build with `rshono start`. Covers a\n *   VPS, a container, a PaaS, and — through `node:` compatibility — Bun and Deno.\n * - `'cloudflare'` — a Worker; the entry exports `{ fetch }`.\n * - `'vercel'` — a Vercel function, plus the on-disk layout and config streaming needs there.\n * - `'aws-lambda'` — a streaming Lambda handler.\n *\n * There is one target per *handoff* — who opens the socket, and what shape a request arrives in — since\n * that is the part an app cannot arrange for itself. `rshono dev` always runs the `node` server.\n *\n * @example\n * ```ts\n * export default defineConfig({ deploy: 'cloudflare' });\n * ```\n *\n * @see {@link https://www.rshono.com/docs/deployment#the-targets | Docs — the targets}\n */\nexport type DeployTarget = 'node' | 'cloudflare' | 'vercel' | 'aws-lambda';\n\n/**\n * Everything the app server needs from the platform it runs on — the whole of what \"which platform is\n * this\" means at request time, since `runtime/entry.rsc.tsx` is written against this and nothing else.\n *\n * One preset implements it per target, and the build-time `@rshono/deploy` alias resolves to exactly\n * that module, so only the selected platform's code is ever in the bundle.\n */\nexport interface DeployRuntime {\n  /**\n   * Hands the app to the platform and returns whatever the entry module should `export default` there:\n   * nothing where rshono owns the process (this binds the port), otherwise the export the platform looks\n   * for — `{ fetch }` on Workers, a streaming handler on Lambda, and on Vercel a Node\n   * `(IncomingMessage, ServerResponse)` listener, which is what its `Nodejs` launcher calls.\n   *\n   * Note that a web `Request` is not the common currency here: two of the three targets are handed one by\n   * their platform, and Vercel is not, so converting is part of the handoff rather than something the\n   * request-handling code below can assume has already happened.\n   */\n  serveApp(app: Hono): unknown;\n  /**\n   * Mounts the hashed client bundle at `/_static` — after src/server.ts, so the app's own middleware covers an\n   * asset response too, and ahead of the page routes, which cannot claim that prefix. A no-op where a CDN\n   * serves it.\n   */\n  mountStaticAssets(app: Hono): void;\n  /**\n   * Mounts `public/` at the web root, after every route, so it only answers paths no route claimed.\n   *\n   * **That ordering is only within the app**, which is the whole surface on `node` and `aws-lambda` and not\n   * on the two targets with a CDN in front. There `public/` is part of the static output and the platform\n   * answers from it *before* the app is invoked — `{ handle: 'filesystem' }` ahead of the function on\n   * Vercel, Workers Assets ahead of the worker on Cloudflare — so it is a CDN-first store rather than a\n   * fallback. `rshono build` warns about a `public/` file that lands on a route's path for exactly that\n   * reason; see `publicRouteCollisions`.\n   *\n   * The two targets do not answer that the same way, and the difference is worth having written down here\n   * rather than discovered in one of them. **Vercel implements this as a no-op**: nothing is uploaded with\n   * the function for it to read, so a mount could never answer. **Cloudflare implements it for real**,\n   * against the `ASSETS` binding — normally dead, since the CDN is checked first, but the binding is the\n   * same store either way and an assets configuration that routes to the worker first would otherwise lose\n   * `public/` entirely. That is the reason its `mountStaticAssets` is live too. So on Cloudflare a `public/`\n   * file is CDN-first *and*, inside the worker, a genuine fallback that a route still beats — which is the\n   * ordering this method's first line describes, reached by the one target whose CDN can be told to stand\n   * aside.\n   */\n  mountPublicFallback(app: Hono): void;\n  /**\n   * Reads the page prerendered for `c.req.path`, or `null` when there is none — in which case the route\n   * renders per request.\n   *\n   * Takes the whole {@link Context} because without a filesystem the store *is* a request-scoped\n   * binding (`c.env.ASSETS` on Workers). The path is untrusted either way, so an implementation treats\n   * traversal as a miss — see `ssgFilePath`, the one mapping from a path to the file that holds its page.\n   */\n  readPrerendered(c: Context, variant: PrerenderVariant): Promise<PrerenderedPage | null>;\n  /** Loads `.env` files where the platform has a filesystem. Env is bindings elsewhere. */\n  loadEnv(): void;\n}\n"]}

package/dist/deploy/filesystem.d.ts

@@ -5,4 +5,3 @@ import type { DeployRuntime } from './contract.js';
  * those presets is this object plus its own {@link DeployRuntime.serveApp}.
  */
 export declare const fileSystemRuntime: Omit<DeployRuntime, 'serveApp'>;
-//# sourceMappingURL=filesystem.d.ts.map

package/dist/deploy/node/runtime.d.ts

@@ -7,4 +7,3 @@ import type { DeployRuntime } from '../contract.js';
  * `@hono/node-server`, and both implement the `node:` APIs it needs.
  */
 export declare const runtime: DeployRuntime;
-//# sourceMappingURL=runtime.d.ts.map

package/dist/deploy/presets.d.ts

@@ -1,4 +1,5 @@
 import type { RspackOptions } from '@rspack/core';
+import type { Route } from '../router.js';
 import type { DeployTarget } from './contract.js';
 /** What a preset's {@link DeployPreset.finalize} is told about the build it is arranging. */
 export interface DeployBuildContext {
@@ -12,6 +13,12 @@ export interface DeployBuildContext {
     publicDir: string | null;
     /** Prerendered pages, `<root>/dist/ssg` — empty when the app has no `render: 'static'` routes. */
     ssgDir: string;
+    /**
+     * The app's route table, as the bundle validated it. Read by the two CDN presets: their platform serves
+     * the static output before the app is invoked, so a `public/` file that lands on a route's path answers
+     * instead of it — see `publicRouteCollisions`.
+     */
+    routes: readonly Route[];
 }
 /**
  * The build-time half of a deploy target: which runtime module the bundle gets, how the server compiler has
@@ -83,4 +90,3 @@ export interface DeploySources {
  * `RSHONO_DEPLOY=` in CI falls through rather than failing the build.
  */
 export declare function resolveDeployPreset(sources?: DeploySources): DeployPreset;
-//# sourceMappingURL=presets.d.ts.map

package/dist/deploy/presets.js

@@ -86,12 +86,23 @@ const PRESETS = {
 };
 /** Every target `deploy` accepts, for error messages and docs. */
 export const DEPLOY_TARGETS = Object.keys(PRESETS);
+/**
+ * `PRESETS[target]` for a target that really is one.
+ *
+ * `Object.hasOwn` rather than a bare bracket access, which resolves every `Object.prototype` key —
+ * `constructor`, `__proto__`, `toString` — to an inherited value that then passes a truthiness guard. A typo
+ * that happens to be one of those used to reach the builder and die on `preset.runtimeModule.split('/')`
+ * instead of getting the message written for an unknown target.
+ */
+function presetFor(target) {
+    return Object.hasOwn(PRESETS, target) ? PRESETS[target] : undefined;
+}
 /**
  * How to deploy what a given target built, or `null` for a name this rshono does not know — which a `dist/`
  * from a newer version can legitimately carry.
  */
 export function deployHintFor(target) {
-    return PRESETS[target]?.deployHint ?? null;
+    return presetFor(target)?.deployHint ?? null;
 }
 /**
  * Resolves the preset to build with: the flag wins over the environment, which wins over the config file,
@@ -102,7 +113,7 @@ export function resolveDeployPreset(sources = {}) {
     const target = sources.flag?.trim() || sources.env?.trim() || sources.config?.trim();
     if (!target)
         return NODE_PRESET;
-    const preset = PRESETS[target];
+    const preset = presetFor(target);
     if (!preset) {
         throw new Error(`[rshono] unknown deploy target ${JSON.stringify(target)} — expected one of: ${DEPLOY_TARGETS.join(', ')}.`);
     }

package/dist/deploy/presets.js.map

@@ -1 +1 @@
-{"version":3,"file":"presets.js","sourceRoot":"","sources":["../../src/deploy/presets.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AA4DxD;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAiB;IACvC,IAAI,EAAE,MAAM;IACZ,aAAa,EAAE,wBAAwB;IACvC,UAAU,EAAE,oBAAoB;CACjC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,iBAAiB,GAAiB;IACtC,IAAI,EAAE,YAAY;IAClB,aAAa,EAAE,8BAA8B;IAC7C,UAAU,EAAE,+BAA+B;IAC3C,WAAW,EAAE,IAAI;IACjB,iBAAiB,EAAE,CAAC,SAAS,CAAC;IAC9B,aAAa,EAAE,CAAC,YAAY,CAAC;IAC7B,eAAe,CAAC,MAAM;QACpB,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC;QAC5B,MAAM,CAAC,aAAa,GAAG,eAAe,CAAC;QACvC,MAAM,CAAC,SAAS,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC3D,CAAC;IACD,QAAQ,EAAE,uBAAuB;CAClC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB,CAAC,MAAqB;IAC/C,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,aAAa,GAAiB;IAClC,IAAI,EAAE,QAAQ;IACd,aAAa,EAAE,0BAA0B;IACzC,UAAU,EAAE,wCAAwC;IACpD,eAAe,EAAE,kBAAkB;IACnC,QAAQ,EAAE,mBAAmB;CAC9B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,iBAAiB,GAAiB;IACtC,IAAI,EAAE,YAAY;IAClB,aAAa,EAAE,8BAA8B;IAC7C,UAAU,EAAE,oDAAoD;IAChE,eAAe,EAAE,kBAAkB;CACpC,CAAC;AAEF,MAAM,OAAO,GAAuC;IAClD,IAAI,EAAE,WAAW;IACjB,UAAU,EAAE,iBAAiB;IAC7B,MAAM,EAAE,aAAa;IACrB,YAAY,EAAE,iBAAiB;CAChC,CAAC;AAEF,kEAAkE;AAClE,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAmB,CAAC;AAErE;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAQ,OAAoD,CAAC,MAAM,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC;AAC3F,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAO,GAAkB,EAAE;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACrF,IAAI,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC;IAEhC,MAAM,MAAM,GAAI,OAAoD,CAAC,MAAM,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,uBAAuB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { RspackOptions } from '@rspack/core';\nimport { finalizeCloudflareBuild } from './cloudflare/build.js';\nimport type { DeployTarget } from './contract.js';\nimport { finalizeVercelBuild } from './vercel/build.js';\n\n/** What a preset's {@link DeployPreset.finalize} is told about the build it is arranging. */\nexport interface DeployBuildContext {\n  /** The project root — where `rshono build` ran, and what a platform config file is written next to. */\n  rootDir: string;\n  /** `<root>/dist`. */\n  distDir: string;\n  /** The hashed client bundle, `<root>/dist/static` — served at `/_static`. */\n  staticDir: string;\n  /** The copy of the app's `public/`, or `null` when it has none. Served at the web root. */\n  publicDir: string | null;\n  /** Prerendered pages, `<root>/dist/ssg` — empty when the app has no `render: 'static'` routes. */\n  ssgDir: string;\n}\n\n/**\n * The build-time half of a deploy target: which runtime module the bundle gets, how the server compiler has\n * to change to produce something the platform can run, and how the output is arranged once it exists.\n *\n * The runtime half is `DeployRuntime`, in its own file because it is compiled *into* the app bundle — this\n * side only ever runs in the CLI.\n */\nexport interface DeployPreset {\n  readonly name: DeployTarget;\n  /**\n   * The module `@rshono/deploy` resolves to, as a path relative to the framework's own `dist/`.\n   * Slash-separated and split on use, so it stays a valid path on Windows too.\n   */\n  readonly runtimeModule: string;\n  /** How to run what was just built, completing the \"build complete —\" line. */\n  readonly deployHint: string;\n  /**\n   * `true` where the platform hands per-request bindings to `app.fetch(request, env)` — Workers, and\n   * nowhere else. It gates the `getRequestContext().env` merge, because every other target passes its own\n   * private handles in that argument (`{ incoming, outgoing }` on Node, the whole invocation on Lambda) and\n   * merging those would put a live socket, or a request's headers and cookies, behind a name typed\n   * `string | undefined`.\n   */\n  readonly envBindings?: boolean;\n  /**\n   * Extra resolve conditions for the server bundle, most specific first — what picks the right build of React\n   * and the RSC runtime, both of which ship one per runtime. Omit to accept whatever the Rspack target\n   * implies, which is correct for Node.\n   */\n  readonly resolveConditions?: readonly string[];\n  /** browserslist-style targets for the server bundle's swc pass. Defaults to Node. */\n  readonly syntaxTargets?: readonly string[];\n  /**\n   * Adjusts the generated server Rspack config for this platform — target, externals policy, output shape.\n   * Mutates in place, and runs before the user's `rspack` hook so that hook keeps the last word.\n   */\n  configureServer?(config: RspackOptions): void;\n  /**\n   * Arranges the finished build for the platform: assembles the directory layout it expects, emits its config\n   * file, and prints how to deploy. Runs last, so everything it needs to move is already on disk.\n   */\n  finalize?(ctx: DeployBuildContext): Promise<void> | void;\n}\n\n/**\n * Node: a long-lived server process. The generated config is already this shape — `target: 'node'`, the\n * externals policy and ESM chunk output are all defaults — so the preset has nothing to contribute.\n */\nexport const NODE_PRESET: DeployPreset = {\n  name: 'node',\n  runtimeModule: 'deploy/node/runtime.js',\n  deployHint: 'run `rshono start`',\n};\n\n/**\n * Cloudflare Workers: the host owns the process, the CDN owns the assets, and there is no filesystem.\n *\n * Every setting here follows from `workerd` not being Node. Dependencies are bundled because nothing resolves\n * `node_modules` at runtime; `node:` and `cloudflare:` imports stay external because the runtime provides\n * them under `nodejs_compat`; and async chunks are inlined because Wrangler's bundler cannot follow the\n * computed specifier Rspack's ESM chunk loader emits — a split bundle deploys and then fails on first render.\n */\nconst CLOUDFLARE_PRESET: DeployPreset = {\n  name: 'cloudflare',\n  runtimeModule: 'deploy/cloudflare/runtime.js',\n  deployHint: 'deploy with `wrangler deploy`',\n  envBindings: true,\n  resolveConditions: ['workerd'],\n  syntaxTargets: ['chrome 120'],\n  configureServer(config) {\n    config.target = 'webworker';\n    config.externalsType = 'module-import';\n    config.externals = [/^(?:node|cloudflare):/];\n    config.output = { ...config.output, asyncChunks: false };\n  },\n  finalize: finalizeCloudflareBuild,\n};\n\n/**\n * Bundles the app's dependencies into the server output instead of importing them from `node_modules`.\n *\n * The generated config externalizes them, which is right where the bundle runs *inside* the project — but a\n * serverless function is uploaded as a directory rather than installed into one, so nothing resolves\n * `node_modules` at request time and an externalized `import 'some-package'` is a cold start that dies on\n * `ERR_MODULE_NOT_FOUND`. Node's own builtins stay external either way, through the `node` externals preset\n * that `target: 'node'` already enables.\n *\n * The cost is a dependency that cannot be bundled — a native addon, or one that reads its own files off disk\n * relative to `__dirname`. Those now fail the build rather than the deploy, which is the same constraint\n * `cloudflare` has always had; the `rspack` hook in `rshono.config.ts` is the way out.\n */\nfunction bundleDependencies(config: RspackOptions): void {\n  config.externals = [];\n}\n\n/**\n * Vercel: one Node function behind the platform's CDN, which serves the assets and reaches the function only\n * for a page. `finalize` assembles the Build Output API layout the platform uploads — including the\n * `supportsResponseStreaming` flag, without which Vercel buffers the whole response and silently undoes\n * streamed SSR.\n *\n * Only `dist/server` is uploaded with the function, which is why dependencies are bundled: see\n * {@link bundleDependencies}.\n */\nconst VERCEL_PRESET: DeployPreset = {\n  name: 'vercel',\n  runtimeModule: 'deploy/vercel/runtime.js',\n  deployHint: 'deploy with `vercel deploy --prebuilt`',\n  configureServer: bundleDependencies,\n  finalize: finalizeVercelBuild,\n};\n\n/**\n * AWS Lambda behind a Function URL in `RESPONSE_STREAM` mode — the AWS shape that keeps streaming. The\n * runtime wraps the app in `awslambda.streamifyResponse`; the buffered alternative would deploy fine and then\n * hold every page until its last byte rendered.\n *\n * The deployment package is `dist/` and nothing else, which is why dependencies are bundled: see\n * {@link bundleDependencies}.\n */\nconst AWS_LAMBDA_PRESET: DeployPreset = {\n  name: 'aws-lambda',\n  runtimeModule: 'deploy/aws-lambda/runtime.js',\n  deployHint: 'zip dist/ with the handler at dist/server/main.mjs',\n  configureServer: bundleDependencies,\n};\n\nconst PRESETS: Record<DeployTarget, DeployPreset> = {\n  node: NODE_PRESET,\n  cloudflare: CLOUDFLARE_PRESET,\n  vercel: VERCEL_PRESET,\n  'aws-lambda': AWS_LAMBDA_PRESET,\n};\n\n/** Every target `deploy` accepts, for error messages and docs. */\nexport const DEPLOY_TARGETS = Object.keys(PRESETS) as DeployTarget[];\n\n/**\n * How to deploy what a given target built, or `null` for a name this rshono does not know — which a `dist/`\n * from a newer version can legitimately carry.\n */\nexport function deployHintFor(target: string): string | null {\n  return (PRESETS as Record<string, DeployPreset | undefined>)[target]?.deployHint ?? null;\n}\n\n/** Where a deploy target can be named, in precedence order. */\nexport interface DeploySources {\n  /** The `--deploy` flag. */\n  flag?: string;\n  /** The `RSHONO_DEPLOY` env var — for a CI job that deploys the same app to more than one place. */\n  env?: string;\n  /** The `deploy` field in `rshono.config.ts`. */\n  config?: string;\n}\n\n/**\n * Resolves the preset to build with: the flag wins over the environment, which wins over the config file,\n * which wins over the `node` default. Blank values are ignored at every level, so an unset-but-present\n * `RSHONO_DEPLOY=` in CI falls through rather than failing the build.\n */\nexport function resolveDeployPreset(sources: DeploySources = {}): DeployPreset {\n  const target = sources.flag?.trim() || sources.env?.trim() || sources.config?.trim();\n  if (!target) return NODE_PRESET;\n\n  const preset = (PRESETS as Record<string, DeployPreset | undefined>)[target];\n  if (!preset) {\n    throw new Error(`[rshono] unknown deploy target ${JSON.stringify(target)} — expected one of: ${DEPLOY_TARGETS.join(', ')}.`);\n  }\n  return preset;\n}\n"]}
+{"version":3,"file":"presets.js","sourceRoot":"","sources":["../../src/deploy/presets.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAkExD;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAiB;IACvC,IAAI,EAAE,MAAM;IACZ,aAAa,EAAE,wBAAwB;IACvC,UAAU,EAAE,oBAAoB;CACjC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,iBAAiB,GAAiB;IACtC,IAAI,EAAE,YAAY;IAClB,aAAa,EAAE,8BAA8B;IAC7C,UAAU,EAAE,+BAA+B;IAC3C,WAAW,EAAE,IAAI;IACjB,iBAAiB,EAAE,CAAC,SAAS,CAAC;IAC9B,aAAa,EAAE,CAAC,YAAY,CAAC;IAC7B,eAAe,CAAC,MAAM;QACpB,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC;QAC5B,MAAM,CAAC,aAAa,GAAG,eAAe,CAAC;QACvC,MAAM,CAAC,SAAS,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC3D,CAAC;IACD,QAAQ,EAAE,uBAAuB;CAClC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB,CAAC,MAAqB;IAC/C,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,aAAa,GAAiB;IAClC,IAAI,EAAE,QAAQ;IACd,aAAa,EAAE,0BAA0B;IACzC,UAAU,EAAE,wCAAwC;IACpD,eAAe,EAAE,kBAAkB;IACnC,QAAQ,EAAE,mBAAmB;CAC9B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,iBAAiB,GAAiB;IACtC,IAAI,EAAE,YAAY;IAClB,aAAa,EAAE,8BAA8B;IAC7C,UAAU,EAAE,oDAAoD;IAChE,eAAe,EAAE,kBAAkB;CACpC,CAAC;AAEF,MAAM,OAAO,GAAuC;IAClD,IAAI,EAAE,WAAW;IACjB,UAAU,EAAE,iBAAiB;IAC7B,MAAM,EAAE,aAAa;IACrB,YAAY,EAAE,iBAAiB;CAChC,CAAC;AAEF,kEAAkE;AAClE,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAmB,CAAC;AAErE;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,MAAc;IAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAsB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC;AAC/C,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAO,GAAkB,EAAE;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACrF,IAAI,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC;IAEhC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,uBAAuB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { RspackOptions } from '@rspack/core';\nimport { finalizeCloudflareBuild } from './cloudflare/build.js';\nimport type { Route } from '../router.js';\nimport type { DeployTarget } from './contract.js';\nimport { finalizeVercelBuild } from './vercel/build.js';\n\n/** What a preset's {@link DeployPreset.finalize} is told about the build it is arranging. */\nexport interface DeployBuildContext {\n  /** The project root — where `rshono build` ran, and what a platform config file is written next to. */\n  rootDir: string;\n  /** `<root>/dist`. */\n  distDir: string;\n  /** The hashed client bundle, `<root>/dist/static` — served at `/_static`. */\n  staticDir: string;\n  /** The copy of the app's `public/`, or `null` when it has none. Served at the web root. */\n  publicDir: string | null;\n  /** Prerendered pages, `<root>/dist/ssg` — empty when the app has no `render: 'static'` routes. */\n  ssgDir: string;\n  /**\n   * The app's route table, as the bundle validated it. Read by the two CDN presets: their platform serves\n   * the static output before the app is invoked, so a `public/` file that lands on a route's path answers\n   * instead of it — see `publicRouteCollisions`.\n   */\n  routes: readonly Route[];\n}\n\n/**\n * The build-time half of a deploy target: which runtime module the bundle gets, how the server compiler has\n * to change to produce something the platform can run, and how the output is arranged once it exists.\n *\n * The runtime half is `DeployRuntime`, in its own file because it is compiled *into* the app bundle — this\n * side only ever runs in the CLI.\n */\nexport interface DeployPreset {\n  readonly name: DeployTarget;\n  /**\n   * The module `@rshono/deploy` resolves to, as a path relative to the framework's own `dist/`.\n   * Slash-separated and split on use, so it stays a valid path on Windows too.\n   */\n  readonly runtimeModule: string;\n  /** How to run what was just built, completing the \"build complete —\" line. */\n  readonly deployHint: string;\n  /**\n   * `true` where the platform hands per-request bindings to `app.fetch(request, env)` — Workers, and\n   * nowhere else. It gates the `getRequestContext().env` merge, because every other target passes its own\n   * private handles in that argument (`{ incoming, outgoing }` on Node, the whole invocation on Lambda) and\n   * merging those would put a live socket, or a request's headers and cookies, behind a name typed\n   * `string | undefined`.\n   */\n  readonly envBindings?: boolean;\n  /**\n   * Extra resolve conditions for the server bundle, most specific first — what picks the right build of React\n   * and the RSC runtime, both of which ship one per runtime. Omit to accept whatever the Rspack target\n   * implies, which is correct for Node.\n   */\n  readonly resolveConditions?: readonly string[];\n  /** browserslist-style targets for the server bundle's swc pass. Defaults to Node. */\n  readonly syntaxTargets?: readonly string[];\n  /**\n   * Adjusts the generated server Rspack config for this platform — target, externals policy, output shape.\n   * Mutates in place, and runs before the user's `rspack` hook so that hook keeps the last word.\n   */\n  configureServer?(config: RspackOptions): void;\n  /**\n   * Arranges the finished build for the platform: assembles the directory layout it expects, emits its config\n   * file, and prints how to deploy. Runs last, so everything it needs to move is already on disk.\n   */\n  finalize?(ctx: DeployBuildContext): Promise<void> | void;\n}\n\n/**\n * Node: a long-lived server process. The generated config is already this shape — `target: 'node'`, the\n * externals policy and ESM chunk output are all defaults — so the preset has nothing to contribute.\n */\nexport const NODE_PRESET: DeployPreset = {\n  name: 'node',\n  runtimeModule: 'deploy/node/runtime.js',\n  deployHint: 'run `rshono start`',\n};\n\n/**\n * Cloudflare Workers: the host owns the process, the CDN owns the assets, and there is no filesystem.\n *\n * Every setting here follows from `workerd` not being Node. Dependencies are bundled because nothing resolves\n * `node_modules` at runtime; `node:` and `cloudflare:` imports stay external because the runtime provides\n * them under `nodejs_compat`; and async chunks are inlined because Wrangler's bundler cannot follow the\n * computed specifier Rspack's ESM chunk loader emits — a split bundle deploys and then fails on first render.\n */\nconst CLOUDFLARE_PRESET: DeployPreset = {\n  name: 'cloudflare',\n  runtimeModule: 'deploy/cloudflare/runtime.js',\n  deployHint: 'deploy with `wrangler deploy`',\n  envBindings: true,\n  resolveConditions: ['workerd'],\n  syntaxTargets: ['chrome 120'],\n  configureServer(config) {\n    config.target = 'webworker';\n    config.externalsType = 'module-import';\n    config.externals = [/^(?:node|cloudflare):/];\n    config.output = { ...config.output, asyncChunks: false };\n  },\n  finalize: finalizeCloudflareBuild,\n};\n\n/**\n * Bundles the app's dependencies into the server output instead of importing them from `node_modules`.\n *\n * The generated config externalizes them, which is right where the bundle runs *inside* the project — but a\n * serverless function is uploaded as a directory rather than installed into one, so nothing resolves\n * `node_modules` at request time and an externalized `import 'some-package'` is a cold start that dies on\n * `ERR_MODULE_NOT_FOUND`. Node's own builtins stay external either way, through the `node` externals preset\n * that `target: 'node'` already enables.\n *\n * The cost is a dependency that cannot be bundled — a native addon, or one that reads its own files off disk\n * relative to `__dirname`. Those now fail the build rather than the deploy, which is the same constraint\n * `cloudflare` has always had; the `rspack` hook in `rshono.config.ts` is the way out.\n */\nfunction bundleDependencies(config: RspackOptions): void {\n  config.externals = [];\n}\n\n/**\n * Vercel: one Node function behind the platform's CDN, which serves the assets and reaches the function only\n * for a page. `finalize` assembles the Build Output API layout the platform uploads — including the\n * `supportsResponseStreaming` flag, without which Vercel buffers the whole response and silently undoes\n * streamed SSR.\n *\n * Only `dist/server` is uploaded with the function, which is why dependencies are bundled: see\n * {@link bundleDependencies}.\n */\nconst VERCEL_PRESET: DeployPreset = {\n  name: 'vercel',\n  runtimeModule: 'deploy/vercel/runtime.js',\n  deployHint: 'deploy with `vercel deploy --prebuilt`',\n  configureServer: bundleDependencies,\n  finalize: finalizeVercelBuild,\n};\n\n/**\n * AWS Lambda behind a Function URL in `RESPONSE_STREAM` mode — the AWS shape that keeps streaming. The\n * runtime wraps the app in `awslambda.streamifyResponse`; the buffered alternative would deploy fine and then\n * hold every page until its last byte rendered.\n *\n * The deployment package is `dist/` and nothing else, which is why dependencies are bundled: see\n * {@link bundleDependencies}.\n */\nconst AWS_LAMBDA_PRESET: DeployPreset = {\n  name: 'aws-lambda',\n  runtimeModule: 'deploy/aws-lambda/runtime.js',\n  deployHint: 'zip dist/ with the handler at dist/server/main.mjs',\n  configureServer: bundleDependencies,\n};\n\nconst PRESETS: Record<DeployTarget, DeployPreset> = {\n  node: NODE_PRESET,\n  cloudflare: CLOUDFLARE_PRESET,\n  vercel: VERCEL_PRESET,\n  'aws-lambda': AWS_LAMBDA_PRESET,\n};\n\n/** Every target `deploy` accepts, for error messages and docs. */\nexport const DEPLOY_TARGETS = Object.keys(PRESETS) as DeployTarget[];\n\n/**\n * `PRESETS[target]` for a target that really is one.\n *\n * `Object.hasOwn` rather than a bare bracket access, which resolves every `Object.prototype` key —\n * `constructor`, `__proto__`, `toString` — to an inherited value that then passes a truthiness guard. A typo\n * that happens to be one of those used to reach the builder and die on `preset.runtimeModule.split('/')`\n * instead of getting the message written for an unknown target.\n */\nfunction presetFor(target: string): DeployPreset | undefined {\n  return Object.hasOwn(PRESETS, target) ? PRESETS[target as DeployTarget] : undefined;\n}\n\n/**\n * How to deploy what a given target built, or `null` for a name this rshono does not know — which a `dist/`\n * from a newer version can legitimately carry.\n */\nexport function deployHintFor(target: string): string | null {\n  return presetFor(target)?.deployHint ?? null;\n}\n\n/** Where a deploy target can be named, in precedence order. */\nexport interface DeploySources {\n  /** The `--deploy` flag. */\n  flag?: string;\n  /** The `RSHONO_DEPLOY` env var — for a CI job that deploys the same app to more than one place. */\n  env?: string;\n  /** The `deploy` field in `rshono.config.ts`. */\n  config?: string;\n}\n\n/**\n * Resolves the preset to build with: the flag wins over the environment, which wins over the config file,\n * which wins over the `node` default. Blank values are ignored at every level, so an unset-but-present\n * `RSHONO_DEPLOY=` in CI falls through rather than failing the build.\n */\nexport function resolveDeployPreset(sources: DeploySources = {}): DeployPreset {\n  const target = sources.flag?.trim() || sources.env?.trim() || sources.config?.trim();\n  if (!target) return NODE_PRESET;\n\n  const preset = presetFor(target);\n  if (!preset) {\n    throw new Error(`[rshono] unknown deploy target ${JSON.stringify(target)} — expected one of: ${DEPLOY_TARGETS.join(', ')}.`);\n  }\n  return preset;\n}\n"]}

package/dist/deploy/public-paths.d.ts

@@ -0,0 +1,42 @@
+import { type Route } from '../router.js';
+/**
+ * The request paths a `public/` tree answers, and the collisions with the route table that only show up
+ * after a deploy.
+ *
+ * `DeployRuntime.mountPublicFallback` registers `public/` **after** every route, so it answers only what no
+ * route claimed. That is the whole story on `node` and `aws-lambda`, where the app owns the URL surface. On
+ * the two targets with a CDN in front, `public/` is part of the static output and the platform answers from
+ * it **before** the app is invoked:
+ *
+ * - **vercel** — `{ handle: 'filesystem' }` sits ahead of the catch-all in `config.json`, by construction.
+ * - **cloudflare** — Workers Assets is checked first, which the generated `wrangler.jsonc` says out loud.
+ *
+ * So an app with `public/about.html` and a page route at `/about.html` renders the page under `rshono dev`
+ * and `rshono start`, and serves the file on those two — a behaviour difference discovered by deploying. A
+ * `public/index.html` beside a page route at `/` is the same collision, on the one path every app has.
+ *
+ * The framework cannot reorder either platform, so this is a build-time warning: the build knows both sides
+ * and comparing them is a set lookup.
+ */
+/** `.html` files are also reachable without the extension where the platform's HTML handling does that. */
+export interface PublicPathOptions {
+    /**
+     * Whether `public/about.html` also answers `/about`. True on Cloudflare, whose Workers Assets defaults to
+     * `auto-trailing-slash` HTML handling; false on Vercel, which serves the file at its own path unless the
+     * project turns `cleanUrls` on. Getting this wrong in the permissive direction is a warning about a
+     * collision the platform does not have, which is the noise that gets a check ignored.
+     */
+    htmlExtensionless: boolean;
+}
+/**
+ * The literal route paths a `public/` file would answer instead, on a target whose platform serves the
+ * static output first — `[]` when there is no `public/` directory or nothing collides.
+ *
+ * Literal paths only. A `public/` file landing inside a parameterised route's pattern is a real collision
+ * too, but deciding it needs the router rather than a set, and the paths every app actually writes files
+ * beside — `/`, `/about`, `/favicon.ico` — are literal. The limit is here rather than in the message
+ * because a reader of the message can do nothing with it.
+ */
+export declare function publicRouteCollisions(publicDir: string | null, routes: readonly Route[], options: PublicPathOptions): string[];
+/** The warning both CDN presets print, so the two say the same thing about the same problem. */
+export declare function warnAboutPublicCollisions(collisions: string[], target: string): void;

package/dist/deploy/public-paths.js

@@ -0,0 +1,66 @@
+import { readdirSync } from 'node:fs';
+import { join, posix } from 'node:path';
+import { isPageRoute } from '../router.js';
+/** Every file in a directory tree, as a `/`-separated path relative to its root. */
+function filesUnder(root, prefix = '') {
+    const found = [];
+    for (const entry of readdirSync(join(root, prefix), { withFileTypes: true })) {
+        const rel = prefix ? posix.join(prefix, entry.name) : entry.name;
+        if (entry.isDirectory())
+            found.push(...filesUnder(root, rel));
+        else if (entry.isFile())
+            found.push(rel);
+    }
+    return found;
+}
+/**
+ * The request paths one `public/` file is served at — its own, plus the extra ones a platform's HTML
+ * handling adds. The same normalisation `ssgFilePath` does for a prerendered page, in the other direction:
+ * a check keyed on raw filenames would miss `/` for `index.html` and would be wrong about the rest.
+ *
+ * Deliberately not exhaustive. It lists what a file is *certainly* reachable at, because a false warning
+ * about a route that works is worse than the collision it would have caught — the same asymmetry
+ * `assertNothingIsShadowed` keeps.
+ */
+function pathsFor(file, options) {
+    const paths = [`/${file}`];
+    const index = file === 'index.html' ? '' : file.endsWith('/index.html') ? file.slice(0, -'/index.html'.length) : null;
+    if (index !== null)
+        paths.push(`/${index}`, `/${index}/`);
+    else if (options.htmlExtensionless && file.endsWith('.html'))
+        paths.push(`/${file.slice(0, -'.html'.length)}`);
+    return [...new Set(paths)];
+}
+/**
+ * The literal route paths a `public/` file would answer instead, on a target whose platform serves the
+ * static output first — `[]` when there is no `public/` directory or nothing collides.
+ *
+ * Literal paths only. A `public/` file landing inside a parameterised route's pattern is a real collision
+ * too, but deciding it needs the router rather than a set, and the paths every app actually writes files
+ * beside — `/`, `/about`, `/favicon.ico` — are literal. The limit is here rather than in the message
+ * because a reader of the message can do nothing with it.
+ */
+export function publicRouteCollisions(publicDir, routes, options) {
+    if (publicDir === null)
+        return [];
+    const claimed = new Map(routes.filter((route) => !route.path.includes(':') && !route.path.includes('*')).map((route) => [route.path, route]));
+    const collisions = [];
+    for (const file of filesUnder(publicDir)) {
+        for (const path of pathsFor(file, options)) {
+            const route = claimed.get(path);
+            if (route)
+                collisions.push(`public/${file} answers ${path}, which ${isPageRoute(route) ? 'a page' : 'an endpoint'} route claims`);
+        }
+    }
+    return collisions;
+}
+/** The warning both CDN presets print, so the two say the same thing about the same problem. */
+export function warnAboutPublicCollisions(collisions, target) {
+    if (collisions.length === 0)
+        return;
+    console.warn(`  ⚠ ${collisions.length} public/ file(s) shadow a route on ${target}, where the CDN answers before the app is invoked:`);
+    for (const line of collisions)
+        console.warn(`    ${line}`);
+    console.warn(`    Under \`rshono dev\` and \`rshono start\` the route wins instead, so this only appears once deployed.`);
+}
+//# sourceMappingURL=public-paths.js.map

package/dist/deploy/public-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-paths.js","sourceRoot":"","sources":["../../src/deploy/public-paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,WAAW,EAAc,MAAM,cAAc,CAAC;AAiCvD,oFAAoF;AACpF,SAAS,UAAU,CAAC,IAAY,EAAE,MAAM,GAAG,EAAE;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACjE,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;aACzD,IAAI,KAAK,CAAC,MAAM,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,OAA0B;IACxD,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtH,IAAI,KAAK,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,IAAI,KAAK,GAAG,CAAC,CAAC;SACrD,IAAI,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/G,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAwB,EAAE,MAAwB,EAAE,OAA0B;IAClH,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9I,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,KAAK;gBAAE,UAAU,CAAC,IAAI,CAAC,UAAU,IAAI,YAAY,IAAI,WAAW,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,eAAe,CAAC,CAAC;QACpI,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,yBAAyB,CAAC,UAAoB,EAAE,MAAc;IAC5E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,OAAO,CAAC,IAAI,CAAC,OAAO,UAAU,CAAC,MAAM,sCAAsC,MAAM,oDAAoD,CAAC,CAAC;IACvI,KAAK,MAAM,IAAI,IAAI,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,IAAI,CAAC,2GAA2G,CAAC,CAAC;AAC5H,CAAC","sourcesContent":["import { readdirSync } from 'node:fs';\nimport { join, posix } from 'node:path';\nimport { isPageRoute, type Route } from '../router.js';\n\n/**\n * The request paths a `public/` tree answers, and the collisions with the route table that only show up\n * after a deploy.\n *\n * `DeployRuntime.mountPublicFallback` registers `public/` **after** every route, so it answers only what no\n * route claimed. That is the whole story on `node` and `aws-lambda`, where the app owns the URL surface. On\n * the two targets with a CDN in front, `public/` is part of the static output and the platform answers from\n * it **before** the app is invoked:\n *\n * - **vercel** — `{ handle: 'filesystem' }` sits ahead of the catch-all in `config.json`, by construction.\n * - **cloudflare** — Workers Assets is checked first, which the generated `wrangler.jsonc` says out loud.\n *\n * So an app with `public/about.html` and a page route at `/about.html` renders the page under `rshono dev`\n * and `rshono start`, and serves the file on those two — a behaviour difference discovered by deploying. A\n * `public/index.html` beside a page route at `/` is the same collision, on the one path every app has.\n *\n * The framework cannot reorder either platform, so this is a build-time warning: the build knows both sides\n * and comparing them is a set lookup.\n */\n\n/** `.html` files are also reachable without the extension where the platform's HTML handling does that. */\nexport interface PublicPathOptions {\n  /**\n   * Whether `public/about.html` also answers `/about`. True on Cloudflare, whose Workers Assets defaults to\n   * `auto-trailing-slash` HTML handling; false on Vercel, which serves the file at its own path unless the\n   * project turns `cleanUrls` on. Getting this wrong in the permissive direction is a warning about a\n   * collision the platform does not have, which is the noise that gets a check ignored.\n   */\n  htmlExtensionless: boolean;\n}\n\n/** Every file in a directory tree, as a `/`-separated path relative to its root. */\nfunction filesUnder(root: string, prefix = ''): string[] {\n  const found: string[] = [];\n  for (const entry of readdirSync(join(root, prefix), { withFileTypes: true })) {\n    const rel = prefix ? posix.join(prefix, entry.name) : entry.name;\n    if (entry.isDirectory()) found.push(...filesUnder(root, rel));\n    else if (entry.isFile()) found.push(rel);\n  }\n  return found;\n}\n\n/**\n * The request paths one `public/` file is served at — its own, plus the extra ones a platform's HTML\n * handling adds. The same normalisation `ssgFilePath` does for a prerendered page, in the other direction:\n * a check keyed on raw filenames would miss `/` for `index.html` and would be wrong about the rest.\n *\n * Deliberately not exhaustive. It lists what a file is *certainly* reachable at, because a false warning\n * about a route that works is worse than the collision it would have caught — the same asymmetry\n * `assertNothingIsShadowed` keeps.\n */\nfunction pathsFor(file: string, options: PublicPathOptions): string[] {\n  const paths = [`/${file}`];\n  const index = file === 'index.html' ? '' : file.endsWith('/index.html') ? file.slice(0, -'/index.html'.length) : null;\n  if (index !== null) paths.push(`/${index}`, `/${index}/`);\n  else if (options.htmlExtensionless && file.endsWith('.html')) paths.push(`/${file.slice(0, -'.html'.length)}`);\n  return [...new Set(paths)];\n}\n\n/**\n * The literal route paths a `public/` file would answer instead, on a target whose platform serves the\n * static output first — `[]` when there is no `public/` directory or nothing collides.\n *\n * Literal paths only. A `public/` file landing inside a parameterised route's pattern is a real collision\n * too, but deciding it needs the router rather than a set, and the paths every app actually writes files\n * beside — `/`, `/about`, `/favicon.ico` — are literal. The limit is here rather than in the message\n * because a reader of the message can do nothing with it.\n */\nexport function publicRouteCollisions(publicDir: string | null, routes: readonly Route[], options: PublicPathOptions): string[] {\n  if (publicDir === null) return [];\n  const claimed = new Map(routes.filter((route) => !route.path.includes(':') && !route.path.includes('*')).map((route) => [route.path, route]));\n  const collisions: string[] = [];\n  for (const file of filesUnder(publicDir)) {\n    for (const path of pathsFor(file, options)) {\n      const route = claimed.get(path);\n      if (route) collisions.push(`public/${file} answers ${path}, which ${isPageRoute(route) ? 'a page' : 'an endpoint'} route claims`);\n    }\n  }\n  return collisions;\n}\n\n/** The warning both CDN presets print, so the two say the same thing about the same problem. */\nexport function warnAboutPublicCollisions(collisions: string[], target: string): void {\n  if (collisions.length === 0) return;\n  console.warn(`  ⚠ ${collisions.length} public/ file(s) shadow a route on ${target}, where the CDN answers before the app is invoked:`);\n  for (const line of collisions) console.warn(`    ${line}`);\n  console.warn(`    Under \\`rshono dev\\` and \\`rshono start\\` the route wins instead, so this only appears once deployed.`);\n}\n"]}

package/dist/deploy/vercel/build.d.ts

@@ -1,3 +1,2 @@
 import type { DeployBuildContext } from '../presets.js';
 export declare function finalizeVercelBuild(ctx: DeployBuildContext): Promise<void>;
-//# sourceMappingURL=build.d.ts.map

package/dist/deploy/vercel/build.js

@@ -1,6 +1,7 @@
 import { cpSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { rm } from 'node:fs/promises';
 import { join } from 'node:path';
+import { publicRouteCollisions, warnAboutPublicCollisions } from '../public-paths.js';
 /**
  * The Build Output API v3 layout, which `vercel deploy --prebuilt` uploads verbatim — producing it directly
  * means Vercel runs no build of its own.
@@ -34,6 +35,11 @@ export async function finalizeVercelBuild(ctx) {
     cpSync(ctx.staticDir, join(staticOut, '_static'), { recursive: true });
     if (ctx.publicDir)
         cpSync(ctx.publicDir, staticOut, { recursive: true });
+    // `{ handle: 'filesystem' }` is ahead of the function by construction, so a `public/` file on a route's
+    // path answers instead of the route here — and only here, which is what makes it worth saying at build
+    // time. `htmlExtensionless: false`: Vercel serves `about.html` at `/about.html` and adds `/about` only
+    // with `cleanUrls`, which is the project's setting and not something this build can read.
+    warnAboutPublicCollisions(publicRouteCollisions(ctx.publicDir, ctx.routes, { htmlExtensionless: false }), 'vercel');
     // Shipped inside the function: the bundle, and the one thing it reads from disk at request time.
     //
     // `public/` is deliberately *not* among them, though it is on the filesystem targets. It went into the

package/dist/deploy/vercel/build.js.map

@@ -1 +1 @@
-{"version":3,"file":"build.js","sourceRoot":"","sources":["../../../src/deploy/vercel/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC;;;GAGG;AACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,OAAO,GAAG,sBAAsB,CAAC;AAEvC;;;GAGG;AACH,MAAM,MAAM,GAAG;IACb,EAAE,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,qCAAqC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC/G,EAAE,MAAM,EAAE,YAAY,EAAE;IACxB,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;CACjC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAuB;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAElD,kFAAkF;IAClF,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,6FAA6F;IAC7F,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,IAAI,GAAG,CAAC,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzE,iGAAiG;IACjG,EAAE;IACF,uGAAuG;IACvG,yGAAyG;IACzG,2GAA2G;IAC3G,qGAAqG;IACrG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9F,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtG,aAAa,CACX,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,EACpC,GAAG,IAAI,CAAC,SAAS,CACf;QACE,kGAAkG;QAClG,kGAAkG;QAClG,sGAAsG;QACtG,OAAO,EAAE,SAAS,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;QACzD,OAAO,EAAE,OAAO;QAChB,YAAY,EAAE,QAAQ;QACtB,8EAA8E;QAC9E,yBAAyB,EAAE,IAAI;KAChC,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CACN,CAAC;IAEF,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAE9G,OAAO,CAAC,GAAG,CAAC,iBAAiB,UAAU,wBAAwB,CAAC,CAAC;AACnE,CAAC","sourcesContent":["import { cpSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';\nimport { rm } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport type { DeployBuildContext } from '../presets.js';\n\n/**\n * The Build Output API v3 layout, which `vercel deploy --prebuilt` uploads verbatim — producing it directly\n * means Vercel runs no build of its own.\n */\nconst OUTPUT_DIR = join('.vercel', 'output');\nconst FUNCTION_DIR = join('functions', 'index.func');\n\n/**\n * The bundle keeps this exact path inside the function because the runtime derives the project root from where\n * it sits (see `deploy/filesystem.ts`), so `dist/ssg` and `dist/public` land where it already looks — and no\n * runtime code needs to know it is on Vercel.\n */\nconst HANDLER = 'dist/server/main.mjs';\n\n/**\n * Routes, in the order Vercel evaluates them: hashed assets get the immutable header the CDN cannot infer,\n * then anything in the static output is served from it, and whatever is left is the app's to render.\n */\nconst ROUTES = [\n  { src: '^/_static/(.*)$', headers: { 'cache-control': 'public, max-age=31536000, immutable' }, continue: true },\n  { handle: 'filesystem' },\n  { src: '/(.*)', dest: '/index' },\n];\n\nexport async function finalizeVercelBuild(ctx: DeployBuildContext): Promise<void> {\n  const outputDir = join(ctx.rootDir, OUTPUT_DIR);\n  const staticOut = join(outputDir, 'static');\n  const functionDir = join(outputDir, FUNCTION_DIR);\n\n  // From scratch, so a deleted page or asset cannot survive in the uploaded output.\n  await rm(outputDir, { recursive: true, force: true });\n  mkdirSync(staticOut, { recursive: true });\n  mkdirSync(functionDir, { recursive: true });\n\n  // Served by the CDN: the hashed bundle under its public path, and `public/` at the web root.\n  cpSync(ctx.staticDir, join(staticOut, '_static'), { recursive: true });\n  if (ctx.publicDir) cpSync(ctx.publicDir, staticOut, { recursive: true });\n\n  // Shipped inside the function: the bundle, and the one thing it reads from disk at request time.\n  //\n  // `public/` is deliberately *not* among them, though it is on the filesystem targets. It went into the\n  // static output above, and `{ handle: 'filesystem' }` sits ahead of the catch-all route, so the platform\n  // answers those paths before the function is invoked — a copy here is bytes uploaded and unpacked on every\n  // cold start that nothing can ever read. `vercel/runtime.ts` turns the matching mount off to say so.\n  cpSync(join(ctx.distDir, 'server'), join(functionDir, 'dist', 'server'), { recursive: true });\n  if (existsSync(ctx.ssgDir)) cpSync(ctx.ssgDir, join(functionDir, 'dist', 'ssg'), { recursive: true });\n\n  writeFileSync(\n    join(functionDir, '.vc-config.json'),\n    `${JSON.stringify(\n      {\n        // The Node the build ran on, so the function runs the runtime the app was tested against — and so\n        // this does not become a hard-coded version the platform retires on a date the framework does not\n        // control. A major Vercel does not offer is an explicit error from the deploy rather than a mismatch.\n        runtime: `nodejs${process.versions.node.split('.')[0]}.x`,\n        handler: HANDLER,\n        launcherType: 'Nodejs',\n        // Without this the platform buffers the whole response, undoing streamed SSR.\n        supportsResponseStreaming: true,\n      },\n      null,\n      2,\n    )}\\n`,\n  );\n\n  writeFileSync(join(outputDir, 'config.json'), `${JSON.stringify({ version: 3, routes: ROUTES }, null, 2)}\\n`);\n\n  console.log(`  • assembled ${OUTPUT_DIR} (Build Output API v3)`);\n}\n"]}
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../../src/deploy/vercel/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAEtF;;;GAGG;AACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,OAAO,GAAG,sBAAsB,CAAC;AAEvC;;;GAGG;AACH,MAAM,MAAM,GAAG;IACb,EAAE,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,qCAAqC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC/G,EAAE,MAAM,EAAE,YAAY,EAAE;IACxB,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;CACjC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAuB;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAElD,kFAAkF;IAClF,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,6FAA6F;IAC7F,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,IAAI,GAAG,CAAC,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzE,wGAAwG;IACxG,uGAAuG;IACvG,uGAAuG;IACvG,0FAA0F;IAC1F,yBAAyB,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IAEpH,iGAAiG;IACjG,EAAE;IACF,uGAAuG;IACvG,yGAAyG;IACzG,2GAA2G;IAC3G,qGAAqG;IACrG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9F,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtG,aAAa,CACX,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,EACpC,GAAG,IAAI,CAAC,SAAS,CACf;QACE,kGAAkG;QAClG,kGAAkG;QAClG,sGAAsG;QACtG,OAAO,EAAE,SAAS,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;QACzD,OAAO,EAAE,OAAO;QAChB,YAAY,EAAE,QAAQ;QACtB,8EAA8E;QAC9E,yBAAyB,EAAE,IAAI;KAChC,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CACN,CAAC;IAEF,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAE9G,OAAO,CAAC,GAAG,CAAC,iBAAiB,UAAU,wBAAwB,CAAC,CAAC;AACnE,CAAC","sourcesContent":["import { cpSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';\nimport { rm } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport type { DeployBuildContext } from '../presets.js';\nimport { publicRouteCollisions, warnAboutPublicCollisions } from '../public-paths.js';\n\n/**\n * The Build Output API v3 layout, which `vercel deploy --prebuilt` uploads verbatim — producing it directly\n * means Vercel runs no build of its own.\n */\nconst OUTPUT_DIR = join('.vercel', 'output');\nconst FUNCTION_DIR = join('functions', 'index.func');\n\n/**\n * The bundle keeps this exact path inside the function because the runtime derives the project root from where\n * it sits (see `deploy/filesystem.ts`), so `dist/ssg` and `dist/public` land where it already looks — and no\n * runtime code needs to know it is on Vercel.\n */\nconst HANDLER = 'dist/server/main.mjs';\n\n/**\n * Routes, in the order Vercel evaluates them: hashed assets get the immutable header the CDN cannot infer,\n * then anything in the static output is served from it, and whatever is left is the app's to render.\n */\nconst ROUTES = [\n  { src: '^/_static/(.*)$', headers: { 'cache-control': 'public, max-age=31536000, immutable' }, continue: true },\n  { handle: 'filesystem' },\n  { src: '/(.*)', dest: '/index' },\n];\n\nexport async function finalizeVercelBuild(ctx: DeployBuildContext): Promise<void> {\n  const outputDir = join(ctx.rootDir, OUTPUT_DIR);\n  const staticOut = join(outputDir, 'static');\n  const functionDir = join(outputDir, FUNCTION_DIR);\n\n  // From scratch, so a deleted page or asset cannot survive in the uploaded output.\n  await rm(outputDir, { recursive: true, force: true });\n  mkdirSync(staticOut, { recursive: true });\n  mkdirSync(functionDir, { recursive: true });\n\n  // Served by the CDN: the hashed bundle under its public path, and `public/` at the web root.\n  cpSync(ctx.staticDir, join(staticOut, '_static'), { recursive: true });\n  if (ctx.publicDir) cpSync(ctx.publicDir, staticOut, { recursive: true });\n\n  // `{ handle: 'filesystem' }` is ahead of the function by construction, so a `public/` file on a route's\n  // path answers instead of the route here — and only here, which is what makes it worth saying at build\n  // time. `htmlExtensionless: false`: Vercel serves `about.html` at `/about.html` and adds `/about` only\n  // with `cleanUrls`, which is the project's setting and not something this build can read.\n  warnAboutPublicCollisions(publicRouteCollisions(ctx.publicDir, ctx.routes, { htmlExtensionless: false }), 'vercel');\n\n  // Shipped inside the function: the bundle, and the one thing it reads from disk at request time.\n  //\n  // `public/` is deliberately *not* among them, though it is on the filesystem targets. It went into the\n  // static output above, and `{ handle: 'filesystem' }` sits ahead of the catch-all route, so the platform\n  // answers those paths before the function is invoked — a copy here is bytes uploaded and unpacked on every\n  // cold start that nothing can ever read. `vercel/runtime.ts` turns the matching mount off to say so.\n  cpSync(join(ctx.distDir, 'server'), join(functionDir, 'dist', 'server'), { recursive: true });\n  if (existsSync(ctx.ssgDir)) cpSync(ctx.ssgDir, join(functionDir, 'dist', 'ssg'), { recursive: true });\n\n  writeFileSync(\n    join(functionDir, '.vc-config.json'),\n    `${JSON.stringify(\n      {\n        // The Node the build ran on, so the function runs the runtime the app was tested against — and so\n        // this does not become a hard-coded version the platform retires on a date the framework does not\n        // control. A major Vercel does not offer is an explicit error from the deploy rather than a mismatch.\n        runtime: `nodejs${process.versions.node.split('.')[0]}.x`,\n        handler: HANDLER,\n        launcherType: 'Nodejs',\n        // Without this the platform buffers the whole response, undoing streamed SSR.\n        supportsResponseStreaming: true,\n      },\n      null,\n      2,\n    )}\\n`,\n  );\n\n  writeFileSync(join(outputDir, 'config.json'), `${JSON.stringify({ version: 3, routes: ROUTES }, null, 2)}\\n`);\n\n  console.log(`  • assembled ${OUTPUT_DIR} (Build Output API v3)`);\n}\n"]}

package/dist/deploy/vercel/runtime.d.ts

@@ -15,4 +15,3 @@ import type { DeployRuntime } from '../contract.js';
  * they ship inside the function and are read from its read-only disk, exactly as on a server.
  */
 export declare const runtime: DeployRuntime;
-//# sourceMappingURL=runtime.d.ts.map

package/dist/index.d.ts

@@ -23,4 +23,3 @@
 export { defineRoutes, type EndpointRoute, type EndpointServerModule, type ErrorPageInfo, type ErrorPageProps, type FallbackPage, type HTTPMethod, type PageComponent, type PageProps, type PageRoute, type PathParams, type Route, type RouteConfig, } from './router.js';
 export { defineConfig, type RshonoConfig, type RspackHookContext } from './config.js';
 export type { DeployTarget } from './deploy/contract.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/router.d.ts

@@ -54,9 +54,12 @@ export interface PageProps<Path extends string = string, E extends Env = Env> {
      * `-Proto`). A fresh instance per request, so mutating it is local to the page; it is not
      * serializable, so hand a `'use client'` component `url.href` rather than `url`.
      *
-     * On a `render: 'static'` route this is the build-time URL — rendered once against `siteUrl`, so
-     * `url.searchParams` is always empty. Read the query from `useNavigation().url` in a `'use client'`
-     * component instead, or mark the route `render: 'dynamic'`.
+     * On a `render: 'static'` route this is the build-time URL — rendered once against `siteUrl`, so the
+     * origin is `siteUrl`'s and `url.searchParams` is always empty, on first paint and after a soft
+     * navigation alike. **`useNavigation().url` is the same frozen URL, not a way around it**: the payload
+     * carries one `href` and both readings come from it. Mark the route `render: 'dynamic'` if the page
+     * depends on the query; a `'use client'` component that only wants it after hydration can read
+     * `location.search` in an effect.
      */
     url: URL;
     /** Matched route params for this request, e.g. `{ id: '42' }` for `/profile/:id`. */
@@ -174,6 +177,12 @@ export interface PageRoute {
      * A parameterised static route without this falls back to rendering per request, with a build
      * warning. Wildcard (`*`), optional and regex params cannot be prerendered.
      *
+     * **Every value has to be one portable file name**, since that is what a prerendered page is stored as,
+     * and the build fails naming the value rather than writing a page nothing will serve. So: no
+     * `\ / : * ? " < > |` or control characters, no trailing `.` or space, and not a reserved Windows device
+     * name (`CON`, `NUL`, `COM1`, …) — the last two enforced everywhere, so a build that works on macOS is
+     * not one that fails in CI on Windows.
+     *
      * @example
      * ```ts
      * {
@@ -310,7 +319,14 @@ export interface RouteConfig<TRoutes extends readonly Route[] = readonly Route[]
     routes: TRoutes;
     /** Page rendered with a 404 status for unmatched paths and for `notFound()` calls. */
     notFound?: FallbackPage;
-    /** Page rendered with a 500 status when a request throws. Receives {@link ErrorPageProps}. */
+    /**
+     * Page rendered with a 500 status when a request throws — a page component, a page module that will not
+     * load, an endpoint, a server action, or middleware. Receives {@link ErrorPageProps}.
+     *
+     * It is a *fresh* render, with its own flight payload, so it hydrates and behaves like any other page.
+     * An app that declares none gets the framework's plain 500 document instead. If the `error` page itself
+     * throws, that is reported too and the framework's document answers.
+     */
     error?: FallbackPage;
 }
 /**
@@ -411,4 +427,3 @@ type RoutesOf<T> = T extends readonly Route[] ? T : T extends {
  */
 export declare function defineRoutes<const T extends readonly Route[] | RouteConfig<readonly Route[]>>(input: T & ValidateInput<T>): RouteConfig<RoutesOf<T>>;
 export {};
-//# sourceMappingURL=router.d.ts.map