@rshono/core 1.0.0-rc.2 → 1.0.0-rc.21

package/dist/server/headers.d.ts

@@ -1,24 +1,50 @@
 /**
- * Small header utilities shared by the response-header defaults, the compressor and the
- * prerendered-page cache. Kept apart from any one of them because getting `Vary` and `ETag`
- * comparison subtly wrong is exactly the kind of thing that only shows up behind a CDN.
+ * Header utilities shared by the response-header defaults and the prerendered-page cache. Their own module
+ * because getting `Vary` and `ETag` comparison subtly wrong only shows up behind a CDN.
  */
 /**
- * Adds `value` to the `Vary` header without discarding what is already there.
+ * What a 404 under the `/_static` mount must carry, on every deploy target.
  *
- * `Vary` is a list, and two different concerns write to it here — content negotiation on `Accept`
- * (HTML document vs flight payload) and `Accept-Encoding` from the compressor. A plain `set` from
- * whichever ran last would drop the other, and a cache would then happily serve one variant in
- * place of the other. `*` is left alone: it already means "never reuse this".
+ * A 404 is heuristically cacheable under RFC 9111, and the miss this answers is the one a **rolling deploy**
+ * produces: an old instance 404s a content-hashed chunk the new one has. Without this a shared cache may
+ * store that answer against a URL that is about to become valid, and then serve it to everyone.
+ *
+ * Shared by the two mounts — `createStaticAssetsApp` for the filesystem targets and `mountStaticAssets` in
+ * `deploy/cloudflare/runtime.ts` — because it was written down in one of them and inherited by accident in
+ * the other, which is how the Workers mount came to have no terminal 404 at all. Here rather than in either,
+ * since `server/static.ts` reaches for `@hono/node-server` and a Worker bundle cannot import it.
+ *
+ * The same string as a page response's default (`PAGE_CACHE_CONTROL` in `entry.rsc.tsx`) and a separate
+ * constant on purpose: that one is about a logged-in user's page, this one about a hash that is about to
+ * resolve, and a change to either must not move the other.
  */
-export declare function appendVary(headers: Headers, value: string): void;
+export declare const ASSET_MISS_CACHE_CONTROL = "private, no-cache";
 /**
- * True when an `If-None-Match` request header matches `etag`, i.e. the client already holds this
- * exact body and should be answered with a 304.
+ * The `Vary` a response needs in order to carry `value`, or `null` when there is nothing to write — because it
+ * already lists it, or because it lists `*`, which means "never reuse this" and covers everything.
+ *
+ * What is already there is kept, spelling and all: a route, a middleware or a proxy may have added an entry of
+ * its own, and a plain `set` would drop it, leaving a cache free to serve one variant in place of another.
  *
- * The header carries a *list*, and each entry may be weak (`W/"…"`). The weak prefix is ignored on
- * both sides because the compressor rewrites a strong tag to a weak one when it changes the bytes
- * on the wire — the representation is still the same one the client cached.
+ * The header is parsed into entries rather than tested as a string, because both of the questions it is asked
+ * are about the *list* and neither is about the text. `*` counts wherever it sits, not only alone — a cache
+ * told never to reuse a response is not told it harder by another field name. And an existing header with no
+ * entries in it (`vary: ''`, which an app writing one from a list that came out empty can produce, and which
+ * Hono keeps verbatim) is nothing to append to: `, RSC` is an empty list element, which RFC 9110 tells a
+ * sender not to generate, and a cache strict enough to reject the malformed header would drop the `Vary` that
+ * is the only thing keeping a page URL's two representations apart. That is the failure this header exists to
+ * prevent, reached through the header itself.
+ *
+ * Pure, and separate from {@link appendVary}, because the two callers cannot write the same way. One holds a
+ * `Response` it built itself; the response floor holds one the *app* may have returned, whose header bag can be
+ * immutable — see the floor in `entry.rsc.tsx`, which writes this answer through `c.header()`.
+ */
+export declare function varyWith(existing: string | null, value: string): string | null;
+/** {@link varyWith}, written straight back — for a `Headers` the caller knows it can write to. */
+export declare function appendVary(headers: Headers, value: string): void;
+/**
+ * True when an `If-None-Match` matches `etag` — the client already holds this body and can be answered with a
+ * 304. The header carries a list, and the weak prefix is ignored on both sides: a CDN that gzips on the way out
+ * changes the bytes without changing the representation, and may weaken the validator when it does.
  */
 export declare function etagMatches(ifNoneMatch: string | undefined, etag: string): boolean;
-//# sourceMappingURL=headers.d.ts.map

package/dist/server/headers.js

@@ -1,35 +1,64 @@
 /**
- * Small header utilities shared by the response-header defaults, the compressor and the
- * prerendered-page cache. Kept apart from any one of them because getting `Vary` and `ETag`
- * comparison subtly wrong is exactly the kind of thing that only shows up behind a CDN.
+ * Header utilities shared by the response-header defaults and the prerendered-page cache. Their own module
+ * because getting `Vary` and `ETag` comparison subtly wrong only shows up behind a CDN.
  */
 /**
- * Adds `value` to the `Vary` header without discarding what is already there.
+ * What a 404 under the `/_static` mount must carry, on every deploy target.
  *
- * `Vary` is a list, and two different concerns write to it here — content negotiation on `Accept`
- * (HTML document vs flight payload) and `Accept-Encoding` from the compressor. A plain `set` from
- * whichever ran last would drop the other, and a cache would then happily serve one variant in
- * place of the other. `*` is left alone: it already means "never reuse this".
+ * A 404 is heuristically cacheable under RFC 9111, and the miss this answers is the one a **rolling deploy**
+ * produces: an old instance 404s a content-hashed chunk the new one has. Without this a shared cache may
+ * store that answer against a URL that is about to become valid, and then serve it to everyone.
+ *
+ * Shared by the two mounts — `createStaticAssetsApp` for the filesystem targets and `mountStaticAssets` in
+ * `deploy/cloudflare/runtime.ts` — because it was written down in one of them and inherited by accident in
+ * the other, which is how the Workers mount came to have no terminal 404 at all. Here rather than in either,
+ * since `server/static.ts` reaches for `@hono/node-server` and a Worker bundle cannot import it.
+ *
+ * The same string as a page response's default (`PAGE_CACHE_CONTROL` in `entry.rsc.tsx`) and a separate
+ * constant on purpose: that one is about a logged-in user's page, this one about a hash that is about to
+ * resolve, and a change to either must not move the other.
  */
+export const ASSET_MISS_CACHE_CONTROL = 'private, no-cache';
+/**
+ * The `Vary` a response needs in order to carry `value`, or `null` when there is nothing to write — because it
+ * already lists it, or because it lists `*`, which means "never reuse this" and covers everything.
+ *
+ * What is already there is kept, spelling and all: a route, a middleware or a proxy may have added an entry of
+ * its own, and a plain `set` would drop it, leaving a cache free to serve one variant in place of another.
+ *
+ * The header is parsed into entries rather than tested as a string, because both of the questions it is asked
+ * are about the *list* and neither is about the text. `*` counts wherever it sits, not only alone — a cache
+ * told never to reuse a response is not told it harder by another field name. And an existing header with no
+ * entries in it (`vary: ''`, which an app writing one from a list that came out empty can produce, and which
+ * Hono keeps verbatim) is nothing to append to: `, RSC` is an empty list element, which RFC 9110 tells a
+ * sender not to generate, and a cache strict enough to reject the malformed header would drop the `Vary` that
+ * is the only thing keeping a page URL's two representations apart. That is the failure this header exists to
+ * prevent, reached through the header itself.
+ *
+ * Pure, and separate from {@link appendVary}, because the two callers cannot write the same way. One holds a
+ * `Response` it built itself; the response floor holds one the *app* may have returned, whose header bag can be
+ * immutable — see the floor in `entry.rsc.tsx`, which writes this answer through `c.header()`.
+ */
+export function varyWith(existing, value) {
+    if (existing === null)
+        return value;
+    const entries = existing.split(',').map((entry) => entry.trim());
+    if (entries.some((entry) => entry === '*' || entry.toLowerCase() === value.toLowerCase()))
+        return null;
+    // Appended to the original text, not to the parsed entries, so a header this has nothing to say about comes
+    // back exactly as its author wrote it.
+    return entries.some(Boolean) ? `${existing}, ${value}` : value;
+}
+/** {@link varyWith}, written straight back — for a `Headers` the caller knows it can write to. */
 export function appendVary(headers, value) {
-    const existing = headers.get('vary');
-    if (existing === null) {
-        headers.set('vary', value);
-        return;
-    }
-    if (existing.trim() === '*')
-        return;
-    const already = existing.split(',').some((entry) => entry.trim().toLowerCase() === value.toLowerCase());
-    if (!already)
-        headers.set('vary', `${existing}, ${value}`);
+    const vary = varyWith(headers.get('vary'), value);
+    if (vary !== null)
+        headers.set('vary', vary);
 }
 /**
- * True when an `If-None-Match` request header matches `etag`, i.e. the client already holds this
- * exact body and should be answered with a 304.
- *
- * The header carries a *list*, and each entry may be weak (`W/"…"`). The weak prefix is ignored on
- * both sides because the compressor rewrites a strong tag to a weak one when it changes the bytes
- * on the wire — the representation is still the same one the client cached.
+ * True when an `If-None-Match` matches `etag` — the client already holds this body and can be answered with a
+ * 304. The header carries a list, and the weak prefix is ignored on both sides: a CDN that gzips on the way out
+ * changes the bytes without changing the representation, and may weaken the validator when it does.
  */
 export function etagMatches(ifNoneMatch, etag) {
     if (!ifNoneMatch)

package/dist/server/headers.js.map

@@ -1 +1 @@
-{"version":3,"file":"headers.js","sourceRoot":"","sources":["../../src/server/headers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,OAAgB,EAAE,KAAa;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO;IACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACxG,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,QAAQ,KAAK,KAAK,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,WAA+B,EAAE,IAAY;IACvE,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3C,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,MAAM,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Small header utilities shared by the response-header defaults, the compressor and the\n * prerendered-page cache. Kept apart from any one of them because getting `Vary` and `ETag`\n * comparison subtly wrong is exactly the kind of thing that only shows up behind a CDN.\n */\n\n/**\n * Adds `value` to the `Vary` header without discarding what is already there.\n *\n * `Vary` is a list, and two different concerns write to it here — content negotiation on `Accept`\n * (HTML document vs flight payload) and `Accept-Encoding` from the compressor. A plain `set` from\n * whichever ran last would drop the other, and a cache would then happily serve one variant in\n * place of the other. `*` is left alone: it already means \"never reuse this\".\n */\nexport function appendVary(headers: Headers, value: string): void {\n  const existing = headers.get('vary');\n  if (existing === null) {\n    headers.set('vary', value);\n    return;\n  }\n  if (existing.trim() === '*') return;\n  const already = existing.split(',').some((entry) => entry.trim().toLowerCase() === value.toLowerCase());\n  if (!already) headers.set('vary', `${existing}, ${value}`);\n}\n\n/**\n * True when an `If-None-Match` request header matches `etag`, i.e. the client already holds this\n * exact body and should be answered with a 304.\n *\n * The header carries a *list*, and each entry may be weak (`W/\"…\"`). The weak prefix is ignored on\n * both sides because the compressor rewrites a strong tag to a weak one when it changes the bytes\n * on the wire — the representation is still the same one the client cached.\n */\nexport function etagMatches(ifNoneMatch: string | undefined, etag: string): boolean {\n  if (!ifNoneMatch) return false;\n  const normalize = (value: string) => value.trim().replace(/^W\\//, '');\n  const wanted = normalize(etag);\n  return ifNoneMatch.split(',').some((entry) => {\n    const candidate = normalize(entry);\n    return candidate === '*' || candidate === wanted;\n  });\n}\n"]}
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../../src/server/headers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAuB,EAAE,KAAa;IAC7D,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACvG,4GAA4G;IAC5G,uCAAuC;IACvC,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACjE,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,UAAU,CAAC,OAAgB,EAAE,KAAa;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,WAA+B,EAAE,IAAY;IACvE,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3C,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,MAAM,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Header utilities shared by the response-header defaults and the prerendered-page cache. Their own module\n * because getting `Vary` and `ETag` comparison subtly wrong only shows up behind a CDN.\n */\n\n/**\n * What a 404 under the `/_static` mount must carry, on every deploy target.\n *\n * A 404 is heuristically cacheable under RFC 9111, and the miss this answers is the one a **rolling deploy**\n * produces: an old instance 404s a content-hashed chunk the new one has. Without this a shared cache may\n * store that answer against a URL that is about to become valid, and then serve it to everyone.\n *\n * Shared by the two mounts — `createStaticAssetsApp` for the filesystem targets and `mountStaticAssets` in\n * `deploy/cloudflare/runtime.ts` — because it was written down in one of them and inherited by accident in\n * the other, which is how the Workers mount came to have no terminal 404 at all. Here rather than in either,\n * since `server/static.ts` reaches for `@hono/node-server` and a Worker bundle cannot import it.\n *\n * The same string as a page response's default (`PAGE_CACHE_CONTROL` in `entry.rsc.tsx`) and a separate\n * constant on purpose: that one is about a logged-in user's page, this one about a hash that is about to\n * resolve, and a change to either must not move the other.\n */\nexport const ASSET_MISS_CACHE_CONTROL = 'private, no-cache';\n\n/**\n * The `Vary` a response needs in order to carry `value`, or `null` when there is nothing to write — because it\n * already lists it, or because it lists `*`, which means \"never reuse this\" and covers everything.\n *\n * What is already there is kept, spelling and all: a route, a middleware or a proxy may have added an entry of\n * its own, and a plain `set` would drop it, leaving a cache free to serve one variant in place of another.\n *\n * The header is parsed into entries rather than tested as a string, because both of the questions it is asked\n * are about the *list* and neither is about the text. `*` counts wherever it sits, not only alone — a cache\n * told never to reuse a response is not told it harder by another field name. And an existing header with no\n * entries in it (`vary: ''`, which an app writing one from a list that came out empty can produce, and which\n * Hono keeps verbatim) is nothing to append to: `, RSC` is an empty list element, which RFC 9110 tells a\n * sender not to generate, and a cache strict enough to reject the malformed header would drop the `Vary` that\n * is the only thing keeping a page URL's two representations apart. That is the failure this header exists to\n * prevent, reached through the header itself.\n *\n * Pure, and separate from {@link appendVary}, because the two callers cannot write the same way. One holds a\n * `Response` it built itself; the response floor holds one the *app* may have returned, whose header bag can be\n * immutable — see the floor in `entry.rsc.tsx`, which writes this answer through `c.header()`.\n */\nexport function varyWith(existing: string | null, value: string): string | null {\n  if (existing === null) return value;\n  const entries = existing.split(',').map((entry) => entry.trim());\n  if (entries.some((entry) => entry === '*' || entry.toLowerCase() === value.toLowerCase())) return null;\n  // Appended to the original text, not to the parsed entries, so a header this has nothing to say about comes\n  // back exactly as its author wrote it.\n  return entries.some(Boolean) ? `${existing}, ${value}` : value;\n}\n\n/** {@link varyWith}, written straight back — for a `Headers` the caller knows it can write to. */\nexport function appendVary(headers: Headers, value: string): void {\n  const vary = varyWith(headers.get('vary'), value);\n  if (vary !== null) headers.set('vary', vary);\n}\n\n/**\n * True when an `If-None-Match` matches `etag` — the client already holds this body and can be answered with a\n * 304. The header carries a list, and the weak prefix is ignored on both sides: a CDN that gzips on the way out\n * changes the bytes without changing the representation, and may weaken the validator when it does.\n */\nexport function etagMatches(ifNoneMatch: string | undefined, etag: string): boolean {\n  if (!ifNoneMatch) return false;\n  const normalize = (value: string) => value.trim().replace(/^W\\//, '');\n  const wanted = normalize(etag);\n  return ifNoneMatch.split(',').some((entry) => {\n    const candidate = normalize(entry);\n    return candidate === '*' || candidate === wanted;\n  });\n}\n"]}

package/dist/server/load-config.d.ts

@@ -1,7 +1,6 @@
-import type { RSHonoConfig } from '../config.js';
+import type { RshonoConfig } from '../config.js';
 /**
- * Load the project config, or `{}` if none exists. Scans `rshono.config.{ts,js,mjs}` at
- * {@link rootDir} unless an explicit {@link configPath} is given (resolved relative to `cwd`).
+ * Loads the project config, or `{}` if there is none: scans `rshono.config.{ts,js,mjs}` at `rootDir`, unless an
+ * explicit `configPath` is given (resolved relative to `cwd`).
  */
-export declare function loadConfig(rootDir: string, configPath?: string): Promise<RSHonoConfig>;
-//# sourceMappingURL=load-config.d.ts.map
+export declare function loadConfig(rootDir: string, configPath?: string): Promise<RshonoConfig>;

package/dist/server/load-config.js

@@ -3,23 +3,19 @@ import { isAbsolute, join, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 const CONFIG_FILES = ['rshono.config.ts', 'rshono.config.js', 'rshono.config.mjs'];
 /**
- * Imports the config module.
+ * Imports the config module. A `.ts` config needs no loader: Node strips types natively from 22.18 on, which is
+ * what the package's `engines` floor is for.
  *
- * A `.js`/`.mjs` config is a plain dynamic import. A `.ts` one can't be — the CLI itself runs as
- * compiled JavaScript, so nothing in the process understands TypeScript by default. `tsx`'s
- * programmatic API is loaded for that case only, which keeps it off the startup path of every
- * other command instead of paying for a TypeScript loader the whole CLI doesn't need.
+ * The one thing native stripping will not do is resolve a `.js` specifier to a `.ts` file, so a config
+ * importing a sibling has to name it with its real extension — {@link loadConfig} turns that resolution failure
+ * into the advice rather than letting a raw `ERR_MODULE_NOT_FOUND` out.
  */
-async function importConfig(file) {
-    const href = pathToFileURL(file).href;
-    if (!/\.[cm]?ts$/.test(file))
-        return import(href);
-    const { tsImport } = await import('tsx/esm/api');
-    return tsImport(href, import.meta.url);
+function importConfig(file) {
+    return import(pathToFileURL(file).href);
 }
 /**
- * Load the project config, or `{}` if none exists. Scans `rshono.config.{ts,js,mjs}` at
- * {@link rootDir} unless an explicit {@link configPath} is given (resolved relative to `cwd`).
+ * Loads the project config, or `{}` if there is none: scans `rshono.config.{ts,js,mjs}` at `rootDir`, unless an
+ * explicit `configPath` is given (resolved relative to `cwd`).
  */
 export async function loadConfig(rootDir, configPath) {
     const file = configPath
@@ -32,7 +28,19 @@ export async function loadConfig(rootDir, configPath) {
     if (!existsSync(file)) {
         throw new Error(`[rshono] config file not found: ${file}`);
     }
-    const mod = await importConfig(file);
+    let mod;
+    try {
+        mod = await importConfig(file);
+    }
+    catch (error) {
+        // The one failure mode native type stripping has that a TypeScript-aware loader does not.
+        if (/\.[cm]?ts$/.test(file) && error?.code === 'ERR_MODULE_NOT_FOUND') {
+            throw new Error(`[rshono] ${file} imports a module Node could not resolve: ${error.message}\n` +
+                '  A .ts config is loaded by Node itself, which does not rewrite a .js specifier to the .ts file ' +
+                'beside it. Import it by its real extension, or move the config to rshono.config.mjs.', { cause: error });
+        }
+        throw error;
+    }
     if (!mod.default) {
         throw new Error(`[rshono] ${file} must \`export default\` a config object (use \`defineConfig({ … })\`).`);
     }

package/dist/server/load-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"load-config.js","sourceRoot":"","sources":["../../src/server/load-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,MAAM,YAAY,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;AAEnF;;;;;;;GAOG;AACH,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACtC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAwC,CAAC;IACzF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACjD,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,GAAG,CAAwC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAe,EAAE,UAAmB;IACnE,MAAM,IAAI,GAAG,UAAU;QACrB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;YACtB,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC;QACtC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,yEAAyE,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC","sourcesContent":["import { existsSync } from 'node:fs';\nimport { isAbsolute, join, resolve } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport type { RSHonoConfig } from '../config.js';\n\nconst CONFIG_FILES = ['rshono.config.ts', 'rshono.config.js', 'rshono.config.mjs'];\n\n/**\n * Imports the config module.\n *\n * A `.js`/`.mjs` config is a plain dynamic import. A `.ts` one can't be — the CLI itself runs as\n * compiled JavaScript, so nothing in the process understands TypeScript by default. `tsx`'s\n * programmatic API is loaded for that case only, which keeps it off the startup path of every\n * other command instead of paying for a TypeScript loader the whole CLI doesn't need.\n */\nasync function importConfig(file: string): Promise<{ default?: RSHonoConfig }> {\n  const href = pathToFileURL(file).href;\n  if (!/\\.[cm]?ts$/.test(file)) return import(href) as Promise<{ default?: RSHonoConfig }>;\n  const { tsImport } = await import('tsx/esm/api');\n  return tsImport(href, import.meta.url) as Promise<{ default?: RSHonoConfig }>;\n}\n\n/**\n * Load the project config, or `{}` if none exists. Scans `rshono.config.{ts,js,mjs}` at\n * {@link rootDir} unless an explicit {@link configPath} is given (resolved relative to `cwd`).\n */\nexport async function loadConfig(rootDir: string, configPath?: string): Promise<RSHonoConfig> {\n  const file = configPath\n    ? isAbsolute(configPath)\n      ? configPath\n      : resolve(process.cwd(), configPath)\n    : CONFIG_FILES.map((f) => join(rootDir, f)).find(existsSync);\n  if (!file) return {};\n  if (!existsSync(file)) {\n    throw new Error(`[rshono] config file not found: ${file}`);\n  }\n  const mod = await importConfig(file);\n  if (!mod.default) {\n    throw new Error(`[rshono] ${file} must \\`export default\\` a config object (use \\`defineConfig({ … })\\`).`);\n  }\n  return mod.default;\n}\n"]}
+{"version":3,"file":"load-config.js","sourceRoot":"","sources":["../../src/server/load-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,MAAM,YAAY,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;AAEnF;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAwC,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAe,EAAE,UAAmB;IACnE,MAAM,IAAI,GAAG,UAAU;QACrB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;YACtB,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC;QACtC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,GAA+B,CAAC;IACpC,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0FAA0F;QAC1F,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAK,KAAkC,EAAE,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACpG,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,6CAA8C,KAAe,CAAC,OAAO,IAAI;gBACvF,kGAAkG;gBAClG,sFAAsF,EACxF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,yEAAyE,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC","sourcesContent":["import { existsSync } from 'node:fs';\nimport { isAbsolute, join, resolve } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport type { RshonoConfig } from '../config.js';\n\nconst CONFIG_FILES = ['rshono.config.ts', 'rshono.config.js', 'rshono.config.mjs'];\n\n/**\n * Imports the config module. A `.ts` config needs no loader: Node strips types natively from 22.18 on, which is\n * what the package's `engines` floor is for.\n *\n * The one thing native stripping will not do is resolve a `.js` specifier to a `.ts` file, so a config\n * importing a sibling has to name it with its real extension — {@link loadConfig} turns that resolution failure\n * into the advice rather than letting a raw `ERR_MODULE_NOT_FOUND` out.\n */\nfunction importConfig(file: string): Promise<{ default?: RshonoConfig }> {\n  return import(pathToFileURL(file).href) as Promise<{ default?: RshonoConfig }>;\n}\n\n/**\n * Loads the project config, or `{}` if there is none: scans `rshono.config.{ts,js,mjs}` at `rootDir`, unless an\n * explicit `configPath` is given (resolved relative to `cwd`).\n */\nexport async function loadConfig(rootDir: string, configPath?: string): Promise<RshonoConfig> {\n  const file = configPath\n    ? isAbsolute(configPath)\n      ? configPath\n      : resolve(process.cwd(), configPath)\n    : CONFIG_FILES.map((f) => join(rootDir, f)).find(existsSync);\n  if (!file) return {};\n  if (!existsSync(file)) {\n    throw new Error(`[rshono] config file not found: ${file}`);\n  }\n  let mod: { default?: RshonoConfig };\n  try {\n    mod = await importConfig(file);\n  } catch (error) {\n    // The one failure mode native type stripping has that a TypeScript-aware loader does not.\n    if (/\\.[cm]?ts$/.test(file) && (error as { code?: string } | null)?.code === 'ERR_MODULE_NOT_FOUND') {\n      throw new Error(\n        `[rshono] ${file} imports a module Node could not resolve: ${(error as Error).message}\\n` +\n          '  A .ts config is loaded by Node itself, which does not rewrite a .js specifier to the .ts file ' +\n          'beside it. Import it by its real extension, or move the config to rshono.config.mjs.',\n        { cause: error },\n      );\n    }\n    throw error;\n  }\n  if (!mod.default) {\n    throw new Error(`[rshono] ${file} must \\`export default\\` a config object (use \\`defineConfig({ … })\\`).`);\n  }\n  return mod.default;\n}\n"]}

package/dist/server/load-env.d.ts

@@ -1,2 +1 @@
 export declare function loadEnvFiles(rootDir: string): void;
-//# sourceMappingURL=load-env.d.ts.map

package/dist/server/prerendered.d.ts

@@ -1,67 +1,121 @@
 /**
- * Everything about a prerendered page that doesn't need a filesystem: where the build puts it, and
- * what it looks like once read back.
+ * Everything about a prerendered page that doesn't need a filesystem: where the build puts it, and what it
+ * looks like once read back.
  *
- * Split out of `ssg.ts` — which owns the writing and the reading, both through `node:fs` — because a
- * deploy target without a filesystem reads the very same layout out of an asset store, and importing
- * it from the fs module would drag `node:fs` and `node:crypto` into a bundle that has neither.
+ * Apart from `ssg.ts`, which does the reading and writing through `node:fs`, because a deploy target without a
+ * filesystem reads the same layout out of an asset store — and importing it from there would drag `node:fs`
+ * into a bundle that has neither.
  */
 /**
- * The two representations of a page, prerendered side by side.
- *
- * A hard load wants the HTML document; a soft navigation asks the same URL for a flight payload.
- * Writing only the HTML meant every in-app click re-rendered a page that was already built, so the
- * prerender only ever paid off for cold loads and crawlers.
+ * The two representations of a page, prerendered side by side: a hard load wants the HTML document, a soft
+ * navigation asks the same URL for a flight payload. Without both, every in-app click would re-render a page
+ * that was already built.
  */
 export type PrerenderVariant = 'html' | 'flight';
 export declare const VARIANTS: {
     readonly html: {
         readonly file: 'index.html';
-        readonly accept: 'text/html';
+        readonly headers: {};
         readonly contentType: 'text/html';
     };
     readonly flight: {
         readonly file: 'index.rsc';
-        readonly accept: 'text/x-component';
+        readonly headers: {
+            readonly RSC: '1';
+        };
         readonly contentType: 'text/x-component';
     };
 };
 /**
- * Where a route's prerendered output lives, relative to the output root — or `null` for a path that
- * cannot be prerendered at all (one with a param or a wildcard left in it).
+ * How a build-time document render tells the prerender pass that the app minted a CSP nonce for its path.
+ *
+ * The other half of the same contract as {@link VARIANTS}, and it exists because the pass cannot see the
+ * request it made: it renders through the app's own middleware inside the server bundle, in a module graph of
+ * its own, and keeps the body alone. What it needs to know is whether a *request* for this path will mint a
+ * nonce, because a document that will is one the framework re-renders per request — so the file the pass is
+ * about to write is one no deployment will read, and saying "prerendered" about it is a lie by omission.
+ *
+ * Set only while `RSHONO_PRERENDER` is in the environment, which is `rshono build`'s own process, so it never
+ * reaches a deployed response; and never stored, since only the body is.
+ */
+export declare const PRERENDER_NONCE_HEADER = "x-rshono-prerender-nonce";
+/**
+ * The index the build leaves beside the pages, naming every file it wrote — one `files` array of
+ * {@link ssgFilePath} names.
  *
- * Always `/`-separated, never the host's separator: the same string addresses a file on a filesystem
- * (`resolve()` and `join()` both accept forward slashes on Windows) and a key in an asset store,
- * where a backslash would simply be the wrong character.
+ * It exists so a reader can tell "this store has no page for that path" without asking the store, which is
+ * the difference between a `Map` lookup and a failed `readFile` (or, without a filesystem, a failed store
+ * fetch) on **every** request to a static route the build could not prerender — misses are deliberately not
+ * cached, so that one never warms up. Absent is not an error: a build from an older rshono has none, and a
+ * reader that finds none looks the way it always did.
  */
-export declare function ssgFilePath(routePath: string, variant?: PrerenderVariant): string | null;
+export declare const SSG_MANIFEST_FILE = "manifest.json";
 /**
- * {@link ssgFilePath} for a path that came off a request, so traversal is a miss rather than a lookup.
+ * Where a path's prerendered output lives, relative to the output root — or `null` for a path no single file
+ * can answer.
  *
- * The first line of defence for every deploy target: a store addressed by key has no `resolve()` to
- * fall back on, so `..` has to be refused here or not at all.
+ * **The one canonical form**, shared by the build that writes the file and by every deploy target that reads
+ * it back, because the two drifting apart is invisible: the build reports the page as prerendered and every
+ * request afterwards falls through to SSR, forever. Each segment is stored *decoded*, so `/docs/café` is
+ * `docs/café` whether the caller holds the path percent-encoded — the build, which interpolates `staticPaths`
+ * values into a URL — or already decoded, as Hono's `c.req.path` is: it runs `decodeURI` over any path
+ * containing a `%`. Decoded is also the form every other static file server addresses, so the tree stays
+ * servable by something that is not this framework.
+ *
+ * Always `/`-separated: the same string addresses a file on a filesystem, which accepts forward slashes on
+ * Windows too, and a key in an asset store, where a backslash would be the wrong character.
+ *
+ * `null` is everything that is not one file: a `.` or `..` segment — so traversal is a miss rather than a
+ * lookup, which a store addressed by key, with no `resolve()` to fall back on, depends on — an empty segment,
+ * and any segment {@link isStorableSegment} refuses as unportable.
  */
-export declare function prerenderedRelPath(requestPath: string, variant: PrerenderVariant): string | null;
+export declare function ssgFilePath(path: string, variant?: PrerenderVariant): string | null;
+/**
+ * {@link ssgFilePath} as a URL path, for a store addressed by one rather than by key. Every segment is escaped
+ * on the way out and the store decodes it back, so a page reached through a URL lands on the same file a
+ * filesystem target opens by name.
+ */
+export declare function ssgAssetPath(relPath: string): string;
+/**
+ * A bounded, insertion-ordered cache of prerendered pages, so a site with thousands of them keeps a working set
+ * rather than the whole build in memory. Only *hits* are stored — caching misses would let anyone mint entries
+ * by requesting paths that don't exist — and the files never change while the server is up.
+ *
+ * Bounded by **bytes**, not by entry count: a count says nothing about how much memory it stands for, and a
+ * page can be any size. At 128 entries — the previous limit — a documentation site with half-megabyte pages
+ * retained ~64 MB across the two variants, with nothing about the number to suggest it.
+ *
+ * A page larger than the whole budget is served and not stored, rather than evicting everything to hold one.
+ */
+export declare function createPageCache(maxBytes?: number): {
+    get(key: string): PrerenderedPage | undefined;
+    set(key: string, page: PrerenderedPage): void;
+};
+/**
+ * Assembles a {@link PrerenderedPage} from a body just read out of the build. `storeEtag` is the validator the
+ * store supplied, where it has one: it already describes these exact bytes, so it is weakened rather than
+ * replaced by a fresh hash.
+ */
+export declare function toPrerenderedPage(body: Uint8Array<ArrayBuffer>, storeEtag?: string | null): Promise<PrerenderedPage>;
 /** A prerendered page, ready to serve: its body and a validator derived from those exact bytes. */
 export interface PrerenderedPage {
-    /** The document or the flight payload, depending on which {@link PrerenderVariant} was read. */
-    body: string;
     /**
-     * `Content-Length` for {@link body}, in bytes rather than characters.
-     *
-     * Served with the response because Hono sets no length for an in-memory body, and without one the
-     * compressor cannot tell a 300-byte page from a 300 KB one — so it gzips both, including the ones
-     * where the framing costs more than it saves.
+     * The document or the flight payload, depending on which {@link PrerenderVariant} was read. Bytes rather
+     * than a string, because this cache entry is served verbatim to every request that hits it — as a string,
+     * each would pay a fresh UTF-8 encode of the whole page.
+     */
+    body: Uint8Array<ArrayBuffer>;
+    /**
+     * `Content-Length` for {@link body}, in bytes. Served explicitly because Hono sets no length for an
+     * in-memory body, and a proxy in front is entitled to make decisions with it.
      */
     contentLength: string;
     /**
      * `ETag` for the page, so a revalidating client can be answered with a 304 instead of the body.
      *
-     * Deliberately **weak**. The bytes on the wire depend on whether the client took gzip, and a
-     * strong validator would have to differ between those two — so the 200 and the 304 that
-     * revalidates it would disagree, and a cache would treat them as different pages. A weak tag
-     * says "the same representation", which is exactly what is true across content codings.
+     * Deliberately **weak**: the bytes on the wire depend on whether something in front re-encoded them, so a
+     * strong validator would differ per coding and a cache would treat the 200 and the 304 that revalidates it
+     * as different pages. A weak tag says "the same representation", which stays true across codings.
      */
     etag: string;
 }
-//# sourceMappingURL=prerendered.d.ts.map