@rshono/core 1.0.0-rc.2 → 1.0.0-rc.21

package/dist/server/prerendered.js

@@ -1,39 +1,199 @@
 /**
- * Everything about a prerendered page that doesn't need a filesystem: where the build puts it, and
- * what it looks like once read back.
+ * Everything about a prerendered page that doesn't need a filesystem: where the build puts it, and what it
+ * looks like once read back.
  *
- * Split out of `ssg.ts` — which owns the writing and the reading, both through `node:fs` — because a
- * deploy target without a filesystem reads the very same layout out of an asset store, and importing
- * it from the fs module would drag `node:fs` and `node:crypto` into a bundle that has neither.
+ * Apart from `ssg.ts`, which does the reading and writing through `node:fs`, because a deploy target without a
+ * filesystem reads the same layout out of an asset store — and importing it from there would drag `node:fs`
+ * into a bundle that has neither.
  */
 export const VARIANTS = {
-    html: { file: 'index.html', accept: 'text/html', contentType: 'text/html' },
-    flight: { file: 'index.rsc', accept: 'text/x-component', contentType: 'text/x-component' },
+    // `headers` is what the build asks each representation for, so it stays the same request the browser makes:
+    // a document is the default and a flight payload is the `RSC` header. See `runtime/request.ts`.
+    html: { file: 'index.html', headers: {}, contentType: 'text/html' },
+    flight: { file: 'index.rsc', headers: { RSC: '1' }, contentType: 'text/x-component' },
 };
 /**
- * Where a route's prerendered output lives, relative to the output root — or `null` for a path that
- * cannot be prerendered at all (one with a param or a wildcard left in it).
+ * How a build-time document render tells the prerender pass that the app minted a CSP nonce for its path.
  *
- * Always `/`-separated, never the host's separator: the same string addresses a file on a filesystem
- * (`resolve()` and `join()` both accept forward slashes on Windows) and a key in an asset store,
- * where a backslash would simply be the wrong character.
+ * The other half of the same contract as {@link VARIANTS}, and it exists because the pass cannot see the
+ * request it made: it renders through the app's own middleware inside the server bundle, in a module graph of
+ * its own, and keeps the body alone. What it needs to know is whether a *request* for this path will mint a
+ * nonce, because a document that will is one the framework re-renders per request — so the file the pass is
+ * about to write is one no deployment will read, and saying "prerendered" about it is a lie by omission.
+ *
+ * Set only while `RSHONO_PRERENDER` is in the environment, which is `rshono build`'s own process, so it never
+ * reaches a deployed response; and never stored, since only the body is.
+ */
+export const PRERENDER_NONCE_HEADER = 'x-rshono-prerender-nonce';
+/**
+ * The index the build leaves beside the pages, naming every file it wrote — one `files` array of
+ * {@link ssgFilePath} names.
+ *
+ * It exists so a reader can tell "this store has no page for that path" without asking the store, which is
+ * the difference between a `Map` lookup and a failed `readFile` (or, without a filesystem, a failed store
+ * fetch) on **every** request to a static route the build could not prerender — misses are deliberately not
+ * cached, so that one never warms up. Absent is not an error: a build from an older rshono has none, and a
+ * reader that finds none looks the way it always did.
+ */
+export const SSG_MANIFEST_FILE = 'manifest.json';
+/**
+ * What a decoded path segment may not hold if it is to be one portable file name. `\ / : * ? " < > |` are
+ * refused by Windows and `/` by every host, so a `staticPaths` value containing one fails the build rather
+ * than writing a page on one machine and not on another — and a route pattern, whose params and wildcards are
+ * spelled with `:` and `*`, falls out of the same rule.
+ */
+const UNPORTABLE_SEGMENT = /[\\/:*?"<>|]/;
+/**
+ * The DOS device names Windows still reserves, with or without an extension and whatever the case — so
+ * `con`, `CON` and `Con.txt` are all the console. `mkdir` on one fails with `EINVAL`, naming a path the
+ * author never wrote, which is why they are refused here with the rest.
+ *
+ * The list is Microsoft's, superscripts included: `CON PRN AUX NUL`, `COM0`–`COM9`, `COM¹ COM² COM³`, and
+ * the same three suffixes for `LPT`. A documentation slug of `con` is a plausible thing to write and
+ * builds fine on Linux today; refusing it everywhere is the same trade `:` and `*` already make — portable
+ * or not at all, rather than a build that works on the author's machine and fails in CI on Windows.
+ */
+const RESERVED_DEVICE_NAME = /^(?:con|prn|aux|nul|com[0-9¹²³]|lpt[0-9¹²³])(?:\..*)?$/i;
+/**
+ * A trailing `.` or space, which Win32 **strips** rather than refusing: `docs/x.` is stored as `docs/x`, so
+ * the page is written where no reader will look for it — "a page the build reports as prerendered and
+ * nothing ever serves", which is the failure {@link ssgFilePath} exists to prevent. The silent half of this
+ * rule, and the more important one: the reserved names above at least fail loudly.
+ */
+const TRAILING_STRIPPED = /[. ]$/;
+/**
+ * Decodes one path segment the way a URL does, treating a malformed escape as the literal text it is:
+ * `decodeURIComponent('%')` throws, and a request path is whatever the client chose to send.
+ */
+function decodeSegment(segment) {
+    try {
+        return decodeURIComponent(segment);
+    }
+    catch {
+        return segment;
+    }
+}
+/**
+ * Whether one decoded segment can be a directory in the prerender tree, on every host rather than on this
+ * one: not empty, not a relative-path marker, made only of characters a file name can hold
+ * ({@link UNPORTABLE_SEGMENT}, plus the control characters, which a percent-escape is free to carry into a
+ * path and no filesystem wants in a name), not a {@link RESERVED_DEVICE_NAME}, and not ending in a
+ * character Win32 would {@link TRAILING_STRIPPED | strip}.
+ *
+ * The last two are Windows rules that no macOS or Linux build can discover for itself — which is exactly
+ * why they belong in a check rather than in a caveat.
  */
-export function ssgFilePath(routePath, variant = 'html') {
-    if (/[:*]/.test(routePath))
-        return null;
-    const trimmed = routePath.replace(/^\/+|\/+$/g, '');
+function isStorableSegment(segment) {
+    if (segment === '' || segment === '.' || segment === '..')
+        return false;
+    if (RESERVED_DEVICE_NAME.test(segment) || TRAILING_STRIPPED.test(segment))
+        return false;
+    return !UNPORTABLE_SEGMENT.test(segment) && ![...segment].some((char) => char < ' ');
+}
+/**
+ * Where a path's prerendered output lives, relative to the output root — or `null` for a path no single file
+ * can answer.
+ *
+ * **The one canonical form**, shared by the build that writes the file and by every deploy target that reads
+ * it back, because the two drifting apart is invisible: the build reports the page as prerendered and every
+ * request afterwards falls through to SSR, forever. Each segment is stored *decoded*, so `/docs/café` is
+ * `docs/café` whether the caller holds the path percent-encoded — the build, which interpolates `staticPaths`
+ * values into a URL — or already decoded, as Hono's `c.req.path` is: it runs `decodeURI` over any path
+ * containing a `%`. Decoded is also the form every other static file server addresses, so the tree stays
+ * servable by something that is not this framework.
+ *
+ * Always `/`-separated: the same string addresses a file on a filesystem, which accepts forward slashes on
+ * Windows too, and a key in an asset store, where a backslash would be the wrong character.
+ *
+ * `null` is everything that is not one file: a `.` or `..` segment — so traversal is a miss rather than a
+ * lookup, which a store addressed by key, with no `resolve()` to fall back on, depends on — an empty segment,
+ * and any segment {@link isStorableSegment} refuses as unportable.
+ */
+export function ssgFilePath(path, variant = 'html') {
     const file = VARIANTS[variant].file;
-    return trimmed === '' ? file : `${trimmed}/${file}`;
+    const trimmed = path.replace(/^\/+|\/+$/g, '');
+    if (trimmed === '')
+        return file;
+    const segments = [];
+    for (const encoded of trimmed.split('/')) {
+        const segment = decodeSegment(encoded);
+        if (!isStorableSegment(segment))
+            return null;
+        segments.push(segment);
+    }
+    return `${segments.join('/')}/${file}`;
+}
+/**
+ * {@link ssgFilePath} as a URL path, for a store addressed by one rather than by key. Every segment is escaped
+ * on the way out and the store decodes it back, so a page reached through a URL lands on the same file a
+ * filesystem target opens by name.
+ */
+export function ssgAssetPath(relPath) {
+    return relPath.split('/').map(encodeURIComponent).join('/');
 }
+/** The default cache budget: enough for a large documentation site's working set, small enough to be ignorable. */
+const DEFAULT_CACHE_BYTES = 32 * 1024 * 1024;
 /**
- * {@link ssgFilePath} for a path that came off a request, so traversal is a miss rather than a lookup.
+ * A bounded, insertion-ordered cache of prerendered pages, so a site with thousands of them keeps a working set
+ * rather than the whole build in memory. Only *hits* are stored — caching misses would let anyone mint entries
+ * by requesting paths that don't exist — and the files never change while the server is up.
+ *
+ * Bounded by **bytes**, not by entry count: a count says nothing about how much memory it stands for, and a
+ * page can be any size. At 128 entries — the previous limit — a documentation site with half-megabyte pages
+ * retained ~64 MB across the two variants, with nothing about the number to suggest it.
  *
- * The first line of defence for every deploy target: a store addressed by key has no `resolve()` to
- * fall back on, so `..` has to be refused here or not at all.
+ * A page larger than the whole budget is served and not stored, rather than evicting everything to hold one.
+ */
+export function createPageCache(maxBytes = DEFAULT_CACHE_BYTES) {
+    const pages = new Map();
+    let bytes = 0;
+    return {
+        get: (key) => pages.get(key),
+        set(key, page) {
+            const size = page.body.byteLength;
+            if (size > maxBytes)
+                return;
+            // Deleted before it is set, so re-setting an existing key moves it to the *back*: `Map.set` on a key it
+            // already holds keeps that key's original position, which would leave the entry just stored sitting at
+            // the front as the next thing evicted — a store whose eviction could drop the write that caused it.
+            const replaced = pages.get(key);
+            if (replaced) {
+                bytes -= replaced.body.byteLength;
+                pages.delete(key);
+            }
+            pages.set(key, page);
+            bytes += size;
+            // Insertion-ordered, so the first key is the oldest.
+            while (bytes > maxBytes) {
+                const oldest = pages.keys().next().value;
+                bytes -= pages.get(oldest).body.byteLength;
+                pages.delete(oldest);
+            }
+        },
+    };
+}
+/**
+ * A weak `ETag` for a page body — see {@link PrerenderedPage.etag} for why weak. Web Crypto rather than
+ * `node:crypto`, so one implementation serves both a Node server and `workerd`.
+ */
+async function weakEtag(body) {
+    const digest = await crypto.subtle.digest('SHA-256', body);
+    const base64url = btoa(String.fromCharCode(...new Uint8Array(digest)))
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+    return `W/"${base64url.slice(0, 22)}"`;
+}
+/**
+ * Assembles a {@link PrerenderedPage} from a body just read out of the build. `storeEtag` is the validator the
+ * store supplied, where it has one: it already describes these exact bytes, so it is weakened rather than
+ * replaced by a fresh hash.
  */
-export function prerenderedRelPath(requestPath, variant) {
-    if (/(^|\/)\.\.?(\/|$)/.test(requestPath))
-        return null;
-    return ssgFilePath(requestPath, variant);
+export async function toPrerenderedPage(body, storeEtag) {
+    return {
+        body,
+        contentLength: String(body.byteLength),
+        etag: storeEtag ? storeEtag.replace(/^(?!W\/)/, 'W/') : await weakEtag(body),
+    };
 }
 //# sourceMappingURL=prerendered.js.map

package/dist/server/prerendered.js.map

@@ -1 +1 @@
-{"version":3,"file":"prerendered.js","sourceRoot":"","sources":["../../src/server/prerendered.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE;IAC3E,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,kBAAkB,EAAE;CACQ,CAAC;AAErG;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,OAAO,GAAqB,MAAM;IAC/E,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IACpC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,OAAyB;IAC/E,IAAI,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC","sourcesContent":["/**\n * Everything about a prerendered page that doesn't need a filesystem: where the build puts it, and\n * what it looks like once read back.\n *\n * Split out of `ssg.ts` — which owns the writing and the reading, both through `node:fs` — because a\n * deploy target without a filesystem reads the very same layout out of an asset store, and importing\n * it from the fs module would drag `node:fs` and `node:crypto` into a bundle that has neither.\n */\n\n/**\n * The two representations of a page, prerendered side by side.\n *\n * A hard load wants the HTML document; a soft navigation asks the same URL for a flight payload.\n * Writing only the HTML meant every in-app click re-rendered a page that was already built, so the\n * prerender only ever paid off for cold loads and crawlers.\n */\nexport type PrerenderVariant = 'html' | 'flight';\n\nexport const VARIANTS = {\n  html: { file: 'index.html', accept: 'text/html', contentType: 'text/html' },\n  flight: { file: 'index.rsc', accept: 'text/x-component', contentType: 'text/x-component' },\n} as const satisfies Record<PrerenderVariant, { file: string; accept: string; contentType: string }>;\n\n/**\n * Where a route's prerendered output lives, relative to the output root — or `null` for a path that\n * cannot be prerendered at all (one with a param or a wildcard left in it).\n *\n * Always `/`-separated, never the host's separator: the same string addresses a file on a filesystem\n * (`resolve()` and `join()` both accept forward slashes on Windows) and a key in an asset store,\n * where a backslash would simply be the wrong character.\n */\nexport function ssgFilePath(routePath: string, variant: PrerenderVariant = 'html'): string | null {\n  if (/[:*]/.test(routePath)) return null;\n  const trimmed = routePath.replace(/^\\/+|\\/+$/g, '');\n  const file = VARIANTS[variant].file;\n  return trimmed === '' ? file : `${trimmed}/${file}`;\n}\n\n/**\n * {@link ssgFilePath} for a path that came off a request, so traversal is a miss rather than a lookup.\n *\n * The first line of defence for every deploy target: a store addressed by key has no `resolve()` to\n * fall back on, so `..` has to be refused here or not at all.\n */\nexport function prerenderedRelPath(requestPath: string, variant: PrerenderVariant): string | null {\n  if (/(^|\\/)\\.\\.?(\\/|$)/.test(requestPath)) return null;\n  return ssgFilePath(requestPath, variant);\n}\n\n/** A prerendered page, ready to serve: its body and a validator derived from those exact bytes. */\nexport interface PrerenderedPage {\n  /** The document or the flight payload, depending on which {@link PrerenderVariant} was read. */\n  body: string;\n  /**\n   * `Content-Length` for {@link body}, in bytes rather than characters.\n   *\n   * Served with the response because Hono sets no length for an in-memory body, and without one the\n   * compressor cannot tell a 300-byte page from a 300 KB one — so it gzips both, including the ones\n   * where the framing costs more than it saves.\n   */\n  contentLength: string;\n  /**\n   * `ETag` for the page, so a revalidating client can be answered with a 304 instead of the body.\n   *\n   * Deliberately **weak**. The bytes on the wire depend on whether the client took gzip, and a\n   * strong validator would have to differ between those two — so the 200 and the 304 that\n   * revalidates it would disagree, and a cache would treat them as different pages. A weak tag\n   * says \"the same representation\", which is exactly what is true across content codings.\n   */\n  etag: string;\n}\n"]}
+{"version":3,"file":"prerendered.js","sourceRoot":"","sources":["../../src/server/prerendered.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,4GAA4G;IAC5G,gGAAgG;IAChG,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE;IACnE,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;CAC8B,CAAC;AAEtH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AAEjE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAE1C;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAG,yDAAyD,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC;;;GAGG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAAO,GAAqB,MAAM;IAC1E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,mHAAmH;AACnH,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE7C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,QAAQ,GAAG,mBAAmB;IAI5D,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO;QACL,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;QAC5B,GAAG,CAAC,GAAG,EAAE,IAAI;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;YAClC,IAAI,IAAI,GAAG,QAAQ;gBAAE,OAAO;YAC5B,wGAAwG;YACxG,uGAAuG;YACvG,oGAAoG;YACpG,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;gBAClC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACrB,KAAK,IAAI,IAAI,CAAC;YACd,qDAAqD;YACrD,OAAO,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC;gBAC1C,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC5C,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,QAAQ,CAAC,IAA6B;IACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;SACnE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,OAAO,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAA6B,EAAE,SAAyB;IAC9F,OAAO;QACL,IAAI;QACJ,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACtC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC;KAC7E,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Everything about a prerendered page that doesn't need a filesystem: where the build puts it, and what it\n * looks like once read back.\n *\n * Apart from `ssg.ts`, which does the reading and writing through `node:fs`, because a deploy target without a\n * filesystem reads the same layout out of an asset store — and importing it from there would drag `node:fs`\n * into a bundle that has neither.\n */\n\n/**\n * The two representations of a page, prerendered side by side: a hard load wants the HTML document, a soft\n * navigation asks the same URL for a flight payload. Without both, every in-app click would re-render a page\n * that was already built.\n */\nexport type PrerenderVariant = 'html' | 'flight';\n\nexport const VARIANTS = {\n  // `headers` is what the build asks each representation for, so it stays the same request the browser makes:\n  // a document is the default and a flight payload is the `RSC` header. See `runtime/request.ts`.\n  html: { file: 'index.html', headers: {}, contentType: 'text/html' },\n  flight: { file: 'index.rsc', headers: { RSC: '1' }, contentType: 'text/x-component' },\n} as const satisfies Record<PrerenderVariant, { file: string; headers: Record<string, string>; contentType: string }>;\n\n/**\n * How a build-time document render tells the prerender pass that the app minted a CSP nonce for its path.\n *\n * The other half of the same contract as {@link VARIANTS}, and it exists because the pass cannot see the\n * request it made: it renders through the app's own middleware inside the server bundle, in a module graph of\n * its own, and keeps the body alone. What it needs to know is whether a *request* for this path will mint a\n * nonce, because a document that will is one the framework re-renders per request — so the file the pass is\n * about to write is one no deployment will read, and saying \"prerendered\" about it is a lie by omission.\n *\n * Set only while `RSHONO_PRERENDER` is in the environment, which is `rshono build`'s own process, so it never\n * reaches a deployed response; and never stored, since only the body is.\n */\nexport const PRERENDER_NONCE_HEADER = 'x-rshono-prerender-nonce';\n\n/**\n * The index the build leaves beside the pages, naming every file it wrote — one `files` array of\n * {@link ssgFilePath} names.\n *\n * It exists so a reader can tell \"this store has no page for that path\" without asking the store, which is\n * the difference between a `Map` lookup and a failed `readFile` (or, without a filesystem, a failed store\n * fetch) on **every** request to a static route the build could not prerender — misses are deliberately not\n * cached, so that one never warms up. Absent is not an error: a build from an older rshono has none, and a\n * reader that finds none looks the way it always did.\n */\nexport const SSG_MANIFEST_FILE = 'manifest.json';\n\n/**\n * What a decoded path segment may not hold if it is to be one portable file name. `\\ / : * ? \" < > |` are\n * refused by Windows and `/` by every host, so a `staticPaths` value containing one fails the build rather\n * than writing a page on one machine and not on another — and a route pattern, whose params and wildcards are\n * spelled with `:` and `*`, falls out of the same rule.\n */\nconst UNPORTABLE_SEGMENT = /[\\\\/:*?\"<>|]/;\n\n/**\n * The DOS device names Windows still reserves, with or without an extension and whatever the case — so\n * `con`, `CON` and `Con.txt` are all the console. `mkdir` on one fails with `EINVAL`, naming a path the\n * author never wrote, which is why they are refused here with the rest.\n *\n * The list is Microsoft's, superscripts included: `CON PRN AUX NUL`, `COM0`–`COM9`, `COM¹ COM² COM³`, and\n * the same three suffixes for `LPT`. A documentation slug of `con` is a plausible thing to write and\n * builds fine on Linux today; refusing it everywhere is the same trade `:` and `*` already make — portable\n * or not at all, rather than a build that works on the author's machine and fails in CI on Windows.\n */\nconst RESERVED_DEVICE_NAME = /^(?:con|prn|aux|nul|com[0-9¹²³]|lpt[0-9¹²³])(?:\\..*)?$/i;\n\n/**\n * A trailing `.` or space, which Win32 **strips** rather than refusing: `docs/x.` is stored as `docs/x`, so\n * the page is written where no reader will look for it — \"a page the build reports as prerendered and\n * nothing ever serves\", which is the failure {@link ssgFilePath} exists to prevent. The silent half of this\n * rule, and the more important one: the reserved names above at least fail loudly.\n */\nconst TRAILING_STRIPPED = /[. ]$/;\n\n/**\n * Decodes one path segment the way a URL does, treating a malformed escape as the literal text it is:\n * `decodeURIComponent('%')` throws, and a request path is whatever the client chose to send.\n */\nfunction decodeSegment(segment: string): string {\n  try {\n    return decodeURIComponent(segment);\n  } catch {\n    return segment;\n  }\n}\n\n/**\n * Whether one decoded segment can be a directory in the prerender tree, on every host rather than on this\n * one: not empty, not a relative-path marker, made only of characters a file name can hold\n * ({@link UNPORTABLE_SEGMENT}, plus the control characters, which a percent-escape is free to carry into a\n * path and no filesystem wants in a name), not a {@link RESERVED_DEVICE_NAME}, and not ending in a\n * character Win32 would {@link TRAILING_STRIPPED | strip}.\n *\n * The last two are Windows rules that no macOS or Linux build can discover for itself — which is exactly\n * why they belong in a check rather than in a caveat.\n */\nfunction isStorableSegment(segment: string): boolean {\n  if (segment === '' || segment === '.' || segment === '..') return false;\n  if (RESERVED_DEVICE_NAME.test(segment) || TRAILING_STRIPPED.test(segment)) return false;\n  return !UNPORTABLE_SEGMENT.test(segment) && ![...segment].some((char) => char < ' ');\n}\n\n/**\n * Where a path's prerendered output lives, relative to the output root — or `null` for a path no single file\n * can answer.\n *\n * **The one canonical form**, shared by the build that writes the file and by every deploy target that reads\n * it back, because the two drifting apart is invisible: the build reports the page as prerendered and every\n * request afterwards falls through to SSR, forever. Each segment is stored *decoded*, so `/docs/café` is\n * `docs/café` whether the caller holds the path percent-encoded — the build, which interpolates `staticPaths`\n * values into a URL — or already decoded, as Hono's `c.req.path` is: it runs `decodeURI` over any path\n * containing a `%`. Decoded is also the form every other static file server addresses, so the tree stays\n * servable by something that is not this framework.\n *\n * Always `/`-separated: the same string addresses a file on a filesystem, which accepts forward slashes on\n * Windows too, and a key in an asset store, where a backslash would be the wrong character.\n *\n * `null` is everything that is not one file: a `.` or `..` segment — so traversal is a miss rather than a\n * lookup, which a store addressed by key, with no `resolve()` to fall back on, depends on — an empty segment,\n * and any segment {@link isStorableSegment} refuses as unportable.\n */\nexport function ssgFilePath(path: string, variant: PrerenderVariant = 'html'): string | null {\n  const file = VARIANTS[variant].file;\n  const trimmed = path.replace(/^\\/+|\\/+$/g, '');\n  if (trimmed === '') return file;\n\n  const segments: string[] = [];\n  for (const encoded of trimmed.split('/')) {\n    const segment = decodeSegment(encoded);\n    if (!isStorableSegment(segment)) return null;\n    segments.push(segment);\n  }\n  return `${segments.join('/')}/${file}`;\n}\n\n/**\n * {@link ssgFilePath} as a URL path, for a store addressed by one rather than by key. Every segment is escaped\n * on the way out and the store decodes it back, so a page reached through a URL lands on the same file a\n * filesystem target opens by name.\n */\nexport function ssgAssetPath(relPath: string): string {\n  return relPath.split('/').map(encodeURIComponent).join('/');\n}\n\n/** The default cache budget: enough for a large documentation site's working set, small enough to be ignorable. */\nconst DEFAULT_CACHE_BYTES = 32 * 1024 * 1024;\n\n/**\n * A bounded, insertion-ordered cache of prerendered pages, so a site with thousands of them keeps a working set\n * rather than the whole build in memory. Only *hits* are stored — caching misses would let anyone mint entries\n * by requesting paths that don't exist — and the files never change while the server is up.\n *\n * Bounded by **bytes**, not by entry count: a count says nothing about how much memory it stands for, and a\n * page can be any size. At 128 entries — the previous limit — a documentation site with half-megabyte pages\n * retained ~64 MB across the two variants, with nothing about the number to suggest it.\n *\n * A page larger than the whole budget is served and not stored, rather than evicting everything to hold one.\n */\nexport function createPageCache(maxBytes = DEFAULT_CACHE_BYTES): {\n  get(key: string): PrerenderedPage | undefined;\n  set(key: string, page: PrerenderedPage): void;\n} {\n  const pages = new Map<string, PrerenderedPage>();\n  let bytes = 0;\n  return {\n    get: (key) => pages.get(key),\n    set(key, page) {\n      const size = page.body.byteLength;\n      if (size > maxBytes) return;\n      // Deleted before it is set, so re-setting an existing key moves it to the *back*: `Map.set` on a key it\n      // already holds keeps that key's original position, which would leave the entry just stored sitting at\n      // the front as the next thing evicted — a store whose eviction could drop the write that caused it.\n      const replaced = pages.get(key);\n      if (replaced) {\n        bytes -= replaced.body.byteLength;\n        pages.delete(key);\n      }\n      pages.set(key, page);\n      bytes += size;\n      // Insertion-ordered, so the first key is the oldest.\n      while (bytes > maxBytes) {\n        const oldest = pages.keys().next().value!;\n        bytes -= pages.get(oldest)!.body.byteLength;\n        pages.delete(oldest);\n      }\n    },\n  };\n}\n\n/**\n * A weak `ETag` for a page body — see {@link PrerenderedPage.etag} for why weak. Web Crypto rather than\n * `node:crypto`, so one implementation serves both a Node server and `workerd`.\n */\nasync function weakEtag(body: Uint8Array<ArrayBuffer>): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', body);\n  const base64url = btoa(String.fromCharCode(...new Uint8Array(digest)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n  return `W/\"${base64url.slice(0, 22)}\"`;\n}\n\n/**\n * Assembles a {@link PrerenderedPage} from a body just read out of the build. `storeEtag` is the validator the\n * store supplied, where it has one: it already describes these exact bytes, so it is weakened rather than\n * replaced by a fresh hash.\n */\nexport async function toPrerenderedPage(body: Uint8Array<ArrayBuffer>, storeEtag?: string | null): Promise<PrerenderedPage> {\n  return {\n    body,\n    contentLength: String(body.byteLength),\n    etag: storeEtag ? storeEtag.replace(/^(?!W\\/)/, 'W/') : await weakEtag(body),\n  };\n}\n\n/** A prerendered page, ready to serve: its body and a validator derived from those exact bytes. */\nexport interface PrerenderedPage {\n  /**\n   * The document or the flight payload, depending on which {@link PrerenderVariant} was read. Bytes rather\n   * than a string, because this cache entry is served verbatim to every request that hits it — as a string,\n   * each would pay a fresh UTF-8 encode of the whole page.\n   */\n  body: Uint8Array<ArrayBuffer>;\n  /**\n   * `Content-Length` for {@link body}, in bytes. Served explicitly because Hono sets no length for an\n   * in-memory body, and a proxy in front is entitled to make decisions with it.\n   */\n  contentLength: string;\n  /**\n   * `ETag` for the page, so a revalidating client can be answered with a 304 instead of the body.\n   *\n   * Deliberately **weak**: the bytes on the wire depend on whether something in front re-encoded them, so a\n   * strong validator would differ per coding and a cache would treat the 200 and the 304 that revalidates it\n   * as different pages. A weak tag says \"the same representation\", which stays true across codings.\n   */\n  etag: string;\n}\n"]}

package/dist/server/server-config.d.ts

@@ -1,72 +1,57 @@
-import type { RSHonoConfig } from '../config.js';
+import type { RshonoConfig } from '../config.js';
 /**
- * The framework settings the server bundle needs at request time, fully resolved
- * (defaults applied, `bodySizeLimit` parsed to bytes, origins normalized to hosts).
- *
- * The value is produced once by {@link resolveServerConfig} from `rshono.config.ts`
- * and compiled into the server bundle as the `__RSHONO_CONFIG__` literal (see
- * `builder/rspack-config.ts`) — there is no runtime env-var interface for these.
+ * The framework settings the server bundle needs at request time, fully resolved — produced once by
+ * {@link resolveServerConfig} and compiled in as the `__RSHONO_CONFIG__` literal. There is no runtime env-var
+ * interface for these, and nothing here is a per-request concern: those are Hono middleware in `src/server.ts`.
  */
 export interface ServerConfig {
     /**
-     * `true` when the bundle came from `rshono dev`.
-     *
-     * Baked in rather than read from `process.env.NODE_ENV` at runtime: it is decided by which command
-     * produced the bundle, and a deploy target need not have a `process` to read it from.
+     * `true` when the bundle came from `rshono dev`. Baked in rather than read from `process.env.NODE_ENV`,
+     * because a deploy target need not have a `process`.
      */
     isDev: boolean;
-    /** Deadline in ms for a single request (server action + flight + SSR). */
-    renderTimeoutMs: number;
     /** Honour `X-Forwarded-Host` / `-Proto` when resolving the browser-facing URL. Forced on in dev. */
     trustProxy: boolean;
-    /** Send a strict per-request-nonce Content-Security-Policy with every HTML document. */
-    cspEnabled: boolean;
-    /** The resolved CSP directives (built-in defaults with the user's merged over them), minus the nonce. */
-    cspDirectives: Record<string, string>;
-    /** CSRF origin check on server-action POSTs. */
-    checkOrigin: boolean;
-    /** Extra origins allowed to post server actions, normalized to lowercase `URL.host` values. */
-    allowedOrigins: string[];
-    /** Max request body in bytes before a 413; `0` disables the cap. */
-    maxBodyBytes: number;
-    /** Gzip compressible responses on the way out. */
-    compress: boolean;
-    /** Default listen port for `start` (overridden by `PORT`). */
-    port?: number;
-    /** Default bind address for `start` (overridden by `HOST`). */
-    host?: string;
+    /**
+     * The output directory this bundle was written to, relative to the project root. Carried into the bundle
+     * because `deploy/filesystem.ts` locates the assets and prerendered pages beside it at runtime, and only the
+     * compiler knows which directory it used.
+     */
+    outDir: string;
+    /**
+     * Whether this target's platform supplies per-request bindings as the second argument to
+     * `app.fetch(request, env)`. Baked in because only the build knows which preset was selected, and
+     * `getRequestContext().env` has to know: see `DeployPreset.envBindings`, which decides it.
+     */
+    envBindings: boolean;
 }
 /**
- * The single source of truth for the framework's built-in defaults.
- *
- * `renderTimeoutMs` and `maxBodyBytes` are resolved here, into the bundle. `port` and `host` are not:
- * they stay env-overridable at runtime, so the default is applied where the address is resolved
- * (`deploy/listen.ts` for a server bundle, `cli/dev.ts` for the dev server) and this is what both read.
+ * The framework's built-in defaults. `port` and `host` are not config fields — they come from `PORT` / `HOST`
+ * or `--port` wherever the address is resolved, and this is what those fall back to.
  */
 export declare const SERVER_DEFAULTS: {
-    readonly renderTimeoutMs: 10000;
-    readonly maxBodyBytes: number;
     readonly port: 3000;
     readonly host: '0.0.0.0';
 };
 /**
- * The built-in {@link RSHonoConfig.csp} policy, keyed by directive so
- * {@link RSHonoConfig.cspDirectives} can override entries individually.
+ * Reads a port out of `--port` or `PORT`, so both are read the same way wherever the address is resolved.
  *
- * `script-src` carries the per-request nonce, appended at request time (see `entry.rsc.tsx`).
- * `style-src` needs `'unsafe-inline'` because React writes inline styles.
+ * A blank value is `undefined` — "unset", falling through to {@link SERVER_DEFAULTS}. An empty `PORT` is
+ * common in CI images and container templates, and the other reading of it is a silent failure: `Number('')`
+ * is `0`, which binds a random free port and then reports success.
+ *
+ * @param source how to name the value in the error — the flag or the variable it came from.
+ * @throws RangeError for anything present that is not a port, rather than letting `NaN` reach Node as a raw
+ *   `ERR_SOCKET_BAD_PORT` with a bundler frame in the stack.
  */
-export declare const CSP_DEFAULTS: Record<string, string>;
-/** Parse a {@link RSHonoConfig.bodySizeLimit} value into a byte count (`false`/`0` → `0`, disabling the cap). */
-export declare function parseByteSize(value: string | number | false | undefined): number | undefined;
+export declare function parsePort(value: string | undefined, source: string): number | undefined;
 /**
- * Resolve the user's {@link RSHonoConfig} into the {@link ServerConfig} baked into the bundle.
- *
- * `isDev` is a build-time input rather than a config field because it decides one thing the user
- * shouldn't have to: `trustProxy` is forced on under `rshono dev`, where the framework's own proxy
- * is the only way in (it sets the forwarded headers itself and binds to localhost).
+ * Resolves the user's config into the {@link ServerConfig} baked into the bundle. `isDev` is a build-time input
+ * rather than a config field because it decides one thing the user should not have to: `trustProxy` is forced on
+ * under `rshono dev`, where the framework's own localhost proxy is the only way in.
  */
-export declare function resolveServerConfig(config: RSHonoConfig, { isDev }: {
+export declare function resolveServerConfig(config: RshonoConfig, { isDev, outDir, envBindings }: {
     isDev: boolean;
+    outDir: string;
+    envBindings?: boolean;
 }): ServerConfig;
-//# sourceMappingURL=server-config.d.ts.map

package/dist/server/server-config.js

@@ -1,94 +1,47 @@
 /**
- * The single source of truth for the framework's built-in defaults.
- *
- * `renderTimeoutMs` and `maxBodyBytes` are resolved here, into the bundle. `port` and `host` are not:
- * they stay env-overridable at runtime, so the default is applied where the address is resolved
- * (`deploy/listen.ts` for a server bundle, `cli/dev.ts` for the dev server) and this is what both read.
+ * The framework's built-in defaults. `port` and `host` are not config fields — they come from `PORT` / `HOST`
+ * or `--port` wherever the address is resolved, and this is what those fall back to.
  */
 export const SERVER_DEFAULTS = {
-    renderTimeoutMs: 10_000,
-    maxBodyBytes: 1024 * 1024, // 1 MiB, matching Next.js's server-action body-size limit.
     port: 3000,
     host: '0.0.0.0',
 };
+/** The highest port a TCP listener can bind. `0` is the lowest, and means "any free port". */
+const MAX_PORT = 65535;
 /**
- * The built-in {@link RSHonoConfig.csp} policy, keyed by directive so
- * {@link RSHonoConfig.cspDirectives} can override entries individually.
+ * Reads a port out of `--port` or `PORT`, so both are read the same way wherever the address is resolved.
  *
- * `script-src` carries the per-request nonce, appended at request time (see `entry.rsc.tsx`).
- * `style-src` needs `'unsafe-inline'` because React writes inline styles.
- */
-export const CSP_DEFAULTS = {
-    'default-src': "'self'",
-    'script-src': "'self'",
-    'style-src': "'self' 'unsafe-inline'",
-    'img-src': "'self' data:",
-    'connect-src': "'self'",
-    // Not covered by default-src, and each closes an injection route of its own: a stray <base>
-    // retargeting every relative URL, plugin content, framing (clickjacking), off-site form posts.
-    'base-uri': "'self'",
-    'object-src': "'none'",
-    'frame-ancestors': "'none'",
-    'form-action': "'self'",
-};
-const UNITS = { b: 1, kb: 1024, mb: 1024 ** 2, gb: 1024 ** 3 };
-/** Parse a {@link RSHonoConfig.bodySizeLimit} value into a byte count (`false`/`0` → `0`, disabling the cap). */
-export function parseByteSize(value) {
-    if (value === undefined)
-        return undefined;
-    if (value === false)
-        return 0;
-    if (typeof value === 'number')
-        return value;
-    const match = /^\s*(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)?\s*$/i.exec(value);
-    if (!match) {
-        throw new Error(`[rshono] invalid bodySizeLimit ${JSON.stringify(value)} — use e.g. '1mb', 1048576, or false.`);
-    }
-    return Math.floor(Number(match[1]) * UNITS[(match[2] ?? 'b').toLowerCase()]);
-}
-/**
- * Normalize a config `allowedOrigins` entry (full origin or bare host) to a lowercase `URL.host`,
- * ready for a direct comparison against a parsed `Origin` header's host.
+ * A blank value is `undefined` — "unset", falling through to {@link SERVER_DEFAULTS}. An empty `PORT` is
+ * common in CI images and container templates, and the other reading of it is a silent failure: `Number('')`
+ * is `0`, which binds a random free port and then reports success.
  *
- * A bare `host:port` has to be retried against a base, because on its own `'localhost:4000'`
- * parses as the *scheme* `localhost:` with path `4000` — leaving an empty host that would
- * silently never match anything. Throws rather than passing a junk entry through, so a typo
- * fails the build instead of quietly disabling the allowlist entry it was meant to add.
+ * @param source how to name the value in the error — the flag or the variable it came from.
+ * @throws RangeError for anything present that is not a port, rather than letting `NaN` reach Node as a raw
+ *   `ERR_SOCKET_BAD_PORT` with a bundler frame in the stack.
  */
-function normalizeOrigin(entry) {
-    const host = URL.parse(entry)?.host || URL.parse(`http://${entry}`)?.host;
-    if (!host) {
-        throw new Error(`[rshono] invalid allowedOrigins entry ${JSON.stringify(entry)} — use a full origin ('https://admin.example.com') or a bare host ('localhost:4000').`);
+export function parsePort(value, source) {
+    const text = value?.trim();
+    if (!text)
+        return undefined;
+    // Digits only: `Number` alone would also accept `0x50`, `1e3`, `+80` and `3.0`, none of which anyone
+    // typed meaning the port they would get.
+    const port = /^\d+$/.test(text) ? Number(text) : Number.NaN;
+    if (Number.isNaN(port) || port > MAX_PORT) {
+        throw new RangeError(`invalid ${source} ${JSON.stringify(value)} — expected an integer between 0 and ${MAX_PORT}.`);
     }
-    return host.toLowerCase();
-}
-/** Drop directives the user blanked out, so `cspDirectives: { 'frame-ancestors': '' }` removes one. */
-function resolveCspDirectives(overrides) {
-    return Object.fromEntries(Object.entries({ ...CSP_DEFAULTS, ...overrides }).filter(([, value]) => value.trim() !== ''));
+    return port;
 }
 /**
- * Resolve the user's {@link RSHonoConfig} into the {@link ServerConfig} baked into the bundle.
- *
- * `isDev` is a build-time input rather than a config field because it decides one thing the user
- * shouldn't have to: `trustProxy` is forced on under `rshono dev`, where the framework's own proxy
- * is the only way in (it sets the forwarded headers itself and binds to localhost).
+ * Resolves the user's config into the {@link ServerConfig} baked into the bundle. `isDev` is a build-time input
+ * rather than a config field because it decides one thing the user should not have to: `trustProxy` is forced on
+ * under `rshono dev`, where the framework's own localhost proxy is the only way in.
  */
-export function resolveServerConfig(config, { isDev }) {
+export function resolveServerConfig(config, { isDev, outDir, envBindings = false }) {
     return {
         isDev,
-        renderTimeoutMs: config.renderTimeout ?? SERVER_DEFAULTS.renderTimeoutMs,
         trustProxy: isDev || (config.trustProxy ?? false),
-        cspEnabled: config.csp ?? false,
-        cspDirectives: resolveCspDirectives(config.cspDirectives),
-        checkOrigin: config.checkOrigin ?? true,
-        allowedOrigins: (config.allowedOrigins ?? [])
-            .map((entry) => entry.trim())
-            .filter(Boolean)
-            .map(normalizeOrigin),
-        maxBodyBytes: parseByteSize(config.bodySizeLimit) ?? SERVER_DEFAULTS.maxBodyBytes,
-        compress: config.compress ?? true,
-        port: config.port,
-        host: config.host,
+        outDir,
+        envBindings,
     };
 }
 //# sourceMappingURL=server-config.js.map

package/dist/server/server-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-config.js","sourceRoot":"","sources":["../../src/server/server-config.ts"],"names":[],"mappings":"AAwCA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,eAAe,EAAE,MAAM;IACvB,YAAY,EAAE,IAAI,GAAG,IAAI,EAAE,2DAA2D;IACtF,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,SAAS;CACP,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAA2B;IAClD,aAAa,EAAE,QAAQ;IACvB,YAAY,EAAE,QAAQ;IACtB,WAAW,EAAE,wBAAwB;IACrC,SAAS,EAAE,cAAc;IACzB,aAAa,EAAE,QAAQ;IACvB,4FAA4F;IAC5F,+FAA+F;IAC/F,UAAU,EAAE,QAAQ;IACpB,YAAY,EAAE,QAAQ;IACtB,iBAAiB,EAAE,QAAQ;IAC3B,aAAa,EAAE,QAAQ;CACxB,CAAC;AAEF,MAAM,KAAK,GAA2B,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;AAEvF,iHAAiH;AACjH,MAAM,UAAU,aAAa,CAAC,KAA0C;IACtE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAG,0CAA0C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC;IAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,uFAAuF,CACtJ,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED,uGAAuG;AACvG,SAAS,oBAAoB,CAAC,SAA6C;IACzE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,EAAE,KAAK,EAAsB;IACrF,OAAO;QACL,KAAK;QACL,eAAe,EAAE,MAAM,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe;QACxE,UAAU,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC;QACjD,UAAU,EAAE,MAAM,CAAC,GAAG,IAAI,KAAK;QAC/B,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC;QACzD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;QACvC,cAAc,EAAE,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;aAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,eAAe,CAAC;QACvB,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,eAAe,CAAC,YAAY;QACjF,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;QACjC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;AACJ,CAAC","sourcesContent":["import type { RSHonoConfig } from '../config.js';\n\n/**\n * The framework settings the server bundle needs at request time, fully resolved\n * (defaults applied, `bodySizeLimit` parsed to bytes, origins normalized to hosts).\n *\n * The value is produced once by {@link resolveServerConfig} from `rshono.config.ts`\n * and compiled into the server bundle as the `__RSHONO_CONFIG__` literal (see\n * `builder/rspack-config.ts`) — there is no runtime env-var interface for these.\n */\nexport interface ServerConfig {\n  /**\n   * `true` when the bundle came from `rshono dev`.\n   *\n   * Baked in rather than read from `process.env.NODE_ENV` at runtime: it is decided by which command\n   * produced the bundle, and a deploy target need not have a `process` to read it from.\n   */\n  isDev: boolean;\n  /** Deadline in ms for a single request (server action + flight + SSR). */\n  renderTimeoutMs: number;\n  /** Honour `X-Forwarded-Host` / `-Proto` when resolving the browser-facing URL. Forced on in dev. */\n  trustProxy: boolean;\n  /** Send a strict per-request-nonce Content-Security-Policy with every HTML document. */\n  cspEnabled: boolean;\n  /** The resolved CSP directives (built-in defaults with the user's merged over them), minus the nonce. */\n  cspDirectives: Record<string, string>;\n  /** CSRF origin check on server-action POSTs. */\n  checkOrigin: boolean;\n  /** Extra origins allowed to post server actions, normalized to lowercase `URL.host` values. */\n  allowedOrigins: string[];\n  /** Max request body in bytes before a 413; `0` disables the cap. */\n  maxBodyBytes: number;\n  /** Gzip compressible responses on the way out. */\n  compress: boolean;\n  /** Default listen port for `start` (overridden by `PORT`). */\n  port?: number;\n  /** Default bind address for `start` (overridden by `HOST`). */\n  host?: string;\n}\n\n/**\n * The single source of truth for the framework's built-in defaults.\n *\n * `renderTimeoutMs` and `maxBodyBytes` are resolved here, into the bundle. `port` and `host` are not:\n * they stay env-overridable at runtime, so the default is applied where the address is resolved\n * (`deploy/listen.ts` for a server bundle, `cli/dev.ts` for the dev server) and this is what both read.\n */\nexport const SERVER_DEFAULTS = {\n  renderTimeoutMs: 10_000,\n  maxBodyBytes: 1024 * 1024, // 1 MiB, matching Next.js's server-action body-size limit.\n  port: 3000,\n  host: '0.0.0.0',\n} as const;\n\n/**\n * The built-in {@link RSHonoConfig.csp} policy, keyed by directive so\n * {@link RSHonoConfig.cspDirectives} can override entries individually.\n *\n * `script-src` carries the per-request nonce, appended at request time (see `entry.rsc.tsx`).\n * `style-src` needs `'unsafe-inline'` because React writes inline styles.\n */\nexport const CSP_DEFAULTS: Record<string, string> = {\n  'default-src': \"'self'\",\n  'script-src': \"'self'\",\n  'style-src': \"'self' 'unsafe-inline'\",\n  'img-src': \"'self' data:\",\n  'connect-src': \"'self'\",\n  // Not covered by default-src, and each closes an injection route of its own: a stray <base>\n  // retargeting every relative URL, plugin content, framing (clickjacking), off-site form posts.\n  'base-uri': \"'self'\",\n  'object-src': \"'none'\",\n  'frame-ancestors': \"'none'\",\n  'form-action': \"'self'\",\n};\n\nconst UNITS: Record<string, number> = { b: 1, kb: 1024, mb: 1024 ** 2, gb: 1024 ** 3 };\n\n/** Parse a {@link RSHonoConfig.bodySizeLimit} value into a byte count (`false`/`0` → `0`, disabling the cap). */\nexport function parseByteSize(value: string | number | false | undefined): number | undefined {\n  if (value === undefined) return undefined;\n  if (value === false) return 0;\n  if (typeof value === 'number') return value;\n  const match = /^\\s*(\\d+(?:\\.\\d+)?)\\s*(b|kb|mb|gb)?\\s*$/i.exec(value);\n  if (!match) {\n    throw new Error(`[rshono] invalid bodySizeLimit ${JSON.stringify(value)} — use e.g. '1mb', 1048576, or false.`);\n  }\n  return Math.floor(Number(match[1]) * UNITS[(match[2] ?? 'b').toLowerCase()]);\n}\n\n/**\n * Normalize a config `allowedOrigins` entry (full origin or bare host) to a lowercase `URL.host`,\n * ready for a direct comparison against a parsed `Origin` header's host.\n *\n * A bare `host:port` has to be retried against a base, because on its own `'localhost:4000'`\n * parses as the *scheme* `localhost:` with path `4000` — leaving an empty host that would\n * silently never match anything. Throws rather than passing a junk entry through, so a typo\n * fails the build instead of quietly disabling the allowlist entry it was meant to add.\n */\nfunction normalizeOrigin(entry: string): string {\n  const host = URL.parse(entry)?.host || URL.parse(`http://${entry}`)?.host;\n  if (!host) {\n    throw new Error(\n      `[rshono] invalid allowedOrigins entry ${JSON.stringify(entry)} — use a full origin ('https://admin.example.com') or a bare host ('localhost:4000').`,\n    );\n  }\n  return host.toLowerCase();\n}\n\n/** Drop directives the user blanked out, so `cspDirectives: { 'frame-ancestors': '' }` removes one. */\nfunction resolveCspDirectives(overrides: Record<string, string> | undefined): Record<string, string> {\n  return Object.fromEntries(Object.entries({ ...CSP_DEFAULTS, ...overrides }).filter(([, value]) => value.trim() !== ''));\n}\n\n/**\n * Resolve the user's {@link RSHonoConfig} into the {@link ServerConfig} baked into the bundle.\n *\n * `isDev` is a build-time input rather than a config field because it decides one thing the user\n * shouldn't have to: `trustProxy` is forced on under `rshono dev`, where the framework's own proxy\n * is the only way in (it sets the forwarded headers itself and binds to localhost).\n */\nexport function resolveServerConfig(config: RSHonoConfig, { isDev }: { isDev: boolean }): ServerConfig {\n  return {\n    isDev,\n    renderTimeoutMs: config.renderTimeout ?? SERVER_DEFAULTS.renderTimeoutMs,\n    trustProxy: isDev || (config.trustProxy ?? false),\n    cspEnabled: config.csp ?? false,\n    cspDirectives: resolveCspDirectives(config.cspDirectives),\n    checkOrigin: config.checkOrigin ?? true,\n    allowedOrigins: (config.allowedOrigins ?? [])\n      .map((entry) => entry.trim())\n      .filter(Boolean)\n      .map(normalizeOrigin),\n    maxBodyBytes: parseByteSize(config.bodySizeLimit) ?? SERVER_DEFAULTS.maxBodyBytes,\n    compress: config.compress ?? true,\n    port: config.port,\n    host: config.host,\n  };\n}\n"]}
+{"version":3,"file":"server-config.js","sourceRoot":"","sources":["../../src/server/server-config.ts"],"names":[],"mappings":"AA6BA;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,SAAS;CACP,CAAC;AAEX,8FAA8F;AAC9F,MAAM,QAAQ,GAAG,KAAK,CAAC;AAEvB;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CAAC,KAAyB,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,qGAAqG;IACrG,yCAAyC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAC5D,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,UAAU,CAAC,WAAW,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,wCAAwC,QAAQ,GAAG,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAoB,EACpB,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,GAAG,KAAK,EAA6D;IAEjG,OAAO;QACL,KAAK;QACL,UAAU,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC;QACjD,MAAM;QACN,WAAW;KACZ,CAAC;AACJ,CAAC","sourcesContent":["import type { RshonoConfig } from '../config.js';\n\n/**\n * The framework settings the server bundle needs at request time, fully resolved — produced once by\n * {@link resolveServerConfig} and compiled in as the `__RSHONO_CONFIG__` literal. There is no runtime env-var\n * interface for these, and nothing here is a per-request concern: those are Hono middleware in `src/server.ts`.\n */\nexport interface ServerConfig {\n  /**\n   * `true` when the bundle came from `rshono dev`. Baked in rather than read from `process.env.NODE_ENV`,\n   * because a deploy target need not have a `process`.\n   */\n  isDev: boolean;\n  /** Honour `X-Forwarded-Host` / `-Proto` when resolving the browser-facing URL. Forced on in dev. */\n  trustProxy: boolean;\n  /**\n   * The output directory this bundle was written to, relative to the project root. Carried into the bundle\n   * because `deploy/filesystem.ts` locates the assets and prerendered pages beside it at runtime, and only the\n   * compiler knows which directory it used.\n   */\n  outDir: string;\n  /**\n   * Whether this target's platform supplies per-request bindings as the second argument to\n   * `app.fetch(request, env)`. Baked in because only the build knows which preset was selected, and\n   * `getRequestContext().env` has to know: see `DeployPreset.envBindings`, which decides it.\n   */\n  envBindings: boolean;\n}\n\n/**\n * The framework's built-in defaults. `port` and `host` are not config fields — they come from `PORT` / `HOST`\n * or `--port` wherever the address is resolved, and this is what those fall back to.\n */\nexport const SERVER_DEFAULTS = {\n  port: 3000,\n  host: '0.0.0.0',\n} as const;\n\n/** The highest port a TCP listener can bind. `0` is the lowest, and means \"any free port\". */\nconst MAX_PORT = 65535;\n\n/**\n * Reads a port out of `--port` or `PORT`, so both are read the same way wherever the address is resolved.\n *\n * A blank value is `undefined` — \"unset\", falling through to {@link SERVER_DEFAULTS}. An empty `PORT` is\n * common in CI images and container templates, and the other reading of it is a silent failure: `Number('')`\n * is `0`, which binds a random free port and then reports success.\n *\n * @param source how to name the value in the error — the flag or the variable it came from.\n * @throws RangeError for anything present that is not a port, rather than letting `NaN` reach Node as a raw\n *   `ERR_SOCKET_BAD_PORT` with a bundler frame in the stack.\n */\nexport function parsePort(value: string | undefined, source: string): number | undefined {\n  const text = value?.trim();\n  if (!text) return undefined;\n  // Digits only: `Number` alone would also accept `0x50`, `1e3`, `+80` and `3.0`, none of which anyone\n  // typed meaning the port they would get.\n  const port = /^\\d+$/.test(text) ? Number(text) : Number.NaN;\n  if (Number.isNaN(port) || port > MAX_PORT) {\n    throw new RangeError(`invalid ${source} ${JSON.stringify(value)} — expected an integer between 0 and ${MAX_PORT}.`);\n  }\n  return port;\n}\n\n/**\n * Resolves the user's config into the {@link ServerConfig} baked into the bundle. `isDev` is a build-time input\n * rather than a config field because it decides one thing the user should not have to: `trustProxy` is forced on\n * under `rshono dev`, where the framework's own localhost proxy is the only way in.\n */\nexport function resolveServerConfig(\n  config: RshonoConfig,\n  { isDev, outDir, envBindings = false }: { isDev: boolean; outDir: string; envBindings?: boolean },\n): ServerConfig {\n  return {\n    isDev,\n    trustProxy: isDev || (config.trustProxy ?? false),\n    outDir,\n    envBindings,\n  };\n}\n"]}

package/dist/server/shutdown.d.ts

@@ -1,7 +1,8 @@
 /**
- * Registers `handler` for both `SIGINT` and `SIGTERM` — the two signals a process
- * manager or `Ctrl-C` uses to ask for a graceful stop. Consolidates the shutdown
- * wiring shared by the server bundle and the `start` launcher.
+ * Registers `handler` for both `SIGINT` and `SIGTERM` — the two signals a process manager or `Ctrl-C` uses to
+ * ask for a graceful stop.
+ *
+ * Registered by the server bundle itself, which is why `rshono start` needs no supervisor to forward signals
+ * to: it imports the bundle into its own process, so these handlers are already the process's.
  */
 export declare function onShutdown(handler: (signal: NodeJS.Signals) => void): void;
-//# sourceMappingURL=shutdown.d.ts.map

package/dist/server/shutdown.js

@@ -1,7 +1,9 @@
 /**
- * Registers `handler` for both `SIGINT` and `SIGTERM` — the two signals a process
- * manager or `Ctrl-C` uses to ask for a graceful stop. Consolidates the shutdown
- * wiring shared by the server bundle and the `start` launcher.
+ * Registers `handler` for both `SIGINT` and `SIGTERM` — the two signals a process manager or `Ctrl-C` uses to
+ * ask for a graceful stop.
+ *
+ * Registered by the server bundle itself, which is why `rshono start` needs no supervisor to forward signals
+ * to: it imports the bundle into its own process, so these handlers are already the process's.
  */
 export function onShutdown(handler) {
     for (const signal of ['SIGINT', 'SIGTERM']) {

package/dist/server/shutdown.js.map

@@ -1 +1 @@
-{"version":3,"file":"shutdown.js","sourceRoot":"","sources":["../../src/server/shutdown.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAyC;IAClE,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;QACpD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC","sourcesContent":["/**\n * Registers `handler` for both `SIGINT` and `SIGTERM` — the two signals a process\n * manager or `Ctrl-C` uses to ask for a graceful stop. Consolidates the shutdown\n * wiring shared by the server bundle and the `start` launcher.\n */\nexport function onShutdown(handler: (signal: NodeJS.Signals) => void): void {\n  for (const signal of ['SIGINT', 'SIGTERM'] as const) {\n    process.on(signal, () => handler(signal));\n  }\n}\n"]}
+{"version":3,"file":"shutdown.js","sourceRoot":"","sources":["../../src/server/shutdown.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,OAAyC;IAClE,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;QACpD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC","sourcesContent":["/**\n * Registers `handler` for both `SIGINT` and `SIGTERM` — the two signals a process manager or `Ctrl-C` uses to\n * ask for a graceful stop.\n *\n * Registered by the server bundle itself, which is why `rshono start` needs no supervisor to forward signals\n * to: it imports the bundle into its own process, so these handlers are already the process's.\n */\nexport function onShutdown(handler: (signal: NodeJS.Signals) => void): void {\n  for (const signal of ['SIGINT', 'SIGTERM'] as const) {\n    process.on(signal, () => handler(signal));\n  }\n}\n"]}