@rshono/core 1.0.0-rc.2 → 1.0.0-rc.21

package/dist/cli/index.js

@@ -3,9 +3,11 @@ import { parseArgs } from 'node:util';
 import { DEPLOY_TARGETS, resolveDeployPreset } from '../deploy/presets.js';
 import { loadConfig } from '../server/load-config.js';
 import { loadEnvFiles } from '../server/load-env.js';
-import { buildCommand } from './build.js';
-import { devCommand } from './dev.js';
-import { startCommand } from './start.js';
+import { parsePort } from '../server/server-config.js';
+import { exit } from './exit.js';
+// The commands are imported where they are dispatched: `build` and `dev` pull in Rspack, and a static import
+// would load it for `start` too — ~30 MB of RSS and ~70ms of startup that would then sit in the server's own
+// process for its whole life, since `start` imports the bundle rather than spawning it.
 const HELP = `rshono — Hono + Rspack + React Server Components
 
 Usage:
@@ -14,26 +16,53 @@ Usage:
   rshono start   [--port 3000]   run the production build
 
 Options:
-  -p, --port <n>      port to listen on (default: PORT env or rshono.config.ts or 3000)
+  -p, --port <n>      port to listen on (default: PORT env or 3000)
   -c, --config <path> path to a config file (default: rshono.config.{ts,js,mjs})
   -d, --deploy <name> platform to build for: ${DEPLOY_TARGETS.join(' | ')} (default: node)
   -h, --help          show this help
   -v, --version       print the version
+
+Environment:
+  PORT                port to listen on, unless --port is given
+  HOST                address \`start\` binds to (default 0.0.0.0); \`dev\` always binds 127.0.0.1
+  RSHONO_DEPLOY       platform to build for, unless --deploy is given
 `;
+/** `as const` so `parseArgs` can type `values` off the literal `type` fields rather than widening them. */
+const CLI_OPTIONS = {
+    port: { type: 'string', short: 'p' },
+    config: { type: 'string', short: 'c' },
+    deploy: { type: 'string', short: 'd' },
+    help: { type: 'boolean', short: 'h' },
+    version: { type: 'boolean', short: 'v' },
+};
+/**
+ * {@link parseArgs}, reported the way the CLI reports every other bad input: one line, then the help.
+ *
+ * A typo'd flag is the likeliest of the three bad inputs and used to get by far the worst output. `parseArgs`
+ * was the first statement of `main`, with nothing between it and the `main().catch` that prints the raw error
+ * object — so `rshono build --porf 3000` answered with nine frames of Node internals, where an unknown
+ * command and an unparseable `--port` each answered with a sentence.
+ *
+ * Node's own message is kept: it names the offending flag, which is the whole content of the error, and
+ * `HELP` beneath it lists the ones that exist. Through {@link exit} rather than `process.exit`, because that
+ * help goes to stdout and a piped stdout drops whatever has not left the buffer.
+ */
+async function readArgs() {
+    try {
+        return parseArgs({ options: CLI_OPTIONS, allowPositionals: true });
+    }
+    catch (error) {
+        console.error(`rshono: ${error instanceof Error ? error.message : String(error)}\n`);
+        console.log(HELP);
+        return exit(1);
+    }
+}
 async function main() {
-    const { values, positionals } = parseArgs({
-        options: {
-            port: { type: 'string', short: 'p' },
-            config: { type: 'string', short: 'c' },
-            deploy: { type: 'string', short: 'd' },
-            help: { type: 'boolean', short: 'h' },
-            version: { type: 'boolean', short: 'v' },
-        },
-        allowPositionals: true,
-    });
+    const { values, positionals } = await readArgs();
     if (values.version) {
         const require = createRequire(import.meta.url);
-        console.log(require('@rshono/core/package.json').version);
+        const { version } = require('@rshono/core/package.json');
+        console.log(version);
         return;
     }
     const command = positionals[0];
@@ -44,34 +73,66 @@ async function main() {
     const rootDir = process.cwd();
     loadEnvFiles(rootDir);
     const config = await loadConfig(rootDir, values.config);
-    const flagPort = values.port ? Number(values.port) : undefined;
-    if (values.port && Number.isNaN(flagPort)) {
-        console.error(`rshono: invalid --port "${values.port}"`);
-        process.exit(1);
+    // Precedence: --port flag > PORT env > the command's built-in default. Both sources go through the same
+    // parse as the bundle's own, so `PORT=""` means "unset" in the CLI and in the server it starts alike.
+    //
+    // The parse stays synchronous and the exit is here, where the other flag errors are answered, rather than
+    // inside a `readPort` helper of its own. That helper had to reach `process.exit` directly — it is not
+    // `async`, and `exit()` returns a promise — so it was the one bad-input path in the CLI that did not
+    // drain a piped stderr. Making it `async` instead is the trap: `??` on a `Promise` is never nullish, so
+    // `--port` would resolve to a pending promise and `PORT` would stop being read at all.
+    let port;
+    try {
+        port = parsePort(values.port, '--port') ?? parsePort(process.env.PORT, 'PORT');
+    }
+    catch (error) {
+        console.error(`rshono: ${error instanceof Error ? error.message : String(error)}`);
+        return exit(1);
     }
-    // Precedence: --port flag > PORT env > rshono.config.ts > the command's built-in default.
-    const envPort = process.env.PORT ? Number(process.env.PORT) : undefined;
-    const port = flagPort ?? envPort ?? config.port;
-    const host = process.env.HOST ?? config.host;
+    const host = process.env.HOST;
     switch (command) {
         case 'dev':
-            return devCommand({ rootDir, port, config });
+            // `HOST` belongs to `start`. The dev server binds loopback unconditionally — its source maps embed the
+            // original source of `'use server'` modules — and `DevOptions` has no `host` field to pass one to, so
+            // the drop is structural rather than conditional. Said out loud because the variable is read a few
+            // lines up and the README lists it under all three commands: `HOST=0.0.0.0 rshono dev` used to do
+            // nothing, with nothing to notice.
+            if (host !== undefined) {
+                console.warn('rshono: HOST is ignored by `rshono dev`, which always binds 127.0.0.1 — it applies to `rshono start`.');
+            }
+            return (await import('./dev.js')).devCommand({ rootDir, port, config });
         case 'build':
-            return buildCommand({
+            return (await import('./build.js')).buildCommand({
                 rootDir,
                 config,
                 preset: resolveDeployPreset({ flag: values.deploy, env: process.env.RSHONO_DEPLOY, config: config.deploy }),
             });
         case 'start':
-            return startCommand({ rootDir, port, host });
+            return (await import('./start.js')).startCommand({ rootDir, port, host });
         default:
             console.error(`rshono: unknown command "${command}"\n`);
             console.log(HELP);
-            process.exit(1);
+            return exit(1);
     }
 }
-main().catch((error) => {
-    console.error(error);
-    process.exit(1);
+/**
+ * The one place a failure becomes output, for every command.
+ *
+ * A `[rshono]` message was written for whoever is running the command, so it is printed as the one line it
+ * is; anything else is a bug in the framework and keeps its stack, because that stack is the report.
+ *
+ * This rule used to live in `build.ts`, as a `phase()` wrapper around three stages of one command — which
+ * left everything outside those three going out through a bare `console.error(error)`: the whole of
+ * `rshono dev`, and `build`'s own `createConfigs`, which is where a missing `src/routes.ts` is found. So the
+ * likeliest first-run mistake there is answered with a raw `Error` object and two frames of framework
+ * internals, which is the same shape of problem an unknown CLI flag had.
+ */
+main().catch(async (error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.startsWith('[rshono]'))
+        console.error(`\n  ✗ ${message}\n`);
+    else
+        console.error(error);
+    await exit(1);
 });
 //# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,IAAI,GAAG;;;;;;;;;;+CAUkC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;;;CAGxE,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACxC,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACpC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACtC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACtC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACzC;QACD,gBAAgB,EAAE,IAAI;KACvB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9B,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,KAAK,CAAC,2BAA2B,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,0FAA0F;IAC1F,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,MAAM,IAAI,GAAG,QAAQ,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;IAE7C,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,KAAK;YACR,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/C,KAAK,OAAO;YACV,OAAO,YAAY,CAAC;gBAClB,OAAO;gBACP,MAAM;gBACN,MAAM,EAAE,mBAAmB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aAC5G,CAAC,CAAC;QACL,KAAK,OAAO;YACV,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C;YACE,OAAO,CAAC,KAAK,CAAC,4BAA4B,OAAO,KAAK,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC","sourcesContent":["import { createRequire } from 'node:module';\nimport { parseArgs } from 'node:util';\nimport { DEPLOY_TARGETS, resolveDeployPreset } from '../deploy/presets.js';\nimport { loadConfig } from '../server/load-config.js';\nimport { loadEnvFiles } from '../server/load-env.js';\nimport { buildCommand } from './build.js';\nimport { devCommand } from './dev.js';\nimport { startCommand } from './start.js';\n\nconst HELP = `rshono — Hono + Rspack + React Server Components\n\nUsage:\n  rshono dev     [--port 3000]   start the dev server\n  rshono build                   build for production (client + server + SSG)\n  rshono start   [--port 3000]   run the production build\n\nOptions:\n  -p, --port <n>      port to listen on (default: PORT env or rshono.config.ts or 3000)\n  -c, --config <path> path to a config file (default: rshono.config.{ts,js,mjs})\n  -d, --deploy <name> platform to build for: ${DEPLOY_TARGETS.join(' | ')} (default: node)\n  -h, --help          show this help\n  -v, --version       print the version\n`;\n\nasync function main(): Promise<void> {\n  const { values, positionals } = parseArgs({\n    options: {\n      port: { type: 'string', short: 'p' },\n      config: { type: 'string', short: 'c' },\n      deploy: { type: 'string', short: 'd' },\n      help: { type: 'boolean', short: 'h' },\n      version: { type: 'boolean', short: 'v' },\n    },\n    allowPositionals: true,\n  });\n\n  if (values.version) {\n    const require = createRequire(import.meta.url);\n    console.log(require('@rshono/core/package.json').version);\n    return;\n  }\n\n  const command = positionals[0];\n  if (values.help || !command) {\n    console.log(HELP);\n    return;\n  }\n\n  const rootDir = process.cwd();\n  loadEnvFiles(rootDir);\n  const config = await loadConfig(rootDir, values.config);\n\n  const flagPort = values.port ? Number(values.port) : undefined;\n  if (values.port && Number.isNaN(flagPort)) {\n    console.error(`rshono: invalid --port \"${values.port}\"`);\n    process.exit(1);\n  }\n  // Precedence: --port flag > PORT env > rshono.config.ts > the command's built-in default.\n  const envPort = process.env.PORT ? Number(process.env.PORT) : undefined;\n  const port = flagPort ?? envPort ?? config.port;\n  const host = process.env.HOST ?? config.host;\n\n  switch (command) {\n    case 'dev':\n      return devCommand({ rootDir, port, config });\n    case 'build':\n      return buildCommand({\n        rootDir,\n        config,\n        preset: resolveDeployPreset({ flag: values.deploy, env: process.env.RSHONO_DEPLOY, config: config.deploy }),\n      });\n    case 'start':\n      return startCommand({ rootDir, port, host });\n    default:\n      console.error(`rshono: unknown command \"${command}\"\\n`);\n      console.log(HELP);\n      process.exit(1);\n  }\n}\n\nmain().catch((error) => {\n  console.error(error);\n  process.exit(1);\n});\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,6GAA6G;AAC7G,6GAA6G;AAC7G,wFAAwF;AAExF,MAAM,IAAI,GAAG;;;;;;;;;;+CAUkC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;;;;;;;;CAQxE,CAAC;AAEF,2GAA2G;AAC3G,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;IACpC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;IACtC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;IACtC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;CAChC,CAAC;AAEX;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,QAAQ;IACrB,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;IAEjD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,2BAA2B,CAAwB,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9B,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAExD,wGAAwG;IACxG,sGAAsG;IACtG,EAAE;IACF,0GAA0G;IAC1G,sGAAsG;IACtG,qGAAqG;IACrG,wGAAwG;IACxG,uFAAuF;IACvF,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAE9B,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,KAAK;YACR,uGAAuG;YACvG,sGAAsG;YACtG,mGAAmG;YACnG,kGAAkG;YAClG,mCAAmC;YACnC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,uGAAuG,CAAC,CAAC;YACxH,CAAC;YACD,OAAO,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,KAAK,OAAO;YACV,OAAO,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC;gBAC/C,OAAO;gBACP,MAAM;gBACN,MAAM,EAAE,mBAAmB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aAC5G,CAAC,CAAC;QACL,KAAK,OAAO;YACV,OAAO,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E;YACE,OAAO,CAAC,KAAK,CAAC,4BAA4B,OAAO,KAAK,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IACpC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,SAAS,OAAO,IAAI,CAAC,CAAC;;QACnE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC,CAAC,CAAC","sourcesContent":["import { createRequire } from 'node:module';\nimport { parseArgs } from 'node:util';\nimport { DEPLOY_TARGETS, resolveDeployPreset } from '../deploy/presets.js';\nimport { loadConfig } from '../server/load-config.js';\nimport { loadEnvFiles } from '../server/load-env.js';\nimport { parsePort } from '../server/server-config.js';\nimport { exit } from './exit.js';\n\n// The commands are imported where they are dispatched: `build` and `dev` pull in Rspack, and a static import\n// would load it for `start` too — ~30 MB of RSS and ~70ms of startup that would then sit in the server's own\n// process for its whole life, since `start` imports the bundle rather than spawning it.\n\nconst HELP = `rshono — Hono + Rspack + React Server Components\n\nUsage:\n  rshono dev     [--port 3000]   start the dev server\n  rshono build                   build for production (client + server + SSG)\n  rshono start   [--port 3000]   run the production build\n\nOptions:\n  -p, --port <n>      port to listen on (default: PORT env or 3000)\n  -c, --config <path> path to a config file (default: rshono.config.{ts,js,mjs})\n  -d, --deploy <name> platform to build for: ${DEPLOY_TARGETS.join(' | ')} (default: node)\n  -h, --help          show this help\n  -v, --version       print the version\n\nEnvironment:\n  PORT                port to listen on, unless --port is given\n  HOST                address \\`start\\` binds to (default 0.0.0.0); \\`dev\\` always binds 127.0.0.1\n  RSHONO_DEPLOY       platform to build for, unless --deploy is given\n`;\n\n/** `as const` so `parseArgs` can type `values` off the literal `type` fields rather than widening them. */\nconst CLI_OPTIONS = {\n  port: { type: 'string', short: 'p' },\n  config: { type: 'string', short: 'c' },\n  deploy: { type: 'string', short: 'd' },\n  help: { type: 'boolean', short: 'h' },\n  version: { type: 'boolean', short: 'v' },\n} as const;\n\n/**\n * {@link parseArgs}, reported the way the CLI reports every other bad input: one line, then the help.\n *\n * A typo'd flag is the likeliest of the three bad inputs and used to get by far the worst output. `parseArgs`\n * was the first statement of `main`, with nothing between it and the `main().catch` that prints the raw error\n * object — so `rshono build --porf 3000` answered with nine frames of Node internals, where an unknown\n * command and an unparseable `--port` each answered with a sentence.\n *\n * Node's own message is kept: it names the offending flag, which is the whole content of the error, and\n * `HELP` beneath it lists the ones that exist. Through {@link exit} rather than `process.exit`, because that\n * help goes to stdout and a piped stdout drops whatever has not left the buffer.\n */\nasync function readArgs(): Promise<ReturnType<typeof parseArgs<{ options: typeof CLI_OPTIONS; allowPositionals: true }>>> {\n  try {\n    return parseArgs({ options: CLI_OPTIONS, allowPositionals: true });\n  } catch (error) {\n    console.error(`rshono: ${error instanceof Error ? error.message : String(error)}\\n`);\n    console.log(HELP);\n    return exit(1);\n  }\n}\n\nasync function main(): Promise<void> {\n  const { values, positionals } = await readArgs();\n\n  if (values.version) {\n    const require = createRequire(import.meta.url);\n    const { version } = require('@rshono/core/package.json') as { version: string };\n    console.log(version);\n    return;\n  }\n\n  const command = positionals[0];\n  if (values.help || !command) {\n    console.log(HELP);\n    return;\n  }\n\n  const rootDir = process.cwd();\n  loadEnvFiles(rootDir);\n  const config = await loadConfig(rootDir, values.config);\n\n  // Precedence: --port flag > PORT env > the command's built-in default. Both sources go through the same\n  // parse as the bundle's own, so `PORT=\"\"` means \"unset\" in the CLI and in the server it starts alike.\n  //\n  // The parse stays synchronous and the exit is here, where the other flag errors are answered, rather than\n  // inside a `readPort` helper of its own. That helper had to reach `process.exit` directly — it is not\n  // `async`, and `exit()` returns a promise — so it was the one bad-input path in the CLI that did not\n  // drain a piped stderr. Making it `async` instead is the trap: `??` on a `Promise` is never nullish, so\n  // `--port` would resolve to a pending promise and `PORT` would stop being read at all.\n  let port: number | undefined;\n  try {\n    port = parsePort(values.port, '--port') ?? parsePort(process.env.PORT, 'PORT');\n  } catch (error) {\n    console.error(`rshono: ${error instanceof Error ? error.message : String(error)}`);\n    return exit(1);\n  }\n  const host = process.env.HOST;\n\n  switch (command) {\n    case 'dev':\n      // `HOST` belongs to `start`. The dev server binds loopback unconditionally — its source maps embed the\n      // original source of `'use server'` modules — and `DevOptions` has no `host` field to pass one to, so\n      // the drop is structural rather than conditional. Said out loud because the variable is read a few\n      // lines up and the README lists it under all three commands: `HOST=0.0.0.0 rshono dev` used to do\n      // nothing, with nothing to notice.\n      if (host !== undefined) {\n        console.warn('rshono: HOST is ignored by `rshono dev`, which always binds 127.0.0.1 — it applies to `rshono start`.');\n      }\n      return (await import('./dev.js')).devCommand({ rootDir, port, config });\n    case 'build':\n      return (await import('./build.js')).buildCommand({\n        rootDir,\n        config,\n        preset: resolveDeployPreset({ flag: values.deploy, env: process.env.RSHONO_DEPLOY, config: config.deploy }),\n      });\n    case 'start':\n      return (await import('./start.js')).startCommand({ rootDir, port, host });\n    default:\n      console.error(`rshono: unknown command \"${command}\"\\n`);\n      console.log(HELP);\n      return exit(1);\n  }\n}\n\n/**\n * The one place a failure becomes output, for every command.\n *\n * A `[rshono]` message was written for whoever is running the command, so it is printed as the one line it\n * is; anything else is a bug in the framework and keeps its stack, because that stack is the report.\n *\n * This rule used to live in `build.ts`, as a `phase()` wrapper around three stages of one command — which\n * left everything outside those three going out through a bare `console.error(error)`: the whole of\n * `rshono dev`, and `build`'s own `createConfigs`, which is where a missing `src/routes.ts` is found. So the\n * likeliest first-run mistake there is answered with a raw `Error` object and two frames of framework\n * internals, which is the same shape of problem an unknown CLI flag had.\n */\nmain().catch(async (error: unknown) => {\n  const message = error instanceof Error ? error.message : String(error);\n  if (message.startsWith('[rshono]')) console.error(`\\n  ✗ ${message}\\n`);\n  else console.error(error);\n  await exit(1);\n});\n"]}

package/dist/cli/start.d.ts

@@ -5,4 +5,3 @@ interface StartOptions {
 }
 export declare function startCommand(options: StartOptions): Promise<void>;
 export {};
-//# sourceMappingURL=start.d.ts.map

package/dist/cli/start.js

@@ -1,39 +1,36 @@
-import { spawn } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { readBuildMarker } from '../deploy/build-marker.js';
 import { deployHintFor } from '../deploy/presets.js';
-import { onShutdown } from '../server/shutdown.js';
+import { exit } from './exit.js';
 export async function startCommand(options) {
     const { rootDir, port, host } = options;
     const distDir = join(rootDir, 'dist');
     const mainPath = join(distDir, 'server', 'main.mjs');
     if (!existsSync(mainPath)) {
         console.error('rshono: no production build found — run `rshono build` first.');
-        process.exit(1);
+        return exit(1);
     }
-    // A bundle built for a hosting platform has no listener in it — its entry hands a `fetch` handler to
-    // whatever is running it. Starting one here would exit silently the moment the module finished
-    // evaluating, so say what happened and point at the command that does deploy it.
+    // A bundle built for a hosting platform has no listener in it, so starting one here would exit silently the
+    // moment the module finished evaluating.
     const target = readBuildMarker(distDir);
     if (target !== null && target !== 'node') {
         const hint = deployHintFor(target);
         console.error(`rshono: this build targets ${target}, which \`rshono start\` cannot run${hint ? ` — ${hint}` : '.'}`);
         console.error('  Rebuild for a server with `rshono build --deploy node` to run it here.');
-        process.exit(1);
+        return exit(1);
     }
-    const env = { ...process.env };
+    // Read by the bundle as it evaluates, which is what binds the port — so they have to be set first.
     if (port !== undefined)
-        env.PORT = String(port);
+        process.env.PORT = String(port);
     if (host !== undefined)
-        env.HOST = host;
-    const child = spawn(process.execPath, ['--enable-source-maps', mainPath], {
-        stdio: 'inherit',
-        env,
-    });
-    onShutdown((signal) => child.kill(signal));
-    child.on('exit', (code, signal) => {
-        process.exit(signal ? 1 : (code ?? 1));
-    });
+        process.env.HOST = host;
+    // Imported into this process rather than spawned into a child. The child only ever existed to pass
+    // `--enable-source-maps`, and `bin/rshono.mjs` already enables the same thing in-process before the CLI
+    // loads — so a supervisor bought a second PID and its own heap in every container, an extra frame in every
+    // stack, and signal forwarding for signals the bundle already handles itself through `onShutdown`. `start`
+    // deliberately imports no Rspack, so the process this leaves behind is the server and little else.
+    await import(pathToFileURL(mainPath).href);
 }
 //# sourceMappingURL=start.js.map

package/dist/cli/start.js.map

@@ -1 +1 @@
-{"version":3,"file":"start.js","sourceRoot":"","sources":["../../src/cli/start.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAQnD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqB;IACtD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,qGAAqG;IACrG,+FAA+F;IAC/F,iFAAiF;IACjF,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,8BAA8B,MAAM,sCAAsC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACrH,OAAO,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS;QAAE,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,IAAI,KAAK,SAAS;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAExC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,sBAAsB,EAAE,QAAQ,CAAC,EAAE;QACxE,KAAK,EAAE,SAAS;QAChB,GAAG;KACJ,CAAC,CAAC;IAEH,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { spawn } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { readBuildMarker } from '../deploy/build-marker.js';\nimport { deployHintFor } from '../deploy/presets.js';\nimport { onShutdown } from '../server/shutdown.js';\n\ninterface StartOptions {\n  rootDir: string;\n  port?: number;\n  host?: string;\n}\n\nexport async function startCommand(options: StartOptions): Promise<void> {\n  const { rootDir, port, host } = options;\n  const distDir = join(rootDir, 'dist');\n  const mainPath = join(distDir, 'server', 'main.mjs');\n  if (!existsSync(mainPath)) {\n    console.error('rshono: no production build found — run `rshono build` first.');\n    process.exit(1);\n  }\n\n  // A bundle built for a hosting platform has no listener in it — its entry hands a `fetch` handler to\n  // whatever is running it. Starting one here would exit silently the moment the module finished\n  // evaluating, so say what happened and point at the command that does deploy it.\n  const target = readBuildMarker(distDir);\n  if (target !== null && target !== 'node') {\n    const hint = deployHintFor(target);\n    console.error(`rshono: this build targets ${target}, which \\`rshono start\\` cannot run${hint ? ` — ${hint}` : '.'}`);\n    console.error('  Rebuild for a server with `rshono build --deploy node` to run it here.');\n    process.exit(1);\n  }\n\n  const env = { ...process.env };\n  if (port !== undefined) env.PORT = String(port);\n  if (host !== undefined) env.HOST = host;\n\n  const child = spawn(process.execPath, ['--enable-source-maps', mainPath], {\n    stdio: 'inherit',\n    env,\n  });\n\n  onShutdown((signal) => child.kill(signal));\n  child.on('exit', (code, signal) => {\n    process.exit(signal ? 1 : (code ?? 1));\n  });\n}\n"]}
+{"version":3,"file":"start.js","sourceRoot":"","sources":["../../src/cli/start.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAQjC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqB;IACtD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,4GAA4G;IAC5G,yCAAyC;IACzC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,8BAA8B,MAAM,sCAAsC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACrH,OAAO,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,mGAAmG;IACnG,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAEhD,mGAAmG;IACnG,wGAAwG;IACxG,2GAA2G;IAC3G,2GAA2G;IAC3G,mGAAmG;IACnG,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC","sourcesContent":["import { existsSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport { readBuildMarker } from '../deploy/build-marker.js';\nimport { deployHintFor } from '../deploy/presets.js';\nimport { exit } from './exit.js';\n\ninterface StartOptions {\n  rootDir: string;\n  port?: number;\n  host?: string;\n}\n\nexport async function startCommand(options: StartOptions): Promise<void> {\n  const { rootDir, port, host } = options;\n  const distDir = join(rootDir, 'dist');\n  const mainPath = join(distDir, 'server', 'main.mjs');\n  if (!existsSync(mainPath)) {\n    console.error('rshono: no production build found — run `rshono build` first.');\n    return exit(1);\n  }\n\n  // A bundle built for a hosting platform has no listener in it, so starting one here would exit silently the\n  // moment the module finished evaluating.\n  const target = readBuildMarker(distDir);\n  if (target !== null && target !== 'node') {\n    const hint = deployHintFor(target);\n    console.error(`rshono: this build targets ${target}, which \\`rshono start\\` cannot run${hint ? ` — ${hint}` : '.'}`);\n    console.error('  Rebuild for a server with `rshono build --deploy node` to run it here.');\n    return exit(1);\n  }\n\n  // Read by the bundle as it evaluates, which is what binds the port — so they have to be set first.\n  if (port !== undefined) process.env.PORT = String(port);\n  if (host !== undefined) process.env.HOST = host;\n\n  // Imported into this process rather than spawned into a child. The child only ever existed to pass\n  // `--enable-source-maps`, and `bin/rshono.mjs` already enables the same thing in-process before the CLI\n  // loads — so a supervisor bought a second PID and its own heap in every container, an extra frame in every\n  // stack, and signal forwarding for signals the bundle already handles itself through `onShutdown`. `start`\n  // deliberately imports no Rspack, so the process this leaves behind is the server and little else.\n  await import(pathToFileURL(mainPath).href);\n}\n"]}

package/dist/config.d.ts

@@ -1,6 +1,6 @@
 import type { RspackOptions } from '@rspack/core';
 import type { DeployTarget } from './deploy/contract.js';
-/** Which of the two Rspack compilers the {@link RSHonoConfig.rspack} hook is being called for. */
+/** Which of the two Rspack compilers the {@link RshonoConfig.rspack} hook is being called for. */
 export interface RspackHookContext {
     /** `true` for the server (`target: node`) bundle, `false` for the client (`target: web`) bundle. */
     isServer: boolean;
@@ -8,114 +8,108 @@ export interface RspackHookContext {
     isDev: boolean;
 }
 /**
- * Project configuration for rshono, default-exported from `rshono.config.ts` at the project root
- * (`.js` / `.mjs` also work). Every field is optional; omit the file entirely to accept all defaults.
+ * Project configuration, default-exported from `rshono.config.ts` at the project root (`.js` / `.mjs`
+ * also work). Every field is optional; omit the file entirely to accept all defaults.
+ *
+ * It holds only what the *build* decides. Per-request concerns — CSRF, CSP, the body cap — are Hono
+ * middleware in `src/server.ts`, which is where Hono already ships all of them.
  *
  * @example
  * ```ts
  * import { defineConfig } from '@rshono/core';
  *
  * export default defineConfig({
- *   csp: true,
- *   bodySizeLimit: '4mb',
- *   allowedOrigins: ['https://admin.example.com'],
+ *   deploy: 'cloudflare',
+ *   siteUrl: 'https://example.com',
  * });
  * ```
+ *
+ * @see {@link https://www.rshono.com/docs/configuration | Docs — configuration}
  */
-export interface RSHonoConfig {
+export interface RshonoConfig {
     /**
-     * The hosting platform `rshono build` targets. Default `'node'` — a long-lived server process, for
-     * a VPS, a container or anywhere else you run `rshono start`.
+     * The hosting platform `rshono build` targets. Default `'node'` — a long-lived server process run
+     * with `rshono start`.
+     *
+     * Overridden by the `--deploy` flag or the `RSHONO_DEPLOY` env var, so one config can build for more
+     * than one place. `rshono dev` ignores it and always runs the Node dev server.
      *
-     * Overridden by the `--deploy` flag or the `RSHONO_DEPLOY` env var, so one config can still be
-     * built for more than one place. `rshono dev` ignores it entirely and always runs the Node dev
-     * server.
+     * @see {@link https://www.rshono.com/docs/deployment | Docs — deployment}
      */
     deploy?: DeployTarget;
     /**
-     * The public origin the site is served from, e.g. `'https://example.com'`.
+     * The public origin the site is served from, e.g. `'https://example.com'`. Must be a bare origin —
+     * a path is rejected rather than silently dropped.
      *
-     * Only used when prerendering `render: 'static'` routes. A prerendered page is one fixed file
-     * handed to everyone, so any absolute URL inside it has to be decided at build time — there is no
-     * request to read a `Host` from. That is what a page's `url` prop is, so without this a static
-     * page bakes in `http://localhost` wherever it builds a canonical tag, an absolute link or an
-     * `og:url`. Dynamic routes are unaffected: they resolve the URL per request.
+     * Only used when prerendering `render: 'static'` routes, which have no request to read a `Host`
+     * from: without it their `url` prop falls back to `http://localhost`, and that is what canonical
+     * tags, absolute links and `og:url` get baked with.
      *
-     * The origin is what's used; a path is rejected rather than silently dropped.
+     * @see {@link https://www.rshono.com/docs/configuration#siteurl | Docs — siteUrl}
      */
     siteUrl?: string;
-    /** Default port for `dev` / `start`. Overridden by the `--port` flag or the `PORT` env var. Default `3000`. */
-    port?: number;
-    /** Bind address for `start`. Overridden by the `HOST` env var. Default `'0.0.0.0'`. */
-    host?: string;
     /**
-     * Honour `X-Forwarded-Host` / `X-Forwarded-Proto` when resolving the browser-facing request
-     * URL (`getContext().url`, a page's `url` prop, and the origin the CSRF check compares against).
+     * Honour `X-Forwarded-Host` / `X-Forwarded-Proto` when resolving the browser-facing request URL —
+     * `getRequestContext().url` and a page's `url` prop. Default `false`; always `true` under
+     * `rshono dev`.
      *
-     * **Off by default, and leave it off unless a proxy you control sets those headers**, because
-     * any client can send them: with it on and nothing stripping them at the edge, one request can
-     * point every absolute URL your app builds at an attacker's host (and poison a shared cache).
-     * Turn it on when you terminate TLS or rewrite `Host` at a reverse proxy / load balancer.
-     * Always `true` under `rshono dev`, where the framework's own proxy sets them and binds to
-     * localhost. Default `false`.
-     */
-    trustProxy?: boolean;
-    /**
-     * CSRF origin check on server-action POSTs — rejects a cross-origin request with 403.
-     * Turn off only behind a gateway that already enforces it. Default `true`.
-     */
-    checkOrigin?: boolean;
-    /**
-     * Extra origins allowed to post server actions, in addition to the app's own origin.
-     * Accepts full origins or bare hosts, e.g. `['https://admin.example.com', 'localhost:4000']`.
-     */
-    allowedOrigins?: string[];
-    /**
-     * Send a strict per-request-nonce `Content-Security-Policy` with every HTML document.
-     * While enabled, `render: 'static'` routes render per request (a prerendered file can't carry a
-     * per-request nonce). Default `false`.
-     */
-    csp?: boolean;
-    /**
-     * Directives merged over the built-in {@link csp} policy, which is deliberately strict
-     * (`default-src 'self'`, no framing, no plugins) and so blocks third-party images, fonts and
-     * API hosts until you widen it here. Set a directive to `''` to drop it entirely.
+     * **Enable it only behind a proxy you control**: any client can send those headers, so with nothing
+     * stripping them at the edge one request can point every absolute URL the app builds at an
+     * attacker's host. Turn it on when you terminate TLS or rewrite `Host` at a reverse proxy.
+     *
+     * Middleware in `src/server.ts` reads Hono's `c.req.url` — the *internal* address — whatever this
+     * says, so give `csrf()` the public origin explicitly.
+     *
+     * **Compiled into the server bundle**, not read at runtime, so it takes a rebuild to change and there is
+     * no environment variable for it: one artifact cannot be promoted from a direct-exposure staging box to a
+     * proxied production one.
      *
-     * The per-request nonce is always appended to `script-src`, whatever you put there.
-     * Ignored unless `csp` is `true`.
+     * **The `vercel` target is the exception, for the scheme only.** TLS terminates at that platform's edge
+     * and the function is reached over plain HTTP, so the request is rebuilt from `X-Forwarded-Proto`
+     * whatever this says — the function is reachable only through the edge, which sets the header on every
+     * request, so it is not client-supplied there. The `Host` header is not part of the exception, and is no
+     * more trusted on that target than on any other.
      *
      * @example
      * ```ts
-     * cspDirectives: {
-     *   'img-src': "'self' data: https://images.example.com",
-     *   'font-src': "'self' https://fonts.gstatic.com",
-     *   'frame-ancestors': "'self'",
-     * }
+     * export default defineConfig({ trustProxy: true });
      * ```
-     */
-    cspDirectives?: Record<string, string>;
-    /**
-     * Max server-action request body before it's rejected with 413 — a memory-exhaustion guard.
-     * A number is bytes; a string carries a unit (`'512kb'`, `'4mb'`); `false` (or `0`) disables the cap.
-     * Default `'1mb'`.
-     */
-    bodySizeLimit?: string | number | false;
-    /** Deadline in milliseconds for a single page render (flight + SSR). Default `10000`. */
-    renderTimeout?: number;
-    /**
-     * Gzip compressible responses (HTML, flight payloads, JSON, CSS, JS). Streaming-safe — each
-     * chunk the renderer flushes is flushed on the wire too. Default `true`.
      *
-     * Set `false` behind a proxy or CDN that already compresses, to avoid doing the work twice.
+     * @see {@link https://www.rshono.com/docs/configuration#proxy-headers | Docs — proxy headers}
      */
-    compress?: boolean;
+    trustProxy?: boolean;
     /**
      * Escape hatch: mutate the generated Rspack config just before it's compiled. Called once per
      * compiler — inspect {@link RspackHookContext.isServer} to tell them apart. Mutate `config` in
      * place and return nothing, or return a replacement.
+     *
+     * @example
+     * ```ts
+     * rspack(config, { isServer }) {
+     *   config.module?.rules?.push({ test: /\.svg$/, type: 'asset/source' });
+     * }
+     * ```
+     *
+     * @see {@link https://rspack.rs/config/ | Rspack — configuration reference}
+     * @see {@link https://www.rshono.com/docs/configuration#the-rspack-hook | Docs — the rspack hook}
      */
     rspack?: (config: RspackOptions, ctx: RspackHookContext) => RspackOptions | void;
 }
-/** Identity helper that types a config object — gives editor autocomplete without an explicit annotation. */
-export declare function defineConfig(config: RSHonoConfig): RSHonoConfig;
-//# sourceMappingURL=config.d.ts.map
+/**
+ * Types a config object for editor autocomplete, without an explicit annotation. Default-export the
+ * result from `rshono.config.ts`.
+ *
+ * @param config - The project's {@link RshonoConfig}; every field is optional.
+ * @returns The config, unchanged and fully typed.
+ *
+ * @example
+ * ```ts
+ * // rshono.config.ts
+ * import { defineConfig } from '@rshono/core';
+ *
+ * export default defineConfig({ deploy: 'cloudflare', siteUrl: 'https://example.com' });
+ * ```
+ *
+ * @see {@link https://www.rshono.com/docs/configuration | Docs — configuration}
+ */
+export declare function defineConfig(config: RshonoConfig): RshonoConfig;

package/dist/config.js

@@ -1,4 +1,20 @@
-/** Identity helper that types a config object — gives editor autocomplete without an explicit annotation. */
+/**
+ * Types a config object for editor autocomplete, without an explicit annotation. Default-export the
+ * result from `rshono.config.ts`.
+ *
+ * @param config - The project's {@link RshonoConfig}; every field is optional.
+ * @returns The config, unchanged and fully typed.
+ *
+ * @example
+ * ```ts
+ * // rshono.config.ts
+ * import { defineConfig } from '@rshono/core';
+ *
+ * export default defineConfig({ deploy: 'cloudflare', siteUrl: 'https://example.com' });
+ * ```
+ *
+ * @see {@link https://www.rshono.com/docs/configuration | Docs — configuration}
+ */
 export function defineConfig(config) {
     return config;
 }

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAyHA,6GAA6G;AAC7G,MAAM,UAAU,YAAY,CAAC,MAAoB;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { RspackOptions } from '@rspack/core';\nimport type { DeployTarget } from './deploy/contract.js';\n\n/** Which of the two Rspack compilers the {@link RSHonoConfig.rspack} hook is being called for. */\nexport interface RspackHookContext {\n  /** `true` for the server (`target: node`) bundle, `false` for the client (`target: web`) bundle. */\n  isServer: boolean;\n  /** `true` under `rshono dev`, `false` under `rshono build`. */\n  isDev: boolean;\n}\n\n/**\n * Project configuration for rshono, default-exported from `rshono.config.ts` at the project root\n * (`.js` / `.mjs` also work). Every field is optional; omit the file entirely to accept all defaults.\n *\n * @example\n * ```ts\n * import { defineConfig } from '@rshono/core';\n *\n * export default defineConfig({\n *   csp: true,\n *   bodySizeLimit: '4mb',\n *   allowedOrigins: ['https://admin.example.com'],\n * });\n * ```\n */\nexport interface RSHonoConfig {\n  /**\n   * The hosting platform `rshono build` targets. Default `'node'` — a long-lived server process, for\n   * a VPS, a container or anywhere else you run `rshono start`.\n   *\n   * Overridden by the `--deploy` flag or the `RSHONO_DEPLOY` env var, so one config can still be\n   * built for more than one place. `rshono dev` ignores it entirely and always runs the Node dev\n   * server.\n   */\n  deploy?: DeployTarget;\n  /**\n   * The public origin the site is served from, e.g. `'https://example.com'`.\n   *\n   * Only used when prerendering `render: 'static'` routes. A prerendered page is one fixed file\n   * handed to everyone, so any absolute URL inside it has to be decided at build time — there is no\n   * request to read a `Host` from. That is what a page's `url` prop is, so without this a static\n   * page bakes in `http://localhost` wherever it builds a canonical tag, an absolute link or an\n   * `og:url`. Dynamic routes are unaffected: they resolve the URL per request.\n   *\n   * The origin is what's used; a path is rejected rather than silently dropped.\n   */\n  siteUrl?: string;\n  /** Default port for `dev` / `start`. Overridden by the `--port` flag or the `PORT` env var. Default `3000`. */\n  port?: number;\n  /** Bind address for `start`. Overridden by the `HOST` env var. Default `'0.0.0.0'`. */\n  host?: string;\n  /**\n   * Honour `X-Forwarded-Host` / `X-Forwarded-Proto` when resolving the browser-facing request\n   * URL (`getContext().url`, a page's `url` prop, and the origin the CSRF check compares against).\n   *\n   * **Off by default, and leave it off unless a proxy you control sets those headers**, because\n   * any client can send them: with it on and nothing stripping them at the edge, one request can\n   * point every absolute URL your app builds at an attacker's host (and poison a shared cache).\n   * Turn it on when you terminate TLS or rewrite `Host` at a reverse proxy / load balancer.\n   * Always `true` under `rshono dev`, where the framework's own proxy sets them and binds to\n   * localhost. Default `false`.\n   */\n  trustProxy?: boolean;\n  /**\n   * CSRF origin check on server-action POSTs — rejects a cross-origin request with 403.\n   * Turn off only behind a gateway that already enforces it. Default `true`.\n   */\n  checkOrigin?: boolean;\n  /**\n   * Extra origins allowed to post server actions, in addition to the app's own origin.\n   * Accepts full origins or bare hosts, e.g. `['https://admin.example.com', 'localhost:4000']`.\n   */\n  allowedOrigins?: string[];\n  /**\n   * Send a strict per-request-nonce `Content-Security-Policy` with every HTML document.\n   * While enabled, `render: 'static'` routes render per request (a prerendered file can't carry a\n   * per-request nonce). Default `false`.\n   */\n  csp?: boolean;\n  /**\n   * Directives merged over the built-in {@link csp} policy, which is deliberately strict\n   * (`default-src 'self'`, no framing, no plugins) and so blocks third-party images, fonts and\n   * API hosts until you widen it here. Set a directive to `''` to drop it entirely.\n   *\n   * The per-request nonce is always appended to `script-src`, whatever you put there.\n   * Ignored unless `csp` is `true`.\n   *\n   * @example\n   * ```ts\n   * cspDirectives: {\n   *   'img-src': \"'self' data: https://images.example.com\",\n   *   'font-src': \"'self' https://fonts.gstatic.com\",\n   *   'frame-ancestors': \"'self'\",\n   * }\n   * ```\n   */\n  cspDirectives?: Record<string, string>;\n  /**\n   * Max server-action request body before it's rejected with 413 — a memory-exhaustion guard.\n   * A number is bytes; a string carries a unit (`'512kb'`, `'4mb'`); `false` (or `0`) disables the cap.\n   * Default `'1mb'`.\n   */\n  bodySizeLimit?: string | number | false;\n  /** Deadline in milliseconds for a single page render (flight + SSR). Default `10000`. */\n  renderTimeout?: number;\n  /**\n   * Gzip compressible responses (HTML, flight payloads, JSON, CSS, JS). Streaming-safe — each\n   * chunk the renderer flushes is flushed on the wire too. Default `true`.\n   *\n   * Set `false` behind a proxy or CDN that already compresses, to avoid doing the work twice.\n   */\n  compress?: boolean;\n  /**\n   * Escape hatch: mutate the generated Rspack config just before it's compiled. Called once per\n   * compiler — inspect {@link RspackHookContext.isServer} to tell them apart. Mutate `config` in\n   * place and return nothing, or return a replacement.\n   */\n  rspack?: (config: RspackOptions, ctx: RspackHookContext) => RspackOptions | void;\n}\n\n/** Identity helper that types a config object — gives editor autocomplete without an explicit annotation. */\nexport function defineConfig(config: RSHonoConfig): RSHonoConfig {\n  return config;\n}\n"]}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAoGA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,MAAoB;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { RspackOptions } from '@rspack/core';\nimport type { DeployTarget } from './deploy/contract.js';\n\n/** Which of the two Rspack compilers the {@link RshonoConfig.rspack} hook is being called for. */\nexport interface RspackHookContext {\n  /** `true` for the server (`target: node`) bundle, `false` for the client (`target: web`) bundle. */\n  isServer: boolean;\n  /** `true` under `rshono dev`, `false` under `rshono build`. */\n  isDev: boolean;\n}\n\n/**\n * Project configuration, default-exported from `rshono.config.ts` at the project root (`.js` / `.mjs`\n * also work). Every field is optional; omit the file entirely to accept all defaults.\n *\n * It holds only what the *build* decides. Per-request concerns — CSRF, CSP, the body cap — are Hono\n * middleware in `src/server.ts`, which is where Hono already ships all of them.\n *\n * @example\n * ```ts\n * import { defineConfig } from '@rshono/core';\n *\n * export default defineConfig({\n *   deploy: 'cloudflare',\n *   siteUrl: 'https://example.com',\n * });\n * ```\n *\n * @see {@link https://www.rshono.com/docs/configuration | Docs — configuration}\n */\nexport interface RshonoConfig {\n  /**\n   * The hosting platform `rshono build` targets. Default `'node'` — a long-lived server process run\n   * with `rshono start`.\n   *\n   * Overridden by the `--deploy` flag or the `RSHONO_DEPLOY` env var, so one config can build for more\n   * than one place. `rshono dev` ignores it and always runs the Node dev server.\n   *\n   * @see {@link https://www.rshono.com/docs/deployment | Docs — deployment}\n   */\n  deploy?: DeployTarget;\n  /**\n   * The public origin the site is served from, e.g. `'https://example.com'`. Must be a bare origin —\n   * a path is rejected rather than silently dropped.\n   *\n   * Only used when prerendering `render: 'static'` routes, which have no request to read a `Host`\n   * from: without it their `url` prop falls back to `http://localhost`, and that is what canonical\n   * tags, absolute links and `og:url` get baked with.\n   *\n   * @see {@link https://www.rshono.com/docs/configuration#siteurl | Docs — siteUrl}\n   */\n  siteUrl?: string;\n  /**\n   * Honour `X-Forwarded-Host` / `X-Forwarded-Proto` when resolving the browser-facing request URL —\n   * `getRequestContext().url` and a page's `url` prop. Default `false`; always `true` under\n   * `rshono dev`.\n   *\n   * **Enable it only behind a proxy you control**: any client can send those headers, so with nothing\n   * stripping them at the edge one request can point every absolute URL the app builds at an\n   * attacker's host. Turn it on when you terminate TLS or rewrite `Host` at a reverse proxy.\n   *\n   * Middleware in `src/server.ts` reads Hono's `c.req.url` — the *internal* address — whatever this\n   * says, so give `csrf()` the public origin explicitly.\n   *\n   * **Compiled into the server bundle**, not read at runtime, so it takes a rebuild to change and there is\n   * no environment variable for it: one artifact cannot be promoted from a direct-exposure staging box to a\n   * proxied production one.\n   *\n   * **The `vercel` target is the exception, for the scheme only.** TLS terminates at that platform's edge\n   * and the function is reached over plain HTTP, so the request is rebuilt from `X-Forwarded-Proto`\n   * whatever this says — the function is reachable only through the edge, which sets the header on every\n   * request, so it is not client-supplied there. The `Host` header is not part of the exception, and is no\n   * more trusted on that target than on any other.\n   *\n   * @example\n   * ```ts\n   * export default defineConfig({ trustProxy: true });\n   * ```\n   *\n   * @see {@link https://www.rshono.com/docs/configuration#proxy-headers | Docs — proxy headers}\n   */\n  trustProxy?: boolean;\n  /**\n   * Escape hatch: mutate the generated Rspack config just before it's compiled. Called once per\n   * compiler — inspect {@link RspackHookContext.isServer} to tell them apart. Mutate `config` in\n   * place and return nothing, or return a replacement.\n   *\n   * @example\n   * ```ts\n   * rspack(config, { isServer }) {\n   *   config.module?.rules?.push({ test: /\\.svg$/, type: 'asset/source' });\n   * }\n   * ```\n   *\n   * @see {@link https://rspack.rs/config/ | Rspack — configuration reference}\n   * @see {@link https://www.rshono.com/docs/configuration#the-rspack-hook | Docs — the rspack hook}\n   */\n  rspack?: (config: RspackOptions, ctx: RspackHookContext) => RspackOptions | void;\n}\n\n/**\n * Types a config object for editor autocomplete, without an explicit annotation. Default-export the\n * result from `rshono.config.ts`.\n *\n * @param config - The project's {@link RshonoConfig}; every field is optional.\n * @returns The config, unchanged and fully typed.\n *\n * @example\n * ```ts\n * // rshono.config.ts\n * import { defineConfig } from '@rshono/core';\n *\n * export default defineConfig({ deploy: 'cloudflare', siteUrl: 'https://example.com' });\n * ```\n *\n * @see {@link https://www.rshono.com/docs/configuration | Docs — configuration}\n */\nexport function defineConfig(config: RshonoConfig): RshonoConfig {\n  return config;\n}\n"]}

package/dist/deploy/aws-lambda/runtime.d.ts

@@ -2,13 +2,10 @@ import type { DeployRuntime } from '../contract.js';
 /**
  * AWS Lambda behind a Function URL, in streaming mode.
  *
- * `streamHandle` wraps the app with `awslambda.streamifyResponse`, which is the only way a Lambda can
- * write a response progressively — and progressive is the whole point of a streamed SSR shell. It
- * requires the Function URL's invoke mode to be `RESPONSE_STREAM`; the buffered `handle` would work
- * anywhere but would hold every page until the last byte rendered.
+ * `streamHandle` wraps the app with `awslambda.streamifyResponse`, the only way a Lambda writes a response
+ * progressively — which is the whole point of a streamed SSR shell. It requires the Function URL's invoke mode
+ * to be `RESPONSE_STREAM`; the buffered `handle` would work anywhere but hold every page until its last byte.
  *
- * The filesystem capabilities are Node's: a Lambda unpacks the deployment package onto a read-only
- * disk, so `dist/static`, `dist/public` and `dist/ssg` are read exactly as they are on a server.
+ * The filesystem capabilities are Node's: a Lambda unpacks the deployment package onto a read-only disk.
  */
 export declare const runtime: DeployRuntime;
-//# sourceMappingURL=runtime.d.ts.map

package/dist/deploy/aws-lambda/runtime.js

@@ -3,19 +3,16 @@ import { fileSystemRuntime } from '../filesystem.js';
 /**
  * AWS Lambda behind a Function URL, in streaming mode.
  *
- * `streamHandle` wraps the app with `awslambda.streamifyResponse`, which is the only way a Lambda can
- * write a response progressively — and progressive is the whole point of a streamed SSR shell. It
- * requires the Function URL's invoke mode to be `RESPONSE_STREAM`; the buffered `handle` would work
- * anywhere but would hold every page until the last byte rendered.
+ * `streamHandle` wraps the app with `awslambda.streamifyResponse`, the only way a Lambda writes a response
+ * progressively — which is the whole point of a streamed SSR shell. It requires the Function URL's invoke mode
+ * to be `RESPONSE_STREAM`; the buffered `handle` would work anywhere but hold every page until its last byte.
  *
- * The filesystem capabilities are Node's: a Lambda unpacks the deployment package onto a read-only
- * disk, so `dist/static`, `dist/public` and `dist/ssg` are read exactly as they are on a server.
+ * The filesystem capabilities are Node's: a Lambda unpacks the deployment package onto a read-only disk.
  */
 export const runtime = {
     ...fileSystemRuntime,
     serveApp(app) {
-        // `awslambda` is a global the Lambda runtime injects, so it is absent when the build imports this
-        // bundle to prerender. Returning nothing then keeps that pass working; a real invocation has it.
+        // A global the Lambda runtime injects, so it is absent when the build imports this bundle to prerender.
         if (typeof globalThis.awslambda === 'undefined')
             return undefined;
         return streamHandle(app);

package/dist/deploy/aws-lambda/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/deploy/aws-lambda/runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,OAAO,GAAkB;IACpC,GAAG,iBAAiB;IAEpB,QAAQ,CAAC,GAAS;QAChB,kGAAkG;QAClG,iGAAiG;QACjG,IAAI,OAAQ,UAAsC,CAAC,SAAS,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC;QAC/F,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;CACF,CAAC","sourcesContent":["import type { Hono } from 'hono';\nimport { streamHandle } from 'hono/aws-lambda';\nimport type { DeployRuntime } from '../contract.js';\nimport { fileSystemRuntime } from '../filesystem.js';\n\n/**\n * AWS Lambda behind a Function URL, in streaming mode.\n *\n * `streamHandle` wraps the app with `awslambda.streamifyResponse`, which is the only way a Lambda can\n * write a response progressively — and progressive is the whole point of a streamed SSR shell. It\n * requires the Function URL's invoke mode to be `RESPONSE_STREAM`; the buffered `handle` would work\n * anywhere but would hold every page until the last byte rendered.\n *\n * The filesystem capabilities are Node's: a Lambda unpacks the deployment package onto a read-only\n * disk, so `dist/static`, `dist/public` and `dist/ssg` are read exactly as they are on a server.\n */\nexport const runtime: DeployRuntime = {\n  ...fileSystemRuntime,\n\n  serveApp(app: Hono): unknown {\n    // `awslambda` is a global the Lambda runtime injects, so it is absent when the build imports this\n    // bundle to prerender. Returning nothing then keeps that pass working; a real invocation has it.\n    if (typeof (globalThis as { awslambda?: unknown }).awslambda === 'undefined') return undefined;\n    return streamHandle(app);\n  },\n};\n"]}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/deploy/aws-lambda/runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,OAAO,GAAkB;IACpC,GAAG,iBAAiB;IAEpB,QAAQ,CAAC,GAAS;QAChB,wGAAwG;QACxG,IAAI,OAAQ,UAAsC,CAAC,SAAS,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC;QAC/F,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;CACF,CAAC","sourcesContent":["import type { Hono } from 'hono';\nimport { streamHandle } from 'hono/aws-lambda';\nimport type { DeployRuntime } from '../contract.js';\nimport { fileSystemRuntime } from '../filesystem.js';\n\n/**\n * AWS Lambda behind a Function URL, in streaming mode.\n *\n * `streamHandle` wraps the app with `awslambda.streamifyResponse`, the only way a Lambda writes a response\n * progressively — which is the whole point of a streamed SSR shell. It requires the Function URL's invoke mode\n * to be `RESPONSE_STREAM`; the buffered `handle` would work anywhere but hold every page until its last byte.\n *\n * The filesystem capabilities are Node's: a Lambda unpacks the deployment package onto a read-only disk.\n */\nexport const runtime: DeployRuntime = {\n  ...fileSystemRuntime,\n\n  serveApp(app: Hono): unknown {\n    // A global the Lambda runtime injects, so it is absent when the build imports this bundle to prerender.\n    if (typeof (globalThis as { awslambda?: unknown }).awslambda === 'undefined') return undefined;\n    return streamHandle(app);\n  },\n};\n"]}