@rshono/core 1.0.0-rc.6 → 1.0.0-rc.8

package/dist/server/prerendered.d.ts

@@ -7,11 +7,9 @@
  * it from the fs module would drag `node:fs` and `node:crypto` into a bundle that has neither.
  */
 /**
- * The two representations of a page, prerendered side by side.
- *
- * A hard load wants the HTML document; a soft navigation asks the same URL for a flight payload.
- * Writing only the HTML meant every in-app click re-rendered a page that was already built, so the
- * prerender only ever paid off for cold loads and crawlers.
+ * The two representations of a page, prerendered side by side: a hard load wants the HTML document, a
+ * soft navigation asks the same URL for a flight payload. Without both, every in-app click would
+ * re-render a page that was already built.
  */
 export type PrerenderVariant = 'html' | 'flight';
 export declare const VARIANTS: {
@@ -45,37 +43,27 @@ export declare function prerenderedRelPath(requestPath: string, variant: Prerend
 /**
  * A bounded, insertion-ordered cache of prerendered pages.
  *
- * Bounded so a site with thousands of prerendered pages keeps a working set rather than the whole build
- * in memory. Only *hits* are ever stored: caching misses would let anyone mint entries by requesting
- * paths that don't exist. The files are written at build time and never change while the server is up,
- * so an entry never needs invalidating.
- *
- * Shared because both targets need exactly this and had a hand-rolled copy of it, down to the same
- * eviction line.
+ * Bounded so a site with thousands of prerendered pages keeps a working set rather than the whole
+ * build in memory. Only *hits* are ever stored: caching misses would let anyone mint entries by
+ * requesting paths that don't exist. The files are written at build time and never change while the
+ * server is up, so an entry never needs invalidating.
  */
 export declare function createPageCache(max?: number): {
     get(key: string): PrerenderedPage | undefined;
     set(key: string, page: PrerenderedPage): void;
 };
 /**
- * A weak `ETag` for a page body.
+ * A weak `ETag` for a page body — see {@link PrerenderedPage.etag} for why weak.
  *
  * Web Crypto rather than `node:crypto`, so the one implementation serves both a Node server and
- * `workerd` — the Cloudflare runtime used to carry its own copy of this, with its own base64url
- * conversion, purely because the other one reached for a Node builtin.
- *
- * Deliberately **weak**: the bytes on the wire depend on whether the client took gzip, and a strong
- * validator would have to differ between those two — so the 200 and the 304 that revalidates it would
- * disagree, and a cache would treat them as different pages. A weak tag says "the same
- * representation", which is exactly what is true across content codings.
+ * `workerd`.
  */
 export declare function weakEtag(body: Uint8Array<ArrayBuffer>): Promise<string>;
 /**
  * Assembles a {@link PrerenderedPage} from a body just read out of the build.
  *
- * `storeEtag` is the validator the store supplied, where it has one — it already describes these exact
- * bytes, so it is preferred over hashing them again, and only weakened. Both call sites went through
- * their own copy of this before, with two different digest implementations.
+ * `storeEtag` is the validator the store supplied, where it has one — it already describes these
+ * exact bytes, so it is preferred over hashing them again, and only weakened.
  */
 export declare function toPrerenderedPage(body: Uint8Array<ArrayBuffer>, storeEtag?: string | null): Promise<PrerenderedPage>;
 /** A prerendered page, ready to serve: its body and a validator derived from those exact bytes. */
@@ -84,26 +72,23 @@ export interface PrerenderedPage {
      * The document or the flight payload, depending on which {@link PrerenderVariant} was read.
      *
      * Bytes rather than a string, because this is a *cache* entry served verbatim to every request that
-     * hits it. Held as a string, each of those requests pays a fresh UTF-8 encode of the whole page on the
-     * way out — the one route where the framework does no rendering at all was spending its time
-     * re-encoding bytes it had already encoded once to measure them. Read once, encoded never.
+     * hits it — held as a string, each of those would pay a fresh UTF-8 encode of the whole page on the
+     * way out. Read once, encoded never.
      */
     body: Uint8Array<ArrayBuffer>;
     /**
-     * `Content-Length` for {@link body}, in bytes rather than characters.
-     *
-     * Served with the response because Hono sets no length for an in-memory body, and a proxy or CDN in
-     * front is entitled to make decisions with it — whether gzipping this response is worth the framing,
-     * most obviously.
+     * `Content-Length` for {@link body}, in bytes rather than characters. Served explicitly because
+     * Hono sets no length for an in-memory body, and a proxy or CDN in front is entitled to make
+     * decisions with it — whether gzipping this response is worth the framing, most obviously.
      */
     contentLength: string;
     /**
      * `ETag` for the page, so a revalidating client can be answered with a 304 instead of the body.
      *
-     * Deliberately **weak**. The bytes on the wire depend on whether something in front re-encoded them,
-     * and a strong validator would have to differ per coding — so the 200 and the 304 that revalidates it
-     * could disagree, and a cache would treat them as different pages. A weak tag says "the same
-     * representation", which is exactly what stays true across content codings.
+     * Deliberately **weak**. The bytes on the wire depend on whether something in front re-encoded
+     * them, and a strong validator would have to differ per coding — so the 200 and the 304 that
+     * revalidates it could disagree, and a cache would treat them as different pages. A weak tag says
+     * "the same representation", which is what stays true across content codings.
      */
     etag: string;
 }

package/dist/server/prerendered.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prerendered.d.ts","sourceRoot":"","sources":["../../src/server/prerendered.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEjD,eAAO,MAAM,QAAQ;;iBACX,IAAI,EAAE,YAAY;iBAAE,MAAM,EAAE,WAAW;iBAAE,WAAW,EAAE,WAAW;;;iBAC/D,IAAI,EAAE,WAAW;iBAAE,MAAM,EAAE,kBAAkB;iBAAE,WAAW,EAAE,kBAAkB;;CACU,CAAC;AAErG;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAyB,GAAG,MAAM,GAAG,IAAI,CAKhG;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAGhG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,GAAG,SAAM,GAAG;IAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAC;IAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAU3I;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAO7E;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC,CAM1H;AAED,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B;;;;;;;OAOG;IACH,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC9B;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;CACd"}
+{"version":3,"file":"prerendered.d.ts","sourceRoot":"","sources":["../../src/server/prerendered.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEjD,eAAO,MAAM,QAAQ;;iBACX,IAAI,EAAE,YAAY;iBAAE,MAAM,EAAE,WAAW;iBAAE,WAAW,EAAE,WAAW;;;iBAC/D,IAAI,EAAE,WAAW;iBAAE,MAAM,EAAE,kBAAkB;iBAAE,WAAW,EAAE,kBAAkB;;CACU,CAAC;AAErG;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAyB,GAAG,MAAM,GAAG,IAAI,CAKhG;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAGhG;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,SAAM,GAAG;IAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAC;IAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAU3I;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAO7E;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC,CAM1H;AAED,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC9B;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;CACd"}

package/dist/server/prerendered.js

@@ -39,13 +39,10 @@ export function prerenderedRelPath(requestPath, variant) {
 /**
  * A bounded, insertion-ordered cache of prerendered pages.
  *
- * Bounded so a site with thousands of prerendered pages keeps a working set rather than the whole build
- * in memory. Only *hits* are ever stored: caching misses would let anyone mint entries by requesting
- * paths that don't exist. The files are written at build time and never change while the server is up,
- * so an entry never needs invalidating.
- *
- * Shared because both targets need exactly this and had a hand-rolled copy of it, down to the same
- * eviction line.
+ * Bounded so a site with thousands of prerendered pages keeps a working set rather than the whole
+ * build in memory. Only *hits* are ever stored: caching misses would let anyone mint entries by
+ * requesting paths that don't exist. The files are written at build time and never change while the
+ * server is up, so an entry never needs invalidating.
  */
 export function createPageCache(max = 128) {
     const pages = new Map();
@@ -60,16 +57,10 @@ export function createPageCache(max = 128) {
     };
 }
 /**
- * A weak `ETag` for a page body.
+ * A weak `ETag` for a page body — see {@link PrerenderedPage.etag} for why weak.
  *
  * Web Crypto rather than `node:crypto`, so the one implementation serves both a Node server and
- * `workerd` — the Cloudflare runtime used to carry its own copy of this, with its own base64url
- * conversion, purely because the other one reached for a Node builtin.
- *
- * Deliberately **weak**: the bytes on the wire depend on whether the client took gzip, and a strong
- * validator would have to differ between those two — so the 200 and the 304 that revalidates it would
- * disagree, and a cache would treat them as different pages. A weak tag says "the same
- * representation", which is exactly what is true across content codings.
+ * `workerd`.
  */
 export async function weakEtag(body) {
     const digest = await crypto.subtle.digest('SHA-256', body);
@@ -82,9 +73,8 @@ export async function weakEtag(body) {
 /**
  * Assembles a {@link PrerenderedPage} from a body just read out of the build.
  *
- * `storeEtag` is the validator the store supplied, where it has one — it already describes these exact
- * bytes, so it is preferred over hashing them again, and only weakened. Both call sites went through
- * their own copy of this before, with two different digest implementations.
+ * `storeEtag` is the validator the store supplied, where it has one — it already describes these
+ * exact bytes, so it is preferred over hashing them again, and only weakened.
  */
 export async function toPrerenderedPage(body, storeEtag) {
     return {

package/dist/server/prerendered.js.map

@@ -1 +1 @@
-{"version":3,"file":"prerendered.js","sourceRoot":"","sources":["../../src/server/prerendered.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE;IAC3E,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,kBAAkB,EAAE;CACQ,CAAC;AAErG;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,OAAO,GAAqB,MAAM;IAC/E,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IACpC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,OAAyB;IAC/E,IAAI,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,GAAG,GAAG,GAAG;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,OAAO;QACL,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;QAC5B,GAAG,CAAC,GAAG,EAAE,IAAI;YACX,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACrB,yFAAyF;YACzF,IAAI,KAAK,CAAC,IAAI,GAAG,GAAG;gBAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAA6B;IAC1D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;SACnE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,OAAO,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAA6B,EAAE,SAAyB;IAC9F,OAAO;QACL,IAAI;QACJ,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACtC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC;KAC7E,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Everything about a prerendered page that doesn't need a filesystem: where the build puts it, and\n * what it looks like once read back.\n *\n * Split out of `ssg.ts` — which owns the writing and the reading, both through `node:fs` — because a\n * deploy target without a filesystem reads the very same layout out of an asset store, and importing\n * it from the fs module would drag `node:fs` and `node:crypto` into a bundle that has neither.\n */\n\n/**\n * The two representations of a page, prerendered side by side.\n *\n * A hard load wants the HTML document; a soft navigation asks the same URL for a flight payload.\n * Writing only the HTML meant every in-app click re-rendered a page that was already built, so the\n * prerender only ever paid off for cold loads and crawlers.\n */\nexport type PrerenderVariant = 'html' | 'flight';\n\nexport const VARIANTS = {\n  html: { file: 'index.html', accept: 'text/html', contentType: 'text/html' },\n  flight: { file: 'index.rsc', accept: 'text/x-component', contentType: 'text/x-component' },\n} as const satisfies Record<PrerenderVariant, { file: string; accept: string; contentType: string }>;\n\n/**\n * Where a route's prerendered output lives, relative to the output root — or `null` for a path that\n * cannot be prerendered at all (one with a param or a wildcard left in it).\n *\n * Always `/`-separated, never the host's separator: the same string addresses a file on a filesystem\n * (`resolve()` and `join()` both accept forward slashes on Windows) and a key in an asset store,\n * where a backslash would simply be the wrong character.\n */\nexport function ssgFilePath(routePath: string, variant: PrerenderVariant = 'html'): string | null {\n  if (/[:*]/.test(routePath)) return null;\n  const trimmed = routePath.replace(/^\\/+|\\/+$/g, '');\n  const file = VARIANTS[variant].file;\n  return trimmed === '' ? file : `${trimmed}/${file}`;\n}\n\n/**\n * {@link ssgFilePath} for a path that came off a request, so traversal is a miss rather than a lookup.\n *\n * The first line of defence for every deploy target: a store addressed by key has no `resolve()` to\n * fall back on, so `..` has to be refused here or not at all.\n */\nexport function prerenderedRelPath(requestPath: string, variant: PrerenderVariant): string | null {\n  if (/(^|\\/)\\.\\.?(\\/|$)/.test(requestPath)) return null;\n  return ssgFilePath(requestPath, variant);\n}\n\n/**\n * A bounded, insertion-ordered cache of prerendered pages.\n *\n * Bounded so a site with thousands of prerendered pages keeps a working set rather than the whole build\n * in memory. Only *hits* are ever stored: caching misses would let anyone mint entries by requesting\n * paths that don't exist. The files are written at build time and never change while the server is up,\n * so an entry never needs invalidating.\n *\n * Shared because both targets need exactly this and had a hand-rolled copy of it, down to the same\n * eviction line.\n */\nexport function createPageCache(max = 128): { get(key: string): PrerenderedPage | undefined; set(key: string, page: PrerenderedPage): void } {\n  const pages = new Map<string, PrerenderedPage>();\n  return {\n    get: (key) => pages.get(key),\n    set(key, page) {\n      pages.set(key, page);\n      // Insertion-ordered, so the first key is the oldest. One entry in means at most one out.\n      if (pages.size > max) pages.delete(pages.keys().next().value!);\n    },\n  };\n}\n\n/**\n * A weak `ETag` for a page body.\n *\n * Web Crypto rather than `node:crypto`, so the one implementation serves both a Node server and\n * `workerd` — the Cloudflare runtime used to carry its own copy of this, with its own base64url\n * conversion, purely because the other one reached for a Node builtin.\n *\n * Deliberately **weak**: the bytes on the wire depend on whether the client took gzip, and a strong\n * validator would have to differ between those two — so the 200 and the 304 that revalidates it would\n * disagree, and a cache would treat them as different pages. A weak tag says \"the same\n * representation\", which is exactly what is true across content codings.\n */\nexport async function weakEtag(body: Uint8Array<ArrayBuffer>): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', body);\n  const base64url = btoa(String.fromCharCode(...new Uint8Array(digest)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n  return `W/\"${base64url.slice(0, 22)}\"`;\n}\n\n/**\n * Assembles a {@link PrerenderedPage} from a body just read out of the build.\n *\n * `storeEtag` is the validator the store supplied, where it has one — it already describes these exact\n * bytes, so it is preferred over hashing them again, and only weakened. Both call sites went through\n * their own copy of this before, with two different digest implementations.\n */\nexport async function toPrerenderedPage(body: Uint8Array<ArrayBuffer>, storeEtag?: string | null): Promise<PrerenderedPage> {\n  return {\n    body,\n    contentLength: String(body.byteLength),\n    etag: storeEtag ? storeEtag.replace(/^(?!W\\/)/, 'W/') : await weakEtag(body),\n  };\n}\n\n/** A prerendered page, ready to serve: its body and a validator derived from those exact bytes. */\nexport interface PrerenderedPage {\n  /**\n   * The document or the flight payload, depending on which {@link PrerenderVariant} was read.\n   *\n   * Bytes rather than a string, because this is a *cache* entry served verbatim to every request that\n   * hits it. Held as a string, each of those requests pays a fresh UTF-8 encode of the whole page on the\n   * way out — the one route where the framework does no rendering at all was spending its time\n   * re-encoding bytes it had already encoded once to measure them. Read once, encoded never.\n   */\n  body: Uint8Array<ArrayBuffer>;\n  /**\n   * `Content-Length` for {@link body}, in bytes rather than characters.\n   *\n   * Served with the response because Hono sets no length for an in-memory body, and a proxy or CDN in\n   * front is entitled to make decisions with it — whether gzipping this response is worth the framing,\n   * most obviously.\n   */\n  contentLength: string;\n  /**\n   * `ETag` for the page, so a revalidating client can be answered with a 304 instead of the body.\n   *\n   * Deliberately **weak**. The bytes on the wire depend on whether something in front re-encoded them,\n   * and a strong validator would have to differ per coding — so the 200 and the 304 that revalidates it\n   * could disagree, and a cache would treat them as different pages. A weak tag says \"the same\n   * representation\", which is exactly what stays true across content codings.\n   */\n  etag: string;\n}\n"]}
+{"version":3,"file":"prerendered.js","sourceRoot":"","sources":["../../src/server/prerendered.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE;IAC3E,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,kBAAkB,EAAE;CACQ,CAAC;AAErG;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,OAAO,GAAqB,MAAM;IAC/E,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IACpC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,OAAyB;IAC/E,IAAI,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,GAAG,GAAG,GAAG;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,OAAO;QACL,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;QAC5B,GAAG,CAAC,GAAG,EAAE,IAAI;YACX,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACrB,yFAAyF;YACzF,IAAI,KAAK,CAAC,IAAI,GAAG,GAAG;gBAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAA6B;IAC1D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;SACnE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,OAAO,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAA6B,EAAE,SAAyB;IAC9F,OAAO;QACL,IAAI;QACJ,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACtC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC;KAC7E,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Everything about a prerendered page that doesn't need a filesystem: where the build puts it, and\n * what it looks like once read back.\n *\n * Split out of `ssg.ts` — which owns the writing and the reading, both through `node:fs` — because a\n * deploy target without a filesystem reads the very same layout out of an asset store, and importing\n * it from the fs module would drag `node:fs` and `node:crypto` into a bundle that has neither.\n */\n\n/**\n * The two representations of a page, prerendered side by side: a hard load wants the HTML document, a\n * soft navigation asks the same URL for a flight payload. Without both, every in-app click would\n * re-render a page that was already built.\n */\nexport type PrerenderVariant = 'html' | 'flight';\n\nexport const VARIANTS = {\n  html: { file: 'index.html', accept: 'text/html', contentType: 'text/html' },\n  flight: { file: 'index.rsc', accept: 'text/x-component', contentType: 'text/x-component' },\n} as const satisfies Record<PrerenderVariant, { file: string; accept: string; contentType: string }>;\n\n/**\n * Where a route's prerendered output lives, relative to the output root — or `null` for a path that\n * cannot be prerendered at all (one with a param or a wildcard left in it).\n *\n * Always `/`-separated, never the host's separator: the same string addresses a file on a filesystem\n * (`resolve()` and `join()` both accept forward slashes on Windows) and a key in an asset store,\n * where a backslash would simply be the wrong character.\n */\nexport function ssgFilePath(routePath: string, variant: PrerenderVariant = 'html'): string | null {\n  if (/[:*]/.test(routePath)) return null;\n  const trimmed = routePath.replace(/^\\/+|\\/+$/g, '');\n  const file = VARIANTS[variant].file;\n  return trimmed === '' ? file : `${trimmed}/${file}`;\n}\n\n/**\n * {@link ssgFilePath} for a path that came off a request, so traversal is a miss rather than a lookup.\n *\n * The first line of defence for every deploy target: a store addressed by key has no `resolve()` to\n * fall back on, so `..` has to be refused here or not at all.\n */\nexport function prerenderedRelPath(requestPath: string, variant: PrerenderVariant): string | null {\n  if (/(^|\\/)\\.\\.?(\\/|$)/.test(requestPath)) return null;\n  return ssgFilePath(requestPath, variant);\n}\n\n/**\n * A bounded, insertion-ordered cache of prerendered pages.\n *\n * Bounded so a site with thousands of prerendered pages keeps a working set rather than the whole\n * build in memory. Only *hits* are ever stored: caching misses would let anyone mint entries by\n * requesting paths that don't exist. The files are written at build time and never change while the\n * server is up, so an entry never needs invalidating.\n */\nexport function createPageCache(max = 128): { get(key: string): PrerenderedPage | undefined; set(key: string, page: PrerenderedPage): void } {\n  const pages = new Map<string, PrerenderedPage>();\n  return {\n    get: (key) => pages.get(key),\n    set(key, page) {\n      pages.set(key, page);\n      // Insertion-ordered, so the first key is the oldest. One entry in means at most one out.\n      if (pages.size > max) pages.delete(pages.keys().next().value!);\n    },\n  };\n}\n\n/**\n * A weak `ETag` for a page body — see {@link PrerenderedPage.etag} for why weak.\n *\n * Web Crypto rather than `node:crypto`, so the one implementation serves both a Node server and\n * `workerd`.\n */\nexport async function weakEtag(body: Uint8Array<ArrayBuffer>): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', body);\n  const base64url = btoa(String.fromCharCode(...new Uint8Array(digest)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n  return `W/\"${base64url.slice(0, 22)}\"`;\n}\n\n/**\n * Assembles a {@link PrerenderedPage} from a body just read out of the build.\n *\n * `storeEtag` is the validator the store supplied, where it has one — it already describes these\n * exact bytes, so it is preferred over hashing them again, and only weakened.\n */\nexport async function toPrerenderedPage(body: Uint8Array<ArrayBuffer>, storeEtag?: string | null): Promise<PrerenderedPage> {\n  return {\n    body,\n    contentLength: String(body.byteLength),\n    etag: storeEtag ? storeEtag.replace(/^(?!W\\/)/, 'W/') : await weakEtag(body),\n  };\n}\n\n/** A prerendered page, ready to serve: its body and a validator derived from those exact bytes. */\nexport interface PrerenderedPage {\n  /**\n   * The document or the flight payload, depending on which {@link PrerenderVariant} was read.\n   *\n   * Bytes rather than a string, because this is a *cache* entry served verbatim to every request that\n   * hits it — held as a string, each of those would pay a fresh UTF-8 encode of the whole page on the\n   * way out. Read once, encoded never.\n   */\n  body: Uint8Array<ArrayBuffer>;\n  /**\n   * `Content-Length` for {@link body}, in bytes rather than characters. Served explicitly because\n   * Hono sets no length for an in-memory body, and a proxy or CDN in front is entitled to make\n   * decisions with it — whether gzipping this response is worth the framing, most obviously.\n   */\n  contentLength: string;\n  /**\n   * `ETag` for the page, so a revalidating client can be answered with a 304 instead of the body.\n   *\n   * Deliberately **weak**. The bytes on the wire depend on whether something in front re-encoded\n   * them, and a strong validator would have to differ per coding — so the 200 and the 304 that\n   * revalidates it could disagree, and a cache would treat them as different pages. A weak tag says\n   * \"the same representation\", which is what stays true across content codings.\n   */\n  etag: string;\n}\n"]}

package/dist/server/server-config.d.ts

@@ -1,11 +1,15 @@
 import type { RshonoConfig } from '../config.js';
 /**
- * The framework settings the server bundle needs at request time, fully resolved
- * (defaults applied, `bodySizeLimit` parsed to bytes, origins normalized to hosts).
+ * The framework settings the server bundle needs at request time, fully resolved.
  *
  * The value is produced once by {@link resolveServerConfig} from `rshono.config.ts`
  * and compiled into the server bundle as the `__RSHONO_CONFIG__` literal (see
  * `builder/rspack-config.ts`) — there is no runtime env-var interface for these.
+ *
+ * Only two fields, because only two things here are decided by the *build*. The per-request
+ * security controls that used to live alongside them — the CSRF check, the CSP, the body cap — are
+ * Hono middleware an app registers in `src/server.ts`, where they can be configured per route and
+ * per environment instead of once per bundle.
  */
 export interface ServerConfig {
     /**
@@ -17,41 +21,18 @@ export interface ServerConfig {
     isDev: boolean;
     /** Honour `X-Forwarded-Host` / `-Proto` when resolving the browser-facing URL. Forced on in dev. */
     trustProxy: boolean;
-    /** Send a strict per-request-nonce Content-Security-Policy with every HTML document. */
-    cspEnabled: boolean;
-    /** The resolved CSP directives (built-in defaults with the user's merged over them), minus the nonce. */
-    cspDirectives: Record<string, string>;
-    /** CSRF origin check on server-action POSTs. */
-    checkOrigin: boolean;
-    /** Extra origins allowed to post server actions, normalized to lowercase `URL.host` values. */
-    allowedOrigins: string[];
-    /** Max request body in bytes before a 413; `0` disables the cap. */
-    maxBodyBytes: number;
 }
 /**
- * The single source of truth for the framework's built-in defaults.
+ * The framework's built-in defaults.
  *
- * `maxBodyBytes` is resolved here, into the bundle. `port` and `host` are not
- * settings at all: they are read from `PORT` / `HOST` (or `--port`) wherever the address is resolved
- * — `deploy/node/runtime.ts` for a server bundle, `cli/dev.ts` for the dev server — and this is the
- * default both fall back to. A config field for them would have been a fourth precedence level for
- * one number, overridden by the environment on every host that matters.
+ * `port` and `host` are not config fields at all — they come from `PORT` / `HOST` (or `--port`)
+ * wherever the address is resolved, `deploy/node/runtime.ts` for a server bundle and `cli/dev.ts`
+ * for the dev server, and this is what both fall back to.
  */
 export declare const SERVER_DEFAULTS: {
-    readonly maxBodyBytes: number;
     readonly port: 3000;
     readonly host: '0.0.0.0';
 };
-/**
- * The built-in {@link RshonoConfig.csp} policy, keyed by directive so
- * {@link RshonoConfig.cspDirectives} can override entries individually.
- *
- * `script-src` carries the per-request nonce, appended at request time (see `entry.rsc.tsx`).
- * `style-src` needs `'unsafe-inline'` because React writes inline styles.
- */
-export declare const CSP_DEFAULTS: Record<string, string>;
-/** Parse a {@link RshonoConfig.bodySizeLimit} value into a byte count (`false`/`0` → `0`, disabling the cap). */
-export declare function parseByteSize(value: string | number | false | undefined): number | undefined;
 /**
  * Resolve the user's {@link RshonoConfig} into the {@link ServerConfig} baked into the bundle.
  *

package/dist/server/server-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-config.d.ts","sourceRoot":"","sources":["../../src/server/server-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,KAAK,EAAE,OAAO,CAAC;IACf,oGAAoG;IACpG,UAAU,EAAE,OAAO,CAAC;IACpB,wFAAwF;IACxF,UAAU,EAAE,OAAO,CAAC;IACpB,yGAAyG;IACzG,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gDAAgD;IAChD,WAAW,EAAE,OAAO,CAAC;IACrB,+FAA+F;IAC/F,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;aAC1B,YAAY;aACZ,IAAI,EAAE,IAAI;aACV,IAAI,EAAE,SAAS;CACP,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAY/C,CAAC;AAIF,iHAAiH;AACjH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAS5F;AA0BD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,YAAY,CAarG"}
+{"version":3,"file":"server-config.d.ts","sourceRoot":"","sources":["../../src/server/server-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,KAAK,EAAE,OAAO,CAAC;IACf,oGAAoG;IACpG,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe;aAC1B,IAAI,EAAE,IAAI;aACV,IAAI,EAAE,SAAS;CACP,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,YAAY,CAKrG"}

package/dist/server/server-config.js

@@ -1,72 +1,14 @@
 /**
- * The single source of truth for the framework's built-in defaults.
+ * The framework's built-in defaults.
  *
- * `maxBodyBytes` is resolved here, into the bundle. `port` and `host` are not
- * settings at all: they are read from `PORT` / `HOST` (or `--port`) wherever the address is resolved
- * — `deploy/node/runtime.ts` for a server bundle, `cli/dev.ts` for the dev server — and this is the
- * default both fall back to. A config field for them would have been a fourth precedence level for
- * one number, overridden by the environment on every host that matters.
+ * `port` and `host` are not config fields at all — they come from `PORT` / `HOST` (or `--port`)
+ * wherever the address is resolved, `deploy/node/runtime.ts` for a server bundle and `cli/dev.ts`
+ * for the dev server, and this is what both fall back to.
  */
 export const SERVER_DEFAULTS = {
-    maxBodyBytes: 1024 * 1024, // 1 MiB, matching Next.js's server-action body-size limit.
     port: 3000,
     host: '0.0.0.0',
 };
-/**
- * The built-in {@link RshonoConfig.csp} policy, keyed by directive so
- * {@link RshonoConfig.cspDirectives} can override entries individually.
- *
- * `script-src` carries the per-request nonce, appended at request time (see `entry.rsc.tsx`).
- * `style-src` needs `'unsafe-inline'` because React writes inline styles.
- */
-export const CSP_DEFAULTS = {
-    'default-src': "'self'",
-    'script-src': "'self'",
-    'style-src': "'self' 'unsafe-inline'",
-    'img-src': "'self' data:",
-    'connect-src': "'self'",
-    // Not covered by default-src, and each closes an injection route of its own: a stray <base>
-    // retargeting every relative URL, plugin content, framing (clickjacking), off-site form posts.
-    'base-uri': "'self'",
-    'object-src': "'none'",
-    'frame-ancestors': "'none'",
-    'form-action': "'self'",
-};
-const UNITS = { b: 1, kb: 1024, mb: 1024 ** 2, gb: 1024 ** 3 };
-/** Parse a {@link RshonoConfig.bodySizeLimit} value into a byte count (`false`/`0` → `0`, disabling the cap). */
-export function parseByteSize(value) {
-    if (value === undefined)
-        return undefined;
-    if (value === false)
-        return 0;
-    if (typeof value === 'number')
-        return value;
-    const match = /^\s*(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)?\s*$/i.exec(value);
-    if (!match) {
-        throw new Error(`[rshono] invalid bodySizeLimit ${JSON.stringify(value)} — use e.g. '1mb', 1048576, or false.`);
-    }
-    return Math.floor(Number(match[1]) * UNITS[(match[2] ?? 'b').toLowerCase()]);
-}
-/**
- * Normalize a config `allowedOrigins` entry (full origin or bare host) to a lowercase `URL.host`,
- * ready for a direct comparison against a parsed `Origin` header's host.
- *
- * A bare `host:port` has to be retried against a base, because on its own `'localhost:4000'`
- * parses as the *scheme* `localhost:` with path `4000` — leaving an empty host that would
- * silently never match anything. Throws rather than passing a junk entry through, so a typo
- * fails the build instead of quietly disabling the allowlist entry it was meant to add.
- */
-function normalizeOrigin(entry) {
-    const host = URL.parse(entry)?.host || URL.parse(`http://${entry}`)?.host;
-    if (!host) {
-        throw new Error(`[rshono] invalid allowedOrigins entry ${JSON.stringify(entry)} — use a full origin ('https://admin.example.com') or a bare host ('localhost:4000').`);
-    }
-    return host.toLowerCase();
-}
-/** Drop directives the user blanked out, so `cspDirectives: { 'frame-ancestors': '' }` removes one. */
-function resolveCspDirectives(overrides) {
-    return Object.fromEntries(Object.entries({ ...CSP_DEFAULTS, ...overrides }).filter(([, value]) => value.trim() !== ''));
-}
 /**
  * Resolve the user's {@link RshonoConfig} into the {@link ServerConfig} baked into the bundle.
  *
@@ -78,14 +20,6 @@ export function resolveServerConfig(config, { isDev }) {
     return {
         isDev,
         trustProxy: isDev || (config.trustProxy ?? false),
-        cspEnabled: config.csp ?? false,
-        cspDirectives: resolveCspDirectives(config.cspDirectives),
-        checkOrigin: config.checkOrigin ?? true,
-        allowedOrigins: (config.allowedOrigins ?? [])
-            .map((entry) => entry.trim())
-            .filter(Boolean)
-            .map(normalizeOrigin),
-        maxBodyBytes: parseByteSize(config.bodySizeLimit) ?? SERVER_DEFAULTS.maxBodyBytes,
     };
 }
 //# sourceMappingURL=server-config.js.map

package/dist/server/server-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-config.js","sourceRoot":"","sources":["../../src/server/server-config.ts"],"names":[],"mappings":"AAgCA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,YAAY,EAAE,IAAI,GAAG,IAAI,EAAE,2DAA2D;IACtF,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,SAAS;CACP,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAA2B;IAClD,aAAa,EAAE,QAAQ;IACvB,YAAY,EAAE,QAAQ;IACtB,WAAW,EAAE,wBAAwB;IACrC,SAAS,EAAE,cAAc;IACzB,aAAa,EAAE,QAAQ;IACvB,4FAA4F;IAC5F,+FAA+F;IAC/F,UAAU,EAAE,QAAQ;IACpB,YAAY,EAAE,QAAQ;IACtB,iBAAiB,EAAE,QAAQ;IAC3B,aAAa,EAAE,QAAQ;CACxB,CAAC;AAEF,MAAM,KAAK,GAA2B,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;AAEvF,iHAAiH;AACjH,MAAM,UAAU,aAAa,CAAC,KAA0C;IACtE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAG,0CAA0C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC;IAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,uFAAuF,CACtJ,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED,uGAAuG;AACvG,SAAS,oBAAoB,CAAC,SAA6C;IACzE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,EAAE,KAAK,EAAsB;IACrF,OAAO;QACL,KAAK;QACL,UAAU,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC;QACjD,UAAU,EAAE,MAAM,CAAC,GAAG,IAAI,KAAK;QAC/B,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC;QACzD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;QACvC,cAAc,EAAE,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;aAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,eAAe,CAAC;QACvB,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,eAAe,CAAC,YAAY;KAClF,CAAC;AACJ,CAAC","sourcesContent":["import type { RshonoConfig } from '../config.js';\n\n/**\n * The framework settings the server bundle needs at request time, fully resolved\n * (defaults applied, `bodySizeLimit` parsed to bytes, origins normalized to hosts).\n *\n * The value is produced once by {@link resolveServerConfig} from `rshono.config.ts`\n * and compiled into the server bundle as the `__RSHONO_CONFIG__` literal (see\n * `builder/rspack-config.ts`) — there is no runtime env-var interface for these.\n */\nexport interface ServerConfig {\n  /**\n   * `true` when the bundle came from `rshono dev`.\n   *\n   * Baked in rather than read from `process.env.NODE_ENV` at runtime: it is decided by which command\n   * produced the bundle, and a deploy target need not have a `process` to read it from.\n   */\n  isDev: boolean;\n  /** Honour `X-Forwarded-Host` / `-Proto` when resolving the browser-facing URL. Forced on in dev. */\n  trustProxy: boolean;\n  /** Send a strict per-request-nonce Content-Security-Policy with every HTML document. */\n  cspEnabled: boolean;\n  /** The resolved CSP directives (built-in defaults with the user's merged over them), minus the nonce. */\n  cspDirectives: Record<string, string>;\n  /** CSRF origin check on server-action POSTs. */\n  checkOrigin: boolean;\n  /** Extra origins allowed to post server actions, normalized to lowercase `URL.host` values. */\n  allowedOrigins: string[];\n  /** Max request body in bytes before a 413; `0` disables the cap. */\n  maxBodyBytes: number;\n}\n\n/**\n * The single source of truth for the framework's built-in defaults.\n *\n * `maxBodyBytes` is resolved here, into the bundle. `port` and `host` are not\n * settings at all: they are read from `PORT` / `HOST` (or `--port`) wherever the address is resolved\n * — `deploy/node/runtime.ts` for a server bundle, `cli/dev.ts` for the dev server — and this is the\n * default both fall back to. A config field for them would have been a fourth precedence level for\n * one number, overridden by the environment on every host that matters.\n */\nexport const SERVER_DEFAULTS = {\n  maxBodyBytes: 1024 * 1024, // 1 MiB, matching Next.js's server-action body-size limit.\n  port: 3000,\n  host: '0.0.0.0',\n} as const;\n\n/**\n * The built-in {@link RshonoConfig.csp} policy, keyed by directive so\n * {@link RshonoConfig.cspDirectives} can override entries individually.\n *\n * `script-src` carries the per-request nonce, appended at request time (see `entry.rsc.tsx`).\n * `style-src` needs `'unsafe-inline'` because React writes inline styles.\n */\nexport const CSP_DEFAULTS: Record<string, string> = {\n  'default-src': \"'self'\",\n  'script-src': \"'self'\",\n  'style-src': \"'self' 'unsafe-inline'\",\n  'img-src': \"'self' data:\",\n  'connect-src': \"'self'\",\n  // Not covered by default-src, and each closes an injection route of its own: a stray <base>\n  // retargeting every relative URL, plugin content, framing (clickjacking), off-site form posts.\n  'base-uri': \"'self'\",\n  'object-src': \"'none'\",\n  'frame-ancestors': \"'none'\",\n  'form-action': \"'self'\",\n};\n\nconst UNITS: Record<string, number> = { b: 1, kb: 1024, mb: 1024 ** 2, gb: 1024 ** 3 };\n\n/** Parse a {@link RshonoConfig.bodySizeLimit} value into a byte count (`false`/`0` → `0`, disabling the cap). */\nexport function parseByteSize(value: string | number | false | undefined): number | undefined {\n  if (value === undefined) return undefined;\n  if (value === false) return 0;\n  if (typeof value === 'number') return value;\n  const match = /^\\s*(\\d+(?:\\.\\d+)?)\\s*(b|kb|mb|gb)?\\s*$/i.exec(value);\n  if (!match) {\n    throw new Error(`[rshono] invalid bodySizeLimit ${JSON.stringify(value)} — use e.g. '1mb', 1048576, or false.`);\n  }\n  return Math.floor(Number(match[1]) * UNITS[(match[2] ?? 'b').toLowerCase()]);\n}\n\n/**\n * Normalize a config `allowedOrigins` entry (full origin or bare host) to a lowercase `URL.host`,\n * ready for a direct comparison against a parsed `Origin` header's host.\n *\n * A bare `host:port` has to be retried against a base, because on its own `'localhost:4000'`\n * parses as the *scheme* `localhost:` with path `4000` — leaving an empty host that would\n * silently never match anything. Throws rather than passing a junk entry through, so a typo\n * fails the build instead of quietly disabling the allowlist entry it was meant to add.\n */\nfunction normalizeOrigin(entry: string): string {\n  const host = URL.parse(entry)?.host || URL.parse(`http://${entry}`)?.host;\n  if (!host) {\n    throw new Error(\n      `[rshono] invalid allowedOrigins entry ${JSON.stringify(entry)} — use a full origin ('https://admin.example.com') or a bare host ('localhost:4000').`,\n    );\n  }\n  return host.toLowerCase();\n}\n\n/** Drop directives the user blanked out, so `cspDirectives: { 'frame-ancestors': '' }` removes one. */\nfunction resolveCspDirectives(overrides: Record<string, string> | undefined): Record<string, string> {\n  return Object.fromEntries(Object.entries({ ...CSP_DEFAULTS, ...overrides }).filter(([, value]) => value.trim() !== ''));\n}\n\n/**\n * Resolve the user's {@link RshonoConfig} into the {@link ServerConfig} baked into the bundle.\n *\n * `isDev` is a build-time input rather than a config field because it decides one thing the user\n * shouldn't have to: `trustProxy` is forced on under `rshono dev`, where the framework's own proxy\n * is the only way in (it sets the forwarded headers itself and binds to localhost).\n */\nexport function resolveServerConfig(config: RshonoConfig, { isDev }: { isDev: boolean }): ServerConfig {\n  return {\n    isDev,\n    trustProxy: isDev || (config.trustProxy ?? false),\n    cspEnabled: config.csp ?? false,\n    cspDirectives: resolveCspDirectives(config.cspDirectives),\n    checkOrigin: config.checkOrigin ?? true,\n    allowedOrigins: (config.allowedOrigins ?? [])\n      .map((entry) => entry.trim())\n      .filter(Boolean)\n      .map(normalizeOrigin),\n    maxBodyBytes: parseByteSize(config.bodySizeLimit) ?? SERVER_DEFAULTS.maxBodyBytes,\n  };\n}\n"]}
+{"version":3,"file":"server-config.js","sourceRoot":"","sources":["../../src/server/server-config.ts"],"names":[],"mappings":"AA0BA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,SAAS;CACP,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,EAAE,KAAK,EAAsB;IACrF,OAAO;QACL,KAAK;QACL,UAAU,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC;KAClD,CAAC;AACJ,CAAC","sourcesContent":["import type { RshonoConfig } from '../config.js';\n\n/**\n * The framework settings the server bundle needs at request time, fully resolved.\n *\n * The value is produced once by {@link resolveServerConfig} from `rshono.config.ts`\n * and compiled into the server bundle as the `__RSHONO_CONFIG__` literal (see\n * `builder/rspack-config.ts`) — there is no runtime env-var interface for these.\n *\n * Only two fields, because only two things here are decided by the *build*. The per-request\n * security controls that used to live alongside them — the CSRF check, the CSP, the body cap — are\n * Hono middleware an app registers in `src/server.ts`, where they can be configured per route and\n * per environment instead of once per bundle.\n */\nexport interface ServerConfig {\n  /**\n   * `true` when the bundle came from `rshono dev`.\n   *\n   * Baked in rather than read from `process.env.NODE_ENV` at runtime: it is decided by which command\n   * produced the bundle, and a deploy target need not have a `process` to read it from.\n   */\n  isDev: boolean;\n  /** Honour `X-Forwarded-Host` / `-Proto` when resolving the browser-facing URL. Forced on in dev. */\n  trustProxy: boolean;\n}\n\n/**\n * The framework's built-in defaults.\n *\n * `port` and `host` are not config fields at all — they come from `PORT` / `HOST` (or `--port`)\n * wherever the address is resolved, `deploy/node/runtime.ts` for a server bundle and `cli/dev.ts`\n * for the dev server, and this is what both fall back to.\n */\nexport const SERVER_DEFAULTS = {\n  port: 3000,\n  host: '0.0.0.0',\n} as const;\n\n/**\n * Resolve the user's {@link RshonoConfig} into the {@link ServerConfig} baked into the bundle.\n *\n * `isDev` is a build-time input rather than a config field because it decides one thing the user\n * shouldn't have to: `trustProxy` is forced on under `rshono dev`, where the framework's own proxy\n * is the only way in (it sets the forwarded headers itself and binds to localhost).\n */\nexport function resolveServerConfig(config: RshonoConfig, { isDev }: { isDev: boolean }): ServerConfig {\n  return {\n    isDev,\n    trustProxy: isDev || (config.trustProxy ?? false),\n  };\n}\n"]}

package/dist/server/ssg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssg.d.ts","sourceRoot":"","sources":["../../src/server/ssg.ts"],"names":[],"mappings":"AAGA,OAAO,EAA+B,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAS1B;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAUrE;AA4BD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAyB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CA8B9I;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IACzB,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAcD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA2D/F"}
+{"version":3,"file":"ssg.d.ts","sourceRoot":"","sources":["../../src/server/ssg.ts"],"names":[],"mappings":"AAGA,OAAO,EAA+B,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAS1B;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAUrE;AA4BD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAyB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CA8B9I;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IACzB,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAoBD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA0D/F"}

package/dist/server/ssg.js

@@ -84,14 +84,14 @@ export async function readPrerendered(ssgDir, requestPath, variant = 'html') {
     pageCache.set(key, page);
     return page;
 }
-/** Renders one representation of a path, or `null` if the app didn't answer with it. */
 async function renderVariant(fetch, url, variant) {
     const response = await fetch(new Request(url, { headers: { Accept: VARIANTS[variant].accept } }));
     if (response.status !== 200)
-        return { status: response.status };
-    if (!(response.headers.get('Content-Type') ?? '').includes(VARIANTS[variant].contentType))
-        return null;
-    return { body: await response.text() };
+        return { ok: false, reason: `${response.status}` };
+    if (!(response.headers.get('Content-Type') ?? '').includes(VARIANTS[variant].contentType)) {
+        return { ok: false, reason: `a non-${VARIANTS[variant].contentType} response` };
+    }
+    return { ok: true, body: await response.text() };
 }
 export async function prerenderStaticRoutes(options) {
     const { routes, fetch, ssgDir } = options;
@@ -118,9 +118,8 @@ export async function prerenderStaticRoutes(options) {
         }
         for (const path of paths) {
             const document = await renderVariant(fetch, origin + path, 'html');
-            if (document === null || !('body' in document)) {
-                const rendered = document === null ? 'a non-HTML response' : `${document.status}`;
-                console.warn(`  ⚠ "${path}" rendered ${rendered} at build time — skipping, will SSR per request.`);
+            if (!document.ok) {
+                console.warn(`  ⚠ "${path}" rendered ${document.reason} at build time — skipping, will SSR per request.`);
                 skipped.push(path);
                 continue;
             }
@@ -131,10 +130,10 @@ export async function prerenderStaticRoutes(options) {
             };
             write('html', document.body);
             // The soft-navigation representation of the same page. Best-effort: if it doesn't come back
-            // cleanly the document is still valid on its own, and serving falls back to rendering flight
-            // per request — the behaviour before this was written at all.
+            // cleanly the document is still valid on its own, and serving falls back to rendering the
+            // flight payload per request.
             const flight = await renderVariant(fetch, origin + path, 'flight');
-            if (flight !== null && 'body' in flight) {
+            if (flight.ok) {
                 write('flight', flight.body);
             }
             else {

package/dist/server/ssg.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssg.js","sourceRoot":"","sources":["../../src/server/ssg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,WAAW,EAA8B,MAAM,cAAc,CAAC;AACvE,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,QAAQ,GAGT,MAAM,kBAAkB,CAAC;AAE1B;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,IAAI,CAAC,OAAO;QAAE,OAAO,kBAAkB,CAAC;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,MAA8B;IACtE,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,wDAAwD,CAAC,CAAC;YACxG,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,4DAA4D,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,mCAAmC,IAAI,IAAI,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,gGAAgG;AAChG,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,WAAmB,EAAE,OAAO,GAAqB,MAAM;IAC3G,iGAAiG;IACjG,4FAA4F;IAC5F,iEAAiE;IACjE,MAAM,GAAG,GAAG,GAAG,MAAM,KAAK,OAAO,KAAK,WAAW,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,OAAO,GAAG,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,mGAAmG;IACnG,sDAAsD;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,iGAAiG;IACjG,mGAAmG;IACnG,mGAAmG;IACnG,gDAAgD;IAChD,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC;AACd,CAAC;AAeD,wFAAwF;AACxF,KAAK,UAAU,aAAa,CAC1B,KAAgC,EAChC,GAAW,EACX,OAAyB;IAEzB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAClG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAChE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACvG,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAyB;IACnE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAkB,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CACV,yEAAyE,kBAAkB,yBAAyB;YAClH,uGAAuG,CAC1G,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,IAAI,yDAAyD,CAAC,CAAC;gBACvG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3F,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;YACnE,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,EAAE,CAAC;gBAC/C,MAAM,QAAQ,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAClF,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,cAAc,QAAQ,kDAAkD,CAAC,CAAC;gBACnG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,CAAC,OAAyB,EAAE,IAAY,EAAE,EAAE;gBACxD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,CAAE,CAAC,CAAC;gBACvD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5B,CAAC,CAAC;YACF,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YAE7B,4FAA4F;YAC5F,6FAA6F;YAC7F,8DAA8D;YAC9D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,CAAC,CAAC;YACnE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;gBACxC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,gFAAgF,CAAC,CAAC;YAC7G,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC","sourcesContent":["import { mkdirSync, writeFileSync } from 'node:fs';\nimport { readFile } from 'node:fs/promises';\nimport { dirname, join, resolve, sep } from 'node:path';\nimport { isPageRoute, type PageRoute, type Route } from '../router.js';\nimport {\n  createPageCache,\n  prerenderedRelPath,\n  ssgFilePath,\n  toPrerenderedPage,\n  VARIANTS,\n  type PrerenderedPage,\n  type PrerenderVariant,\n} from './prerendered.js';\n\n/**\n * Stand-in origin for a build that didn't declare {@link RshonoConfig.siteUrl}. Deliberately\n * obviously-wrong rather than a guess: a page that bakes this into a canonical tag should be easy\n * to spot, and the build warns when static routes are prerendered without a real origin.\n */\nconst DEFAULT_SSG_ORIGIN = 'http://localhost';\n\n/**\n * Resolve {@link RshonoConfig.siteUrl} to the origin prerendering should render against.\n *\n * A path is rejected rather than dropped: `'https://example.com/docs'` almost certainly means the\n * author expects a base path, and silently serving from the root would be a confusing way to find\n * out that isn't supported.\n */\nexport function resolveSiteOrigin(siteUrl: string | undefined): string {\n  if (!siteUrl) return DEFAULT_SSG_ORIGIN;\n  const parsed = URL.parse(siteUrl);\n  if (!parsed || (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')) {\n    throw new Error(`[rshono] invalid siteUrl ${JSON.stringify(siteUrl)} — use a full origin, e.g. 'https://example.com'.`);\n  }\n  if (parsed.pathname !== '/' || parsed.search || parsed.hash) {\n    throw new Error(`[rshono] siteUrl ${JSON.stringify(siteUrl)} must be a bare origin — a base path is not supported.`);\n  }\n  return parsed.origin;\n}\n\nfunction interpolatePath(pattern: string, params: Record<string, string>): string {\n  return pattern\n    .split('/')\n    .map((segment) => {\n      if (!segment.startsWith(':')) {\n        if (segment.includes('*')) {\n          throw new Error(`Cannot prerender \"${pattern}\": wildcard segments are not supported by staticPaths.`);\n        }\n        return segment;\n      }\n      const name = segment.slice(1);\n      if (!/^\\w+$/.test(name)) {\n        throw new Error(`Cannot prerender \"${pattern}\": optional/regex params are not supported by staticPaths.`);\n      }\n      const value = params[name];\n      if (value === undefined) {\n        throw new Error(`staticPaths for \"${pattern}\" returned a param set without \"${name}\".`);\n      }\n      return encodeURIComponent(value);\n    })\n    .join('/');\n}\n\n/** Prerendered pages, keyed by the request that produced them (see {@link readPrerendered}). */\nconst pageCache = createPageCache();\n\nexport async function readPrerendered(ssgDir: string, requestPath: string, variant: PrerenderVariant = 'html'): Promise<PrerenderedPage | null> {\n  // Keyed by what the request carried, not by the resolved filename, so a hit costs one Map lookup\n  // instead of re-deriving the path every time. Safe because only *hits* are cached: an entry\n  // exists only if this exact key already passed the checks below.\n  const key = `${ssgDir}\\0${variant}\\0${requestPath}`;\n  const cached = pageCache.get(key);\n  if (cached) return cached;\n\n  const relPath = prerenderedRelPath(requestPath, variant);\n  if (relPath === null) return null;\n  // Belt and braces: the shared guard already refused a traversal, and this proves the resolved file\n  // is under the root whatever else the path contained.\n  const root = resolve(ssgDir);\n  const file = resolve(root, relPath);\n  if (!file.startsWith(root + sep)) return null;\n\n  // No encoding argument: the bytes are what gets served, and decoding them to a string here would\n  // only mean re-encoding them on every request that hits the cache. Copied out of the Buffer rather\n  // than kept as one, because `readFile` can hand back a view into Node's shared allocation pool and\n  // this is retained for the life of the process.\n  let body: Uint8Array<ArrayBuffer>;\n  try {\n    body = new Uint8Array(await readFile(file));\n  } catch {\n    return null;\n  }\n\n  const page = await toPrerenderedPage(body);\n  pageCache.set(key, page);\n  return page;\n}\n\ninterface PrerenderOptions {\n  routes: readonly Route[];\n  fetch: (request: Request) => Response | Promise<Response>;\n  ssgDir: string;\n  /** {@link RshonoConfig.siteUrl} — the origin absolute URLs in the output are built against. */\n  siteUrl?: string;\n}\n\nexport interface PrerenderResult {\n  written: string[];\n  skipped: string[];\n}\n\n/** Renders one representation of a path, or `null` if the app didn't answer with it. */\nasync function renderVariant(\n  fetch: PrerenderOptions['fetch'],\n  url: string,\n  variant: PrerenderVariant,\n): Promise<{ body: string } | { status: number } | null> {\n  const response = await fetch(new Request(url, { headers: { Accept: VARIANTS[variant].accept } }));\n  if (response.status !== 200) return { status: response.status };\n  if (!(response.headers.get('Content-Type') ?? '').includes(VARIANTS[variant].contentType)) return null;\n  return { body: await response.text() };\n}\n\nexport async function prerenderStaticRoutes(options: PrerenderOptions): Promise<PrerenderResult> {\n  const { routes, fetch, ssgDir } = options;\n  const staticRoutes = routes.filter((r): r is PageRoute => isPageRoute(r) && r.render === 'static');\n  const origin = resolveSiteOrigin(options.siteUrl);\n\n  if (staticRoutes.length > 0 && !options.siteUrl) {\n    console.warn(\n      `  ⚠ No siteUrl in rshono.config — prerendered pages are built against ${DEFAULT_SSG_ORIGIN}, so any absolute URL\\n` +\n        `    they derive from a page's \\`url\\` prop (canonical tags, og:url, absolute links) will point there.`,\n    );\n  }\n\n  const written: string[] = [];\n  const skipped: string[] = [];\n\n  for (const route of staticRoutes) {\n    let paths: string[];\n    if (!/[:*]/.test(route.path)) {\n      paths = [route.path];\n    } else {\n      if (!route.staticPaths) {\n        console.warn(`  ⚠ Static route \"${route.path}\" has params but no staticPaths — will SSR per request.`);\n        skipped.push(route.path);\n        continue;\n      }\n      paths = (await route.staticPaths()).map((params) => interpolatePath(route.path, params));\n    }\n\n    for (const path of paths) {\n      const document = await renderVariant(fetch, origin + path, 'html');\n      if (document === null || !('body' in document)) {\n        const rendered = document === null ? 'a non-HTML response' : `${document.status}`;\n        console.warn(`  ⚠ \"${path}\" rendered ${rendered} at build time — skipping, will SSR per request.`);\n        skipped.push(path);\n        continue;\n      }\n\n      const write = (variant: PrerenderVariant, body: string) => {\n        const file = join(ssgDir, ssgFilePath(path, variant)!);\n        mkdirSync(dirname(file), { recursive: true });\n        writeFileSync(file, body);\n      };\n      write('html', document.body);\n\n      // The soft-navigation representation of the same page. Best-effort: if it doesn't come back\n      // cleanly the document is still valid on its own, and serving falls back to rendering flight\n      // per request — the behaviour before this was written at all.\n      const flight = await renderVariant(fetch, origin + path, 'flight');\n      if (flight !== null && 'body' in flight) {\n        write('flight', flight.body);\n      } else {\n        console.warn(`  ⚠ \"${path}\" produced no flight payload — soft navigations to it will render per request.`);\n      }\n\n      written.push(path);\n    }\n  }\n\n  return { written, skipped };\n}\n"]}
+{"version":3,"file":"ssg.js","sourceRoot":"","sources":["../../src/server/ssg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,WAAW,EAA8B,MAAM,cAAc,CAAC;AACvE,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,QAAQ,GAGT,MAAM,kBAAkB,CAAC;AAE1B;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,IAAI,CAAC,OAAO;QAAE,OAAO,kBAAkB,CAAC;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,MAA8B;IACtE,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,wDAAwD,CAAC,CAAC;YACxG,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,4DAA4D,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,mCAAmC,IAAI,IAAI,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,gGAAgG;AAChG,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,WAAmB,EAAE,OAAO,GAAqB,MAAM;IAC3G,iGAAiG;IACjG,4FAA4F;IAC5F,iEAAiE;IACjE,MAAM,GAAG,GAAG,GAAG,MAAM,KAAK,OAAO,KAAK,WAAW,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,OAAO,GAAG,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,mGAAmG;IACnG,sDAAsD;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,iGAAiG;IACjG,mGAAmG;IACnG,mGAAmG;IACnG,gDAAgD;IAChD,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC;AACd,CAAC;AAwBD,KAAK,UAAU,aAAa,CAAC,KAAgC,EAAE,GAAW,EAAE,OAAyB;IACnG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAClG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAChF,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,WAAW,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAyB;IACnE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAkB,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CACV,yEAAyE,kBAAkB,yBAAyB;YAClH,uGAAuG,CAC1G,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,IAAI,yDAAyD,CAAC,CAAC;gBACvG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3F,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;YACnE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,cAAc,QAAQ,CAAC,MAAM,kDAAkD,CAAC,CAAC;gBAC1G,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,CAAC,OAAyB,EAAE,IAAY,EAAE,EAAE;gBACxD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,CAAE,CAAC,CAAC;gBACvD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5B,CAAC,CAAC;YACF,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YAE7B,4FAA4F;YAC5F,0FAA0F;YAC1F,8BAA8B;YAC9B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,CAAC,CAAC;YACnE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,gFAAgF,CAAC,CAAC;YAC7G,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC","sourcesContent":["import { mkdirSync, writeFileSync } from 'node:fs';\nimport { readFile } from 'node:fs/promises';\nimport { dirname, join, resolve, sep } from 'node:path';\nimport { isPageRoute, type PageRoute, type Route } from '../router.js';\nimport {\n  createPageCache,\n  prerenderedRelPath,\n  ssgFilePath,\n  toPrerenderedPage,\n  VARIANTS,\n  type PrerenderedPage,\n  type PrerenderVariant,\n} from './prerendered.js';\n\n/**\n * Stand-in origin for a build that didn't declare {@link RshonoConfig.siteUrl}. Deliberately\n * obviously-wrong rather than a guess: a page that bakes this into a canonical tag should be easy\n * to spot, and the build warns when static routes are prerendered without a real origin.\n */\nconst DEFAULT_SSG_ORIGIN = 'http://localhost';\n\n/**\n * Resolve {@link RshonoConfig.siteUrl} to the origin prerendering should render against.\n *\n * A path is rejected rather than dropped: `'https://example.com/docs'` almost certainly means the\n * author expects a base path, and silently serving from the root would be a confusing way to find\n * out that isn't supported.\n */\nexport function resolveSiteOrigin(siteUrl: string | undefined): string {\n  if (!siteUrl) return DEFAULT_SSG_ORIGIN;\n  const parsed = URL.parse(siteUrl);\n  if (!parsed || (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')) {\n    throw new Error(`[rshono] invalid siteUrl ${JSON.stringify(siteUrl)} — use a full origin, e.g. 'https://example.com'.`);\n  }\n  if (parsed.pathname !== '/' || parsed.search || parsed.hash) {\n    throw new Error(`[rshono] siteUrl ${JSON.stringify(siteUrl)} must be a bare origin — a base path is not supported.`);\n  }\n  return parsed.origin;\n}\n\nfunction interpolatePath(pattern: string, params: Record<string, string>): string {\n  return pattern\n    .split('/')\n    .map((segment) => {\n      if (!segment.startsWith(':')) {\n        if (segment.includes('*')) {\n          throw new Error(`Cannot prerender \"${pattern}\": wildcard segments are not supported by staticPaths.`);\n        }\n        return segment;\n      }\n      const name = segment.slice(1);\n      if (!/^\\w+$/.test(name)) {\n        throw new Error(`Cannot prerender \"${pattern}\": optional/regex params are not supported by staticPaths.`);\n      }\n      const value = params[name];\n      if (value === undefined) {\n        throw new Error(`staticPaths for \"${pattern}\" returned a param set without \"${name}\".`);\n      }\n      return encodeURIComponent(value);\n    })\n    .join('/');\n}\n\n/** Prerendered pages, keyed by the request that produced them (see {@link readPrerendered}). */\nconst pageCache = createPageCache();\n\nexport async function readPrerendered(ssgDir: string, requestPath: string, variant: PrerenderVariant = 'html'): Promise<PrerenderedPage | null> {\n  // Keyed by what the request carried, not by the resolved filename, so a hit costs one Map lookup\n  // instead of re-deriving the path every time. Safe because only *hits* are cached: an entry\n  // exists only if this exact key already passed the checks below.\n  const key = `${ssgDir}\\0${variant}\\0${requestPath}`;\n  const cached = pageCache.get(key);\n  if (cached) return cached;\n\n  const relPath = prerenderedRelPath(requestPath, variant);\n  if (relPath === null) return null;\n  // Belt and braces: the shared guard already refused a traversal, and this proves the resolved file\n  // is under the root whatever else the path contained.\n  const root = resolve(ssgDir);\n  const file = resolve(root, relPath);\n  if (!file.startsWith(root + sep)) return null;\n\n  // No encoding argument: the bytes are what gets served, and decoding them to a string here would\n  // only mean re-encoding them on every request that hits the cache. Copied out of the Buffer rather\n  // than kept as one, because `readFile` can hand back a view into Node's shared allocation pool and\n  // this is retained for the life of the process.\n  let body: Uint8Array<ArrayBuffer>;\n  try {\n    body = new Uint8Array(await readFile(file));\n  } catch {\n    return null;\n  }\n\n  const page = await toPrerenderedPage(body);\n  pageCache.set(key, page);\n  return page;\n}\n\ninterface PrerenderOptions {\n  routes: readonly Route[];\n  fetch: (request: Request) => Response | Promise<Response>;\n  ssgDir: string;\n  /** {@link RshonoConfig.siteUrl} — the origin absolute URLs in the output are built against. */\n  siteUrl?: string;\n}\n\nexport interface PrerenderResult {\n  written: string[];\n  skipped: string[];\n}\n\n/**\n * One representation of a path, as the app answered for it at build time.\n *\n * Discriminated on `ok` rather than returned as a body-or-status-or-null union: both callers have to\n * tell \"the app rendered this\" from \"it did not\", and only one of them cares *why* — which as three\n * shapes made every read a `'body' in result` check against a value that could also be null.\n */\ntype RenderedVariant = { ok: true; body: string } | { ok: false; reason: string };\n\nasync function renderVariant(fetch: PrerenderOptions['fetch'], url: string, variant: PrerenderVariant): Promise<RenderedVariant> {\n  const response = await fetch(new Request(url, { headers: { Accept: VARIANTS[variant].accept } }));\n  if (response.status !== 200) return { ok: false, reason: `${response.status}` };\n  if (!(response.headers.get('Content-Type') ?? '').includes(VARIANTS[variant].contentType)) {\n    return { ok: false, reason: `a non-${VARIANTS[variant].contentType} response` };\n  }\n  return { ok: true, body: await response.text() };\n}\n\nexport async function prerenderStaticRoutes(options: PrerenderOptions): Promise<PrerenderResult> {\n  const { routes, fetch, ssgDir } = options;\n  const staticRoutes = routes.filter((r): r is PageRoute => isPageRoute(r) && r.render === 'static');\n  const origin = resolveSiteOrigin(options.siteUrl);\n\n  if (staticRoutes.length > 0 && !options.siteUrl) {\n    console.warn(\n      `  ⚠ No siteUrl in rshono.config — prerendered pages are built against ${DEFAULT_SSG_ORIGIN}, so any absolute URL\\n` +\n        `    they derive from a page's \\`url\\` prop (canonical tags, og:url, absolute links) will point there.`,\n    );\n  }\n\n  const written: string[] = [];\n  const skipped: string[] = [];\n\n  for (const route of staticRoutes) {\n    let paths: string[];\n    if (!/[:*]/.test(route.path)) {\n      paths = [route.path];\n    } else {\n      if (!route.staticPaths) {\n        console.warn(`  ⚠ Static route \"${route.path}\" has params but no staticPaths — will SSR per request.`);\n        skipped.push(route.path);\n        continue;\n      }\n      paths = (await route.staticPaths()).map((params) => interpolatePath(route.path, params));\n    }\n\n    for (const path of paths) {\n      const document = await renderVariant(fetch, origin + path, 'html');\n      if (!document.ok) {\n        console.warn(`  ⚠ \"${path}\" rendered ${document.reason} at build time — skipping, will SSR per request.`);\n        skipped.push(path);\n        continue;\n      }\n\n      const write = (variant: PrerenderVariant, body: string) => {\n        const file = join(ssgDir, ssgFilePath(path, variant)!);\n        mkdirSync(dirname(file), { recursive: true });\n        writeFileSync(file, body);\n      };\n      write('html', document.body);\n\n      // The soft-navigation representation of the same page. Best-effort: if it doesn't come back\n      // cleanly the document is still valid on its own, and serving falls back to rendering the\n      // flight payload per request.\n      const flight = await renderVariant(fetch, origin + path, 'flight');\n      if (flight.ok) {\n        write('flight', flight.body);\n      } else {\n        console.warn(`  ⚠ \"${path}\" produced no flight payload — soft navigations to it will render per request.`);\n      }\n\n      written.push(path);\n    }\n  }\n\n  return { written, skipped };\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rshono/core",
-  "version": "1.0.0-rc.6",
+  "version": "1.0.0-rc.8",
   "description": "Minimalist web framework — Hono + Rspack + React Server Components",
   "author": "Lasse <lasse@lassetange.com> (https://www.lassetange.com)",
   "license": "ISC",