@rshono/core 1.0.0-rc.7 → 1.0.0-rc.8

package/README.md

@@ -177,24 +177,49 @@ export default defineConfig({
   deploy: 'node', // hosting platform to build for (--deploy or RSHONO_DEPLOY override)
   siteUrl: 'https://example.com', // public origin, baked into prerendered pages' absolute URLs
   trustProxy: false, // honour X-Forwarded-Host/-Proto — only behind a proxy you control
-  checkOrigin: true, // CSRF origin check on server-action POSTs
-  allowedOrigins: [], // extra origins allowed to post actions, e.g. ['https://admin.example.com']
-  csp: false, // strict per-request-nonce Content-Security-Policy
-  cspDirectives: {}, // widen the built-in CSP, e.g. { 'img-src': "'self' https://cdn.example.com" }
-  bodySizeLimit: '1mb', // request body cap: '512kb' | 4_000_000 | false to disable
   rspack(config, { isServer, isDev }) {
     return config; // escape hatch: mutate the generated Rspack config
   },
 });
 ```
 
-`deploy` and `rspack` are consumed by the CLI; the rest are **compiled into the server bundle** at build
-time, so changing one means a rebuild and there is no parallel env-var interface for them (environment
+That is the whole file. It holds what the **build** decides; per-request security is Hono middleware in
+`src/server.ts`, which is mounted ahead of the page routes and so wraps renders and server actions too:
+
+```ts
+// src/server.ts
+import { publicUrl } from '@rshono/core/server';
+import { bodyLimit } from 'hono/body-limit'; // https://hono.dev/docs/middleware/builtin/body-limit
+import { csrf } from 'hono/csrf'; // https://hono.dev/docs/middleware/builtin/csrf
+import { NONCE, secureHeaders } from 'hono/secure-headers'; // https://hono.dev/docs/middleware/builtin/secure-headers
+
+// Caps a body before anything buffers it — pages, actions and your own handlers alike. 413 over cap.
+server.use(bodyLimit({ maxSize: 1024 * 1024 }));
+
+// Rejects a cross-origin POST with 403 before it can reach a server action. `publicUrl(c)` rather
+// than Hono's default, which compares against the address the server was *reached* on — the internal
+// one behind any proxy. It honours `trustProxy`.
+server.use(csrf({ origin: (origin, c) => origin === publicUrl(c).origin }));
+
+// HSTS, COOP, CORP and the rest. `NONCE` in `scriptSrc` makes the CSP per-request: Hono mints the
+// nonce, rshono stamps it onto the bootstrap scripts and the inlined flight payload.
+server.use(secureHeaders({ contentSecurityPolicy: { scriptSrc: ["'self'", NONCE] } }));
+```
+
+`create-rshono` scaffolds the first two. Under `rshono dev` the framework widens `script-src` with
+`'unsafe-eval'` for React Refresh — never in a build — so one policy serves both, and a route with a
+nonce in play falls back to rendering per request. Everything else Hono ships works the same way:
+`cors`, `basicAuth`, `jwt`, `timeout`, `requestId`, `ipRestriction`. A middleware that rejects by
+throwing an `HTTPException` keeps its own status rather than becoming the 500 page.
+[Middleware docs](https://www.rshono.com/docs/hono#security-middleware) · [Hono](https://hono.dev/docs).
+
+`deploy` and `rspack` are consumed by the CLI; `trustProxy` is **compiled into the server bundle** at build
+time, so changing it means a rebuild and there is no parallel env-var interface for it (environment
 variables are for secrets). The port and bind address are deliberately not config fields — on every host
 that runs this, the environment is what sets them. [Configuration docs](https://www.rshono.com/docs/configuration).
 
-The defaults those fields describe, in short: CSRF-checked action POSTs, untrusted proxy headers, a 1 MiB
-body cap on **every** route, `nosniff` / `Referrer-Policy` / `X-Frame-Options` on every response,
+The defaults, in short: untrusted proxy headers, `nosniff` / `Referrer-Policy` / `X-Frame-Options` on
+every response (a floor your own `secureHeaders()` overrides),
 `private, no-cache` plus `Vary: Accept` on dynamic pages, `public, max-age=300` and a weak `ETag` on
 prerendered ones, and errors redacted in production — with one `onServerError()` funnel for reporting them
 and three fallbacks (a fatal client overlay, a visible 500 document, a reported bootstrap failure) so a
@@ -261,8 +286,9 @@ Every target streams, which is the bar a new one has to clear.
   loads in plain Node.
 - **production e2e** — builds `apps/testbed`, boots the real production server, and asserts pages, the flight
   protocol, actions (client and no-JS), CSRF rejection, secret stripping in bundles _and_ rendered HTML, SSG
-  output with `ETag`/304, cache and security headers, and error reporting. Settings baked into the bundle
-  (CSP, CSRF, body cap) each get their own build from a fixture config.
+  output with `ETag`/304, cache and security headers, and error reporting. The hardened permutations — a
+  nonce CSP, a CSRF allowlist, a small body cap — are middleware, so they run against that same build
+  under a different environment; `trustProxy` is baked in and gets a fixture config.
 - **the other deploy targets** — the `cloudflare` bundle driven as `fetch(request, env, ctx)` against a
   stand-in `ASSETS` binding, a real build per serverless target checked against the handoff its platform
   expects, and `rshono start`'s refusal to run a build made for another one.

package/dist/builder/page-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"page-files.d.ts","sourceRoot":"","sources":["../../src/builder/page-files.ts"],"names":[],"mappings":"AAsBA,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAqBzF"}
+{"version":3,"file":"page-files.d.ts","sourceRoot":"","sources":["../../src/builder/page-files.ts"],"names":[],"mappings":"AA0BA,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAqBzF"}

package/dist/builder/page-files.js

@@ -1,10 +1,14 @@
+/**
+ * Finds the page modules named by inline `component: () => import('…')` thunks in `routes.ts`, so the
+ * server compiler can put `page-entry-loader.cjs` in front of exactly those files and inject their
+ * `'use server-entry'` directive. A page wired up any other way declares the directive itself.
+ */
 import { readFileSync, statSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 const COMPONENT_THUNK = /component:\s*(?:async\s*)?\(\s*\)\s*=>\s*import\(\s*(['"])([^'"]+)\1\s*\)/g;
 const EXTENSIONS = ['.tsx', '.ts', '.jsx', '.js'];
-// The index candidates go through `join` rather than `base + '/index…'`: these paths end up in a Set
-// that rspack compares against its own resource paths, and a hardcoded `/` resolves fine on Windows
-// while storing a path no rspack resource will ever equal.
+// Index candidates go through `join` rather than `base + '/index…'`: these paths are compared against
+// Rspack's own resource paths, and a hardcoded `/` stores one no Windows resource will ever equal.
 function resolveCandidates(base) {
     return [...EXTENSIONS.map((ext) => base + ext), ...EXTENSIONS.map((ext) => join(base, `index${ext}`)), base];
 }

package/dist/builder/page-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"page-files.js","sourceRoot":"","sources":["../../src/builder/page-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,MAAM,eAAe,GAAG,4EAA4E,CAAC;AAErG,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAElD,qGAAqG;AACrG,oGAAoG;AACpG,2DAA2D;AAC3D,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,MAAc,EAAE,IAAiB;IACjF,IAAI,CAAC,KAAK,EAAE,CAAC;IACb,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAwB,CAAC;QAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;aAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACpB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { readFileSync, statSync } from 'node:fs';\nimport { dirname, join, resolve } from 'node:path';\n\nconst COMPONENT_THUNK = /component:\\s*(?:async\\s*)?\\(\\s*\\)\\s*=>\\s*import\\(\\s*(['\"])([^'\"]+)\\1\\s*\\)/g;\n\nconst EXTENSIONS = ['.tsx', '.ts', '.jsx', '.js'];\n\n// The index candidates go through `join` rather than `base + '/index…'`: these paths end up in a Set\n// that rspack compares against its own resource paths, and a hardcoded `/` resolves fine on Windows\n// while storing a path no rspack resource will ever equal.\nfunction resolveCandidates(base: string): string[] {\n  return [...EXTENSIONS.map((ext) => base + ext), ...EXTENSIONS.map((ext) => join(base, `index${ext}`)), base];\n}\n\nfunction isFile(path: string): boolean {\n  try {\n    return statSync(path).isFile();\n  } catch {\n    return false;\n  }\n}\n\nexport function scanPageFiles(routesFile: string, srcDir: string, into: Set<string>): void {\n  into.clear();\n  let source: string;\n  try {\n    source = readFileSync(routesFile, 'utf8');\n  } catch {\n    return;\n  }\n  for (const match of source.matchAll(COMPONENT_THUNK)) {\n    const spec = match[2];\n    let base: string | undefined;\n    if (spec.startsWith('.')) base = resolve(dirname(routesFile), spec);\n    else if (spec.startsWith('@/')) base = resolve(srcDir, spec.slice(2));\n    if (!base) continue;\n    for (const candidate of resolveCandidates(base)) {\n      if (isFile(candidate)) {\n        into.add(candidate);\n        break;\n      }\n    }\n  }\n}\n"]}
+{"version":3,"file":"page-files.js","sourceRoot":"","sources":["../../src/builder/page-files.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,MAAM,eAAe,GAAG,4EAA4E,CAAC;AAErG,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAElD,sGAAsG;AACtG,mGAAmG;AACnG,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,MAAc,EAAE,IAAiB;IACjF,IAAI,CAAC,KAAK,EAAE,CAAC;IACb,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAwB,CAAC;QAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;aAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACpB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * Finds the page modules named by inline `component: () => import('…')` thunks in `routes.ts`, so the\n * server compiler can put `page-entry-loader.cjs` in front of exactly those files and inject their\n * `'use server-entry'` directive. A page wired up any other way declares the directive itself.\n */\nimport { readFileSync, statSync } from 'node:fs';\nimport { dirname, join, resolve } from 'node:path';\n\nconst COMPONENT_THUNK = /component:\\s*(?:async\\s*)?\\(\\s*\\)\\s*=>\\s*import\\(\\s*(['\"])([^'\"]+)\\1\\s*\\)/g;\n\nconst EXTENSIONS = ['.tsx', '.ts', '.jsx', '.js'];\n\n// Index candidates go through `join` rather than `base + '/index…'`: these paths are compared against\n// Rspack's own resource paths, and a hardcoded `/` stores one no Windows resource will ever equal.\nfunction resolveCandidates(base: string): string[] {\n  return [...EXTENSIONS.map((ext) => base + ext), ...EXTENSIONS.map((ext) => join(base, `index${ext}`)), base];\n}\n\nfunction isFile(path: string): boolean {\n  try {\n    return statSync(path).isFile();\n  } catch {\n    return false;\n  }\n}\n\nexport function scanPageFiles(routesFile: string, srcDir: string, into: Set<string>): void {\n  into.clear();\n  let source: string;\n  try {\n    source = readFileSync(routesFile, 'utf8');\n  } catch {\n    return;\n  }\n  for (const match of source.matchAll(COMPONENT_THUNK)) {\n    const spec = match[2];\n    let base: string | undefined;\n    if (spec.startsWith('.')) base = resolve(dirname(routesFile), spec);\n    else if (spec.startsWith('@/')) base = resolve(srcDir, spec.slice(2));\n    if (!base) continue;\n    for (const candidate of resolveCandidates(base)) {\n      if (isFile(candidate)) {\n        into.add(candidate);\n        break;\n      }\n    }\n  }\n}\n"]}

package/dist/builder/public-env.d.ts

@@ -1,2 +1,8 @@
+/**
+ * The `process.env` view compiled into the browser bundle: `NODE_ENV` plus the `PUBLIC_`-prefixed
+ * variables. Everything else stays server-only — a stray read of it in client code becomes
+ * `undefined` rather than shipping the value. Also what `env-shadow-loader.cjs` shadows SSR-layer
+ * modules with, so the server renders the same thing the browser hydrates.
+ */
 export declare function publicEnv(isDev: boolean): Record<string, string>;
 //# sourceMappingURL=public-env.d.ts.map

package/dist/builder/public-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-env.d.ts","sourceRoot":"","sources":["../../src/builder/public-env.ts"],"names":[],"mappings":"AAAA,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGhE"}
+{"version":3,"file":"public-env.d.ts","sourceRoot":"","sources":["../../src/builder/public-env.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGhE"}

package/dist/builder/public-env.js

@@ -1,3 +1,9 @@
+/**
+ * The `process.env` view compiled into the browser bundle: `NODE_ENV` plus the `PUBLIC_`-prefixed
+ * variables. Everything else stays server-only — a stray read of it in client code becomes
+ * `undefined` rather than shipping the value. Also what `env-shadow-loader.cjs` shadows SSR-layer
+ * modules with, so the server renders the same thing the browser hydrates.
+ */
 export function publicEnv(isDev) {
     const entries = Object.entries(process.env).filter((entry) => entry[0].startsWith('PUBLIC_') && entry[1] !== undefined);
     return { NODE_ENV: isDev ? 'development' : 'production', ...Object.fromEntries(entries) };

package/dist/builder/public-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"public-env.js","sourceRoot":"","sources":["../../src/builder/public-env.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACnJ,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAC5F,CAAC","sourcesContent":["export function publicEnv(isDev: boolean): Record<string, string> {\n  const entries = Object.entries(process.env).filter((entry): entry is [string, string] => entry[0].startsWith('PUBLIC_') && entry[1] !== undefined);\n  return { NODE_ENV: isDev ? 'development' : 'production', ...Object.fromEntries(entries) };\n}\n"]}
+{"version":3,"file":"public-env.js","sourceRoot":"","sources":["../../src/builder/public-env.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACnJ,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAC5F,CAAC","sourcesContent":["/**\n * The `process.env` view compiled into the browser bundle: `NODE_ENV` plus the `PUBLIC_`-prefixed\n * variables. Everything else stays server-only — a stray read of it in client code becomes\n * `undefined` rather than shipping the value. Also what `env-shadow-loader.cjs` shadows SSR-layer\n * modules with, so the server renders the same thing the browser hydrates.\n */\nexport function publicEnv(isDev: boolean): Record<string, string> {\n  const entries = Object.entries(process.env).filter((entry): entry is [string, string] => entry[0].startsWith('PUBLIC_') && entry[1] !== undefined);\n  return { NODE_ENV: isDev ? 'development' : 'production', ...Object.fromEntries(entries) };\n}\n"]}

package/dist/builder/rspack-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rspack-config.d.ts","sourceRoot":"","sources":["../../src/builder/rspack-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,aAAa,EAAoB,MAAM,cAAc,CAAC;AAK3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AA4FzD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,2IAA2I;IAC3I,MAAM,EAAE,YAAY,CAAC;IACrB,4GAA4G;IAC5G,MAAM,EAAE,YAAY,CAAC;IACrB,wBAAwB,CAAC,EAAE,MAAM,IAAI,CAAC;CACvC;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,mBAAmB,GAAG,CAAC,aAAa,EAAE,aAAa,CAAC,CA6M1F"}
+{"version":3,"file":"rspack-config.d.ts","sourceRoot":"","sources":["../../src/builder/rspack-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,aAAa,EAAoB,MAAM,cAAc,CAAC;AAK3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AA0FzD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,2IAA2I;IAC3I,MAAM,EAAE,YAAY,CAAC;IACrB,4GAA4G;IAC5G,MAAM,EAAE,YAAY,CAAC;IACrB,wBAAwB,CAAC,EAAE,MAAM,IAAI,CAAC;CACvC;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,mBAAmB,GAAG,CAAC,aAAa,EAAE,aAAa,CAAC,CA4M1F"}

package/dist/builder/rspack-config.js

@@ -31,15 +31,15 @@ function enclosingNodeModules(file) {
 /**
  * Where packages are resolved from: the app's own `node_modules`, then the framework's.
  *
- * The second part is what makes {@link INJECTED_PACKAGES} resolvable from app source. npm, yarn and bun
- * hoist the framework's dependencies to the app's own `node_modules`, so they need nothing; pnpm gives
- * `@rshono/core` a private directory and installs its dependencies as *siblings* of the framework
- * rather than inside it, and nothing under the app's tree can see them — the build fails with
- * `Can't resolve 'react-server-dom-rspack/client'` in a file the user never wrote that import into.
+ * The second part is what makes {@link INJECTED_PACKAGES} resolvable from app source. npm, yarn and
+ * bun hoist the framework's dependencies into the app's own `node_modules`; pnpm installs them as
+ * *siblings* of `@rshono/core` where nothing under the app's tree can see them, and the build then
+ * fails with `Can't resolve 'react-server-dom-rspack/client'` in a file the user never wrote that
+ * import into.
  *
  * Asking Node where the framework itself resolves the package finds the directory in any layout, and
- * making it a search path rather than an alias keeps the package's own `exports` conditions in play —
- * the RSC layer, the SSR layer and each deploy target need a different build of it.
+ * a search path rather than an alias keeps the package's own `exports` conditions in play — the RSC
+ * layer, the SSR layer and each deploy target need a different build of it.
  */
 function resolveModules() {
     const require = createRequire(import.meta.url);
@@ -64,10 +64,9 @@ function resolveModules() {
  *
  * Rspack's RSC plugins ask for their client and server-entry proxies by *absolute path*, which on
  * Windows means a drive letter (`D:\app\src\home.tsx`) instead of a leading slash. Externalizing one
- * of those emits `import("D:\\app\\src\\home.tsx")`, and Node rejects that with
- * `ERR_UNSUPPORTED_ESM_URL_SCHEME` ("Received protocol 'd:'") — a build that works everywhere else
- * fails on Windows only. `win32.isAbsolute` also accepts the POSIX form, so it is used on every
- * platform: one code path, and the Windows shapes stay testable off Windows.
+ * of those emits `import("D:\\app\\src\\home.tsx")`, which Node rejects with
+ * `ERR_UNSUPPORTED_ESM_URL_SCHEME`. `win32.isAbsolute` also accepts the POSIX form, so it is used on
+ * every platform — one code path, and the Windows shapes stay testable off Windows.
  */
 function isPathRequest(request) {
     return request.startsWith('.') || win32.isAbsolute(request);
@@ -77,13 +76,12 @@ const NODE_TARGETS = ['node >= 22'];
 /**
  * Rspack's native CSS pipeline, which both compilers get.
  *
- * It parses *finished* CSS, so a stylesheet needing a PostCSS plugin — Tailwind, most obviously — adds
- * the loader through the {@link RshonoConfig.rspack} hook, along with the two packages a PostCSS pass
- * takes. The framework stays out of it: `postcss` is a dependency an app that wants one can have, rather
- * than one every app pays for. The Styling section of the README has the four lines involved.
+ * It parses *finished* CSS, so a stylesheet needing a PostCSS plugin — Tailwind, most obviously —
+ * adds the loader through the {@link RshonoConfig.rspack} hook, along with the packages a PostCSS
+ * pass takes. `postcss` is then a dependency of the apps that want one rather than of every app.
  *
- * A fresh object per compiler, not one shared between them — the hook is handed each config in turn, and
- * an app that reaches in to change this rule should not find it has changed the other bundle's too.
+ * A fresh object per compiler, so an app that reaches in to change this rule does not find it has
+ * changed the other bundle's too.
  */
 function cssRule() {
     return { test: /\.css$/i, type: 'css/auto' };
@@ -263,8 +261,7 @@ export function createConfigs(options) {
         plugins: [
             pageScanPlugin,
             new ServerPlugin({ onServerComponentChanges }),
-            // Bake the framework settings from rshono.config.ts into the bundle (read as __RSHONO_CONFIG__
-            // in entry.rsc.tsx) — the server-side counterpart to the client's publicEnv injection.
+            // Bakes rshono.config.ts into the bundle, read back as `__RSHONO_CONFIG__` at request time.
             new rspack.DefinePlugin({ __RSHONO_CONFIG__: JSON.stringify(resolveServerConfig(config, { isDev })) }),
         ],
         performance: false,

package/dist/builder/rspack-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"rspack-config.js","sourceRoot":"","sources":["../../src/builder/rspack-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAuD,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAG3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,kGAAkG;AAClG,kGAAkG;AAClG,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACvD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AAElD,MAAM,gBAAgB,GAAG,wFAAwF,CAAC;AAElH;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAEtD,+GAA+G;AAC/G,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QACrC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,cAAc;IACrB,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACxD,IAAI,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;QAChF,CAAC;IACH,CAAC;IACD,qGAAqG;IACrG,8BAA8B;IAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACjF,MAAM,YAAY,GAAG,CAAC,YAAY,CAAC,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,SAAS,OAAO;IACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC/C,CAAC;AAYD,MAAM,UAAU,aAAa,CAAC,OAA4B;IACxD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,GAAG,OAAO,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;IAElD,MAAM,UAAU,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,iCAAiC,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/F,MAAM,cAAc,GAAG,aAAa,IAAI,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAE/F,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,CAAC,OAAiB,EAAe,EAAE,CAAC,CAAC;QACnD,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,mBAAmB;QAC5B,GAAG,EAAE;YACH,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE;gBACP,YAAY,EAAE,MAAM;gBACpB,GAAG,EAAE;oBACH,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;oBAClE,YAAY,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE;iBAC7C;gBACD,GAAG,EAAE,EAAE,OAAO,EAAE;gBAChB,iBAAiB,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE;aACnD;SACF;QACD,IAAI,EAAE,iBAAiB;KACxB,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG;QAClB,UAAU,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;QACnD,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;QACjD,OAAO,EAAE,cAAc,EAAE;KAC1B,CAAC;IAEF,mGAAmG;IACnG,mGAAmG;IACnG,+FAA+F;IAC/F,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACzD,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,cAAc,EAAE,CAAC,GAAG,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IACzI,MAAM,iBAAiB,GAAG,CAAC,cAAc,EAAE,GAAG,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAExE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;IAC9E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC;IAE1C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,cAAc,GAAG;QACrB,KAAK,CAAC,QAAkB;YACtB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACnE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;YAC1D,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC;KACF,CAAC;IAEF,MAAM,YAAY,GAAkB;QAClC,IAAI,EAAE,QAAQ;QACd,IAAI;QACJ,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK;QACrC,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;QAC5B,MAAM,EAAE;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;YACrC,UAAU,EAAE,WAAW;YACvB,KAAK,EAAE,CAAC,KAAK;YACb,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,8BAA8B;YACnE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gCAAgC;YAC5E,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iCAAiC;YAC5E,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iCAAiC;YACjF,mBAAmB,EAAE,2BAA2B;SACjD;QACD,YAAY,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;SACtC;QACD,OAAO,EAAE;YACP,GAAG,WAAW;YACd,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;SACvB;QACD,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,sDAAsD,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;SAC9H;QACD,OAAO,EAAE;YACP,IAAI,YAAY,EAAE;YAClB,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,0BAA0B,EAAE,EAAE,IAAI,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F;QACD,WAAW,EAAE,KAAK;KACnB,CAAC;IAEF,MAAM,YAAY,GAAkB;QAClC,IAAI,EAAE,QAAQ;QACd,IAAI;QACJ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK;QACrC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,MAAM,EAAE;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;YACrC,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,QAAQ;YACtB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,mBAAmB;YAClC,UAAU,EAAE,WAAW;YACvB,mBAAmB,EAAE,2BAA2B;SACjD;QACD,YAAY,EAAE;YACZ,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;SAC/B;QACD,aAAa,EAAE,eAAe;QAC9B,SAAS,EAAE;YACT,CAAC,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE;gBACxB,IACE,CAAC,OAAO;oBACR,aAAa,CAAC,OAAO,CAAC;oBACtB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;oBACxB,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;oBAC9B,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;oBAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;oBACrB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAC9B,CAAC;oBACD,OAAO,QAAQ,EAAE,CAAC;gBACpB,CAAC;gBACD,QAAQ,CAAC,SAAS,EAAE,iBAAiB,OAAO,EAAE,CAAC,CAAC;YAClD,CAAC;SACF;QACD,OAAO,EAAE;YACP,GAAG,iBAAiB;YACpB,KAAK,EAAE;gBACL,iBAAiB,EAAE,UAAU;gBAC7B,qBAAqB,EAAE,cAAc;gBACrC,2FAA2F;gBAC3F,wEAAwE;gBACxE,iBAAiB,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC3E,GAAG,EAAE,MAAM;aACZ;SACF;QACD,MAAM,EAAE;YACN,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;oBACnD,OAAO,EAAE,KAAK;oBACd,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,uBAAuB,CAAC,EAAE,CAAC;iBAC5E;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,MAAM;oBACf,OAAO,EAAE,KAAK;oBACd,GAAG,EAAE;wBACH;4BACE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,uBAAuB,CAAC;4BAChE,OAAO,EAAE,EAAE,OAAO,EAAE,0BAA0B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE;yBAC1G;qBACF;iBACF;gBACD,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,YAAY,CAAC,CAAC,CAAC;gBACpD,OAAO,EAAE;gBACT;oBACE,IAAI,EAAE,sDAAsD;oBAC5D,IAAI,EAAE,OAAO;oBACb,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;iBAC3B;gBACD,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE;gBACzC;oBACE,QAAQ,EAAE,QAAQ;oBAClB,KAAK,EAAE,MAAM,CAAC,GAAG;oBACjB,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE;iBAC/C;gBACD;oBACE,WAAW,EAAE,MAAM,CAAC,GAAG;oBACvB,OAAO,EAAE,QAAQ;oBACjB,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE;iBAC/C;aACF;SACF;QACD,OAAO,EAAE;YACP,cAAc;YACd,IAAI,YAAY,CAAC,EAAE,wBAAwB,EAAE,CAAC;YAC9C,+FAA+F;YAC/F,uFAAuF;YACvF,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;SACvG;QACD,WAAW,EAAE,KAAK;KACnB,CAAC;IAEF,6FAA6F;IAC7F,kBAAkB;IAClB,MAAM,CAAC,eAAe,EAAE,CAAC,YAAY,CAAC,CAAC;IAEvC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACjC,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,UAAU,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,IAAI,YAAY;YACpE,UAAU,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,YAAY;SACpE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AACtC,CAAC","sourcesContent":["import { rspack, type Compiler, type RspackOptions, type RuleSetRule } from '@rspack/core';\nimport { ReactRefreshRspackPlugin } from '@rspack/plugin-react-refresh';\nimport { existsSync } from 'node:fs';\nimport { createRequire } from 'node:module';\nimport { basename, dirname, join, win32 } from 'node:path';\nimport type { RshonoConfig } from '../config.js';\nimport type { DeployPreset } from '../deploy/presets.js';\nimport { resolveServerConfig } from '../server/server-config.js';\nimport { scanPageFiles } from './page-files.js';\nimport { publicEnv } from './public-env.js';\n\n// The framework's own compiled output (this file lives in `dist/builder/`), which is what the two\n// compilers consume: the entries and loaders below are the *built* framework, not its TypeScript.\nconst FRAMEWORK_DIST = join(import.meta.dirname, '..');\nconst FRAMEWORK_ROOT = join(FRAMEWORK_DIST, '..');\n\nconst BUNDLED_PACKAGES = /^(@rshono\\/core|react|react-dom|react-server-dom-rspack|hono|@hono\\/node-server)(\\/|$)/;\n\n/**\n * Packages that end up imported *by app source* without the app ever mentioning them: the RSC\n * transform rewrites a `'use client'` module, a page or a server action into imports of the RSC\n * runtime, and those requests resolve from the app's own `src/`.\n */\nconst INJECTED_PACKAGES = ['react-server-dom-rspack'];\n\n/** The `node_modules` directory a resolved file sits in — `…/node_modules/pkg/index.js` → `…/node_modules`. */\nfunction enclosingNodeModules(file: string): string | undefined {\n  let dir = dirname(file);\n  while (basename(dir) !== 'node_modules') {\n    const parent = dirname(dir);\n    if (parent === dir) return undefined;\n    dir = parent;\n  }\n  return dir;\n}\n\n/**\n * Where packages are resolved from: the app's own `node_modules`, then the framework's.\n *\n * The second part is what makes {@link INJECTED_PACKAGES} resolvable from app source. npm, yarn and bun\n * hoist the framework's dependencies to the app's own `node_modules`, so they need nothing; pnpm gives\n * `@rshono/core` a private directory and installs its dependencies as *siblings* of the framework\n * rather than inside it, and nothing under the app's tree can see them — the build fails with\n * `Can't resolve 'react-server-dom-rspack/client'` in a file the user never wrote that import into.\n *\n * Asking Node where the framework itself resolves the package finds the directory in any layout, and\n * making it a search path rather than an alias keeps the package's own `exports` conditions in play —\n * the RSC layer, the SSR layer and each deploy target need a different build of it.\n */\nfunction resolveModules(): string[] {\n  const require = createRequire(import.meta.url);\n  const dirs = new Set<string>();\n  for (const name of INJECTED_PACKAGES) {\n    try {\n      const dir = enclosingNodeModules(require.resolve(name));\n      if (dir) dirs.add(dir);\n    } catch {\n      // Left to the resolver to report against the request that actually needed it.\n    }\n  }\n  // A checkout or a vendored copy, where the framework has real dependencies of its own and the lookup\n  // above found nothing to add.\n  dirs.add(join(FRAMEWORK_ROOT, 'node_modules'));\n  return ['node_modules', ...dirs];\n}\n\n/**\n * Whether a request names a file rather than a package, and so belongs in the bundle.\n *\n * Rspack's RSC plugins ask for their client and server-entry proxies by *absolute path*, which on\n * Windows means a drive letter (`D:\\app\\src\\home.tsx`) instead of a leading slash. Externalizing one\n * of those emits `import(\"D:\\\\app\\\\src\\\\home.tsx\")`, and Node rejects that with\n * `ERR_UNSUPPORTED_ESM_URL_SCHEME` (\"Received protocol 'd:'\") — a build that works everywhere else\n * fails on Windows only. `win32.isAbsolute` also accepts the POSIX form, so it is used on every\n * platform: one code path, and the Windows shapes stay testable off Windows.\n */\nfunction isPathRequest(request: string): boolean {\n  return request.startsWith('.') || win32.isAbsolute(request);\n}\n\nconst BROWSER_TARGETS = ['last 2 versions', '> 0.2%', 'not dead', 'Firefox ESR'];\nconst NODE_TARGETS = ['node >= 22'];\n\n/**\n * Rspack's native CSS pipeline, which both compilers get.\n *\n * It parses *finished* CSS, so a stylesheet needing a PostCSS plugin — Tailwind, most obviously — adds\n * the loader through the {@link RshonoConfig.rspack} hook, along with the two packages a PostCSS pass\n * takes. The framework stays out of it: `postcss` is a dependency an app that wants one can have, rather\n * than one every app pays for. The Styling section of the README has the four lines involved.\n *\n * A fresh object per compiler, not one shared between them — the hook is handed each config in turn, and\n * an app that reaches in to change this rule should not find it has changed the other bundle's too.\n */\nfunction cssRule(): RuleSetRule {\n  return { test: /\\.css$/i, type: 'css/auto' };\n}\n\nexport interface RspackConfigOptions {\n  rootDir: string;\n  isDev: boolean;\n  /** The project's resolved config — supplies the {@link RshonoConfig.rspack} hook and the runtime settings baked into the server bundle. */\n  config: RshonoConfig;\n  /** The platform being built for: decides the `@rshono/deploy` runtime and any server-compiler overrides. */\n  preset: DeployPreset;\n  onServerComponentChanges?: () => void;\n}\n\nexport function createConfigs(options: RspackConfigOptions): [RspackOptions, RspackOptions] {\n  const { rootDir, isDev, config, preset, onServerComponentChanges } = options;\n  const srcDir = join(rootDir, 'src');\n  const mode = isDev ? 'development' : 'production';\n\n  const routesFile = ['routes.ts', 'routes.tsx'].map((f) => join(srcDir, f)).find(existsSync);\n  if (!routesFile) {\n    throw new Error(`[rshono] src/routes.ts not found in ${rootDir} — it is the one required file.`);\n  }\n  const serverAppFile = ['server.ts', 'server.tsx'].map((f) => join(srcDir, f)).find(existsSync);\n  const serverAppAlias = serverAppFile ?? join(FRAMEWORK_DIST, 'runtime', 'empty-server-app.js');\n\n  const rscEntry = join(FRAMEWORK_DIST, 'runtime', 'entry.rsc.js');\n  const ssrEntry = join(FRAMEWORK_DIST, 'runtime', 'entry.ssr.js');\n  const clientEntry = join(FRAMEWORK_DIST, 'runtime', 'entry.client.js');\n\n  const swcRule = (targets: string[]): RuleSetRule => ({\n    test: /\\.[cm]?[jt]sx?$/,\n    exclude: /[\\\\/]core-js[\\\\/]/,\n    use: {\n      loader: 'builtin:swc-loader',\n      options: {\n        detectSyntax: 'auto',\n        jsc: {\n          transform: { react: { runtime: 'automatic', development: isDev } },\n          experimental: { keepImportAttributes: true },\n        },\n        env: { targets },\n        rspackExperiments: { reactServerComponents: true },\n      },\n    },\n    type: 'javascript/auto',\n  });\n\n  const resolveBase = {\n    extensions: ['.tsx', '.ts', '.jsx', '.js', '.json'],\n    extensionAlias: { '.js': ['.ts', '.tsx', '.js'] },\n    modules: resolveModules(),\n  };\n\n  // The platform's own resolve conditions, ahead of whatever the Rspack target implies ('...'). This\n  // is what hands the server bundle the right build of React and the RSC runtime, both of which ship\n  // one per runtime. Left unset for Node, where the target already implies the `node` condition.\n  const runtimeConditions = preset.resolveConditions ?? [];\n  const serverResolveBase = runtimeConditions.length > 0 ? { ...resolveBase, conditionNames: [...runtimeConditions, '...'] } : resolveBase;\n  const rscConditionNames = ['react-server', ...runtimeConditions, '...'];\n\n  const { ServerPlugin, ClientPlugin } = rspack.experiments.rsc.createPlugins();\n  const { Layers } = rspack.experiments.rsc;\n\n  const pageFiles = new Set<string>();\n  scanPageFiles(routesFile, srcDir, pageFiles);\n  const pageScanPlugin = {\n    apply(compiler: Compiler) {\n      const refresh = () => scanPageFiles(routesFile, srcDir, pageFiles);\n      compiler.hooks.beforeRun.tap('rshono/page-scan', refresh);\n      compiler.hooks.watchRun.tap('rshono/page-scan', refresh);\n    },\n  };\n\n  const clientConfig: RspackOptions = {\n    name: 'client',\n    mode,\n    target: 'web',\n    context: rootDir,\n    devtool: isDev ? 'source-map' : false,\n    entry: { main: clientEntry },\n    output: {\n      path: join(rootDir, 'dist', 'static'),\n      publicPath: '/_static/',\n      clean: !isDev,\n      filename: isDev ? 'chunks/main.js' : 'chunks/main.[contenthash].js',\n      chunkFilename: isDev ? 'chunks/[name].js' : 'chunks/[name].[contenthash].js',\n      cssFilename: isDev ? 'chunks/[name].css' : 'chunks/[name].[contenthash].css',\n      cssChunkFilename: isDev ? 'chunks/[name].css' : 'chunks/[name].[contenthash].css',\n      assetModuleFilename: 'assets/[name].[hash][ext]',\n    },\n    optimization: {\n      moduleIds: isDev ? 'named' : 'hashed',\n    },\n    resolve: {\n      ...resolveBase,\n      alias: { '@': srcDir },\n    },\n    module: {\n      rules: [swcRule(BROWSER_TARGETS), cssRule(), { test: /\\.(png|jpe?g|gif|webp|avif|ico|svg|woff2?|ttf|otf)$/i, type: 'asset' }],\n    },\n    plugins: [\n      new ClientPlugin(),\n      new rspack.DefinePlugin({ 'process.env': JSON.stringify(publicEnv(isDev)) }),\n      ...(isDev ? [new rspack.HotModuleReplacementPlugin(), new ReactRefreshRspackPlugin()] : []),\n    ],\n    performance: false,\n  };\n\n  const serverConfig: RspackOptions = {\n    name: 'server',\n    mode,\n    target: 'node',\n    context: rootDir,\n    devtool: isDev ? 'source-map' : false,\n    entry: { main: rscEntry },\n    output: {\n      path: join(rootDir, 'dist', 'server'),\n      clean: true,\n      module: true,\n      chunkFormat: 'module',\n      chunkLoading: 'import',\n      library: { type: 'module' },\n      filename: 'main.mjs',\n      chunkFilename: 'chunks/[name].mjs',\n      publicPath: '/_static/',\n      assetModuleFilename: 'assets/[name].[hash][ext]',\n    },\n    optimization: {\n      minimize: isDev ? false : true,\n    },\n    externalsType: 'module-import',\n    externals: [\n      ({ request }, callback) => {\n        if (\n          !request ||\n          isPathRequest(request) ||\n          request.startsWith('@/') ||\n          request.startsWith('@rshono/') ||\n          request.startsWith('builtin:') ||\n          request.includes('!') ||\n          BUNDLED_PACKAGES.test(request)\n        ) {\n          return callback();\n        }\n        callback(undefined, `module-import ${request}`);\n      },\n    ],\n    resolve: {\n      ...serverResolveBase,\n      alias: {\n        '@rshono/routes$': routesFile,\n        '@rshono/server-app$': serverAppAlias,\n        // The one import that decides which platform the server bundle is for. Split on '/' so the\n        // preset can declare a POSIX-looking path and still resolve on Windows.\n        '@rshono/deploy$': join(FRAMEWORK_DIST, ...preset.runtimeModule.split('/')),\n        '@': srcDir,\n      },\n    },\n    module: {\n      rules: [\n        {\n          test: (resource: string) => pageFiles.has(resource),\n          enforce: 'pre',\n          use: [{ loader: join(FRAMEWORK_DIST, 'builder', 'page-entry-loader.cjs') }],\n        },\n        {\n          test: /\\.[cm]?[tj]sx?$/,\n          include: srcDir,\n          enforce: 'pre',\n          use: [\n            {\n              loader: join(FRAMEWORK_DIST, 'builder', 'env-shadow-loader.cjs'),\n              options: { prelude: `const process = { env: ${JSON.stringify(publicEnv(isDev))} }; `, layer: Layers.ssr },\n            },\n          ],\n        },\n        swcRule([...(preset.syntaxTargets ?? NODE_TARGETS)]),\n        cssRule(),\n        {\n          test: /\\.(png|jpe?g|gif|webp|avif|ico|svg|woff2?|ttf|otf)$/i,\n          type: 'asset',\n          generator: { emit: false },\n        },\n        { resource: ssrEntry, layer: Layers.ssr },\n        {\n          resource: rscEntry,\n          layer: Layers.rsc,\n          resolve: { conditionNames: rscConditionNames },\n        },\n        {\n          issuerLayer: Layers.rsc,\n          exclude: ssrEntry,\n          resolve: { conditionNames: rscConditionNames },\n        },\n      ],\n    },\n    plugins: [\n      pageScanPlugin,\n      new ServerPlugin({ onServerComponentChanges }),\n      // Bake the framework settings from rshono.config.ts into the bundle (read as __RSHONO_CONFIG__\n      // in entry.rsc.tsx) — the server-side counterpart to the client's publicEnv injection.\n      new rspack.DefinePlugin({ __RSHONO_CONFIG__: JSON.stringify(resolveServerConfig(config, { isDev })) }),\n    ],\n    performance: false,\n  };\n\n  // The platform's own overrides, then the user's hook — so an app can still adjust whatever a\n  // preset decided.\n  preset.configureServer?.(serverConfig);\n\n  const rspackHook = config.rspack;\n  if (rspackHook) {\n    return [\n      rspackHook(clientConfig, { isServer: false, isDev }) ?? clientConfig,\n      rspackHook(serverConfig, { isServer: true, isDev }) ?? serverConfig,\n    ];\n  }\n  return [clientConfig, serverConfig];\n}\n"]}
+{"version":3,"file":"rspack-config.js","sourceRoot":"","sources":["../../src/builder/rspack-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAuD,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAG3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,kGAAkG;AAClG,kGAAkG;AAClG,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACvD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AAElD,MAAM,gBAAgB,GAAG,wFAAwF,CAAC;AAElH;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAEtD,+GAA+G;AAC/G,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QACrC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,cAAc;IACrB,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACxD,IAAI,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;QAChF,CAAC;IACH,CAAC;IACD,qGAAqG;IACrG,8BAA8B;IAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACjF,MAAM,YAAY,GAAG,CAAC,YAAY,CAAC,CAAC;AAEpC;;;;;;;;;GASG;AACH,SAAS,OAAO;IACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC/C,CAAC;AAYD,MAAM,UAAU,aAAa,CAAC,OAA4B;IACxD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,GAAG,OAAO,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;IAElD,MAAM,UAAU,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,iCAAiC,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/F,MAAM,cAAc,GAAG,aAAa,IAAI,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAE/F,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,CAAC,OAAiB,EAAe,EAAE,CAAC,CAAC;QACnD,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,mBAAmB;QAC5B,GAAG,EAAE;YACH,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE;gBACP,YAAY,EAAE,MAAM;gBACpB,GAAG,EAAE;oBACH,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;oBAClE,YAAY,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE;iBAC7C;gBACD,GAAG,EAAE,EAAE,OAAO,EAAE;gBAChB,iBAAiB,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE;aACnD;SACF;QACD,IAAI,EAAE,iBAAiB;KACxB,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG;QAClB,UAAU,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;QACnD,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;QACjD,OAAO,EAAE,cAAc,EAAE;KAC1B,CAAC;IAEF,mGAAmG;IACnG,mGAAmG;IACnG,+FAA+F;IAC/F,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACzD,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,cAAc,EAAE,CAAC,GAAG,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IACzI,MAAM,iBAAiB,GAAG,CAAC,cAAc,EAAE,GAAG,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAExE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;IAC9E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC;IAE1C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,cAAc,GAAG;QACrB,KAAK,CAAC,QAAkB;YACtB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACnE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;YAC1D,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC;KACF,CAAC;IAEF,MAAM,YAAY,GAAkB;QAClC,IAAI,EAAE,QAAQ;QACd,IAAI;QACJ,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK;QACrC,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;QAC5B,MAAM,EAAE;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;YACrC,UAAU,EAAE,WAAW;YACvB,KAAK,EAAE,CAAC,KAAK;YACb,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,8BAA8B;YACnE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gCAAgC;YAC5E,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iCAAiC;YAC5E,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iCAAiC;YACjF,mBAAmB,EAAE,2BAA2B;SACjD;QACD,YAAY,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;SACtC;QACD,OAAO,EAAE;YACP,GAAG,WAAW;YACd,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;SACvB;QACD,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,sDAAsD,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;SAC9H;QACD,OAAO,EAAE;YACP,IAAI,YAAY,EAAE;YAClB,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,0BAA0B,EAAE,EAAE,IAAI,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F;QACD,WAAW,EAAE,KAAK;KACnB,CAAC;IAEF,MAAM,YAAY,GAAkB;QAClC,IAAI,EAAE,QAAQ;QACd,IAAI;QACJ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK;QACrC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,MAAM,EAAE;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;YACrC,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,QAAQ;YACtB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,mBAAmB;YAClC,UAAU,EAAE,WAAW;YACvB,mBAAmB,EAAE,2BAA2B;SACjD;QACD,YAAY,EAAE;YACZ,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;SAC/B;QACD,aAAa,EAAE,eAAe;QAC9B,SAAS,EAAE;YACT,CAAC,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE;gBACxB,IACE,CAAC,OAAO;oBACR,aAAa,CAAC,OAAO,CAAC;oBACtB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;oBACxB,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;oBAC9B,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;oBAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;oBACrB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAC9B,CAAC;oBACD,OAAO,QAAQ,EAAE,CAAC;gBACpB,CAAC;gBACD,QAAQ,CAAC,SAAS,EAAE,iBAAiB,OAAO,EAAE,CAAC,CAAC;YAClD,CAAC;SACF;QACD,OAAO,EAAE;YACP,GAAG,iBAAiB;YACpB,KAAK,EAAE;gBACL,iBAAiB,EAAE,UAAU;gBAC7B,qBAAqB,EAAE,cAAc;gBACrC,2FAA2F;gBAC3F,wEAAwE;gBACxE,iBAAiB,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC3E,GAAG,EAAE,MAAM;aACZ;SACF;QACD,MAAM,EAAE;YACN,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;oBACnD,OAAO,EAAE,KAAK;oBACd,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,uBAAuB,CAAC,EAAE,CAAC;iBAC5E;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,MAAM;oBACf,OAAO,EAAE,KAAK;oBACd,GAAG,EAAE;wBACH;4BACE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,uBAAuB,CAAC;4BAChE,OAAO,EAAE,EAAE,OAAO,EAAE,0BAA0B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE;yBAC1G;qBACF;iBACF;gBACD,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,YAAY,CAAC,CAAC,CAAC;gBACpD,OAAO,EAAE;gBACT;oBACE,IAAI,EAAE,sDAAsD;oBAC5D,IAAI,EAAE,OAAO;oBACb,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;iBAC3B;gBACD,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE;gBACzC;oBACE,QAAQ,EAAE,QAAQ;oBAClB,KAAK,EAAE,MAAM,CAAC,GAAG;oBACjB,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE;iBAC/C;gBACD;oBACE,WAAW,EAAE,MAAM,CAAC,GAAG;oBACvB,OAAO,EAAE,QAAQ;oBACjB,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE;iBAC/C;aACF;SACF;QACD,OAAO,EAAE;YACP,cAAc;YACd,IAAI,YAAY,CAAC,EAAE,wBAAwB,EAAE,CAAC;YAC9C,4FAA4F;YAC5F,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;SACvG;QACD,WAAW,EAAE,KAAK;KACnB,CAAC;IAEF,6FAA6F;IAC7F,kBAAkB;IAClB,MAAM,CAAC,eAAe,EAAE,CAAC,YAAY,CAAC,CAAC;IAEvC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACjC,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,UAAU,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,IAAI,YAAY;YACpE,UAAU,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,YAAY;SACpE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AACtC,CAAC","sourcesContent":["import { rspack, type Compiler, type RspackOptions, type RuleSetRule } from '@rspack/core';\nimport { ReactRefreshRspackPlugin } from '@rspack/plugin-react-refresh';\nimport { existsSync } from 'node:fs';\nimport { createRequire } from 'node:module';\nimport { basename, dirname, join, win32 } from 'node:path';\nimport type { RshonoConfig } from '../config.js';\nimport type { DeployPreset } from '../deploy/presets.js';\nimport { resolveServerConfig } from '../server/server-config.js';\nimport { scanPageFiles } from './page-files.js';\nimport { publicEnv } from './public-env.js';\n\n// The framework's own compiled output (this file lives in `dist/builder/`), which is what the two\n// compilers consume: the entries and loaders below are the *built* framework, not its TypeScript.\nconst FRAMEWORK_DIST = join(import.meta.dirname, '..');\nconst FRAMEWORK_ROOT = join(FRAMEWORK_DIST, '..');\n\nconst BUNDLED_PACKAGES = /^(@rshono\\/core|react|react-dom|react-server-dom-rspack|hono|@hono\\/node-server)(\\/|$)/;\n\n/**\n * Packages that end up imported *by app source* without the app ever mentioning them: the RSC\n * transform rewrites a `'use client'` module, a page or a server action into imports of the RSC\n * runtime, and those requests resolve from the app's own `src/`.\n */\nconst INJECTED_PACKAGES = ['react-server-dom-rspack'];\n\n/** The `node_modules` directory a resolved file sits in — `…/node_modules/pkg/index.js` → `…/node_modules`. */\nfunction enclosingNodeModules(file: string): string | undefined {\n  let dir = dirname(file);\n  while (basename(dir) !== 'node_modules') {\n    const parent = dirname(dir);\n    if (parent === dir) return undefined;\n    dir = parent;\n  }\n  return dir;\n}\n\n/**\n * Where packages are resolved from: the app's own `node_modules`, then the framework's.\n *\n * The second part is what makes {@link INJECTED_PACKAGES} resolvable from app source. npm, yarn and\n * bun hoist the framework's dependencies into the app's own `node_modules`; pnpm installs them as\n * *siblings* of `@rshono/core` where nothing under the app's tree can see them, and the build then\n * fails with `Can't resolve 'react-server-dom-rspack/client'` in a file the user never wrote that\n * import into.\n *\n * Asking Node where the framework itself resolves the package finds the directory in any layout, and\n * a search path rather than an alias keeps the package's own `exports` conditions in play — the RSC\n * layer, the SSR layer and each deploy target need a different build of it.\n */\nfunction resolveModules(): string[] {\n  const require = createRequire(import.meta.url);\n  const dirs = new Set<string>();\n  for (const name of INJECTED_PACKAGES) {\n    try {\n      const dir = enclosingNodeModules(require.resolve(name));\n      if (dir) dirs.add(dir);\n    } catch {\n      // Left to the resolver to report against the request that actually needed it.\n    }\n  }\n  // A checkout or a vendored copy, where the framework has real dependencies of its own and the lookup\n  // above found nothing to add.\n  dirs.add(join(FRAMEWORK_ROOT, 'node_modules'));\n  return ['node_modules', ...dirs];\n}\n\n/**\n * Whether a request names a file rather than a package, and so belongs in the bundle.\n *\n * Rspack's RSC plugins ask for their client and server-entry proxies by *absolute path*, which on\n * Windows means a drive letter (`D:\\app\\src\\home.tsx`) instead of a leading slash. Externalizing one\n * of those emits `import(\"D:\\\\app\\\\src\\\\home.tsx\")`, which Node rejects with\n * `ERR_UNSUPPORTED_ESM_URL_SCHEME`. `win32.isAbsolute` also accepts the POSIX form, so it is used on\n * every platform — one code path, and the Windows shapes stay testable off Windows.\n */\nfunction isPathRequest(request: string): boolean {\n  return request.startsWith('.') || win32.isAbsolute(request);\n}\n\nconst BROWSER_TARGETS = ['last 2 versions', '> 0.2%', 'not dead', 'Firefox ESR'];\nconst NODE_TARGETS = ['node >= 22'];\n\n/**\n * Rspack's native CSS pipeline, which both compilers get.\n *\n * It parses *finished* CSS, so a stylesheet needing a PostCSS plugin — Tailwind, most obviously —\n * adds the loader through the {@link RshonoConfig.rspack} hook, along with the packages a PostCSS\n * pass takes. `postcss` is then a dependency of the apps that want one rather than of every app.\n *\n * A fresh object per compiler, so an app that reaches in to change this rule does not find it has\n * changed the other bundle's too.\n */\nfunction cssRule(): RuleSetRule {\n  return { test: /\\.css$/i, type: 'css/auto' };\n}\n\nexport interface RspackConfigOptions {\n  rootDir: string;\n  isDev: boolean;\n  /** The project's resolved config — supplies the {@link RshonoConfig.rspack} hook and the runtime settings baked into the server bundle. */\n  config: RshonoConfig;\n  /** The platform being built for: decides the `@rshono/deploy` runtime and any server-compiler overrides. */\n  preset: DeployPreset;\n  onServerComponentChanges?: () => void;\n}\n\nexport function createConfigs(options: RspackConfigOptions): [RspackOptions, RspackOptions] {\n  const { rootDir, isDev, config, preset, onServerComponentChanges } = options;\n  const srcDir = join(rootDir, 'src');\n  const mode = isDev ? 'development' : 'production';\n\n  const routesFile = ['routes.ts', 'routes.tsx'].map((f) => join(srcDir, f)).find(existsSync);\n  if (!routesFile) {\n    throw new Error(`[rshono] src/routes.ts not found in ${rootDir} — it is the one required file.`);\n  }\n  const serverAppFile = ['server.ts', 'server.tsx'].map((f) => join(srcDir, f)).find(existsSync);\n  const serverAppAlias = serverAppFile ?? join(FRAMEWORK_DIST, 'runtime', 'empty-server-app.js');\n\n  const rscEntry = join(FRAMEWORK_DIST, 'runtime', 'entry.rsc.js');\n  const ssrEntry = join(FRAMEWORK_DIST, 'runtime', 'entry.ssr.js');\n  const clientEntry = join(FRAMEWORK_DIST, 'runtime', 'entry.client.js');\n\n  const swcRule = (targets: string[]): RuleSetRule => ({\n    test: /\\.[cm]?[jt]sx?$/,\n    exclude: /[\\\\/]core-js[\\\\/]/,\n    use: {\n      loader: 'builtin:swc-loader',\n      options: {\n        detectSyntax: 'auto',\n        jsc: {\n          transform: { react: { runtime: 'automatic', development: isDev } },\n          experimental: { keepImportAttributes: true },\n        },\n        env: { targets },\n        rspackExperiments: { reactServerComponents: true },\n      },\n    },\n    type: 'javascript/auto',\n  });\n\n  const resolveBase = {\n    extensions: ['.tsx', '.ts', '.jsx', '.js', '.json'],\n    extensionAlias: { '.js': ['.ts', '.tsx', '.js'] },\n    modules: resolveModules(),\n  };\n\n  // The platform's own resolve conditions, ahead of whatever the Rspack target implies ('...'). This\n  // is what hands the server bundle the right build of React and the RSC runtime, both of which ship\n  // one per runtime. Left unset for Node, where the target already implies the `node` condition.\n  const runtimeConditions = preset.resolveConditions ?? [];\n  const serverResolveBase = runtimeConditions.length > 0 ? { ...resolveBase, conditionNames: [...runtimeConditions, '...'] } : resolveBase;\n  const rscConditionNames = ['react-server', ...runtimeConditions, '...'];\n\n  const { ServerPlugin, ClientPlugin } = rspack.experiments.rsc.createPlugins();\n  const { Layers } = rspack.experiments.rsc;\n\n  const pageFiles = new Set<string>();\n  scanPageFiles(routesFile, srcDir, pageFiles);\n  const pageScanPlugin = {\n    apply(compiler: Compiler) {\n      const refresh = () => scanPageFiles(routesFile, srcDir, pageFiles);\n      compiler.hooks.beforeRun.tap('rshono/page-scan', refresh);\n      compiler.hooks.watchRun.tap('rshono/page-scan', refresh);\n    },\n  };\n\n  const clientConfig: RspackOptions = {\n    name: 'client',\n    mode,\n    target: 'web',\n    context: rootDir,\n    devtool: isDev ? 'source-map' : false,\n    entry: { main: clientEntry },\n    output: {\n      path: join(rootDir, 'dist', 'static'),\n      publicPath: '/_static/',\n      clean: !isDev,\n      filename: isDev ? 'chunks/main.js' : 'chunks/main.[contenthash].js',\n      chunkFilename: isDev ? 'chunks/[name].js' : 'chunks/[name].[contenthash].js',\n      cssFilename: isDev ? 'chunks/[name].css' : 'chunks/[name].[contenthash].css',\n      cssChunkFilename: isDev ? 'chunks/[name].css' : 'chunks/[name].[contenthash].css',\n      assetModuleFilename: 'assets/[name].[hash][ext]',\n    },\n    optimization: {\n      moduleIds: isDev ? 'named' : 'hashed',\n    },\n    resolve: {\n      ...resolveBase,\n      alias: { '@': srcDir },\n    },\n    module: {\n      rules: [swcRule(BROWSER_TARGETS), cssRule(), { test: /\\.(png|jpe?g|gif|webp|avif|ico|svg|woff2?|ttf|otf)$/i, type: 'asset' }],\n    },\n    plugins: [\n      new ClientPlugin(),\n      new rspack.DefinePlugin({ 'process.env': JSON.stringify(publicEnv(isDev)) }),\n      ...(isDev ? [new rspack.HotModuleReplacementPlugin(), new ReactRefreshRspackPlugin()] : []),\n    ],\n    performance: false,\n  };\n\n  const serverConfig: RspackOptions = {\n    name: 'server',\n    mode,\n    target: 'node',\n    context: rootDir,\n    devtool: isDev ? 'source-map' : false,\n    entry: { main: rscEntry },\n    output: {\n      path: join(rootDir, 'dist', 'server'),\n      clean: true,\n      module: true,\n      chunkFormat: 'module',\n      chunkLoading: 'import',\n      library: { type: 'module' },\n      filename: 'main.mjs',\n      chunkFilename: 'chunks/[name].mjs',\n      publicPath: '/_static/',\n      assetModuleFilename: 'assets/[name].[hash][ext]',\n    },\n    optimization: {\n      minimize: isDev ? false : true,\n    },\n    externalsType: 'module-import',\n    externals: [\n      ({ request }, callback) => {\n        if (\n          !request ||\n          isPathRequest(request) ||\n          request.startsWith('@/') ||\n          request.startsWith('@rshono/') ||\n          request.startsWith('builtin:') ||\n          request.includes('!') ||\n          BUNDLED_PACKAGES.test(request)\n        ) {\n          return callback();\n        }\n        callback(undefined, `module-import ${request}`);\n      },\n    ],\n    resolve: {\n      ...serverResolveBase,\n      alias: {\n        '@rshono/routes$': routesFile,\n        '@rshono/server-app$': serverAppAlias,\n        // The one import that decides which platform the server bundle is for. Split on '/' so the\n        // preset can declare a POSIX-looking path and still resolve on Windows.\n        '@rshono/deploy$': join(FRAMEWORK_DIST, ...preset.runtimeModule.split('/')),\n        '@': srcDir,\n      },\n    },\n    module: {\n      rules: [\n        {\n          test: (resource: string) => pageFiles.has(resource),\n          enforce: 'pre',\n          use: [{ loader: join(FRAMEWORK_DIST, 'builder', 'page-entry-loader.cjs') }],\n        },\n        {\n          test: /\\.[cm]?[tj]sx?$/,\n          include: srcDir,\n          enforce: 'pre',\n          use: [\n            {\n              loader: join(FRAMEWORK_DIST, 'builder', 'env-shadow-loader.cjs'),\n              options: { prelude: `const process = { env: ${JSON.stringify(publicEnv(isDev))} }; `, layer: Layers.ssr },\n            },\n          ],\n        },\n        swcRule([...(preset.syntaxTargets ?? NODE_TARGETS)]),\n        cssRule(),\n        {\n          test: /\\.(png|jpe?g|gif|webp|avif|ico|svg|woff2?|ttf|otf)$/i,\n          type: 'asset',\n          generator: { emit: false },\n        },\n        { resource: ssrEntry, layer: Layers.ssr },\n        {\n          resource: rscEntry,\n          layer: Layers.rsc,\n          resolve: { conditionNames: rscConditionNames },\n        },\n        {\n          issuerLayer: Layers.rsc,\n          exclude: ssrEntry,\n          resolve: { conditionNames: rscConditionNames },\n        },\n      ],\n    },\n    plugins: [\n      pageScanPlugin,\n      new ServerPlugin({ onServerComponentChanges }),\n      // Bakes rshono.config.ts into the bundle, read back as `__RSHONO_CONFIG__` at request time.\n      new rspack.DefinePlugin({ __RSHONO_CONFIG__: JSON.stringify(resolveServerConfig(config, { isDev })) }),\n    ],\n    performance: false,\n  };\n\n  // The platform's own overrides, then the user's hook — so an app can still adjust whatever a\n  // preset decided.\n  preset.configureServer?.(serverConfig);\n\n  const rspackHook = config.rspack;\n  if (rspackHook) {\n    return [\n      rspackHook(clientConfig, { isServer: false, isDev }) ?? clientConfig,\n      rspackHook(serverConfig, { isServer: true, isDev }) ?? serverConfig,\n    ];\n  }\n  return [clientConfig, serverConfig];\n}\n"]}

package/dist/cli/dev.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev.d.ts","sourceRoot":"","sources":["../../src/cli/dev.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAQjD,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAuNnE"}
+{"version":3,"file":"dev.d.ts","sourceRoot":"","sources":["../../src/cli/dev.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAajD,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAgPnE"}

package/dist/cli/dev.js

@@ -1,6 +1,7 @@
 import { serve } from '@hono/node-server';
 import { rspack } from '@rspack/core';
 import { Hono } from 'hono';
+import { proxy } from 'hono/proxy';
 import { mkdir, rm } from 'node:fs/promises';
 import { join } from 'node:path';
 import { Worker } from 'node:worker_threads';
@@ -9,6 +10,10 @@ import { NODE_PRESET } from '../deploy/presets.js';
 import { SERVER_DEFAULTS } from '../server/server-config.js';
 import { createStaticAssetsApp } from '../server/static.js';
 const WORKER_READY_TIMEOUT_MS = 15_000;
+/** An error as the dev server shows it in the browser: the stack where there is one, since this is dev. */
+function describe(error) {
+    return error instanceof Error ? (error.stack ?? error.message) : String(error);
+}
 export async function devCommand(options) {
     const { rootDir, config } = options;
     const port = options.port ?? SERVER_DEFAULTS.port;
@@ -19,8 +24,12 @@ export async function devCommand(options) {
     const sseClients = new Set();
     let clientHash;
     const sseChunk = (data) => encoder.encode(`data: ${JSON.stringify(data)}\n\n`);
-    function broadcast(message) {
-        const chunk = sseChunk(message);
+    /**
+     * Writes one already-encoded SSE frame to every open client, dropping the ones that have gone away.
+     * A browser that navigated or closed leaves a controller whose `enqueue` throws, and `cancel` is not
+     * always reached first — so a failed write is what retires a client.
+     */
+    function sendToAll(chunk) {
         for (const controller of sseClients) {
             try {
                 controller.enqueue(chunk);
@@ -30,6 +39,9 @@ export async function devCommand(options) {
             }
         }
     }
+    function broadcast(message) {
+        sendToAll(sseChunk(message));
+    }
     let serverComponentsChanged = false;
     const [clientConfig, serverConfig] = createConfigs({
         rootDir,
@@ -63,13 +75,22 @@ export async function devCommand(options) {
                 worker.terminate();
                 reject(new Error(`server worker did not become ready within ${WORKER_READY_TIMEOUT_MS / 1000}s`));
             }, WORKER_READY_TIMEOUT_MS);
+            let ready = false;
             worker.once('message', (message) => {
                 if (message?.type === 'ready' && typeof message.port === 'number') {
+                    ready = true;
                     clearTimeout(timeout);
                     resolve({ worker, port: message.port });
                 }
             });
-            worker.once('error', (error) => {
+            // `on`, not `once`: an error *after* the worker is ready has no pending promise left to reject,
+            // and a consumed `once` would leave that error with no listener at all — which Node turns into
+            // an uncaught exception that takes the dev server down with the worker.
+            worker.on('error', (error) => {
+                if (ready) {
+                    console.error('  ✗ server worker crashed:', error);
+                    return;
+                }
                 clearTimeout(timeout);
                 reject(error);
             });
@@ -77,7 +98,12 @@ export async function devCommand(options) {
                 if (worker === currentWorker && code !== 0) {
                     console.error(`  ✗ server worker exited with code ${code} — waiting for the next rebuild`);
                     currentWorker = null;
+                    // Opened with the reason rather than left closed: a request arriving before the next rebuild
+                    // parks on this gate, and an unopened one would hang the browser with only the terminal
+                    // saying why. `hooks.invalid` installs a fresh closed gate the moment a file changes, so the
+                    // next build still holds requests until the worker is back.
                     workerGate = createGate();
+                    workerGate.open({ error: `The server worker exited with code ${code}. See the terminal for the error it crashed with.` });
                 }
             });
         });
@@ -110,9 +136,16 @@ export async function devCommand(options) {
             }
             catch (error) {
                 console.error('  ✗ failed to start server worker:', error);
-                gate.open({ error: error instanceof Error ? (error.stack ?? error.message) : String(error) });
+                gate.open({ error: describe(error) });
             }
         });
+        // No link in this queue may be left rejected: `.then` on a rejected promise short-circuits, and
+        // from that point no worker is ever spawned again and no gate is ever opened — a dev server that
+        // answers nothing and explains nothing. The `try` above covers the restart; this covers the rest.
+        restartChain = restartChain.catch((error) => {
+            console.error('  ✗ dev server restart failed:', error);
+            gate.open({ error: describe(error) });
+        });
         await restartChain;
     });
     clientCompiler.hooks.done.tap('rshono/hmr', (stats) => {
@@ -159,16 +192,10 @@ export async function devCommand(options) {
             },
         });
     });
-    setInterval(() => {
-        for (const controller of sseClients) {
-            try {
-                controller.enqueue(encoder.encode(': ping\n\n'));
-            }
-            catch {
-                sseClients.delete(controller);
-            }
-        }
-    }, 15_000).unref();
+    // An SSE comment, not a message: it keeps an idle connection off a proxy's timeout without the
+    // client having to know about a frame type that means nothing.
+    const ping = encoder.encode(': ping\n\n');
+    setInterval(() => sendToAll(ping), 15_000).unref();
     front.all('*', async (c) => {
         const { error } = await workerGate.promise;
         if (error || workerPort === null) {
@@ -176,32 +203,33 @@ export async function devCommand(options) {
         }
         const incoming = new URL(c.req.url);
         const target = `http://127.0.0.1:${workerPort}${incoming.pathname}${incoming.search}`;
-        const headers = new Headers(c.req.raw.headers);
-        headers.delete('accept-encoding');
-        headers.set('x-forwarded-host', incoming.host);
-        headers.set('x-forwarded-proto', incoming.protocol.replace(':', ''));
-        const hasBody = c.req.method !== 'GET' && c.req.method !== 'HEAD';
-        const response = await fetch(target, {
-            method: c.req.method,
-            headers,
-            body: hasBody ? c.req.raw.body : undefined,
+        // Hono's proxy helper rather than a hand-rolled `fetch`: it carries the method, the streamed body
+        // (with the `duplex` Node requires) and the client's abort signal, so a browser that goes away
+        // takes the worker's render with it. On the way back it strips the hop-by-hop headers. `headers`
+        // replaces the set wholesale, so the request's own are spread back in first.
+        const response = await proxy(target, {
+            raw: c.req.raw,
+            // The worker's redirects are the app's answer to this request, not something to follow here —
+            // they have to reach the browser, with the internal address rewritten off them below.
             redirect: 'manual',
-            // @ts-expect-error — Node fetch requires duplex for streamed bodies
-            duplex: hasBody ? 'half' : undefined,
+            headers: {
+                ...c.req.header(),
+                // This front-end *is* the proxy the app sits behind, and `trustProxy` is forced on in dev for
+                // exactly that reason: without these the app resolves every URL against the worker's random
+                // 127.0.0.1 port instead of the address the browser actually used.
+                'x-forwarded-host': incoming.host,
+                'x-forwarded-proto': incoming.protocol.replace(':', ''),
+            },
         });
-        const responseHeaders = new Headers(response.headers);
-        responseHeaders.delete('content-encoding');
-        responseHeaders.delete('content-length');
-        const location = responseHeaders.get('location');
+        // A redirect to the worker's own address has to become a relative one, or the browser leaves the
+        // dev server for a random port only this process knows about. `proxy` hands back a response whose
+        // headers are still mutable, so the rewrite happens in place.
+        const location = response.headers.get('location');
         const loc = location ? URL.parse(location, target) : null;
         if (loc && loc.host === `127.0.0.1:${workerPort}`) {
-            responseHeaders.set('location', `${loc.pathname}${loc.search}${loc.hash}`);
+            response.headers.set('location', `${loc.pathname}${loc.search}${loc.hash}`);
         }
-        return new Response(response.body, {
-            status: response.status,
-            statusText: response.statusText,
-            headers: responseHeaders,
-        });
+        return response;
     });
     serve({ fetch: front.fetch, port, hostname: '127.0.0.1' }, (info) => {
         console.log(`  ➜ rshono dev server: http://localhost:${info.port}`);