@skgo/sveltekit-adapter 0.14.0 → 0.15.0

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@skgo/sveltekit-adapter",
-	"version": "0.14.0",
+	"version": "0.15.0",
 	"description": "SvelteKit adapter for skgo: builds a frontend that a Go binary renders and answers",
 	"keywords": [
 		"adapter",

package/skgo-adapter/entry.js

@@ -25,6 +25,7 @@ import { decoders, init_transport, parse } from 'skgo:kit/transport';
 import { components, universalLoads } from 'skgo:nodes';
 import { transport } from 'skgo:hooks';
 import { serialize_data } from 'skgo:kit/serialize-data';
+import { create_universal_fetch } from 'skgo:kit/load-data';
 
 /**
  * The app's transport hook, installed the way kit installs it
@@ -77,8 +78,50 @@ function make_state() {
 	};
 }
 
-/** All render-time I/O is dispatched by Go, including the handleFetch hook. */
-function create_fetch(req, url) {
+const bytes_to_base64 = (bytes) => {
+	let binary = '';
+	for (let i = 0; i < bytes.length; i += 0x8000) {
+		binary += String.fromCharCode.apply(null, bytes.subarray(i, i + 0x8000));
+	}
+	return btoa(binary);
+};
+
+const base64_to_bytes = (encoded) => {
+	const binary = atob(encoded);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+};
+
+// Statuses a real Response cannot carry a body for (runtime/server/constants.js).
+const NULL_BODY = [101, 204, 205, 304];
+
+/**
+ * Every response header a fetch answered with, and whether the app's
+ * `filterSerializedResponseHeaders` lets Go replay it into the document. Go
+ * evaluates that filter, so the one kit hands its serializer answers from what
+ * Go said: the same name and value always get the same answer.
+ *
+ * @param {Set<string>} serialized
+ */
+function resolve_options(serialized) {
+	return {
+		filterSerializedResponseHeaders: (name, value) => serialized.has(name + ':' + value)
+	};
+}
+
+/**
+ * Kit's `event.fetch` (runtime/server/fetch.js) with its whole body — the
+ * handleFetch hook, credential inheritance, internal dispatch, cookie
+ * write-back — done by Go. What stays here is what the engine owns: turning
+ * what a component passed into a Request, and the bytes Go answers with into a
+ * Response.
+ *
+ * @param {object} req
+ * @param {URL} url
+ * @param {Set<string>} serialized
+ */
+function create_fetch(req, url, serialized) {
 	return async function (input, init) {
 		const request = input instanceof Request ? input : new Request(new URL(input, url).href, init);
 		const target = new URL(request.url, url);
@@ -88,138 +131,35 @@ function create_fetch(req, url) {
 			method: request.method || 'GET', url: target.href, headers,
 			credentials: request.credentials, mode: request.mode
 		};
-		if (typeof request._body === 'string') envelope.body = request._body;
-		else if (request._body != null) throw new TypeError('skgo: render-time fetch request bodies must be text');
+		if (request.body !== null) {
+			const bytes = new Uint8Array(await request._consume());
+			if (bytes.length) envelope.bodyBase64 = bytes_to_base64(bytes);
+		}
 		const answer = JSON.parse(await globalThis.__skgo_fetch(JSON.stringify(envelope)));
 		if (answer.error) throw new TypeError(answer.error);
 		const value = answer.response;
-		const body = value.bodyBase64
-			? Uint8Array.from(atob(value.bodyBase64), (c) => c.charCodeAt(0))
-			: value.body ?? '';
-		const response = new Response(body, { status: value.status, statusText: value.statusText, headers: value.headers });
-		response._serializedHeaders = value.serializedHeaders ?? {};
-		return response;
-	};
-}
-
-/**
- * Kit's universal-load fetch contract (server/page/load_data.js): record bodies
- * when consumed, hash the author's headers/body rather than inherited cookies,
- * and reject access to headers hydration will not receive. The final HTML is
- * emitted by Kit's own serialize_data, including escaping, hashes and TTLs.
- */
-function create_universal_fetch(event, req, fetched) {
-	return async (input, init) => {
-		const request_headers = input instanceof Request
-			? ([...input.headers].length ? new Headers(input.headers) : undefined)
-			: init?.headers;
-		const request_body = input instanceof Request ? input._body : init?.body;
-		const url = new URL(input instanceof Request ? input.url : input, event.url);
-		let response = await event.fetch(input, init);
-		if (!same_origin(url, event.url) && (url.protocol === 'http:' || url.protocol === 'https:')) {
-			const mode = input instanceof Request ? input.mode : init?.mode ?? 'cors';
-			if (mode === 'no-cors') {
-				const allowed = response._serializedHeaders;
-				response = new Response('', { status: response.status, statusText: response.statusText, headers: response.headers });
-				response._serializedHeaders = allowed;
-			} else {
-				const acao = response.headers.get('access-control-allow-origin');
-				if (!acao || (acao !== '*' && acao !== origin_of(event.url))) {
-					throw new Error("CORS error: incorrect or missing 'Access-Control-Allow-Origin' header");
-				}
-			}
+		for (const [name, header, allowed] of value.headers ?? []) {
+			if (allowed) serialized.add(name + ':' + header);
 		}
-		const cache_url = same_origin(url, event.url)
-			? url.pathname + url.search
-			: url.href;
-		const allowed = response._serializedHeaders;
-		const wrap = (target) => {
-			const record = (body, is_b64) => {
-				fetched.push({
-					url: cache_url, method: event.request.method,
-					request_headers, request_body, response: target,
-					response_body: body, is_b64, allowed
-				});
-			};
-			const text = async () => {
-				const body = await target.text();
-				if (body === '' && [101, 204, 205, 304].includes(target.status)) {
-					record(undefined, false);
-					return undefined;
-				}
-				record(body, false);
-				return body;
-			};
-			const headers = new Headers(target.headers);
-			const get = headers.get.bind(headers);
-			if (req.csr) {
-				headers.get = (key) => {
-					const lower = key.toLowerCase();
-					const value = get(lower);
-					if (value && !lower.startsWith('x-sveltekit-') && !(lower in allowed)) {
-						throw new Error(`Failed to get response header "${lower}" — it must be included by the filterSerializedResponseHeaders option (at ${event.route.id})`);
-					}
-					return value;
-				};
-			}
-			return new Proxy(target, {
-				get(target, key) {
-					if (key === 'headers') return headers;
-					if (key === 'text') return text;
-					if (key === 'json') return async () => { const body = await text(); return body ? JSON.parse(body) : undefined; };
-					if (key === 'arrayBuffer') return async () => {
-						const buffer = await target.arrayBuffer();
-						let binary = '';
-						for (const byte of new Uint8Array(buffer)) binary += String.fromCharCode(byte);
-						record(btoa(binary), true);
-						return buffer;
-					};
-					if (key === 'clone') return () => wrap(target.clone());
-					const value = Reflect.get(target, key, target);
-					return typeof value === 'function' ? value.bind(target) : value;
-				}
-			});
-		};
-		return wrap(response);
+		let body = null;
+		if (!NULL_BODY.includes(value.status) && request.method !== 'HEAD') {
+			body = value.bodyBase64 ? base64_to_bytes(value.bodyBase64) : value.body ?? '';
+		}
+		return new Response(body, {
+			status: value.status,
+			statusText: value.statusText,
+			headers: (value.headers ?? []).map(([name, header]) => [name, header])
+		});
 	};
 }
 
-
-/**
- * Same-origin, spelled out rather than taken from `origin`. The engine's URL is
- * Go's (goja_nodejs, over net/url) and its `origin` is scheme and hostname with
- * the port left out, which would make a page on :8080 and a URL on :9999 look
- * like the same site — and this is the one comparison standing between a
- * cached response and a foreign response. Protocol, hostname and
- * port are each exactly what the standard compares. Go enforces dispatch separately.
- *
- * @param {URL} a
- * @param {URL} b
- */
-function same_origin(a, b) {
-	const port = (url) => url.port || (url.protocol === 'https:' ? '443' : '80');
-	return a.protocol === b.protocol && a.hostname === b.hostname && port(a) === port(b);
-}
-
-/**
- * What `url.origin` would say if this engine's URL reported it the way the
- * standard does, used for CORS validation.
- *
- * @param {URL} url
- */
-function origin_of(url) {
-	const default_port = (url.protocol === 'http:' && url.port === '80') || (url.protocol === 'https:' && url.port === '443');
-	const host = default_port ? url.host.replace(/:(80|443)$/, '') : url.host;
-	return host ? url.protocol + '//' + host : 'null';
-}
-
 /**
  * A RequestEvent stand-in. run_remote_function spreads it and derives the
  * event a query actually sees, which is where kit makes url, params and
  * route throw. Go owns the real request; the only I/O anything here performs
  * is `fetch`'s in-process call back into Go for one of the app's own routes.
  */
-function make_event(req, url) {
+function make_event(req, url, serialized) {
 	return {
 		cookies: {
 			get: (name) => (req.cookies ?? {})[name],
@@ -228,7 +168,7 @@ function make_event(req, url) {
 			delete: () => {},
 			serialize: () => ''
 		},
-		fetch: create_fetch(req, url),
+		fetch: create_fetch(req, url, serialized),
 		getClientAddress: () => req.client_address ?? '127.0.0.1',
 		locals: {},
 		params: req.params ?? {},
@@ -270,7 +210,7 @@ function node_data(node) {
 	});
 }
 
-async function build_props(req, url, event, state, fetched) {
+async function build_props(req, url, event, state, fetched, serialized) {
 	const form = req.form ? devalue.parse(req.form, decoders) : null;
 	const page = {
 		error: req.error ?? null,
@@ -313,7 +253,7 @@ async function build_props(req, url, event, state, fetched) {
 					parent: async () => parent_data,
 					depends: () => {},
 					untrack: (fn) => fn(),
-					fetch: create_universal_fetch(event, req, fetched),
+					fetch: create_universal_fetch(event, undefined, fetched, req.csr, resolve_options(serialized)),
 					setHeaders: () => {
 						throw new Error('skgo: universal load setHeaders is not supported during rendering');
 					}
@@ -421,9 +361,10 @@ globalThis.__skgo_render = function (req_json) {
 		const req = JSON.parse(req_json);
 		const url = new URL(req.url);
 		const state = make_state();
-		const event = make_event(req, url);
+		const serialized = new Set();
+		const event = make_event(req, url, serialized);
 		const fetched = [];
-		const props_promise = build_props(req, url, event, state, fetched);
+		const props_promise = build_props(req, url, event, state, fetched, serialized);
 		const promise = props_promise.then((props) => {
 			result.status = props.page.status;
 			result.error = req.error ?? null;
@@ -469,7 +410,9 @@ globalThis.__skgo_render = function (req_json) {
 			(rendered) => {
 				result.head = rendered.head;
 				result.body = rendered.body;
-				result.fetched = fetched.map((item) => serialize_data(item, (key) => key in item.allowed)).join("\n\t\t\t");
+				result.fetched = fetched
+					.map((item) => serialize_data(item, resolve_options(serialized).filterSerializedResponseHeaders))
+					.join("\n\t\t\t");
 				result.done = true;
 			},
 			(err) => {

package/skgo-adapter/env.js

@@ -26,7 +26,7 @@
 
 import { createRequire } from 'node:module';
 import { execFileSync } from 'node:child_process';
-import { randomBytes } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import { protectEnvironmentFiles } from './env-private.js';
 import { existsSync, readdirSync, readFileSync, realpathSync, rmSync, statSync, mkdirSync, writeFileSync, chmodSync } from 'node:fs';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
@@ -63,7 +63,7 @@ async function fromApp(specifier) {
 }
 
 const { rolldown } = await fromApp('vite/rolldown');
-const { transformSync } = await fromApp('vite/rolldown/experimental');
+const { parseSync, transformSync } = await fromApp('vite/rolldown/experimental');
 // `fetchModule` operates on the app's own `DevEnvironment`, so it has to be
 // the app's copy for the same reason rolldown is: a second module realm's
 // vite does not recognise this one's environments.
@@ -133,6 +133,9 @@ function kitAliases(root) {
 		'skgo:kit/shared': join(runtime, 'shared.js'),
 		'skgo:kit/transport': join(runtime, 'app/internal/transport.js'),
 		'skgo:kit/serialize-data': join(runtime, 'server/page/serialize_data.js'),
+		// kit's own universal fetch, which the entry hands every universal load
+		// rather than keeping a second copy of its CORS, replay and header rules.
+		'skgo:kit/load-data': join(runtime, 'server/page/load_data.js'),
 		'skgo:kit/props': join(runtime, 'props.svelte.js'),
 		'skgo:kit/root': join(runtime, 'components/root.svelte'),
 		// kit's own `$app/paths` server implementation, which app-paths.js
@@ -166,8 +169,9 @@ function bare(id) {
 	return !id.startsWith('.') && !id.startsWith('\0') && !id.startsWith('/') && !isAbsolute(id);
 }
 
-/** The constructs goja's parser rejects, and the only reason to lower a module. */
-const UNPARSEABLE = /for\s+await\s*\(|async\s+function\s*\*|async\s*\*/;
+// A conservative prefilter: comments may separate an unsupported construct's
+// tokens. The syntax tree, not their spelling or surrounding text, decides.
+const MAY_NEED_LOWERING = /\b(?:async|await)\b/;
 
 /**
  * The goja environment: the vite plugin that declares it, and the call that
@@ -485,7 +489,7 @@ export function nodeTable(root, nodes) {
  * @param {string} id
  * @param {{ lowered?: Set<string>, helpers?: string }} options
  */
-function engineTransform(code, id, { lowered, helpers } = {}) {
+export function engineTransform(code, id, { lowered, helpers } = {}) {
 	let out = code;
 	// svelte/src/internal/server/crypto.js hides a `node:crypto` import behind
 	// a variable so bundlers cannot resolve it. goja rejects the syntax
@@ -496,7 +500,7 @@ function engineTransform(code, id, { lowered, helpers } = {}) {
 			'=> Promise.reject(new Error("skgo: no dynamic import in the SSR engine"))'
 		);
 	}
-	if (!UNPARSEABLE.test(out)) {
+	if (!needsLowering(out, id)) {
 		return out === code ? null : { code: out, map: null };
 	}
 	lowered?.add(id);
@@ -511,6 +515,30 @@ function engineTransform(code, id, { lowered, helpers } = {}) {
 	return { code: lower, map: null };
 }
 
+// A text match is only a cheap prefilter. Svelte's renderer has a JSDoc
+// parameter named `render_async` immediately before `*/`, which looks like
+// an async generator to the old regexp. Lowering that comment rewrote all of its
+// private fields to WeakMaps and retained whole render trees in the engine.
+function needsLowering(code, id) {
+	if (!MAY_NEED_LOWERING.test(code)) return false;
+	const nodes = [parseSync(id.replace(/\0/g, '_'), code).program];
+	while (nodes.length) {
+		const node = nodes.pop();
+		if (!node || typeof node !== 'object') continue;
+		if (node.type === 'ForOfStatement' && node.await) return true;
+		if ((node.type === 'FunctionDeclaration' || node.type === 'FunctionExpression') &&
+			node.async && node.generator) return true;
+		for (const value of Object.values(node)) {
+			if (value && typeof value === 'object') {
+				if (Array.isArray(value)) {
+					for (const child of value) nodes.push(child);
+				} else nodes.push(value);
+			}
+		}
+	}
+	return false;
+}
+
 /**
  * Where oxc's lowering helpers live, resolved the way dev has to resolve them:
  * from vite rather than from the app. Under pnpm `@oxc-project/runtime` is a
@@ -787,6 +815,13 @@ export function gojaDevEnvironment({ outDir = '.svelte-kit' } = {}) {
 				// temporary version forever.
 				changed.push(file);
 
+				// The document templates are read afresh for every `/info`, but Go
+				// installs them only when the version moves. Nothing else moves it
+				// for a template, which is not a route and has no module to drop.
+				if ([kit.files.appTemplate, kit.files.errorTemplate].some((t) => normalize(t) === normalize(file))) {
+					manifestVersion++;
+				}
+
 				const routeFile = normalize(file).startsWith(normalize(kit.files.routes) + '/');
 				if (routeFile && (event === 'add' || event === 'unlink')) manifestDirty = true;
 				const name = relative(kit.files.routes, file).split(/[\\/]/).at(-1);
@@ -958,6 +993,138 @@ export function gojaDevEnvironment({ outDir = '.svelte-kit' } = {}) {
 	return plugin;
 }
 
+/**
+ * A watcher event for a file whose bytes are the ones vite already has is not an edit.
+ *
+ * chokidar reports a file nobody has read since it was written as changed on
+ * any filesystem event, metadata-only ones included, and something on a
+ * developer's machine (a sync client, a scanner) touches generated files that
+ * way. Kit's own dev server has no answer to it: vite turns each report into a
+ * hot update or a full page reload, and a reload throws away what a visitor
+ * had typed and aborts the documents Go was rendering for them. So the dev
+ * server remembers the content it last loaded or was told about, and lets
+ * through only the reports whose content differs.
+ *
+ * Content means the file's bytes, not the text vite decoded from them: two
+ * different invalid byte sequences decode to the same replacement characters,
+ * and an edit between them is still an edit. What vite loaded is therefore
+ * remembered only when the file's bytes decode to exactly it; a file a plugin
+ * generated or rewrote on the way in has no such bytes, and its first report
+ * is let through.
+ *
+ * The adapter's own output directory is not an input at all. It is where the
+ * build writes the documents Go embeds, vite holds no module for any of them,
+ * and vite answers a report for an html file it holds no module for by
+ * reloading every open page. It is excluded from the watcher the way kit
+ * excludes its own `.svelte-kit` output (kit/exports/vite/index.js, the
+ * `server.watch.ignored` it sets), so nothing written there is ever reported.
+ *
+ * chokidar emits one report twice, `change` and then `all`, and the first
+ * verdict stands for both. A `change` emitted from inside a `change` listener
+ * is a plugin's own (vite-plugin-svelte re-emits it for a preprocessor's
+ * dependants, whose bytes are unchanged); those always pass.
+ *
+ * @param {{ out?: string }} [options] the adapter's output directory, relative to the vite root
+ * @returns {import('vite').Plugin}
+ */
+export function gojaDevUnchangedFiles({ out = 'build' } = {}) {
+	/** What vite last loaded for a file, or last reported changed: its byte digest. */
+	const known = new Map();
+	const digest = (/** @type {Uint8Array} */ bytes) => createHash('sha256').update(bytes).digest('base64');
+	const read = (/** @type {string} */ file) => {
+		try {
+			return digest(readFileSync(file));
+		} catch {
+			return null;
+		}
+	};
+	/** Remember a file by the bytes vite decoded `code` from, if they are the ones on disk now. */
+	const remember = (/** @type {string} */ file, /** @type {string} */ code) => {
+		try {
+			const bytes = readFileSync(file);
+			if (bytes.toString('utf8') === code) known.set(posix(file), digest(bytes));
+			else known.delete(posix(file));
+		} catch {
+			known.delete(posix(file));
+		}
+	};
+
+	return {
+		name: 'skgo-dev-unchanged-files',
+		apply: 'serve',
+
+		config(config) {
+			const emitted = posix(resolve(config.root ?? process.cwd(), out));
+			return { server: { watch: { ignored: [emitted, `${emitted}/**`] } } };
+		},
+
+		configureServer(server) {
+			const watcher = server.watcher;
+			const emit = watcher.emit;
+			let depth = 0;
+			/** @type {{ file: string, same: boolean } | null} */
+			let verdict = null;
+			/** @type {(file: string) => boolean} */
+			const unchanged = (file) => {
+				const key = posix(file);
+				const now = read(file);
+				const same = now !== null && known.get(key) === now;
+				if (now !== null) known.set(key, now);
+				return same;
+			};
+			// Kit validates templates synchronously from its watcher. An in-place
+			// save can expose truncated bytes; report that validation error but
+			// keep the watcher alive so the completed save can regenerate Kit.
+			const notify = (receiver, event, args, file) => {
+				try {
+					return emit.call(receiver, event, ...args);
+				} catch (error) {
+					const authored = typeof file === 'string' ? relative(server.config.root, file) : null;
+					if (!(error instanceof Error) || authored === null ||
+						!['%sveltekit.head%', '%sveltekit.body%'].some(tag => error.message === `${authored} is missing ${tag}`)) throw error;
+					known.delete(posix(file));
+					server.config.logger.error(error.stack ?? error.message);
+					server.ws.send({ type: 'error', err: { message: error.message, stack: error.stack ?? '', plugin: 'skgo-dev-unchanged-files' } });
+					return false;
+				}
+			};
+			watcher.emit = function (event, ...args) {
+				const all = event === 'all';
+				const kind = all ? args[0] : event;
+				const file = all ? args[1] : args[0];
+				if (typeof file === 'string' && kind === 'add' && !all) {
+					const now = read(file);
+					if (now !== null) known.set(posix(file), now);
+				} else if (typeof file === 'string' && kind === 'change') {
+					if (all) {
+						const reported = verdict && verdict.file === file ? verdict : null;
+						verdict = null;
+						if (reported ? reported.same : unchanged(file)) return false;
+					} else if (depth === 0) {
+						verdict = { file, same: unchanged(file) };
+						if (verdict.same) return false;
+					}
+				}
+				if (all) return notify(this, event, args, file);
+				depth++;
+				try {
+					return notify(this, event, args, file);
+				} finally {
+					depth--;
+				}
+			};
+		},
+
+		transform: {
+			order: 'pre',
+			handler(code, id) {
+				if (!id.includes('?') && !id.startsWith('\0') && isAbsolute(id)) remember(id, code);
+				return null;
+			}
+		}
+	};
+}
+
 const OXC_HELPERS = '@oxc-project/runtime/helpers/';
 
 /**

package/skgo-adapter/polyfill.js

@@ -25,8 +25,10 @@ globalThis.process = { versions: { webcontainer: 'skgo' } };
 // (exports/internal/shared.js), which builds one to reject a location that
 // could not survive an HTTP header — and does it inside a try/catch, so an
 // absent Headers would be reported as an invalid location rather than as a
-// missing global. Only the construction and the validation it performs are
-// needed; nothing in the engine sends a request.
+// missing global. It is also what a render's fetch response carries, so it
+// follows the Fetch standard where kit's universal fetch can see it: names are
+// lowercased and iterate sorted, a repeated name is joined with ", ", and
+// Set-Cookie alone is kept as a list (getSetCookie) and iterates once per value.
 if (typeof globalThis.Headers === 'undefined') {
 	// RFC 9110 field-name and field-value rules, which is all the real
 	// constructor checks that matters here.
@@ -36,8 +38,10 @@ if (typeof globalThis.Headers === 'undefined') {
 	globalThis.Headers = class Headers {
 		constructor(init) {
 			this._ = new Map();
+			this._cookies = [];
 			if (init instanceof Headers) {
 				for (const [k, v] of init._) this._.set(k, v);
+				this._cookies = init._cookies.slice();
 			} else if (Array.isArray(init)) {
 				for (const [k, v] of init) this.append(k, v);
 			} else if (init && typeof init === 'object') {
@@ -49,21 +53,35 @@ if (typeof globalThis.Headers === 'undefined') {
 			const v = String(value).trim();
 			if (!NAME.test(n)) throw new TypeError('Invalid header name: ' + n);
 			if (BAD_VALUE.test(v)) throw new TypeError('Invalid header value');
-			this._.set(n.toLowerCase(), v);
+			const k = n.toLowerCase();
+			if (k === 'set-cookie') this._cookies = [v];
+			else this._.set(k, v);
 		}
 		append(name, value) {
-			const existing = this.get(name);
-			this.set(name, existing === null ? value : existing + ', ' + value);
+			const n = String(name);
+			const v = String(value).trim();
+			if (!NAME.test(n)) throw new TypeError('Invalid header name: ' + n);
+			if (BAD_VALUE.test(v)) throw new TypeError('Invalid header value');
+			const k = n.toLowerCase();
+			if (k === 'set-cookie') this._cookies.push(v);
+			else this._.set(k, this._.has(k) ? this._.get(k) + ', ' + v : v);
 		}
 		get(name) {
 			const k = String(name).toLowerCase();
+			if (k === 'set-cookie') return this._cookies.length ? this._cookies.join(', ') : null;
 			return this._.has(k) ? this._.get(k) : null;
 		}
+		getSetCookie() {
+			return this._cookies.slice();
+		}
 		has(name) {
-			return this._.has(String(name).toLowerCase());
+			const k = String(name).toLowerCase();
+			return k === 'set-cookie' ? this._cookies.length > 0 : this._.has(k);
 		}
 		delete(name) {
-			this._.delete(String(name).toLowerCase());
+			const k = String(name).toLowerCase();
+			if (k === 'set-cookie') this._cookies = [];
+			else this._.delete(k);
 		}
 		forEach(fn, thisArg) {
 			for (const [k, v] of this.entries()) fn.call(thisArg, v, k, this);
@@ -75,7 +93,10 @@ if (typeof globalThis.Headers === 'undefined') {
 			return Array.from(this.entries(), ([, v]) => v)[Symbol.iterator]();
 		}
 		entries() {
-			return Array.from(this._).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)[Symbol.iterator]();
+			const all = Array.from(this._);
+			for (const cookie of this._cookies) all.push(['set-cookie', cookie]);
+			// A stable sort keeps the Set-Cookie values in the order they arrived.
+			return all.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)[Symbol.iterator]();
 		}
 		[Symbol.iterator]() {
 			return this.entries();
@@ -83,52 +104,264 @@ if (typeof globalThis.Headers === 'undefined') {
 	};
 }
 
-// Request and Response back a render-time `event.fetch`. Kit's own
-// `normalize_fetch_input` (runtime/server/fetch.js) turns whatever a
-// component passed into a real Request before deciding what to do with it, and
-// the answer a render's fetch gets back has to be a real Response — `await
-// (await event.fetch(...)).json()` is what a page actually writes. Nothing
-// here sends bytes anywhere: building one is string and Map bookkeeping, and
-// the one call that leaves the engine is `__skgo_fetch` itself.
+// ReadableStream is what a Response body is on the server too: kit's universal
+// fetch tees `response.body` to record what a load read, and builds a Response
+// over a stream to turn that copy into bytes. This is the part of the standard
+// that path touches — a default reader, tee and cancel — over chunks that are
+// already in memory, because Go hands a render a finished body and the engine
+// holds no socket to stream from.
+if (typeof globalThis.ReadableStream === 'undefined') {
+	class ReadableStreamDefaultReader {
+		constructor(stream) {
+			if (stream._locked) throw new TypeError('ReadableStream is locked');
+			stream._locked = true;
+			this._stream = stream;
+		}
+		read() {
+			return this._stream._read();
+		}
+		releaseLock() {
+			this._stream._locked = false;
+		}
+		cancel(reason) {
+			return this._stream.cancel(reason, true);
+		}
+	}
+
+	globalThis.ReadableStream = class ReadableStream {
+		constructor(source = {}) {
+			this._source = source;
+			this._queue = [];
+			this._state = 'readable';
+			this._error = undefined;
+			this._waiters = [];
+			this._locked = false;
+			this._disturbed = false;
+			const wake = () => this._waiters.splice(0).forEach((resolve) => resolve());
+			this._controller = {
+				enqueue: (chunk) => {
+					if (this._state !== 'readable') throw new TypeError('The stream is not readable');
+					this._queue.push(chunk);
+					wake();
+				},
+				close: () => {
+					if (this._state === 'readable') this._state = 'closed';
+					wake();
+				},
+				error: (reason) => {
+					if (this._state === 'readable') {
+						this._state = 'errored';
+						this._error = reason;
+						this._queue = [];
+					}
+					wake();
+				},
+				desiredSize: 1
+			};
+			this._started = Promise.resolve().then(() => source.start?.(this._controller));
+		}
+		get locked() {
+			return this._locked;
+		}
+		getReader() {
+			return new ReadableStreamDefaultReader(this);
+		}
+		async _read() {
+			this._disturbed = true;
+			await this._started;
+			for (;;) {
+				if (this._queue.length) return { value: this._queue.shift(), done: false };
+				if (this._state === 'closed') return { value: undefined, done: true };
+				if (this._state === 'errored') throw this._error;
+				if (this._source.pull) {
+					await this._source.pull(this._controller);
+					if (this._queue.length || this._state !== 'readable') continue;
+				}
+				await new Promise((resolve) => this._waiters.push(resolve));
+			}
+		}
+		async cancel(reason, viaReader = false) {
+			if (this._locked && !viaReader) throw new TypeError('ReadableStream is locked');
+			this._disturbed = true;
+			if (this._state === 'readable') {
+				this._state = 'closed';
+				this._queue = [];
+				this._waiters.splice(0).forEach((resolve) => resolve());
+				await this._source.cancel?.(reason);
+			}
+		}
+		tee() {
+			const reader = this.getReader();
+			const branches = [];
+			let chain = Promise.resolve();
+			const pump = () => (chain = chain.then(async () => {
+				const result = await reader.read().catch((error) => ({ error }));
+				if (result.error !== undefined) branches.forEach((branch) => branch._controller.error(result.error));
+				else if (result.done) branches.forEach((branch) => branch._controller.close());
+				else branches.forEach((branch) => branch._state === 'readable' && branch._controller.enqueue(result.value));
+			}));
+			for (let i = 0; i < 2; i++) branches.push(new ReadableStream({ pull: pump }));
+			return branches;
+		}
+		[Symbol.asyncIterator]() {
+			const reader = this.getReader();
+			return { next: () => reader.read(), [Symbol.asyncIterator]() { return this; } };
+		}
+	};
+}
+
+// What a body of any of the kinds `Request` and `Response` take comes to as
+// bytes: text, an ArrayBuffer or a view over one, URLSearchParams (which is
+// text), or a ReadableStream of those.
+const body_bytes = async (body) => {
+	if (body === null || body === undefined) return new Uint8Array(0);
+	if (typeof body === 'string') return new TextEncoder().encode(body);
+	if (typeof URLSearchParams !== 'undefined' && body instanceof URLSearchParams) {
+		return new TextEncoder().encode(body.toString());
+	}
+	if (body instanceof ArrayBuffer) return new Uint8Array(body.slice(0));
+	if (ArrayBuffer.isView(body)) {
+		return new Uint8Array(body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength));
+	}
+	if (body instanceof ReadableStream) {
+		const chunks = [];
+		let length = 0;
+		const reader = body.getReader();
+		for (;;) {
+			const { value, done } = await reader.read();
+			if (done) break;
+			const bytes = await body_bytes(value);
+			chunks.push(bytes);
+			length += bytes.length;
+		}
+		const out = new Uint8Array(length);
+		let at = 0;
+		for (const chunk of chunks) {
+			out.set(chunk, at);
+			at += chunk.length;
+		}
+		return out;
+	}
+	return new TextEncoder().encode(String(body));
+};
+globalThis.__skgo_body_bytes = body_bytes;
+
+// The part of Request and Response that is the same on both: one body, readable
+// once, as text, JSON, bytes or a stream.
+const Body = class {
+	get bodyUsed() {
+		return this._used || (this._stream !== undefined && this._stream._disturbed);
+	}
+	get body() {
+		if (this._source === null || this._source === undefined) return null;
+		if (this._stream === undefined) {
+			this._stream = this._source instanceof ReadableStream
+				? this._source
+				: new ReadableStream({
+					start: async (controller) => {
+						const bytes = await body_bytes(this._source);
+						if (bytes.length) controller.enqueue(bytes);
+						controller.close();
+					}
+				});
+		}
+		return this._stream;
+	}
+	async _consume() {
+		if (this.bodyUsed) throw new TypeError('Body is unusable: Body has already been read');
+		if (this._source === null || this._source === undefined) {
+			this._used = true;
+			return new Uint8Array(0);
+		}
+		if (this._stream === undefined && !(this._source instanceof ReadableStream)) {
+			this._used = true;
+			return body_bytes(this._source);
+		}
+		const stream = this.body;
+		this._used = true;
+		return body_bytes(stream);
+	}
+	async text() {
+		return new TextDecoder().decode(await this._consume());
+	}
+	async json() {
+		return JSON.parse(await this.text());
+	}
+	async arrayBuffer() {
+		const bytes = await this._consume();
+		return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+	}
+	_cloneSource() {
+		if (this.bodyUsed) throw new TypeError('Body is unusable: Body has already been read');
+		if (this._source === null || this._source === undefined) return null;
+		if (this._source instanceof ReadableStream || this._stream !== undefined) {
+			const [kept, copy] = this.body.tee();
+			this._stream = kept;
+			return copy;
+		}
+		return this._source;
+	}
+};
+
+// Request and Response back a render's `event.fetch`. Kit's own
+// `normalize_fetch_input` (runtime/server/fetch.js) turns whatever a component
+// passed into a real Request before deciding what to do with it, and the
+// answer a render's fetch gets back has to be a real Response — `await (await
+// event.fetch(...)).json()` is what a page actually writes. Nothing here sends
+// bytes anywhere: building one is bookkeeping, and the one call that leaves
+// the engine is `__skgo_fetch` itself.
 if (typeof globalThis.Request === 'undefined') {
-	globalThis.Request = class Request {
+	globalThis.Request = class Request extends Body {
 		constructor(input, init = {}) {
-			if (input instanceof Request) {
-				this.url = input.url;
-				this.method = (init.method ?? input.method ?? 'GET').toUpperCase();
-				this.headers = init.headers ? new Headers(init.headers) : new Headers(input.headers);
-				this._body = init.body !== undefined ? init.body : input._body;
-				this.credentials = init.credentials ?? input.credentials ?? 'same-origin';
-				this.mode = init.mode ?? input.mode ?? 'cors';
-			} else {
-				this.url = String(input);
-				this.method = (init.method ?? 'GET').toUpperCase();
-				this.headers = new Headers(init.headers);
-				this._body = init.body;
-				this.credentials = init.credentials ?? 'same-origin';
-				this.mode = init.mode ?? 'cors';
+			super();
+			const from = input instanceof Request ? input : null;
+			this.url = from ? from.url : String(input);
+			this.method = String(init.method ?? from?.method ?? 'GET').toUpperCase();
+			this.headers = new Headers(init.headers ?? from?.headers);
+			this.credentials = init.credentials ?? from?.credentials ?? 'same-origin';
+			this.mode = init.mode ?? from?.mode ?? 'cors';
+			this.cache = init.cache ?? from?.cache ?? 'default';
+			this.signal = init.signal ?? from?.signal ?? undefined;
+			this._used = false;
+			const own = init.body !== undefined && init.body !== null;
+			this._source = own ? init.body : from ? from._cloneSource() : null;
+			if (this._source !== null && (this.method === 'GET' || this.method === 'HEAD')) {
+				throw new TypeError('Request with GET/HEAD method cannot have body.');
+			}
+			if (own && !this.headers.has('content-type')) {
+				if (typeof init.body === 'string') {
+					this.headers.set('content-type', 'text/plain;charset=UTF-8');
+				} else if (typeof URLSearchParams !== 'undefined' && init.body instanceof URLSearchParams) {
+					this.headers.set('content-type', 'application/x-www-form-urlencoded;charset=UTF-8');
+				}
 			}
 		}
-		async text() { return this._body ?? ''; }
-		async json() { return JSON.parse(this._body ?? 'null'); }
-        clone() { return new Request(this); }
+		clone() {
+			return new Request(this);
+		}
 	};
 }
 
 if (typeof globalThis.Response === 'undefined') {
-	globalThis.Response = class Response {
+	globalThis.Response = class Response extends Body {
 		constructor(body, init = {}) {
-			this._body = body ?? '';
+			super();
+			this._source = body ?? null;
+			this._used = false;
 			this.status = init.status ?? 200;
 			this.statusText = init.statusText ?? '';
-			this.headers = init.headers instanceof Headers ? init.headers : new Headers(init.headers);
+			this.headers = new Headers(init.headers);
 			this.ok = this.status >= 200 && this.status < 300;
+			this.url = '';
+			this.redirected = false;
+			this.type = 'default';
 		}
-		async text() { return typeof this._body === 'string' ? this._body : new TextDecoder().decode(this._body); }
-        async json() { return JSON.parse(await this.text()); }
-        async arrayBuffer() { return (typeof this._body === 'string' ? new TextEncoder().encode(this._body) : new Uint8Array(this._body)).buffer; }
 		clone() {
-			return new Response(this._body, { status: this.status, statusText: this.statusText, headers: new Headers(this.headers) });
+			return new Response(this._cloneSource(), {
+				status: this.status,
+				statusText: this.statusText,
+				headers: this.headers
+			});
 		}
 	};
 }

package/skgo-adapter.js

@@ -14,7 +14,7 @@ import { createRequire } from 'node:module';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join, relative, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { gojaDevEnvironment, gojaEnvironment, goEnvironmentValues, nodeTable, SSR_TARGET } from './skgo-adapter/env.js';
+import { gojaDevEnvironment, gojaDevUnchangedFiles, gojaEnvironment, goEnvironmentValues, nodeTable, SSR_TARGET } from './skgo-adapter/env.js';
 import { identity } from './skgo-adapter/identity.js';
 import { checkEndpoints, validateGenerated } from './skgo-adapter/generated.js';
 import { authorizePrerenderedScripts } from './skgo-adapter/prerender-csp.js';
@@ -188,7 +188,7 @@ export default function skgo({ out = 'build', precompress = true } = {}) {
 		// compiles the SSR bundle in is also declared in `vite dev`, where Go
 		// pulls one transformed module at a time out of it instead. Each plugin
 		// states its own `apply`, so only one of them is ever live.
-		vite: { plugins: { post: [environment.plugin, goja.plugin, gojaDevEnvironment()] } },
+		vite: { plugins: { post: [environment.plugin, goja.plugin, gojaDevEnvironment(), gojaDevUnchangedFiles({ out })] } },
 		async adapt(builder) {
 			rmSync(out, { force: true, recursive: true });