@timber-js/app 0.2.0-alpha.21 → 0.2.0-alpha.211

package/dist/adapters/nitro.js

@@ -1,110 +1,105 @@
-import { join, relative } from "node:path";
-import { cp, mkdir, readFile, writeFile } from "node:fs/promises";
+import { t as RSC_CONTENT_TYPE } from "../_chunks/rsc-media-type-DDc7duTD.js";
+import { a as STATIC_CACHE, i as IMMUTABLE_CACHE, n as runSharedBuildSteps, o as adapterBase, r as writeHeadersFile, t as buildStaticDirectoryOutput } from "../_chunks/build-output-helper-RV_BRcF1.js";
+import { transformWithOxc } from "vite";
+import { basename, dirname, join, relative, sep } from "node:path";
+import { existsSync } from "node:fs";
+import { cp, glob, readFile, writeFile } from "node:fs/promises";
 import { execFile } from "node:child_process";
+//#region src/server/compress.ts?raw
+var compress_default = "// Response compression for self-hosted deployments (dev server, Nitro preview).\n//\n// Uses CompressionStream (Web Platform API) for gzip. Brotli is intentionally\n// left to CDNs and reverse proxies — at streaming-friendly quality levels its\n// ratio advantage is marginal, and node:zlib's brotli transform buffers output\n// internally, breaking streaming. Cloudflare Workers auto-compress at the edge —\n// this module is only used on Node.js/Bun.\n//\n// See design/25-production-deployments.md.\n//\n// This module is also emitted standalone as `_compress.mjs` by\n// `adapters/compress-module.ts`, which strips types but does not bundle. Its\n// imports must therefore be interpolated there — a new import that is not\n// fails the build with an explanatory error rather than resolving to nothing\n// on the deployed server.\n\nimport { RSC_CONTENT_TYPE } from '../shared/rsc-media-type.ts';\n\n// ─── Constants ────────────────────────────────────────────────────────────\n\n/**\n * MIME types that benefit from compression.\n * text/* is handled via prefix matching; these are the specific\n * application/* and image/* types that are compressible.\n */\nexport const COMPRESSIBLE_TYPES = new Set([\n  'text/html',\n  'text/css',\n  'text/plain',\n  'text/xml',\n  'text/javascript',\n  RSC_CONTENT_TYPE,\n  'application/json',\n  'application/javascript',\n  'application/xml',\n  'application/xhtml+xml',\n  'application/rss+xml',\n  'application/atom+xml',\n  'image/svg+xml',\n]);\n\n/**\n * Status codes that should never be compressed (no body or special semantics).\n */\nconst NO_COMPRESS_STATUSES = new Set([204, 304]);\n\n// ─── Encoding Negotiation ─────────────────────────────────────────────────\n\n/**\n * Parse Accept-Encoding and return the best supported encoding.\n * Returns 'gzip' if the client accepts it, null otherwise.\n *\n * Brotli (br) is intentionally not handled at the application level.\n * At the streaming-friendly quality levels (0–4), brotli's compression\n * ratio advantage over gzip is marginal, and node:zlib's brotli transform\n * buffers output internally — turning smooth streaming responses into\n * large infrequent bursts. Brotli's real wins come from offline/static\n * compression at higher quality levels (5–11), which CDNs and reverse\n * proxies (Cloudflare, nginx, Caddy) apply on cached responses.\n *\n * See design/25-production-deployments.md.\n */\nexport function negotiateEncoding(acceptEncoding: string): 'gzip' | null {\n  if (!acceptEncoding) return null;\n\n  // Parse tokens with quality values from the Accept-Encoding header.\n  // Per RFC 9110 §12.5.3, q=0 means \"not acceptable\" — the client explicitly\n  // rejects that encoding. Tokens without a q-value default to q=1.\n  // e.g. \"gzip;q=1.0, br;q=0\" → gzip is acceptable, br is rejected.\n  const parts = acceptEncoding.split(',');\n  for (const part of parts) {\n    const [token, ...params] = part.split(';');\n    const name = token.trim().toLowerCase();\n    if (name !== 'gzip') continue;\n\n    // Check for q=0 (explicitly disabled)\n    let qValue = 1; // default quality is 1\n    for (const param of params) {\n      const trimmed = param.trim().toLowerCase();\n      if (trimmed.startsWith('q=')) {\n        qValue = parseFloat(trimmed.slice(2));\n        if (Number.isNaN(qValue)) qValue = 1;\n        break;\n      }\n    }\n\n    if (qValue > 0) return 'gzip';\n  }\n\n  return null;\n}\n\n// ─── Compressibility Check ────────────────────────────────────────────────\n\n/**\n * Determine if a response should be compressed.\n *\n * Returns false for:\n * - Responses without a body (204, 304, null body)\n * - Already-encoded responses (Content-Encoding set)\n * - Non-compressible content types (images, binary)\n * - SSE streams (text/event-stream — must not be buffered)\n */\nexport function shouldCompress(response: Response): boolean {\n  // No body to compress\n  if (!response.body) return false;\n  if (NO_COMPRESS_STATUSES.has(response.status)) return false;\n\n  // Already compressed\n  if (response.headers.has('Content-Encoding')) return false;\n\n  // Check content type\n  const contentType = response.headers.get('Content-Type');\n  if (!contentType) return false;\n\n  // Extract the MIME type (strip charset and other parameters)\n  const mimeType = contentType.split(';')[0].trim().toLowerCase();\n\n  // SSE must not be compressed — it relies on chunk-by-chunk delivery\n  if (mimeType === 'text/event-stream') return false;\n\n  return COMPRESSIBLE_TYPES.has(mimeType);\n}\n\n// ─── Compression ──────────────────────────────────────────────────────────\n\n/**\n * Compress a Web Response if the client supports it and the content is compressible.\n *\n * Returns the original response unchanged if compression is not applicable.\n * Returns a new Response with the compressed body, Content-Encoding, and Vary headers.\n *\n * The body is piped through a compression stream — no buffering of the full response.\n * This preserves streaming behavior for HTML shell + deferred Suspense chunks.\n */\nexport function compressResponse(request: Request, response: Response): Response {\n  // Check if response is compressible\n  if (!shouldCompress(response)) return response;\n\n  // Negotiate encoding with the client\n  const acceptEncoding = request.headers.get('Accept-Encoding') ?? '';\n  const encoding = negotiateEncoding(acceptEncoding);\n  if (!encoding) return response;\n\n  // Compress the body stream with gzip via the Web Platform CompressionStream API.\n  const compressedBody = compressWithGzip(response.body!);\n\n  // Build new headers: copy originals, add compression headers, remove Content-Length\n  // (compressed size is unknown until streaming completes).\n  const headers = new Headers(response.headers);\n  headers.set('Content-Encoding', encoding);\n  headers.delete('Content-Length');\n\n  // Append to Vary header (preserve existing Vary values)\n  const existingVary = headers.get('Vary');\n  if (existingVary) {\n    if (!existingVary.toLowerCase().includes('accept-encoding')) {\n      headers.set('Vary', `${existingVary}, Accept-Encoding`);\n    }\n  } else {\n    headers.set('Vary', 'Accept-Encoding');\n  }\n\n  return new Response(compressedBody, {\n    status: response.status,\n    statusText: response.statusText,\n    headers,\n  });\n}\n\n// ─── Gzip (node:zlib with Z_SYNC_FLUSH) ──────────────────────────────────\n//\n// Uses node:zlib's createGzip with Z_SYNC_FLUSH so each chunk is flushed\n// to the output immediately. The Web Platform CompressionStream API buffers\n// internally and does NOT flush per-chunk — this kills streaming because\n// the browser doesn't receive the HTML shell until the gzip stream closes\n// (i.e. after all Suspense boundaries resolve).\n//\n// Z_SYNC_FLUSH adds ~2–5% size overhead vs Z_NO_FLUSH but preserves\n// correct streaming behavior: the shell renders instantly, Suspense\n// fallbacks are visible immediately, and streamed content appears\n// progressively.\n\nimport { createGzip, constants } from 'node:zlib';\nimport { Readable, pipeline } from 'node:stream';\n\n/**\n * Compress a ReadableStream with gzip, flushing each chunk immediately.\n *\n * Uses node:zlib's createGzip with Z_SYNC_FLUSH to ensure each HTML chunk\n * (shell, Suspense resolution, RSC payload) is delivered to the browser\n * as soon as it's available — preserving streaming semantics.\n */\nfunction compressWithGzip(body: ReadableStream<Uint8Array>): ReadableStream<Uint8Array> {\n  const gzip = createGzip({ flush: constants.Z_SYNC_FLUSH });\n  const nodeInput = Readable.fromWeb(body as import('stream/web').ReadableStream);\n\n  // pipeline() instead of bare pipe(): pipe() does not forward source errors,\n  // so an erroring body (streaming route handler, dropped upstream fetch)\n  // would emit an unhandled 'error' event and crash the process. pipeline()\n  // destroys gzip on source error — the returned web stream rejects — and\n  // tears down nodeInput when the consumer cancels the web stream, which\n  // cancels the source body via fromWeb. The error reaches the consumer\n  // through the web stream; the callback only marks it handled at the Node\n  // layer.\n  pipeline(nodeInput, gzip, () => {});\n\n  return Readable.toWeb(gzip) as ReadableStream<Uint8Array>;\n}\n";
+//#endregion
 //#region src/adapters/compress-module.ts
 /**
-* Generate a standalone ESM module that exports compressResponse().
+* The one import `server/compress.ts` is allowed to carry, and its inlined
+* form.
+*
+* The binding list is matched exactly rather than as `{…}`. A second binding
+* added to that import would otherwise be erased along with the statement and
+* become a `ReferenceError` in the deployed `_compress.mjs` — the failure this
+* whole module exists to make impossible. Matching exactly means such an
+* import falls through to the rejection below instead.
+*/
+var INLINED_IMPORTS = [{
+	pattern: /^import\s*\{\s*RSC_CONTENT_TYPE\s*,?\s*\}\s*from\s*["'][^"']*shared\/rsc-media-type\.(?:js|ts)["'];?[ \t]*$/m,
+	replacement: `const RSC_CONTENT_TYPE = ${JSON.stringify(RSC_CONTENT_TYPE)};`
+}];
+/**
+* Every way a module specifier can reach the emitted file, minus Node
+* builtins.
 *
-* Written to `_compress.mjs` during buildOutput. Imported by the Nitro entry
-* and preview server.
+* `node:*` is exempt because it resolves on the deployed server exactly as it
+* does here — `_compress.mjs` already imports `node:zlib` and `node:stream`,
+* and self-hosted (Node/Bun) is the only place this file runs. Everything
+* else — relative paths, bare packages — has no resolution target next to a
+* lone `.mjs` in the build output.
+*
+* All three forms are listed rather than the one `server/compress.ts` happens
+* to use, because a re-export or a lazy `await import()` fails in exactly the
+* same place and is exactly as invisible until deploy.
+*/
+var MODULE_SPECIFIERS = [
+	/^[ \t]*(?:import|export)\b[^\n]*\bfrom\s*["'](?!node:)[^"']+["']/m,
+	/^[ \t]*import\s*["'](?!node:)[^"']+["']/m,
+	/\bimport\s*\(\s*["'](?!node:)[^"']+["']/
+];
+/**
+* Replace the shared-module imports with their values and reject anything
+* else that would leave a dangling specifier in `_compress.mjs`.
+*
+* Exported separately from `generateCompressModule` so both branches can be
+* driven with fixtures: the source it normally compiles is fixed, so a test
+* of the generator alone can only ever exercise whichever branch that source
+* happens to take today.
 *
 * @internal Exported for testing.
 */
-function generateCompressModule() {
-	return `// Generated by @timber-js/app — response compression for self-hosted deployments.
-// Do not edit — this file is regenerated on each build.
-// Uses CompressionStream (Web API) for gzip. Brotli is left to CDNs/reverse
-// proxies — at streaming quality levels its ratio advantage is marginal and
-// node:zlib buffers output internally, breaking streaming.
-
-const COMPRESSIBLE_TYPES = new Set([
-  'text/html', 'text/css', 'text/plain', 'text/xml', 'text/javascript',
-  'text/x-component', 'application/json', 'application/javascript',
-  'application/xml', 'application/xhtml+xml', 'application/rss+xml',
-  'application/atom+xml', 'image/svg+xml',
-]);
-
-const NO_COMPRESS_STATUSES = new Set([204, 304]);
-
-function negotiateEncoding(acceptEncoding) {
-  if (!acceptEncoding) return null;
-  // Parse tokens with quality values. Per RFC 9110 §12.5.3, q=0 means
-  // "not acceptable" — the client explicitly rejects that encoding.
-  // Brotli (br) is intentionally not handled at the application level.
-  const parts = acceptEncoding.split(',');
-  for (const part of parts) {
-    const [token, ...params] = part.split(';');
-    const name = token.trim().toLowerCase();
-    if (name !== 'gzip') continue;
-    let qValue = 1;
-    for (const param of params) {
-      const trimmed = param.trim().toLowerCase();
-      if (trimmed.startsWith('q=')) {
-        qValue = parseFloat(trimmed.slice(2));
-        if (Number.isNaN(qValue)) qValue = 1;
-        break;
-      }
-    }
-    if (qValue > 0) return 'gzip';
-  }
-  return null;
+function inlineCompressImports(code) {
+	let out = code;
+	for (const { pattern, replacement } of INLINED_IMPORTS) out = out.replace(pattern, replacement);
+	assertStandalone(out, "server/compress.ts", "_compress.mjs");
+	return out;
 }
-
-function shouldCompress(response) {
-  if (!response.body) return false;
-  if (NO_COMPRESS_STATUSES.has(response.status)) return false;
-  if (response.headers.has('Content-Encoding')) return false;
-  const contentType = response.headers.get('Content-Type');
-  if (!contentType) return false;
-  const mimeType = contentType.split(';')[0].trim().toLowerCase();
-  if (mimeType === 'text/event-stream') return false;
-  return COMPRESSIBLE_TYPES.has(mimeType);
-}
-
-function compressWithGzip(body) {
-  return body.pipeThrough(new CompressionStream('gzip'));
-}
-
-export function compressResponse(request, response) {
-  if (!shouldCompress(response)) return response;
-  const acceptEncoding = request.headers.get('Accept-Encoding') || '';
-  const encoding = negotiateEncoding(acceptEncoding);
-  if (!encoding) return response;
-  const compressedBody = compressWithGzip(response.body);
-  const headers = new Headers(response.headers);
-  headers.set('Content-Encoding', encoding);
-  headers.delete('Content-Length');
-  const existingVary = headers.get('Vary');
-  if (existingVary) {
-    if (!existingVary.toLowerCase().includes('accept-encoding')) {
-      headers.set('Vary', existingVary + ', Accept-Encoding');
-    }
-  } else {
-    headers.set('Vary', 'Accept-Encoding');
-  }
-  return new Response(compressedBody, {
-    status: response.status,
-    statusText: response.statusText,
-    headers,
-  });
+/**
+* Throw if type-stripped server source still imports anything but a Node
+* builtin. Such a module is emitted alone into the build output, where no
+* specifier has anything to resolve to.
+*
+* @internal Shared by the standalone-module generators.
+*/
+function assertStandalone(code, source, emitted) {
+	const surviving = MODULE_SPECIFIERS.map((pattern) => pattern.exec(code)).find(Boolean);
+	if (surviving) throw new Error(`[timber] ${source} is emitted as a standalone ${emitted} (type-stripped, not bundled), so it cannot import anything at runtime. Found: ${surviving[0].trim()}\n  Either inline the value in the generator in adapters/ or keep the dependency out of ${source}.`);
 }
-`;
+/**
+* Compile server/compress.ts into a standalone ESM module.
+*
+* Uses Vite's OXC transform to strip TypeScript types from the
+* embedded source. The result is written to `_compress.mjs` during
+* buildOutput.
+*
+* @internal Exported for testing.
+*/
+async function generateCompressModule() {
+	return "// Generated by @timber-js/app — compiled from server/compress.ts.\n// Do not edit — this file is regenerated on each build.\n" + inlineCompressImports((await transformWithOxc(compress_default, "compress.ts", { lang: "ts" })).code);
 }
 //#endregion
-//#region src/adapters/nitro.ts
-var IMMUTABLE_CACHE = "public, max-age=31536000, immutable";
-var STATIC_CACHE = "public, max-age=3600, must-revalidate";
-function generateHeadersFile() {
-	return `# Auto-generated by @timber-js/app — static asset cache headers.
-# See design/25-production-deployments.md §"CDN / Edge Cache"
-
-/assets/*
-  Cache-Control: ${IMMUTABLE_CACHE}
-
-/*
-  Cache-Control: ${STATIC_CACHE}
-`;
+//#region src/server/canonicalize.ts?raw
+var canonicalize_default = "/**\n * URL canonicalization — runs once at the request boundary.\n *\n * Every layer (proxy.ts, middleware.ts, access.ts, components) sees the same\n * canonical path. No re-decoding occurs at any later stage.\n *\n * See design/07-routing.md §\"URL Canonicalization & Security\"\n */\n\n/** Result of canonicalization — either a clean path or a rejection. */\nexport type CanonicalizeResult = { ok: true; pathname: string } | { ok: false; status: 400 };\n\n/**\n * Encoded separators that produce a 400 rejection.\n * %2f (/) and %5c (\\) cause path-confusion attacks.\n *\n * Shared between the runtime canonicalizer and the build-time route scanner\n * to ensure both enforce identical security rules. See design/13-security.md.\n */\nexport const ENCODED_SEPARATOR_RE = /%2f|%5c/i;\n\n/** Null byte — rejected. Shared with the route scanner. */\nexport const NULL_BYTE_RE = /%00/i;\n\n/**\n * Canonicalize a URL pathname.\n *\n * 1. Reject encoded separators (%2f, %5c) and null bytes (%00)\n * 2. Single percent-decode\n * 3. Collapse // → /\n * 4. Resolve .. segments (reject if escaping root)\n * 5. Strip trailing slash (except root \"/\")\n *\n * @param rawPathname - The raw pathname from the request URL (percent-encoded)\n * @param stripTrailingSlash - Whether to strip trailing slashes. Default: true.\n */\nexport function canonicalize(rawPathname: string, stripTrailingSlash = true): CanonicalizeResult {\n  // Step 1: Reject dangerous encoded sequences BEFORE decoding.\n  // This must happen on the raw input so %252f doesn't bypass after a single decode.\n  if (ENCODED_SEPARATOR_RE.test(rawPathname)) {\n    return { ok: false, status: 400 };\n  }\n  if (NULL_BYTE_RE.test(rawPathname)) {\n    return { ok: false, status: 400 };\n  }\n\n  // Step 2: Single percent-decode.\n  // Double-encoded input (%2561 → %61) stays as %61 — not decoded again.\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(rawPathname);\n  } catch {\n    // Malformed percent-encoding → 400\n    return { ok: false, status: 400 };\n  }\n\n  // Reject null bytes that appeared after decoding (from valid %00-like sequences\n  // that weren't caught above — belt and suspenders).\n  if (decoded.includes('\\0')) {\n    return { ok: false, status: 400 };\n  }\n\n  // Backslash is NOT a path separator — keep as literal character.\n  // But reject if it would create // after normalization (e.g., /\\evil.com).\n  // We do NOT convert \\ to / — it stays as a literal.\n\n  // Step 3: Collapse consecutive slashes.\n  let pathname = decoded.replace(/\\/\\/+/g, '/');\n\n  // Step 4: Resolve .. and . segments.\n  const segments = pathname.split('/');\n  const resolved: string[] = [];\n  for (const seg of segments) {\n    if (seg === '..') {\n      if (resolved.length <= 1) {\n        // Trying to escape root — 400\n        return { ok: false, status: 400 };\n      }\n      resolved.pop();\n    } else if (seg !== '.') {\n      resolved.push(seg);\n    }\n  }\n\n  pathname = resolved.join('/') || '/';\n\n  // Step 5: Strip trailing slash (except root \"/\").\n  if (stripTrailingSlash && pathname.length > 1 && pathname.endsWith('/')) {\n    pathname = pathname.slice(0, -1);\n  }\n\n  return { ok: true, pathname };\n}\n";
+//#endregion
+//#region src/adapters/canonicalize-module.ts
+/**
+* Compile server/canonicalize.ts into a standalone ESM module exporting
+* `canonicalize`.
+*
+* @internal Exported for testing.
+*/
+async function generateCanonicalizeModule() {
+	const result = await transformWithOxc(canonicalize_default, "canonicalize.ts", { lang: "ts" });
+	assertStandalone(result.code, "server/canonicalize.ts", "_canonicalize.mjs");
+	return "// Generated by @timber-js/app — compiled from server/canonicalize.ts.\n// Do not edit — this file is regenerated on each build.\n" + result.code;
 }
+//#endregion
+//#region src/adapters/nitro-presets.ts
 var PRESET_CONFIGS = {
 	"vercel": {
 		nitroPreset: "vercel",
@@ -171,6 +166,409 @@ var PRESET_CONFIGS = {
 		runtimeName: "bun"
 	}
 };
+/** Presets that produce a locally-runnable server entry. */
+var LOCALLY_PREVIEWABLE = /* @__PURE__ */ new Set(["node-server", "bun"]);
+//#endregion
+//#region src/adapters/nitro-preview.ts
+/**
+* Content-Type by file extension for the preview server. Static hosts decide
+* this themselves; the table covers the file types a web build ships so the
+* preview does not turn ordinary files into downloads. An extension missing
+* here is served as `application/octet-stream`.
+*/
+var PREVIEW_MIME_TYPES = {
+	".html": "text/html; charset=utf-8",
+	".htm": "text/html; charset=utf-8",
+	".css": "text/css; charset=utf-8",
+	".js": "text/javascript; charset=utf-8",
+	".mjs": "text/javascript; charset=utf-8",
+	".cjs": "text/javascript; charset=utf-8",
+	".map": "application/json; charset=utf-8",
+	".json": "application/json; charset=utf-8",
+	".jsonld": "application/ld+json",
+	".webmanifest": "application/manifest+json",
+	".xml": "application/xml",
+	".rss": "application/rss+xml",
+	".atom": "application/atom+xml",
+	".txt": "text/plain; charset=utf-8",
+	".md": "text/markdown; charset=utf-8",
+	".csv": "text/csv; charset=utf-8",
+	".ics": "text/calendar; charset=utf-8",
+	".vtt": "text/vtt; charset=utf-8",
+	".pdf": "application/pdf",
+	".wasm": "application/wasm",
+	".zip": "application/zip",
+	".gz": "application/gzip",
+	".png": "image/png",
+	".apng": "image/apng",
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".gif": "image/gif",
+	".svg": "image/svg+xml",
+	".ico": "image/x-icon",
+	".webp": "image/webp",
+	".avif": "image/avif",
+	".bmp": "image/bmp",
+	".tif": "image/tiff",
+	".tiff": "image/tiff",
+	".woff": "font/woff",
+	".woff2": "font/woff2",
+	".ttf": "font/ttf",
+	".otf": "font/otf",
+	".mp3": "audio/mpeg",
+	".wav": "audio/wav",
+	".ogg": "audio/ogg",
+	".oga": "audio/ogg",
+	".m4a": "audio/mp4",
+	".flac": "audio/flac",
+	".mp4": "video/mp4",
+	".webm": "video/webm",
+	".ogv": "video/ogg",
+	".mov": "video/quicktime"
+};
+/**
+* Generate a standalone preview server script that uses Node's built-in
+* HTTP server. This bypasses Nitro entirely — the Nitro entry.ts imports
+* h3 which isn't available outside a Nitro build. For local preview we
+* just need to serve static files and, in a server build, route requests
+* to the RSC handler.
+*
+* Generated at build time rather than at preview time, so everything it
+* serves comes from the build's artifacts instead of guesses about the
+* directory it runs in.
+*
+* @internal Exported for testing.
+*/
+function generatePreviewScript(options) {
+	const immutablePrefixes = options.immutableDirs.map((dir) => `/${dir}/`);
+	const contentTypes = options.output === "static" ? options.contentTypes : {};
+	const handlerSetup = options.output === "server" ? `// Set runtime before importing the handler.
+process.env.TIMBER_RUNTIME = ${JSON.stringify(options.runtimeName)};
+${options.hasManifestInit ? `
+// Load the build manifest before the handler reads it.
+await import('./_timber-manifest-init.js');
+` : ""}
+// Import the RSC handler (default export is the fetch-like handler).
+const { default: handler, runWithEarlyHintsSender } = await import(${JSON.stringify(options.rscEntry)});
+
+// Import compression helper for self-hosted response compression.
+const { compressResponse } = await import('./_compress.mjs');
+
+// Web→Node response bridge with backpressure (TIM-1154).
+const { sendNodeResponse } = await import('./_send-response.mjs');
+` : "";
+	const fallback = options.output === "static" ? `  if (badPath) {
+    res.writeHead(400, { 'Content-Type': 'text/plain' });
+    res.end('Bad Request');
+    return;
+  }
+  const notFound = await findFile('/404.html');
+  if (notFound) {
+    await sendFile(req, res, notFound, 404, 'text/html', 'public, max-age=0, must-revalidate');
+    return;
+  }
+  res.writeHead(404, { 'Content-Type': 'text/plain' });
+  res.end('Not Found');
+` : `  await handleDynamic(req, res, url);
+`;
+	const dynamicHandler = options.output === "server" ? `
+async function handleDynamic(req, res, url) {
+  // Convert Node request to Web Request.
+  const headers = new Headers();
+  for (const [key, value] of Object.entries(req.headers)) {
+    if (value) {
+      if (Array.isArray(value)) {
+        for (const v of value) headers.append(key, v);
+      } else {
+        headers.set(key, value);
+      }
+    }
+  }
+
+  let body = undefined;
+  if (req.method !== 'GET' && req.method !== 'HEAD') {
+    body = await new Promise((resolve) => {
+      const chunks = [];
+      req.on('data', (chunk) => chunks.push(chunk));
+      req.on('end', () => resolve(Buffer.concat(chunks)));
+    });
+  }
+
+  const webRequest = new Request(url.href, {
+    method: req.method,
+    headers,
+    body,
+    duplex: body ? 'half' : undefined,
+  });
+
+  try {
+    // Support 103 Early Hints when available.
+    const earlyHintsSender = (typeof res.writeEarlyHints === 'function')
+      ? (links) => { try { res.writeEarlyHints({ link: links }); } catch {} }
+      : undefined;
+
+    const rawResponse = earlyHintsSender && runWithEarlyHintsSender
+      ? await runWithEarlyHintsSender(earlyHintsSender, () => handler(webRequest))
+      : await handler(webRequest);
+
+    // Compress the response for self-hosted deployments.
+    const webResponse = compressResponse(webRequest, rawResponse);
+
+    // Write the response to Node's ServerResponse. sendNodeResponse handles
+    // status, headers (including Set-Cookie splitting via [...headers]),
+    // body streaming with backpressure, and client disconnect cleanup.
+    // See TIM-1154.
+    await sendNodeResponse(res, webResponse);
+  } catch (err) {
+    console.error('[timber preview] Request error:', err);
+    if (!res.headersSent) {
+      res.writeHead(500, { 'Content-Type': 'text/plain' });
+    }
+    res.end('Internal Server Error');
+  }
+}
+` : "";
+	return `// Generated by @timber-js/app — standalone preview server.
+// Do not edit — this file is regenerated on each build.
+// Uses Node's built-in HTTP server to serve the build's files${options.output === "server" ? " and route\n// dynamic requests through the RSC handler" : ""}. No Nitro/h3 dependency.
+
+import { createServer } from 'node:http';
+import { readFile, stat } from 'node:fs/promises';
+import { join, extname, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { canonicalize } from './_canonicalize.mjs';
+
+const __dirname = fileURLToPath(new URL('.', import.meta.url));
+
+${handlerSetup}
+const MIME_TYPES = ${JSON.stringify(PREVIEW_MIME_TYPES, null, 2)};
+
+// Recorded by the build: content-hashed directories, and the Content-Type of
+// each extensionless API route output (a file name cannot say it). Both are
+// decoded route-space paths, matched against the decoded request path.
+const IMMUTABLE_PREFIXES = ${JSON.stringify(immutablePrefixes)};
+const BASE = ${JSON.stringify(options.base)};
+const CONTENT_TYPES = ${JSON.stringify(contentTypes)};
+const SERVE_DIRECTORY_INDEX = ${options.output === "static"};
+
+const publicDir = join(__dirname, 'public');
+
+/**
+ * The file under publicDir that a decoded URL path names, or null. A static
+ * build lays its pages out as <path>/index.html, so a directory serves its
+ * index there.
+ */
+async function findFile(pathname) {
+  const filePath = join(publicDir, pathname);
+  // Prevent path traversal (and a sibling like public-other/ passing a bare
+  // prefix check).
+  if (!filePath.startsWith(publicDir + sep)) return null;
+  try {
+    const fileStat = await stat(filePath);
+    if (fileStat.isFile()) return filePath;
+    if (SERVE_DIRECTORY_INDEX && fileStat.isDirectory()) {
+      const index = join(filePath, 'index.html');
+      if ((await stat(index)).isFile()) return index;
+    }
+  } catch {
+    // Not found.
+  }
+  return null;
+}
+
+/**
+ * The route-space path for a request path, or null when the request is
+ * outside the deployment base (it names no file of this build).
+ */
+function stripBase(pathname) {
+  if (BASE === '/') return pathname;
+  if (pathname === BASE.slice(0, -1)) return '/';
+  if (!pathname.startsWith(BASE)) return null;
+  return pathname.slice(BASE.length - 1);
+}
+
+async function sendFile(req, res, filePath, status, contentType, cacheControl) {
+  const body = await readFile(filePath);
+  res.writeHead(status, {
+    'Content-Type': contentType,
+    'Content-Length': body.length,
+    'Cache-Control': cacheControl,
+  });
+  res.end(req.method === 'HEAD' ? undefined : body);
+}
+${dynamicHandler}
+// Port resolution (TIM-842):
+//   - Default to 3000
+//   - If PORT env var is set, honor it strictly (fail loudly on conflict)
+//   - Otherwise auto-bump from 3000 until a free port is found
+// Mirrors the dev server behavior so timber dev/preview/production all
+// behave the same way around port selection.
+const envPort = process.env.PORT ? parseInt(process.env.PORT, 10) : null;
+const portIsExplicit = envPort != null && Number.isFinite(envPort) && envPort > 0;
+const startPort = portIsExplicit ? envPort : 3000;
+const host = process.env.HOST || 'localhost';
+
+// Set after listenWithBump() resolves so request handlers can build
+// absolute URLs from the actual bound port (which may differ from
+// startPort after an auto-bump).
+let boundPort = startPort;
+
+const server = createServer(async (req, res) => {
+  // Scheme from the socket's TLS state — a hardcoded http:// breaks CSRF
+  // origin comparison and absolute-URL construction when TLS is terminated
+  // at this server (TIM-1073; mirrors the dev-server fix in TIM-1067).
+  // X-Forwarded-Proto is intentionally not consulted here: on a direct
+  // connection it would be attacker-controlled. The CSRF layer honors it
+  // separately for reverse-proxy deployments.
+  const scheme = req.socket?.encrypted ? 'https' : 'http';
+  const url = new URL(req.url || '/', \`\${scheme}://\${host}:\${boundPort}\`);
+
+  // The runtime's own request-boundary canonicalizer (_canonicalize.mjs,
+  // compiled from server/canonicalize.ts): one decode, and the same 400s for
+  // encoded separators, null bytes, malformed encoding, and escaping the root
+  // (design/13-security.md). The base is stripped from its canonical result,
+  // so an encoded spelling of the base is the same path. What remains, in
+  // route space, is looked up in public/; null names no file.
+  const canonical = canonicalize(url.pathname, false);
+  const badPath = !canonical.ok;
+  const pathname = canonical.ok ? stripBase(canonical.pathname) : null;
+  const filePath = pathname === null ? null : await findFile(pathname);
+  if (filePath) {
+    const contentType =
+      CONTENT_TYPES[pathname] || MIME_TYPES[extname(filePath).toLowerCase()] || 'application/octet-stream';
+    // Hashed assets get immutable cache, others get short cache.
+    const isImmutable = IMMUTABLE_PREFIXES.some((prefix) => pathname.startsWith(prefix));
+    const cacheControl = isImmutable ? ${JSON.stringify(IMMUTABLE_CACHE)} : ${JSON.stringify(STATIC_CACHE)};
+    await sendFile(req, res, filePath, 200, contentType, cacheControl);
+    return;
+  }
+
+${fallback}});
+
+function listenWithBump(port, attempt = 0) {
+  return new Promise((resolveListen, rejectListen) => {
+    const onError = (err) => {
+      server.removeListener('listening', onListening);
+      if (err && err.code === 'EADDRINUSE' && !portIsExplicit && attempt < 100) {
+        if (attempt === 0) {
+          console.log(\`  [timber] Port \${port} in use, trying \${port + 1}...\`);
+        }
+        listenWithBump(port + 1, attempt + 1).then(resolveListen, rejectListen);
+        return;
+      }
+      rejectListen(err);
+    };
+    const onListening = () => {
+      server.removeListener('error', onError);
+      resolveListen(port);
+    };
+    server.once('error', onError);
+    server.once('listening', onListening);
+    server.listen(port, host);
+  });
+}
+
+try {
+  boundPort = await listenWithBump(startPort);
+  if (boundPort !== startPort) {
+    console.log();
+    console.log(\`  [timber] Port \${startPort} in use, using \${boundPort}\`);
+  }
+  console.log();
+  console.log('  ⚡ timber preview server running at:');
+  console.log();
+  console.log(\`    ➜  http://\${host}:\${boundPort}\`);
+  console.log();
+} catch (err) {
+  if (err && err.code === 'EADDRINUSE') {
+    console.error(\`[timber] Port \${startPort} is already in use. \` +
+      'Set PORT to a free port, or unset PORT to auto-pick.');
+  } else {
+    console.error('[timber] Failed to start preview server:', err);
+  }
+  process.exit(1);
+}
+`;
+}
+/** Spawn a Nitro preview process and pipe stdio. */
+function spawnNitroPreview(command, args, cwd) {
+	return new Promise((resolve, reject) => {
+		const child = execFile(command, args, { cwd }, (err) => {
+			if (err) reject(err);
+			else resolve();
+		});
+		child.stdout?.pipe(process.stdout);
+		child.stderr?.pipe(process.stderr);
+	});
+}
+/**
+* Generate a standalone ESM module that exports sendNodeResponse.
+*
+* Mirrors srvx/node's sendNodeResponse: status + headers via writeHead,
+* body streaming with backpressure (waits for drain on write() === false),
+* and client disconnect cleanup. Written to `_send-response.mjs` during
+* buildOutput for use by the preview server script. See TIM-1154.
+*
+* @internal Exported for testing.
+*/
+function generateSendResponseModule() {
+	return `// Generated by @timber-js/app — Web→Node response bridge.
+// Do not edit — this file is regenerated on each build.
+// Mirrors srvx/node's sendNodeResponse with backpressure support.
+
+export function sendNodeResponse(nodeRes, webRes) {
+  if (!webRes) {
+    nodeRes.statusCode = 500;
+    return new Promise((resolve) => nodeRes.end(resolve));
+  }
+  const rawHeaders = [...webRes.headers];
+  const writeHeaders = rawHeaders.flat();
+  if (!nodeRes.headersSent) {
+    if (nodeRes.req?.httpVersion === '2.0') {
+      nodeRes.writeHead(webRes.status, writeHeaders);
+    } else {
+      nodeRes.writeHead(webRes.status, webRes.statusText, writeHeaders);
+    }
+  }
+  if (!webRes.body) {
+    return new Promise((resolve) => nodeRes.end(resolve));
+  }
+  // Stream with backpressure: pause reading when the kernel buffer is
+  // full (write() returns false) and resume on 'drain'.
+  if (nodeRes.destroyed) {
+    webRes.body.cancel();
+    return;
+  }
+  const reader = webRes.body.getReader();
+  function streamCancel(error) {
+    reader.cancel(error).catch(() => {});
+    if (error) nodeRes.destroy(error);
+  }
+  function streamHandle({ done, value }) {
+    try {
+      if (done) {
+        nodeRes.end();
+      } else if (nodeRes.write(value)) {
+        reader.read().then(streamHandle, streamCancel);
+      } else {
+        nodeRes.once('drain', () => reader.read().then(streamHandle, streamCancel));
+      }
+    } catch (error) {
+      streamCancel(error instanceof Error ? error : undefined);
+    }
+  }
+  nodeRes.on('close', streamCancel);
+  nodeRes.on('error', streamCancel);
+  reader.read().then(streamHandle, streamCancel);
+  return reader.closed.catch(streamCancel).finally(() => {
+    nodeRes.off('close', streamCancel);
+    nodeRes.off('error', streamCancel);
+  });
+}
+`;
+}
+//#endregion
+//#region src/adapters/nitro.ts
 /**
 * Create a Nitro-based adapter for multi-platform deployment.
 *
@@ -190,50 +588,82 @@ var PRESET_CONFIGS = {
 function nitro(options = {}) {
 	const preset = options.preset ?? "node-server";
 	const compress = options.compress ?? true;
-	const presetConfig = PRESET_CONFIGS[preset];
-	const pendingPromises = [];
 	return {
 		name: `nitro-${preset}`,
-		async buildOutput(config, buildDir) {
-			const outDir = join(buildDir, "nitro");
-			await mkdir(outDir, { recursive: true });
-			const clientDir = join(buildDir, "client");
-			const publicDir = join(outDir, "public");
-			await mkdir(publicDir, { recursive: true });
-			await cp(clientDir, publicDir, {
-				recursive: true,
-				filter: config.clientJavascriptDisabled ? (src) => !src.endsWith(".js") : void 0
-			}).catch(() => {});
-			await writeFile(join(publicDir, "_headers"), generateHeadersFile());
-			if (config.manifestInit) await writeFile(join(outDir, "_timber-manifest-init.js"), config.manifestInit);
-			await writeFile(join(outDir, "_compress.mjs"), generateCompressModule());
-			await cp(join(buildDir, "rsc"), join(outDir, "rsc"), { recursive: true });
-			await cp(join(buildDir, "ssr"), join(outDir, "ssr"), { recursive: true }).catch(() => {});
-			if (config.manifestInit) {
+		async buildOutput(config, artifacts) {
+			const outDir = join(artifacts.outputDir, "nitro");
+			if (artifacts.output === "static") {
+				await buildStaticDirectoryOutput(config, artifacts, outDir, "public");
+				const publicDir = join(outDir, "public");
+				await writeHeadersFile(publicDir, config, artifacts);
+				await writeFile(join(outDir, CANONICALIZE_MODULE), await generateCanonicalizeModule());
+				await writeFile(join(outDir, PREVIEW_SCRIPT), generatePreviewScript({
+					output: "static",
+					immutableDirs: artifacts.immutableDirs,
+					base: adapterBase(config),
+					contentTypes: artifacts.contentTypes
+				}));
+				if ((options.staticTarget ?? "generic") === "github-pages") {
+					await writeFile(join(publicDir, ".nojekyll"), "");
+					try {
+						if ((await readFile(join(publicDir, "_redirects"), "utf-8")).trim().length > 0) console.warn("[timber] Warning: GitHub Pages does not support _redirects files. Redirect rules from middleware/proxy will not work on this platform.");
+					} catch {}
+				}
+				return;
+			}
+			await runSharedBuildSteps({
+				config,
+				artifacts,
+				outDir,
+				publicDirName: "public"
+			});
+			await writeFile(join(outDir, "_compress.mjs"), await generateCompressModule());
+			await writeFile(join(outDir, "_send-response.mjs"), generateSendResponseModule());
+			if (LOCALLY_PREVIEWABLE.has(preset)) {
+				await writeFile(join(outDir, CANONICALIZE_MODULE), await generateCanonicalizeModule());
+				await writeFile(join(outDir, PREVIEW_SCRIPT), generatePreviewScript({
+					output: "server",
+					runtimeName: PRESET_CONFIGS[preset].runtimeName,
+					rscEntry: importSpecifier(outDir, join(artifacts.rsc.path, "index.js")),
+					hasManifestInit: !!artifacts.manifestInit,
+					immutableDirs: artifacts.immutableDirs,
+					base: adapterBase(config)
+				}));
+			}
+			if (artifacts.manifestInit) {
 				const rscEntry = join(outDir, "rsc", "index.js");
 				const rscContent = await readFile(rscEntry, "utf-8");
-				await writeFile(rscEntry, `${config.manifestInit}\n${rscContent}`);
+				await writeFile(rscEntry, `${artifacts.manifestInit}\n${rscContent}`);
 			}
-			const entry = generateNitroEntry(buildDir, outDir, preset, compress);
+			const entry = generateNitroEntry(preset, compress);
 			await writeFile(join(outDir, "entry.ts"), entry);
-			await runNitroBuild(outDir, preset, options.nitroConfig);
+			const { serverDir } = await runNitroBuild(outDir, preset, artifacts.immutableDirs, options.nitroConfig);
+			if (artifacts.prebuilt) {
+				const prebuiltSrc = artifacts.prebuilt.path;
+				await cp(prebuiltSrc, join(serverDir, "prebuilt"), { recursive: true });
+				if (preset === "vercel" || preset === "vercel-edge") await copyPrebuiltToVercelFuncClones(dirname(serverDir), prebuiltSrc, basename(serverDir));
+			}
 		},
-		preview: LOCALLY_PREVIEWABLE.has(preset) ? async (_config, buildDir) => {
-			const previewScript = generatePreviewScript(buildDir, preset);
-			const scriptPath = join(buildDir, "nitro", "_preview-server.mjs");
-			await writeFile(scriptPath, previewScript);
-			await spawnNitroPreview(preset === "bun" ? "bun" : "node", [scriptPath], join(buildDir, "nitro"));
-		} : void 0,
-		waitUntil: presetConfig.supportsWaitUntil ? (promise) => {
-			const tracked = promise.catch((err) => {
-				console.error("[timber] waitUntil promise rejected:", err);
-			});
-			pendingPromises.push(tracked);
-		} : void 0
+		async preview(_config, { output, outputDir }) {
+			if (output === "server" && !LOCALLY_PREVIEWABLE.has(preset)) throw new Error(`[timber] The nitro '${preset}' preset has no local runtime, so \`timber preview\` cannot run its server build. Preview with a node-server build, or with the platform's own tooling.`);
+			const nitroDir = join(outputDir, "nitro");
+			const script = join(nitroDir, PREVIEW_SCRIPT);
+			if (!existsSync(script)) throw new Error(`[timber] No preview server at ${script}. Run \`timber build\` before \`timber preview\`.`);
+			await spawnNitroPreview(output === "server" && preset === "bun" ? "bun" : process.execPath, [script], nitroDir);
+		}
 	};
 }
+/** The preview server buildOutput writes into the Nitro output directory. */
+var PREVIEW_SCRIPT = "_preview-server.mjs";
+/** The request-path canonicalizer the preview server imports beside it. */
+var CANONICALIZE_MODULE = "_canonicalize.mjs";
+/** A relative ESM import specifier for `file`, as imported from a module in `fromDir`. */
+function importSpecifier(fromDir, file) {
+	const path = relative(fromDir, file).split(sep).join("/");
+	return path.startsWith("../") ? path : "./" + path;
+}
 /** @internal Exported for testing. */
-function generateNitroEntry(buildDir, outDir, preset, compress = true, hasManifestInit = false) {
+function generateNitroEntry(preset, compress = true) {
 	const serverEntryRelative = "./rsc/index.js";
 	const runtimeName = PRESET_CONFIGS[preset].runtimeName;
 	const earlyHints = PRESET_CONFIGS[preset].supportsEarlyHints;
@@ -274,15 +704,7 @@ function generateNitroEntry(buildDir, outDir, preset, compress = true, hasManife
 	return `// Generated by @timber-js/app/adapters/nitro
 // Do not edit — this file is regenerated on each build.
 
-// Patch global Web Streams with fast-webstreams (backed by Node.js native streams).
-// Must run before ANY code creates ReadableStream/WritableStream/TransformStream.
-// React's RSC Flight streams, SSR output, .tee(), and all pipeThrough transforms
-// benefit: 3.8x faster reads, 11x faster transforms, 13x faster sequential tee.
-// See: https://github.com/vercel-labs/fast-webstreams
-import { patchGlobalWebStreams } from 'experimental-fast-webstreams'
-patchGlobalWebStreams()
-
-${hasManifestInit ? "import './_timber-manifest-init.js'\n" : ""}import handler, { runWithEarlyHintsSender${supportsWaitUntil ? ", runWithWaitUntil" : ""} } from '${serverEntryRelative}'
+import handler, { runWithEarlyHintsSender${supportsWaitUntil ? ", runWithWaitUntil" : ""} } from '${serverEntryRelative}'
 ${compress ? "import { compressResponse } from './_compress.mjs'\n" : ""}
 // Set TIMBER_RUNTIME for instrumentation.ts conditional SDK initialization.
 // See design/25-production-deployments.md §"TIMBER_RUNTIME".
@@ -301,222 +723,64 @@ ${handlerCall}
 }
 `;
 }
+/**
+* Prefixes of nitro build-output lines that give wrong advice for timber
+* builds. Every nitro bundler path emits these hints via `logger.success` —
+* the rollup path hardcodes `npx nitro preview`; rolldown and vite default
+* to it. That command resolves `.output/nitro.json` relative to cwd, but
+* timber's nitro build lives at `.timber/dist/nitro/.output`, so the
+* suggested command can never work from the project root.
+* Prefix matching degrades gracefully: if upstream rewords the line
+* entirely, it passes through rather than being silently eaten.
+*/
+var NITRO_PREVIEW_HINT_PREFIX = "You can preview this build using";
+var NITRO_DEPLOY_HINT_PREFIX = "You can deploy this build using";
+var SUPPRESSED_NITRO_HINT_PREFIXES = [NITRO_PREVIEW_HINT_PREFIX, NITRO_DEPLOY_HINT_PREFIX];
 /** @internal Exported for testing. */
-function generateNitroConfig(preset, userConfig) {
-	const presetConfig = PRESET_CONFIGS[preset];
-	const config = {
-		preset: presetConfig.nitroPreset,
-		entry: "./entry.ts",
-		output: { dir: presetConfig.outputDir },
-		routeRules: { "/assets/**": { headers: { "Cache-Control": IMMUTABLE_CACHE } } },
-		...presetConfig.extraConfig,
-		...userConfig
-	};
-	return `// Generated by @timber-js/app/adapters/nitro
-// Do not edit — this file is regenerated on each build.
-
-import { defineNitroConfig } from 'nitro/config'
-
-export default defineNitroConfig(${JSON.stringify(config, null, 2)})
-`;
+function isSuppressedNitroHint(message, prefixes = SUPPRESSED_NITRO_HINT_PREFIXES) {
+	return typeof message === "string" && prefixes.some((prefix) => message.startsWith(prefix));
 }
-/** Presets that produce a locally-runnable server entry. */
-var LOCALLY_PREVIEWABLE = new Set(["node-server", "bun"]);
 /**
-* Generate a standalone preview server script that uses Node's built-in
-* HTTP server. This bypasses Nitro entirely — the Nitro entry.ts imports
-* h3 which isn't available outside a Nitro build. For local preview we
-* just need to serve static files and route requests to the RSC handler.
+* Nitro's rolldown and vite builders render `framework.previewCommand` /
+* `framework.deployCommand` into these hints. A user who explicitly set one
+* via `nitroConfig` has provided valid guidance — only suppress the hints
+* whose command is still nitro's broken default.
 *
 * @internal Exported for testing.
 */
-function generatePreviewScript(buildDir, preset) {
-	const rscEntryRelative = relative(join(buildDir, "nitro"), join(buildDir, "rsc", "index.js"));
-	const rscEntry = rscEntryRelative.startsWith(".") ? rscEntryRelative : "./" + rscEntryRelative;
-	const publicDir = "./public";
-	const manifestInitPath = "./_timber-manifest-init.js";
-	return `// Generated by @timber-js/app — standalone preview server.
-// Uses Node's built-in HTTP server to serve static assets and route
-// dynamic requests through the RSC handler. No Nitro/h3 dependency.
-
-// Patch global Web Streams with fast-webstreams before any imports.
-import { patchGlobalWebStreams } from 'experimental-fast-webstreams';
-patchGlobalWebStreams();
-
-import { createServer } from 'node:http';
-import { readFile, stat } from 'node:fs/promises';
-import { join, extname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { existsSync } from 'node:fs';
-
-// Set runtime before importing the handler.
-process.env.TIMBER_RUNTIME = '${PRESET_CONFIGS[preset].runtimeName}';
-
-// Load the build manifest if it exists.
-const __dirname = fileURLToPath(new URL('.', import.meta.url));
-const manifestPath = join(__dirname, '${manifestInitPath}');
-if (existsSync(manifestPath)) {
-  await import('${manifestInitPath}');
-}
-
-// Import the RSC handler (default export is the fetch-like handler).
-const { default: handler, runWithEarlyHintsSender } = await import('${rscEntry}');
-
-// Import compression helper for self-hosted response compression.
-const { compressResponse } = await import('./_compress.mjs');
-
-const MIME_TYPES = {
-  '.html': 'text/html',
-  '.js': 'application/javascript',
-  '.mjs': 'application/javascript',
-  '.css': 'text/css',
-  '.json': 'application/json',
-  '.png': 'image/png',
-  '.jpg': 'image/jpeg',
-  '.jpeg': 'image/jpeg',
-  '.gif': 'image/gif',
-  '.svg': 'image/svg+xml',
-  '.ico': 'image/x-icon',
-  '.woff': 'font/woff',
-  '.woff2': 'font/woff2',
-  '.ttf': 'font/ttf',
-  '.otf': 'font/otf',
-  '.webp': 'image/webp',
-  '.avif': 'image/avif',
-  '.webm': 'video/webm',
-  '.mp4': 'video/mp4',
-  '.txt': 'text/plain',
-  '.xml': 'application/xml',
-  '.wasm': 'application/wasm',
-};
-
-const publicDir = join(__dirname, '${publicDir}');
-const port = parseInt(process.env.PORT || '3000', 10);
-const host = process.env.HOST || process.env.HOSTNAME || 'localhost';
-
-const server = createServer(async (req, res) => {
-  const url = new URL(req.url || '/', \`http://\${host}:\${port}\`);
-
-  // Try serving static files from the public directory first.
-  const filePath = join(publicDir, url.pathname);
-  // Prevent path traversal.
-  if (filePath.startsWith(publicDir)) {
-    try {
-      const fileStat = await stat(filePath);
-      if (fileStat.isFile()) {
-        const ext = extname(filePath);
-        const contentType = MIME_TYPES[ext] || 'application/octet-stream';
-        const body = await readFile(filePath);
-        // Hashed assets get immutable cache, others get short cache.
-        const cacheControl = url.pathname.startsWith('/assets/')
-          ? 'public, max-age=31536000, immutable'
-          : 'public, max-age=3600, must-revalidate';
-        res.writeHead(200, {
-          'Content-Type': contentType,
-          'Content-Length': body.length,
-          'Cache-Control': cacheControl,
-        });
-        res.end(body);
-        return;
-      }
-    } catch {
-      // File not found — fall through to the RSC handler.
-    }
-  }
-
-  // Convert Node request to Web Request.
-  const headers = new Headers();
-  for (const [key, value] of Object.entries(req.headers)) {
-    if (value) {
-      if (Array.isArray(value)) {
-        for (const v of value) headers.append(key, v);
-      } else {
-        headers.set(key, value);
-      }
-    }
-  }
-
-  let body = undefined;
-  if (req.method !== 'GET' && req.method !== 'HEAD') {
-    body = await new Promise((resolve) => {
-      const chunks = [];
-      req.on('data', (chunk) => chunks.push(chunk));
-      req.on('end', () => resolve(Buffer.concat(chunks)));
-    });
-  }
-
-  const webRequest = new Request(url.href, {
-    method: req.method,
-    headers,
-    body,
-    duplex: body ? 'half' : undefined,
-  });
-
-  try {
-    // Support 103 Early Hints when available.
-    const earlyHintsSender = (typeof res.writeEarlyHints === 'function')
-      ? (links) => { try { res.writeEarlyHints({ link: links }); } catch {} }
-      : undefined;
-
-    const rawResponse = earlyHintsSender && runWithEarlyHintsSender
-      ? await runWithEarlyHintsSender(earlyHintsSender, () => handler(webRequest))
-      : await handler(webRequest);
-
-    // Compress the response for self-hosted deployments.
-    const webResponse = compressResponse(webRequest, rawResponse);
-
-    // Write the response back to the Node response.
-    res.writeHead(webResponse.status, Object.fromEntries(webResponse.headers.entries()));
-
-    if (webResponse.body) {
-      const reader = webResponse.body.getReader();
-      const pump = async () => {
-        while (true) {
-          const { done, value } = await reader.read();
-          if (done) { res.end(); return; }
-          res.write(value);
-        }
-      };
-      await pump();
-    } else {
-      res.end();
-    }
-  } catch (err) {
-    console.error('[timber preview] Request error:', err);
-    if (!res.headersSent) {
-      res.writeHead(500, { 'Content-Type': 'text/plain' });
-    }
-    res.end('Internal Server Error');
-  }
-});
-
-server.listen(port, host, () => {
-  console.log();
-  console.log('  ⚡ timber preview server running at:');
-  console.log();
-  console.log(\`    ➜  http://\${host}:\${port}\`);
-  console.log();
-});
-`;
+function selectSuppressedHintPrefixes(framework) {
+	return [...framework?.previewCommand ? [] : [NITRO_PREVIEW_HINT_PREFIX], ...framework?.deployCommand ? [] : [NITRO_DEPLOY_HINT_PREFIX]];
 }
-/** @internal Exported for testing. */
-function generateNitroPreviewCommand(buildDir, preset) {
-	if (!LOCALLY_PREVIEWABLE.has(preset)) return null;
-	const nitroDir = join(buildDir, "nitro");
-	const entryPath = join(nitroDir, "entry.ts");
-	return {
-		command: preset === "bun" ? "bun" : "node",
-		args: [entryPath],
-		cwd: nitroDir
+/**
+* Wrap a nitro logger's `success` so hardcoded preview/deploy hints are
+* dropped for this programmatic build only. Returns the original
+* (unfiltered) success fn so timber can print its own hint — which shares
+* the suppressed prefix on purpose, replacing nitro's wording.
+*
+* @internal Exported for testing.
+*/
+function wrapNitroLoggerForBuild(logger, prefixes = SUPPRESSED_NITRO_HINT_PREFIXES) {
+	const originalSuccess = logger.success.bind(logger);
+	const wrapped = (message, ...args) => {
+		if (isSuppressedNitroHint(message, prefixes)) return;
+		originalSuccess(message, ...args);
 	};
+	logger.success = Object.assign(wrapped, logger.success);
+	return originalSuccess;
 }
 /**
-* Run the Nitro production build using the programmatic API.
-* Uses dynamic import so nitro is only loaded at build time.
-* Externalizes the timber RSC/SSR output — those files are pre-built
-* by timber and have internal references that nitro's bundler can't follow.
+* Timber's own post-build hint. Locally-runnable presets are previewed via
+* `timber preview`, which invokes this adapter's `preview()` to run the
+* generated `_preview-server.mjs`. Serverless presets get no hint — their
+* output lives under `.timber/dist/nitro/`, so any cwd-relative deploy
+* command would be as wrong as the nitro hint this replaces.
+*
+* @internal Exported for testing.
 */
-async function runNitroBuild(nitroDir, preset, userConfig) {
+function getPostBuildHint(preset) {
+	return LOCALLY_PREVIEWABLE.has(preset) ? "You can preview this build using `timber preview`" : null;
+}
+async function runNitroBuild(nitroDir, preset, immutableDirs, userConfig) {
 	const presetConfig = PRESET_CONFIGS[preset];
 	const { createNitro, build: nitroBuild, prepare, copyPublicAssets } = await import("nitro/builder");
 	const nitro = await createNitro({
@@ -524,35 +788,43 @@ async function runNitroBuild(nitroDir, preset, userConfig) {
 		preset: presetConfig.nitroPreset,
 		renderer: { handler: join(nitroDir, "entry.ts") },
 		output: { dir: join(nitroDir, presetConfig.outputDir) },
-		routeRules: { "/assets/**": { headers: { "Cache-Control": IMMUTABLE_CACHE } } },
+		routeRules: Object.fromEntries(immutableDirs.map((dir) => [`/${dir}/**`, { headers: { "Cache-Control": IMMUTABLE_CACHE } }])),
 		rollupConfig: { external: [/\.\.\/rsc\//] },
 		...presetConfig.extraConfig,
 		...userConfig
 	});
+	const framework = nitro.options.builder === "rollup" ? void 0 : nitro.options.framework;
+	const logSuccess = wrapNitroLoggerForBuild(nitro.logger, selectSuppressedHintPrefixes(framework));
+	const raw = nitro.options.output.serverDir;
+	const serverDir = raw.endsWith("/") ? raw.slice(0, -1) : raw;
 	await prepare(nitro);
 	await copyPublicAssets(nitro);
 	await nitroBuild(nitro);
 	await nitro.close();
-}
-/** Spawn a Nitro preview process and pipe stdio. */
-function spawnNitroPreview(command, args, cwd) {
-	return new Promise((resolve, reject) => {
-		const child = execFile(command, args, { cwd }, (err) => {
-			if (err) reject(err);
-			else resolve();
-		});
-		child.stdout?.pipe(process.stdout);
-		child.stderr?.pipe(process.stderr);
-	});
+	const hint = framework?.previewCommand ? null : getPostBuildHint(preset);
+	if (hint) logSuccess(hint);
+	return { serverDir };
 }
 /**
-* Get the preset configuration for a given preset name.
+* Copy prebuilt payloads into cloned Vercel function directories.
+*
+* When users configure `vercel.functionRules`, Nitro's compiled hook clones
+* the base __server.func to per-route .func directories. These clones are
+* created during `runNitroBuild()` — before our post-build prebuilt copy.
+* Each clone resolves `../prebuilt` independently, so they each need a copy.
+*
 * @internal Exported for testing.
 */
-function getPresetConfig(preset) {
-	return PRESET_CONFIGS[preset];
+async function copyPrebuiltToVercelFuncClones(functionsDir, prebuiltSrc, baseFuncName) {
+	const funcDirs = [];
+	try {
+		for await (const match of glob("**/*.func", { cwd: functionsDir })) if (!match.endsWith(baseFuncName)) funcDirs.push(join(functionsDir, match));
+	} catch {
+		return;
+	}
+	await Promise.all(funcDirs.map((dir) => cp(prebuiltSrc, join(dir, "prebuilt"), { recursive: true })));
 }
 //#endregion
-export { generateNitroConfig, generateNitroEntry, generateNitroPreviewCommand, generatePreviewScript, getPresetConfig, nitro };
+export { copyPrebuiltToVercelFuncClones, generateNitroEntry, getPostBuildHint, isSuppressedNitroHint, nitro, selectSuppressedHintPrefixes, wrapNitroLoggerForBuild };
 
 //# sourceMappingURL=nitro.js.map