@vesk/adapter 0.2.64 → 0.2.66

package/dist/client-bundle.js

@@ -1504,10 +1504,34 @@ async function buildTreeShakenRuntimeNow(runtimeDir, usedNames) {
     const missing = unique.filter((n) => !available.has(n));
     if (missing.length > 0) {
         console.error(`vesk: runtime names not exported — ${missing.join(', ')}; falling back to full runtime`);
+        // Fall back to a FULL esbuild bundle of every name that DOES exist, not
+        // to the legacy concatenation. The concat strips `export ` from whole
+        // runtime files and drops them into ONE module scope, where
+        // hydrate.js and router.js both declare a top-level `hydrateInitial`
+        // (`Identifier 'hydrateInitial' has already been declared`) — a
+        // page-wide SyntaxError. So the "safety net" guaranteed total failure
+        // for every page, which is the opposite of its job. The bundle keeps
+        // the runtime in a closed IIFE, so the unknown names are simply absent
+        // (a clear ReferenceError at the one call site) instead of every page
+        // dying at evaluation.
+        const full = await bundleRuntimeNames(runtimeDir, [...available]);
+        if (full)
+            return full;
+        // esbuild itself failed — last resort is the old concat.
         return buildRuntimeCode(runtimeDir);
     }
+    return (await bundleRuntimeNames(runtimeDir, unique, true)) ?? buildRuntimeCode(runtimeDir);
+}
+/**
+ * Bundles the named runtime exports into one closed IIFE plus an explicit
+ * re-export tail. Returns null when esbuild fails, so callers can fall back.
+ */
+async function bundleRuntimeNames(runtimeDir, names, strict = false) {
+    if (names.length === 0)
+        return null;
     const entry = runtimeTreeShakeEntry();
     const indexClient = esbuildPath(join(runtimeDir, 'index-client.js'));
+    const unique = [...new Set(names)];
     try {
         try {
             mkdirSync(dirname(entry), { recursive: true });
@@ -1541,8 +1565,9 @@ async function buildTreeShakenRuntimeNow(runtimeDir, usedNames) {
         return `${bundle}\nconst { ${unique.join(', ')} } = __veskRuntime;\nexport { ${unique.join(', ')} };\n`;
     }
     catch (e) {
-        console.error('vesk: runtime tree-shake failed, falling back to full runtime:', e.message);
-        return buildRuntimeCode(runtimeDir);
+        if (strict)
+            console.error('vesk: runtime tree-shake failed, falling back to full runtime:', e.message);
+        return null;
     }
     finally {
         try {

package/dist/dev-server.js

@@ -903,11 +903,17 @@ function matchPath(pattern, pathname) {
     const pathParts = pathname.split('/').filter(Boolean);
     let pi = 0, pp = 0;
     while (pi < pathParts.length && pp < patternParts.length) {
-        if (patternParts[pp].startsWith(':')) {
+        const seg = patternParts[pp];
+        // `*name` is a catch-all and absorbs the rest of the path.
+        if (seg.startsWith('*')) {
+            pi = pathParts.length;
+            pp++;
+        }
+        else if (seg.startsWith(':')) {
             pi++;
             pp++;
         }
-        else if (patternParts[pp] === pathParts[pi]) {
+        else if (seg === pathParts[pi]) {
             pi++;
             pp++;
         }
@@ -915,5 +921,9 @@ function matchPath(pattern, pathname) {
             return false;
         }
     }
+    // A trailing catch-all still matches an empty tail; the loop above exits as
+    // soon as the URL is exhausted, so without this it was never reached.
+    if (pp === patternParts.length - 1 && patternParts[pp].startsWith('*'))
+        pp++;
     return pp === patternParts.length && pi === pathParts.length;
 }

package/dist/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAqE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEpK,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,EAAE,EACnB,SAAS,EAAE,SAAS,EAAE,EACtB,SAAS,EAAE,YAAY,EAAE,EACzB,YAAY,EAAE,cAAc,EAAE,EAC9B,iBAAiB,EAAE,OAAO,EAC1B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,CAAC,EAAE,MAAM,EAClB,aAAa,UAAQ,GACpB,QAAQ,CAmDV"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAqE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAiCpK,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,EAAE,EACnB,SAAS,EAAE,SAAS,EAAE,EACtB,SAAS,EAAE,YAAY,EAAE,EACzB,YAAY,EAAE,cAAc,EAAE,EAC9B,iBAAiB,EAAE,OAAO,EAC1B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,CAAC,EAAE,MAAM,EAClB,aAAa,UAAQ,GACpB,QAAQ,CAuEV"}

package/dist/manifest.js

@@ -1,3 +1,33 @@
+/**
+ * Specificity key for a route pattern, compared segment by segment: a literal
+ * segment outranks a dynamic one, so `/users/me` is tried before
+ * `/users/:id`.
+ *
+ * Every consumer of the manifest — prod-server, adapter dev-server, platform
+ * handler — scans `routes` in order and takes the FIRST match, so the order
+ * written here IS the routing precedence. Entries came out in directory-scan
+ * order, which puts `[id]` ahead of `me`, leaving a static API route
+ * permanently unreachable in a production build while the dev tree matcher
+ * (which sorts siblings) answered correctly.
+ */
+function specificityKey(path) {
+    return path
+        .split('/')
+        .filter(Boolean)
+        // `:x` is one segment, `*x` is the rest of the path — so `*` sorts below
+        // `:` and both below a literal.
+        .map(seg => (seg.startsWith('*') ? '2' + seg : seg.startsWith(':') ? '1' + seg : '0' + seg));
+}
+function compareSpecificity(a, b) {
+    const ka = specificityKey(a);
+    const kb = specificityKey(b);
+    const len = Math.min(ka.length, kb.length);
+    for (let i = 0; i < len; i++) {
+        if (ka[i] !== kb[i])
+            return ka[i] < kb[i] ? -1 : 1;
+    }
+    return kb.length - ka.length;
+}
 export function generateManifest(routes, ssrRoutes, apiRoutes, staticRoutes, middlewareEnabled, actionMap, headExtra, eventsEnabled = false) {
     const routeEntries = [];
     for (const r of ssrRoutes) {
@@ -14,15 +44,36 @@ export function generateManifest(routes, ssrRoutes, apiRoutes, staticRoutes, mid
             entry.tags = r._isrTags;
         routeEntries.push(entry);
     }
+    const apiEntries = [];
     for (const r of apiRoutes) {
         const urlParts = r.fullPath.split('/').filter(Boolean);
-        const name = urlParts.map(s => s.startsWith(':') ? s.slice(1) || 'param' : s).join('_') || 'index';
-        routeEntries.push({
-            path: `/api${r.fullPath}`,
+        // A catch-all segment is emitted as `*name`, not `:name`. They were both
+        // written as `:name`, which made `[...rest]` and `[id]` indistinguishable
+        // in the manifest — and since every consumer treats `:` as exactly ONE
+        // segment, a catch-all API route could never match more than one segment
+        // in a production build (`/api/files/a/b/c` never reached `[...rest]`,
+        // while the dev tree matcher handled it correctly).
+        const parts = urlParts.map((s, i) => {
+            const last = i === urlParts.length - 1;
+            if (last && r.isCatchAll && s.startsWith(':'))
+                return '*' + s.slice(1);
+            return s;
+        });
+        // Strip the `:name` / `*name` prefix from DYNAMIC AND CATCH-ALL segments
+        // only. A blanket `slice(1)` also decapitates static segments, which made
+        // `/api/posts` point at `server/api/osts.js` while the file on disk is
+        // `posts.js` — so every static API route 404'd in a production build.
+        const name = parts
+            .map(s => (s.startsWith(':') || s.startsWith('*')) ? s.slice(1) || 'param' : s)
+            .join('_') || 'index';
+        apiEntries.push({
+            path: parts.length ? `/api/${parts.join('/')}` : '/api',
             type: 'api',
             function: `server/api/${name}.js`,
         });
     }
+    apiEntries.sort((a, b) => compareSpecificity(a.path, b.path));
+    routeEntries.push(...apiEntries);
     const ssgEntries = [];
     for (const r of staticRoutes) {
         ssgEntries.push({

package/dist/platform-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-handler.d.ts","sourceRoot":"","sources":["../src/platform-handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AASvE,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAMpD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,wBAAgB,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEtC;AAgBD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAyMjF;AAED,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsFzF;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB"}
+{"version":3,"file":"platform-handler.d.ts","sourceRoot":"","sources":["../src/platform-handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AASvE,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAMpD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,wBAAgB,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEtC;AAgBD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CA8MjF;AAED,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsFzF;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB"}

package/dist/platform-handler.js

@@ -119,16 +119,21 @@ function __matchPath(pattern, pathname) {
   let pi = 0, pp = 0;
   const params = {};
   while (pi < pathParts.length && pp < patternParts.length) {
-    if (patternParts[pp].startsWith(':')) {
-      const name = patternParts[pp].slice(1);
-      params[name] = pathParts[pi];
+    const seg = patternParts[pp];
+    // A "*name" segment is a catch-all and absorbs the rest of the path.
+    if (seg.startsWith('*')) { params[seg.slice(1)] = pathParts.slice(pi).join('/'); pi = pathParts.length; pp++; }
+    else if (seg.startsWith(':')) {
+      params[seg.slice(1)] = pathParts[pi];
       pi++; pp++;
-    } else if (patternParts[pp] === pathParts[pi]) {
+    } else if (seg === pathParts[pi]) {
       pi++; pp++;
     } else {
       return null;
     }
   }
+  // A trailing catch-all still matches an empty tail; the loop above exits as
+  // soon as the URL is exhausted, so without this it was never reached.
+  if (pp === patternParts.length - 1 && patternParts[pp].startsWith('*')) { params[patternParts[pp].slice(1)] = pathParts.slice(pi).join('/'); pp++; }
   if (pp === patternParts.length && pi === pathParts.length) return params;
   return null;
 }

package/dist/prod-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAkDjG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AAkGD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAqexI"}
+{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAkDjG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AAkGD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAkiBxI"}

package/dist/prod-server.js

@@ -215,13 +215,20 @@ export async function startProdServer(outDir, options) {
         let pi = 0, pp = 0;
         const params = {};
         while (pi < pathParts.length && pp < patternParts.length) {
-            if (patternParts[pp].startsWith(':')) {
-                const name = patternParts[pp].slice(1);
+            const seg = patternParts[pp];
+            if (seg.startsWith('*')) {
+                // Catch-all: absorbs every remaining segment (possibly none).
+                params[seg.slice(1)] = pathParts.slice(pi).join('/');
+                pi = pathParts.length;
+                pp++;
+            }
+            else if (seg.startsWith(':')) {
+                const name = seg.slice(1);
                 params[name] = pathParts[pi];
                 pi++;
                 pp++;
             }
-            else if (patternParts[pp] === pathParts[pi]) {
+            else if (seg === pathParts[pi]) {
                 pi++;
                 pp++;
             }
@@ -229,6 +236,13 @@ export async function startProdServer(outDir, options) {
                 return null;
             }
         }
+        // A trailing catch-all still matches with an empty tail (`/api/files` ->
+        // `/api/files/*rest` with rest=''). The loop above exits as soon as the
+        // URL is exhausted, so without this the catch-all was never reached.
+        if (pp === patternParts.length - 1 && patternParts[pp].startsWith('*')) {
+            params[patternParts[pp].slice(1)] = pathParts.slice(pi).join('/');
+            pp++;
+        }
         if (pp === patternParts.length && pi === pathParts.length)
             return params;
         return null;
@@ -267,6 +281,52 @@ export async function startProdServer(outDir, options) {
             }
             return origWriteHead(statusCode, headers);
         });
+        // Per-request security overrides (`request.setCsp()`, `.setSecurityHeader()`,
+        // `.setRateLimit()`, `.setCsrf()`) accumulate in the runtime's
+        // AsyncLocalStorage bag. The server cannot import the runtime directly (it
+        // is injected into generated code as a string), so it reads the bridge it
+        // registers on globalThis. Without this every one of those setters was a
+        // silent no-op.
+        const securityBridge = globalThis.__vesk_security;
+        // Rate limiting is enforced BEFORE the handler runs, so a per-request
+        // limit set inside the handler cannot apply to this same request. It is
+        // surfaced here for the next request on the connection-independent bag;
+        // the global limit configured in vesk.config is what gates this one.
+        // Wrap a handler call so overrides it records land in a fresh bag that is
+        // still readable when the response is written. Falls back to a pass-through
+        // when the runtime has not registered its bridge.
+        const securityRun = securityBridge?.run;
+        const withSecurityScope = securityRun
+            ? (fn) => securityRun(fn)
+            : (fn) => fn();
+        const applyOverrideHeaders = (headers) => {
+            const overrides = securityBridge?.get?.();
+            if (!overrides)
+                return headers;
+            const next = { ...headers };
+            if (typeof overrides.contentSecurityPolicy === 'string') {
+                next['Content-Security-Policy'] = overrides.contentSecurityPolicy;
+            }
+            const custom = overrides.customHeaders;
+            if (custom) {
+                for (const [name, value] of Object.entries(custom)) {
+                    if (value === false)
+                        delete next[name];
+                    else
+                        next[name] = value;
+                }
+            }
+            return next;
+        };
+        const origWriteHead2 = res.writeHead.bind(res);
+        let overridesApplied = false;
+        res.writeHead = ((statusCode, headers) => {
+            if (!overridesApplied) {
+                overridesApplied = true;
+                headers = applyOverrideHeaders((headers || {}));
+            }
+            return origWriteHead2(statusCode, headers);
+        });
         const publicDir = resolve(staticDir, 'public');
         const rootFile = url.pathname.length > 1 ? resolveWithin(publicDir, url.pathname.slice(1)) : null;
         if (rootFile && existsSync(rootFile) && statSync(rootFile).isFile()) {
@@ -413,7 +473,8 @@ export async function startProdServer(outDir, options) {
             }
             try {
                 const webRequest = makeWebRequest(req, url.href, maxBodyBytes);
-                const response = await mod.handleAction(webRequest, actionId);
+                const handleAction = mod.handleAction.bind(mod);
+                const response = await withSecurityScope(() => handleAction(webRequest, actionId));
                 await deliverResponse(res, response);
             }
             catch (e) {
@@ -435,7 +496,7 @@ export async function startProdServer(outDir, options) {
                         if (mod) {
                             try {
                                 const webRequest = makeWebRequest(req, url.href, maxBodyBytes);
-                                const response = await mod.handle(webRequest);
+                                const response = await withSecurityScope(() => mod.handle(webRequest));
                                 await deliverResponse(res, response);
                                 return;
                             }
@@ -478,7 +539,7 @@ export async function startProdServer(outDir, options) {
                             if (route.revalidate && route.revalidate > 0) {
                                 const { pageIsr } = await import('@vesk/runtime/src/index-server');
                                 cachedResult = await pageIsr(url.pathname, async () => {
-                                    const response = await mod.handle(webRequest);
+                                    const response = await withSecurityScope(() => mod.handle(webRequest));
                                     return { html: await response.text(), headers: Object.fromEntries(response.headers) };
                                 }, { revalidate: route.revalidate, tags: route.tags || [] });
                             }
@@ -487,7 +548,7 @@ export async function startProdServer(outDir, options) {
                                 res.end(cachedResult.html);
                                 return;
                             }
-                            const response = await mod.handle(webRequest);
+                            const response = await withSecurityScope(() => mod.handle(webRequest));
                             const headers = Object.fromEntries(response.headers);
                             if (!headers['content-type'] && !headers['Content-Type'])
                                 headers['Content-Type'] = 'text/html';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vesk/adapter",
-  "version": "0.2.64",
+  "version": "0.2.66",
   "type": "module",
   "description": "Vesk adapter — builds deployable .vesk/ output for Deno and Node serverless",
   "main": "./dist/index.js",
@@ -23,9 +23,9 @@
     "sharp": "^0.35.3"
   },
   "dependencies": {
-    "@vesk/compiler": "^0.2.64",
-    "@vesk/runtime": "^0.2.64",
-    "@vesk/types": "^0.2.64"
+    "@vesk/compiler": "^0.2.66",
+    "@vesk/runtime": "^0.2.66",
+    "@vesk/types": "^0.2.66"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1",