@vesk/adapter 0.2.67 → 0.2.69

package/dist/client-bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-bundle.d.ts","sourceRoot":"","sources":["../src/client-bundle.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAmF,MAAM,yBAAyB,CAAC;AAuEnL;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BhE;AAED;;;;;GAKG;AACH,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7B,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IACtH,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,YAAY,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,MAAM,CAAC,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;oBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;iBAAE,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC;KAC/F,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAmDD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAKzD;AAkCD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B7D;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAyBlD;AAuQD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASxD;AA4CD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,GAAG,MAAM,CAoBnG;AAED,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,MAAM,CAKtE;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,SAAS,EAAE,EACtB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CA2pB7B;AAMD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA+B3D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAUlE;AAoCD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAI/F"}
+{"version":3,"file":"client-bundle.d.ts","sourceRoot":"","sources":["../src/client-bundle.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAmF,MAAM,yBAAyB,CAAC;AAuEnL;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BhE;AAED;;;;;GAKG;AACH,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7B,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IACtH,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,YAAY,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,MAAM,CAAC,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;oBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;iBAAE,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC;KAC/F,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAmDD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAKzD;AAkCD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B7D;AAiCD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAyBlD;AAuQD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASxD;AA4CD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,GAAG,MAAM,CAoBnG;AAED,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,MAAM,CAKtE;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,SAAS,EAAE,EACtB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAysB7B;AAMD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA+B3D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAUlE;AAoCD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAI/F"}

package/dist/client-bundle.js

@@ -12,6 +12,7 @@ import { resolveComponentName } from '@vesk/compiler/src/server-codegen';
 import { collectVskImportPaths, vskImportLines } from '@vesk/compiler/src/vsk-imports';
 import { inlineMdContentAttrs, guessProjectRoots } from '@vesk/compiler/src/md-inline';
 import { resolveImportPath, findTsconfigPath } from '@vesk/compiler/src/module-imports';
+import { serverOnlyPlugin } from '@vesk/adapter/src/server-only-plugin';
 import { availableParallelism } from 'node:os';
 /**
  * Run `fn` over `items` with at most `limit` in flight, preserving input
@@ -256,6 +257,28 @@ export function nativeLibraryImportStubs(code) {
     });
     return lines.join('\n') + '\n\n';
 }
+/**
+ * Report, and under `--strict` fail on, a server-only package that reached a
+ * client chunk.
+ *
+ * Not an error by default: importing `../db.ts` from a page is the normal way
+ * to write a server-rendered page, and the import is harmless as long as the
+ * binding is only touched during SSR — which is the whole reason the bundler
+ * substitutes a throwing stub instead of breaking the module. `--strict` is the
+ * gate for authors who want the build to refuse it outright, the same bargain
+ * `--strict` already makes for unresolvable chunk imports.
+ */
+function reportServerOnlyImports(chunkName, hits, strict) {
+    const detail = [...new Set(hits.map(h => `"${h.binding}" from "${h.specifier}"`))].join(', ');
+    if (strict) {
+        throw new Error(`[vesk] ${chunkName} imports a server-only package in client code: ${detail}. ` +
+            'Move that work into an API route (app/api/**/route.ts) or a server action. ' +
+            'Pass without --strict to allow it (the binding is replaced by a throwing stub).');
+    }
+    console.error(`[vesk] ${chunkName}: removed server-only import from client code (${detail}). ` +
+        'It is replaced by a stub that throws if the component calls it at runtime — ' +
+        'server-only work belongs in an API route or a server action.');
+}
 /**
  * Demotes surviving value exports to plain declarations (`export const x`
  * becomes `const x`) and drops bare re-export lists (`export { x }`,
@@ -1008,7 +1031,7 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
                             console.error('[vesk] chunk import merge aborted for', chunkName + ':', chunkImports.reason);
                         const head = chunkImports.render();
                         const code = (head ? head + '\n\n' : '') + chunkCode.join('\n\n');
-                        chunkEntries.push({ name: chunkName, code, node, importsTable: chunkImports, imports: chunkHasImports(head.length, !chunkImports.ok) });
+                        chunkEntries.push({ name: chunkName, code, node, importsTable: chunkImports, imports: chunkHasImports(head.length, !chunkImports.ok), });
                     }
                 }
                 walkSplit(node.children || [], [..._chain, node]);
@@ -1027,7 +1050,7 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
                 console.error('[vesk] chunk import merge aborted for shared.js:', sharedImports.reason);
             const head = sharedImports.render();
             const code = (head ? head + '\n\n' : '') + sharedCode.join('\n\n');
-            chunkEntries.push({ name: SHARED_CHUNK_NAME, code, node: null, importsTable: sharedImports, imports: chunkHasImports(head.length, !sharedImports.ok) });
+            chunkEntries.push({ name: SHARED_CHUNK_NAME, code, node: null, importsTable: sharedImports, imports: chunkHasImports(head.length, !sharedImports.ok), });
         }
         const chunkIIFE = (body) => `(()=>{\nconst __components = globalThis.__components || (globalThis.__components = {});\nconst __hydrators = globalThis.__hydrators || (globalThis.__hydrators = {});\n${body}\n})();\n`;
         /**
@@ -1187,6 +1210,19 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
                 const tmpFile = join(tmpBase, 'entry.js');
                 const toBundle = `const __components = globalThis.__components || (globalThis.__components = {});\nconst __hydrators = globalThis.__hydrators || (globalThis.__hydrators = {});\n${entry.code}\n`;
                 writeFileSync(tmpFile, toBundle);
+                // Keeps a database driver out of a browser bundle. The interception has
+                // to be here, inside the bundler, because that is the only place the
+                // transitive import `db.ts → slintorm → pg` is ever visible: by now the
+                // chunk's own import list is merged, and the offender is almost never
+                // in it.
+                const serverOnlyHits = [];
+                const driverHits = [];
+                const eagerHits = [];
+                const serverOnlyGuard = serverOnlyPlugin({
+                    onStub: hit => serverOnlyHits.push(hit),
+                    onDriver: hit => driverHits.push(hit),
+                    onEager: hit => eagerHits.push(hit),
+                });
                 try {
                     // Pass the app tsconfig so esbuild resolves tsconfig `paths` aliases
                     // (`@/x`, `@app/x`) inside transitively bundled modules too.
@@ -1212,7 +1248,7 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
                         // shared-modules.js serves every route chunk. (esbuild's `alias`
                         // option only accepts bare package names, so this is a resolver
                         // rather than a map.)
-                        ...(sharedRedirectPlugin ? { plugins: [sharedRedirectPlugin] } : {}),
+                        ...(sharedRedirectPlugin ? { plugins: [sharedRedirectPlugin, serverOnlyGuard] } : { plugins: [serverOnlyGuard] }),
                         ...(appTsconfig ? { tsconfig: appTsconfig } : {}),
                     });
                     finalCode = result.outputFiles[0].text;
@@ -1247,6 +1283,35 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
                     }
                     catch { }
                 }
+                // Checked OUTSIDE the try above, deliberately. A TCP driver cannot be
+                // stubbed into a browser bundle — a page that looked fine and failed on
+                // its first query would be worse than a build error — and the catch
+                // block degrades every failure into "strip the imports and carry on",
+                // which is exactly the wrong outcome for this one.
+                if (eagerHits.length > 0) {
+                    // A stub would throw while the chunk is still evaluating, so the page
+                    // would die before a component existed. That is the worst place to
+                    // learn about it: refuse the build instead.
+                    const detail = eagerHits
+                        .map(h => `${h.importer} uses ${h.bindings.map(b => `"${b}"`).join(', ')} from "${h.specifier}" at module scope`)
+                        .join('; ');
+                    console.error('[vesk] server-only package used at module scope in client code', entry.name + ':', detail);
+                    throw new Error(`[vesk] ${entry.name}: ${detail}.\n` +
+                        'A module-scope statement runs the moment the browser evaluates the chunk, so a ' +
+                        'server-only package cannot be substituted there. Move that work into an API route ' +
+                        '(app/api/**/route.ts) or a server action — if the binding is only used from inside ' +
+                        'a function, this build already handles it.');
+                }
+                if (driverHits.length > 0) {
+                    const detail = [...new Set(driverHits.map(h => `${h.specifier} (from ${h.importer})`))].join(', ');
+                    console.error('[vesk] chunk bundle contains a TCP-only driver', entry.name + ':', detail);
+                    throw new Error(`[vesk] ${entry.name} pulls a TCP-only driver into the browser bundle: ${detail}. ` +
+                        "A browser cannot open a socket. Import the package's edge/browser-safe entry if it " +
+                        'ships one, or keep database access in an API route (app/api/**/route.ts) or a server action.');
+                }
+                if (serverOnlyHits.length > 0) {
+                    reportServerOnlyImports(entry.name, serverOnlyHits, options?.strict);
+                }
             }
             else {
                 // No-import chunk: wrap the compiled source in the registry IIFE. The

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACe,YAAY,EAAE,WAAW,EAC7B,UAAU,EAChC,MAAM,yBAAyB,CAAC;AAoDjC;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;CACjB;AACD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,UAAU,EAAE,EACrB,OAAO,EAAE,iBAAiB,EAAE,GAAG,IAAI,GAAG,SAAS,GAC9C,UAAU,EAAE,CAQd;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,UAAU,EAAE,EACrB,KAAK,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,GACxC,UAAU,EAAE,CAGd;AAkDD,wBAAsB,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAiXpG;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAIhE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,aAAa,GACd,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACe,YAAY,EAAE,WAAW,EAC7B,UAAU,EAChC,MAAM,yBAAyB,CAAC;AAoDjC;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;CACjB;AACD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,UAAU,EAAE,EACrB,OAAO,EAAE,iBAAiB,EAAE,GAAG,IAAI,GAAG,SAAS,GAC9C,UAAU,EAAE,CAQd;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,UAAU,EAAE,EACrB,KAAK,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,GACxC,UAAU,EAAE,CAGd;AAkDD,wBAAsB,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CA0XpG;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAIhE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,aAAa,GACd,MAAM,2BAA2B,CAAC"}

package/dist/index.js

@@ -15,6 +15,7 @@ import { compileMiddleware, compileMiddlewareCode } from '@vesk/adapter/src/midd
 import { compileEvents } from '@vesk/adapter/src/events';
 import { generateClientBundle } from '@vesk/adapter/src/client-bundle';
 import { generateManifest } from '@vesk/adapter/src/manifest';
+import { isSocketlessTarget, tcpDriverViolations, edgeDriverBuildError } from '@vesk/adapter/src/server-only';
 import { copyStaticAssets } from '@vesk/adapter/src/static';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 async function resolveCompilerApi(name) {
@@ -204,6 +205,15 @@ export async function build(appDir, options) {
     if (pluginHeadExtra)
         console.error('vesk build: baked plugin head → config.json + SSR functions');
     console.error(`vesk build: output → ${outDir}`);
+    // Socketless-target gate, before anything is compiled or bundled. An edge
+    // runtime has no TCP socket, so a build that imports a socket driver produces
+    // a function that fails on its first query — in production, from a log. Fail
+    // here instead, naming the file, the line and the driver.
+    if (isSocketlessTarget(options?.platform, options?.target)) {
+        const driverHits = tcpDriverViolations(appDir);
+        if (driverHits.length > 0)
+            throw edgeDriverBuildError(driverHits);
+    }
     const dirs = [
         resolve(outDir, 'server', 'functions'),
         resolve(outDir, 'server', 'api'),

package/dist/prod-server.d.ts

@@ -1,10 +1,10 @@
 import { type Server } from 'node:http';
+import type { CompressionConfig, ProdServerOptions } from '@vesk/adapter/src/types';
 export declare function bodyTooLarge(maxBytes: number): Error & {
     status: number;
 };
-export declare function startProdServer(outDir: string, options?: {
-    port?: number;
-    host?: string;
-    maxBodyBytes?: number;
+export declare function startProdServer(outDir: string, options?: ProdServerOptions & {
+    compression?: CompressionConfig | false;
+    healthCheck?: boolean;
 }): Promise<Server>;
 //# sourceMappingURL=prod-server.d.ts.map

package/dist/prod-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAkDjG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AAkGD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAkiBxI"}
+{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAajG,OAAO,KAAK,EAAkB,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAuFpG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AA0FD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG;IAAE,WAAW,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAqlBvK"}

package/dist/prod-server.js

@@ -1,5 +1,5 @@
 import { readFileSync, existsSync, statSync } from 'node:fs';
-import { resolve, extname, dirname, basename } from 'node:path';
+import { resolve, dirname, basename } from 'node:path';
 import { createServer } from 'node:http';
 import { fileURLToPath } from 'node:url';
 import { createRateLimiter, resolveComponentName, safeJsonForScript, getClientProtocol, DEFAULT_MAX_BODY_BYTES } from '@vesk/compiler/src/server-codegen';
@@ -11,6 +11,8 @@ import { resolveWithin, installMdReadHook } from '@vesk/adapter/src/paths';
 import { resolveCssUrls, hasBuiltGlobalCss } from '@vesk/adapter/src/css';
 import { loadVeskConfig } from '@vesk/adapter/src/load-config';
 import { renderDefaultNotFoundPage, renderDefaultErrorPage } from '@vesk/adapter/src/default-pages';
+import { installResponsePipeline } from '@vesk/adapter/src/response-pipeline';
+import { mimeFor } from '@vesk/adapter/src/platform-output';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 async function readBody(req, maxBytes = DEFAULT_MAX_BODY_BYTES) {
     const chunks = [];
@@ -23,15 +25,68 @@ async function readBody(req, maxBytes = DEFAULT_MAX_BODY_BYTES) {
     }
     return Buffer.concat(chunks);
 }
+/** Open-ended content types. Buffering one would hold the response until the
+ *  stream closed — which, for a never-ending event stream, is never. */
+const STREAMING_TYPES = new Set(['text/event-stream', 'application/x-ndjson']);
+/** Above this, a "buffered" body is streamed instead rather than held whole. */
+const DELIVER_BUFFER_LIMIT = 1024 * 1024;
 /**
- * Writes a handler Response to the socket, piping a streaming body
- * chunk-by-chunk (SSE / text streams) instead of buffering everything.
+ * Writes a handler Response to the socket.
+ *
+ * A finite body is delivered as ONE `end(buffer)`, not chunk-by-chunk, and that
+ * is load-bearing: the response pipeline can only tag a body and revalidate it
+ * against `If-None-Match` — and only apply content-encoding — once it can see
+ * the whole body. Streaming a 2 KB JSON body would silently opt every API
+ * response out of both. A response that turns out to exceed the buffer limit,
+ * or that declares an open-ended content type, falls back to streaming so the
+ * memory and time-to-first-byte cost of a genuinely large body is unchanged.
  */
 async function deliverResponse(res, response) {
-    res.writeHead(response.status, Object.fromEntries(response.headers));
+    const headers = Object.fromEntries(response.headers);
     const body = response.body;
-    if (body && typeof body.getReader === 'function') {
-        const reader = body.getReader();
+    if (!body || typeof body.getReader !== 'function') {
+        res.writeHead(response.status, headers);
+        res.end(await response.text());
+        return;
+    }
+    const contentType = String(response.headers.get('content-type') || '').split(';')[0].trim().toLowerCase();
+    const reader = body.getReader();
+    if (STREAMING_TYPES.has(contentType)) {
+        res.writeHead(response.status, headers);
+        pumpRemaining(res, reader);
+        return;
+    }
+    const chunks = [];
+    let size = 0;
+    let overflow = false;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            chunks.push(Buffer.from(value));
+            size += value.byteLength;
+            if (size > DELIVER_BUFFER_LIMIT) {
+                overflow = true;
+                break;
+            }
+        }
+    }
+    catch {
+        /* stream aborted by the client */
+    }
+    res.writeHead(response.status, headers);
+    if (overflow) {
+        for (const chunk of chunks)
+            res.write(chunk);
+        pumpRemaining(res, reader);
+        return;
+    }
+    res.end(Buffer.concat(chunks));
+}
+/** Drain an already-started reader onto the socket, then end it. */
+function pumpRemaining(res, reader) {
+    void (async () => {
         try {
             for (;;) {
                 const { done, value } = await reader.read();
@@ -44,9 +99,7 @@ async function deliverResponse(res, response) {
             /* stream aborted by the client */
         }
         res.end();
-        return;
-    }
-    res.end(await response.text());
+    })();
 }
 export function bodyTooLarge(maxBytes) {
     const err = new Error(`Request body exceeds limit (${maxBytes} bytes)`);
@@ -111,13 +164,6 @@ function makeWebRequest(nodeReq, url, maxBodyBytes = DEFAULT_MAX_BODY_BYTES) {
     webRequest.query = query;
     return webRequest;
 }
-const MIME = {
-    '.svg': 'image/svg+xml', '.css': 'text/css', '.js': 'application/javascript',
-    '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
-    '.ico': 'image/x-icon', '.html': 'text/html', '.json': 'application/json',
-    '.webmanifest': 'application/manifest+json',
-    '.woff': 'font/woff', '.woff2': 'font/woff2', '.wasm': 'application/wasm',
-};
 export async function startProdServer(outDir, options) {
     const port = options?.port || 3000;
     const host = options?.host || '127.0.0.1';
@@ -142,11 +188,16 @@ export async function startProdServer(outDir, options) {
     const projectDir = resolve(outDir, '..');
     let securityConfig = {};
     let mdConfig;
+    let compressionConfig = {};
+    let healthCheckEnabled = true;
     try {
         const config = await loadVeskConfig(projectDir);
         if (config) {
             securityConfig = { security: config.security };
             mdConfig = config.md;
+            // `compression: false` disables encoding entirely; an object tunes it.
+            compressionConfig = config.compression === false ? { enabled: false } : (config.compression || {});
+            healthCheckEnabled = config.healthCheck !== false;
         }
     }
     catch (e) {
@@ -154,6 +205,13 @@ export async function startProdServer(outDir, options) {
         // config must never silently disable the app's chosen security policy.
         console.error('vesk start: failed to load vesk.config — falling back to secure defaults:', e instanceof Error ? e.message : e);
     }
+    // Explicit server options win over vesk.config (the CLI passes nothing here,
+    // so this is the programmatic path — how tests and embedders configure it).
+    if (options?.compression !== undefined) {
+        compressionConfig = options.compression === false ? { enabled: false } : options.compression;
+    }
+    if (options?.healthCheck !== undefined)
+        healthCheckEnabled = options.healthCheck !== false;
     if (mdConfig) {
         try {
             const { configureMd } = await import('@vesk/runtime/src/md');
@@ -262,6 +320,23 @@ export async function startProdServer(outDir, options) {
             ? 'https'
             : getClientProtocol({ headers: req.headers }, !!securityConfig?.trustProxy);
         globalThis.__vesk_ssr_base_url = `${proto}://${reqHost}`;
+        // Liveness probe. Deliberately the FIRST thing in the handler, ahead of the
+        // rate limiter, middleware and the pipeline below:
+        //  - a probe that can be answered 429 is indistinguishable from a dead
+        //    server to an orchestrator, which then restarts a healthy pod;
+        //  - it must not be rewritten or authed by user middleware;
+        //  - it must never be encoded or tagged — a load balancer revalidating a
+        //    cached "ok" is testing its own cache, not this process.
+        if (healthCheckEnabled && (url.pathname === '/healthz' || url.pathname === '/_vesk/healthz')) {
+            const probe = JSON.stringify({ status: 'ok', uptime: Math.floor(process.uptime()) });
+            res.writeHead(200, {
+                'Content-Type': 'application/json; charset=utf-8',
+                'Content-Length': String(Buffer.byteLength(probe)),
+                'Cache-Control': 'no-store',
+            });
+            res.end(probe);
+            return;
+        }
         if (rateLimiter) {
             const clientIp = getClientIpFromReq(req);
             if (!rateLimiter.check(clientIp)) {
@@ -327,11 +402,22 @@ export async function startProdServer(outDir, options) {
             }
             return origWriteHead2(statusCode, headers);
         });
+        // Installed LAST so it wraps the two header decorators above: its captured
+        // `writeHead` is their wrapper, so security headers and per-request
+        // overrides are still merged in — once, at flush time. One install covers
+        // every response the handler produces (static files, SSR HTML, API JSON,
+        // middleware short-circuits), so no call site can be missed.
+        installResponsePipeline(res, req, {
+            compress: compressionConfig.enabled !== false,
+            compressThreshold: compressionConfig.threshold,
+            brotliQuality: compressionConfig.brotliQuality,
+            gzipLevel: compressionConfig.gzipLevel,
+            etag: compressionConfig.etag !== false,
+        });
         const publicDir = resolve(staticDir, 'public');
         const rootFile = url.pathname.length > 1 ? resolveWithin(publicDir, url.pathname.slice(1)) : null;
         if (rootFile && existsSync(rootFile) && statSync(rootFile).isFile()) {
-            const ext = extname(rootFile);
-            res.writeHead(200, { 'Content-Type': MIME[ext] || 'application/octet-stream' });
+            res.writeHead(200, { 'Content-Type': mimeFor(rootFile) });
             res.end(readFileSync(rootFile));
             return;
         }
@@ -387,9 +473,8 @@ export async function startProdServer(outDir, options) {
                 return;
             }
             if (existsSync(staticPath) && statSync(staticPath).isFile()) {
-                const ext = extname(staticPath);
                 res.writeHead(200, {
-                    'Content-Type': MIME[ext] || 'application/octet-stream',
+                    'Content-Type': mimeFor(staticPath),
                     // A content-hashed name can never change meaning, so it is immutable
                     // for a year; anything unhashed must be revalidated or a deploy would
                     // serve stale JS forever.
@@ -651,8 +736,19 @@ export async function startProdServer(outDir, options) {
         server.close(() => process.exit(0));
         setTimeout(() => process.exit(0), 3000).unref();
     }
-    process.on('SIGINT', () => shutdown('SIGINT'));
-    process.on('SIGTERM', () => shutdown('SIGTERM'));
+    // Named handlers so they can be detached on close. Without this every
+    // start/stop cycle leaks two process listeners, which is a hard crash
+    // (MaxListenersExceededWarning → throw) once a host restarts the server more
+    // than five times — the shape every test harness and hot-restarting dev
+    // wrapper uses.
+    const onSigint = () => shutdown('SIGINT');
+    const onSigterm = () => shutdown('SIGTERM');
+    process.on('SIGINT', onSigint);
+    process.on('SIGTERM', onSigterm);
+    server.once('close', () => {
+        process.off('SIGINT', onSigint);
+        process.off('SIGTERM', onSigterm);
+    });
     server.listen(port, host, () => {
         console.error(`vesk production server at http://localhost:${port} (listening on ${host})`);
     });

package/dist/response-pipeline.d.ts

@@ -0,0 +1,54 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export type ContentEncoding = 'br' | 'gzip';
+/**
+ * Pick a content coding from `Accept-Encoding`.
+ *
+ * Quality values are honoured because a client is entitled to say "I accept
+ * gzip but not brotli" (`br;q=0`) or "gzip only at half priority". `*` applies
+ * to codings the header does not name. Ties go to brotli: every browser that
+ * sends both lists them equally, and brotli is smaller.
+ */
+export declare function negotiateEncoding(header: string | string[] | undefined): ContentEncoding | null;
+/**
+ * Would compressing this content type actually pay?
+ *
+ * The rule is "text-like, not already compressed". Images, fonts, video and
+ * archives are already compressed — a second pass costs CPU and usually makes
+ * the body *larger*, which is why the size check in `installResponsePipeline`
+ * is kept as a second line of defence rather than the only one.
+ */
+export declare function isCompressibleType(contentType: string | undefined): boolean;
+/**
+ * A validator for these exact bytes.
+ *
+ * sha1 rather than sha256 because this is a cache validator, not a security
+ * primitive (RFC 9110 requires "a function of the representation", and nginx
+ * ships md5 here), and every request hashes its body. Truncated to 20 bytes of
+ * base64 — 27 characters — which is far beyond collision range for a validator.
+ */
+export declare function etagFor(body: Buffer): string;
+/**
+ * `If-None-Match` satisfaction, weak comparison as RFC 9110 §13.1.2 requires
+ * for GET. Weak comparison ignores the `W/` prefix on either side, which is what
+ * makes a `W/"x"` from a proxy match our strong `"x"`.
+ */
+export declare function ifNoneMatchSatisfied(header: string | string[] | undefined, etag: string): boolean;
+export interface ResponsePipelineOptions {
+    /** Set false to disable content-coding negotiation. Default true. */
+    compress?: boolean;
+    /** Smallest body worth compressing, in bytes. Default 1024. */
+    compressThreshold?: number;
+    /** Set false to disable ETag/304. Default true. */
+    etag?: boolean;
+    /** brotli quality 0-11. Default 5 — 11 is several hundred ms per megabyte. */
+    brotliQuality?: number;
+    /** gzip level 1-9. Default 6. */
+    gzipLevel?: number;
+}
+/**
+ * Wrap `res` so every buffered response is tagged with an ETag, revalidated
+ * against `If-None-Match`, and encoded — in that order, because a 304 must be
+ * decided on the *unencoded* bytes.
+ */
+export declare function installResponsePipeline(res: ServerResponse, req: IncomingMessage, options?: ResponsePipelineOptions): void;
+//# sourceMappingURL=response-pipeline.d.ts.map

package/dist/response-pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-pipeline.d.ts","sourceRoot":"","sources":["../src/response-pipeline.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAKjE,MAAM,MAAM,eAAe,GAAG,IAAI,GAAG,MAAM,CAAC;AAE5C;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,eAAe,GAAG,IAAI,CAgC/F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAwB3E;AAED;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAWjG;AAED,MAAM,WAAW,uBAAuB;IACvC,qEAAqE;IACrE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AA8BD;;;;GAIG;AACH,wBAAgB,uBAAuB,CACtC,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,uBAA4B,GACnC,IAAI,CA2ON"}