@webjsdev/server 0.8.58 → 0.8.59

package/src/vendor.js

@@ -338,6 +338,27 @@ let lastLiveResolveFailed = false;
 
 const JSPM_GENERATE_ENDPOINT = 'https://api.jspm.io/generate';
 const JSPM_GENERATE_TIMEOUT_MS = 10_000;
+// Bounds a single bundle GET during the SERVER's warmup live-integrity pass
+// (`fetchLiveIntegrity`). Short on purpose: that pass gates readiness, so a
+// stalled CDN must not hold the first request, and it is additionally capped
+// by INTEGRITY_TOTAL_BUDGET_MS across all URLs.
+const INTEGRITY_FETCH_TIMEOUT_MS = 10_000;
+
+// Bounds a single bundle GET made by the pin command, which either writes the
+// bytes to disk (`downloadBundle`) or fetches them to hash
+// (`fetchIntegrity`). Deliberately six times the warmup budget, because the
+// two are not the same situation: a pin is a one-shot command a person ran and
+// is waiting on, with a whole multi-megabyte package to transfer, while the
+// warmup is a server holding a request. Ten seconds is generous for the
+// latter and tight for the former on a slow link.
+//
+// 60s matches what importmap-rails effectively allows. It sets no timeout at
+// all, but Ruby's Net::HTTP defaults open_timeout and read_timeout to 60s, so
+// a Rails pin is bounded at a minute without asking. JavaScript's fetch() has
+// no default whatsoever, which is why this has to be explicit: without it a
+// CDN that accepts the connection and then stalls hangs the pin forever, with
+// no ambient deadline on a CLI run to cut it short.
+const PIN_BUNDLE_TIMEOUT_MS = 60_000;
 
 /**
  * Provider names accepted by `webjs vendor pin --from <provider>`.
@@ -387,12 +408,15 @@ export function normalizeProvider(name) {
  *
  * @param {Array<string>} installs  e.g. ['dayjs@1.11.13', '@codemirror/lint@6.9.6']
  * @param {string} provider  one of SUPPORTED_PROVIDERS
+ * @param {number} [timeoutMs]  defaults to the SERVER budget; a CLI caller
+ *   passes the longer one, since it is a command someone is waiting on rather
+ *   than a request being held open.
  * @returns {Promise<JspmCallResult>}
  */
-async function jspmCall(installs, provider) {
+async function jspmCall(installs, provider, timeoutMs = JSPM_GENERATE_TIMEOUT_MS) {
   const label = installs.length === 1 ? `'${installs[0]}'` : `${installs.length} packages`;
   const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), JSPM_GENERATE_TIMEOUT_MS);
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
     const response = await fetch(JSPM_GENERATE_ENDPOINT, {
       method: 'POST',
@@ -440,7 +464,7 @@ async function jspmCall(installs, provider) {
     return { ok: true, imports, transient: false };
   } catch (e) {
     const msg = e && e.name === 'AbortError'
-      ? `timed out after ${JSPM_GENERATE_TIMEOUT_MS}ms`
+      ? `timed out after ${timeoutMs}ms`
       : `${e && e.message}`;
     console.error(`[webjs] could not vendor ${label} via ${provider}: ${msg}`);
     return { ok: false, imports: {}, transient: true };
@@ -466,8 +490,8 @@ async function jspmCall(installs, provider) {
  * @param {string} [provider]  one of SUPPORTED_PROVIDERS; defaults to 'jspm'
  * @returns {Promise<Record<string, string>>}
  */
-async function jspmResolveOne(install, provider = 'jspm') {
-  const { ok, imports, transient } = await jspmProbeOne(install, provider);
+async function jspmResolveOne(install, provider = 'jspm', timeoutMs) {
+  const { ok, imports, transient } = await jspmProbeOne(install, provider, timeoutMs);
   // Preserve the public contract: an empty map on any failure, and the
   // module-global retry flag set ONLY on a transient one (a permanent 401
   // for an unresolvable private/server-only dep is tolerated).
@@ -492,13 +516,13 @@ async function jspmResolveOne(install, provider = 'jspm') {
  * @param {string} provider
  * @returns {Promise<JspmCallResult>}
  */
-function jspmProbeOne(install, provider) {
+function jspmProbeOne(install, provider, timeoutMs) {
   const cacheKey = `${provider}::probe::${install}`;
   const existing = jspmCache.get(cacheKey);
   if (existing) return existing;
 
   const promise = (async () => {
-    const result = await jspmCall([install], provider);
+    const result = await jspmCall([install], provider, timeoutMs);
     // Do not cache a failure: a transient one must be re-attempted on the
     // next resolve, and a permanent one is cheap to re-confirm and must not
     // pin a stale "unresolvable" verdict across a dependency change.
@@ -543,14 +567,18 @@ function jspmProbeOne(install, provider) {
  *
  * @param {Array<string>} installs  e.g. ['dayjs@1.11.13', 'clsx@2.1.1']
  * @param {string} [provider]  one of SUPPORTED_PROVIDERS; defaults to 'jspm'
+ * @param {number} [timeoutMs]  per-call budget. Defaults to the SERVER one,
+ *   because this runs on a cold first request as well as from the CLI; the two
+ *   pin commands pass PIN_BUNDLE_TIMEOUT_MS instead. importmap-rails only ever
+ *   resolves from the CLI, so its flat 60s has no request path to slow down.
  * @returns {Promise<Record<string, string>>}
  */
-export async function jspmGenerate(installs, provider = 'jspm') {
+export async function jspmGenerate(installs, provider = 'jspm', timeoutMs) {
   if (installs.length === 0) return {};
 
   // A single install has no cross-package graph to reconcile, so the
   // isolated path IS the coherent path; reuse the per-install cache.
-  if (installs.length === 1) return jspmResolveOne(installs[0], provider);
+  if (installs.length === 1) return jspmResolveOne(installs[0], provider, timeoutMs);
 
   // Stable key regardless of scan order so the same dep set hits cache.
   const unifiedKey = `${provider}::unified::${[...installs].sort().join('\n')}`;
@@ -558,7 +586,7 @@ export async function jspmGenerate(installs, provider = 'jspm') {
   if (cached) return cached;
 
   const promise = (async () => {
-    const unified = await jspmCall(installs, provider);
+    const unified = await jspmCall(installs, provider, timeoutMs);
     if (unified.ok) return unified.imports;
 
     // The unified call failed. Drop the cached failure so a later retry
@@ -570,14 +598,14 @@ export async function jspmGenerate(installs, provider = 'jspm') {
       // per-install fragments (each may still be cached / reachable) so we
       // serve whatever we can, and flag the transient failure for retry.
       lastLiveResolveFailed = true;
-      return mergePerInstall(await Promise.all(installs.map(i => jspmResolveOne(i, provider))));
+      return mergePerInstall(await Promise.all(installs.map(i => jspmResolveOne(i, provider, timeoutMs))));
     }
 
     // Permanent failure: at least one install is unresolvable. Probe each
     // in isolation to learn which ones jspm can resolve, then re-run the
     // unified call over only those so the survivors form one consistent
     // graph (restores #446 coherence for the resolvable subset).
-    const probes = await Promise.all(installs.map(i => jspmProbeOne(i, provider)));
+    const probes = await Promise.all(installs.map(i => jspmProbeOne(i, provider, timeoutMs)));
 
     // A GOOD package whose isolated probe failed TRANSIENTLY (a network blip
     // mid-probe) must NOT be classified as unresolvable and dropped. Only a
@@ -612,11 +640,11 @@ export async function jspmGenerate(installs, provider = 'jspm') {
       return mergePerInstall(probes.map(p => p.imports));
     }
     if (resolvable.length === 0) return {};
-    if (resolvable.length === 1) return jspmResolveOne(resolvable[0], provider);
+    if (resolvable.length === 1) return jspmResolveOne(resolvable[0], provider, timeoutMs);
 
     // Re-run unified over the resolvable subset. If even that fails (a
     // conflict among the survivors), fall back to their merged fragments.
-    const retry = await jspmCall(resolvable, provider);
+    const retry = await jspmCall(resolvable, provider, timeoutMs);
     if (retry.ok) return retry.imports;
     return mergePerInstall(resolvable.map(i => probes[installs.indexOf(i)].imports));
   })();
@@ -679,6 +707,12 @@ export async function vendorImportMapEntries(bareImports, appDir) {
 export function clearVendorCache() {
   jspmCache.clear();
   liveIntegrityCache.clear();
+  // Deliberately does NOT touch `lastLiveResolveFailed`, which looks like an
+  // omission and is not. `resolveVendorImports` is the flag's only reader and
+  // it resets the flag on entry, while the pinned short-circuit above that
+  // returns `ok: true` outright, so a value left behind by an earlier
+  // `pinAll` or `vendorImportMapEntries` can never be observed. Clearing it
+  // here would be a change nothing could write a failing test for (#1150).
 }
 
 /**
@@ -1071,14 +1105,21 @@ async function writePinFile(appDir, imports, integrity, provider) {
  * success or null on failure. The integrity hash is computed from the
  * downloaded bytes so it's always consistent with what's on disk.
  *
+ * Bounded by PIN_BUNDLE_TIMEOUT_MS. `pinAll(dir, { download: true })`
+ * runs this once per resolved URL on a CLI run with no ambient
+ * deadline, so a CDN that accepts the connection and then stalls would
+ * otherwise hang the pin with nothing to interrupt it (#1150).
+ *
  * @param {string} url
  * @param {string} appDir
  * @param {string} filename
  * @returns {Promise<{ bytes: number, integrity: string } | null>}
  */
 async function downloadBundle(url, appDir, filename) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), PIN_BUNDLE_TIMEOUT_MS);
   try {
-    const response = await fetch(url);
+    const response = await fetch(url, { signal: controller.signal });
     if (!response.ok) {
       console.error(`[webjs] download ${url} returned ${response.status}`);
       return null;
@@ -1094,8 +1135,13 @@ async function downloadBundle(url, appDir, filename) {
     await writeFile(join(pinDir(appDir), filename), buf);
     return { bytes: buf.byteLength, integrity: await sha384Integrity(buf) };
   } catch (e) {
-    console.error(`[webjs] download ${url} failed: ${e && e.message}`);
+    const why = e && e.name === 'AbortError'
+      ? `timed out after ${PIN_BUNDLE_TIMEOUT_MS}ms`
+      : e && e.message;
+    console.error(`[webjs] download ${url} failed: ${why}`);
     return null;
+  } finally {
+    clearTimeout(timer);
   }
 }
 
@@ -1105,12 +1151,21 @@ async function downloadBundle(url, appDir, filename) {
  * so the importmap can carry SRI hashes even when bundles aren't
  * locally vendored.
  *
+ * Bounded by PIN_BUNDLE_TIMEOUT_MS, the same budget `downloadBundle`
+ * gets, since it transfers the same bytes and differs only in whether
+ * they are written to disk. Default-mode `pinAll` runs this once per
+ * resolved URL, so a CDN that accepts the connection and then stalls
+ * would otherwise hang the pin with nothing to interrupt it: there is
+ * no ambient deadline on a CLI run (#1150).
+ *
  * @param {string} url
  * @returns {Promise<string | null>}  the integrity string, or null on failure
  */
 async function fetchIntegrity(url) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), PIN_BUNDLE_TIMEOUT_MS);
   try {
-    const response = await fetch(url);
+    const response = await fetch(url, { signal: controller.signal });
     if (!response.ok) {
       console.error(`[webjs] hash ${url} returned ${response.status}`);
       return null;
@@ -1121,8 +1176,13 @@ async function fetchIntegrity(url) {
     const buf = new Uint8Array(await response.arrayBuffer());
     return await sha384Integrity(buf);
   } catch (e) {
-    console.error(`[webjs] hash ${url} failed: ${e && e.message}`);
+    const why = e && e.name === 'AbortError'
+      ? `timed out after ${PIN_BUNDLE_TIMEOUT_MS}ms`
+      : e && e.message;
+    console.error(`[webjs] hash ${url} failed: ${why}`);
     return null;
+  } finally {
+    clearTimeout(timer);
   }
 }
 
@@ -1254,7 +1314,7 @@ export async function pinAll(appDir, opts = {}) {
     installs.push(install);
     partsByInstall.set(spec, { pkg, version, subpath });
   }
-  const resolved = await jspmGenerate(installs, from);
+  const resolved = await jspmGenerate(installs, from, PIN_BUNDLE_TIMEOUT_MS);
 
   /** @type {Record<string, string>} */
   const importmap = {};
@@ -1496,7 +1556,11 @@ export async function listPinned(appDir) {
 // ---------------------------------------------------------------------------
 
 const NPM_REGISTRY = 'https://registry.npmjs.org';
-const NPM_TIMEOUT_MS = 10_000;
+// The npm registry is reached only by `audit`, `outdated`, and `update`,
+// all CLI commands, so it takes the same generous budget the pin bundle
+// fetch does rather than the server's. importmap-rails makes these same two
+// calls with Ruby's 60s Net::HTTP default.
+const NPM_TIMEOUT_MS = 60_000;
 
 /**
  * Fetch one URL from registry.npmjs.org with a small timeout. Returns
@@ -1696,7 +1760,7 @@ export async function updatePinned(appDir, opts = {}) {
       if (specPkg !== pkg) continue;
       const subpath = spec.slice(specPkg.length);
       const install = `${pkg}@${latest}${subpath}`;
-      const resolved = await jspmGenerate([install], from);
+      const resolved = await jspmGenerate([install], from, PIN_BUNDLE_TIMEOUT_MS);
       const newUrl = resolved[spec];
       if (!newUrl) continue;
       newImports[spec] = newUrl;
@@ -2169,7 +2233,6 @@ export async function checkImportmapCoherence(imports, opts) {
  */
 const liveIntegrityCache = new Map();
 
-const INTEGRITY_FETCH_TIMEOUT_MS = 10_000;
 // Cap concurrent bundle fetches so a large dep set does not open dozens of
 // sockets at once during warmup. Matches the bounded posture of the rest of
 // vendor.js (the jspm resolve is per-package but the network is the shared

package/webjs-config.schema.json

@@ -2,8 +2,8 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://webjs.dev/schemas/webjs-config.schema.json",
   "title": "webjs config block",
-  "description": "Schema for the `webjs` object in a webjs app's package.json. Each key maps to a documented reader (a server reader, or for `dev`/`start` the CLI's readAppTasks). An unknown key is flagged (additionalProperties is false) so a typo no longer silently falls back to the default.",
-  "$comment": "Single source of truth lives in THREE co-located places that must stay in lockstep: this schema, the TS type at packages/core/src/webjs-config.d.ts, and the reader functions (readElideEnabled in dev.js, readSeedEnabled in dev.js, compileHeaderRules in headers.js, compileRedirectRules / readTrailingSlashPolicy in redirects.js, readBasePath in base-path.js, readCspConfig in csp.js, readBodyLimits / computeServerTimeouts in body-limit.js, and the CLI's readAppTasks in packages/cli/lib/app-tasks.js for dev/start, #550). Adding a webjs.* key means updating all three. See packages/server/AGENTS.md for the one documented procedure.",
+  "description": "Schema for the `webjs` object in a WebJs app's package.json. Each key maps to a documented reader, mostly a server reader and for a few keys a CLI one. An unknown key is flagged (additionalProperties is false) so a typo no longer silently falls back to the default.",
+  "$comment": "Single source of truth lives in THREE co-located places that must stay in lockstep: this schema, the TS type at packages/core/src/webjs-config.d.ts, and the reader functions. Adding a `webjs.*` key means updating all three (plus the KNOWN_KEYS drift test). The reader inventory is deliberately NOT repeated here: packages/server/AGENTS.md holds the one canonical list and the procedure, because every duplicate of that list drifted.",
   "type": "object",
   "additionalProperties": false,
   "properties": {
@@ -160,7 +160,7 @@
       "default": 5000
     },
     "dev": {
-      "description": "Dev task orchestration (#550). `before`/`parallel` are read by the CLI (readAppTasks in packages/cli/lib/app-tasks.js); `regenerate` is read by the server (readRegenerateRules in dev-regenerate.js). webjs dev runs `before` (one-shot, e.g. webjs db migrate) to completion, then `parallel` (long-lived watchers) alongside the server. Replaces the old predev hook + concurrently watchers.",
+      "description": "Dev task orchestration (#550). Split per sub-key: `before`/`parallel` are read by the CLI (readAppTasks in packages/cli/lib/app-tasks.js), while `regenerate` (readRegenerateRules in dev-regenerate.js) and `watch` (readDevWatchPathsFromApp in dev.js) are read by the server. webjs dev runs `before` (one-shot, e.g. webjs db migrate) to completion, then `parallel` (long-lived watchers) alongside the server. Replaces the old predev hook + concurrently watchers.",
       "type": "object",
       "additionalProperties": false,
       "properties": {
@@ -216,6 +216,22 @@
           "items": { "type": "string" }
         }
       }
+    },
+    "doctor": {
+      "description": "`webjs doctor` policy (#1257). Read by the CLI (readDoctorPolicy in packages/cli/lib/doctor.js), NOT the server.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "gate": {
+          "description": "Per-check severity, keyed by the stable DOCTOR_CODES code (NODE_VERSION, UNMARKED_ASSET_LINKS, ELISION_CARRIERS, ...). `error` fails the exit, `warn` reports without failing, `off` silences the check: its finding is not printed and it cannot fail the exit, including under --strict (it still appears on the checklist as [off], in the summary's silenced count, and in full under --json). A code with no entry keeps its default: error for a hard toolchain failure, warn otherwise. This is how CI gates on a chosen subset without --strict making every warning fatal. A malformed gate is a hard error, so a typo cannot silently un-gate CI: that covers an unknown code, a bad severity, a wrong SHAPE (a non-object `doctor` or `gate`), and a misspelled sibling of `gate` such as `gates`. A result that could not check (a network or toolchain outage) is capped at warn and can never be escalated to error.",
+          "type": "object",
+          "propertyNames": { "pattern": "^[A-Z][A-Z0-9_]*$" },
+          "additionalProperties": {
+            "type": "string",
+            "enum": ["off", "warn", "error"]
+          }
+        }
+      }
     }
   }
 }

package/src/page-action.js

@@ -1,259 +0,0 @@
-import { isNotFound, isRedirect, isForbidden, isUnauthorized } from '@webjsdev/core';
-import { ssrPage, ssrNotFound, ssrForbidden, ssrUnauthorized, loadModule } from './ssr.js';
-import { readBytesBounded, payloadTooLarge, DEFAULT_MAX_MULTIPART_BYTES } from './body-limit.js';
-import { getBodyLimits } from './context.js';
-import { propagateTrustedRemoteIp } from './rate-limit.js';
-import { makeThenable } from './thenable-params.js';
-
-/**
- * Page server actions: a `page.{js,ts}` may export an `action` function that
- * handles a non-GET/HEAD submission to the page's own URL. This is webjs's
- * Remix-style page-action path, adapted to the no-build progressive-enhancement
- * model: a `<form method="POST">` submits with JS disabled, the action runs on
- * the server, and a validation failure re-renders the SAME page with field
- * errors and the user's typed values preserved.
- *
- * Behavior (see #244):
- *   - Action throws `redirect(url)` or `notFound()` => honored exactly as a page
- *     render does (3xx / 404). A thrown `redirect()` may target an external URL
- *     (it is the explicit nav sentinel, author-controlled).
- *   - Action returns a SUCCESS result => 303 See Other to `result.redirect` if
- *     present, else to the page's own path (Post/Redirect/Get, so a reload does
- *     not resubmit). `result.redirect` MUST be a same-site local path (see
- *     `sameSiteRedirect`), a non-local value is ignored to avoid an
- *     open-redirect through a user-controlled action result.
- *   - Action returns a FAILURE result => re-SSR the SAME page (status 422) with
- *     the result on `ctx.actionData`, so the page template can read
- *     `actionData.fieldErrors` / `actionData.values` and repopulate inputs.
- *
- * Failure detection is robust (it does not require a literal `success: false`):
- * see `isFailureResult`.
- *
- * @typedef {{
- *   success?: boolean,
- *   data?: unknown,
- *   error?: string,
- *   fieldErrors?: Record<string,string>,
- *   values?: Record<string,string>,
- *   status?: number,
- *   redirect?: string,
- * }} ActionResult
- */
-
-/**
- * Whether an action result is a FAILURE (re-render the page) rather than a
- * success (PRG redirect). A result is a failure when ANY of these hold:
- *   - `result.success === false` (explicit), OR
- *   - `result.fieldErrors` is present (per-field validation messages), OR
- *   - `result.error` is present AND `result.success !== true`.
- *
- * Success is the explicit `success: true`, or a bare value (or
- * undefined/null) carrying no error markers. This means an action that returns
- * `{ error, status }` or `{ fieldErrors }` WITHOUT a literal `success: false`
- * is still treated as a failure and its error is surfaced, not swallowed.
- *
- * @param {ActionResult | null | undefined} result
- * @returns {boolean}
- */
-function isFailureResult(result) {
-  if (!result || typeof result !== 'object') return false;
-  if (result.success === false) return true;
-  if (result.fieldErrors != null) return true;
-  if (result.error != null && result.success !== true) return true;
-  return false;
-}
-
-/**
- * Restrict a page action's `result.redirect` to a SAME-SITE local target.
- * Allowed: a path beginning with a single `/` (e.g. `/login`, `/a?b=1#c`).
- * Rejected: a protocol-relative `//host/...` and any absolute `scheme://...`
- * URL. A user-controlled redirect target is an open-redirect vector, so a
- * non-local value is dropped and the caller falls back to the page's own path.
- *
- * A thrown `redirect(absoluteUrl)` (the nav sentinel) is intentionally NOT
- * routed through here: that is the author-controlled escape hatch for a
- * legitimate external redirect.
- *
- * @param {unknown} target
- * @returns {string | null} the safe local path, or null when not same-site
- */
-function sameSiteRedirect(target) {
-  if (typeof target !== 'string') return null;
-  // Must start with a single slash (a leading `//` is protocol-relative and
-  // would navigate cross-origin).
-  if (!target.startsWith('/') || target.startsWith('//')) return null;
-  // A backslash after the leading slash (`/\evil.com`) is normalized by some
-  // browsers into a protocol-relative URL, so reject it too.
-  if (target.startsWith('/\\')) return null;
-  return target;
-}
-
-/**
- * Load a page module and return its `action` export, or null if it has none.
- * Uses ssr.js's shared `loadModule`, so page-action loading is consistent with
- * the SSR re-render. In prod the URL is stable and Node's module cache serves
- * one evaluation; in dev a cache-bust forces a fresh evaluation.
- *
- * @param {string} file absolute path to the page module
- * @param {boolean} dev
- * @returns {Promise<{ action: Function, module: Record<string, unknown> } | null>}
- */
-export async function loadPageAction(file, dev) {
-  try {
-    const mod = await loadModule(file, dev);
-    return typeof mod.action === 'function'
-      ? { action: /** @type {Function} */ (mod.action), module: mod }
-      : null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Read the submitted body ONCE, bounded by the form/multipart limit (issue
- * #237), and return both a `FormData` (handed to the action as `formData`) and a
- * rebuilt `Request` carrying the already-read bytes (handed to the action as
- * `request`, so it can still call `request.json()` / `request.formData()`). The
- * body is consumed off the ORIGINAL request directly, NOT via `req.clone()`: a
- * tee'd clone whose reader is cancelled mid-stream (the over-limit case)
- * deadlocks the untaken branch, hanging the response.
- *
- * An over-limit body is reported as `tooLarge` (the caller returns 413) and is
- * never buffered whole. A form posts more than a JSON RPC call (textarea, small
- * upload), so it uses the higher `multipart` cap. A non-form content type yields
- * an empty FormData so the action signature stays stable; the rebuilt request
- * still carries the raw bytes for the action to parse however it likes.
- *
- * @param {Request} req
- * @returns {Promise<{ tooLarge: boolean, formData: FormData, request: Request }>}
- */
-async function parseFormBody(req) {
-  const ct = req.headers.get('content-type') || '';
-  const limits = getBodyLimits();
-  const limit = limits ? limits.multipart : DEFAULT_MAX_MULTIPART_BYTES;
-  const { tooLarge, bytes } = await readBytesBounded(req, limit);
-  if (tooLarge) return { tooLarge: true, formData: new FormData(), request: req };
-
-  // Rebuild a fresh Request from the bytes so the action can re-read the body.
-  // SECURITY (#756): strip any inbound `x-webjs-remote-ip` the copy carried so a
-  // client cannot spoof it through the rebuild, and carry the FRAMEWORK-trusted
-  // remote IP forward out of band (the rebuild is a new object, so the listener's
-  // WeakMap stamp on `req` does not follow it). Without this, `clientIp` inside a
-  // page `action` (the no-JS form write path, e.g. login throttling) would read
-  // the spoofable header on Bun.
-  const headers = new Headers(req.headers);
-  headers.delete('x-webjs-remote-ip');
-  const rebuilt = new Request(req.url, {
-    method: req.method,
-    headers,
-    body: bytes && bytes.byteLength ? bytes : undefined,
-  });
-  propagateTrustedRemoteIp(req, rebuilt);
-
-  const isForm = /multipart\/form-data|application\/x-www-form-urlencoded/i.test(ct);
-  let formData = new FormData();
-  if (isForm) {
-    // Parse a SECOND fresh Request (the rebuilt one is reserved for the action).
-    const forParse = new Request(req.url, {
-      method: 'POST',
-      headers: ct ? { 'content-type': ct } : undefined,
-      body: bytes && bytes.byteLength ? bytes : undefined,
-    });
-    formData = await forParse.formData();
-  }
-  return { tooLarge: false, formData, request: rebuilt };
-}
-
-/**
- * Run a page `action` for a non-GET/HEAD request and produce the HTTP response.
- * The caller has already confirmed the path matches a page route AND that the
- * page module exports an `action` (via `loadPageAction`). The action runs inside
- * the same segment middleware as the page (the caller wraps this).
- *
- * The failure re-render reuses the SAME page module instance whose `action` just
- * ran (passed through as `pageModule`), so the page module is loaded once per
- * POST rather than evaluated a second time.
- *
- * @param {import('./router.js').PageRoute} route
- * @param {Record<string,string>} params
- * @param {URL} url
- * @param {{ action: Function, module: Record<string, unknown> }} loaded the page module's `action` plus the loaded module
- * @param {Request} req
- * @param {object} ssrOpts the same opts object `ssrPage` receives in dev.js
- * @returns {Promise<Response>}
- */
-export async function runPageAction(route, params, url, loaded, req, ssrOpts) {
-  const { action, module: pageModule } = loaded;
-  const searchParams = Object.fromEntries(url.searchParams.entries());
-  let formData = new FormData();
-  // The body is read ONCE here (bounded). `actionReq` is a rebuilt request the
-  // action can re-read; on a parse failure it falls back to the original `req`.
-  let actionReq = req;
-  try {
-    const parsed = await parseFormBody(req);
-    // Over the form/multipart limit (issue #237): 413 before the action runs.
-    if (parsed.tooLarge) return payloadTooLarge();
-    formData = parsed.formData;
-    actionReq = parsed.request;
-  } catch {
-    formData = new FormData();
-  }
-
-  /** @type {ActionResult | undefined} */
-  let result;
-  try {
-    // params / searchParams are awaitable AND sync-readable here too (#848).
-    result = await action({
-      request: actionReq,
-      params: makeThenable(params),
-      searchParams: makeThenable(searchParams),
-      url,
-      formData,
-    });
-  } catch (err) {
-    if (isRedirect(err)) {
-      const e = /** @type any */ (err);
-      // A thrown redirect from an action (a POST) defaults to 307 Temporary
-      // Redirect, which is method-preserving so the action's intent survives
-      // the bounce; an explicit `redirect(url, status)` overrides it. This is
-      // deliberately NOT the GET gate's 302 default (see ssr.js). PRG (303) is
-      // the SUCCESS-result path below.
-      return new Response(null, { status: e.status || 307, headers: { location: e.url } });
-    }
-    if (isNotFound(err)) {
-      return ssrNotFound(ssrOpts.notFoundFile ?? null, { ...ssrOpts, req, url });
-    }
-    // forbidden()/unauthorized() from a page action render the same 403/401
-    // boundary as the page-render path (#848), not a generic 500.
-    if (isForbidden(err)) {
-      return ssrForbidden(route, { ...ssrOpts, req, url });
-    }
-    if (isUnauthorized(err)) {
-      return ssrUnauthorized(route, { ...ssrOpts, req, url });
-    }
-    throw err;
-  }
-
-  // A page action MAY return a `Response` directly (e.g. a content-negotiated
-  // `streamResponse`, #248). Honor it verbatim, so the action owns the status +
-  // content type and the router applies it (a stream body surgically). With JS
-  // off the same action returns a normal ActionResult instead, so the PRG /
-  // re-render paths below still drive the no-JS form.
-  if (result instanceof Response) return result;
-
-  if (!isFailureResult(result)) {
-    // SUCCESS: Post/Redirect/Get. A user-controlled `result.redirect` is only
-    // honored when it is a same-site local path; otherwise fall back to the
-    // page's own path so a poisoned value cannot become an open redirect.
-    const ownPath = (url.pathname + url.search) || '/';
-    const safe = result ? sameSiteRedirect(result.redirect) : null;
-    return new Response(null, { status: 303, headers: { location: safe || ownPath } });
-  }
-
-  // FAILURE: re-render the SAME page with the action result available on
-  // ctx.actionData, status 422. Repopulation is the page author's job (native
-  // `value=${actionData.values?.field}`). Pass the already-loaded page module so
-  // the re-render shares this POST's single evaluation.
-  const status = typeof result.status === 'number' && result.status >= 400 ? result.status : 422;
-  return ssrPage(route, params, url, { ...ssrOpts, req, actionData: result, status, pageModule });
-}