@weft-js/start 0.1.1 → 0.1.2

package/src/server/dispatch.ts

@@ -0,0 +1,70 @@
+import { EXTENSION, type ServerExtension } from '../extension'
+import * as exec from '../exec'
+import type { Scope } from '../exec'
+import { rtRoute } from '../hub'
+import { socketRoute } from '../socket'
+import { serverFunction } from './functions'
+import type { HandlerOptions } from './types'
+
+interface Dispatch {
+  options: HandlerOptions
+  authBase: string
+  extensions: Map<string, ServerExtension>
+  form: (url: URL, request: Request, scope: Scope) => Promise<Response>
+  media: (url: URL, request: Request) => Promise<Response>
+  og: (url: URL, request: Request) => Promise<Response>
+  data: (path: string, request: Request, scope: Scope) => Promise<Response>
+  prerenderList: (request: Request, url: URL) => Promise<Response>
+  page: (url: URL, request: Request, scope: Scope) => Promise<Response>
+}
+
+/** Select the endpoint for a request. */
+export function makeDispatch({
+  options,
+  authBase,
+  extensions,
+  form,
+  media,
+  og,
+  data,
+  prerenderList,
+  page,
+}: Dispatch) {
+  /** Everything under `/_weft/x/<key>/`, for the extension with that key. Nothing else reaches it. */
+  async function extensionRoute(url: URL, request: Request, scope: Scope) {
+    const [key = '', ...rest] = url.pathname.slice(EXTENSION.length).split('/')
+    const extension = extensions.get(key)
+    if (!extension?.handle) return new Response('Not found', { status: 404 })
+    return extension.handle(request, rest.join('/'), {
+      invalidate: (tags) => exec.invalidate(scope, tags),
+      report: (d) => options.onDiagnostic?.(d),
+    })
+  }
+
+  return (request: Request, scope: Scope): Promise<Response> => {
+    const url = new URL(request.url)
+    if (options.auth && (url.pathname === authBase || url.pathname.startsWith(authBase + '/')))
+      return Promise.resolve(options.auth.handler(request))
+    if (url.pathname.startsWith('/_weft/fn/')) return serverFunction(options, url, request, scope)
+    if (url.pathname.startsWith(EXTENSION)) return extensionRoute(url, request, scope)
+    if (
+      request.method === 'POST' &&
+      !url.pathname.startsWith('/_weft/') &&
+      /^(application\/x-www-form-urlencoded|multipart\/form-data)/.test(
+        request.headers.get('content-type') ?? '',
+      )
+    )
+      return form(url, request, scope)
+    if (url.pathname === '/_weft/rt') return rtRoute(request, scope, options.realtime?.origins)
+    if (url.pathname === '/_weft/ws') return socketRoute(request, scope, options.realtime?.origins)
+    if (request.method !== 'GET' && request.method !== 'HEAD')
+      return Promise.resolve(new Response('Method not allowed', { status: 405 }))
+    if (url.pathname.startsWith('/_weft/m/')) return media(url, request)
+    if (url.pathname.startsWith('/_weft/og/') && url.pathname.endsWith('.png'))
+      return og(url, request)
+    if (url.pathname.startsWith('/_weft/data/') || url.pathname === '/_weft/data')
+      return data((url.pathname.slice('/_weft/data'.length) || '/') + url.search, request, scope)
+    if (url.pathname === '/_weft/og-routes') return prerenderList(request, url)
+    return page(url, request, scope)
+  }
+}

package/src/server/form.ts

@@ -0,0 +1,85 @@
+import {
+  decodeForm,
+  fieldsOf,
+  fns,
+  isRedirect,
+  StartError,
+  FnError,
+  type SchemaIssue,
+} from '../data'
+import * as exec from '../exec'
+import type { Scope } from '../exec'
+import { echoed, withHeaders } from './request'
+import type { HandlerOptions } from './types'
+export function makeForm(
+  options: HandlerOptions,
+  page: (url: URL, request: Request, scope: Scope) => Promise<Response>,
+) {
+  /**
+   * A form POST to a page (research 29 §5): the mutation, then 303 (Post/Redirect/Get) or the page again with the
+   * errors and what was typed. A form can't send `x-weft`, so the CSRF proof is the browser's own origin headers.
+   */
+  return async function form(url: URL, request: Request, scope: Scope): Promise<Response> {
+    const origin = request.headers.get('origin')
+    const from = request.headers.get('sec-fetch-site')
+    if (
+      !(origin
+        ? origin === url.origin && (!from || from === 'same-origin')
+        : from === 'same-origin')
+    ) {
+      options.onDiagnostic?.({
+        code: 'F002',
+        severity: 'error',
+        message: `F002: a form POST to ${url.pathname} without the same-origin proof (\`Origin\` or \`Sec-Fetch-Site\`)`,
+      })
+      return new Response('Forbidden', { status: 403 })
+    }
+    const fields = await request.formData()
+    const named = fields.get('$fn')
+    const id = typeof named === 'string' ? named : ''
+    const f = fns.get(id)
+    if (f?.kind !== 'mutation') {
+      options.onDiagnostic?.({
+        code: 'F003',
+        severity: 'error',
+        message: `F003: a form POST names \`${id}\`, which is no mutation (the page is older than the server)`,
+      })
+      return new Response('Not found', { status: 404 })
+    }
+    const see = (href: string) =>
+      withHeaders(
+        new Response(null, {
+          status: 303,
+          headers: { location: href, 'cache-control': 'no-cache' },
+        }),
+        scope,
+      )
+    const input = decodeForm(fields)
+    try {
+      await exec.runMutation(scope, f, input, [], true)
+      return see(url.pathname + url.search)
+    } catch (e) {
+      if (isRedirect(e)) return see(e.href)
+      const known = e instanceof StartError || e instanceof FnError
+      if (!known)
+        options.onDiagnostic?.({
+          code: 'E_FN',
+          severity: 'error',
+          message: `${id}: ${e instanceof Error ? (e.stack ?? e.message) : String(e)}`,
+        })
+      const failure = e as { issues?: SchemaIssue[]; status?: number; message?: string } | null
+      const issues = failure?.issues
+      const { errors, message } = fieldsOf(issues)
+      const key = fields.get('$form')
+      scope.form = {
+        id,
+        ...(typeof key === 'string' && { key }),
+        values: echoed(input),
+        errors,
+        message: issues ? message : (exec.shown(e, scope) as Error).message,
+        status: issues ? 422 : (failure?.status ?? 500),
+      }
+      return page(url, request, scope)
+    }
+  }
+}

package/src/server/functions.ts

@@ -0,0 +1,129 @@
+import { sessionChanged } from '../auth'
+import { fns, isRedirect, FnError, StartError } from '../data'
+import * as exec from '../exec'
+import type { Scope } from '../exec'
+import { multipartBody, withHeaders } from './request'
+import type { HandlerOptions } from './types'
+
+/** `/_weft/fn/<id>`: GET runs a query, POST a mutation (CSRF-checked), both answering JSON (research 27 §3). */
+export async function serverFunction(
+  options: HandlerOptions,
+  url: URL,
+  request: Request,
+  scope: Scope,
+): Promise<Response> {
+  const id = decodeURIComponent(url.pathname.slice('/_weft/fn/'.length))
+  const f = fns.get(id)
+  const out = (body: unknown, status = 200) =>
+    withHeaders(Response.json(body, { status, headers: { 'cache-control': 'no-store' } }), scope)
+  const fail = (
+    code: string,
+    message: string,
+    status: number,
+    extra: object = {},
+    sent?: unknown,
+  ) => {
+    options.onDiagnostic?.({ code, severity: 'error', message })
+    return out(
+      { e: { code, message: sent instanceof Error ? sent.message : message, ...extra } },
+      status,
+    )
+  }
+  if (!f)
+    return fail(
+      'Q009',
+      `Q009: no server function \`${id}\` (the page is older than the server, or the module isn't a server module): reload`,
+      404,
+    )
+  let fromForm = false
+  if (f.kind === 'stream')
+    return fail('Q009', `Q009: \`${id}\` is a stream: its client reads it over \`/_weft/rt\``, 405)
+  try {
+    if (f.kind === 'query') {
+      if (request.method !== 'GET' && request.method !== 'HEAD')
+        return fail('Q009', `Q009: \`${id}\` is a query: GET only`, 405)
+      const raw = url.searchParams.get('i')
+      const e = await exec.fetchQuery(scope, f, raw === null ? undefined : JSON.parse(raw))
+      return out({ v: e.v, t: e.tags })
+    }
+    if (request.method !== 'POST') return fail('Q010', `Q010: mutation \`${id}\` needs POST`, 405)
+    const origin = request.headers.get('origin')
+    const from = request.headers.get('sec-fetch-site')
+    const cross =
+      (origin && origin !== url.origin) || (from && from !== 'same-origin' && from !== 'none')
+    const type = request.headers.get('content-type') ?? ''
+    const multipart = type.startsWith('multipart/form-data') // `<Form>` with a file; `x-weft` still forces a preflight
+    if (
+      cross ||
+      request.headers.get('x-weft') !== '1' ||
+      !(multipart || type.startsWith('application/json'))
+    )
+      return fail(
+        'Q010',
+        `Q010: mutation \`${id}\` without the CSRF proof (POST + JSON + \`x-weft: 1\`, same origin): call it through its stub`,
+        403,
+      )
+    const body = multipart
+      ? await multipartBody(request)
+      : ((await request.json()) as { i?: unknown; f?: [string, unknown][]; c?: 1 })
+    fromForm = !!body.c
+    // A token opens only the functions listed for it, and what a mutation refreshes would run as that token too.
+    const refresh =
+      Array.isArray(body.f) && !request.headers.has('authorization') ? body.f.slice(0, 200) : []
+    const answer = await exec.runMutation(scope, f, body.i, refresh, fromForm)
+    if (options.dev && sessionChanged(scope.headers))
+      options.onDiagnostic?.({
+        code: 'A004',
+        severity: 'warning',
+        message: `\`${id}\` changed the session cookie without a redirect: the tab keeps what the last session cached. \`redirect()\` after it`,
+      })
+    return out(answer)
+  } catch (e) {
+    return functionError(e, { fromForm, scope, options, id, out, fail })
+  }
+}
+
+function functionError(
+  e: unknown,
+  c: {
+    fromForm: boolean
+    scope: Scope
+    options: HandlerOptions
+    id: string
+    out: (body: unknown, status?: number) => Response
+    fail: (
+      code: string,
+      message: string,
+      status: number,
+      extra?: object,
+      sent?: unknown,
+    ) => Response
+  },
+): Response {
+  const { fromForm, scope, options, id, out, fail } = c
+  // The session changed: a full load, so nothing cached for the last user survives in the tab (research 28 §3).
+  if (isRedirect(e)) return out({ r: e.href, ...(sessionChanged(scope.headers) && { x: 1 }) })
+  if (e instanceof FnError) return out({ e: { code: e.code, message: e.message } }, e.status)
+  // A wrong field in a form is an answer, not a fault: nothing to log.
+  if (e instanceof StartError && fromForm && e.extra.issues)
+    return out({ e: { code: e.code, message: e.message, issues: e.extra.issues } }, 422)
+  if (e instanceof StartError)
+    return fail(
+      e.code,
+      e.message,
+      (e.extra.status as number) ?? 500,
+      e.extra.issues ? { issues: e.extra.issues } : e.extra.typed ? { data: e.extra.data } : {},
+      exec.shown(e, scope),
+    )
+  options.onDiagnostic?.({
+    code: 'E_FN',
+    severity: 'error',
+    message: `${id}: ${e instanceof Error ? (e.stack ?? e.message) : String(e)}`,
+  })
+  return out(
+    {
+      e: { message: options.dev && e instanceof Error ? e.message : 'Server function failed.' },
+    },
+    500,
+  )
+}

package/src/server/handler.ts

@@ -0,0 +1,39 @@
+import type { AsyncLocalStorage } from 'node:async_hooks'
+import * as exec from '../exec'
+import type { Scope } from '../exec'
+import { hub } from '../hub'
+import { compressed } from './compression'
+import { stamped } from './request'
+import type { makeServices } from './services'
+import type { HandlerOptions } from './types'
+
+/** Wrap endpoint routing in the request scope and boot lifecycle. */
+export function makeHandler(
+  options: HandlerOptions,
+  als: AsyncLocalStorage<Scope>,
+  services: ReturnType<typeof makeServices>,
+  route: (request: Request, scope: Scope) => Promise<Response>,
+) {
+  return async (incoming: Request): Promise<Response> => {
+    const request = options.auth ? stamped(incoming) : incoming
+    await services.loadExtensions()
+    services.check()
+    const scope = exec.createScope(request, services.scopeOptions)
+    // The build's prerender only lists cards: it holds no secrets and may have no database.
+    if (new URL(request.url).pathname === '/_weft/og-routes')
+      return als.run(scope, () => route(request, scope))
+    await services.boot()
+    if (options.liveRequired?.length) await hub().probed
+    if (hub().refused)
+      return Response.json(
+        {
+          e: {
+            code: 'R015',
+            message: options.dev ? hub().refused!.message : 'Live data is unavailable.',
+          },
+        },
+        { status: 503, headers: { 'cache-control': 'no-store' } },
+      )
+    return compressed(request, await als.run(scope, () => route(request, scope)))
+  }
+}

package/src/server/head.ts

@@ -0,0 +1,96 @@
+import { mergeMeta, type Merged } from '@weft-js/core/ssr'
+import { pageText } from '../derive.mjs'
+import { pointAt } from './resolver'
+import { cardPath, hash } from './text'
+import type {
+  HandlerOptions,
+  Level,
+  Manifest,
+  MetaSource,
+  Resolved,
+  RouteEntry,
+  RouteModule,
+} from './types'
+
+/** Whether a title or description can come from the page itself. */
+export const leftToPage = (s: MetaSource['title']) => s === 'config' || s === 'none'
+
+/** Complete a head from the metadata and the rendered page. */
+export function makeComplete(
+  options: HandlerOptions,
+  manifest: Manifest,
+  site: NonNullable<HandlerOptions['site']>,
+  mod: (file?: string) => RouteModule | undefined,
+  CARD: { width: number; height: number },
+) {
+  /**
+   * The content hash of a generated card: what it draws. The built-in card reads the head and the site's look and
+   * nothing else, so a loader's timestamp can't change its URL; an `.og.tsx` also gets the page's data.
+   */
+  function cardUrl(route: RouteEntry, levels: Level[], head: Merged, path: string) {
+    const card = route.card ?? manifest.defaultCard
+    const size = mod(card)?.size ?? CARD
+    const { image: _, ...graph } = head.og
+    const leaf = levels.at(-1)!
+    const v = hash(
+      [
+        options.build ?? '',
+        card ?? 'builtin',
+        JSON.stringify(size),
+        JSON.stringify({ ...head, og: graph }),
+        JSON.stringify(site.card ?? null),
+        card ? JSON.stringify(leaf.data ?? null) : '',
+      ].join('\0'),
+    )
+    return `/_weft/og/${cardPath(path)}.png?v=${v}`
+  }
+
+  /**
+   * The rest of the head, once the page's HTML can speak for it (research 20 §10): a level that set no title or
+   * description gets the page's own, under anything a layout or the route wrote, and `image: 'auto'` becomes the
+   * card, whose URL hashes the text it shows. Called once per request, before anything is written.
+   */
+  return function complete(r: Resolved, html?: string) {
+    if (!r.metas || !r.source) return r.head
+    const { metas, source } = r
+    r.metas = undefined
+    const left = leftToPage(source.title) || leftToPage(source.description)
+    const words = left && r.status === 200 && html ? pageText(html) : {}
+    const title = leftToPage(source.title) ? words.title : undefined
+    const description = leftToPage(source.description) ? words.description : undefined
+    if (title) source.title = 'auto'
+    if (description) source.description = 'auto'
+    const head = (r.head = mergeMeta(
+      site,
+      { ...(title !== undefined && { title }), ...(description !== undefined && { description }) },
+      ...metas,
+    ))
+    pointAt(head, r.origin)
+    if (
+      head.jsonLd === undefined &&
+      r.route?.pattern === '/' &&
+      r.status === 200 &&
+      r.origin &&
+      site.name
+    )
+      head.jsonLd = {
+        '@context': 'https://schema.org',
+        '@type': 'WebSite',
+        name: site.name,
+        url: r.origin,
+        ...(site.description && { description: site.description }),
+      }
+    if (head.og.image === 'auto') {
+      const showing = r.status === 200 && r.route
+      if (showing)
+        head.og.image = {
+          url: cardUrl(r.route!, r.levels, head, r.path),
+          ...CARD,
+          alt: head.og.title ?? head.title,
+        }
+      else delete head.og.image
+      if (showing) source.image = r.route!.card || manifest.defaultCard ? 'card' : 'auto'
+    } else if (head.og.image) source.image = 'explicit'
+    return head
+  }
+}

package/src/server/media.ts

@@ -0,0 +1,60 @@
+import type { HandlerOptions } from './types'
+import type { MediaServer } from '../exec'
+export function makeMedia(
+  options: HandlerOptions,
+  mediaServer: () => Promise<MediaServer> | undefined,
+) {
+  /** `/_weft/m/<hash>/<width>.<fmt>` (research 29 §6): content-addressed, so cached for good; `auto` varies on `Accept`. */
+  return async function media(url: URL, request: Request): Promise<Response> {
+    const m = /^\/_weft\/m\/([0-9a-f]{32})\/(\d+)\.([a-z0-9]+)$/.exec(url.pathname)
+    const server = await mediaServer()
+    if (!server)
+      options.onDiagnostic?.({
+        code: 'M017',
+        severity: 'error',
+        message:
+          'M017: a media URL was requested, but nothing provides `media.server`. Add `media()` from `@weft-js/plugin-media` to `plugins`',
+      })
+    const out =
+      m &&
+      (await server?.serve({
+        hash: m[1]!,
+        width: Number(m[2]),
+        format: m[3]!,
+        accept: request.headers.get('accept') ?? '',
+      }))
+    if (!out) return new Response('Not found', { status: 404 })
+    const headers = new Headers({
+      'content-type': out.type,
+      'cache-control': 'public, max-age=31536000, immutable',
+      etag: `"${m[1]}-${out.width}-${out.format}"`,
+      'x-content-type-options': 'nosniff',
+    })
+    if (out.negotiated) headers.set('vary', 'Accept')
+    if (out.type === 'image/svg+xml')
+      headers.set(
+        'content-security-policy',
+        "default-src 'none'; style-src 'unsafe-inline'; sandbox",
+      )
+    if (out.temporary) {
+      // The original, standing in for a rung still encoding.
+      headers.set('cache-control', 'no-store')
+      headers.delete('etag')
+    }
+    if (request.headers.get('if-none-match') === headers.get('etag'))
+      return new Response(null, { status: 304, headers })
+    const range =
+      /^(video|audio)\//.test(out.type) &&
+      /^bytes=(\d+)-(\d*)$/.exec(request.headers.get('range') ?? '')
+    if (!range) return new Response(out.bytes as BodyInit, { headers })
+    const start = Number(range[1])
+    const end = Math.min(range[2] ? Number(range[2]) : Infinity, out.bytes.length - 1)
+    if (start > end)
+      return new Response(null, {
+        status: 416,
+        headers: { 'content-range': `bytes */${out.bytes.length}` },
+      })
+    headers.set('content-range', `bytes ${start}-${end}/${out.bytes.length}`)
+    return new Response(out.bytes.subarray(start, end + 1) as BodyInit, { status: 206, headers })
+  }
+}

package/src/server/navigation-cache.ts

@@ -0,0 +1,80 @@
+import { createHash } from 'node:crypto'
+
+/** Prevent retention of a route response. */
+export function noRetention(response: Response): Response {
+  response.headers.set('cache-control', 'no-store')
+  response.headers.delete('etag')
+  return response
+}
+
+function cacheDirectives(policy: string): string[] | undefined {
+  const parts: string[] = []
+  let start = 0
+  let quoted = false
+  let escaped = false
+  for (let i = 0; i < policy.length; i++) {
+    const char = policy[i]
+    if (escaped) escaped = false
+    else if (quoted && char === '\\') escaped = true
+    else if (char === '"') quoted = !quoted
+    else if (char === ',' && !quoted) {
+      parts.push(policy.slice(start, i).trim())
+      start = i + 1
+    }
+  }
+  if (quoted || escaped) return undefined
+  parts.push(policy.slice(start).trim())
+  return parts.filter(Boolean)
+}
+
+/** Validate only the final, authorized route representation. */
+export function validateNavigation(
+  response: Response,
+  request: Request,
+  body: string,
+  build: string | undefined,
+  status: number,
+): Response {
+  const headers = response.headers
+  const policy = headers.get('cache-control') ?? ''
+  const directives = cacheDirectives(policy)
+  if (!directives) return noRetention(response)
+  const noStore = directives.some((part) => /^no-store(?:\s*=|$)/i.test(part))
+  if (status < 200 || status >= 300 || headers.has('set-cookie') || noStore) {
+    if (noStore) {
+      headers.delete('etag')
+      return response
+    }
+    return noRetention(response)
+  }
+
+  const kept = directives.filter((part) => !/^(public|max-age)(?:\s*=|$)/i.test(part))
+  // A bare private directive protects the entire response, including unlisted fields.
+  const barePrivate = kept.some((part) => /^private$/i.test(part))
+  if (!barePrivate) kept.unshift('private')
+  kept.splice(1, 0, 'max-age=0')
+  if (!policy) kept.push('stale-while-revalidate=30')
+  headers.set('cache-control', kept.join(', '))
+  const vary = headers.get('vary')
+  if (vary !== '*') {
+    const names = (vary ?? '')
+      .split(',')
+      .map((name) => name.trim())
+      .filter(Boolean)
+    for (const name of ['Accept', 'Cookie', 'Authorization'])
+      if (!names.some((existing) => existing.toLowerCase() === name.toLowerCase())) names.push(name)
+    headers.set('vary', names.join(', '))
+  }
+  const tag = `"${createHash('sha256')
+    .update(JSON.stringify([build ?? '', body]))
+    .digest('hex')}"`
+  headers.set('etag', tag)
+  const candidates = (request.headers.get('if-none-match') ?? '').split(',')
+  if (
+    candidates.some(
+      (candidate) => candidate.trim().replace(/^W\//, '') === tag || candidate.trim() === '*',
+    )
+  )
+    return new Response(null, { status: 304, headers })
+  return response
+}

package/src/server/navigation.tsx

@@ -0,0 +1,85 @@
+import { renderToStringAsync } from '@weft-js/core/ssr'
+import type { Merged } from '@weft-js/core/ssr'
+import type { RoutePayload, createRouteState } from '../router'
+import * as exec from '../exec'
+import type { Scope } from '../exec'
+import { App } from '../view'
+import { withLevels } from './render'
+import { payloadOf, wire } from './payload'
+import { noRetention, validateNavigation } from './navigation-cache'
+import { cookieJar, redirectBody, withHeaders } from './request'
+import type { HandlerOptions, Resolved } from './types'
+export function makeNavigation({
+  resolve,
+  finished,
+  statics,
+  stateOf,
+  PASSES,
+  options,
+}: {
+  resolve: (path: string, request: Request) => Promise<Resolved>
+  finished: (r: Resolved, request: Request) => Promise<Merged>
+  statics: Set<string>
+  stateOf: (r: Resolved, payload: RoutePayload) => ReturnType<typeof createRouteState>
+  PASSES: number
+  options: HandlerOptions
+}) {
+  /** The route as JSON for client navigation, with deferred fields awaited. */
+  return async function data(path: string, request: Request, scope: Scope): Promise<Response> {
+    const r = await resolve(path, request)
+    if (r.redirect) {
+      const headers = new Headers(r.redirectHeaders)
+      headers.delete('location')
+      headers.set('cache-control', 'no-store')
+      return noRetention(
+        redirectBody(
+          Response.json(
+            { m: [], p: path, s: r.redirect.status, r: r.redirect.href } satisfies RoutePayload,
+            { headers },
+          ),
+          scope,
+          'application/json',
+        ),
+      )
+    }
+    for (const lv of r.levels)
+      if (lv.d?.length)
+        lv.data = {
+          ...(lv.data as object),
+          ...Object.fromEntries(
+            await Promise.all(
+              lv.d.map(async (k) => [k, await (lv.raw as Record<string, unknown>)[k]]),
+            ),
+          ),
+        }
+    await finished(r, request)
+    const c = wire(scope)
+    let payload = payloadOf(r, true, options)
+    if (r.levels.some((lv) => statics.has(lv.id))) {
+      const route = stateOf(r, payload)
+      const out = await renderToStringAsync(() => <App route={route} />, {
+        passes: PASSES,
+        shown: (e) => exec.shown(e, scope),
+        app: { cookies: cookieJar(request) },
+      })
+      const at = out.lastIndexOf('<script type="application/json" data-weft>')
+      payload = {
+        ...withLevels(payload, at < 0 ? out : out.slice(0, at), statics, true),
+        ...(at >= 0 && {
+          b: JSON.parse(
+            out
+              .slice(at)
+              .replace(/^<[^>]*>/, '')
+              .replace(/<\/script>$/, ''),
+          ),
+        }),
+      }
+    }
+    const body = JSON.stringify({ ...payload, ...(c.length && { c }) })
+    const response = withHeaders(
+      new Response(body, { headers: { 'content-type': 'application/json' } }),
+      scope,
+    )
+    return validateNavigation(response, request, body, options.build, r.error ? 500 : r.status)
+  }
+}