@zubra/actions 5.5.0 → 5.6.0

package/README.md

@@ -12,4 +12,6 @@ const response = await actions.fetch(request);  // fetch-style servers; null if
 
 Adapters: `@zubra/actions/hono`, `@zubra/actions/express`, `@zubra/actions/fastify`. Put `actions.script()` on pages with action forms.
 
+On Cloudflare Workers (no disk to compile from): `npx zubra-actions build components --out src/actions`, then `createActions({ actions })` from `@zubra/actions/edge`. See `docs/actions.md`.
+
 The contract, the security rules and the no-JavaScript path are in [docs/actions.md](https://github.com/journey-to-code-org/zubra/blob/main/docs/actions.md).

package/bin/zubra-actions.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+// zubra-actions build <components> --out <folder>
+import { buildActions } from '../src/build.js';
+
+const [command, ...rest] = process.argv.slice(2);
+const usage = 'Usage: zubra-actions build <components folder> --out <folder>';
+if (command !== 'build') {
+  console.error(usage);
+  process.exit(command === '--help' || command === '-h' ? 0 : 2);
+}
+let components = 'components';
+let out;
+for (let i = 0; i < rest.length; i++) {
+  if (rest[i] === '--out' || rest[i] === '-o') out = rest[++i];
+  else if (rest[i].startsWith('--out=')) out = rest[i].slice(6);
+  else components = rest[i];
+}
+if (!out) {
+  console.error(usage);
+  process.exit(2);
+}
+try {
+  const routes = await buildActions({ components, out });
+  console.log(`${routes.length} action${routes.length === 1 ? '' : 's'} → ${out}/index.js`);
+  for (const route of routes) console.log(`  ${route}`);
+} catch (error) {
+  console.error(`zubra-actions: ${error.message}`);
+  process.exit(1);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zubra/actions",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "description": "Serve Zubra components' 'use server' functions over plain form posts, enhanced to fetch when JavaScript loads.",
   "type": "module",
   "main": "./src/index.js",
@@ -14,6 +14,14 @@
       "types": "./src/client.d.ts",
       "default": "./src/client.js"
     },
+    "./edge": {
+      "types": "./src/edge.d.ts",
+      "default": "./src/edge.js"
+    },
+    "./build": {
+      "types": "./src/build.d.ts",
+      "default": "./src/build.js"
+    },
     "./express": "./src/express.js",
     "./fastify": "./src/fastify.js",
     "./hono": "./src/hono.js"
@@ -22,8 +30,8 @@
     "test": "node --test \"test/*.test.js\""
   },
   "peerDependencies": {
-    "@zubra/compiler": "^5.5.0",
-    "@zubra/server": "^5.5.0"
+    "@zubra/compiler": "^5.6.0",
+    "@zubra/server": "^5.6.0"
   },
   "devDependencies": {
     "@zubra/compiler": "file:../compiler",
@@ -34,8 +42,12 @@
     "hono": "4.13.17",
     "playwright": "1.63.0"
   },
+  "bin": {
+    "zubra-actions": "./bin/zubra-actions.js"
+  },
   "files": [
     "src",
+    "bin",
     "README.md"
   ],
   "engines": {

package/src/build.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Write each component's server functions to `<out>/<component>.server.js` and `<out>/index.js`
+ * exporting `actions`, for `@zubra/actions/edge`. Resolves to every route.
+ */
+export function buildActions(options: { components?: string; out: string }): Promise<string[]>;

package/src/build.js

@@ -0,0 +1,71 @@
+// `zubra-actions build`: a components folder's server functions as plain modules, for hosts that
+// can't compile at start-up (a Cloudflare Worker has no disk and can't import code it generates).
+// Your bundler (Wrangler, esbuild, Vite) then bundles them like any other import:
+//
+//   npx zubra-actions build components --out src/actions     # writes src/actions/index.js
+//   import { actions } from './actions/index.js';
+//   import { createActions } from '@zubra/actions/edge';
+//   const forms = createActions({ actions });
+//
+// Rebuild when a component's server functions change; the files say they're generated.
+import { mkdirSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import { flatName, rewriteImports, serverHalves } from './compile.js';
+
+const HEADER = '// Generated by `zubra-actions build` from';
+/** A path from `from` to `to`, with "/" between its parts, as imports have. */
+const posix = (from, to) => relative(from, to).split(sep).join('/');
+
+/**
+ * Writes `<out>/<component>.server.js` for each component with server functions, and
+ * `<out>/index.js` exporting `actions`: every route. Resolves to the routes. Files it wrote before
+ * that no longer have a component are removed; nothing else in `out` is touched.
+ */
+export async function buildActions({ components = 'components', out }) {
+  if (!out) throw new TypeError('buildActions({ components, out }): `out` is the folder to write');
+  const root = resolve(components);
+  const dir = resolve(out);
+  mkdirSync(dir, { recursive: true });
+  const halves = await serverHalves(root);
+  const written = new Set(['index.js']);
+  // The same check the Node entry makes: two components may not define one URL.
+  const urls = [];
+  for (const { output } of halves) {
+    for (const url of urlsOf(output)) {
+      if (urls.includes(url)) throw new Error(`@zubra/actions: two components define ${url}`);
+      urls.push(url);
+    }
+  }
+  const imports = [];
+  const maps = [];
+  for (const [n, { path, output }] of halves.entries()) {
+    const file = `${flatName(relative(root, path))}.server.js`;
+    const source = posix(dir, path);
+    // Relative imports still reach the component's neighbours, from where the file now is.
+    const code = rewriteImports(output, (specifier) => {
+      const target = posix(dir, resolve(dirname(path), specifier));
+      return target.startsWith('.') ? target : `./${target}`;
+    });
+    writeFileSync(join(dir, file), `${HEADER} ${source}. Don't edit it.\n${code}`);
+    written.add(file);
+    imports.push(`import { actions as a${n} } from './${file}';`);
+    maps.push(`a${n}`);
+  }
+  writeFileSync(
+    join(dir, 'index.js'),
+    `${HEADER} ${posix(dir, root) || '.'}. Don't edit it.\n` +
+      `// Every component's 'use server' functions: { '/_zb/action/<tag>/<name>': fn }.\n` +
+      `${imports.join('\n')}${imports.length ? '\n' : ''}\nexport const actions = { ${maps.map((m) => `...${m}`).join(', ')} };\n`,
+  );
+  // Leftovers from components that are gone (only files this command writes).
+  for (const entry of readdirSync(dir)) {
+    if (entry.endsWith('.server.js') && !written.has(entry)) rmSync(join(dir, entry));
+  }
+  return urls;
+}
+
+/** The URLs a server half's `actions` map names, read from the compiler's output (not run: it may import what only the host has). */
+function urlsOf(output) {
+  const map = /export const actions = \{([^]*?)\};/.exec(output)?.[1] ?? '';
+  return [...map.matchAll(/"(\/_zb\/action\/[^"]+)"\s*:/g)].map(([, url]) => url);
+}

package/src/compile.js

@@ -0,0 +1,47 @@
+// The server halves of a components folder: each component's 'use server' functions, compiled.
+// Node only (reads the folder, runs the compiler); used when the Node entry starts and by
+// `zubra-actions build`, so both see the same functions.
+import { readdirSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { findCompiler } from '@zubra/server';
+
+const SOURCE = /\.zb(?:\.[jt]sx)?$/;
+
+let compiler;
+async function load() {
+  if (!compiler) {
+    findCompiler();
+    compiler = await import('@zubra/compiler');
+  }
+  return compiler;
+}
+
+/** `[{ path, output }]` for every component under `root` that has server functions, in path order. */
+export async function serverHalves(root) {
+  const { request, sources: read } = await load();
+  const halves = [];
+  for (const path of sources(resolve(root))) {
+    const response = request({ emit: 'server', path, files: read(path) });
+    if (!response.ok) throw new Error(response.error);
+    if (/^export (async )?function /m.test(response.output)) halves.push({ path, output: response.output });
+  }
+  return halves;
+}
+
+/** A component's path without its extension, flattened into one file name: `forms/login.zb` → `forms__login`. */
+export const flatName = (relativePath) => relativePath.split(/[\\/]/).join('__').replace(SOURCE, '');
+
+/** Rewrite each relative import (`'./x'`, `'../x'`) with `to(specifier)`: static, re-exports, and `import('./x')`. */
+export function rewriteImports(code, to) {
+  return code.replace(/(\bfrom\s*|\bimport\s*\(?\s*)(['"])(\.{1,2}\/[^'"]+)\2/g, (_, keyword, quote, specifier) => `${keyword}${quote}${to(specifier)}${quote}`);
+}
+
+function sources(dir, out = []) {
+  for (const entry of readdirSync(dir).sort()) {
+    const path = join(dir, entry);
+    if (statSync(path).isDirectory()) {
+      if (entry !== 'node_modules' && !entry.startsWith('.')) sources(path, out);
+    } else if (SOURCE.test(entry)) out.push(path);
+  }
+  return out;
+}

package/src/core.js

@@ -0,0 +1,119 @@
+// What @zubra/actions does with a request, given its routes: no file system, no Node.js. The Node
+// entry (index.js) compiles a components folder into routes when it starts; the edge entry
+// (edge.js) is given routes built ahead of time (`zubra-actions build`). Both answer through this.
+export const MOUNT = '/_zb/action/';
+export const SCRIPT_PATH = '/_zb/actions.js';
+export const COOKIE = '__zb_result';
+export const CLEAR = `${COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+
+/**
+ * `routes`: a Map of URL → function. `client`: the enhancing script's source, served at
+ * SCRIPT_PATH, or null when the host serves it as a static file.
+ */
+export function createActionsCore({ routes, client = null, origins = [], onError = (error) => console.error(error), context = () => ({}) }) {
+  const allowed = (request) => {
+    const site = request.headers.get('sec-fetch-site');
+    if (site) return site === 'same-origin' || site === 'none';
+    const origin = request.headers.get('origin');
+    if (!origin) return true; // not a browser (curl, a test): CSRF needs a browser
+    return origin === new URL(request.url).origin || origins.includes(origin);
+  };
+
+  /** The page to go back to: the referring page on this origin, else the site root. */
+  const back = (request) => {
+    const referer = request.headers.get('referer');
+    try {
+      const url = new URL(referer, request.url);
+      if (url.origin === new URL(request.url).origin) return url.pathname + url.search;
+    } catch {}
+    return '/';
+  };
+
+  async function fetch(request, extra = {}) {
+    const url = new URL(request.url);
+    if (request.method === 'GET' && url.pathname === SCRIPT_PATH) {
+      return client === null ? null : new Response(client, { headers: { 'content-type': 'text/javascript; charset=utf-8' } });
+    }
+    if (!url.pathname.startsWith(MOUNT)) return null;
+    if (request.method !== 'POST') return text(405, 'Method Not Allowed', { allow: 'POST' });
+    if (!allowed(request)) return text(403, 'Cross-site form posts are refused');
+    const fn = routes.get(url.pathname);
+    if (!fn) return text(404, 'Not Found');
+    const wantsJson = (request.headers.get('accept') ?? '').includes('application/json');
+    let value;
+    let failed = false;
+    try {
+      const more = await context({ request, ...extra });
+      value = await fn(await request.formData(), { ...more, request });
+    } catch (error) {
+      onError(error, request);
+      failed = true;
+      value = { error: 'Something went wrong' };
+    }
+    if (value instanceof Response) {
+      // A redirect after success: the enhanced path is told where to go rather than following it,
+      // so the page navigates once, with the location's #fragment kept (fetch drops it).
+      const location = value.headers.get('location');
+      if (wantsJson && location && value.status >= 300 && value.status < 400) {
+        const headers = new Headers({ 'zb-location': location });
+        for (const cookie of value.headers.getSetCookie()) headers.append('set-cookie', cookie);
+        return new Response(null, { status: 204, headers });
+      }
+      return value;
+    }
+    if (wantsJson) {
+      return new Response(JSON.stringify(value ?? null), {
+        status: failed ? 500 : 200,
+        headers: { 'content-type': 'application/json' },
+      });
+    }
+    const headers = new Headers({ location: back(request) });
+    const cookie = encodeURIComponent(JSON.stringify({ action: url.pathname, value: value ?? null }));
+    // A cookie holds about 4 KB; a bigger result reaches only the enhanced path.
+    if (cookie.length < 3800) {
+      headers.append('set-cookie', `${COOKIE}=${cookie}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`);
+    }
+    return new Response(null, { status: 303, headers });
+  }
+
+  /**
+   * After a no-JavaScript post: `{ action, value }` once, else null. `request` is a fetch Request
+   * or a Node request; `setHeader(name, value)` is given the header that clears the cookie.
+   */
+  function result(request, setHeader) {
+    const header = (typeof request.headers.get === 'function' ? request.headers.get('cookie') : request.headers.cookie) ?? '';
+    const match = header.split(/;\s*/).find((part) => part.startsWith(`${COOKIE}=`));
+    if (!match) return null;
+    setHeader?.('set-cookie', CLEAR);
+    try {
+      return JSON.parse(decodeURIComponent(match.slice(COOKIE.length + 1)));
+    } catch {
+      return null;
+    }
+  }
+
+  return {
+    fetch,
+    result,
+    routes: () => [...routes.keys()],
+    script: () => `<script type="module" src="${SCRIPT_PATH}"></script>`,
+    clearCookie: CLEAR,
+  };
+}
+
+/** `{ url: fn }` (one component's `actions`, or several merged) as routes, refusing a URL twice. */
+export function routesFrom(...maps) {
+  const routes = new Map();
+  for (const map of maps) {
+    for (const [url, fn] of Object.entries(map ?? {})) {
+      if (!url.startsWith(MOUNT) || typeof fn !== 'function') throw new TypeError(`@zubra/actions: ${url} is not an action route`);
+      if (routes.has(url)) throw new Error(`@zubra/actions: two components define ${url}`);
+      routes.set(url, fn);
+    }
+  }
+  return routes;
+}
+
+function text(status, body, headers = {}) {
+  return new Response(body, { status, headers: { 'content-type': 'text/plain; charset=utf-8', ...headers } });
+}

package/src/edge.d.ts

@@ -0,0 +1,33 @@
+import type { ActionResult } from './index.js';
+
+export const MOUNT: '/_zb/action/';
+export const SCRIPT_PATH: '/_zb/actions.js';
+export const COOKIE: '__zb_result';
+
+/** A server function: the form's data, and `request` with whatever `context()` returned. */
+export type ActionFunction = (formData: FormData, context: { request: Request; [key: string]: unknown }) => unknown;
+
+export interface EdgeActionsOptions<Extra extends object = object> {
+  /** `{ '/_zb/action/<tag>/<name>': fn }`: `actions` from `zubra-actions build`'s index.js. */
+  actions: Record<string, ActionFunction>;
+  /** The enhancing script's source, to serve at `/_zb/actions.js`. Default: serve it from static assets. */
+  client?: string | null;
+  /** Other origins allowed to post, beyond the request's own. */
+  origins?: string[];
+  /** Called when a server function throws. The client gets a generic error either way. */
+  onError?: (error: unknown, request: Request) => void;
+  /** What else a server function gets beside `request`; `extra` is fetch's second argument (`{ env, ctx }`). */
+  context?: (from: { request: Request } & Extra) => object | Promise<object>;
+}
+
+export interface EdgeActions<Extra extends object = object> {
+  /** A Response for an action (or the client script, when `client` was given); null for any other request. */
+  fetch(request: Request, extra?: Extra): Promise<Response | null>;
+  /** After a no-JavaScript post, its result, once; `setHeader` gets the header that clears it. */
+  result<T = unknown>(request: Request, setHeader?: (name: string, value: string) => void): ActionResult<T> | null;
+  routes(): string[];
+  script(): string;
+  clearCookie: string;
+}
+
+export function createActions<Extra extends object = object>(options: EdgeActionsOptions<Extra>): EdgeActions<Extra>;

package/src/edge.js

@@ -0,0 +1,24 @@
+// @zubra/actions without a disk: for Cloudflare Workers, Deno and anything else that can't compile
+// a components folder when it starts. The server functions come from `zubra-actions build`; the
+// requests are answered exactly as the Node entry answers them (core.js).
+//
+//   import { actions } from './actions/index.js';          // npx zubra-actions build components --out src/actions
+//   import { createActions } from '@zubra/actions/edge';
+//   const forms = createActions({ actions, context: ({ request, env }) => ({ user: who(request, env) }) });
+//   export default { fetch: async (request, env) => (await forms.fetch(request, { env })) ?? page(request) };
+//
+// The enhancing script (`@zubra/actions/client`) is served from your static assets at
+// /_zb/actions.js, as the runtime is, unless you pass its source as `client`.
+import { createActionsCore, routesFrom } from './core.js';
+
+export { MOUNT, SCRIPT_PATH, COOKIE } from './core.js';
+
+/**
+ * `actions`: `{ url: fn }`, the build's `actions` (or several merged). `context(…)` gets
+ * `{ request, ...extra }`, where `extra` is fetch's second argument (`{ env, ctx }` in a Worker).
+ * `origins`, `onError` as the Node entry's.
+ */
+export function createActions({ actions, client = null, origins = [], onError = (error) => console.error(error), context = () => ({}) } = {}) {
+  if (!actions || typeof actions !== 'object') throw new TypeError("createActions({ actions }): pass `actions` from `zubra-actions build`'s index.js");
+  return createActionsCore({ routes: routesFrom(actions), client, origins, onError, context });
+}

package/src/index.js

@@ -14,18 +14,14 @@
 // - Anything else (the browser's own post) gets 303 See Other back to the page it came from, with
 //   the return value in a one-use cookie, so the page can render it (`result()`).
 // - A cross-site post is refused (Origin / Sec-Fetch-Site), so forms on other sites can't call it.
-import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
-import { dirname, join, relative, resolve, sep } from 'node:path';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join, relative, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { findCompiler } from '@zubra/server';
+import { createActionsCore, routesFrom, MOUNT, SCRIPT_PATH, COOKIE } from './core.js';
+import { flatName, rewriteImports, serverHalves } from './compile.js';
 
-findCompiler();
-const compiler = await import('@zubra/compiler');
+export { MOUNT, SCRIPT_PATH, COOKIE };
 
-export const MOUNT = '/_zb/action/';
-export const SCRIPT_PATH = '/_zb/actions.js';
-export const COOKIE = '__zb_result';
-const SOURCE = /\.zb(?:\.[jt]sx)?$/;
 const CLIENT = readFileSync(new URL('./client.js', import.meta.url), 'utf8');
 
 /**
@@ -50,140 +46,25 @@ export async function createActions({
   mkdirSync(cacheDir, { recursive: true });
 
   // URL → function, from every component's server half.
-  const routes = new Map();
-  for (const path of sources(root)) {
-    const response = compiler.request({ emit: 'server', path, files: compiler.sources(path) });
-    if (!response.ok) throw new Error(response.error);
-    if (!/^export (async )?function /m.test(response.output)) continue;
-    const module = join(cacheDir, `${relative(root, path).split(sep).join('__').replace(SOURCE, '')}.server.mjs`);
-    writeFileSync(module, absoluteImports(response.output, dirname(path)));
-    const { actions } = await import(`${pathToFileURL(module).href}?t=${Date.now()}`);
-    for (const [url, fn] of Object.entries(actions)) {
-      if (routes.has(url)) throw new Error(`@zubra/actions: two components define ${url}`);
-      routes.set(url, fn);
-    }
-  }
-
-  const allowed = (request) => {
-    const site = request.headers.get('sec-fetch-site');
-    if (site) return site === 'same-origin' || site === 'none';
-    const origin = request.headers.get('origin');
-    if (!origin) return true; // not a browser (curl, a test): CSRF needs a browser
-    return origin === new URL(request.url).origin || origins.includes(origin);
-  };
-
-  /** The page to go back to: the referring page on this origin, else the site root. */
-  const back = (request) => {
-    const referer = request.headers.get('referer');
-    try {
-      const url = new URL(referer, request.url);
-      if (url.origin === new URL(request.url).origin) return url.pathname + url.search;
-    } catch {}
-    return '/';
-  };
-
-  async function fetch(request, extra = {}) {
-    const url = new URL(request.url);
-    if (request.method === 'GET' && url.pathname === SCRIPT_PATH) {
-      return new Response(CLIENT, { headers: { 'content-type': 'text/javascript; charset=utf-8' } });
-    }
-    if (!url.pathname.startsWith(MOUNT)) return null;
-    if (request.method !== 'POST') return text(405, 'Method Not Allowed', { allow: 'POST' });
-    if (!allowed(request)) return text(403, 'Cross-site form posts are refused');
-    const fn = routes.get(url.pathname);
-    if (!fn) return text(404, 'Not Found');
-    const wantsJson = (request.headers.get('accept') ?? '').includes('application/json');
-    let value;
-    let failed = false;
-    try {
-      const more = await context({ request, ...extra });
-      value = await fn(await request.formData(), { ...more, request });
-    } catch (error) {
-      onError(error, request);
-      failed = true;
-      value = { error: 'Something went wrong' };
-    }
-    if (value instanceof Response) {
-      // A redirect after success: the enhanced path is told where to go rather than following it,
-      // so the page navigates once, with the location's #fragment kept (fetch drops it).
-      const location = value.headers.get('location');
-      if (wantsJson && location && value.status >= 300 && value.status < 400) {
-        const headers = new Headers({ 'zb-location': location });
-        for (const cookie of value.headers.getSetCookie()) headers.append('set-cookie', cookie);
-        return new Response(null, { status: 204, headers });
-      }
-      return value;
-    }
-    if (wantsJson) {
-      return new Response(JSON.stringify(value ?? null), {
-        status: failed ? 500 : 200,
-        headers: { 'content-type': 'application/json' },
-      });
-    }
-    const headers = new Headers({ location: back(request) });
-    const cookie = encodeURIComponent(JSON.stringify({ action: url.pathname, value: value ?? null }));
-    // A cookie holds about 4 KB; a bigger result reaches only the enhanced path.
-    if (cookie.length < 3800) {
-      headers.append('set-cookie', `${COOKIE}=${cookie}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`);
-    }
-    return new Response(null, { status: 303, headers });
-  }
-
-  /**
-   * After a no-JavaScript post: `{ action, value }` once, else null. `request` is a fetch Request
-   * or a Node request; `setHeader(name, value)` is given the header that clears the cookie.
-   */
-  function result(request, setHeader) {
-    const header = (typeof request.headers.get === 'function' ? request.headers.get('cookie') : request.headers.cookie) ?? '';
-    const match = header.split(/;\s*/).find((part) => part.startsWith(`${COOKIE}=`));
-    if (!match) return null;
-    setHeader?.('set-cookie', CLEAR);
-    try {
-      return JSON.parse(decodeURIComponent(match.slice(COOKIE.length + 1)));
-    } catch {
-      return null;
-    }
+  const maps = [];
+  for (const { path, output } of await serverHalves(root)) {
+    const module = join(cacheDir, `${flatName(relative(root, path))}.server.mjs`);
+    // The server half lives in the cache folder, so its relative imports point back at the source.
+    writeFileSync(module, rewriteImports(output, (specifier) => pathToFileURL(resolve(dirname(path), specifier)).href));
+    maps.push((await import(`${pathToFileURL(module).href}?t=${Date.now()}`)).actions);
   }
+  const core = createActionsCore({ routes: routesFrom(...maps), client: CLIENT, origins, onError, context });
 
   /** Node's http: answers ours and returns true, or returns false without reading the body. */
   async function handle(req, res) {
     if (!req.url.startsWith(MOUNT) && !req.url.startsWith(SCRIPT_PATH)) return false;
-    const response = await fetch(toRequest(req), { req });
+    const response = await core.fetch(toRequest(req), { req });
     if (!response) return false;
     await send(response, res);
     return true;
   }
 
-  return {
-    fetch,
-    handle,
-    result,
-    routes: () => [...routes.keys()],
-    script: () => `<script type="module" src="${SCRIPT_PATH}"></script>`,
-    clearCookie: CLEAR,
-  };
-}
-
-const CLEAR = `${COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
-
-function text(status, body, headers = {}) {
-  return new Response(body, { status, headers: { 'content-type': 'text/plain; charset=utf-8', ...headers } });
-}
-
-function sources(dir, out = []) {
-  for (const entry of readdirSync(dir).sort()) {
-    const path = join(dir, entry);
-    if (statSync(path).isDirectory()) {
-      if (entry !== 'node_modules' && !entry.startsWith('.')) sources(path, out);
-    } else if (SOURCE.test(entry)) out.push(path);
-  }
-  return out;
-}
-
-/** The server half lives in the cache folder, so its relative imports point back at the source. */
-function absoluteImports(code, from) {
-  return code.replace(/(\bfrom\s*|\bimport\s*)(['"])(\.{1,2}\/[^'"]+)\2/g, (_, keyword, quote, specifier) =>
-    `${keyword}${quote}${pathToFileURL(resolve(from, specifier)).href}${quote}`);
+  return { ...core, handle };
 }
 
 /** A Node request as a fetch Request (the body streams; nothing is read until it's ours). */