eddev 2.3.31 → 2.4.0-beta.2

package/dist/app/server/server-app.js

@@ -0,0 +1,186 @@
+import { invalidateByTag } from "@vercel/functions";
+import { withTrailingSlash } from "ufo";
+import { blockManifestReader } from "../lib/internal/read-block-manifest.js";
+import { viewManifestReader } from "../lib/internal/read-view-manifest.js";
+import { proxyWpAdmin } from "./proxy-wp-admin.js";
+import { renderPageForIndexing } from "./render-ai-page.js";
+import { renderPage } from "./render-ssr-page.js";
+import { handleRPCRequest } from "./rpc-handler.js";
+import { ServerContext } from "./server-context.js";
+import { appendSetCookie, getCookie, getRawPath, getRequestHeaders, getRequestURL, withHeaders } from "./utils/request.js";
+const BYPASS_COOKIE = "__prerender_bypass";
+const json = (value, init) => Response.json(value, init);
+const methodNotAllowed = () => new Response("Method Not Allowed", { status: 405 });
+const isGet = (req) => req.method === "GET" || req.method === "HEAD";
+/**
+ * The serverless app: route data, named queries and mutations, RPC procedures, WordPress proxying
+ * and server-rendered pages. Nitro calls `fetch` for every request that isn't a static asset or
+ * handled by a route rule (eg. the `/wp-content/**` proxies).
+ */
+export function createServerApp(opts) {
+    ServerContext.setRuntime({ assets: opts.assets });
+    async function handleData(req, url) {
+        const serverContext = ServerContext.main;
+        const path = url.pathname;
+        if (path === "/_data/route" || path.startsWith("/_data/route/")) {
+            if (!isGet(req))
+                return methodNotAllowed();
+            const pathname = path.slice("/_data/route".length) || "/";
+            return serverContext.fetchRouteData({
+                pathname,
+                newOrigin: url.origin,
+                bypass: serverContext.shouldBypass(req),
+            });
+        }
+        if (path.startsWith("/_data/query/")) {
+            if (!isGet(req))
+                return methodNotAllowed();
+            // The query name and JSON params are encoded in the raw path: /_data/query/<name>=<params>
+            const queryPath = getRawPath(req).replace("/_data/query", "");
+            const paramSeparator = queryPath.indexOf("=");
+            const id = paramSeparator === -1 ? queryPath : queryPath.slice(0, paramSeparator);
+            const paramString = paramSeparator === -1 ? undefined : queryPath.slice(paramSeparator + 1);
+            let params = {};
+            try {
+                params =
+                    typeof paramString === "string" && paramString.length
+                        ? JSON.parse(decodeURIComponent(paramString.replace(/\/$/, "")))
+                        : {};
+            }
+            catch (e) {
+                throw new Error("Invalid query parameters");
+            }
+            return serverContext.fetchNamedQuery({
+                name: id,
+                params,
+                headers: getRequestHeaders(req),
+                bypass: serverContext.shouldBypass(req),
+            });
+        }
+        if (path.startsWith("/_data/manifest/")) {
+            if (!isGet(req))
+                return methodNotAllowed();
+            const id = decodeURIComponent(path.slice("/_data/manifest/".length).replace(/\/$/, ""));
+            const assets = id === "handler" ? opts.assets.client : opts.assets.modules[id];
+            return json({ id, assets: assets ?? null });
+        }
+        if (path.startsWith("/_data/mutation/")) {
+            if (req.method !== "POST")
+                return methodNotAllowed();
+            const name = "/" + path.slice("/_data/mutation/".length);
+            const body = await req.json();
+            return serverContext.fetchMutation({ name, body, headers: getRequestHeaders(req) });
+        }
+        if (path === "/_data/submit-gf" || path === "/_data/submit-gf/") {
+            if (req.method !== "POST")
+                return methodNotAllowed();
+            const headers = new Headers(req.headers);
+            headers.delete("content-length");
+            headers.delete("host");
+            headers.delete("connection");
+            headers.delete("pragma");
+            return serverContext.fetchOrigin("/wp-json/ed/v1/gf/submit/", {
+                method: "POST",
+                headers,
+                body: await req.blob(),
+            });
+        }
+        return new Response("Not Found", { status: 404 });
+    }
+    async function handleAI(req, url) {
+        if (url.pathname !== "/_ai/page" && !url.pathname.startsWith("/_ai/page/")) {
+            return new Response("Not Found", { status: 404 });
+        }
+        if (!isGet(req))
+            return methodNotAllowed();
+        const pathname = url.pathname.slice("/_ai/page".length) || "/";
+        const page = await renderPageForIndexing({ pathname, newOrigin: url.origin });
+        return new Response(page.contents, {
+            headers: {
+                "Content-Type": "text/html; charset=utf-8",
+                "Cache-Control": "no-store",
+            },
+        });
+    }
+    /** Vercel prerender bypass helpers, used by the WordPress admin toolbar and cache purging. */
+    async function handleBypass(req, url) {
+        if (!isGet(req))
+            return methodNotAllowed();
+        const token = process.env.VERCEL_BYPASS_TOKEN;
+        const action = url.pathname.replace(/^\/_bypass\/?/, "").replace(/\/$/, "");
+        if (action === "enable") {
+            if (!token)
+                return json(false);
+            const headers = new Headers();
+            appendSetCookie(headers, BYPASS_COOKIE, token, { expires: new Date(Date.now() + 1000 * 60 * 60 * 24) });
+            return json(true, { headers });
+        }
+        if (action === "disable") {
+            const headers = new Headers();
+            appendSetCookie(headers, BYPASS_COOKIE, "");
+            return json(true, { headers });
+        }
+        if (action === "check") {
+            return json(!!token && getCookie(req, BYPASS_COOKIE) === token);
+        }
+        if (action === "purge") {
+            if (token && req.headers.get("x-prerender-revalidate") === token) {
+                await invalidateByTag("data");
+                return json(true);
+            }
+            return json(false);
+        }
+        return new Response("Not Found", { status: 404 });
+    }
+    return {
+        async fetch(req) {
+            const serverContext = ServerContext.main;
+            const url = getRequestURL(req);
+            await Promise.allSettled([viewManifestReader.preloadAll(), blockManifestReader.preloadAll()]);
+            // RPC
+            if (serverContext.rpcBases.some((base) => url.pathname.startsWith(base))) {
+                return handleRPCRequest(req, opts.rpc);
+            }
+            // Data API
+            if (url.pathname.startsWith("/_data/")) {
+                return handleData(req, url);
+            }
+            // LLM indexing route
+            if (url.pathname.startsWith("/_ai/")) {
+                return handleAI(req, url);
+            }
+            // Prerender bypass
+            if (url.pathname.startsWith("/_bypass/")) {
+                return handleBypass(req, url);
+            }
+            // Outdated build assets
+            if (url.pathname.match(/^\/(_build|_admin)\//)) {
+                return new Response("", { status: 404 });
+            }
+            // Proxy WordPress
+            if ((url.pathname.includes(".") && !url.pathname.includes("[")) ||
+                url.pathname.startsWith("/graphql") ||
+                url.pathname.startsWith("/wp-")) {
+                return proxyWpAdmin(req);
+            }
+            // Enforce trailing slashes
+            if (!url.pathname.endsWith("/")) {
+                url.pathname = withTrailingSlash(url.pathname);
+                return Response.redirect(url, 301);
+            }
+            // SSR
+            const response = await renderPage({
+                pathname: url.pathname,
+                newOrigin: url.origin,
+                hostname: url.hostname,
+                bypass: serverContext.shouldBypass(req),
+            });
+            if (opts.skewProtection) {
+                // Pins this browser to the deployment it loaded, so later chunk/data requests hit matching code.
+                const { deploymentId } = opts.skewProtection;
+                return withHeaders(response, (headers) => appendSetCookie(headers, "__vdpl", deploymentId, { httpOnly: false }));
+            }
+            return response;
+        },
+    };
+}

package/dist/app/server/server-context.d.ts

@@ -1,5 +1,5 @@
-import { Manifest } from "vinxi/manifest";
-import { H3Event, RequestHeaders } from "vinxi/http";
+import type { ServerAssets } from "./assets.js";
+import { type RequestHeaders } from "./utils/request.js";
 import type { EDCacheConfig, EDConfig } from "../../node/project/config.js";
 import { TrackerTags } from "../lib/routing/types.js";
 import { QueryMonitor } from "../utils/query-monitor.js";
@@ -13,7 +13,7 @@ export type ServerContextArgs = {
     cacheConfig: EDCacheConfig;
 };
 export type ServerContextRuntime = {
-    getManifest: (name: string) => Manifest;
+    assets: ServerAssets;
 };
 /**
  * Data returned from WordPress origin /_appdata route
@@ -53,7 +53,7 @@ export declare class ServerContext {
         bypass?: boolean;
         newOrigin?: string;
     }): Promise<ServerAppData>;
-    extractRequestHeaders(req?: RequestHeaders): Partial<Record<import("vinxi/http").HTTPHeaderName, string | undefined>>;
+    extractRequestHeaders(req?: RequestHeaders): Record<string, string>;
     fetchNamedQuery(req: {
         name: string;
         bypass: boolean;
@@ -66,7 +66,7 @@ export declare class ServerContext {
         headers: RequestHeaders;
     }): Promise<Response>;
     get allowedCorsOrigins(): string[];
-    shouldBypass(event: H3Event): boolean;
+    shouldBypass(req: Request): boolean;
     getCorsOrigin(originHeader: string): string | undefined;
     getCorsHeaders(origin: string): {
         "Access-Control-Allow-Methods"?: undefined;

package/dist/app/server/server-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-context.d.ts","sourceRoot":"","sources":["../../../src/app/server/server-context.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAwB,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAE3E,OAAO,EAAmB,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAExD,OAAO,EAAqB,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAG5E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,OAAO,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,eAAe,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,MAAM,EAAE,QAAQ,CAAA;IAChB,WAAW,EAAE,aAAa,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAA;CACxC,CAAA;AAkBD;;GAEG;AACH,KAAK,aAAa,GAAG;IACnB,OAAO,EAAE,GAAG,CAAA;IACZ,QAAQ,EAAE,WAAW,CAAA;CACtB,CAAA;AAED,qBAAa,aAAa;IACxB,GAAG,EAAE,OAAO,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAA;IACxD,QAAQ,EAAE,MAAM,EAAE,CAAK;IACvB,MAAM,EAAE,QAAQ,CAAA;IAChB,WAAW,EAAE,aAAa,CAAA;IAE1B,MAAM,CAAC,IAAI,EAAE,aAAa,CAAA;gBAEd,IAAI,EAAE,iBAAiB;IAYnC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAOzC,IAAI,OAAO,yBAEV;IAED,IAAI,YAAY,YAEf;IAED,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,2BAA2B;IAQnC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,oBAAoB;IAI1C,YAAY,CAAC,GAAG,EAAE,MAAM;IAQlB,WAAW,CACf,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,WAAW,GAAG;QAAE,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GACjE,OAAO,CAAC,QAAQ,CAAC;IAgCpB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,OAAO,GAAG,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,EAAE;IA+FvG,cAAc,CAAC,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,cAAc,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;IAuHxG,YAAY,CAAC,IAAI,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IA4C1F,qBAAqB,CAAC,GAAG,CAAC,EAAE,cAAc;IAYpC,eAAe,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,cAAc,CAAA;KAAE;IAoE/F,aAAa,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,cAAc,CAAA;KAAE;IA0BhF,IAAI,kBAAkB,aAcrB;IAED,YAAY,CAAC,KAAK,EAAE,OAAO;IAc3B,aAAa,CAAC,YAAY,EAAE,MAAM;IAUlC,cAAc,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;;;CAiD9B"}
+{"version":3,"file":"server-context.d.ts","sourceRoot":"","sources":["../../../src/app/server/server-context.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EAAa,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAE3E,OAAO,EAAmB,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAExD,OAAO,EAAqB,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAG5E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,OAAO,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,eAAe,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,MAAM,EAAE,QAAQ,CAAA;IAChB,WAAW,EAAE,aAAa,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,YAAY,CAAA;CACrB,CAAA;AAkBD;;GAEG;AACH,KAAK,aAAa,GAAG;IACnB,OAAO,EAAE,GAAG,CAAA;IACZ,QAAQ,EAAE,WAAW,CAAA;CACtB,CAAA;AAED,qBAAa,aAAa;IACxB,GAAG,EAAE,OAAO,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAA;IACxD,QAAQ,EAAE,MAAM,EAAE,CAAK;IACvB,MAAM,EAAE,QAAQ,CAAA;IAChB,WAAW,EAAE,aAAa,CAAA;IAE1B,MAAM,CAAC,IAAI,EAAE,aAAa,CAAA;gBAEd,IAAI,EAAE,iBAAiB;IAYnC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAOzC,IAAI,OAAO,yBAEV;IAED,IAAI,YAAY,YAEf;IAED,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,2BAA2B;IAQnC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,oBAAoB;IAI1C,YAAY,CAAC,GAAG,EAAE,MAAM;IAQlB,WAAW,CACf,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,WAAW,GAAG;QAAE,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GACjE,OAAO,CAAC,QAAQ,CAAC;IAwCpB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,OAAO,GAAG,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,EAAE;IA+FvG,cAAc,CAAC,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,cAAc,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;IAuHxG,YAAY,CAAC,IAAI,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IA4C1F,qBAAqB,CAAC,GAAG,CAAC,EAAE,cAAc;IAapC,eAAe,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,cAAc,CAAA;KAAE;IAoE/F,aAAa,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,cAAc,CAAA;KAAE;IA0BhF,IAAI,kBAAkB,aAcrB;IAED,YAAY,CAAC,GAAG,EAAE,OAAO;IAczB,aAAa,CAAC,YAAY,EAAE,MAAM;IAUlC,cAAc,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;;;CAiD9B"}

package/dist/app/server/server-context.js

@@ -1,8 +1,8 @@
 import chalk from "chalk";
 import { inspect } from "node:util";
 import { parseURL, stringifyParsedURL, withQuery, withTrailingSlash } from "ufo";
-import { getCookie, getHeader } from "vinxi/http";
-import { fetchWP } from "../../node/utils/fetch-wp.js";
+import { getCookie } from "./utils/request.js";
+import { fetchOrigin as fetchFromOrigin } from "./utils/fetch-origin.js";
 import { QueryMonitor } from "../utils/query-monitor.js";
 import { filterHeader } from "./utils/headers.js";
 import { createUrlReplacer } from "./utils/replace-host.js";
@@ -78,18 +78,25 @@ export class ServerContext {
         const fetchOps = { ...opts };
         delete fetchOps.replaceUrls;
         delete fetchOps.newOrigin;
-        const response = await fetchWP(url, {
+        const response = await fetchFromOrigin(url, {
             ...fetchOps,
         });
-        if (!response.ok) {
-            return response;
-        }
-        const headers = {};
+        // Only pass on allowed headers, for error responses too. The origin's connection headers
+        // (transfer-encoding, keep-alive etc.) are forbidden over HTTP/2, and fetch has already decoded the
+        // body, so content-length and content-encoding no longer apply.
+        const headers = new Headers();
         response.headers.forEach((value, key) => {
             if (filterHeader(key, PROXY_RESPONSE_HEADERS)) {
-                headers[key] = value;
+                headers.append(key, value);
             }
         });
+        if (!response.ok) {
+            return new Response(response.body, {
+                status: response.status,
+                statusText: response.statusText,
+                headers,
+            });
+        }
         let text = await response.text();
         if (opts?.replaceUrls) {
             text = this.replaceUrls(text, opts.newOrigin);
@@ -343,8 +350,9 @@ export class ServerContext {
         const headers = {};
         if (req) {
             for (let key of PROXY_REQUEST_HEADERS) {
-                if (req[key]) {
-                    headers[key] = req[key];
+                const value = req[key];
+                if (value) {
+                    headers[key] = value;
                 }
             }
         }
@@ -442,15 +450,15 @@ export class ServerContext {
         }
         return result;
     }
-    shouldBypass(event) {
+    shouldBypass(req) {
         const bypassToken = process.env.VERCEL_BYPASS_TOKEN;
         if (!bypassToken)
             return false;
         const cookieName = "__prerender_bypass";
-        if (getCookie(event, cookieName) === bypassToken) {
+        if (getCookie(req, cookieName) === bypassToken) {
             return true;
         }
-        if (getHeader(event, "x-prerender-revalidate") === bypassToken) {
+        if (req.headers.get("x-prerender-revalidate") === bypassToken) {
             return true;
         }
         return false;

package/dist/app/server/utils/fetch-origin.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Fetches from the WordPress origin, adding the eddev API key when origin protection is enabled.
+ *
+ * Uses the platform's own `fetch` (Node, Vercel, Cloudflare Workers), with normal TLS verification.
+ * Local's self-signed certificates are accepted in `eddev dev` and `eddev preview`, which disable TLS
+ * verification for the whole process (`NODE_TLS_REJECT_UNAUTHORIZED=0`).
+ *
+ * The CLI's `fetchWP` (undici, with certificate checks disabled) is deliberately not used here: undici
+ * doesn't work in the Workers runtime, and it disabled certificate checks for every request the
+ * production server made.
+ */
+export declare function fetchOrigin(url: string | URL, init?: RequestInit): Promise<Response>;
+//# sourceMappingURL=fetch-origin.d.ts.map

package/dist/app/server/utils/fetch-origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-origin.d.ts","sourceRoot":"","sources":["../../../../src/app/server/utils/fetch-origin.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAUxF"}

package/dist/app/server/utils/fetch-origin.js

@@ -0,0 +1,21 @@
+import { apiConfig } from "../../lib/runtime/apiConfig.js";
+/**
+ * Fetches from the WordPress origin, adding the eddev API key when origin protection is enabled.
+ *
+ * Uses the platform's own `fetch` (Node, Vercel, Cloudflare Workers), with normal TLS verification.
+ * Local's self-signed certificates are accepted in `eddev dev` and `eddev preview`, which disable TLS
+ * verification for the whole process (`NODE_TLS_REJECT_UNAUTHORIZED=0`).
+ *
+ * The CLI's `fetchWP` (undici, with certificate checks disabled) is deliberately not used here: undici
+ * doesn't work in the Workers runtime, and it disabled certificate checks for every request the
+ * production server made.
+ */
+export function fetchOrigin(url, init = {}) {
+    const headers = new Headers(init.headers);
+    // Runtime environment first, then the key baked in at build time (see the generated context.ts)
+    const apiKey = (typeof process !== "undefined" ? process.env?.SITE_API_KEY : undefined) || apiConfig.apiKey;
+    if (apiKey) {
+        headers.set("x-ed-api-key", apiKey);
+    }
+    return fetch(url, { ...init, headers });
+}

package/dist/app/server/utils/request.d.ts

@@ -0,0 +1,20 @@
+import { serialize as serializeCookie } from "cookie-es";
+/** Request headers as a plain object with lowercase keys. */
+export type RequestHeaders = Record<string, string | undefined>;
+/**
+ * The request URL as seen by the visitor. Honours `x-forwarded-proto: https` from a trusted proxy
+ * (Vercel, Cloudflare, the local dev HTTPS redirect), matching h3 v1's `getRequestURL` default.
+ */
+export declare function getRequestURL(req: Request): URL;
+/** The raw path and query string of a request, without decoding. */
+export declare function getRawPath(req: Request): string;
+export declare function getRequestHeaders(req: Request): RequestHeaders;
+export declare function getCookie(req: Request, name: string): string | undefined;
+export type CookieOptions = Parameters<typeof serializeCookie>[2];
+/** Appends a `Set-Cookie` header. Defaults the cookie path to `/`. */
+export declare function appendSetCookie(headers: Headers, name: string, value: string, options?: CookieOptions): void;
+/** Request headers suitable for forwarding to another origin. */
+export declare function getProxyRequestHeaders(req: Request): Record<string, string>;
+/** Returns a copy of the response with additional headers, for responses whose headers may be immutable. */
+export declare function withHeaders(response: Response, apply: (headers: Headers) => void): Response;
+//# sourceMappingURL=request.d.ts.map

package/dist/app/server/utils/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../../src/app/server/utils/request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,SAAS,IAAI,eAAe,EAAE,MAAM,WAAW,CAAA;AAE/E,6DAA6D;AAC7D,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAE/D;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,CAM/C;AAED,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAG/C;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAM9D;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIxE;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;AAEjE,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,QAEzG;AAcD,iEAAiE;AACjE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM3E;AAED,4GAA4G;AAC5G,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,QAAQ,CAI3F"}

package/dist/app/server/utils/request.js

@@ -0,0 +1,60 @@
+import { parse as parseCookies, serialize as serializeCookie } from "cookie-es";
+/**
+ * The request URL as seen by the visitor. Honours `x-forwarded-proto: https` from a trusted proxy
+ * (Vercel, Cloudflare, the local dev HTTPS redirect), matching h3 v1's `getRequestURL` default.
+ */
+export function getRequestURL(req) {
+    const url = new URL(req.url);
+    if (req.headers.get("x-forwarded-proto") === "https") {
+        url.protocol = "https:";
+    }
+    return url;
+}
+/** The raw path and query string of a request, without decoding. */
+export function getRawPath(req) {
+    const url = new URL(req.url);
+    return req.url.slice(url.origin.length) || "/";
+}
+export function getRequestHeaders(req) {
+    const headers = {};
+    req.headers.forEach((value, name) => {
+        headers[name] = value;
+    });
+    return headers;
+}
+export function getCookie(req, name) {
+    const header = req.headers.get("cookie");
+    if (!header)
+        return undefined;
+    return parseCookies(header)[name];
+}
+/** Appends a `Set-Cookie` header. Defaults the cookie path to `/`. */
+export function appendSetCookie(headers, name, value, options = {}) {
+    headers.append("set-cookie", serializeCookie(name, value, { path: "/", ...options }));
+}
+/** Headers which shouldn't be forwarded when proxying a request (same list as h3 v1). */
+const IGNORED_PROXY_HEADERS = new Set([
+    "transfer-encoding",
+    "accept-encoding",
+    "connection",
+    "keep-alive",
+    "upgrade",
+    "expect",
+    "host",
+    "accept",
+]);
+/** Request headers suitable for forwarding to another origin. */
+export function getProxyRequestHeaders(req) {
+    const headers = {};
+    req.headers.forEach((value, name) => {
+        if (!IGNORED_PROXY_HEADERS.has(name))
+            headers[name] = value;
+    });
+    return headers;
+}
+/** Returns a copy of the response with additional headers, for responses whose headers may be immutable. */
+export function withHeaders(response, apply) {
+    const headers = new Headers(response.headers);
+    apply(headers);
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+}

package/dist/node/cli/cli-worker.d.ts

@@ -1,13 +1,17 @@
 import { Worker } from "node:worker_threads";
+import type { SPATarget } from "../compiler/bundler.spa.js";
 import type { StatefulLog } from "../utils/stateful-log.js";
-type WorkerMode = "admin" | "frontend" | "graphql" | "serverless";
+type WorkerMode = "spa" | "graphql" | "serverless";
+type WorkerOptions = {
+    log: StatefulLog<any>;
+    mode: WorkerMode;
+    verbose: boolean;
+    /** For the `spa` mode: which bundles to build */
+    spaTargets?: SPATarget[];
+};
 export declare class CLIWorker {
     worker: Worker;
-    constructor({ log, mode, verbose }: {
-        log: StatefulLog<any>;
-        mode: WorkerMode;
-        verbose: boolean;
-    });
+    constructor({ log, mode, verbose, spaTargets }: WorkerOptions);
     shutdown(): Promise<void>;
 }
 export {};

package/dist/node/cli/cli-worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-worker.d.ts","sourceRoot":"","sources":["../../../src/node/cli/cli-worker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAwC,MAAM,qBAAqB,CAAA;AAClF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAG3D,KAAK,UAAU,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,CAAA;AAEjE,qBAAa,SAAS;IACpB,MAAM,EAAE,MAAM,CAAA;gBACF,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAAE,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,IAAI,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE;IAkC3F,QAAQ;CAGf"}
+{"version":3,"file":"cli-worker.d.ts","sourceRoot":"","sources":["../../../src/node/cli/cli-worker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAwC,MAAM,qBAAqB,CAAA;AAClF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAG3D,KAAK,UAAU,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAA;AAElD,KAAK,aAAa,GAAG;IACnB,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,iDAAiD;IACjD,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;CACzB,CAAA;AAED,qBAAa,SAAS;IACpB,MAAM,EAAE,MAAM,CAAA;gBACF,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,aAAa;IAmCvD,QAAQ;CAGf"}

package/dist/node/cli/cli-worker.js

@@ -2,11 +2,12 @@ import { Worker, isMainThread, parentPort, workerData } from "node:worker_thread
 import { configureCliMode } from "./cli-mode.js";
 export class CLIWorker {
     worker;
-    constructor({ log, mode, verbose }) {
+    constructor({ log, mode, verbose, spaTargets }) {
         const worker = new Worker(new URL(import.meta.url), {
             workerData: {
                 mode,
                 verbose,
+                spaTargets,
             },
             stdout: true,
             stderr: true,
@@ -86,23 +87,15 @@ if (!isMainThread) {
             parentPort?.postMessage(JSON.stringify({ type: "log", log: serializeLogData(log) }));
         });
     }
-    if (mode === "admin") {
-        const { AdminBundler, adminLog } = await import("../compiler/bundler.admin.js");
-        const bundler = new AdminBundler(project, {
+    if (mode === "spa") {
+        const { SPABundler, spaLog } = await import("../compiler/bundler.spa.js");
+        const bundler = new SPABundler(project, {
             mode: "development",
             watch: true,
+            targets: workerData.spaTargets,
         });
         bundler.start();
-        pipeLog(adminLog);
-    }
-    else if (mode === "frontend") {
-        const { FrontendBundler, frontendLog } = await import("../compiler/bundler.frontend.js");
-        const bundler = new FrontendBundler(project, {
-            mode: "development",
-            watch: true,
-        });
-        bundler.start();
-        pipeLog(frontendLog);
+        pipeLog(spaLog);
     }
     else if (mode === "graphql") {
         const { GraphQLGenerator, graphqlLog } = await import("../graphql/graphql-codegen.js");