nukejs 0.0.20 → 0.0.22

package/README.md

@@ -40,7 +40,7 @@ NukeJS gives you:
 | **SPA navigation** | Client-side page transitions after first load |
 | **Hot module replacement** | Instant page updates during development |
 | **Zero config** | Works out of the box; `nuke.config.ts` for overrides |
-| **Deploy anywhere** | Node.js or Vercel serverless |
+| **Deploy anywhere** | Node.js, Vercel, or Cloudflare — zero config |
 
 ### The core idea
 
@@ -442,7 +442,8 @@ export async function GET(req: ApiRequest, res: ApiResponse) {
 }
 
 export async function POST(req: ApiRequest, res: ApiResponse) {
-  const user = await db.createUser(req.body);
+  const body = await req.json();
+  const user = await db.createUser(body);
   res.json(user, 201);
 }
 ```
@@ -464,14 +465,23 @@ export async function DELETE(req: ApiRequest, res: ApiResponse) {
 
 ### Request object
 
-| Property | Type | Description |
+| Property / Method | Type | Description |
 |---|---|---|
-| `req.body` | `any` | Parsed JSON body (or raw string), up to 10 MB |
+| `req.json<T>()` | `Promise<T>` | Parse the request body as JSON (10 MB limit, prototype-pollution guard) |
+| `req.text()` | `Promise<string>` | Read the request body as a UTF-8 string (10 MB limit) |
+| `req.buffer()` | `Promise<Buffer>` | Read the request body as a raw `Buffer` — use this for binary or multipart data |
 | `req.params` | `Record<string, string \| string[]>` | Dynamic route segments |
 | `req.query` | `Record<string, string>` | URL search params |
 | `req.method` | `string` | HTTP method |
 | `req.headers` | `IncomingHttpHeaders` | Request headers |
 
+> **Multipart / file uploads:** body helpers do not parse `multipart/form-data`. Pipe `req` directly into a multipart parser instead:
+> ```ts
+> import busboy from 'busboy';
+> const bb = busboy({ headers: req.headers });
+> req.pipe(bb);
+> ```
+
 ### Response object
 
 | Method | Description |
@@ -550,8 +560,7 @@ export default function Layout({ children }: { children: React.ReactNode }) {
 | `nuke dev` | Served by the built-in middleware before any API or SSR routing |
 | `nuke build` (Node) | Copied to `dist/static/` and served by the production HTTP server |
 | `nuke build` (Vercel) | Copied to `.vercel/output/static/` — served by Vercel's CDN, no function invocation |
-
-On Vercel, public files receive the same zero-latency CDN treatment as `__n.js`.
+| `nuke build` (Cloudflare) | Copied to `.cloudflare/output/static/` — served by Cloudflare's CDN, no Worker invocation |
 
 ---
 
@@ -1022,7 +1031,28 @@ dist/
 
 ### Vercel
 
-Just import the code from GitHub.
+Just import the code from GitHub. NukeJS detects the Vercel environment automatically and builds the right output — no configuration needed.
+
+### Cloudflare Workers & Pages
+
+Just import the code from GitHub. NukeJS detects the Cloudflare environment automatically and builds the right output — no configuration needed.
+
+The build output goes to `.cloudflare/output/`:
+
+```
+.cloudflare/output/
+├── _worker.mjs     # Single ESM Cloudflare Worker (all routes bundled)
+└── static/
+    ├── __n.js                  # NukeJS client runtime
+    ├── __client-component/     # Bundled "use client" component files
+    └── <app/public files>      # Copied from app/public/ at build time
+```
+
+Static files in `static/` are served directly by Cloudflare's CDN — the Worker is only invoked for pages and API routes.
+
+> **Cloudflare Pages (recommended):** Set your build output directory to `.cloudflare/output` in the Pages dashboard. Static assets are served via CDN automatically through the `ASSETS` binding.
+
+> **Cloudflare Workers:** Use `wrangler deploy` as your deploy command. Static assets are inlined into the worker bundle at build time — no separate CDN step required.
 
 ### Environment variables
 

package/bin/index.mjs

@@ -106,21 +106,60 @@ if (!arg || arg === 'dev') {
   runWithTsx(devScript, { ENVIRONMENT: 'development' });
 
 } else if (arg === 'build') {
-  // nuke build  →  run compiled dist via plain node
+  // nuke build [--cloudflare|--vercel]  →  run the appropriate compiled build script.
+  //
+  // Target selection order:
+  //   1. --cloudflare / --vercel flag  (explicit CLI override)
+  //   2. package.json "nuke": { "target": "cloudflare"|"vercel" }  (project config)
+  //   3. CF_PAGES / CLOUDFLARE_WORKERS env vars  (Cloudflare Pages CI)
+  //   4. VERCEL / VERCEL_ENV / NOW_BUILDER env vars  (Vercel CI)
+  //   5. Default: Node.js build
+
+  const extraArgs = process.argv.slice(3);
+
+  let pkgTarget = null;
+  try {
+    const pkgPath = path.join(process.cwd(), 'package.json');
+    if (fs.existsSync(pkgPath)) {
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+      pkgTarget = pkg?.nuke?.target ?? null;
+    }
+  } catch { /* malformed package.json — ignore, fall through */ }
+
+  const isCloudflare = !!(
+    extraArgs.includes('--cloudflare') ||
+    pkgTarget === 'cloudflare' ||
+    process.env.CLOUDFLARE_ACCOUNT_ID ||   // injected by all Cloudflare CI (Workers + Pages)
+    process.env.CLOUDFLARE_API_TOKEN ||    // injected by all Cloudflare CI
+    process.env.WORKERS_CI ||             // Cloudflare Workers CI
+    process.env.CF_PAGES ||
+    process.env.CF_PAGES_BRANCH ||
+    process.env.CF_PAGES_COMMIT_SHA ||
+    process.env.CF_PAGES_URL ||
+    process.env.CLOUDFLARE_WORKERS
+  );
+
   const isVercel = !!(
+    extraArgs.includes('--vercel') ||
+    pkgTarget === 'vercel' ||
     process.env.VERCEL ||
     process.env.VERCEL_ENV ||
     process.env.NOW_BUILDER
   );
 
-  if (isVercel) {
-    runWithNode(path.join(distDir, 'build-vercel.js'));
+  // Resolve the target once so the spawned build script can read it too.
+  const nukeTarget = isCloudflare ? 'cloudflare' : isVercel ? 'vercel' : 'node';
+
+  if (isCloudflare) {
+    runWithNode(path.join(distDir, 'build-cloudflare.js'), { NUKE_TARGET: nukeTarget });
+  } else if (isVercel) {
+    runWithNode(path.join(distDir, 'build-vercel.js'), { NUKE_TARGET: nukeTarget });
   } else {
-    runWithNode(path.join(distDir, 'build-node.js'));
+    runWithNode(path.join(distDir, 'build-node.js'), { NUKE_TARGET: nukeTarget });
   }
 
 } else {
   console.error(`\n  ✖  Unknown command: "${arg}"`);
-  console.error(`     Usage:  nuke [dev|build]\n`);
+  console.error(`     Usage:  nuke [dev|build [--cloudflare|--vercel]]\n`);
   process.exit(1);
 }

package/dist/build-cloudflare.js

@@ -0,0 +1,699 @@
+import fs from "fs";
+import path from "path";
+import { randomBytes } from "node:crypto";
+import { build } from "esbuild";
+import { loadConfig } from "./config.js";
+import {
+  walkFiles,
+  analyzeFile,
+  collectServerPages,
+  collectGlobalClientRegistry,
+  bundleClientComponents,
+  findPageLayouts,
+  buildPerPageRegistry,
+  makePageAdapterSource,
+  buildCombinedBundle,
+  copyPublicFiles
+} from "./build-common.js";
+const OUTPUT_DIR = path.resolve(".cloudflare/output");
+const STATIC_DIR = path.join(OUTPUT_DIR, "static");
+if (fs.existsSync(OUTPUT_DIR)) {
+  fs.rmSync(OUTPUT_DIR, { recursive: true, force: true });
+  console.log("\u{1F5D1}\uFE0F  Cleaned .cloudflare/output/");
+}
+fs.mkdirSync(STATIC_DIR, { recursive: true });
+const config = await loadConfig();
+const SERVER_DIR = path.resolve(config.serverDir);
+const PAGES_DIR = path.resolve("./app/pages");
+const PUBLIC_DIR = path.resolve("./app/public");
+const CF_EXTERNALS = ["cloudflare:*", "__STATIC_CONTENT_MANIFEST"];
+const CF_DEFINE = {
+  "process.env.NODE_ENV": '"production"'
+};
+const NODE_SHIM = (
+  /* js */
+  `
+// \u2500\u2500\u2500 Node req/res shim \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+class __NodeRequest__ {
+  constructor(cfRequest, parsedUrl, bodyBytes) {
+    this.url     = parsedUrl.pathname + parsedUrl.search;
+    this.method  = cfRequest.method;
+    this.headers = Object.fromEntries(cfRequest.headers.entries());
+    this.body    = null;   // populated externally before handler call
+    this.query   = Object.fromEntries(parsedUrl.searchParams.entries());
+    this.params  = {};
+    // Pre-read body bytes for stream emulation
+    this._bodyBytes   = bodyBytes;   // Uint8Array | null
+    this._dataFns     = [];
+    this._endFns      = [];
+    this._errorFns    = [];
+    this._streamQueued = false;
+  }
+
+  // Stream interface \u2014 'data' / 'end' / 'error' \u2014 used by body-parsing
+  // middleware and req.json() / req.text() from the API adapter template.
+  on(event, fn) {
+    if      (event === 'data')  this._dataFns.push(fn);
+    else if (event === 'end')   this._endFns.push(fn);
+    else if (event === 'error') this._errorFns.push(fn);
+
+    // Schedule a single microtask flush the first time a listener is added.
+    // All listeners registered synchronously in the same tick will be ready
+    // by the time the microtask fires.
+    if (!this._streamQueued) {
+      this._streamQueued = true;
+      Promise.resolve().then(() => {
+        if (this._bodyBytes && this._bodyBytes.length > 0) {
+          for (const fn of this._dataFns) fn(this._bodyBytes);
+        }
+        for (const fn of this._endFns) fn();
+      });
+    }
+    return this;
+  }
+
+  off(event, fn) {
+    if      (event === 'data')  this._dataFns  = this._dataFns.filter(f => f !== fn);
+    else if (event === 'end')   this._endFns   = this._endFns.filter(f => f !== fn);
+    else if (event === 'error') this._errorFns = this._errorFns.filter(f => f !== fn);
+    return this;
+  }
+
+  destroy() {}
+  resume()  { return this; }
+  pause()   { return this; }
+}
+
+class __NodeResponse__ {
+  constructor() {
+    this.statusCode = 200;
+    this._headers   = new Headers();
+    this._chunks    = [];
+    this._resolve   = null;
+    this._promise   = new Promise(r => { this._resolve = r; });
+    // Attach NukeJS dispatcher helpers directly on construction so handlers
+    // receive them regardless of which dispatcher path is used.
+    this.json = (data, status = 200) => {
+      this.statusCode = status;
+      this.setHeader('content-type', 'application/json; charset=utf-8');
+      this.end(JSON.stringify(data));
+    };
+    this.status = (code) => { this.statusCode = code; return this; };
+    this.redirect = (location, code = 302) => {
+      this.statusCode = code;
+      this.setHeader('location', String(location));
+      this.end();
+    };
+  }
+
+  setHeader(name, value)  { this._headers.set(String(name), String(value)); }
+  getHeader(name)         { return this._headers.get(String(name)) ?? undefined; }
+  removeHeader(name)      { this._headers.delete(String(name)); }
+  hasHeader(name)         { return this._headers.has(String(name)); }
+
+  write(chunk) {
+    if (chunk == null) return;
+    this._chunks.push(typeof chunk === 'string' ? chunk : new TextDecoder().decode(chunk));
+  }
+
+  end(chunk) {
+    if (chunk != null)
+      this._chunks.push(typeof chunk === 'string' ? chunk : new TextDecoder().decode(chunk));
+    this._resolve(
+      new Response(this._chunks.join(''), {
+        status:  this.statusCode,
+        headers: this._headers,
+      }),
+    );
+  }
+
+  // Await this inside the fetch handler to get the completed Web Response.
+  toResponse() { return this._promise; }
+}
+`
+);
+function makeApiDispatcherSource(routes, middlewarePath) {
+  const middlewareImport = middlewarePath ? `import __userMiddleware__ from ${JSON.stringify(middlewarePath)};` : "";
+  const middlewareRun = middlewarePath ? `
+  // Run user middleware before routing.  If it ends the response, bail out.
+  await __userMiddleware__(req, res);
+  if ((res as any).writableEnded || (res as any).headersSent) return true;
+` : "";
+  const imports = routes.map((r, i) => `import * as __api_${i}__ from ${JSON.stringify(r.absPath)};`).join("\n");
+  const routeEntries = routes.map(
+    (r, i) => `  { regex: ${JSON.stringify(r.srcRegex)}, params: ${JSON.stringify(r.paramNames)}, mod: __api_${i}__ },`
+  ).join("\n");
+  return (
+    /* ts */
+    `import type { IncomingMessage, ServerResponse } from 'http';
+${imports}
+${middlewareImport}
+
+const __CF_API_ROUTES__ = [
+${routeEntries}
+];
+
+/**
+ * Try to dispatch \`req\` to an API route.
+ * Returns true if a route matched (even if the handler threw), false otherwise.
+ */
+export async function __dispatchApi__(req: IncomingMessage, res: ServerResponse): Promise<boolean> {
+  const url      = new URL((req as any).url || '/', 'http://localhost');
+  const pathname = url.pathname;
+${middlewareRun}
+  for (const route of __CF_API_ROUTES__) {
+    const m = pathname.match(new RegExp(route.regex));
+    if (!m) continue;
+
+    const method  = ((req.method || 'GET')).toUpperCase();
+    const apiReq  = req as any;
+    const apiRes  = res as any;
+
+    // Populate NukeJS API handler surface on the shim.
+    apiReq.query  = Object.fromEntries(url.searchParams.entries());
+    apiReq.params = {};
+    route.params.forEach((name: string, i: number) => { apiReq.params[name] = m[i + 1]; });
+
+    // Attach .json() / .text() / .buffer() that resolve from the pre-read body.
+    const rawBytes: Uint8Array | null = apiReq._bodyBytes ?? null;
+    apiReq.text   = () => Promise.resolve(rawBytes ? new TextDecoder().decode(rawBytes) : '');
+    apiReq.json   = () => apiReq.text().then((t: string) => {
+      const parsed = t ? JSON.parse(t) : null;
+      if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {
+        delete parsed.__proto__;
+        delete parsed.constructor;
+      }
+      return parsed;
+    });
+    apiReq.buffer = () => Promise.resolve(rawBytes ?? new Uint8Array(0));
+
+    const fn = (route.mod as any)[method] ?? (route.mod as any)['default'];
+    if (typeof fn !== 'function') {
+      apiRes.json({ error: \`Method \${method} not allowed\` }, 405);
+      return true;
+    }
+    await fn(apiReq, apiRes);
+    return true;
+  }
+  return false;
+}
+`
+  );
+}
+function makePagesDispatcherSource(routes, errorAdapters2 = {}, middlewarePath) {
+  const middlewareImport = middlewarePath ? `import __userMiddleware__ from ${JSON.stringify(middlewarePath)};` : "";
+  const middlewareRun = middlewarePath ? `
+  // Run user middleware before routing.  If it ends the response, bail out.
+  await __userMiddleware__(req, res);
+  if ((res as any).writableEnded || (res as any).headersSent) return true;
+` : "";
+  const imports = routes.map((r, i) => `import __page_${i}__ from ${JSON.stringify(r.adapterPath)};`).join("\n");
+  const routeEntries = routes.map(
+    (r, i) => `  { regex: ${JSON.stringify(r.srcRegex)}, params: ${JSON.stringify(r.paramNames)}, catchAll: ${JSON.stringify(r.catchAllNames)}, handler: __page_${i}__ },`
+  ).join("\n");
+  const error404Import = errorAdapters2.adapter404 ? `import __error_404__ from ${JSON.stringify(errorAdapters2.adapter404)};` : "";
+  const error500Import = errorAdapters2.adapter500 ? `import __error_500__ from ${JSON.stringify(errorAdapters2.adapter500)};` : "";
+  const notFoundFallback = errorAdapters2.adapter404 ? `  try { await __error_404__(req, res); return true; } catch(e) { console.error('[_404 error]', e); }` : `  (res as any).statusCode = 404;
+  res.setHeader('content-type', 'text/plain; charset=utf-8');
+  res.end('Not Found');`;
+  const clientErrHandler = errorAdapters2.adapter500 ? (
+    /* ts */
+    `    try {
+      const eq = new URLSearchParams();
+      eq.set('__errorMessage', url.searchParams.get('__clientError') || 'Client error');
+      const stack = url.searchParams.get('__clientStack');
+      if (stack) eq.set('__errorStack', stack);
+      (req as any).url = '/_500?' + eq.toString();
+      await __error_500__(req, res);
+      return true;
+    } catch(e) { console.error('[_500 client error]', e); }`
+  ) : `    (res as any).statusCode = 500; res.end('Internal Server Error'); return true;`;
+  const errHandler = errorAdapters2.adapter500 ? (
+    /* ts */
+    `    try {
+      const errMsg   = err instanceof Error ? err.message : String(err);
+      const errStack = err instanceof Error ? err.stack   : undefined;
+      const eq = new URLSearchParams();
+      eq.set('__errorMessage', errMsg);
+      if (errStack) eq.set('__errorStack', errStack);
+      (req as any).url = '/_500?' + eq.toString();
+      await __error_500__(req, res);
+      return true;
+    } catch(e) { console.error('[_500 error]', e); }`
+  ) : `    (res as any).statusCode = 500; res.end('Internal Server Error'); return true;`;
+  return (
+    /* ts */
+    `import type { IncomingMessage, ServerResponse } from 'http';
+${imports}
+${error404Import}
+${error500Import}
+${middlewareImport}
+
+const __CF_PAGE_ROUTES__: Array<{
+  regex:    string;
+  params:   string[];
+  catchAll: string[];
+  handler:  (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+}> = [
+${routeEntries}
+];
+
+/**
+ * Try to dispatch \`req\` to a page route.
+ * Returns true if a route matched (even if the handler threw), false otherwise.
+ */
+export async function __dispatchPages__(req: IncomingMessage, res: ServerResponse): Promise<boolean> {
+  const url      = new URL((req as any).url || '/', 'http://localhost');
+  const pathname = url.pathname;
+${middlewareRun}
+  // Client-side error \u2014 forward to _500 page if available.
+  if (url.searchParams.has('__clientError')) {
+${clientErrHandler}
+  }
+
+  for (const route of __CF_PAGE_ROUTES__) {
+    const m = pathname.match(new RegExp(route.regex));
+    if (!m) continue;
+
+    const catchAllSet = new Set(route.catchAll);
+    route.params.forEach((name, i) => {
+      const raw = m[i + 1] ?? '';
+      if (catchAllSet.has(name)) {
+        raw.split('/').filter(Boolean).forEach(seg => url.searchParams.append(name, seg));
+      } else {
+        url.searchParams.set(name, raw);
+      }
+    });
+    (req as any).url = pathname + (url.search || '');
+
+    try {
+      await route.handler(req, res);
+      return true;
+    } catch (err) {
+      console.error('[page handler error]', err);
+${errHandler}
+      return true;
+    }
+  }
+
+${notFoundFallback}
+  return false;
+}
+`
+  );
+}
+function makeWorkerEntrySource(hasApi2, hasPages2, inlineStaticMap2, middlewarePath) {
+  const apiImport = hasApi2 ? `import { __dispatchApi__   } from "./cf-api-dispatcher.js";` : "";
+  const pagesImport = hasPages2 ? `import { __dispatchPages__ } from "./cf-pages-dispatcher.js";` : "";
+  const middlewareImport = middlewarePath ? `import __userMiddleware__ from ${JSON.stringify(middlewarePath)};` : "";
+  const middlewareRun = middlewarePath ? `
+      await __userMiddleware__(nodeReq as any, nodeRes as any);
+      if ((nodeRes as any).writableEnded || (nodeRes as any).headersSent) return nodeRes.toResponse();
+` : "";
+  const apiDispatch = hasApi2 ? `if (await __dispatchApi__(nodeReq as any, nodeRes as any))   return nodeRes.toResponse();` : "";
+  const pagesDispatch = hasPages2 ? `if (await __dispatchPages__(nodeReq as any, nodeRes as any)) return nodeRes.toResponse();` : "";
+  return (
+    /* ts */
+    `${NODE_SHIM}
+
+${apiImport}
+${pagesImport}
+${middlewareImport}
+
+/**
+ * Pre-buffer the request body into a Uint8Array so we can both:
+ *   a) inject it into req.body (parsed), and
+ *   b) expose a fake stream interface on the shim (on('data', \u2026)).
+ * Returns null for requests without bodies (GET, HEAD, OPTIONS).
+ */
+const __INLINE_STATIC_MAP__ = new Map<string, { ct: string; body: string; text: boolean }>([
+${inlineStaticMap2}
+]);
+
+async function readBodyBytes(request: Request): Promise<Uint8Array | null> {
+  const noBody = ['GET', 'HEAD', 'OPTIONS'].includes(request.method.toUpperCase());
+  if (noBody) return null;
+  try {
+    const buf = await request.arrayBuffer();
+    return buf.byteLength > 0 ? new Uint8Array(buf) : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Attempt to parse the raw body bytes according to the Content-Type header.
+ * Returns the parsed body (object, string, or null).
+ */
+function parseBodyBytes(bodyBytes: Uint8Array | null, contentType: string): unknown {
+  if (!bodyBytes || bodyBytes.length === 0) return null;
+  const text = new TextDecoder().decode(bodyBytes);
+  try {
+    if (contentType.includes('application/json')) {
+      const parsed = JSON.parse(text);
+      if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {
+        delete (parsed as any).__proto__;
+        delete (parsed as any).constructor;
+      }
+      return parsed;
+    }
+    if (contentType.includes('application/x-www-form-urlencoded')) {
+      return Object.fromEntries(new URLSearchParams(text).entries());
+    }
+    return text;
+  } catch {
+    return text;
+  }
+}
+
+export default {
+  async fetch(request: Request, env: Record<string, any>, ctx: ExecutionContext): Promise<Response> {
+    const parsedUrl = new URL(request.url);
+
+    // \u2500\u2500 1. Static assets via Cloudflare Pages ASSETS binding \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    // When deployed with Cloudflare Pages, \`env.ASSETS\` is a fetcher that
+    // serves files from the static/ output directory via the CDN.  We issue a
+    // GET probe (no body) so we never accidentally consume the request body.
+    if (env && env.ASSETS) {
+      try {
+        const probe       = new Request(request.url, { method: 'GET', headers: request.headers });
+        const staticResp  = await (env.ASSETS as Fetcher).fetch(probe);
+        if (staticResp.status !== 404) return staticResp;
+      } catch (_) {
+        // ASSETS binding unavailable or errored \u2014 fall through to inline map.
+      }
+    }
+
+    // \u2500\u2500 1b. Inline static asset map (standalone Workers fallback) \u2500\u2500\u2500\u2500\u2500\u2500
+    // When deployed via wrangler deploy (not Cloudflare Pages), there is
+    // no ASSETS binding.  Static files are inlined at build time into this map.
+    {
+      const __inlineAsset__ = __INLINE_STATIC_MAP__.get(parsedUrl.pathname);
+      if (__inlineAsset__) {
+        const body = __inlineAsset__.text
+          ? __inlineAsset__.body
+          : Uint8Array.from(atob(__inlineAsset__.body), c => c.charCodeAt(0));
+        return new Response(body, {
+          status: 200,
+          headers: { 'content-type': __inlineAsset__.ct },
+        });
+      }
+    }
+
+    // \u2500\u2500 2. Pre-buffer the request body \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    const bodyBytes   = await readBodyBytes(request);
+    const contentType = request.headers.get('content-type') || '';
+    const parsedBody  = parseBodyBytes(bodyBytes, contentType);
+
+    // \u2500\u2500 3. Build Node-compatible req / res shims \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    const nodeReq         = new ((__NodeRequest__ as any))(request, parsedUrl, bodyBytes);
+    nodeReq.body          = parsedBody;
+    const nodeRes         = new ((__NodeResponse__ as any))();
+
+    try {
+      // \u2500\u2500 User middleware \u2014 runs once, before any routing \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+${middlewareRun}
+      // \u2500\u2500 4. API routes \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+      ${apiDispatch}
+
+      // \u2500\u2500 5. Page routes \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+      ${pagesDispatch}
+
+      // \u2500\u2500 6. No route matched \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+      return new Response('Not Found', {
+        status: 404,
+        headers: { 'content-type': 'text/plain; charset=utf-8' },
+      });
+
+    } catch (err) {
+      console.error('[worker unhandled error]', err);
+      return new Response('Internal Server Error', {
+        status: 500,
+        headers: { 'content-type': 'text/plain; charset=utf-8' },
+      });
+    }
+  },
+};
+`
+  );
+}
+async function bundleForWorker(entryPath, outPath, extraDefine = {}) {
+  const result = await build({
+    entryPoints: [entryPath],
+    bundle: true,
+    format: "esm",
+    platform: "browser",
+    target: "es2022",
+    external: CF_EXTERNALS,
+    define: { ...CF_DEFINE, ...extraDefine },
+    jsx: "automatic",
+    write: false,
+    resolveExtensions: [".js", ".mjs", ".ts", ".tsx", ".jsx", ".json"]
+    // Do NOT set `banner` — the Node shim is inline in the worker entry source.
+  });
+  fs.mkdirSync(path.dirname(outPath), { recursive: true });
+  fs.writeFileSync(outPath, result.outputFiles[0].text);
+}
+const apiFiles = walkFiles(SERVER_DIR);
+if (apiFiles.length === 0) console.warn(`\u26A0  No server files found in ${SERVER_DIR}`);
+const apiRoutes = apiFiles.map((relPath) => ({
+  ...analyzeFile(relPath, "api"),
+  absPath: path.join(SERVER_DIR, relPath)
+})).sort((a, b) => b.specificity - a.specificity);
+const serverPages = collectServerPages(PAGES_DIR);
+await buildCombinedBundle(STATIC_DIR);
+copyPublicFiles(PUBLIC_DIR, STATIC_DIR);
+const TEXT_EXTS = /* @__PURE__ */ new Set([
+  ".js",
+  ".mjs",
+  ".cjs",
+  ".ts",
+  ".jsx",
+  ".tsx",
+  ".css",
+  ".html",
+  ".htm",
+  ".json",
+  ".xml",
+  ".txt",
+  ".csv",
+  ".svg",
+  ".map"
+]);
+const MIME_MAP = {
+  ".html": "text/html; charset=utf-8",
+  ".htm": "text/html; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".js": "application/javascript; charset=utf-8",
+  ".mjs": "application/javascript; charset=utf-8",
+  ".cjs": "application/javascript; charset=utf-8",
+  ".map": "application/json; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".xml": "application/xml; charset=utf-8",
+  ".txt": "text/plain; charset=utf-8",
+  ".csv": "text/csv; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".ico": "image/x-icon",
+  ".bmp": "image/bmp",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".otf": "font/otf",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav",
+  ".ogg": "audio/ogg",
+  ".pdf": "application/pdf",
+  ".wasm": "application/wasm"
+};
+function walkStaticDir(dir, base = dir) {
+  const results = [];
+  if (!fs.existsSync(dir)) return results;
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const abs = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...walkStaticDir(abs, base));
+    } else {
+      results.push({ rel: "/" + path.relative(base, abs).replace(/\\/g, "/"), abs });
+    }
+  }
+  return results;
+}
+const cfUserMiddlewareSrc = path.resolve("middleware.ts");
+const cfMiddlewarePath = fs.existsSync(cfUserMiddlewareSrc) ? cfUserMiddlewareSrc : void 0;
+if (cfMiddlewarePath) console.log("  found     middleware.ts  (will be bundled into worker)");
+let hasApi = false;
+let hasPages = false;
+if (apiRoutes.length > 0) {
+  hasApi = true;
+  const dispSrc = makeApiDispatcherSource(apiRoutes);
+  const dispPath = path.join(SERVER_DIR, `_cf_api_dispatcher_${randomBytes(4).toString("hex")}.ts`);
+  fs.writeFileSync(dispPath, dispSrc);
+  try {
+    const outPath = path.join(OUTPUT_DIR, "cf-api-dispatcher.js");
+    await bundleForWorker(dispPath, outPath);
+    console.log(`  built     API dispatcher \u2192 cf-api-dispatcher.js  (${apiRoutes.length} route(s))`);
+  } finally {
+    fs.unlinkSync(dispPath);
+  }
+}
+const tempAdapterPaths = [];
+const errorAdapterPaths = [];
+const errorAdapters = {};
+if (serverPages.length > 0 || ["_404.tsx", "_500.tsx"].some((f) => fs.existsSync(path.join(PAGES_DIR, f)))) {
+  hasPages = true;
+  const globalRegistry = collectGlobalClientRegistry(serverPages, PAGES_DIR);
+  const prerenderedHtml = await bundleClientComponents(globalRegistry, PAGES_DIR, STATIC_DIR);
+  const prerenderedRecord = Object.fromEntries(prerenderedHtml);
+  const dispatcherRoutes = [];
+  for (const page of serverPages) {
+    const adapterDir = path.dirname(page.absPath);
+    const adapterPath = path.join(
+      adapterDir,
+      `_cf_page_adapter_${randomBytes(4).toString("hex")}.ts`
+    );
+    const layoutPaths = findPageLayouts(page.absPath, PAGES_DIR);
+    const { registry, clientComponentNames } = buildPerPageRegistry(page.absPath, layoutPaths, PAGES_DIR);
+    const layoutImports = layoutPaths.map((lp, i) => {
+      const rel = path.relative(adapterDir, lp).replace(/\\/g, "/");
+      return `import __layout_${i}__ from ${JSON.stringify(rel.startsWith(".") ? rel : "./" + rel)};`;
+    }).join("\n");
+    fs.writeFileSync(
+      adapterPath,
+      makePageAdapterSource({
+        pageImport: JSON.stringify("./" + path.basename(page.absPath)),
+        layoutImports,
+        clientComponentNames,
+        allClientIds: [...registry.keys()],
+        layoutArrayItems: layoutPaths.map((_, i) => `__layout_${i}__`).join(", "),
+        prerenderedHtml: prerenderedRecord,
+        routeParamNames: page.paramNames,
+        catchAllNames: page.catchAllNames
+      })
+    );
+    tempAdapterPaths.push(adapterPath);
+    dispatcherRoutes.push({
+      adapterPath,
+      srcRegex: page.srcRegex,
+      paramNames: page.paramNames,
+      catchAllNames: page.catchAllNames
+    });
+    console.log(`  prepared  ${path.relative(PAGES_DIR, page.absPath)}  \u2192  ${page.funcPath}  [page]`);
+  }
+  for (const [statusCode, key] of [[404, "adapter404"], [500, "adapter500"]]) {
+    const src = path.join(PAGES_DIR, `_${statusCode}.tsx`);
+    if (!fs.existsSync(src)) continue;
+    console.log(`  building  _${statusCode}.tsx  \u2192  pages dispatcher  [error page]`);
+    const adapterDir = path.dirname(src);
+    const adapterPath = path.join(
+      adapterDir,
+      `_cf_error_adapter_${randomBytes(4).toString("hex")}.ts`
+    );
+    const layoutPaths = findPageLayouts(src, PAGES_DIR);
+    const { registry, clientComponentNames } = buildPerPageRegistry(src, layoutPaths, PAGES_DIR);
+    const layoutImports = layoutPaths.map((lp, i) => {
+      const rel = path.relative(adapterDir, lp).replace(/\\/g, "/");
+      return `import __layout_${i}__ from ${JSON.stringify(rel.startsWith(".") ? rel : "./" + rel)};`;
+    }).join("\n");
+    fs.writeFileSync(
+      adapterPath,
+      makePageAdapterSource({
+        pageImport: JSON.stringify("./" + path.basename(src)),
+        layoutImports,
+        clientComponentNames,
+        allClientIds: [...registry.keys()],
+        layoutArrayItems: layoutPaths.map((_, i) => `__layout_${i}__`).join(", "),
+        prerenderedHtml: prerenderedRecord,
+        routeParamNames: [],
+        catchAllNames: [],
+        statusCode
+      })
+    );
+    errorAdapters[key] = adapterPath;
+    errorAdapterPaths.push(adapterPath);
+  }
+  const pageDispSrc = makePagesDispatcherSource(dispatcherRoutes, errorAdapters);
+  const pageDispPath = path.join(
+    PAGES_DIR,
+    `_cf_pages_dispatcher_${randomBytes(4).toString("hex")}.ts`
+  );
+  fs.writeFileSync(pageDispPath, pageDispSrc);
+  try {
+    const outPath = path.join(OUTPUT_DIR, "cf-pages-dispatcher.js");
+    await bundleForWorker(pageDispPath, outPath);
+    console.log(`  built     Pages dispatcher \u2192 cf-pages-dispatcher.js  (${serverPages.length} page(s))`);
+  } finally {
+    fs.unlinkSync(pageDispPath);
+    for (const p of tempAdapterPaths) if (fs.existsSync(p)) fs.unlinkSync(p);
+    for (const p of errorAdapterPaths) if (fs.existsSync(p)) fs.unlinkSync(p);
+  }
+}
+const staticEntries = walkStaticDir(STATIC_DIR);
+const inlineStaticMap = staticEntries.map(({ rel, abs }) => {
+  const ext = path.extname(rel).toLowerCase();
+  const contentType = MIME_MAP[ext] ?? "application/octet-stream";
+  const isText = TEXT_EXTS.has(ext);
+  const raw = fs.readFileSync(abs);
+  if (isText) {
+    const escaped = JSON.stringify(raw.toString("utf-8"));
+    return `  [${JSON.stringify(rel)}, { ct: ${JSON.stringify(contentType)}, body: ${escaped}, text: true }],`;
+  } else {
+    const b64 = raw.toString("base64");
+    return `  [${JSON.stringify(rel)}, { ct: ${JSON.stringify(contentType)}, body: ${JSON.stringify(b64)}, text: false }],`;
+  }
+}).join("\n");
+const workerSrc = makeWorkerEntrySource(hasApi, hasPages, inlineStaticMap, cfMiddlewarePath);
+const workerSrcPath = path.join(
+  OUTPUT_DIR,
+  `_cf_worker_entry_${randomBytes(4).toString("hex")}.ts`
+);
+fs.writeFileSync(workerSrcPath, workerSrc);
+try {
+  await bundleForWorker(workerSrcPath, path.join(OUTPUT_DIR, "_worker.mjs"));
+  console.log(`  built     Worker entry     \u2192 .cloudflare/output/_worker.mjs`);
+} finally {
+  fs.unlinkSync(workerSrcPath);
+  for (const disp of ["cf-api-dispatcher.js", "cf-pages-dispatcher.js"]) {
+    const p = path.join(OUTPUT_DIR, disp);
+    if (fs.existsSync(p)) fs.unlinkSync(p);
+  }
+}
+const projectName = path.basename(process.cwd()).replace(/[^a-z0-9-]/gi, "-").toLowerCase();
+const wranglerToml = `# Generated by NukeJS build-cloudflare \u2014 edit as needed.
+# This file is used by \`wrangler deploy\` for standalone Workers deployment.
+# For Cloudflare Pages, configure the build output directory in the Pages
+# dashboard instead (.cloudflare/output).
+
+name         = "${projectName}"
+main         = ".cloudflare/output/_worker.mjs"
+compatibility_date = "${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}"
+
+[build]
+command = "nuke build --cloudflare"
+
+# Uncomment to add KV, R2, D1, or other bindings:
+# [[kv_namespaces]]
+# binding = "KV"
+# id      = "YOUR_KV_NAMESPACE_ID"
+`;
+fs.writeFileSync(path.resolve("wrangler.toml"), wranglerToml);
+const routeCount = apiRoutes.length + serverPages.length;
+const assetCount = staticEntries.length;
+console.log(`
+\u2713 Cloudflare build complete \u2014 ${routeCount} route(s), ${assetCount} static asset(s)
+  Worker:  .cloudflare/output/_worker.mjs
+  Static:  .cloudflare/output/static/
+  Config:  wrangler.toml
+
+Deploy options:
+  Pages    \u2192 wrangler pages deploy .cloudflare/output
+  Workers  \u2192 wrangler deploy
+`);

package/dist/build-common.js

@@ -418,6 +418,19 @@ function renderStyleTag(tag: any): string {
   return \`  <style\${media}>\${tag.content ?? ''}</style>\`;
 }
 
+// \u2500\u2500\u2500 HTML minifier \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+// Minifies the final HTML string before sending it to the client.
+// Sentinel comments (<!--n-head-->, <!--/n-head-->, <!--n-body-scripts-->,
+// <!--/n-body-scripts-->) are preserved \u2014 the client runtime needs them for
+// head diffing during soft navigation.
+function minifyHtml(h: string): string {
+  return h
+    .replace(/<!--(?!(n-head|\\/n-head|n-body-scripts|\\/n-body-scripts))[\\s\\S]*?-->/g, '')
+    .replace(/>\\s+</g, '> <')
+    .replace(/\\s*\\n\\s*/g, '')
+    .trim();
+}
+
 // \u2500\u2500\u2500 Renderer \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 const VOID_TAGS = new Set([
   'area','base','br','col','embed','hr','img','input',
@@ -661,7 +674,7 @@ export default async function handler(req: IncomingMessage, res: ServerResponse)
 
     res.statusCode = ${statusCode};
     res.setHeader('Content-Type', 'text/html; charset=utf-8');
-    res.end(html);
+    res.end(minifyHtml(html));
   } catch (err: any) {
     // Re-throw so the server entry (build-node / build-vercel) can route to
     // the _500 page handler. Do not swallow the error here.

package/dist/build-node.js

@@ -1,5 +1,6 @@
 import fs from "fs";
 import path from "path";
+import { build } from "esbuild";
 import { loadConfig } from "./config.js";
 import {
   analyzeFile,
@@ -27,6 +28,21 @@ const manifest = [];
 function funcPathToFilename(funcPath, prefix) {
   return funcPath.replace(new RegExp(`^\\/${prefix}\\/`), "") + ".mjs";
 }
+const userMiddlewareSrc = path.resolve("middleware.ts");
+const hasUserMiddleware = fs.existsSync(userMiddlewareSrc);
+if (hasUserMiddleware) {
+  const result = await build({
+    entryPoints: [userMiddlewareSrc],
+    bundle: true,
+    format: "esm",
+    platform: "node",
+    target: "node20",
+    packages: "external",
+    write: false
+  });
+  fs.writeFileSync(path.join(OUT_DIR, "middleware.mjs"), result.outputFiles[0].text);
+  console.log("  built     middleware.ts  \u2192  dist/middleware.mjs");
+}
 const apiFiles = walkFiles(SERVER_DIR);
 if (apiFiles.length === 0) console.warn(`\u26A0  No server files found in ${SERVER_DIR}`);
 const apiRoutes = apiFiles.map((relPath) => ({ ...analyzeFile(relPath, "api"), absPath: path.join(SERVER_DIR, relPath) })).sort((a, b) => b.specificity - a.specificity);
@@ -100,7 +116,44 @@ const compiled   = routes.map(r => ({ ...r, regex: new RegExp(r.srcRegex) }));
 const STATIC_DIR = path.join(__dirname, 'static');
 const MIME_MAP   = { ${MIME_MAP_ENTRIES} };
 
+// \u2500\u2500 Middleware \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+// Load user middleware (compiled from middleware.ts at build time) once at
+// startup.  The variable stays null if no middleware was built.
+let __middleware__ = null;
+{
+  const mwPath = path.join(__dirname, 'middleware.mjs');
+  if (fs.existsSync(mwPath)) {
+    try {
+      const mod = await import(pathToFileURL(mwPath).href);
+      if (typeof mod.default === 'function') {
+        __middleware__ = mod.default;
+        console.log('nukejs: middleware loaded');
+      } else {
+        console.warn('nukejs: middleware.mjs does not export a default function, skipping');
+      }
+    } catch(e) { console.error('[middleware load error]', e); }
+  }
+}
+
 const server = http.createServer(async (req, res) => {
+  // 0. User middleware \u2014 runs before every request (static files included).
+  //    May mutate req.url (e.g. locale rewrites) \u2014 read it AFTER this runs.
+  //    If it ends the response, skip all framework handling.
+  if (__middleware__) {
+    try {
+      await __middleware__(req, res);
+      if (res.writableEnded || res.headersSent) return;
+    } catch(e) {
+      console.error('[middleware error]', e);
+      if (!res.headersSent) {
+        res.statusCode = 500;
+        res.setHeader('Content-Type', 'text/plain');
+        res.end('Internal Server Error');
+      }
+      return;
+    }
+  }
+
   const url   = req.url || '/';
   const clean = url.split('?')[0];
 

package/dist/build-vercel.js

@@ -72,13 +72,20 @@ function emitVercelFunction(name, bundleText) {
     JSON.stringify({ runtime: "nodejs20.x", handler: "index.mjs", launcherType: "Nodejs" }, null, 2)
   );
 }
-function makeApiDispatcherSource(routes) {
+function makeApiDispatcherSource(routes, middlewarePath) {
+  const middlewareImport = middlewarePath ? `import __userMiddleware__ from ${JSON.stringify(middlewarePath)};` : "";
+  const middlewareRun = middlewarePath ? `
+  // Run user middleware before routing.  If it ends the response, bail out.
+  await __userMiddleware__(req, res);
+  if ((res as any).writableEnded || (res as any).headersSent) return;
+` : "";
   const imports = routes.map((r, i) => `import * as __api_${i}__ from ${JSON.stringify(r.absPath)};`).join("\n");
   const routeEntries = routes.map(
     (r, i) => `  { regex: ${JSON.stringify(r.srcRegex)}, params: ${JSON.stringify(r.paramNames)}, mod: __api_${i}__ },`
   ).join("\n");
   return `import type { IncomingMessage, ServerResponse } from 'http';
 ${imports}
+${middlewareImport}
 
 function enhance(res: ServerResponse) {
   (res as any).json = function(data: any, status = 200) {
@@ -112,6 +119,7 @@ ${routeEntries}
 ];
 
 export default async function handler(req: IncomingMessage, res: ServerResponse) {
+${middlewareRun}
   const url      = new URL(req.url || '/', 'http://localhost');
   const pathname = url.pathname;
 
@@ -143,7 +151,13 @@ export default async function handler(req: IncomingMessage, res: ServerResponse)
 }
 `;
 }
-function makePagesDispatcherSource(routes, errorAdapters = {}) {
+function makePagesDispatcherSource(routes, errorAdapters = {}, middlewarePath) {
+  const middlewareImport = middlewarePath ? `import __userMiddleware__ from ${JSON.stringify(middlewarePath)};` : "";
+  const middlewareRun = middlewarePath ? `
+  // Run user middleware before routing.  If it ends the response, bail out.
+  await __userMiddleware__(req, res);
+  if ((res as any).writableEnded || (res as any).headersSent) return;
+` : "";
   const imports = routes.map((r, i) => `import __page_${i}__ from ${JSON.stringify(r.adapterPath)};`).join("\n");
   const routeEntries = routes.map(
     (r, i) => `  { regex: ${JSON.stringify(r.srcRegex)}, params: ${JSON.stringify(r.paramNames)}, catchAll: ${JSON.stringify(r.catchAllNames)}, handler: __page_${i}__ },`
@@ -180,6 +194,7 @@ function makePagesDispatcherSource(routes, errorAdapters = {}) {
 ${imports}
 ${error404Import}
 ${error500Import}
+${middlewareImport}
 
 const ROUTES: Array<{
   regex:    string;
@@ -191,6 +206,7 @@ ${routeEntries}
 ];
 
 export default async function handler(req: IncomingMessage, res: ServerResponse) {
+${middlewareRun}
   const url      = new URL(req.url || '/', 'http://localhost');
   const pathname = url.pathname;
 
@@ -227,13 +243,16 @@ ${notFoundHandler}
 }
 `;
 }
+const userMiddlewareSrc = path.resolve("middleware.ts");
+const vercelMiddlewarePath = fs.existsSync(userMiddlewareSrc) ? userMiddlewareSrc : void 0;
+if (vercelMiddlewarePath) console.log("  found     middleware.ts  (will be bundled into functions)");
 const vercelRoutes = [];
 const apiFiles = walkFiles(SERVER_DIR);
 if (apiFiles.length === 0) console.warn(`\u26A0  No server files found in ${SERVER_DIR}`);
 const apiRoutes = apiFiles.map((relPath) => ({ ...analyzeFile(relPath, "api"), absPath: path.join(SERVER_DIR, relPath) })).sort((a, b) => b.specificity - a.specificity);
 if (apiRoutes.length > 0) {
   const dispatcherPath = path.join(SERVER_DIR, `_api_dispatcher_${randomBytes(4).toString("hex")}.ts`);
-  fs.writeFileSync(dispatcherPath, makeApiDispatcherSource(apiRoutes));
+  fs.writeFileSync(dispatcherPath, makeApiDispatcherSource(apiRoutes, vercelMiddlewarePath));
   try {
     const result = await build({
       entryPoints: [dispatcherPath],
@@ -320,7 +339,7 @@ if (serverPages.length > 0 || hasErrorPages) {
     errorAdapterPaths.push(adapterPath);
   }
   const dispatcherPath = path.join(PAGES_DIR, `_pages_dispatcher_${randomBytes(4).toString("hex")}.ts`);
-  fs.writeFileSync(dispatcherPath, makePagesDispatcherSource(dispatcherRoutes, errorAdapters));
+  fs.writeFileSync(dispatcherPath, makePagesDispatcherSource(dispatcherRoutes, errorAdapters, vercelMiddlewarePath));
   try {
     const result = await build({
       entryPoints: [dispatcherPath],

package/dist/bundle.js

@@ -166,7 +166,9 @@ function headBlock(head) {
   return { nodes, closeComment };
 }
 function fingerprint(el) {
-  return el.tagName + "|" + Array.from(el.attributes).sort((a, b) => a.name.localeCompare(b.name)).map((a) => `${a.name}=${a.value}`).join("&");
+  const attrPart = Array.from(el.attributes).sort((a, b) => a.name.localeCompare(b.name)).map((a) => `${a.name}=${a.value}`).join("&");
+  const contentPart = el.tagName === "STYLE" ? el.textContent ?? "" : "";
+  return el.tagName + "|" + attrPart + (contentPart ? "|" + contentPart : "");
 }
 function syncHeadTags(doc) {
   const live = headBlock(document.head);

package/dist/middleware-loader.js

@@ -26,7 +26,12 @@ async function loadMiddleware() {
     appDir,
     `middleware.${appDir.endsWith("dist") ? "js" : "ts"}`
   );
-  const userPath = path.join(process.cwd(), "middleware.ts");
+  const userCandidates = [
+    path.join(process.cwd(), "middleware.ts"),
+    path.join(process.cwd(), "middleware.js"),
+    path.join(process.cwd(), "middleware.mjs")
+  ];
+  const userPath = userCandidates.find((p) => fs.existsSync(p)) ?? userCandidates[0];
   const paths = [.../* @__PURE__ */ new Set([builtinPath, userPath])];
   for (const middlewarePath of paths) {
     await loadMiddlewareFromPath(middlewarePath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nukejs",
-  "version": "0.0.20",
+  "version": "0.0.22",
   "description": "A minimal, opinionated full-stack React framework on Node.js that server-renders everything and hydrates only interactive parts.",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",