rosefc 0.0.0-stage → 0.2.0

package/package.json

@@ -1,6 +1,112 @@
 {
   "name": "rosefc",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "The next-century web framework: zero-hydration, compile-time reactivity, single binary deploy",
+  "type": "module",
+  "scripts": {
+    "dev": "tsx src/cli/index.ts dev example",
+    "build": "tsx src/cli/index.ts build example",
+    "preview": "tsx src/cli/index.ts preview example",
+    "serve": "tsx src/cli/index.ts serve example",
+    "pack": "node pack.mjs",
+    "prepublishOnly": "npm run pack",
+    "benchmark": "tsx tests/benchmark.ts",
+    "test": "tsx src/cli/index.ts build example && tsx tests/test-client.ts",
+    "test:cli": "node tests/test-cli.mjs",
+    "test:e2e": "tsx tests/test-e2e.ts",
+    "test:als": "node tests/test-dev-als.mjs",
+    "test:edge": "tsx tests/test-edge.ts",
+    "test:harness": "tsx tests/test-harness.ts",
+    "test:sliced": "tsx tests/test-sliced.ts",
+    "test:export": "tsx tests/test-export.ts",
+    "test:go": "tsx src/cli/index.ts build example && node tests/test-go.mjs",
+    "test:pack": "node tests/test-pack.mjs",
+    "test:resilience": "tsx tests/test-resilience.ts",
+    "build:go": "node -e \"const fs=require('fs');if(!fs.existsSync('dist')){console.error('build:go: dist/ missing - run npm run build first');process.exit(1)}\" && go build -o rosefd-server ."
+  },
+  "bin": {
+    "rosefd": "dist-cli/rosefd.mjs"
+  },
+  "exports": {
+    "./edge": "./dist-cli/edge.mjs",
+    "./runtime": "./dist-cli/runtime.mjs",
+    "./compiler": "./dist-cli/compiler.mjs",
+    "./export": "./dist-cli/export.mjs",
+    "./test": "./dist-cli/test.mjs"
+  },
+  "files": [
+    "dist-cli",
+    "src/FRAMEWORK_VERSION",
+    "src/types/rosefd.d.ts",
+    "src/cli/content.ts",
+    "src/cli/edge.ts",
+    "src/cli/hot-vary.ts",
+    "src/cli/origin.ts",
+    "src/cli/prod-server.ts",
+    "src/cli/shell.ts",
+    "src/cli/shutdown.ts",
+    "src/cli/validator.ts",
+    "src/hash.ts",
+    "src/runtime/db.ts",
+    "src/runtime/index.ts",
+    "src/runtime/lorawan.ts",
+    "deploy/api",
+    "deploy/cloudflare",
+    "deploy/k8s",
+    "deploy/netlify",
+    "deploy/Dockerfile.node",
+    "deploy/Dockerfile.static",
+    "deploy/docker-compose.yml",
+    "deploy/fly.toml",
+    "deploy/netlify.toml",
+    "deploy/native",
+    "deploy/server.cjs",
+    "deploy/vercel.json",
+    "LICENSE"
+  ],
+  "license": "MIT",
+  "author": {
+    "name": "okdunli",
+    "url": "https://github.com/okdunli"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/okdunli/rosefd.git"
+  },
+  "homepage": "https://github.com/okdunli/rosefd#readme",
+  "bugs": {
+    "url": "https://github.com/okdunli/rosefd/issues"
+  },
+  "keywords": [
+    "framework",
+    "ssr",
+    "zero-hydration",
+    "compile-time-reactivity",
+    "fullstack",
+    "miniprogram",
+    "flutter",
+    "android",
+    "arkts",
+    "swiftui",
+    "electron",
+    "edge",
+    "esm"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "dependencies": {
+    "esbuild": "^0.24.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "jsdom": "^29.1.1",
+    "pg": "^8.23.0",
+    "tsx": "^4.7.0",
+    "typescript": "^5.6.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}

package/src/FRAMEWORK_VERSION

@@ -0,0 +1 @@
+0.2.0

package/src/cli/content.ts

@@ -0,0 +1,188 @@
+
+import fs from "node:fs";
+import path from "node:path";
+
+export interface ContentEntry {
+  slug: string;
+  frontmatter: Record<string, string | string[]>;
+  /** markdown source, unrendered (the page renders it, highlight applies) */
+  body: string;
+  /** rendered html with heading anchors (T20-free: ids for TOC deep links) */
+  html: string;
+  readingTime: number;
+  wordCount: number;
+  toc: { level: number; text: string; id: string }[];
+  excerpt: string;
+}
+
+/** Parse `---`-delimited frontmatter: `key: value` lines, `[a, b]` arrays. */
+export function parseFrontmatter(raw: string): {
+  frontmatter: Record<string, string | string[]>;
+  body: string;
+} {
+  if (!raw.startsWith("---")) return { frontmatter: {}, body: raw };
+  const end = raw.indexOf("\n---", 3);
+  if (end < 0) return { frontmatter: {}, body: raw };
+  const head = raw.slice(4, end);
+  const body = raw.slice(raw.indexOf("\n", end + 1) + 1).replace(/^\s*\n/, "");
+  const frontmatter: Record<string, string | string[]> = {};
+  for (const line of head.split("\n")) {
+    const m = /^(\w[\w-]*):\s*(.*)$/.exec(line.trim());
+    if (!m) continue;
+    const [, k, v] = m;
+    const arr = /^\[(.+)\]$/.exec(v.trim());
+    frontmatter[k] = arr
+      ? arr[1].split(",").map((x) => x.trim().replace(/^["']|["']$/g, ""))
+      : v.trim().replace(/^["']|["']$/g, "");
+  }
+  return { frontmatter, body };
+}
+
+/** Mini-markdown → HTML: headings, fenced code, lists, bold/italic/code,
+ *  links, paragraphs. Zero dependencies; ~100 lines cover the blog 90%. */
+function interpolate(md: string, vars: Record<string, unknown>): string {
+  return md.replace(/{{(\w[\w.]*)}}/g, (_m, k) => {
+    const v = k.split(".").reduce((o: any, p) => (o == null ? o : o[p]), vars as any);
+    return v === undefined || v === null ? "" : String(v);
+  });
+}
+
+export function renderMarkdown(md: string, vars?: Record<string, unknown>): string {
+  if (vars) md = interpolate(md, vars);
+  const blocks: string[] = [];
+  // fenced code blocks first: stash them, placeholder back in later
+  let src = md.replace(/```(\w*)\n([\s\S]*?)```/g, (_m, lang, code) => {
+    blocks.push(
+      `<pre data-lang="${lang}"><code>${code
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")}</code></pre>`,
+    );
+    return `\u0000CODE${blocks.length - 1}\u0000`;
+  });
+
+  const inline = (s: string) =>
+    s
+      .replace(/&/g, "&amp;")
+      .replace(/</g, "&lt;")
+      .replace(/>/g, "&gt;")
+      .replace(/`([^`]+)`/g, "<code>$1</code>")
+      .replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>")
+      .replace(/\*([^*]+)\*/g, "<em>$1</em>")
+      .replace(
+        /\[([^\]]+)\]\(([^)]+)\)/g,
+        '<a href="$2" rel="noopener">$1</a>',
+      );
+
+  const out: string[] = [];
+  let listOpen: "ul" | "ol" | null = null;
+  const closeList = () => {
+    if (listOpen) { out.push(`</${listOpen}>`); listOpen = null; }
+  };
+  for (const line of src.split("\n")) {
+    const h = /^(#{1,4})\s+(.*)$/.exec(line);
+    const li = /^\s*[-*]\s+(.*)$/.exec(line);
+    const oli = /^\s*\d+\.\s+(.*)$/.exec(line);
+    if (h) { closeList(); out.push(`<h${h[1].length}>${inline(h[2])}</h${h[1].length}>`); }
+    else if (li) {
+      if (listOpen !== "ul") { closeList(); out.push("<ul>"); listOpen = "ul"; }
+      out.push(`<li>${inline(li[1])}</li>`);
+    } else if (oli) {
+      if (listOpen !== "ol") { closeList(); out.push("<ol>"); listOpen = "ol"; }
+      out.push(`<li>${inline(oli[1])}</li>`);
+    } else if (line.trim() === "") { closeList(); }
+    else if (line.startsWith("\u0000CODE")) { closeList(); out.push(line); }
+    else { closeList(); out.push(`<p>${inline(line)}</p>`); }
+  }
+  closeList();
+  return out
+    .join("\n")
+    .replace(/\u0000CODE(\d+)\u0000/g, (_m, i) => blocks[Number(i)]);
+}
+
+/** Scan src/content/<collection>/*.md into entries (slug = filename). */
+export function scanContentDir(contentDir: string): Record<string, ContentEntry[]> {
+  const collections: Record<string, ContentEntry[]> = {};
+  if (!fs.existsSync(contentDir)) return collections;
+  for (const coll of fs.readdirSync(contentDir, { withFileTypes: true })) {
+    if (!coll.isDirectory()) continue;
+    const entries: ContentEntry[] = [];
+    const dir = path.join(contentDir, coll.name);
+    for (const f of fs.readdirSync(dir)) {
+      if (!f.endsWith(".md")) continue;
+      const raw = fs.readFileSync(path.join(dir, f), "utf-8");
+            const { frontmatter, body } = parseFrontmatter(raw);
+      if (String(frontmatter.draft ?? "").toLowerCase() === "true") continue;
+      const slug = f.replace(/\.md$/, "");
+      const html = renderMarkdown(body);
+      const words = body.replace(/[#*`\[\]()>-]/g, " ").split(/\s+/).filter(Boolean).length;
+      const headings: { level: number; text: string; id: string }[] = [];
+      const tocHtml = html.replace(/<h([1-4])>([^<]+)<\/h\1>/g, (_m, lvl: string, txt: string) => {
+        const id = txt.toLowerCase().replace(/[^\w\s-]/g, "").trim().replace(/\s+/g, "-");
+        headings.push({ level: Number(lvl), text: txt, id });
+        return `<h${lvl} id="${id}">${txt}</h${lvl}>`;
+      });
+      entries.push({
+        slug, frontmatter,
+        body, html: tocHtml,
+        readingTime: Math.max(1, Math.round(words / 200)),
+        wordCount: words,
+        toc: headings,
+        excerpt: String(frontmatter.summary ?? "") || (html.match(/<p>([\s\S]*?)<\/p>/)?.[1] ?? "").replace(/<[^>]+>/g, "").slice(0, 160),
+      });
+    }
+    entries.sort((a, b) =>
+      String(b.frontmatter.date ?? "").localeCompare(String(a.frontmatter.date ?? "")),
+    );
+    collections[coll.name] = entries;
+  }
+  return collections;
+}
+
+/** Prev/next navigation within a collection (date-descending order). */
+export function prevNext(
+  entries: ContentEntry[],
+  slug: string,
+): { prev: ContentEntry | null; next: ContentEntry | null } {
+  const i = entries.findIndex((e) => e.slug === slug);
+  return { prev: i > 0 ? entries[i - 1] : null, next: i >= 0 && i < entries.length - 1 ? entries[i + 1] : null };
+}
+
+/** Group a collection by a frontmatter array field (tags/categories). */
+export function byTag(
+  entries: ContentEntry[],
+  field: string,
+): Record<string, ContentEntry[]> {
+  const out: Record<string, ContentEntry[]> = {};
+  for (const e of entries) {
+    for (const t of (e.frontmatter[field] as string[] | undefined) ?? []) {
+      (out[t] ??= []).push(e);
+    }
+  }
+  return out;
+}
+
+globalThis.__rosefdContentMk = renderMarkdown;
+
+/** RSS 2.0 feed from a collection - wire to /feed.xml or /api/feed. */
+export function buildRss(
+  entries: ContentEntry[],
+  opts: { title: string; origin: string; description?: string; pathPrefix?: string },
+): string {
+  const esc = (v: unknown) =>
+    String(v ?? "")
+      .replace(/&/g, "&amp;")
+      .replace(/</g, "&lt;")
+      .replace(/>/g, "&gt;")
+      .replace(/"/g, "&quot;");
+  const prefix = opts.pathPrefix ?? "/";
+  const items = entries
+    .map((e) => {
+      const url = `${opts.origin}${prefix}${e.slug}`;
+      const pub = e.frontmatter.date ? new Date(String(e.frontmatter.date)).toUTCString() : "";
+      const excerpt = e.excerpt ? `<description>${esc(e.excerpt)}</description>` : "";
+      return `    <item>\n      <title>${esc(e.frontmatter.title)}</title>\n      <link>${esc(url)}</link>\n      <guid isPermaLink="true">${esc(url)}</guid>\n      ${pub ? `<pubDate>${pub}</pubDate>\n      ` : ""}${excerpt}\n    </item>`;
+    })
+    .join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>\n<rss version="2.0"><channel>\n<title>${esc(opts.title)}</title>\n<link>${esc(opts.origin)}${prefix}</link>\n<description>${esc(opts.description ?? "")}</description>\n${items}\n</channel></rss>`;
+}

package/src/cli/edge.ts

@@ -0,0 +1,298 @@
+
+// Rosefd Edge adapter - Web-standard fetch handler.
+import { pathToFileURL } from 'url';
+import { join } from 'path';
+import { buildShell, shellOpen, clientScriptTag, securityHeaders, mintNonce, getClientSource, setBundleMode } from './shell.js';
+import { hotVaryValues } from './hot-vary.js';
+
+type ServerModule = {
+  renderPage(pathname: string, form?: FormData): Promise<{ html: string; state: string; head: string[]; status?: number; csr?: boolean; shell?: boolean; lang?: string; dir?: string }>;
+  renderPageStream(pathname: string, write: (chunk: string) => void, shellOpen: string, clientTag: string): Promise<number>;
+  canStream(pathname: string): boolean;
+  isNoJs(pathname: string): boolean;
+  /** the matched route exported `shell = false` - the streaming shell must ask before it flushes */
+  shellOff?(pathname: string): boolean;
+  /** P0-2: routes that exported `buffer = true` - buffered, never streamed */
+  isBuffered(pathname: string): boolean;
+  isApi(pathname: string): boolean;
+  handleApi(method: string, pathname: string, request: Request): Promise<Response>;
+ /** The document's <html lang>/<dir> for a pathname (streaming needs them before the render) */
+  docAttrs(pathname: string): { lang: string; dir: string };
+  /** The headers the matched route declared with `export const hotVary` - extra cache-key dimensions, or null when it declared none */
+  hotVaryFor?(pathname: string): string[] | null;
+  /** pages/_middleware.rose's handler, or null when the project has none */
+  middleware: ((request: Request) => Promise<Response | void | null>) | null;
+  /** run the middleware once per request; returns its short-circuit Response or null */
+  runMiddleware(rawReq: any, form?: FormData): Promise<Response | null>;
+ /** The runtime plugin hooks, and whether the project declares any */
+  runRequestHooks(ctx: {
+    request: Request; url: URL; method: string; pathname: string; state: Record<string, unknown>;
+  }): Promise<Response | null>;
+  runResponseHooks(ctx: {
+    request: Request; url: URL; method: string; pathname: string; state: Record<string, unknown>;
+  }, res: Response): Promise<Response>;
+  hasRequestHooks: boolean;
+  hasResponseHooks: boolean;
+  /** routes whose component reads getContext(): never prerendered, always live */
+  dynamicRoutes: string[];
+ /** per-route response headers [] when no route exports any */
+  routeHeaders: Array<{ pattern: string; headers: Record<string, string> }>;
+  /** the route's own exported headers for a pathname, or null */
+  headersFor(pathname: string): Record<string, string> | null;
+ /** Routes that exported `csp = { nonce: true }` - nonce policy, never baked */
+  cspNonce(pathname: string): boolean;
+  /** P0-1: the query of the request being rendered, for $query() */
+  setQuery(query: Record<string, string>): void;
+};
+
+
+export { onShutdown, runShutdownHooks, shutdownHookCount } from './shutdown.js';
+
+// CSRF guard: a state-changing request that did not come from this site is refused before middleware, hooks and routing see it.
+function crossSiteWrite(request: Request): Response | null {
+  const m = request.method;
+  if (m !== 'POST' && m !== 'PUT' && m !== 'PATCH' && m !== 'DELETE') return null;
+  const origin = request.headers.get('origin');
+  if (origin) {
+    let host: string;
+    try {
+      host = new URL(origin).host;
+    } catch {
+      return new Response('Cross-site request blocked (unparsable Origin header)', { status: 403 });
+    }
+    return host === new URL(request.url).host
+      ? null
+      : new Response('Cross-site request blocked (Origin does not match Host)', { status: 403 });
+  }
+  const site = request.headers.get('sec-fetch-site');
+  if (site && site !== 'same-origin' && site !== 'same-site' && site !== 'none') {
+    return new Response(`Cross-site request blocked (sec-fetch-site: ${site})`, { status: 403 });
+  }
+  return null;
+}
+
+/**
+ * The whole request unit - setQuery through the rendered response - runs one
+ * at a time, on the same promise-chain shape as the runtime's fallback render
+ * mutex. The runtime lock protects the render MAPS (isolateRender swaps them
+ * once it is inside the render), but setQuery writes a module-level variable
+ * OUTSIDE that lock, so without this queue two concurrent requests could
+ * still overwrite each other's query before either render began - a render
+ * then read the other request's $query(). Queueing the unit also means the
+ * render lock inside is always free when a unit is admitted, so the two locks
+ * can never deadlock against each other. Under a context store (Node) none of
+ * this applies: each chain carries its own maps and query bag.
+ */
+let edgeQueue: Promise<void> = Promise.resolve();
+const withEdgeQueue = <T>(fn: () => Promise<T>): Promise<T> => {
+  const prev = edgeQueue;
+  let release!: () => void;
+  edgeQueue = new Promise<void>((r) => { release = r; });
+  return prev.then(fn).finally(release);
+};
+
+/**
+ * Create a fetch handler from a built Rosefd project.
+ * @param outDir directory containing server.js and client.js
+ * @param preloaded for runtimes with NO filesystem (Cloudflare Workers /
+ *   Pages): the caller statically imports the server bundle (so the deploy
+ *   compiler bundles it in) and fetches the site's own static assets once
+ *   per isolate. Anything provided here is used verbatim; anything absent
+ *   falls back to reading it from outDir, exactly as before.
+ */
+export async function createEdgeHandler(
+  outDir: string,
+  preloaded?: { server?: ServerModule; client?: string; styles?: string; broken?: string[] },
+): Promise<(request: Request) => Promise<Response>> {
+  const mod: ServerModule = preloaded?.server ?? await import(pathToFileURL(join(outDir, 'server.js')).href);
+  let client: string | null = null;
+  let styles = '';
+  if (preloaded && 'client' in preloaded) {
+    client = preloaded.client ?? null;
+  } else {
+    try {
+      client = await (await import('fs/promises')).readFile(join(outDir, 'client.js'), 'utf-8');
+    } catch {
+      client = null;
+    }
+  }
+  if (client && client.includes('chunks/')) client = null;
+  // Sliced mode: every route's document inlines its OWN bundle, so the source
+  // is resolved per request (mtime-cached inside shell.ts). The server bundle
+  // exports sliceKeyFor only in sliced builds - its presence is the mode test,
+  // and it also flips shell.ts's resolver into per-route mode (this process
+  // never ran the CLI's build(), which is what sets the flag there).
+  const sliced = typeof (mod as { sliceKeyFor?: unknown }).sliceKeyFor === 'function';
+  if (sliced) setBundleMode('sliced');
+  // The dist this handler serves, not the process cwd's: an edge runtime is
+  // handed a directory, and a slice resolved against the wrong one would
+  // silently fall back to the core (every route's chain in one document).
+  const clientFor = (pathname: string): string | null =>
+    sliced ? getClientSource((mod as { sliceKeyFor: (p: string) => string | null }).sliceKeyFor(pathname), outDir) : client;
+  if (preloaded && 'styles' in preloaded) {
+    styles = preloaded.styles ?? '';
+  } else {
+    try {
+      styles = await (await import('fs/promises')).readFile(join(outDir, 'styles.css'), 'utf-8');
+    } catch {
+      styles = '';
+    }
+  }
+  let broken = new Set<string>();
+  if (preloaded && 'broken' in preloaded) {
+    broken = new Set(preloaded.broken);
+  } else {
+    try {
+      broken = new Set(JSON.parse(await (await import('fs/promises')).readFile(join(outDir, 'broken.json'), 'utf-8')));
+    } catch {
+      broken = new Set();
+    }
+  }
+
+  const pageHeaders = (pathname: string, nonce = ''): Record<string, string> => {
+    const headers: Record<string, string> = {};
+    for (const [k, v] of Object.entries(securityHeaders(clientFor(pathname), nonce))) headers[k.toLowerCase()] = v;
+    if (!headers['cache-control']) headers['cache-control'] = 'no-cache';
+    const own = mod.headersFor?.(pathname);
+    if (own) for (const [k, v] of Object.entries(own)) headers[k.toLowerCase()] = v;
+    return headers;
+  };
+
+  return async function handle(request: Request): Promise<Response> {
+    const refused = crossSiteWrite(request);
+    if (refused) return refused;
+    const { pathname, searchParams } = new URL(request.url);
+    const canonical = pathname.replace(/\/+$/, '') || '/';
+    if (canonical !== pathname) {
+      return new Response(null, { status: 308, headers: { location: canonical + new URL(request.url).search } });
+    }
+    // setQuery onward: the serialized unit. The streaming branch returns as
+    // soon as the Response exists (its start() is lazy and runs outside the
+    // queue), so a slow reader never holds the queue - the render lock inside
+    // still serializes the render itself.
+    return withEdgeQueue(async () => {
+    mod.setQuery?.(Object.fromEntries(searchParams));
+    const hookCtx = mod.hasRequestHooks || mod.hasResponseHooks
+      ? { request, url: new URL(request.url), method: request.method, pathname, state: {} as Record<string, unknown> }
+      : null;
+    if (hookCtx) {
+      const short = await mod.runRequestHooks(hookCtx);
+      if (short) return mod.runResponseHooks(hookCtx, short);
+    }
+    if (mod.middleware) {
+      const mw = await mod.runMiddleware(request);
+      if (mw) return hookCtx ? mod.runResponseHooks(hookCtx, mw) : mw;
+    }
+    // 0.2.0: the native data channel. A mini program / mobile client cannot
+    // execute the render, so it asks for the JSON half of one - the state the
+    // page's $data produced. Middleware already ran above (a wall short-
+    // circuited before this point), so a gated route never leaks through it.
+    if (pathname === '/__rosefd/data' && request.method === 'GET') {
+      const target = searchParams.get('path') || '/';
+      try {
+        // The gate is per-page: judge the target path, not the channel URL.
+        if (mod.middleware) {
+          const mw = await mod.runMiddleware(new Request(new URL(target, request.url), { method: 'GET', headers: request.headers }));
+          if (mw) {
+            const headers = new Headers(mw.headers);
+            headers.set('access-control-allow-origin', '*');
+            return new Response(await mw.arrayBuffer(), { status: mw.status, headers });
+          }
+        }
+        mod.setQuery?.(Object.fromEntries(new URL('http://x' + target).searchParams));
+        const page = await (mod as any).renderPage(target, undefined, { withState: true });
+        let state: unknown = {};
+        try { state = JSON.parse(page?.state || '{}'); } catch { state = {}; }
+        return new Response(JSON.stringify({ path: target, status: page?.status ?? 200, state }), {
+          status: 200,
+          headers: {
+            'content-type': 'application/json; charset=utf-8',
+            'access-control-allow-origin': '*',
+            'cache-control': 'no-store',
+          },
+        });
+      } catch (err) {
+        return new Response(JSON.stringify({ error: String((err as Error)?.message ?? err).slice(0, 200) }), {
+          status: 500,
+          headers: { 'content-type': 'application/json; charset=utf-8', 'access-control-allow-origin': '*' },
+        });
+      }
+    }
+    if (mod.isApi(pathname)) {
+      if (request.method !== 'GET') {
+        const fn = (mod as any).invalidateRenderCache;
+        if (typeof fn === 'function') fn();
+      }
+      const apiRes = await mod.handleApi(request.method, pathname, request);
+      return hookCtx ? mod.runResponseHooks(hookCtx, apiRes) : apiRes;
+    }
+    const form = request.method === 'POST' ? await request.formData() : undefined;
+    if (form) {
+      const fn = (mod as any).invalidateRenderCache;
+      if (typeof fn === 'function') fn();
+    }
+    if (!form && !broken.has(pathname) && !mod.isBuffered?.(pathname) && mod.canStream(pathname) && !mod.isNoJs(pathname) && !request.headers.get('x-pjax')) {
+      const nonce = mod.cspNonce?.(pathname) ? mintNonce() : '';
+      const streamed = new Response(null, {
+        status: 200,
+        headers: { 'content-type': 'text/html; charset=utf-8', ...pageHeaders(pathname, nonce) }
+      });
+      const head = hookCtx ? await mod.runResponseHooks(hookCtx, streamed) : streamed;
+      const encoder = new TextEncoder();
+      const stream = new ReadableStream<Uint8Array>({
+        async start(controller) {
+          const doc = mod.docAttrs(pathname);
+          await mod.renderPageStream(
+            pathname,
+            (chunk) => controller.enqueue(encoder.encode(chunk)),
+            shellOpen(styles, doc.lang, doc.dir, !mod.shellOff?.(pathname)),
+            clientScriptTag(clientFor(pathname), nonce)
+          );
+          controller.close();
+        }
+      });
+      return new Response(stream, { status: head.status, headers: head.headers });
+    }
+    const cookieHeader = request.headers.get('cookie') || '';
+    const qs = searchParams.toString();
+    // The render memo is shared across requests, so its key carries the
+    // negotiation fingerprint too - accept-language plus whatever the matched
+    // route declared with `export const hotVary`.
+    const dims = hotVaryValues(pathname, (mod as any).hotVaryFor, (n) => request.headers.get(n)).join('\u0000');
+    const memoHit = !form && (mod as any).isCachedRoute?.(pathname)
+      ? (mod as any).peekRenderCache?.(pathname, cookieHeader, qs, dims)
+      : null;
+    const page = memoHit ?? ((mod as any).renderPageCached && !form
+      ? await (mod as any).renderPageCached(pathname, cookieHeader, qs, dims)
+      : await mod.renderPage(pathname, form));
+    const nonce = mod.cspNonce?.(pathname) ? mintNonce() : '';
+    // A page that called redirect() returns { redirect, status } with no html;
+    // the prod edge entry must honor it or the document 500s (dev/preview route
+    // through a different handler that already does).
+    if ((page as { redirect?: string }).redirect) {
+      const target = (page as { redirect: string }).redirect;
+      const loc = new URL(target, request.url);
+      const body = `<!DOCTYPE html><title>Redirecting</title><p>Redirecting to <a href="${target}">${target}</a>.</p>`;
+      return new Response(body, { status: (page as { status?: number }).status ?? 302, headers: { 'content-type': 'text/html; charset=utf-8', location: loc.pathname + loc.search } });
+    }
+    let html = buildShell(page.html, page.state, clientFor(pathname), page.head, styles, page.csr !== false, page.lang, page.dir, nonce, page.shell !== false);
+    if (request.headers.get('x-pjax')) html = pjaxFragment(html);
+    const buffered = new Response(html, {
+      status: page.status ?? 200,
+      headers: { 'content-type': 'text/html; charset=utf-8', ...pageHeaders(pathname, nonce) }
+    });
+    return hookCtx ? mod.runResponseHooks(hookCtx, buffered) : buffered;
+    });
+  };
+}
+
+function pjaxFragment(html: string): string {
+  const mi = html.indexOf('<main id="sk-main"');
+  if (mi < 0) return html;
+  const me = html.indexOf('</main>', mi);
+  if (me < 0) return html;
+  const main = html.slice(mi, me + '</main>'.length);
+  const tm = html.match(/<title>([\s\S]*?)<\/title>/i);
+  const title = tm ? tm[0] : '';
+  return title + main;
+}

package/src/cli/hot-vary.ts

@@ -0,0 +1,27 @@
+// The dimensions a SHARED cache entry is negotiated on.
+//
+// Every server-side cache in this framework - the prod server's hot cache and
+// the route render memo (`export const cache = N`) - answers bytes that were
+// rendered for a different request, so each one's key has to name the whole
+// representation. URL + cookie is not the whole representation: a render that
+// localizes on Accept-Language, or that reads a private header of its own
+// (x-locale, x-rv-url), produces different bytes per request under one URL
+// (BUG.md AB). The framework carries accept-language unconditionally; anything
+// beyond it has to be declared by the route - `export const hotVary =
+// ['x-rv-url']` - which the build turns into a pattern-matched lookup
+// (hotVaryFor) in the server bundle.
+//
+// Index 0 is therefore always accept-language. The rest are the declared
+// headers, in declaration order, so a caller that replays them onto a
+// synthesized request (the hot cache's warm render) can pair names with values
+// by position.
+export function hotVaryValues(
+  pathname: string,
+  hotVaryFor: ((p: string) => string[] | null) | undefined,
+  get: (name: string) => string | null | undefined,
+): string[] {
+  const al = String(get('accept-language') ?? '').trim().toLowerCase();
+  const dims = hotVaryFor?.(pathname) ?? [];
+  if (!dims.length) return [al];
+  return [al, ...dims.map((d) => String(get(d) ?? '').trim())];
+}

package/src/cli/origin.ts

@@ -0,0 +1,10 @@
+
+export function requestOrigin(req: any, fallbackPort: number | string): string {
+  const rawProto = String(req.headers?.['x-forwarded-proto'] || '');
+  // A chain of proxies appends: "https, http". The client-facing hop is first.
+  const proto = rawProto.split(',')[0]!.trim();
+  const scheme = proto === 'https' || proto === 'http' ? proto : 'http';
+  const rawHost = String(req.headers?.['x-forwarded-host'] || '');
+  const host = rawHost.split(',')[0]!.trim() || req.headers?.host || `localhost:${fallbackPort}`;
+  return `${scheme}://${host}`;
+}