AkurAI-Build

Latest change 1c2159692a31765cd66ed709791ba11468054873 - Initial commit: bunfork v0.1.0 source tree by Olafur Bui

Pass 5 conclusion: `bunfork-static-v1` can honestly host official Vue/Vite browser builds and Nuxt `generate` artifacts only as validated, prebuilt static files. It cannot claim Vue/Vite/Nuxt source, build, SSR, Nitro, or adapter compatibility.

Reports 01–04 establish the same boundary: Bunfork is not a JS runtime or framework compiler, and current serving is coupled to SQLCipher, MiniJinja pages, and `/assets` ([docs/adversarial/01-product-truth.md](/home/olafurbui/bunfork/docs/adversarial/01-product-truth.md), [src/server.rs](/home/olafurbui/bunfork/src/server.rs:153), [src/main.rs](/home/olafurbui/bunfork/src/main.rs:213)).

### Admission contract

Admit only an immutable directory plus:

```json
{
  "format": "bunfork-static-v1",
  "mode": "mpa | spa",
  "base": "/",
  "fallback": null,
  "trailing_slash": "ignore | redirect | directory",
  "precompressed": true
}
```

Require:

- regular files only; reject symlinks, devices, hidden path segments, traversal, malformed encodings, and paths escaping the root;
- explicit `base`, normalized to `/foo/`; reject requests outside it;
- browser JS, CSS, WASM, images, fonts, JSON, source maps, and HTML are copied byte-for-byte and never executed or rewritten;
- verified digest manifest before binding;
- Vue SFCs and Vite/Nuxt configuration are never accepted as runtime input.

Vue SFCs require compiler transforms for script, template, scoped styles, virtual modules, and HMR ([.refrepos/vue/packages/compiler-sfc/README.md](/home/olafurbui/bunfork/.refrepos/vue/packages/compiler-sfc/README.md:1)). Vite’s production output is the admissible boundary: `vite build` emits a static-hostable bundle ([.refrepos/vite/docs/guide/build.md](/home/olafurbui/bunfork/.refrepos/vite/docs/guide/build.md:1)). Vite `public/` files are copied unchanged into the output root ([.refrepos/vite/docs/guide/assets.md](/home/olafurbui/bunfork/.refrepos/vite/docs/guide/assets.md:108)).

Nuxt admission is limited to `.output/public` from `nuxt generate` or `nuxt build --prerender`; Nuxt explicitly documents that directory as deployable to static hosting ([.refrepos/nuxt/docs/1.getting-started/15.prerendering.md](/home/olafurbui/bunfork/.refrepos/nuxt/docs/1.getting-started/15.prerendering.md:41)). Preserve `_payload.json`, generated HTML, public assets, and `200.html`/`404.html` when present.

### Routing rules

For `GET` and `HEAD` only:

1. Strip and validate `base`.
2. `/` maps to `index.html`.
3. `/x/` maps to `x/index.html`.
4. `/x` maps to `x/index.html` only in `directory` mode.
5. `redirect` mode canonicalizes instead of serving both forms.
6. Never infer `.html`.
7. Missing MPA routes return `404`, using explicit `404.html` if present.
8. SPA fallback applies only after ordinary lookup fails, only for navigation-like requests, and never for missing assets, source maps, JSON, or API-like paths.
9. `HEAD` matches `GET` status and headers without a body.
10. Other methods return `405` with `Allow: GET, HEAD`.

Nuxt’s `200.html` is specifically a success-status SPA fallback, while `404.html` preserves not-found behavior ([.refrepos/nuxt/docs/1.getting-started/15.prerendering.md](/home/olafurbui/bunfork/.refrepos/nuxt/docs/1.getting-started/15.prerendering.md:41)). Vite base paths rewrite generated asset URLs and may be relative (`./` or empty), so the manifest must make the deployment base explicit ([.refrepos/vite/docs/guide/build.md](/home/olafurbui/bunfork/.refrepos/vite/docs/guide/build.md:31)).

### Cache, compression, and CSP

- HTML, fallback, error documents: `Cache-Control: no-cache` or `no-store`.
- Content-addressed assets: `public, max-age=31536000, immutable`.
- Non-hashed assets: conservative revalidation.
- Prefer `.br`, then `.gz`, only when advertised; otherwise original. Always emit `Vary: Accept-Encoding`.
- Emit `ETag` from the artifact digest and stable `Content-Length`.
- Keep `nosniff`, frame denial, and restrictive referrer policy.
- CSP must be fixture-driven. Do not assume the current policy is sufficient: current Bunfork sends only `default-src 'self'`, with no `script-src` allowance ([src/server.rs](/home/olafurbui/bunfork/src/server.rs:484)). Static hosting must not inject inline scripts; fixtures requiring inline/eval must either ship a compatible CSP declaration or be rejected.

### Precise Nitro/SSR rejection

Reject `.output/server`, Nitro server bundles, `server/` API or middleware behavior, route rules involving `swr`, `isr`, redirects, CORS, headers, or `ssr: false`, and any artifact requiring runtime environment, cookies, request data, server storage, or `$fetch` server execution.

Nitro produces standalone runtime code and API routes in `.output`; that is executable server output, not static content ([.refrepos/nuxt/docs/3.guide/1.concepts/4.server-engine.md](/home/olafurbui/bunfork/.refrepos/nuxt/docs/3.guide/1.concepts/4.server-engine.md:50)). Nuxt route rules install server middleware and Nitro cache handlers ([.refrepos/nuxt/docs/3.guide/2.best-practices/performance.md](/home/olafurbui/bunfork/.refrepos/nuxt/docs/3.guide/2.best-practices/performance.md:47)). Vite SSR similarly requires a server entry and an SSR build loaded by `import()` ([.refrepos/vite/docs/guide/ssr.md](/home/olafurbui/bunfork/.refrepos/vite/docs/guide/ssr.md:168)). Bunfork must reject these before startup, not serve them accidentally.

### Current Bunfork verdict

Not admitted today. It requires database/key/token startup, scans MiniJinja pages, hard-wires `/assets`, lacks file-index lookup, SPA fallback, base handling, artifact cache policy, and static manifest verification ([src/main.rs](/home/olafurbui/bunfork/src/main.rs:205), [src/server.rs](/home/olafurbui/bunfork/src/server.rs:180)). Its current CSP and deployment format are also not `bunfork-static-v1`.

### Black-box fixtures

Use official builds:

- Vite Vue SPA: production `dist`, nested `base`, `public/robots.txt`, hashed assets, client-side `/about` route.
- Nuxt `generate`: `.output/public`, prerendered route, `_payload.json`, `200.html`, `404.html`, unlinked route, and a negative `server/api` fixture.
- Nuxt hybrid/Nitro negative: `.output/server`, API route, `routeRules` with `swr`/`isr`, redirect, and `ssr:false`.
- Vue SFC negative: unbuilt `.vue` with `<script setup>`, scoped CSS, and event handler.

Assert exact bytes, deep-link reloads, base rejection, fallback exclusion for assets, `GET`/`HEAD`/wrong methods, MIME, ETag, cache headers, compression, CSP/browser console, traversal rejection, and startup refusal for Nitro/SSR.

Differentiating operational feature: an admission report containing the digest manifest, route map, fallback decision, cache class, compression variants, and rejection findings; verify it at startup for tamper-evident promotion and rollback.