Deployment

tavo build emits two provider-neutral deployment outputs. Treat .tavo/build as generated output and rebuild it after every application change.

text.tavo/build/client/              static assets and prerendered HTML
.tavo/build/server/start.mjs       generated Node production server

Static hosting can serve CSR and prerendered output but cannot run server loaders, route actions, or sessions. Run the generated Node server when the application needs request-time behavior.

bashnpx tavo build
PORT=4174 node .tavo/build/server/start.mjs

Business logic stays in route modules and server-only application services. Core 1.0 publishes static and Node deployment outputs.

• Rebuild after every source change.

• Publish .tavo/build/client to a static host or run .tavo/build/server/start.mjs with Node.

• Configure trusted hosts, canonical origin, CSP, secrets, and monitor authentication.

• Exercise a real SSR request, a client navigation, an action, and an error response.

• Inspect generated route sizes and enforce budgets in CI.

text.tavo/build/client/
  static assets and prerendered HTML
.tavo/build/server/start.mjs
  generated Node production server

tavo build creates both provider-neutral outputs, discovers routes, generates route types, and attempts eligible prerenders. Invalid bundles or JavaScript budget violations fail the command.

• GET and HEAD render pages. Other methods dispatch a matching route action.

• A non-page method without a matching action returns 405 with Allow: GET, HEAD.

• The Node handler rejects bodies larger than maxRequestBodyBytes with 413; the default is 10 MiB.

• Uncaught route, plugin, and handler failures return a hardened generic 500 response rather than exposing an exception.

• canonicalOrigin must be a credential-free HTTP(S) origin with no path, query, or hash; invalid input throws TAVO_SSR_001.

• Page and action responses receive baseline security headers. Add deployment-specific CSP and proxy policy at the platform boundary.

• Node client disconnects abort request-owned work; streaming responses also cancel their active reader.