Deployment

tavo build emits two provider-neutral deployment outputs. Treat .tavo/build as generated output and rebuild it after every application change.

text.tavo/build/client/              static assets and prerendered HTML
.tavo/build/server/start.mjs       generated Node production server

Static hosting serves CSR assets and the HTML created during prerendering. Build-time loaders have already run; server loaders, actions, sessions, image optimization, and revalidation cannot run on that host. Run the generated Node server when the application needs request-time behavior.

Configure the static host to serve existing prerendered HTML first and use the application index.html as the fallback for remaining client routes. Test a direct visit and refresh of a nested URL. A browser-only 404 view cannot change the HTTP status returned by a static host; configure the host separately if real 404 responses are required.

bashnpx tavo build
PORT=4174 node .tavo/build/server/start.mjs

Business logic stays in route modules and server-only application services. Core 1.0 publishes static and Node deployment outputs.

• Rebuild after every source change.

• Publish .tavo/build/client to a static host or run .tavo/build/server/start.mjs with Node.

• Configure trusted hosts, canonical origin, CSP, secrets, and monitor authentication.

• Exercise a real SSR request, a client navigation, an action, and an error response.

• Inspect generated route sizes and enforce budgets in CI.

text.tavo/build/client/
  static assets and prerendered HTML
.tavo/build/server/start.mjs
  generated Node production server

tavo build creates both provider-neutral outputs, discovers routes, generates route types, and attempts eligible prerenders. Invalid bundles or JavaScript budget violations fail the command.

• GET and HEAD render pages. Other methods dispatch a matching route action.

• A non-page method without a matching action returns 405 with Allow: GET, HEAD.

• The Node handler rejects bodies larger than maxRequestBodyBytes with 413; the default is 10 MiB.

• Uncaught route, plugin, and handler failures return a hardened generic 500 response rather than exposing an exception.

• canonicalOrigin must be a credential-free HTTP(S) origin with no path, query, or hash; invalid input throws TAVO_SSR_001.

• Page and action responses receive baseline security headers. Add deployment-specific CSP and proxy policy at the platform boundary.

• Node client disconnects abort request-owned work; streaming responses also cancel their active reader.