server

server chooses where the built application runs: a discriminated union keyed by adapter. meeko build writes output to .meeko/output/<adapter>/; the CLI's --adapter takes precedence over configuration. Without server, the adapter is node.

Since 1.7, server adapters (node, bun, deno and cloudflare) also accept contentSecurityPolicy and headers: they are fixed at build time, and the application applies them to every response, completing the CSP per response (hashes for prerendered pages, a nonce for SSR pages, hashes for SSR pages with cache and a closed policy for JSON).

Usage#

// meeko.config.ts
import { defineMeekoConfig } from "@meekojs/meeko/framework";

export default defineMeekoConfig({
  server: {
    adapter: "node",
    contentSecurityPolicy: {
      "default-src": ["'self'"],
      "script-src": ["'self'"],
      "style-src": ["'self'", "'unsafe-inline'"],
      "object-src": ["'none'"],
      "base-uri": ["'none'"],
      "frame-ancestors": ["'none'"],
    },
    headers: {
      "X-Content-Type-Options": "nosniff",
      "Referrer-Policy": "strict-origin-when-cross-origin",
      "/admin/*": { "X-Robots-Tag": "noindex" },
    },
  },
});

Type#

readonly server?: MeekoServerConfig

interface ServerResponseConfig {
	readonly contentSecurityPolicy?: ContentSecurityPolicy
	readonly headers?: ServerHeaders
}

type ServerHeaders = Readonly<Record<string, string | Readonly<Record<string, string>>>>

type StaticHeaderFile = '_headers' | 'nginx'

Options#

Shared by node, bun, deno and cloudflare (since 1.7)#

By adapter#

Result#

Per-response CSP for server adapters:

A header already present on the response (from Meeko, a handler or middleware) is not replaced, and a 304 never carries CSP.

Examples#

Cloudflare Workers with D1#

import { defineMeekoConfig } from "@meekojs/meeko/framework";

export default defineMeekoConfig({
  server: {
    adapter: "cloudflare",
    name: "mi-app",
    compatibilityDate: "2026-10-19",
    wrangler: {
      d1_databases: [{ binding: "DB", database_name: "mi-app", database_id: "<id>" }],
      vars: { MEEKO_PUBLIC_ORIGIN: "https://mi-app.example" },
    },
    headers: { "X-Content-Type-Options": "nosniff" },
  },
});

A static site for Netlify and nginx#

import { defineMeekoConfig } from "@meekojs/meeko/framework";

export default defineMeekoConfig({
  site: "https://example.com",
  server: {
    adapter: "static",
    headerFiles: ["_headers", "nginx"],
    contentSecurityPolicy: { "default-src": ["'self'"], "style-src": ["'self'", "'unsafe-inline'"], "object-src": ["'none'"] },
    headers: { "X-Content-Type-Options": "nosniff", "Referrer-Policy": "strict-origin-when-cross-origin" },
  },
});

The same project on multiple targets#

npx meeko build                     # server.adapter, or node
npx meeko build --adapter bun       # without changing configuration
npx meeko build --adapter static    # fails with SSR pages, API, RPC, Socket or server middleware

With --adapter, options from another server adapter do not apply: static over a node configuration builds without headerFiles.

Common mistakes#

An unknown adapter#

export default defineMeekoConfig({ server: { adapter: "vercel" } as never });

meeko dev, meeko build, meeko check and meeko routes stop with …/meeko.config.ts: server.adapter debe ser "node", "cloudflare", "deno", "bun" o "static".

import { defineMeekoConfig } from "@meekojs/meeko/framework";
export default defineMeekoConfig({ server: { adapter: "node" } });

CSP in headers#

server: { adapter: "node", headers: { "Content-Security-Policy": "default-src 'self'" } }

…/meeko.config.ts: server.headers no puede fijar Content-Security-Policy; use server.contentSecurityPolicy, que añade los hashes de los scripts. Written manually, the policy would lack the nonce and hashes and block Meeko's scripts.

server: { adapter: "node", contentSecurityPolicy: { "default-src": ["'self'"] } }

Route patterns with static#

server: { adapter: "static", headers: { "/admin/*": { "X-Robots-Tag": "noindex" } } }

…/meeko.config.ts: server.headers "/admin/*": el adaptador static aplica sus cabeceras a todas las rutas; los patrones de ruta necesitan un adaptador con servidor. headerFiles writes a single block for all routes.

server: { adapter: "static", headers: { "X-Robots-Tag": "noindex" } }

A pattern with text instead of headers#

server: { adapter: "node", headers: { "/docs/*": "max-age=60" } }

…/meeko.config.ts: server.headers "/docs/*" must be an object of header values.

server: { adapter: "node", headers: { "/docs/*": { "Cache-Control": "public, max-age=60" } } }

Unquoted CSP sources#

server: { adapter: "bun", contentSecurityPolicy: { "script-src": ["self ok"] } }

…/meeko.config.ts: server.contentSecurityPolicy: invalid source "self ok" in script-src.

server: { adapter: "bun", contentSecurityPolicy: { "script-src": ["'self'"] } }

Options from another adapter#

server: { adapter: "static", port: 3000 } as never

…/meeko.config.ts: server (static): campo desconocido port. With cloudflare, an invalid name gives server.name debe ser un nombre de Worker (minúsculas, dígitos y guiones), and with node, an out-of-range port gives server.port debe ser un entero entre 0 y 65535.

server: { adapter: "node", port: 3000 }

Notes#

• Security. Start with default-src 'self', object-src 'none', base-uri 'none' and frame-ancestors 'none'. Reserve 'unsafe-inline' for style-src if a highlighter writes style="…" attributes: Meeko does not add a nonce or hash to that directive to avoid overriding it. The JSON policy (default-src 'none') covers all of /api/ and RPC: an endpoint with contentType: "response" returning HTML must set its own Content-Security-Policy.
• Development. CSP only applies in production (meeko start, meeko preview and output builds); in meeko dev, Vite injects scripts without a nonce. headers does apply in meeko dev to responses handled by the application.
• Cookies and caches. A response with Set-Cookie and a public Cache-Control is sent as private, no-store without ETag, with or without these options.
• Environment variables. MEEKO_HOST, MEEKO_PORT and MEEKO_PUBLIC_ORIGIN are read at runtime, not at build time; server.host and server.port only apply to Node.
• Custom host. Options are transferred in the manifest (AppManifest.contentSecurityPolicy and AppManifest.headers); a host that creates its AppManifest manually passes them there. Since 1.8, the headers of addPublicFile travel separately, in AppManifest.publicFileHeaders, by the exact pathname of the file: the patterns of headers replace only the headers they set. This applies in production: in meeko dev, public files do not go through the application, so they carry only the headers of addPublicFile, and headers does not affect them.

Related#

• contentSecurityPolicyBuilds the Content-Security-Policy header from a directive-based policy and adds the hashes of a page's inline scripts and styles.
• serveNodeServes a Meeko application with Node's HTTP server, its Socket channels with ws, graceful shutdown on signals and the process failure policy.
• createBunServerThe fetch and websocket handlers for serving a Meeko application with Bun.serve, using Bun's native WebSocket for Socket and its payload, backpressure and idle limits.
• serveDenoServes a Meeko application with Deno.serve, with Socket over Deno.upgradeWebSocket, graceful shutdown on signals and the process failure policy.
• createWorkerServes a Meeko application from a Cloudflare module Worker, created once per isolate with its bindings, forwarding Socket upgrades to their room's Durable Object.
• meeko buildChecks the project and writes production output to .meeko/output/<adaptador>/, including the client, server and prerendered pages.
• Build, deployment and verificationMeeko as a full-stack framework
• CSP and headers in server adaptersMeeko as a full-stack framework
• Static siteMeeko as a full-stack framework
• Cloudflare WorkersMeeko as a full-stack framework