@abide/abide 0.38.1 → 0.39.0

package/AGENTS.md

@@ -69,7 +69,7 @@ Test suites compile `.abide` and rewrite verbs under `bun test` via `preload = [
 
 ### RPC verbs — @documentation rpc
 
-- `abide/server/GET`, `abide/server/POST`, `abide/server/PUT`, `abide/server/PATCH`, `abide/server/DELETE`, `abide/server/HEAD` — declare a verb: `VERB(handler, opts?)`; the preload rewrites each to `defineVerb(method, url, …)` (server) or `remoteProxy` (client). `opts`: `inputSchema`, `outputSchema`, `filesSchema`, `clients`, `crossOrigin`, `maxBodySize`, `timeout`. The returned function is callable in-process and exposes `.raw(args)` (the `Response`), `.stream(args)` (frame iterable), and `.fetch(request)` (router entry).
+- `abide/server/GET`, `abide/server/POST`, `abide/server/PUT`, `abide/server/PATCH`, `abide/server/DELETE`, `abide/server/HEAD` — declare a verb: `VERB(handler, opts?)`; the preload rewrites each to `defineVerb(method, url, …)` (server) or `remoteProxy` (client). `opts`: `inputSchema`, `outputSchema`, `filesSchema`, `clients`, `crossOrigin`, `maxBodySize`, `timeout`. The returned function is callable in-process as `fn(args, callOpts?)` and exposes `.raw(args, callOpts?)` (the `Response`), `.stream(args)` (frame iterable), and `.fetch(request)` (router entry). `callOpts` is a curated `Pick` of `RequestInit` for per-call transport — `signal`, `keepalive`, `priority`, `cache`, `headers` — that the server handler never sees, so the call stays isomorphic: `signal` merges with the scope abort + client timeout (`AbortSignal.any`, ignored under `cache()`), and `headers` merge onto the framework headers with `traceparent`/offline/`content-type` winning.
 - `abide/server/rpc/defineVerb` — the rewrite target the verb helpers expand to: validates args against `inputSchema` (422 on issues), enforces `timeout` (504 + abort), and registers the verb for MCP/CLI/OpenAPI/inspector discovery.
 
 ### Responses — @documentation response
@@ -162,7 +162,7 @@ Test suites compile `.abide` and rewrite verbs under `bun test` via `preload = [
 - `abide/ui/enterScope`, `abide/ui/exitScope` — push/pop the lexical scope around an SSR render.
 - `abide/ui/router`, `abide/ui/startClient`, `abide/ui/renderToStream` — the client router, the official client entry (reads `window.__SSR__`, seeds cache, starts the router), and the out-of-order SSR streamer.
 - `abide/ui/remoteProxy`, `abide/ui/socketProxy` — the bundler-emitted client substitutes that swap a server verb/socket import for a `fetch` proxy / ws-multiplexed `Socket`.
-- `abide/ui/dom/*` — the compiled-template DOM runtime (one node-builder per construct): `mount`, `mountChild`, `mountSlot`, `outlet`, `hydrate`, `skeleton`, `cloneStatic`, `anchorCursor`, `text`, `appendText`, `appendTextAt`, `appendSnippet`, `appendStatic`, `attr`, `on`, `attach`, `each`, `eachAsync`, `when`, `awaitBlock`, `tryBlock`, `switchBlock`, `applyResolved`. `outlet` is the marker-range a layout `<slot/>` compiles to (no wrapper element — the router fills it with the next chain layer as a direct child).
+- `abide/ui/dom/*` — the compiled-template DOM runtime (one node-builder per construct): `mount`, `mountChild`, `mergeProps`, `spreadProps`, `restProps`, `spreadAttrs`, `readCall`, `mountSlot`, `outlet`, `hydrate`, `skeleton`, `cloneStatic`, `anchorCursor`, `text`, `appendText`, `appendTextAt`, `appendSnippet`, `appendStatic`, `attr`, `on`, `attach`, `each`, `eachAsync`, `when`, `awaitBlock`, `tryBlock`, `switchBlock`, `applyResolved`. `outlet` is the marker-range a layout `<slot/>` compiles to (no wrapper element — the router fills it with the next chain layer as a direct child). `readCall` guards a method call lowered onto a reactive-doc read (`model.draft.trim()` → `readCall(model.read("draft"), …)`) so a nullish read throws naming the scope path and member, not the engine's opaque `undefined is not an object`. A `{...expr}` spreads onto a component (its props, via `mergeProps`/`spreadProps`) or a native element (its attributes, via `spreadAttrs` — each key reactive, an `on<event>` function becomes a listener); keys resolve last-wins in source order. A component reads the props it doesn't name with `const { foo, ...rest } = props()` — `rest` (a `restProps` bag of the unconsumed props) can itself be spread onward (`<input {...rest}/>`).
 - `abide/ui/runtime/*` — render-pass helpers: `escapeKey` (JSON-Pointer key escaping), `nextBlockId`, `enterRenderPass`, `exitRenderPass`.
 
 ## Build / tooling — @documentation building
@@ -171,7 +171,7 @@ Test suites compile `.abide` and rewrite verbs under `bun test` via `preload = [
 - `abide/compile` — `compile({ cwd?, target?, outfile?, buildClient? })`: produce a standalone Bun server executable (bytecode, embedded compressed assets).
 - `abide/preload` — the Bun preload (`bunfig.toml`) that installs the `.abide`, resolver, and CSS-noop plugins and rewrites verb/socket imports.
 - `abide/resolver-plugin` — `abideResolverPlugin({ cwd?, embedAssets?, target? })`: virtualizes every generated module and rewrites verbs/sockets per side.
-- `abide/ui-plugin` — `abideUiPlugin`: the Bun loader compiling `.abide` SFCs to ES modules (scoped `<style>` via virtual imports; `layout.abide` → `<abide-outlet>`).
+- `abide/ui-plugin` — `abideUiPlugin`: the Bun loader compiling `.abide` SFCs to ES modules (scoped `<style>` via virtual imports; a `layout.abide`'s `<slot/>` lowers to the marker-range `outlet` the router fills as a direct child, no wrapper element).
 - `abide/tsconfig` — `tsconfig.app.json` for consumers to extend (`bundler` resolution, `strict`, `noEmit`, `bun` types).
 
 ## Desktop bundle — @documentation bundle

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # abide
 
+## 0.39.0
+
+### Minor Changes
+
+- [`ae15b27`](https://github.com/briancray/abide/commit/ae15b2733c3c569b9bde9e4d79f9b768836b3a46) - async SSR render with inline nested-blocking awaits and spread/rest props ([`514a796`](https://github.com/briancray/abide/commit/514a796833c5be4caa296b295d63fda6c8452a36))
+
+- [`527795d`](https://github.com/briancray/abide/commit/527795d1035f7cb169723a03571603a9ce8556e1) - Remote functions now accept an optional trailing options bag — `fn(args, opts)` — for per-call transport control: `signal`, `keepalive`, `priority`, `cache`, and `headers`. It's a curated `Pick` of `RequestInit`, not a raw passthrough: the server handler never observes these, so the call stays isomorphic, and a caller can't clobber the method, body, or framework headers the RPC contract owns. `opts.signal` merges with the scope abort and client timeout (`AbortSignal.any`) rather than replacing them, and is ignored under `cache()` so one reader can't abort a coalesced flight the others share. `opts.headers` merge onto abide's headers with the framework winning — a caller adds transport metadata (idempotency-key, authorization) but can't overwrite `traceparent`, the offline marker, or `content-type`.
+
+### Patch Changes
+
+- [`ae15b27`](https://github.com/briancray/abide/commit/ae15b2733c3c569b9bde9e4d79f9b768836b3a46) - harden client router, asset serving, sockets, and runtime edge cases ([`4735920`](https://github.com/briancray/abide/commit/4735920edea942dcd2954c522673b0c8af5a9a7f))
+
+- [`ae15b27`](https://github.com/briancray/abide/commit/ae15b2733c3c569b9bde9e4d79f9b768836b3a46) - consolidate escapeHtml and safeJsonForScript into shared/ ([`ae2d602`](https://github.com/briancray/abide/commit/ae2d6022f6dc23994164d1764bf5b812b136e383))
+
+- [`76a4a19`](https://github.com/briancray/abide/commit/76a4a19048fd5373b0d3ed75f2c6de017e33c7a3) - Make reactive errors and stack traces read in authored terms. A method call lowered onto a reactive-doc read now routes through a guard (`readCall`) that throws naming the scope path and member (`cannot call .close() — scope value "modal" is undefined`) instead of the engine's opaque `undefined is not an object`. The client build's source maps ignore-list abide's own framework sources, so a debugger collapses the mount-stack wall (`scope`/`mountRange`/`runNode`/…) and shows only authored `.abide`/`.ts` frames. Reactive bindings emit named thunks (`attr_title`/`text`/`bind_value`) so those surviving frames carry a name instead of `(anonymous)`.
+
 ## 0.38.1
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@abide/abide",
-    "version": "0.38.1",
+    "version": "0.39.0",
     "type": "module",
     "sideEffects": false,
     "description": "Isomorphic multimodal HTTP framework built for humans and machines in a single Bun runtime",
@@ -79,6 +79,11 @@
         "./ui/outbox": "./src/lib/ui/outbox.ts",
         "./ui/dom/mount": "./src/lib/ui/dom/mount.ts",
         "./ui/dom/mountChild": "./src/lib/ui/dom/mountChild.ts",
+        "./ui/dom/mergeProps": "./src/lib/ui/dom/mergeProps.ts",
+        "./ui/dom/spreadProps": "./src/lib/ui/dom/spreadProps.ts",
+        "./ui/dom/restProps": "./src/lib/ui/dom/restProps.ts",
+        "./ui/dom/spreadAttrs": "./src/lib/ui/dom/spreadAttrs.ts",
+        "./ui/dom/readCall": "./src/lib/ui/dom/readCall.ts",
         "./ui/dom/hydrate": "./src/lib/ui/dom/hydrate.ts",
         "./ui/dom/text": "./src/lib/ui/dom/text.ts",
         "./ui/dom/appendText": "./src/lib/ui/dom/appendText.ts",
@@ -127,6 +132,9 @@
         "./ui/socketProxy": "./src/lib/ui/socketProxy.ts",
         "./server/prompts/renderPromptTemplate": "./src/lib/server/prompts/renderPromptTemplate.ts"
     },
+    "scripts": {
+        "test": "bun test ./tests"
+    },
     "bin": {
         "abide": "./bin/abide.ts"
     },

package/src/build.ts

@@ -1,6 +1,7 @@
 import { clientBuildPlugins } from './clientBuildPlugins.ts'
 import { abideLog } from './lib/shared/abideLog.ts'
 import { exitOnBuildFailure } from './lib/shared/exitOnBuildFailure.ts'
+import { markFrameworkSourcesIgnored } from './lib/shared/markFrameworkSourcesIgnored.ts'
 
 const CLIENT_ENTRY = new URL('./clientEntry.ts', import.meta.url).pathname
 
@@ -97,6 +98,19 @@ export async function build({
             return false
         }
 
+        /* Ignore-list abide's own framework sources in every emitted map, so a debugger
+           collapses the mount-stack wall (scope/mountRange/runNode/…) and a stack trace
+           shows only authored `.abide`/`.ts` frames. Runs before the gzip step so the
+           `.gz` siblings compress the updated maps. */
+        await Promise.all(
+            result.outputs
+                .filter((output) => output.kind === 'sourcemap')
+                .map(async (output) => {
+                    const map = await Bun.file(output.path).json()
+                    await Bun.write(output.path, JSON.stringify(markFrameworkSourcesIgnored(map)))
+                }),
+        )
+
         // Dev skips the gzip siblings (paths still point into stagingDir here).
         const compressedBytes = compress
             ? (

package/src/lib/bundle/exitWithParent.ts

@@ -10,10 +10,12 @@ the var is absent (standalone `abide start`).
 */
 export function exitWithParent(): void {
     const parent = process.env.ABIDE_PARENT_PID
-    if (!parent) {
+    const parentPid = Number(parent)
+    /* A non-numeric value is truthy but coerces to NaN; without the integer guard
+       process.kill(NaN, 0) throws on the first tick and exits a healthy server. */
+    if (!parent || !Number.isInteger(parentPid)) {
         return
     }
-    const parentPid = Number(parent)
     const timer = setInterval(() => {
         try {
             // Signal 0 sends nothing — it only probes existence, throwing when the

package/src/lib/server/rpc/readBodyWithinLimit.ts

@@ -40,5 +40,8 @@ export async function readBodyWithinLimit(request: Request, maxBytes: number): P
         method: request.method,
         headers: request.headers,
         body: buffered,
+        /* Carry the inbound signal forward so a handler reading `request().signal` still
+           aborts on client disconnect — a fresh Request would otherwise drop it. */
+        signal: request.signal,
     })
 }

package/src/lib/server/runtime/createAppAssetServer.ts

@@ -34,13 +34,19 @@ export async function createAppAssetServer({
 }): Promise<(req: Request, url: URL) => Promise<Response>> {
     // Per-pathname asset header bundles, hashed-chunk-aware Cache-Control.
     const headersForAsset = createAssetHeaderCache(cacheControlForAsset)
-    const diskGzipPaths = assets
+    /* Boot snapshot of every disk `_app` path, mirroring createPublicAssetServer: the
+       header cache keys on (request-controlled) pathnames, so building bundles for junk
+       `/_app/*` probes would grow it without bound. A rebuild restarts the server (same
+       restart `bun --watch` triggers on a code change), re-snapshotting. */
+    const diskPaths = assets
         ? new Set<string>()
-        : await globToPathSet(
-              `${distDir}/_app`,
-              '**/*.gz',
-              (file) => `/_app/${file.replace(/\.gz$/, '')}`,
-          )
+        : await globToPathSet(`${distDir}/_app`, '**/*', (file) => `/_app/${file}`)
+    /* Derive the precompressed `.gz` sibling set from the single tree scan (it already
+       includes the `.gz` files) — a gzip-capable client gets those bytes without
+       on-the-fly compression. Keyed by the base path (the `.gz` suffix stripped). */
+    const diskGzipPaths = new Set(
+        [...diskPaths].filter((path) => path.endsWith('.gz')).map((path) => path.slice(0, -3)),
+    )
 
     return async function serveAppAsset(req, url) {
         if (containsTraversal(req.url)) {
@@ -49,8 +55,20 @@ export async function createAppAssetServer({
                 headers: { 'Content-Type': TEXT_PLAIN, 'Cache-Control': NO_STORE },
             })
         }
+        /* Embed map and gzip Set hold decoded filesystem names; url.pathname stays
+           percent-encoded — decode so a chunk/asset with a non-ASCII name matches and
+           Bun.file opens the real path, not a literal `%xx` name. */
+        let assetPath: string
+        try {
+            assetPath = decodeURIComponent(url.pathname)
+        } catch {
+            return new Response('Not Found', {
+                status: 404,
+                headers: { 'Content-Type': TEXT_PLAIN, 'Cache-Control': NO_STORE },
+            })
+        }
         if (assets) {
-            const compressed = assets[url.pathname]
+            const compressed = assets[assetPath]
             /* Miss-check before header work: the header cache keys on
                (request-controlled) pathnames, so building bundles for junk
                `/_app/*` probes would grow it without bound. */
@@ -63,12 +81,20 @@ export async function createAppAssetServer({
             return respondWithEmbeddedAsset(
                 compressed,
                 acceptsGzip(req),
-                headersForAsset(url.pathname),
+                headersForAsset(assetPath),
             )
         }
-        const { base: baseHeaders, gzip: gzipHeaders } = headersForAsset(url.pathname)
-        const diskPath = distDir + url.pathname
-        if (acceptsGzip(req) && diskGzipPaths.has(url.pathname)) {
+        /* Miss-check before header work so probes for non-existent chunks can't grow the
+           header cache (the embed branch above guards the same way). */
+        if (!diskPaths.has(assetPath)) {
+            return new Response('Not Found', {
+                status: 404,
+                headers: { 'Content-Type': TEXT_PLAIN, 'Cache-Control': NO_STORE },
+            })
+        }
+        const { base: baseHeaders, gzip: gzipHeaders } = headersForAsset(assetPath)
+        const diskPath = distDir + assetPath
+        if (acceptsGzip(req) && diskGzipPaths.has(assetPath)) {
             return new Response(Bun.file(`${diskPath}.gz`), { headers: gzipHeaders })
         }
         return new Response(Bun.file(diskPath), { headers: baseHeaders })

package/src/lib/server/runtime/createPublicAssetServer.ts

@@ -50,18 +50,27 @@ export async function createPublicAssetServer({
         if (containsTraversal(req.url)) {
             return undefined
         }
+        /* Both the embed map and the disk Set hold decoded filesystem names, but
+           url.pathname stays percent-encoded — decode it so a file whose name has a
+           space or non-ASCII char matches. A malformed escape can't name a real file. */
+        let assetPath: string
+        try {
+            assetPath = decodeURIComponent(url.pathname)
+        } catch {
+            return undefined
+        }
         if (publicAssets) {
-            const compressed = publicAssets[url.pathname]
+            const compressed = publicAssets[assetPath]
             if (!compressed) {
                 return undefined
             }
-            return respondWithEmbeddedAsset(compressed, acceptsGzip(req), headersFor(url.pathname))
+            return respondWithEmbeddedAsset(compressed, acceptsGzip(req), headersFor(assetPath))
         }
-        if (!diskPaths.has(url.pathname)) {
+        if (!diskPaths.has(assetPath)) {
             return undefined
         }
-        return new Response(Bun.file(publicDir + url.pathname), {
-            headers: headersFor(url.pathname).base,
+        return new Response(Bun.file(publicDir + assetPath), {
+            headers: headersFor(assetPath).base,
         })
     }
 }

package/src/lib/server/runtime/createUiPageRenderer.ts

@@ -3,16 +3,17 @@ import { SSR_CACHE_CONTROL } from '../../shared/CACHE_CONTROL_VALUES.ts'
 import { formatTraceparent } from '../../shared/formatTraceparent.ts'
 import { isReplayableMethod } from '../../shared/isReplayableMethod.ts'
 import { layoutChainForRoute } from '../../shared/layoutChainForRoute.ts'
+import { safeJsonForScript } from '../../shared/safeJsonForScript.ts'
 import type { CacheEntry } from '../../shared/types/CacheEntry.ts'
 import type { CacheSnapshotEntry } from '../../shared/types/CacheSnapshotEntry.ts'
 import type { StreamedResolution } from '../../shared/types/StreamedResolution.ts'
 import { renderChain } from '../../ui/renderChain.ts'
 import { renderToStream } from '../../ui/renderToStream.ts'
+import { resumeSeedScript } from '../../ui/resumeSeedScript.ts'
 import type { UiComponent } from '../../ui/runtime/types/UiComponent.ts'
 import { pageUrlFromStore } from './pageUrlFromStore.ts'
 import { SSR_SWAP_SCRIPT } from './SSR_SWAP_SCRIPT.ts'
 import { STREAMED_HTML_HEADER } from './STREAMED_HTML_HEADER.ts'
-import { safeJsonForScript } from './safeJsonForScript.ts'
 import { serializeCacheSnapshot } from './serializeCacheSnapshot.ts'
 import { streamCacheResolutions } from './streamCacheResolutions.ts'
 import type { RequestStore } from './types/RequestStore.ts'
@@ -33,11 +34,11 @@ function wantsJson(request: Request): boolean {
 const CACHE_RESOLVE_SCRIPT =
     'window.__abideResolve=function(r){(window.__abideResumeCache=window.__abideResumeCache||[]).push(r)}'
 
-/* One streamed cache resolution as an inline `__abideResolve(...)` call. `<` is escaped
-   (as in encodeResume) so a body value can't close the script early. */
+/* One streamed cache resolution as an inline `__abideResolve(...)` call. Encoded via
+   safeJsonForScript so `<`, `-->`, and U+2028/U+2029 can't close the script early or
+   parse as line terminators — the same escaping the page's other inline scripts use. */
 function resolveChunk(resolution: StreamedResolution): string {
-    const payload = JSON.stringify(resolution).replace(/</g, '\\u003c')
-    return `<script>__abideResolve(${payload})</script>`
+    return `<script>__abideResolve(${safeJsonForScript(resolution)})</script>`
 }
 
 /*
@@ -168,19 +169,21 @@ export function createUiPageRenderer({
             ...chainKeys.map((key) => layouts[key]?.().then((module) => module.default)),
             loadPage().then((module) => module.default),
         ])
-        const ssr = renderChain(
+        const ssr = await renderChain(
             views.filter((view): view is UiComponent => view !== undefined),
             params,
         )
 
-        /* Snapshot the cache settled by render-return — top-level `await` reads (render
-           blocked on them) — into __SSR__. A `{#await}` read is NOT here: its expression
-           is a thunk `renderToStream` runs lazily, so its entry is created mid-stream and
-           seeded after the drain (see below). */
+        /* Snapshot the cache settled by render-return — top-level `await` reads and blocking
+           `{#await … then}` reads (the async render awaited them inline) — into __SSR__. A
+           STREAMING `{#await}` read is NOT here: its expression is a thunk `renderToStream`
+           runs lazily, so its entry is created mid-stream and seeded after the drain (below). */
         const inline = await serializeCacheSnapshot(store.cache)
         const inlinedKeys = new Set(inline.map((entry) => entry.key))
 
-        /* No await blocks → render synchronously, ship buffered. */
+        /* No STREAMING await blocks → ship buffered. Blocking `{#await … then}` blocks
+           rendered inline (their markup is already in `ssr.html`); seed their resolved
+           values so hydration adopts them without a refetch. */
         if (ssr.awaits.length === 0) {
             const html = injectRoutePreloads(
                 shell.replace(SSR_MARKER, (_match, key: string) =>
@@ -190,7 +193,7 @@ export function createUiPageRenderer({
             )
             const withState = html.replace(
                 '</body>',
-                `${await stateTag(routeUrl, params, store, inline)}</body>`,
+                `${resumeSeedScript(ssr.resume)}${await stateTag(routeUrl, params, store, inline)}</body>`,
             )
             return new Response(withState, {
                 headers: {
@@ -219,38 +222,46 @@ export function createUiPageRenderer({
         return new Response(
             new ReadableStream({
                 async start(controller) {
-                    controller.enqueue(encoder.encode(before ?? ''))
-                    let first = true
-                    for await (const chunk of renderToStream(() => ssr)) {
-                        controller.enqueue(
-                            encoder.encode(
-                                first ? chunk : `${chunk}<script>__abideSwap()</script>`,
-                            ),
+                    /* The shell `before` already flushed, so a mid-stream render rejection
+                       (a streaming `{#await}` with no `:catch`) can't become a 500 — surface it
+                       on the stream (`controller.error`) so the response terminates legibly
+                       instead of leaking an unhandledrejection (process-fatal under Bun). */
+                    try {
+                        controller.enqueue(encoder.encode(before ?? ''))
+                        let first = true
+                        for await (const chunk of renderToStream(() => ssr)) {
+                            controller.enqueue(
+                                encoder.encode(
+                                    first ? chunk : `${chunk}<script>__abideSwap()</script>`,
+                                ),
+                            )
+                            first = false
+                        }
+                        /* The {#await} reads created (and settled) their cache entries DURING the
+                           stream — the await expression is a thunk `renderToStream` ran lazily —
+                           so they missed the render-return snapshot. Drain them now: each lands an
+                           inline `__abideResolve(...)` chunk (a warm snapshot, or a `{ key, miss }`
+                           marker for an unshippable body → live refetch) before the deferred
+                           bundle, so startClient seeds the store and the block's subscription read
+                           is warm. Skip keys already shipped inline in __SSR__. */
+                        const streamedEntries = Array.from(store.cache.entries.values()).filter(
+                            (entry: CacheEntry) =>
+                                entry.settled === true &&
+                                entry.request !== undefined &&
+                                isReplayableMethod(entry.request.method.toUpperCase()) &&
+                                !inlinedKeys.has(entry.key),
                         )
-                        first = false
+                        for await (const resolution of streamCacheResolutions(
+                            store.cache,
+                            streamedEntries,
+                        )) {
+                            controller.enqueue(encoder.encode(resolveChunk(resolution)))
+                        }
+                        controller.enqueue(encoder.encode(after ?? ''))
+                        controller.close()
+                    } catch (streamError) {
+                        controller.error(streamError)
                     }
-                    /* The {#await} reads created (and settled) their cache entries DURING the
-                       stream — the await expression is a thunk `renderToStream` ran lazily —
-                       so they missed the render-return snapshot. Drain them now: each lands an
-                       inline `__abideResolve(...)` chunk (a warm snapshot, or a `{ key, miss }`
-                       marker for an unshippable body → live refetch) before the deferred
-                       bundle, so startClient seeds the store and the block's subscription read
-                       is warm. Skip keys already shipped inline in __SSR__. */
-                    const streamedEntries = Array.from(store.cache.entries.values()).filter(
-                        (entry: CacheEntry) =>
-                            entry.settled === true &&
-                            entry.request !== undefined &&
-                            isReplayableMethod(entry.request.method.toUpperCase()) &&
-                            !inlinedKeys.has(entry.key),
-                    )
-                    for await (const resolution of streamCacheResolutions(
-                        store.cache,
-                        streamedEntries,
-                    )) {
-                        controller.enqueue(encoder.encode(resolveChunk(resolution)))
-                    }
-                    controller.enqueue(encoder.encode(after ?? ''))
-                    controller.close()
                 },
             }),
             {

package/src/lib/server/runtime/internalErrorResponse.ts

@@ -1,4 +1,5 @@
 import { NO_STORE } from '../../shared/CACHE_CONTROL_VALUES.ts'
+import { escapeHtml } from '../../shared/escapeHtml.ts'
 
 /*
 The framework's default 500 response. Shared by the per-request scope's catch
@@ -8,12 +9,14 @@ drift. Only reached when the app supplies no `handleError` hook.
 Secure by default: a bare `Internal Server Error` so paths, library versions,
 and message contents never leak to clients in production. The full stack is
 shown only under `abide dev` (ABIDE_DEV=1, the orchestrator's signal); the
-cause is logged server-side regardless.
+cause is logged server-side regardless. The stack is HTML-escaped because a
+thrown Error built from request-influenced input can carry markup that would
+otherwise execute in the dev browser when embedded in the `<pre>`.
 */
 export function internalErrorResponse(error: unknown): Response {
     const body =
         Bun.env.ABIDE_DEV === '1'
-            ? `<pre>${String((error as Error)?.stack ?? error)}</pre>`
+            ? `<pre>${escapeHtml(String((error as Error)?.stack ?? error))}</pre>`
             : 'Internal Server Error'
     return new Response(body, {
         status: 500,

package/src/lib/server/runtime/snapshotEntryFromCache.ts

@@ -52,7 +52,10 @@ export async function snapshotEntryFromCache(
     if (!isTextual(contentType)) {
         return undefined
     }
-    const body = await response.text()
+    /* Read a CLONE, not the original: a reader that captured this same `entry.promise`
+       before the replacement below still holds `response` and may `.clone()` it — reading
+       the original here would lock its body and throw "Body already used" for that reader. */
+    const body = await response.clone().text()
     entry.promise = Promise.resolve(
         new Response(body, {
             status: response.status,

package/src/lib/server/sockets/createSocketDispatcher.ts

@@ -152,6 +152,13 @@ export function createSocketDispatcher(sockets: SocketRoutes): SocketDispatcher
             return fail(resolution.message)
         }
         const { entry } = resolution
+        /* A client reusing a live `sub` id rebinds it: drop the prior binding first (and
+           unsubscribe its topic if that was the last local sub) so the old socket's Set
+           doesn't retain the id forever, leaking the topic subscription. */
+        const rebound = removeSub(state, frame.sub)
+        if (rebound) {
+            ws.unsubscribe(`socket:${rebound}`)
+        }
         const isFirstLocalSub = addSub(state, frame.socket, frame.sub)
         if (isFirstLocalSub) {
             ws.subscribe(`socket:${frame.socket}`)

package/src/lib/shared/createRemoteFunction.ts

@@ -8,6 +8,7 @@ import type { ClientFlags } from './types/ClientFlags.ts'
 import type { HttpVerb } from './types/HttpVerb.ts'
 import type { RawRemoteFunction } from './types/RawRemoteFunction.ts'
 import type { RemoteFunction } from './types/RemoteFunction.ts'
+import type { RpcOptions } from './types/RpcOptions.ts'
 import type { Subscribable } from './types/Subscribable.ts'
 
 /*
@@ -39,8 +40,12 @@ export function createRemoteFunction<Args, Return>(opts: {
     clients: ClientFlags
     /* Server-side only: exempts a mutating verb from the router's same-origin CSRF gate. */
     crossOrigin?: boolean
-    buildRequest: (args: Args | undefined) => Request
-    invoke: (args: Args | undefined, getRequest: () => Request) => Promise<Response>
+    buildRequest: (args: Args | undefined, opts?: RpcOptions) => Request
+    invoke: (
+        args: Args | undefined,
+        getRequest: () => Request,
+        opts?: RpcOptions,
+    ) => Promise<Response>
     parseArgsForFetch?: (request: Request) => Promise<Args | undefined>
 }): RemoteFunction<Args, Return> {
     const { method, url, clients, crossOrigin, buildRequest, invoke, parseArgsForFetch } = opts
@@ -52,15 +57,19 @@ export function createRemoteFunction<Args, Return>(opts: {
     short-circuits to the prebuilt one — and caches the result so the
     client invoke + the cache meta reader share a single Request.
     */
-    function dispatch(args: Args | undefined, prebuilt?: Request): Promise<Response> {
+    function dispatch(
+        args: Args | undefined,
+        opts?: RpcOptions,
+        prebuilt?: Request,
+    ): Promise<Response> {
         let cached = prebuilt
         function getRequest(): Request {
             if (cached === undefined) {
-                cached = buildRequest(args)
+                cached = buildRequest(args, opts)
             }
             return cached
         }
-        const promise = invoke(args, getRequest)
+        const promise = invoke(args, getRequest, opts)
         recordRemoteMeta(promise, getRequest)
         return promise
     }
@@ -72,8 +81,8 @@ export function createRemoteFunction<Args, Return>(opts: {
     contained type lie — buildRpcRequest's `instanceof FormData` branch handles
     it at runtime.
     */
-    function rawCall(args: Args | FormData): Promise<Response> {
-        return dispatch(args as Args)
+    function rawCall(args: Args | FormData, opts?: RpcOptions): Promise<Response> {
+        return dispatch(args as Args, opts)
     }
     rawCall.method = method
     rawCall.url = url
@@ -81,8 +90,8 @@ export function createRemoteFunction<Args, Return>(opts: {
     Object.defineProperty(rawCall, REMOTE_FUNCTION, { value: true })
     const raw = rawCall as RawRemoteFunction<Args>
 
-    function callable(args: Args | FormData): Promise<Return> {
-        return raw(args).then(decodeResponse) as Promise<Return>
+    function callable(args: Args | FormData, opts?: RpcOptions): Promise<Return> {
+        return raw(args, opts).then(decodeResponse) as Promise<Return>
     }
     callable.method = method
     callable.url = url
@@ -113,10 +122,10 @@ export function createRemoteFunction<Args, Return>(opts: {
                   }
                   throw error
               }
-              return dispatch(args, request)
+              return dispatch(args, undefined, request)
           }
         : (request: Request): Promise<Response> => {
-              return dispatch(undefined, request)
+              return dispatch(undefined, undefined, request)
           }
     return callable as RemoteFunction<Args, Return>
 }

package/src/lib/shared/escapeHtml.ts

@@ -0,0 +1,15 @@
+/*
+HTML-escapes the five HTML-significant characters — the same set the runtime
+`$esc` handles. Isomorphic: shared by the build-time SSR/static-clone generators
+(so server markup and the client clone template can't diverge on escaping) and
+the server runtime's dev error page. Static text reaches the compile callers
+already entity-decoded (see parseTemplate), so escaping round-trips it through
+the HTML parser to the same plain text the client would build directly.
+*/
+export function escapeHtml(value: string): string {
+    return value.replace(
+        /[&<>"']/g,
+        (char) =>
+            ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[char] ?? char,
+    )
+}

package/src/lib/shared/markFrameworkSourcesIgnored.ts

@@ -0,0 +1,47 @@
+import type { SourceMap } from './types/SourceMap.ts'
+
+/*
+The path fragment that identifies abide's own framework sources in a source map.
+The mount stack's "wall" — `scope`, `withScope`, `mountRange`, `runNode`,
+`createEffectNode`, … — all live under the package's `src/lib/`; an author's
+`.abide`/`.ts` frames never do. Matched as the contiguous directory + lib path
+(not the npm name `@abide/abide`, which differs from the on-disk dir `abide`), so
+it holds across the monorepo (`packages/abide/src/lib/`) and an install
+(`node_modules/@abide/abide/src/lib/`) alike, while a user app dir like
+`my-abide-app/src/lib/` does not match.
+
+DERIVED from THIS module's own location (`…/<pkgDir>/src/lib/shared/…`) rather than
+hardcoded, so it tracks a package-dir rename instead of silently going stale (an
+empty ignore-list = the mount-stack wall reappears, which no test would catch). Falls
+back to the literal if the expected `/src/lib/` layout is ever absent.
+*/
+const FRAMEWORK_LIB_PATH = ((): string => {
+    const LIB_MARKER = '/src/lib/'
+    const here = new URL(import.meta.url).pathname
+    const libIndex = here.indexOf(LIB_MARKER)
+    if (libIndex === -1) {
+        return 'abide/src/lib/'
+    }
+    const beforeLib = here.slice(0, libIndex)
+    const packageDir = beforeLib.slice(beforeLib.lastIndexOf('/') + 1)
+    return `${packageDir}${LIB_MARKER}`
+})()
+
+/*
+Marks every abide-framework source in a parsed source map as ignore-listed, so a
+debugger collapses framework frames and a stack trace shows only authored ones —
+the fix for the long mount-stack wall, applied without touching the runtime. Sets
+both the standardized `ignoreList` and Chrome's legacy `x_google_ignoreList` for
+the widest debugger support. Mutates and returns the same map.
+*/
+export function markFrameworkSourcesIgnored(map: SourceMap): SourceMap {
+    const ignored = (map.sources ?? []).reduce<number[]>((indices, source, index) => {
+        if (source !== null && source.includes(FRAMEWORK_LIB_PATH)) {
+            indices.push(index)
+        }
+        return indices
+    }, [])
+    map.ignoreList = ignored
+    map.x_google_ignoreList = ignored
+    return map
+}

package/src/lib/shared/streamResponse.ts

@@ -122,6 +122,11 @@ async function* parseSse<T>(response: Response): AsyncGenerator<T> {
         if (errorMessage !== undefined) {
             throw new Error(errorMessage)
         }
+        /* A frame with an empty `data:` value (a keepalive) carries no payload — skip it
+           rather than letting JSON.parse('') throw and tear down the whole iteration. */
+        if (frame.data === '') {
+            continue
+        }
         yield JSON.parse(frame.data) as T
     }
 }
@@ -157,7 +162,9 @@ consumer loops can react to mid-stream failure.
 */
 async function* parseJsonLines<T>(response: Response): AsyncGenerator<T> {
     for await (const raw of frameReader(response, '\n')) {
-        if (raw.length === 0) {
+        /* Skip blank lines: a CRLF stream yields a lone `\r` (non-zero length) between
+           records, and JSON.parse('\r') would throw and tear down the whole iteration. */
+        if (raw.trim().length === 0) {
             continue
         }
         const parsed = JSON.parse(raw)