@abide/abide 0.38.1 → 0.40.0

package/AGENTS.md

@@ -69,7 +69,7 @@ Test suites compile `.abide` and rewrite verbs under `bun test` via `preload = [
 
 ### RPC verbs — @documentation rpc
 
-- `abide/server/GET`, `abide/server/POST`, `abide/server/PUT`, `abide/server/PATCH`, `abide/server/DELETE`, `abide/server/HEAD` — declare a verb: `VERB(handler, opts?)`; the preload rewrites each to `defineVerb(method, url, …)` (server) or `remoteProxy` (client). `opts`: `inputSchema`, `outputSchema`, `filesSchema`, `clients`, `crossOrigin`, `maxBodySize`, `timeout`. The returned function is callable in-process and exposes `.raw(args)` (the `Response`), `.stream(args)` (frame iterable), and `.fetch(request)` (router entry).
+- `abide/server/GET`, `abide/server/POST`, `abide/server/PUT`, `abide/server/PATCH`, `abide/server/DELETE`, `abide/server/HEAD` — declare a verb: `VERB(handler, opts?)`; the preload rewrites each to `defineVerb(method, url, …)` (server) or `remoteProxy` (client). `opts`: `inputSchema`, `outputSchema`, `filesSchema`, `clients`, `crossOrigin`, `maxBodySize`, `timeout`. The returned function is callable in-process as `fn(args, callOpts?)` and exposes `.raw(args, callOpts?)` (the `Response`), `.stream(args)` (frame iterable), and `.fetch(request)` (router entry). `callOpts` is a curated `Pick` of `RequestInit` for per-call transport — `signal`, `keepalive`, `priority`, `cache`, `headers` — that the server handler never sees, so the call stays isomorphic: `signal` merges with the scope abort + client timeout (`AbortSignal.any`, ignored under `cache()`), and `headers` merge onto the framework headers with `traceparent`/offline/`content-type` winning.
 - `abide/server/rpc/defineVerb` — the rewrite target the verb helpers expand to: validates args against `inputSchema` (422 on issues), enforces `timeout` (504 + abort), and registers the verb for MCP/CLI/OpenAPI/inspector discovery.
 
 ### Responses — @documentation response
@@ -142,7 +142,7 @@ Test suites compile `.abide` and rewrite verbs under `bun test` via `preload = [
 
 ### Reactive state — @documentation reactive-state
 
-- `abide/ui/scope` — `scope()`: the sole reactive surface. `.state(initial?, transform?)` (writable cell), `.computed(fn)` (read-only), `.linked(seed, transform?)` (local draft reseeded from upstream). Bare `state`/`computed`/`linked` are a compile error; a writable computed is expressed at the binding (`bind:value={{ get, set }}`). Also carries doc/persistence/undo/broadcast methods.
+- `abide/ui/scope` — `scope()`: the sole reactive surface. `.state(initial?, transform?)` (writable cell), `.computed(fn)` (read-only), `.linked(seed, transform?)` (local draft reseeded from upstream). Bare `state`/`computed`/`linked` are a compile error; a writable computed is expressed at the binding (`bind:value={{ get, set }}`). `.share(key, value)`/`.shared(key)` pass context down the tree (closest-ancestor lookup; the reactive doc itself doesn't inherit, so share a `cell` for reactive context). Also carries doc/persistence/undo/broadcast methods.
 
 ### Effect — @documentation effect
 
@@ -151,7 +151,7 @@ Test suites compile `.abide` and rewrite verbs under `bun test` via `preload = [
 ### Tail & navigate — @documentation tail · navigate
 
 - `abide/ui/tail` — `tail(subscribable)`: latest frame of a `Socket`/stream (reactive); window form `tail(s, { last })` → array; `tail.error`/`tail.status` probes.
-- `abide/ui/navigate` — `navigate(path, replace?)`: client navigation through the router.
+- `abide/ui/navigate` — `navigate(path, options?)`: client navigation through the router. `options` is `{ replace?, keepScroll? }` — `replace` swaps the current history entry, `keepScroll` preserves the live scroll offset across an in-page URL swap.
 
 ### Outbox — @documentation ui
 
@@ -162,7 +162,7 @@ Test suites compile `.abide` and rewrite verbs under `bun test` via `preload = [
 - `abide/ui/enterScope`, `abide/ui/exitScope` — push/pop the lexical scope around an SSR render.
 - `abide/ui/router`, `abide/ui/startClient`, `abide/ui/renderToStream` — the client router, the official client entry (reads `window.__SSR__`, seeds cache, starts the router), and the out-of-order SSR streamer.
 - `abide/ui/remoteProxy`, `abide/ui/socketProxy` — the bundler-emitted client substitutes that swap a server verb/socket import for a `fetch` proxy / ws-multiplexed `Socket`.
-- `abide/ui/dom/*` — the compiled-template DOM runtime (one node-builder per construct): `mount`, `mountChild`, `mountSlot`, `outlet`, `hydrate`, `skeleton`, `cloneStatic`, `anchorCursor`, `text`, `appendText`, `appendTextAt`, `appendSnippet`, `appendStatic`, `attr`, `on`, `attach`, `each`, `eachAsync`, `when`, `awaitBlock`, `tryBlock`, `switchBlock`, `applyResolved`. `outlet` is the marker-range a layout `<slot/>` compiles to (no wrapper element — the router fills it with the next chain layer as a direct child).
+- `abide/ui/dom/*` — the compiled-template DOM runtime (one node-builder per construct): `mount`, `mountChild`, `mergeProps`, `spreadProps`, `restProps`, `spreadAttrs`, `readCall`, `mountSlot`, `outlet`, `hydrate`, `skeleton`, `cloneStatic`, `anchorCursor`, `text`, `appendText`, `appendTextAt`, `appendSnippet`, `appendStatic`, `attr`, `on`, `attach`, `each`, `eachAsync`, `when`, `awaitBlock`, `tryBlock`, `switchBlock`, `applyResolved`. `outlet` is the marker-range a layout `<slot/>` compiles to (no wrapper element — the router fills it with the next chain layer as a direct child). `readCall` guards a method call lowered onto a reactive-doc read (`model.draft.trim()` → `readCall(model.read("draft"), …)`) so a nullish read throws naming the scope path and member, not the engine's opaque `undefined is not an object`. A `{...expr}` spreads onto a component (its props, via `mergeProps`/`spreadProps`) or a native element (its attributes, via `spreadAttrs` — each key reactive, an `on<event>` function becomes a listener); keys resolve last-wins in source order. A component reads the props it doesn't name with `const { foo, ...rest } = props()` — `rest` (a `restProps` bag of the unconsumed props) can itself be spread onward (`<input {...rest}/>`).
 - `abide/ui/runtime/*` — render-pass helpers: `escapeKey` (JSON-Pointer key escaping), `nextBlockId`, `enterRenderPass`, `exitRenderPass`.
 
 ## Build / tooling — @documentation building
@@ -171,7 +171,7 @@ Test suites compile `.abide` and rewrite verbs under `bun test` via `preload = [
 - `abide/compile` — `compile({ cwd?, target?, outfile?, buildClient? })`: produce a standalone Bun server executable (bytecode, embedded compressed assets).
 - `abide/preload` — the Bun preload (`bunfig.toml`) that installs the `.abide`, resolver, and CSS-noop plugins and rewrites verb/socket imports.
 - `abide/resolver-plugin` — `abideResolverPlugin({ cwd?, embedAssets?, target? })`: virtualizes every generated module and rewrites verbs/sockets per side.
-- `abide/ui-plugin` — `abideUiPlugin`: the Bun loader compiling `.abide` SFCs to ES modules (scoped `<style>` via virtual imports; `layout.abide` → `<abide-outlet>`).
+- `abide/ui-plugin` — `abideUiPlugin`: the Bun loader compiling `.abide` SFCs to ES modules (scoped `<style>` via virtual imports; a `layout.abide`'s `<slot/>` lowers to the marker-range `outlet` the router fills as a direct child, no wrapper element).
 - `abide/tsconfig` — `tsconfig.app.json` for consumers to extend (`bundler` resolution, `strict`, `noEmit`, `bun` types).
 
 ## Desktop bundle — @documentation bundle

package/CHANGELOG.md

@@ -1,5 +1,68 @@
 # abide
 
+## 0.40.0
+
+### Minor Changes
+
+- [`05ea7e2`](https://github.com/briancray/abide/commit/05ea7e235b1e7c035d3b4313e12fc83733fa814b) - <template elseif> conditional chains ([`c3237cc`](https://github.com/briancray/abide/commit/c3237ccc0d222c36e8b00ce68595eb92609ef856))
+
+- [`15c0ad3`](https://github.com/briancray/abide/commit/15c0ad334f698dfb49a9dcd0e0361925afc4f6c8) - `navigate` takes an options object — `navigate(path, { replace?, keepScroll? })` — replacing the old `navigate(path, replace?)` boolean. **Breaking:** a caller passing a boolean (`navigate(path, true)`) must migrate to `navigate(path, { replace: true })`; a bare `navigate(path)` is unchanged. The new `keepScroll` flag carries the live scroll offset onto the destination entry so an in-page URL swap — e.g. selecting another episode on the same detail page — restores to the current position instead of jumping to top. A push re-buckets the offset under the freshly minted entry id; a `replace` keeps the entry's bucket instead of discarding it.
+
+- [`ba56bb2`](https://github.com/briancray/abide/commit/ba56bb28be06fa0a11ab57fb10fa2d6b75ab8656) - Add `share`/`shared` context to `scope()`. The reactive doc does not inherit down the scope tree (each scope owns a separate document), so passing a value from an ancestor to a descendant previously meant threading it through every layer as props. `scope().share(key, value)` now puts a named value on a scope's own side-map, and `scope().shared(key)` reads the closest ancestor (self included) that has the key — an existence-checked, non-tracking upward walk, returning `undefined` when no scope provides it. The value is held by reference and the lookup never subscribes, so reactive context is expressed by sharing a `cell` (or a scope) rather than a plain object — reactivity rides what you share, not the share itself. A shared `undefined` shadows an ancestor (the walk stops on `has`, not truthiness). The shared map is released on `dispose`.
+
+### Patch Changes
+
+- [`a5a37f9`](https://github.com/briancray/abide/commit/a5a37f94258a56c4f24eb2b5539a280ce877bdfc) - extract resolveBranches for branch lookup ([`19a28a1`](https://github.com/briancray/abide/commit/19a28a1236e38a78c53a2adff0a981c8ad20b698))
+
+- [`a5a37f9`](https://github.com/briancray/abide/commit/a5a37f94258a56c4f24eb2b5539a280ce877bdfc) - sync AGENTS.md surface map for scope share/shared and navigate options ([`3e41255`](https://github.com/briancray/abide/commit/3e4125516164c94cfe9c9e6baa35f9ff9ec9c3e0))
+
+- [`a5a37f9`](https://github.com/briancray/abide/commit/a5a37f94258a56c4f24eb2b5539a280ce877bdfc) - use Promise.withResolvers in runWithVerbTimeout ([`504bdca`](https://github.com/briancray/abide/commit/504bdcac285cfd3762c8390fd1b6d640e62029bc))
+
+- [`a5a37f9`](https://github.com/briancray/abide/commit/a5a37f94258a56c4f24eb2b5539a280ce877bdfc) - extract VerbBaseOpts for shared verb options ([`d7414ca`](https://github.com/briancray/abide/commit/d7414cab7a557b54395321026d818b9fba82ba34))
+
+- [`ccc7f87`](https://github.com/briancray/abide/commit/ccc7f879d0506af084335785026200aeb38fdde4) - `on()` no longer attaches a non-function event handler. A component that omits an optional `on*` prop forwards it as `undefined`, yet the compiler still emits the `on()` call — so the listener fired `undefined(event)` and threw "handler is not a function" on every matching event (a keystroke or input on a search box, a click, …). `on()` now skips attaching when the handler is not a function, so an omitted optional handler is a no-op rather than a per-event crash.
+
+- [`c29dcd2`](https://github.com/briancray/abide/commit/c29dcd2796b5caa3ee41857aa612322b1e4220fa) - Parse `html`-branded raw markup in the parent's namespace. The client-side raw-HTML
+  binding parsed markup by setting `innerHTML` on a throwaway `<div>`, so the fragment
+  parser always used the HTML namespace — markup bound inside an `<svg>` produced
+  HTML-namespaced `<path>`/`<circle>` elements that exist in the DOM but never render.
+  This only surfaced on client-created or re-rendered nodes; the initial SSR/hydration
+  path adopts the server markup verbatim and kept the correct namespace, so an icon
+  component (`{html(svgInnerMarkup)}` inside `<svg>`) rendered on first paint but
+  vanished the moment its subtree was rebuilt on the client (e.g. a live cache delta).
+  A new `parseRawNodes` helper picks an SVG holder when the parent is SVG-namespaced,
+  shared by both `appendText` and `appendTextAt`.
+
+- [`9a74da6`](https://github.com/briancray/abide/commit/9a74da67c1f65cdb37e7a47af2e7b104cfe7620f) - Stop the signal-ref rewrite from descending into type space. `renameSignalRefs` rewrote every value-position identifier matching a signal name, but never skipped TypeScript type aliases, interfaces, or type annotations — so a component that destructures a prop (`const { option, ...rest } = props<Props>()`) and names that prop in its own type (`type Props = { option?: (value: T) => unknown; … }`) had the type member rewritten into a call (`option(): …`). This only surfaced once a `...rest` binding forced the named prop type to be emitted into the build (a no-rest `props<{…}>()` strips its type argument); with simple property types the mangle landed as accidentally-valid method-signature syntax, but optional/function/union members (`option?: (v) => unknown`, `value?: T | T[] | string`) became invalid TS and failed the page build. The visitor now leaves type aliases, interfaces, and any type node untouched — type space never holds a runtime read, and types erase at build regardless.
+
+- [`92597f0`](https://github.com/briancray/abide/commit/92597f0cbabc1e44449c0f0f812048481c38c579) - RPC bodies and socket frames now ship as ref-json (cycles, shared references, and
+  the types JSON drops/coerces — `undefined`, `bigint`, `Date`, `Map`, `Set`, `NaN`,
+  `±Infinity`, `-0` — survive the wire), and the server still accepts ordinary JSON from
+  non-abide clients. abide's own client flags a ref-json body with the `abide-ref-json`
+  header so the server decodes it with the matching codec; a request without the header
+  (curl, an OpenAPI-generated SDK, a webhook) is read with plain `JSON.parse`, so the
+  documented HTTP/OpenAPI body contract keeps working. The header is the discriminator
+  rather than the payload shape because ref-json's `[root, slots]` envelope is ambiguous
+  with a legitimate plain-JSON two-element array body. Socket frames need no header — a
+  frame is always an object, never the envelope array, so a plain-JSON frame falls back
+  to `JSON.parse` unambiguously.
+
+## 0.39.0
+
+### Minor Changes
+
+- [`ae15b27`](https://github.com/briancray/abide/commit/ae15b2733c3c569b9bde9e4d79f9b768836b3a46) - async SSR render with inline nested-blocking awaits and spread/rest props ([`514a796`](https://github.com/briancray/abide/commit/514a796833c5be4caa296b295d63fda6c8452a36))
+
+- [`527795d`](https://github.com/briancray/abide/commit/527795d1035f7cb169723a03571603a9ce8556e1) - Remote functions now accept an optional trailing options bag — `fn(args, opts)` — for per-call transport control: `signal`, `keepalive`, `priority`, `cache`, and `headers`. It's a curated `Pick` of `RequestInit`, not a raw passthrough: the server handler never observes these, so the call stays isomorphic, and a caller can't clobber the method, body, or framework headers the RPC contract owns. `opts.signal` merges with the scope abort and client timeout (`AbortSignal.any`) rather than replacing them, and is ignored under `cache()` so one reader can't abort a coalesced flight the others share. `opts.headers` merge onto abide's headers with the framework winning — a caller adds transport metadata (idempotency-key, authorization) but can't overwrite `traceparent`, the offline marker, or `content-type`.
+
+### Patch Changes
+
+- [`ae15b27`](https://github.com/briancray/abide/commit/ae15b2733c3c569b9bde9e4d79f9b768836b3a46) - harden client router, asset serving, sockets, and runtime edge cases ([`4735920`](https://github.com/briancray/abide/commit/4735920edea942dcd2954c522673b0c8af5a9a7f))
+
+- [`ae15b27`](https://github.com/briancray/abide/commit/ae15b2733c3c569b9bde9e4d79f9b768836b3a46) - consolidate escapeHtml and safeJsonForScript into shared/ ([`ae2d602`](https://github.com/briancray/abide/commit/ae2d6022f6dc23994164d1764bf5b812b136e383))
+
+- [`76a4a19`](https://github.com/briancray/abide/commit/76a4a19048fd5373b0d3ed75f2c6de017e33c7a3) - Make reactive errors and stack traces read in authored terms. A method call lowered onto a reactive-doc read now routes through a guard (`readCall`) that throws naming the scope path and member (`cannot call .close() — scope value "modal" is undefined`) instead of the engine's opaque `undefined is not an object`. The client build's source maps ignore-list abide's own framework sources, so a debugger collapses the mount-stack wall (`scope`/`mountRange`/`runNode`/…) and shows only authored `.abide`/`.ts` frames. Reactive bindings emit named thunks (`attr_title`/`text`/`bind_value`) so those surviving frames carry a name instead of `(anonymous)`.
+
 ## 0.38.1
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@abide/abide",
-    "version": "0.38.1",
+    "version": "0.40.0",
     "type": "module",
     "sideEffects": false,
     "description": "Isomorphic multimodal HTTP framework built for humans and machines in a single Bun runtime",
@@ -79,6 +79,11 @@
         "./ui/outbox": "./src/lib/ui/outbox.ts",
         "./ui/dom/mount": "./src/lib/ui/dom/mount.ts",
         "./ui/dom/mountChild": "./src/lib/ui/dom/mountChild.ts",
+        "./ui/dom/mergeProps": "./src/lib/ui/dom/mergeProps.ts",
+        "./ui/dom/spreadProps": "./src/lib/ui/dom/spreadProps.ts",
+        "./ui/dom/restProps": "./src/lib/ui/dom/restProps.ts",
+        "./ui/dom/spreadAttrs": "./src/lib/ui/dom/spreadAttrs.ts",
+        "./ui/dom/readCall": "./src/lib/ui/dom/readCall.ts",
         "./ui/dom/hydrate": "./src/lib/ui/dom/hydrate.ts",
         "./ui/dom/text": "./src/lib/ui/dom/text.ts",
         "./ui/dom/appendText": "./src/lib/ui/dom/appendText.ts",
@@ -127,6 +132,9 @@
         "./ui/socketProxy": "./src/lib/ui/socketProxy.ts",
         "./server/prompts/renderPromptTemplate": "./src/lib/server/prompts/renderPromptTemplate.ts"
     },
+    "scripts": {
+        "test": "bun test ./tests"
+    },
     "bin": {
         "abide": "./bin/abide.ts"
     },

package/src/build.ts

@@ -1,6 +1,7 @@
 import { clientBuildPlugins } from './clientBuildPlugins.ts'
 import { abideLog } from './lib/shared/abideLog.ts'
 import { exitOnBuildFailure } from './lib/shared/exitOnBuildFailure.ts'
+import { markFrameworkSourcesIgnored } from './lib/shared/markFrameworkSourcesIgnored.ts'
 
 const CLIENT_ENTRY = new URL('./clientEntry.ts', import.meta.url).pathname
 
@@ -97,6 +98,19 @@ export async function build({
             return false
         }
 
+        /* Ignore-list abide's own framework sources in every emitted map, so a debugger
+           collapses the mount-stack wall (scope/mountRange/runNode/…) and a stack trace
+           shows only authored `.abide`/`.ts` frames. Runs before the gzip step so the
+           `.gz` siblings compress the updated maps. */
+        await Promise.all(
+            result.outputs
+                .filter((output) => output.kind === 'sourcemap')
+                .map(async (output) => {
+                    const map = await Bun.file(output.path).json()
+                    await Bun.write(output.path, JSON.stringify(markFrameworkSourcesIgnored(map)))
+                }),
+        )
+
         // Dev skips the gzip siblings (paths still point into stagingDir here).
         const compressedBytes = compress
             ? (

package/src/lib/bundle/exitWithParent.ts

@@ -10,10 +10,12 @@ the var is absent (standalone `abide start`).
 */
 export function exitWithParent(): void {
     const parent = process.env.ABIDE_PARENT_PID
-    if (!parent) {
+    const parentPid = Number(parent)
+    /* A non-numeric value is truthy but coerces to NaN; without the integer guard
+       process.kill(NaN, 0) throws on the first tick and exits a healthy server. */
+    if (!parent || !Number.isInteger(parentPid)) {
         return
     }
-    const parentPid = Number(parent)
     const timer = setInterval(() => {
         try {
             // Signal 0 sends nothing — it only probes existence, throwing when the

package/src/lib/server/rpc/parseArgs.ts

@@ -1,6 +1,8 @@
 import { carriesBodyArgs } from '../../shared/carriesBodyArgs.ts'
 import { contentTypeOf } from '../../shared/contentTypeOf.ts'
+import { decodeRefJson } from '../../shared/decodeRefJson.ts'
 import { HttpError } from '../../shared/HttpError.ts'
+import { REF_JSON_HEADER } from '../../shared/REF_JSON_HEADER.ts'
 import type { HttpVerb } from '../../shared/types/HttpVerb.ts'
 import { error } from '../error.ts'
 import { requestContext } from '../runtime/requestContext.ts'
@@ -92,7 +94,14 @@ export async function parseArgs(
             if (contentType.includes('application/json')) {
                 const text = await bounded.text()
                 if (text !== '') {
-                    body = JSON.parse(text)
+                    /* abide's own client flags ref-json with REF_JSON_HEADER (restores
+                       cycles/shared refs JSON can't carry); a non-abide client (curl, an
+                       OpenAPI SDK) omits it and sends ordinary JSON — read with plain
+                       JSON.parse, since the ref-json envelope is ambiguous with a 2-element
+                       array body. */
+                    body = bounded.headers.has(REF_JSON_HEADER)
+                        ? decodeRefJson(text)
+                        : JSON.parse(text)
                 }
             } else if (
                 contentType.includes('application/x-www-form-urlencoded') ||

package/src/lib/server/rpc/readBodyWithinLimit.ts

@@ -40,5 +40,8 @@ export async function readBodyWithinLimit(request: Request, maxBytes: number): P
         method: request.method,
         headers: request.headers,
         body: buffered,
+        /* Carry the inbound signal forward so a handler reading `request().signal` still
+           aborts on client disconnect — a fresh Request would otherwise drop it. */
+        signal: request.signal,
     })
 }

package/src/lib/server/rpc/runWithVerbTimeout.ts

@@ -19,18 +19,16 @@ export function runWithVerbTimeout(
     ms: number,
     onTimeout: () => void,
 ): Promise<Response> {
-    let timer: ReturnType<typeof setTimeout> | undefined
     let timedOut = false
-    const deadline = new Promise<Response>((resolve) => {
-        timer = setTimeout(() => {
-            timedOut = true
-            onTimeout()
-            resolve(error(504, 'handler timeout'))
-        }, ms)
-    })
+    const deadline = Promise.withResolvers<Response>()
+    const timer = setTimeout(() => {
+        timedOut = true
+        onTimeout()
+        deadline.resolve(error(504, 'handler timeout'))
+    }, ms)
     return (async () => {
         try {
-            return await Promise.race([work, deadline])
+            return await Promise.race([work, deadline.promise])
         } finally {
             clearTimeout(timer)
             if (timedOut) {

package/src/lib/server/rpc/types/VerbHelper.ts

@@ -3,6 +3,21 @@ import type { RemoteFunction } from '../../../shared/types/RemoteFunction.ts'
 import type { StandardSchemaV1 } from '../../../shared/types/StandardSchemaV1.ts'
 import type { RemoteHandler } from './RemoteHandler.ts'
 
+/*
+Options every verb overload accepts: the OpenAPI 200 `outputSchema`, the
+`clients` surface flags, the same-origin CSRF exemption (`crossOrigin`), the
+pre-parse body-byte ceiling (`maxBodySize`), and the per-surface handler
+`timeout` (ms). The schema-bearing overloads intersect this with their own
+`inputSchema`/`filesSchema` members.
+*/
+type VerbBaseOpts = {
+    outputSchema?: StandardSchemaV1
+    clients?: Partial<ClientFlags>
+    crossOrigin?: boolean
+    maxBodySize?: number
+    timeout?: number
+}
+
 /*
 Shared signature for every verb helper (GET / POST / …). Three overloads:
 
@@ -50,36 +65,18 @@ export type VerbHelper = {
             StandardSchemaV1.InferOutput<InputSchema> & StandardSchemaV1.InferOutput<FilesSchema>,
             Return
         >,
-        opts: {
+        opts: VerbBaseOpts & {
             inputSchema: InputSchema
             filesSchema: FilesSchema
-            outputSchema?: StandardSchemaV1
-            clients?: Partial<ClientFlags>
-            crossOrigin?: boolean
-            maxBodySize?: number
-            timeout?: number
         },
     ): RemoteFunction<StandardSchemaV1.InferInput<InputSchema>, Return>
     <Return = unknown, InputSchema extends StandardSchemaV1 = StandardSchemaV1>(
         fn: RemoteHandler<StandardSchemaV1.InferOutput<InputSchema>, Return>,
-        opts: {
-            inputSchema: InputSchema
-            outputSchema?: StandardSchemaV1
-            clients?: Partial<ClientFlags>
-            crossOrigin?: boolean
-            maxBodySize?: number
-            timeout?: number
-        },
+        opts: VerbBaseOpts & { inputSchema: InputSchema },
     ): RemoteFunction<StandardSchemaV1.InferInput<InputSchema>, Return>
     <Args = undefined, Return = unknown>(
         fn: RemoteHandler<Args, Return>,
-        opts: {
-            outputSchema?: StandardSchemaV1
-            clients?: Partial<ClientFlags>
-            crossOrigin?: boolean
-            maxBodySize?: number
-            timeout?: number
-        },
+        opts: VerbBaseOpts,
     ): RemoteFunction<Args, Return>
     <Args = undefined, Return = unknown>(
         fn: RemoteHandler<Args, Return>,

package/src/lib/server/runtime/SSR_SWAP_SCRIPT.ts

@@ -1,17 +1,18 @@
 /*
 The tiny inline script the abide-ui SSR stream ships in <head>. For each streamed
 `<abide-resolve data-id>` frame it reads the leading `<script type=application/json>`,
-registers the resolved value into
-`window.__abideResume` (the resume manifest hydration reads) and swaps the resolved
-markup into the matching `<!--abide:await:ID-->…<!--/abide:await:ID-->` boundary —
-so the pending shell paints instantly and each value lands as it arrives, before
-the client bundle even loads. Vanilla and self-contained (no framework runtime),
-minified to one line so it inlines cheaply ahead of the document body.
+stores its raw ref-json text into `window.__abideResume` (the resume manifest hydration
+reads, decoding each entry at read time) and swaps the resolved markup into the matching
+`<!--abide:await:ID-->…<!--/abide:await:ID-->` boundary — so the pending shell paints
+instantly and each value lands as it arrives, before the client bundle even loads. It
+stores the text undecoded precisely because it's vanilla and self-contained — no framework
+runtime, hence no ref-json decoder; the bundle decodes on read. Minified to one line so it
+inlines cheaply ahead of the document body.
 */
 export const SSR_SWAP_SCRIPT =
     "function __abideSwap(){var f=document.querySelector('abide-resolve');while(f){" +
     "var id=f.getAttribute('data-id'),p=f.firstChild,w=document.createTreeWalker(document.body,NodeFilter.SHOW_COMMENT),o=null,c;" +
-    "if(p&&p.nodeName==='SCRIPT'){try{(window.__abideResume=window.__abideResume||{})[id]=JSON.parse(p.textContent||'null');}catch(e){}p.remove();}" +
+    "if(p&&p.nodeName==='SCRIPT'){(window.__abideResume=window.__abideResume||{})[id]=p.textContent||'';p.remove();}" +
     "while((c=w.nextNode())){if(c.data==='abide:await:'+id){o=c;break;}}" +
     "if(o){var n=o.nextSibling;while(n&&!(n.nodeType===8&&n.data==='/abide:await:'+id)){var x=n.nextSibling;n.remove();n=x;}" +
     "while(f.firstChild){o.parentNode.insertBefore(f.firstChild,n);}}f.remove();f=document.querySelector('abide-resolve');}}"

package/src/lib/server/runtime/createAppAssetServer.ts

@@ -34,13 +34,19 @@ export async function createAppAssetServer({
 }): Promise<(req: Request, url: URL) => Promise<Response>> {
     // Per-pathname asset header bundles, hashed-chunk-aware Cache-Control.
     const headersForAsset = createAssetHeaderCache(cacheControlForAsset)
-    const diskGzipPaths = assets
+    /* Boot snapshot of every disk `_app` path, mirroring createPublicAssetServer: the
+       header cache keys on (request-controlled) pathnames, so building bundles for junk
+       `/_app/*` probes would grow it without bound. A rebuild restarts the server (same
+       restart `bun --watch` triggers on a code change), re-snapshotting. */
+    const diskPaths = assets
         ? new Set<string>()
-        : await globToPathSet(
-              `${distDir}/_app`,
-              '**/*.gz',
-              (file) => `/_app/${file.replace(/\.gz$/, '')}`,
-          )
+        : await globToPathSet(`${distDir}/_app`, '**/*', (file) => `/_app/${file}`)
+    /* Derive the precompressed `.gz` sibling set from the single tree scan (it already
+       includes the `.gz` files) — a gzip-capable client gets those bytes without
+       on-the-fly compression. Keyed by the base path (the `.gz` suffix stripped). */
+    const diskGzipPaths = new Set(
+        [...diskPaths].filter((path) => path.endsWith('.gz')).map((path) => path.slice(0, -3)),
+    )
 
     return async function serveAppAsset(req, url) {
         if (containsTraversal(req.url)) {
@@ -49,8 +55,20 @@ export async function createAppAssetServer({
                 headers: { 'Content-Type': TEXT_PLAIN, 'Cache-Control': NO_STORE },
             })
         }
+        /* Embed map and gzip Set hold decoded filesystem names; url.pathname stays
+           percent-encoded — decode so a chunk/asset with a non-ASCII name matches and
+           Bun.file opens the real path, not a literal `%xx` name. */
+        let assetPath: string
+        try {
+            assetPath = decodeURIComponent(url.pathname)
+        } catch {
+            return new Response('Not Found', {
+                status: 404,
+                headers: { 'Content-Type': TEXT_PLAIN, 'Cache-Control': NO_STORE },
+            })
+        }
         if (assets) {
-            const compressed = assets[url.pathname]
+            const compressed = assets[assetPath]
             /* Miss-check before header work: the header cache keys on
                (request-controlled) pathnames, so building bundles for junk
                `/_app/*` probes would grow it without bound. */
@@ -63,12 +81,20 @@ export async function createAppAssetServer({
             return respondWithEmbeddedAsset(
                 compressed,
                 acceptsGzip(req),
-                headersForAsset(url.pathname),
+                headersForAsset(assetPath),
             )
         }
-        const { base: baseHeaders, gzip: gzipHeaders } = headersForAsset(url.pathname)
-        const diskPath = distDir + url.pathname
-        if (acceptsGzip(req) && diskGzipPaths.has(url.pathname)) {
+        /* Miss-check before header work so probes for non-existent chunks can't grow the
+           header cache (the embed branch above guards the same way). */
+        if (!diskPaths.has(assetPath)) {
+            return new Response('Not Found', {
+                status: 404,
+                headers: { 'Content-Type': TEXT_PLAIN, 'Cache-Control': NO_STORE },
+            })
+        }
+        const { base: baseHeaders, gzip: gzipHeaders } = headersForAsset(assetPath)
+        const diskPath = distDir + assetPath
+        if (acceptsGzip(req) && diskGzipPaths.has(assetPath)) {
             return new Response(Bun.file(`${diskPath}.gz`), { headers: gzipHeaders })
         }
         return new Response(Bun.file(diskPath), { headers: baseHeaders })

package/src/lib/server/runtime/createPublicAssetServer.ts

@@ -50,18 +50,27 @@ export async function createPublicAssetServer({
         if (containsTraversal(req.url)) {
             return undefined
         }
+        /* Both the embed map and the disk Set hold decoded filesystem names, but
+           url.pathname stays percent-encoded — decode it so a file whose name has a
+           space or non-ASCII char matches. A malformed escape can't name a real file. */
+        let assetPath: string
+        try {
+            assetPath = decodeURIComponent(url.pathname)
+        } catch {
+            return undefined
+        }
         if (publicAssets) {
-            const compressed = publicAssets[url.pathname]
+            const compressed = publicAssets[assetPath]
             if (!compressed) {
                 return undefined
             }
-            return respondWithEmbeddedAsset(compressed, acceptsGzip(req), headersFor(url.pathname))
+            return respondWithEmbeddedAsset(compressed, acceptsGzip(req), headersFor(assetPath))
         }
-        if (!diskPaths.has(url.pathname)) {
+        if (!diskPaths.has(assetPath)) {
             return undefined
         }
-        return new Response(Bun.file(publicDir + url.pathname), {
-            headers: headersFor(url.pathname).base,
+        return new Response(Bun.file(publicDir + assetPath), {
+            headers: headersFor(assetPath).base,
         })
     }
 }

package/src/lib/server/runtime/createUiPageRenderer.ts

@@ -3,16 +3,17 @@ import { SSR_CACHE_CONTROL } from '../../shared/CACHE_CONTROL_VALUES.ts'
 import { formatTraceparent } from '../../shared/formatTraceparent.ts'
 import { isReplayableMethod } from '../../shared/isReplayableMethod.ts'
 import { layoutChainForRoute } from '../../shared/layoutChainForRoute.ts'
+import { safeJsonForScript } from '../../shared/safeJsonForScript.ts'
 import type { CacheEntry } from '../../shared/types/CacheEntry.ts'
 import type { CacheSnapshotEntry } from '../../shared/types/CacheSnapshotEntry.ts'
 import type { StreamedResolution } from '../../shared/types/StreamedResolution.ts'
 import { renderChain } from '../../ui/renderChain.ts'
 import { renderToStream } from '../../ui/renderToStream.ts'
+import { resumeSeedScript } from '../../ui/resumeSeedScript.ts'
 import type { UiComponent } from '../../ui/runtime/types/UiComponent.ts'
 import { pageUrlFromStore } from './pageUrlFromStore.ts'
 import { SSR_SWAP_SCRIPT } from './SSR_SWAP_SCRIPT.ts'
 import { STREAMED_HTML_HEADER } from './STREAMED_HTML_HEADER.ts'
-import { safeJsonForScript } from './safeJsonForScript.ts'
 import { serializeCacheSnapshot } from './serializeCacheSnapshot.ts'
 import { streamCacheResolutions } from './streamCacheResolutions.ts'
 import type { RequestStore } from './types/RequestStore.ts'
@@ -33,11 +34,11 @@ function wantsJson(request: Request): boolean {
 const CACHE_RESOLVE_SCRIPT =
     'window.__abideResolve=function(r){(window.__abideResumeCache=window.__abideResumeCache||[]).push(r)}'
 
-/* One streamed cache resolution as an inline `__abideResolve(...)` call. `<` is escaped
-   (as in encodeResume) so a body value can't close the script early. */
+/* One streamed cache resolution as an inline `__abideResolve(...)` call. Encoded via
+   safeJsonForScript so `<`, `-->`, and U+2028/U+2029 can't close the script early or
+   parse as line terminators — the same escaping the page's other inline scripts use. */
 function resolveChunk(resolution: StreamedResolution): string {
-    const payload = JSON.stringify(resolution).replace(/</g, '\\u003c')
-    return `<script>__abideResolve(${payload})</script>`
+    return `<script>__abideResolve(${safeJsonForScript(resolution)})</script>`
 }
 
 /*
@@ -168,19 +169,21 @@ export function createUiPageRenderer({
             ...chainKeys.map((key) => layouts[key]?.().then((module) => module.default)),
             loadPage().then((module) => module.default),
         ])
-        const ssr = renderChain(
+        const ssr = await renderChain(
             views.filter((view): view is UiComponent => view !== undefined),
             params,
         )
 
-        /* Snapshot the cache settled by render-return — top-level `await` reads (render
-           blocked on them) — into __SSR__. A `{#await}` read is NOT here: its expression
-           is a thunk `renderToStream` runs lazily, so its entry is created mid-stream and
-           seeded after the drain (see below). */
+        /* Snapshot the cache settled by render-return — top-level `await` reads and blocking
+           `{#await … then}` reads (the async render awaited them inline) — into __SSR__. A
+           STREAMING `{#await}` read is NOT here: its expression is a thunk `renderToStream`
+           runs lazily, so its entry is created mid-stream and seeded after the drain (below). */
         const inline = await serializeCacheSnapshot(store.cache)
         const inlinedKeys = new Set(inline.map((entry) => entry.key))
 
-        /* No await blocks → render synchronously, ship buffered. */
+        /* No STREAMING await blocks → ship buffered. Blocking `{#await … then}` blocks
+           rendered inline (their markup is already in `ssr.html`); seed their resolved
+           values so hydration adopts them without a refetch. */
         if (ssr.awaits.length === 0) {
             const html = injectRoutePreloads(
                 shell.replace(SSR_MARKER, (_match, key: string) =>
@@ -190,7 +193,7 @@ export function createUiPageRenderer({
             )
             const withState = html.replace(
                 '</body>',
-                `${await stateTag(routeUrl, params, store, inline)}</body>`,
+                `${resumeSeedScript(ssr.resume)}${await stateTag(routeUrl, params, store, inline)}</body>`,
             )
             return new Response(withState, {
                 headers: {
@@ -219,38 +222,46 @@ export function createUiPageRenderer({
         return new Response(
             new ReadableStream({
                 async start(controller) {
-                    controller.enqueue(encoder.encode(before ?? ''))
-                    let first = true
-                    for await (const chunk of renderToStream(() => ssr)) {
-                        controller.enqueue(
-                            encoder.encode(
-                                first ? chunk : `${chunk}<script>__abideSwap()</script>`,
-                            ),
+                    /* The shell `before` already flushed, so a mid-stream render rejection
+                       (a streaming `{#await}` with no `:catch`) can't become a 500 — surface it
+                       on the stream (`controller.error`) so the response terminates legibly
+                       instead of leaking an unhandledrejection (process-fatal under Bun). */
+                    try {
+                        controller.enqueue(encoder.encode(before ?? ''))
+                        let first = true
+                        for await (const chunk of renderToStream(() => ssr)) {
+                            controller.enqueue(
+                                encoder.encode(
+                                    first ? chunk : `${chunk}<script>__abideSwap()</script>`,
+                                ),
+                            )
+                            first = false
+                        }
+                        /* The {#await} reads created (and settled) their cache entries DURING the
+                           stream — the await expression is a thunk `renderToStream` ran lazily —
+                           so they missed the render-return snapshot. Drain them now: each lands an
+                           inline `__abideResolve(...)` chunk (a warm snapshot, or a `{ key, miss }`
+                           marker for an unshippable body → live refetch) before the deferred
+                           bundle, so startClient seeds the store and the block's subscription read
+                           is warm. Skip keys already shipped inline in __SSR__. */
+                        const streamedEntries = Array.from(store.cache.entries.values()).filter(
+                            (entry: CacheEntry) =>
+                                entry.settled === true &&
+                                entry.request !== undefined &&
+                                isReplayableMethod(entry.request.method.toUpperCase()) &&
+                                !inlinedKeys.has(entry.key),
                         )
-                        first = false
+                        for await (const resolution of streamCacheResolutions(
+                            store.cache,
+                            streamedEntries,
+                        )) {
+                            controller.enqueue(encoder.encode(resolveChunk(resolution)))
+                        }
+                        controller.enqueue(encoder.encode(after ?? ''))
+                        controller.close()
+                    } catch (streamError) {
+                        controller.error(streamError)
                     }
-                    /* The {#await} reads created (and settled) their cache entries DURING the
-                       stream — the await expression is a thunk `renderToStream` ran lazily —
-                       so they missed the render-return snapshot. Drain them now: each lands an
-                       inline `__abideResolve(...)` chunk (a warm snapshot, or a `{ key, miss }`
-                       marker for an unshippable body → live refetch) before the deferred
-                       bundle, so startClient seeds the store and the block's subscription read
-                       is warm. Skip keys already shipped inline in __SSR__. */
-                    const streamedEntries = Array.from(store.cache.entries.values()).filter(
-                        (entry: CacheEntry) =>
-                            entry.settled === true &&
-                            entry.request !== undefined &&
-                            isReplayableMethod(entry.request.method.toUpperCase()) &&
-                            !inlinedKeys.has(entry.key),
-                    )
-                    for await (const resolution of streamCacheResolutions(
-                        store.cache,
-                        streamedEntries,
-                    )) {
-                        controller.enqueue(encoder.encode(resolveChunk(resolution)))
-                    }
-                    controller.enqueue(encoder.encode(after ?? ''))
-                    controller.close()
                 },
             }),
             {