@bananacool467/authtics-host 0.2.5 → 0.2.7

package/dist/cli.js

@@ -1,26 +1,192 @@
 #!/usr/bin/env node
 import { createServer } from "node:http";
 import { createJiti } from "jiti";
+import { createHash } from "node:crypto";
 import path from "node:path";
 import fs from "node:fs";
 import url from "node:url";
-import { renderPage } from "./renderEngine.js";
+import { renderPage, handleSrtwsConnection, deleteSrtwsServer, handleHTML } from "./renderEngine.js";
+import { setBuildStyle, tempFileForTsx } from "./rendererTempFiles.js";
+import { initializeSuperBuildOutput, refreshSuperRouteManifest } from "./superBuildOutput.js";
 let config_ = {};
 let uptime = 0;
 let totalRequests = 0;
 let users = 0;
 let usersPaused = false;
+let srtws;
 const jiti = createJiti(import.meta.url);
 const routes = new Map();
 const __filename = url.fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const hmrClients = new Set();
+const DAT_GUESS_WINDOW_MS = 30 * 60 * 1000;
+const DAT_DISTINCT_GUESS_LIMIT = 5;
+const DAT_IP_BLOCK_MS = 24 * 60 * 60 * 1000;
+const ACTION_RATE_WINDOW_MS = 60 * 1000;
+const ACTION_RATE_RULES = {
+    "/__authtics_host_apis__/set-users-paused": {
+        maxRequests: 5,
+        windowMs: ACTION_RATE_WINDOW_MS,
+        bucket: "pause",
+    },
+    "/__authtics_host_apis__/restart": {
+        maxRequests: 1,
+        windowMs: ACTION_RATE_WINDOW_MS,
+        bucket: "lifecycle",
+    },
+    "/__authtics_host_apis__/shutdown": {
+        maxRequests: 1,
+        windowMs: ACTION_RATE_WINDOW_MS,
+        bucket: "lifecycle",
+    },
+};
+const failedDatGuesses = new Map();
+const blockedDatIps = new Map();
+const actionRequestTimes = new Map();
+let datLockoutFile = "";
+function fingerprint(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function clientIpForRateLimit(req) {
+    return (req.ip || req.socket.remoteAddress || "unknown").trim();
+}
+function persistDatLockouts() {
+    if (!datLockoutFile)
+        return;
+    try {
+        fs.mkdirSync(path.dirname(datLockoutFile), { recursive: true });
+        const temporaryPath = `${datLockoutFile}.${process.pid}.tmp`;
+        fs.writeFileSync(temporaryPath, JSON.stringify(Object.fromEntries(blockedDatIps)), { encoding: "utf8", mode: 0o600 });
+        try {
+            fs.chmodSync(temporaryPath, 0o600);
+        }
+        catch {
+        }
+        fs.renameSync(temporaryPath, datLockoutFile);
+    }
+    catch (error) {
+        console.error("[HostJS] Could not persist DAT lockouts:", error);
+    }
+}
+function loadDatLockouts() {
+    if (!datLockoutFile)
+        return;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(datLockoutFile, "utf8"));
+        const now = Date.now();
+        for (const [ipHash, until] of Object.entries(parsed)) {
+            if (typeof until === "number" && until > now) {
+                blockedDatIps.set(ipHash, until);
+            }
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            console.warn("[HostJS] Could not read DAT lockouts; starting with an empty lockout list.");
+        }
+    }
+}
+function sendDatGuardResponse(res, statusCode, code, message, retryAfterSeconds) {
+    const headers = {
+        "Content-Type": "application/json",
+        "Cache-Control": "no-store",
+    };
+    if (retryAfterSeconds !== undefined) {
+        headers["Retry-After"] = String(retryAfterSeconds);
+    }
+    res.writeHead(statusCode, headers);
+    res.end(JSON.stringify({ error: code, message, retryAfter: retryAfterSeconds }));
+}
+function recordInvalidDatGuess(ipHash, suppliedDat, now) {
+    let guesses = failedDatGuesses.get(ipHash);
+    if (!guesses) {
+        guesses = new Map();
+        failedDatGuesses.set(ipHash, guesses);
+    }
+    for (const [candidateHash, timestamp] of guesses) {
+        if (now - timestamp >= DAT_GUESS_WINDOW_MS)
+            guesses.delete(candidateHash);
+    }
+    guesses.set(fingerprint(suppliedDat), now);
+    if (guesses.size >= DAT_DISTINCT_GUESS_LIMIT) {
+        blockedDatIps.set(ipHash, now + DAT_IP_BLOCK_MS);
+        failedDatGuesses.delete(ipHash);
+        persistDatLockouts();
+        return true;
+    }
+    return false;
+}
+function checkActionRateLimit(ipHash, pathname, now) {
+    const rule = ACTION_RATE_RULES[pathname];
+    if (!rule)
+        return undefined;
+    const key = `${ipHash}:${rule.bucket}`;
+    const recent = (actionRequestTimes.get(key) ?? [])
+        .filter(timestamp => now - timestamp < rule.windowMs);
+    if (recent.length >= rule.maxRequests) {
+        actionRequestTimes.set(key, recent);
+        return Math.max(1, Math.ceil((recent[0] + rule.windowMs - now) / 1000));
+    }
+    recent.push(now);
+    actionRequestTimes.set(key, recent);
+    return undefined;
+}
+function guardDatApiRequest(req, res, pathname) {
+    const now = Date.now();
+    const ipHash = fingerprint(clientIpForRateLimit(req));
+    const blockedUntil = blockedDatIps.get(ipHash);
+    if (blockedUntil !== undefined) {
+        if (blockedUntil > now) {
+            sendDatGuardResponse(res, 429, "DAT_IP_BLOCKED", "DAT-protected endpoints are temporarily unavailable from this IP.", Math.ceil((blockedUntil - now) / 1000));
+            return false;
+        }
+        blockedDatIps.delete(ipHash);
+        persistDatLockouts();
+    }
+    const configuredDats = typeof config_.dat === "string"
+        ? [config_.dat]
+        : Array.isArray(config_.dat)
+            ? config_.dat.filter((value) => typeof value === "string")
+            : [];
+    const datRestrictionEnabled = config_.dat !== undefined && config_.dat !== null;
+    const datMatches = !datRestrictionEnabled ||
+        configuredDats.includes(req.dat ?? "");
+    if (datRestrictionEnabled && !datMatches) {
+        const justBlocked = recordInvalidDatGuess(ipHash, req.dat ?? "<missing>", now);
+        if (justBlocked) {
+            sendDatGuardResponse(res, 429, "DAT_IP_BLOCKED", "Too many distinct invalid DAT values. DAT-protected endpoints are blocked for 24 hours.", Math.ceil(DAT_IP_BLOCK_MS / 1000));
+        }
+        else {
+            sendDatGuardResponse(res, 401, "INVALID_DAT", "DAT authorization failed.");
+        }
+        return false;
+    }
+    if (datRestrictionEnabled) {
+        failedDatGuesses.delete(ipHash);
+    }
+    const retryAfter = checkActionRateLimit(ipHash, pathname, now);
+    if (retryAfter !== undefined) {
+        sendDatGuardResponse(res, 429, "ACTION_RATE_LIMITED", "This action is temporarily rate-limited. Try again later.", retryAfter);
+        return false;
+    }
+    return true;
+}
 function safeWatch(target, onChange) {
     const shouldReact = (filename) => {
         if (!filename)
             return false;
         if (filename.includes('.authtics_host'))
             return false;
+        if (filename.includes('.hostjs'))
+            return false;
+        if (filename.includes('.upm'))
+            return false;
+        if (filename.includes('.tsbuildinfo'))
+            return false;
+        if (filename.includes('.local'))
+            return false;
+        if (filename.includes('.cache'))
+            return false;
         if (filename.includes('node_modules'))
             return false;
         return /\.(tsx?|jsx?|html|css)$/i.test(filename);
@@ -67,20 +233,89 @@ function notifyHmrClients() {
     hmrDebounceTimer = setTimeout(() => {
         hmrDebounceTimer = null;
         for (const client of hmrClients) {
+            if (client.destroyed || client.writableEnded) {
+                hmrClients.delete(client);
+                continue;
+            }
             try {
                 client.write('data: reload\n\n');
             }
             catch {
                 hmrClients.delete(client);
+                client.destroy();
             }
         }
     }, 120);
 }
 const MIME_TYPES = {
     '.html': 'text/html',
+    '.htm': 'text/html',
     '.css': 'text/css',
     '.js': 'application/javascript',
+    '.mjs': 'application/javascript',
+    '.jsx': 'text/jsx',
+    '.ts': 'text/typescript',
+    '.tsx': 'text/tsx',
     '.json': 'application/json',
+    '.jsonld': 'application/ld+json',
+    '.map': 'application/json',
+    '.c': 'text/x-csrc',
+    '.cpp': 'text/x-c++src',
+    '.h': 'text/x-chdr',
+    '.hpp': 'text/x-c++hdr',
+    '.cs': 'text/x-csharp',
+    '.go': 'text/x-gosrc',
+    '.py': 'text/x-python',
+    '.rb': 'text/x-ruby',
+    '.php': 'application/x-httpd-php',
+    '.java': 'text/x-java-source',
+    '.kt': 'text/x-kotlin',
+    '.swift': 'text/x-swift',
+    '.rs': 'text/rust',
+    '.sh': 'application/x-sh',
+    '.bat': 'application/x-msdos-program',
+    '.ps1': 'application/x-powershell',
+    '.pl': 'text/x-perl',
+    '.r': 'text/x-rsrc',
+    '.sql': 'text/x-sql',
+    '.xml': 'application/xml',
+    '.yaml': 'text/yaml',
+    '.yml': 'text/yaml',
+    '.toml': 'text/toml',
+    '.ini': 'text/plain',
+    '.cfg': 'text/plain',
+    '.conf': 'text/plain',
+    '.md': 'text/markdown',
+    '.txt': 'text/plain',
+    '.csv': 'text/csv',
+    '.tsv': 'text/tab-separated-values',
+    '.pdf': 'application/pdf',
+    '.wasm': 'application/wasm',
+    '.elf': 'application/x-elf',
+    '.exe': 'application/x-msdownload',
+    '.dll': 'application/x-msdownload',
+    '.o': 'application/x-object',
+    '.a': 'application/x-archive',
+    '.so': 'application/x-sharedlib',
+    '.dylib': 'application/x-apple-binary',
+    '.msi': 'application/x-msi',
+    '.apk': 'application/vnd.android.package-archive',
+    '.bin': 'application/octet-stream',
+    '.iso': 'application/x-iso9660-image',
+    '.img': 'application/octet-stream',
+    '.dmg': 'application/x-apple-diskimage',
+    '.vmdk': 'application/x-virtualbox-vmdk',
+    '.vhd': 'application/x-vhd',
+    '.qcow2': 'application/x-qcow2',
+    '.zip': 'application/zip',
+    '.tar': 'application/x-tar',
+    '.gz': 'application/gzip',
+    '.tgz': 'application/gzip',
+    '.bz2': 'application/x-bzip2',
+    '.xz': 'application/x-xz',
+    '.rar': 'application/vnd.rar',
+    '.7z': 'application/x-7z-compressed',
+    '.cab': 'application/vnd.ms-cab-compressed',
     '.png': 'image/png',
     '.jpg': 'image/jpeg',
     '.jpeg': 'image/jpeg',
@@ -88,13 +323,49 @@ const MIME_TYPES = {
     '.svg': 'image/svg+xml',
     '.ico': 'image/x-icon',
     '.webp': 'image/webp',
+    '.avif': 'image/avif',
+    '.bmp': 'image/bmp',
+    '.tiff': 'image/tiff',
+    '.tif': 'image/tiff',
+    '.psd': 'image/vnd.adobe.photoshop',
+    '.ai': 'application/postscript',
+    '.mp4': 'video/mp4',
+    '.mkv': 'video/x-matroska',
+    '.avi': 'video/x-msvideo',
+    '.mov': 'video/quicktime',
+    '.wmv': 'video/x-ms-wmv',
+    '.webm': 'video/webm',
+    '.flv': 'video/x-flv',
+    '.mp3': 'audio/mpeg',
+    '.wav': 'audio/wav',
+    '.ogg': 'audio/ogg',
+    '.oga': 'audio/ogg',
+    '.ogv': 'video/ogg',
+    '.flac': 'audio/flac',
+    '.aac': 'audio/aac',
+    '.m4a': 'audio/x-m4a',
     '.woff': 'font/woff',
     '.woff2': 'font/woff2',
     '.ttf': 'font/ttf',
-    '.mp4': 'video/mp4',
-    '.mp3': 'audio/mpeg',
-    '.txt': 'text/plain',
-    '.pdf': 'application/pdf',
+    '.otf': 'font/otf',
+    '.eot': 'application/vnd.ms-fontobject',
+    '.sqlite': 'application/vnd.sqlite3',
+    '.sqlite3': 'application/vnd.sqlite3',
+    '.db': 'application/octet-stream',
+    '.mdb': 'application/x-msaccess',
+    '.obj': 'model/obj',
+    '.stl': 'model/stl',
+    '.gltf': 'model/gltf+json',
+    '.glb': 'model/gltf-binary',
+    '.fbx': 'application/octet-stream',
+    '.dae': 'model/vnd.collada+xml',
+    '.3ds': 'image/x-3ds',
+    '.doc': 'application/msword',
+    '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    '.xls': 'application/vnd.ms-excel',
+    '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    '.ppt': 'application/vnd.ms-powerpoint',
+    '.pptx': 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
 };
 const getCpu = () => {
     return new Promise((resolve) => {
@@ -258,7 +529,7 @@ export default class App {
                     stdio: 'inherit'
                 });
                 child.unref();
-                this.server.close(() => {
+                this.server?.close(() => {
                     process.kill(process.pid, 'SIGTERM');
                 });
             }
@@ -272,12 +543,12 @@ export default class App {
             if (datMatched) {
                 res.writeHead(200, { "Content-Type": "application/json" });
                 res.end(JSON.stringify({ message: "Shutting down..." }));
-                this.server.close(() => {
+                this.server?.close(() => {
                     process.kill(process.pid, 'SIGTERM');
                 });
             }
         });
-        this.post("/__authtics_host_apis__/get-is-ssr", async (req, res) => {
+        this.post("/__authtics_host_apis__/get-render-type", async (req, res) => {
             let datMatched = false;
             if (config_.dat && config_.dat == req.dat)
                 datMatched = true;
@@ -286,7 +557,7 @@ export default class App {
             if (datMatched) {
                 res.writeHead(200, { "Content-Type": "application/json" });
                 res.end(JSON.stringify({
-                    isSsr: config_.ssr
+                    renderType: config_.renderType
                 }));
             }
         });
@@ -388,15 +659,15 @@ export default class App {
             this.server = await start();
         }
         catch (error) {
-            console.error("Server failed to start:", error);
+            console.error("[HostJS] Server failed to start: ", error);
         }
     }
-    get(routePath, handler) {
-        routes.set(`GET:${routePath}`, handler);
-    }
     registerApp(route) {
         routes.set(`APP_TSX`, route);
     }
+    get(routePath, handler) {
+        routes.set(`GET:${routePath}`, handler);
+    }
     post(routePath, handler) {
         routes.set(`POST:${routePath}`, handler);
     }
@@ -406,6 +677,15 @@ export default class App {
     delete(routePath, handler) {
         routes.set(`DELETE:${routePath}`, handler);
     }
+    use(handler) {
+        const randomMultiplier = BigInt(Math.floor(Math.random() * 1000000000));
+        let newId = randomMultiplier * 1000000000000000000000000000000n;
+        routes.set(`USE:${newId}`, handler);
+    }
+    on(method, handler) {
+        if (this.server)
+            this.server.on(method, handler);
+    }
     remove(method, routePath) {
         if (routes.has(`${method}:${routePath}`))
             routes.delete(`${method}:${routePath}`);
@@ -420,7 +700,14 @@ async function start() {
     }
     catch {
     }
+    const requestedBuildStyle = config.buildStyle ?? "default";
+    if (requestedBuildStyle !== "default" && requestedBuildStyle !== "super") {
+        throw new Error('[HostJS] Invalid buildStyle. Expected "default" or "super".');
+    }
+    const buildStyle = requestedBuildStyle;
+    setBuildStyle(buildStyle, process.cwd());
     const PORT = config.port ?? 3000;
+    const renderType = config.renderType ?? 'ssr';
     const showPanel = config.devMode !== false;
     const autoPaging = config.autoPage !== false;
     const compiler = 'esbuild';
@@ -428,6 +715,9 @@ async function start() {
     const pagesDir = config.autoPage === true ? path.join(process.cwd(), config.autoPageDir || "") : undefined;
     const publicDir = config.autoFile === true ? path.join(process.cwd(), config.autoFileDir || "") : undefined;
     const apiDir = pagesDir ? path.join(pagesDir, "api") : undefined;
+    if (buildStyle === "super") {
+        initializeSuperBuildOutput(process.cwd(), config, pagesDir, publicDir);
+    }
     const server = createServer(async (req, res) => {
         const { url = "/", method } = req;
         const actuallyShowPanel = showPanel;
@@ -539,8 +829,17 @@ async function start() {
             res.writeHead(302, { Location: req.url + '/' });
             res.end();
         };
-        res.setCookie = function (name, value) {
-            res.setHeader("Set-Cookie", `${name}=${value}; Path=/`);
+        res.setCookie = function (name, value, sameSite = "Lax", HttpOnly = true, Secure = true, MaxAge = null) {
+            const cookieParts = [`${name}=${value}`, "Path=/"];
+            if (MaxAge !== null)
+                cookieParts.push(`Max-Age=${MaxAge}`);
+            if (HttpOnly)
+                cookieParts.push("HttpOnly");
+            if (Secure)
+                cookieParts.push("Secure");
+            if (sameSite)
+                cookieParts.push(`SameSite=${sameSite}`);
+            res.setHeader("Set-Cookie", cookieParts.join("; "));
         };
         res.rmvCookie = function (name) {
             res.setHeader("Set-Cookie", `${name}=; Path=/; Max-Age=0`);
@@ -550,9 +849,28 @@ async function start() {
         pathname = safePath;
         if (pathname !== "/" && pathname.endsWith("/"))
             pathname = pathname.slice(0, -1);
-        if (!pathname.includes('/__authtics') && !pathname.includes('/hmr')) {
+        if (!pathname.includes('/__authtics') && !pathname.includes('/hmr') && !pathname.includes('/srtws')) {
             totalRequests++;
         }
+        const useRoutes = Array.from(routes.entries()).filter(([key]) => key.startsWith("USE:"));
+        if (useRoutes.length > 0 && !pathname.includes('/__authtics') && !pathname.includes('/hmr') && !pathname.includes('/srtws')) {
+            let i = 0;
+            const next = () => {
+                i++;
+                if (i >= useRoutes.length)
+                    return;
+                const [key, handler] = useRoutes[i];
+                if (typeof handler === 'function') {
+                    const id = BigInt(key.split(":")[1]);
+                    handler(req, res, id, next);
+                }
+            };
+            const [key, handler] = useRoutes[0];
+            if (typeof handler === 'function') {
+                const id = BigInt(key.split(":")[1]);
+                handler(req, res, id, next);
+            }
+        }
         const routeKey = `${method}:${pathname}`;
         if (routes.has(routeKey)) {
             if (Array.isArray(config_.dat) && !config_.dat.includes(req.dat) && usersPaused && !routeKey.endsWith('.js')) {
@@ -561,17 +879,17 @@ async function start() {
                     if (fs.existsSync(pausedTsxFile || "")) {
                         try {
                             let html = await renderPage(pausedTsxFile || "", url, actuallyShowPanel, compiler, hotReload, autoPaging, config.autoPageDir, (routes.get("APP_TSX") || ""), (f, p) => {
-                                routes.set(`GET:${p}`, (req, res) => {
-                                    res.setHeader("Content-Type", "application/javascript");
+                                routes.set(`GET:${p}`, (_, res) => {
+                                    res.setHeader("Content-Type", p.toLowerCase().endsWith(".map") ? "application/json" : "application/javascript");
                                     res.end(f);
                                 });
-                            }, (p) => { routes.delete(`GET:${p}`); }, req.dat, config_.dat);
+                            }, (p) => { routes.delete(`GET:${p}`); }, req.dat, config_.dat, config_.renderType, config_.patchForSsr);
                             html = html.replace("<script>", "<script>\nwindow.__paused__ = true;");
                             res.setHeader("Content-Type", "text/html");
                             return res.end(html);
                         }
                         catch (e) {
-                            console.error("[authtics] renderPage error:", e.message);
+                            console.error("[HostJS] renderPage error:", e.message);
                             res.writeHead(500);
                             return res.end(`<html><body><pre>500 | Render error:\n${e.message}</pre></body></html>`);
                         }
@@ -584,17 +902,17 @@ async function start() {
                         if (fs.existsSync(appPath)) {
                             try {
                                 let html = await renderPage(appPath, url, actuallyShowPanel, compiler, hotReload, autoPaging, config.autoPageDir, (routes.get("APP_TSX") || ""), (f, p) => {
-                                    routes.set(`GET:${p}`, (req, res) => {
-                                        res.setHeader("Content-Type", "application/javascript");
+                                    routes.set(`GET:${p}`, (_, res) => {
+                                        res.setHeader("Content-Type", p.toLowerCase().endsWith(".map") ? "application/json" : "application/javascript");
                                         res.end(f);
                                     });
-                                }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat);
+                                }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat, config_.renderType);
                                 html = html.replace("<script>", "<script>\nwindow.__paused__ = true;");
                                 res.setHeader("Content-Type", "text/html");
                                 return res.end(html);
                             }
                             catch (e) {
-                                console.error("[authtics] renderPage error:", e.message);
+                                console.error("[HostJS] renderPage error:", e.message);
                                 res.writeHead(500);
                                 return res.end(`<html><body><pre>500 | Render error:\n${e.message}</pre></body></html>`);
                             }
@@ -614,17 +932,17 @@ async function start() {
                     if (fs.existsSync(pausedTsxFile || "")) {
                         try {
                             let html = await renderPage(pausedTsxFile || "", url, actuallyShowPanel, compiler, hotReload, autoPaging, config.autoPageDir, (routes.get("APP_TSX") || ""), (f, p) => {
-                                routes.set(`GET:${p}`, (req, res) => {
-                                    res.setHeader("Content-Type", "application/javascript");
+                                routes.set(`GET:${p}`, (_, res) => {
+                                    res.setHeader("Content-Type", p.toLowerCase().endsWith(".map") ? "application/json" : "application/javascript");
                                     res.end(f);
                                 });
-                            }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat);
+                            }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat, config_.renderType, config_.patchForSsr);
                             html = html.replace("<script>", "<script>\nwindow.__paused__ = true;");
                             res.setHeader("Content-Type", "text/html");
                             return res.end(html);
                         }
                         catch (e) {
-                            console.error("[authtics] renderPage error:", e.message);
+                            console.error("[HostJS] renderPage error:", e.message);
                             res.writeHead(500);
                             return res.end(`<html><body><pre>500 | Render error:\n${e.message}</pre></body></html>`);
                         }
@@ -637,17 +955,17 @@ async function start() {
                         if (fs.existsSync(appPath)) {
                             try {
                                 let html = await renderPage(appPath, url, actuallyShowPanel, compiler, hotReload, autoPaging, config.autoPageDir, (routes.get("APP_TSX") || ""), (f, p) => {
-                                    routes.set(`GET:${p}`, (req, res) => {
-                                        res.setHeader("Content-Type", "application/javascript");
+                                    routes.set(`GET:${p}`, (_, res) => {
+                                        res.setHeader("Content-Type", p.toLowerCase().endsWith(".map") ? "application/json" : "application/javascript");
                                         res.end(f);
                                     });
-                                }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat);
+                                }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat, config_.renderType);
                                 html = html.replace("<script>", "<script>\nwindow.__paused__ = true;");
                                 res.setHeader("Content-Type", "text/html");
                                 return res.end(html);
                             }
                             catch (e) {
-                                console.error("[authtics] renderPage error:", e.message);
+                                console.error("[HostJS] renderPage error:", e.message);
                                 res.writeHead(500);
                                 return res.end(`<html><body><pre>500 | Render error:\n${e.message}</pre></body></html>`);
                             }
@@ -662,6 +980,17 @@ async function start() {
                 }));
             }
             const handler = routes.get(routeKey);
+            if (typeof handler === "function" && routeKey.toLowerCase().endsWith(".map")) {
+                const configuredDAT = config_.dat;
+                const hasMatchingDAT = configuredDAT === undefined ||
+                    (Array.isArray(configuredDAT)
+                        ? configuredDAT.includes(req.dat ?? "")
+                        : configuredDAT === req.dat);
+                if (!hasMatchingDAT) {
+                    res.writeHead(404);
+                    return res.end();
+                }
+            }
             if (typeof handler === 'string') {
                 return;
             }
@@ -672,14 +1001,24 @@ async function start() {
         if (pathname === '/hmr') {
             res.writeHead(200, {
                 'Content-Type': 'text/event-stream',
-                'Cache-Control': 'no-cache',
+                'Cache-Control': 'no-cache, no-transform',
                 'Connection': 'keep-alive',
                 'Access-Control-Allow-Origin': '*',
             });
             res.write('data: connected\n\n');
             hmrClients.add(res);
             users++;
-            req.on('close', () => { hmrClients.delete(res); users--; });
+            const cleanup = () => {
+                hmrClients.delete(res);
+                users = Math.max(0, users - 1);
+            };
+            req.on('close', cleanup);
+            req.on('aborted', cleanup);
+            res.on('close', cleanup);
+            res.on('error', cleanup);
+            return;
+        }
+        if (pathname === '/srtws') {
             return;
         }
         if (Array.isArray(config_.dat) && !config_.dat.includes(req.dat) && usersPaused) {
@@ -688,17 +1027,17 @@ async function start() {
                 if (fs.existsSync(pausedTsxFile || "")) {
                     try {
                         let html = await renderPage(pausedTsxFile || "", url, actuallyShowPanel, compiler, hotReload, autoPaging, config.autoPageDir, (routes.get("APP_TSX") || ""), (f, p) => {
-                            routes.set(`GET:${p}`, (req, res) => {
-                                res.setHeader("Content-Type", "application/javascript");
+                            routes.set(`GET:${p}`, (_, res) => {
+                                res.setHeader("Content-Type", p.toLowerCase().endsWith(".map") ? "application/json" : "application/javascript");
                                 res.end(f);
                             });
-                        }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat);
+                        }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat, config_.renderType, config_.patchForSsr);
                         html = html.replace("<script>", "<script>\nwindow.__paused__ = true;");
                         res.setHeader("Content-Type", "text/html");
                         return res.end(html);
                     }
                     catch (e) {
-                        console.error("[authtics] renderPage error:", e.message);
+                        console.error("[HostJS] renderPage error:", e.message);
                         res.writeHead(500);
                         return res.end(`<html><body><pre>500 | Render error:\n${e.message}</pre></body></html>`);
                     }
@@ -711,17 +1050,17 @@ async function start() {
                     if (fs.existsSync(appPath)) {
                         try {
                             let html = await renderPage(appPath, url, actuallyShowPanel, compiler, hotReload, autoPaging, config.autoPageDir, (routes.get("APP_TSX") || ""), (f, p) => {
-                                routes.set(`GET:${p}`, (req, res) => {
-                                    res.setHeader("Content-Type", "application/javascript");
+                                routes.set(`GET:${p}`, (_, res) => {
+                                    res.setHeader("Content-Type", p.toLowerCase().endsWith(".map") ? "application/json" : "application/javascript");
                                     res.end(f);
                                 });
-                            }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat);
+                            }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat, config_.renderType, config_.patchForSsr);
                             html = html.replace("<script>", "<script>\nwindow.__paused__ = true;");
                             res.setHeader("Content-Type", "text/html");
                             return res.end(html);
                         }
                         catch (e) {
-                            console.error("[authtics] renderPage error:", e.message);
+                            console.error("[HostJS] renderPage error:", e.message);
                             res.writeHead(500);
                             return res.end(`<html><body><pre>500 | Render error:\n${e.message}</pre></body></html>`);
                         }
@@ -741,17 +1080,17 @@ async function start() {
                 if (fs.existsSync(pausedTsxFile || "")) {
                     try {
                         let html = await renderPage(pausedTsxFile || "", url, actuallyShowPanel, compiler, hotReload, autoPaging, config.autoPageDir, (routes.get("APP_TSX") || ""), (f, p) => {
-                            routes.set(`GET:${p}`, (req, res) => {
-                                res.setHeader("Content-Type", "application/javascript");
+                            routes.set(`GET:${p}`, (_, res) => {
+                                res.setHeader("Content-Type", p.toLowerCase().endsWith(".map") ? "application/json" : "application/javascript");
                                 res.end(f);
                             });
-                        }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat);
+                        }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat, config_.renderType, config_.patchForSsr);
                         html = html.replace("<script>", "<script>\nwindow.__paused__ = true;");
                         res.setHeader("Content-Type", "text/html");
                         return res.end(html);
                     }
                     catch (e) {
-                        console.error("[authtics] renderPage error:", e.message);
+                        console.error("[HostJS] renderPage error:", e.message);
                         res.writeHead(500);
                         return res.end(`<html><body><pre>500 | Render error:\n${e.message}</pre></body></html>`);
                     }
@@ -764,17 +1103,17 @@ async function start() {
                     if (fs.existsSync(appPath)) {
                         try {
                             let html = await renderPage(appPath, url, actuallyShowPanel, compiler, hotReload, autoPaging, config.autoPageDir, (routes.get("APP_TSX") || ""), (f, p) => {
-                                routes.set(`GET:${p}`, (req, res) => {
-                                    res.setHeader("Content-Type", "application/javascript");
+                                routes.set(`GET:${p}`, (_, res) => {
+                                    res.setHeader("Content-Type", p.toLowerCase().endsWith(".map") ? "application/json" : "application/javascript");
                                     res.end(f);
                                 });
-                            }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat);
+                            }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat, config_.renderType, config_.patchForSsr);
                             html = html.replace("<script>", "<script>\nwindow.__paused__ = true;");
                             res.setHeader("Content-Type", "text/html");
                             return res.end(html);
                         }
                         catch (e) {
-                            console.error("[authtics] renderPage error:", e.message);
+                            console.error("[HostJS] renderPage error:", e.message);
                             res.writeHead(500);
                             return res.end(`<html><body><pre>500 | Render error:\n${e.message}</pre></body></html>`);
                         }
@@ -808,12 +1147,12 @@ async function start() {
                     const handler = apiModule.default ?? apiModule.handler ?? null;
                     if (typeof handler !== 'function') {
                         res.writeHead(500);
-                        return res.end(`[authtics] API route ${pathname} must export a default function`);
+                        return res.end(`[HostJS] API route ${pathname} must export a default function`);
                     }
                     return handler(req, res);
                 }
                 catch (e) {
-                    console.error(`[authtics] API route error (${pathname}):`, e.message);
+                    console.error(`[HostJS] API route error (${pathname}):`, e.message);
                     res.writeHead(500);
                     return res.end(JSON.stringify({ error: e.message }));
                 }
@@ -822,11 +1161,11 @@ async function start() {
             if (fs.existsSync(notFoundPath)) {
                 try {
                     let html = await renderPage(notFoundPath, url, actuallyShowPanel, compiler, hotReload, autoPaging, config.autoPageDir, (routes.get("APP_TSX") || ""), (f, p) => {
-                        routes.set(`GET:${p}`, (req, res) => {
-                            res.setHeader("Content-Type", "application/javascript");
+                        routes.set(`GET:${p}`, (_, res) => {
+                            res.setHeader("Content-Type", p.toLowerCase().endsWith(".map") ? "application/json" : "application/javascript");
                             res.end(f);
                         });
-                    }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat);
+                    }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat, config_.renderType, config_.patchForSsr);
                     res.setHeader("Content-Type", "text/html");
                     res.writeHead(404);
                     html = html.replace("<script>", "<script>\nwindow.__status_code__ = 404;");
@@ -845,14 +1184,24 @@ async function start() {
         const urlPath = pathname === "/" ? "/index" : pathname;
         const tsxPath = pagesDir ? path.join(pagesDir, `${urlPath}.tsx`) : undefined;
         const htmlPath = pagesDir ? path.join(pagesDir, `${urlPath}.html`) : undefined;
+        if (srtws)
+            deleteSrtwsServer();
+        if (fs.existsSync(tempFileForTsx(tsxPath || "")) && renderType === "srtws" && !srtws) {
+            srtws = handleSrtwsConnection(server, tsxPath || "", config, url, req.cookies.dat, (p) => { routes.delete(`GET:${p}`); }, (f, p) => {
+                routes.set(`GET:${p}`, (_, res) => {
+                    res.setHeader("Content-Type", p.toLowerCase().endsWith(".map") ? "application/json" : "application/javascript");
+                    res.end(f);
+                });
+            });
+        }
         if (tsxPath && fs.existsSync(tsxPath)) {
             try {
                 const html = await renderPage(tsxPath, url, actuallyShowPanel, compiler, hotReload, autoPaging, config.autoPageDir, (routes.get("APP_TSX") || ""), (f, p) => {
-                    routes.set(`GET:${p}`, (req, res) => {
-                        res.setHeader("Content-Type", "application/javascript");
+                    routes.set(`GET:${p}`, (_, res) => {
+                        res.setHeader("Content-Type", p.toLowerCase().endsWith(".map") ? "application/json" : "application/javascript");
                         res.end(f);
                     });
-                }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat);
+                }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat, config_.renderType, config_.patchForSsr);
                 res.setHeader("Content-Type", "text/html");
                 return res.end(html);
             }
@@ -863,8 +1212,9 @@ async function start() {
             }
         }
         if (htmlPath && fs.existsSync(htmlPath)) {
-            res.setHeader("Content-Type", "text/html");
-            return res.end(fs.readFileSync(htmlPath, "utf-8"));
+            const html = await handleHTML(fs.readFileSync(htmlPath, "utf-8"), actuallyShowPanel, config_.dat, req.cookies.dat, hotReload);
+            res.setHeader("Content-Type", "text/html; charset=utf-8");
+            return res.end(html);
         }
         if (routes.has("APP_TSX")) {
             const appTsxPath = routes.get("APP_TSX");
@@ -872,11 +1222,11 @@ async function start() {
             if (fs.existsSync(appPath)) {
                 try {
                     const html = await renderPage(appPath, url, actuallyShowPanel, compiler, hotReload, autoPaging, config.autoPageDir, (routes.get("APP_TSX") || ""), (f, p) => {
-                        routes.set(`GET:${p}`, (req, res) => {
-                            res.setHeader("Content-Type", "application/javascript");
+                        routes.set(`GET:${p}`, (_, res) => {
+                            res.setHeader("Content-Type", p.toLowerCase().endsWith(".map") ? "application/json" : "application/javascript");
                             res.end(f);
                         });
-                    }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat);
+                    }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat, config_.renderType, config_.patchForSsr);
                     res.setHeader("Content-Type", "text/html");
                     return res.end(html);
                 }
@@ -891,11 +1241,11 @@ async function start() {
         if (fs.existsSync(notFoundPath)) {
             try {
                 let html = await renderPage(notFoundPath, url, actuallyShowPanel, compiler, hotReload, autoPaging, config.autoPageDir, (routes.get("APP_TSX") || ""), (f, p) => {
-                    routes.set(`GET:${p}`, (req, res) => {
-                        res.setHeader("Content-Type", "application/javascript");
+                    routes.set(`GET:${p}`, (_, res) => {
+                        res.setHeader("Content-Type", p.toLowerCase().endsWith(".map") ? "application/json" : "application/javascript");
                         res.end(f);
                     });
-                }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat);
+                }, (p) => { routes.delete(`GET:${p}`); }, req.cookies.dat, config_.dat, config_.renderType, config_.patchForSsr);
                 res.setHeader("Content-Type", "text/html");
                 res.writeHead(404);
                 html = html.replace("<script>", "<script>\nwindow.__status_code__ = 404;");
@@ -934,7 +1284,17 @@ async function start() {
         if (fs.existsSync(_404Built))
             watchSet.add(_404Built);
         for (const dir of watchSet) {
-            safeWatch(dir, notifyHmrClients);
+            safeWatch(dir, () => {
+                if (buildStyle === "super") {
+                    try {
+                        refreshSuperRouteManifest(process.cwd(), config, pagesDir, publicDir);
+                    }
+                    catch (error) {
+                        console.error("[HostJS] Failed to refresh Super route manifest:", error);
+                    }
+                }
+                notifyHmrClients();
+            });
         }
     }
     return server;