@elurjs/kit 2.4.9 → 2.5.0

package/dist/lib/cli.js

@@ -6,10 +6,12 @@ import { existsSync, watch } from "node:fs";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { renderToString } from "@elurjs/core/server";
-import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import "@elurjs/core";
+import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { consumeImageRegistry, setImageManifest } from "./image/registry.js";
 import { build, loadConfigFromFile } from "vite";
+import { networkInterfaces } from "node:os";
+import { AsyncLocalStorage } from "node:async_hooks";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __esmMin = (fn, res, err) => () => {
@@ -201,8 +203,35 @@ function toIdentifier(name, index) {
 	const cleaned = name.replace(/[^a-zA-Z0-9_$]/g, "_");
 	return /^[a-zA-Z_$]/.test(cleaned) ? `${cleaned}_${index}` : `_${cleaned}_${index}`;
 }
+/**
+* Source for the standalone router module emitted in split builds. Router
+* options are baked in so the public module takes no arguments.
+*/
+function buildRouterEntrySource(routerImport = "@elurjs/kit/router", options = {}) {
+	const opts = {};
+	if (options.prefetch === false) opts.prefetch = false;
+	if (options.morph === true) opts.morph = true;
+	if (options.loadingIndicator === true) opts.loadingIndicator = true;
+	const args = Object.keys(opts).length > 0 ? JSON.stringify(opts) : "";
+	return `// AUTO-GENERATED by @elurjs/kit. Do not edit.
+import { startClientRouter } from ${JSON.stringify(routerImport)};
+
+startClientRouter(${args});
+`;
+}
+/**
+* Serializes the startClientRouter options embedded in a combined entry.
+* Only non-default flags are emitted to keep the generated code minimal.
+*/
+function routerCallArgs(router) {
+	const opts = {};
+	if (router?.prefetch === false) opts.prefetch = false;
+	if (router?.morph === true) opts.morph = true;
+	if (router?.loadingIndicator === true) opts.loadingIndicator = true;
+	return Object.keys(opts).length > 0 ? JSON.stringify(opts) : "";
+}
 /** Builds the source code of the client entry module. */
-function buildEntrySource(islands, outFile, hydrateImport = "@elurjs/kit/island", routerImport = "@elurjs/kit/router") {
+function buildEntrySource(islands, outFile, hydrateImport = "@elurjs/kit/island", routerImport = "@elurjs/kit/router", router) {
 	const registryLines = islands.map((island, i) => ({
 		ident: toIdentifier(island.name, i),
 		name: island.name,
@@ -211,18 +240,36 @@ function buildEntrySource(islands, outFile, hydrateImport = "@elurjs/kit/island"
 	const islandHydration = registryLines ? `const registry = {
 ${registryLines}
 };
-// Defer hydration until the browser is idle so the first paint is not
-// blocked. Islands with directive "load" already have SSR-rendered DOM,
-// so the user sees content immediately — hydration only adds interactivity.
 const hydrate = () => hydrateIslands(registry);
-if ("requestIdleCallback" in window) {
-  requestIdleCallback(hydrate, { timeout: 2000 });
-} else {
-  setTimeout(hydrate, 0);
-}
+// Islands inside persisted nodes must not be disposed across navigations.
+// The router announces the survivors in the elur:before-render detail; the
+// DOM query fallback covers hosts that dispatch it without detail.
+const cleanup = (persisted) =>
+  cleanupHydratedIslands({
+    except: persisted ?? document.querySelectorAll("[data-elur-persist]"),
+  });
+let sawBeforeRender = false;
+
+// Hydrate right after parse: module scripts are deferred, so this already
+// runs once the DOM is ready. Directives schedule themselves inside
+// hydrateIslands — "load"/"only" run immediately (real Astro semantics),
+// "idle"/"visible" keep their deferred scheduling.
+hydrate();
+
+// The router dispatches elur:before-render BEFORE swapping #app: islands are
+// disposed while still attached (Fase A2), except persisted subtrees.
+document.addEventListener("elur:before-render", (event) => {
+  sawBeforeRender = true;
+  cleanup(event.detail?.persisted);
+});
+
+// Re-hydrate after SPA navigations.
 document.addEventListener("elur:rendered", () => {
-  cleanupHydratedIslands();
-  hydrateIslands(registry);
+  // Compat fallback: hosts that only dispatch elur:rendered (streaming swap
+  // script, hand-rolled integrations) still need the cleanup pass.
+  if (!sawBeforeRender) cleanup();
+  sawBeforeRender = false;
+  hydrate();
 });
 
 // Vite HMR: when an island module (or the entry itself) updates, dispose the
@@ -230,20 +277,15 @@ document.addEventListener("elur:rendered", () => {
 // dynamic import() resolves to the fresh modules, so no full page reload is
 // needed (progressive enhancement, audit §10.2 / §12.2).
 if (import.meta.hot) {
-  import.meta.hot.accept((newModule) => {
+  import.meta.hot.accept(() => {
     cleanupHydratedIslands();
     hydrateIslands(registry);
-    if (newModule) {
-      // Re-run the module so its side effects (router, listeners) apply.
-    }
   });
 }` : "";
+	const embedRouter = router ? router.enabled !== false && !router.separate : true;
 	return `// AUTO-GENERATED by @elurjs/kit. Do not edit.
-import { startClientRouter } from ${JSON.stringify(routerImport)};
-import { hydrateIslands, cleanupHydratedIslands } from ${JSON.stringify(hydrateImport)};
-
-startClientRouter();
-${islandHydration}
+${embedRouter ? `import { startClientRouter } from ${JSON.stringify(routerImport)};\n` : ""}import { hydrateIslands, cleanupHydratedIslands } from ${JSON.stringify(hydrateImport)};
+${embedRouter ? `\nstartClientRouter(${routerCallArgs(router)});\n` : ""}${islandHydration}
 `;
 }
 /** Computes a POSIX-style relative import specifier between two files. */
@@ -253,15 +295,23 @@ function toImportSpecifier(fromFile, toFile) {
 	return spec;
 }
 /**
-* Generates and writes the client entry module for the given islands.
+* Generates and writes the client entry module for the given islands. When
+* `options.router.separate` is set (and the router is enabled), a standalone
+* router module is written alongside it (default: `router.ts` next to the
+* entry — bundle it as a second input to emit `/_elur/router.js`).
 *
 * @param options Generation options.
 * @returns The absolute path of the written entry file.
 */
 async function generateClientEntry(options) {
-	const source = buildEntrySource(options.islands, options.outFile, options.hydrateImport, options.routerImport);
+	const source = buildEntrySource(options.islands, options.outFile, options.hydrateImport, options.routerImport, options.router);
 	await mkdir(dirname(options.outFile), { recursive: true });
 	await writeFile(options.outFile, source, "utf8");
+	if (options.router) {
+		const routerFile = options.router.outFile ?? join(dirname(options.outFile), "router.ts");
+		const routerSource = options.router.enabled === false ? `// AUTO-GENERATED by @elurjs/kit. Do not edit.\n// router.enabled: false — intentionally empty.\nexport {};\n` : buildRouterEntrySource(options.routerImport ?? "@elurjs/kit/router", options.router);
+		await writeFile(routerFile, routerSource, "utf8");
+	}
 	return options.outFile;
 }
 //#endregion
@@ -301,6 +351,18 @@ var init_render_to_string = __esmMin((() => {
 }));
 //#endregion
 //#region src/build/document-shell.ts
+/**
+* Extracts the inner HTML of `#app` from a full document produced by
+* `documentShell`. Returns `undefined` when the markers are missing (e.g. a
+* hand-written document).
+*/
+function extractAppBody(html) {
+	const start = html.indexOf(APP_START_MARKER);
+	if (start < 0) return void 0;
+	const end = html.indexOf(APP_END_MARKER, start + 21);
+	if (end < 0) return void 0;
+	return html.slice(start + 21, end);
+}
 function escapeHtml(value) {
 	return value.replace(/[&<>"']/g, (c) => HTML_ESCAPES[c]);
 }
@@ -348,12 +410,33 @@ function buildHeadTags(metadata, fallbackTitle) {
 	if (metadata.other) for (const [name, content] of Object.entries(metadata.other)) tags.push(`<meta data-elur-head name="${escapeHtml(name)}" content="${escapeHtml(content)}" />`);
 	return tags.map((t) => `\n    ${t}`).join("");
 }
+/**
+* Document-level Speculation Rules (Chromium-only, ignored elsewhere).
+*
+* `href_matches: "/*"` scopes the rule to same-origin path links; the
+* `selector_matches` exclusions keep downloads, new-tab links, router-opt-outs
+* and explicit `data-no-speculation` links out of speculation. Actions are
+* POST endpoints reached through forms/`callAction`, never through document
+* links, so they are not speculated. `eagerness: "moderate"` speculates on
+* hover — the same trigger as the client router's prefetch.
+*/
+function speculationRulesScript(mode) {
+	return `\n    <script type="speculationrules">${JSON.stringify({ [mode]: [{
+		source: "document",
+		where: { and: [{ href_matches: "/*" }, { not: { selector_matches: "a[download], a[target], a[data-no-router], a[data-no-speculation]" } }] },
+		eagerness: "moderate"
+	}] })}<\/script>`;
+}
 /** Wraps rendered body HTML into a full HTML document. */
 function documentShell(opts) {
-	const { body, title = "Elur Kit App", lang = "es", data, actions, clientEntry, htmlAttributes, headScripts, headLinks, metadata } = opts;
+	const { body, title = "Elur Kit App", lang = "es", data, actions, clientEntry, routerEntry, htmlAttributes, headScripts, headLinks, metadata } = opts;
 	const dataScript = data !== void 0 ? `\n    <script type="application/json" id="elur-data">${serializeData(data)}<\/script>` : "";
 	const actionsScript = actions && Object.keys(actions).length > 0 ? `\n    <script type="application/json" id="elur-actions">${serializeData(actions)}<\/script>` : "";
+	const modulePreload = (src) => `\n    <link rel="modulepreload" href="${escapeHtml(src)}" />`;
+	const preloads = (clientEntry ? modulePreload(clientEntry) : "") + (routerEntry ? modulePreload(routerEntry) : "");
 	const entryScript = clientEntry ? `\n    <script type="module" src="${escapeHtml(clientEntry)}"><\/script>` : "";
+	const routerScript = routerEntry ? `\n    <script type="module" src="${escapeHtml(routerEntry)}"><\/script>` : "";
+	const speculationScript = opts.speculation ? speculationRulesScript(opts.speculation) : "";
 	const htmlAttrs = htmlAttributes ? Object.entries(htmlAttributes).filter(([, value]) => value !== void 0 && value !== null && value !== "").map(([key, value]) => ` ${escapeHtml(key)}="${escapeHtml(String(value))}"`).join("") : "";
 	const headScriptsHtml = headScripts ? headScripts.filter((script) => typeof script === "string" && script.trim().length > 0).map((script) => {
 		if (script.trimStart().startsWith("<script")) return `\n    ${script}`;
@@ -362,20 +445,20 @@ function documentShell(opts) {
 	const headTags = metadata ? buildHeadTags(metadata, title) : "";
 	const titleTag = metadata?.title ? "" : `\n    <title>${escapeHtml(title)}</title>`;
 	const headLinksHtml = headLinks ? headLinks.filter((link) => typeof link === "string" && link.trim().length > 0).map((link) => `\n    ${link}`).join("") : "";
-	const renderEndpointMeta = opts.renderEndpoint === false ? "\n    <meta name=\"elur:render-endpoint\" content=\"off\" />" : "";
+	const renderEndpointMeta = opts.renderEndpoint === false && opts.routerEnabled !== false ? "\n    <meta name=\"elur:render-endpoint\" content=\"off\" />" : "";
 	return `<!DOCTYPE html>
 <html lang="${escapeHtml(lang)}"${htmlAttrs}>
   <head>
     <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />${renderEndpointMeta}${titleTag}${headTags}${headLinksHtml}${headScriptsHtml}
+    <meta name="viewport" content="width=device-width, initial-scale=1" />${renderEndpointMeta}${titleTag}${headTags}${headLinksHtml}${headScriptsHtml}${preloads}${speculationScript}
   </head>
   <body>
-    <div id="app">${body}</div>${dataScript}${actionsScript}${entryScript}
+    <div id="app">${APP_START_MARKER}${body}${APP_END_MARKER}</div>${dataScript}${actionsScript}${entryScript}${routerScript}
   </body>
 </html>
 `;
 }
-var HTML_ESCAPES;
+var HTML_ESCAPES, APP_START_MARKER, APP_END_MARKER;
 var init_document_shell = __esmMin((() => {
 	HTML_ESCAPES = {
 		"&": "&amp;",
@@ -384,6 +467,14 @@ var init_document_shell = __esmMin((() => {
 		"\"": "&quot;",
 		"'": "&#39;"
 	};
+	APP_START_MARKER = "<!--elur:app:start-->";
+	APP_END_MARKER = "<!--elur:app:end-->";
+}));
+//#endregion
+//#region src/island/island.ts
+var ISLAND_MARKER_ATTR;
+var init_island = __esmMin((() => {
+	ISLAND_MARKER_ATTR = "data-elur-island";
 }));
 //#endregion
 //#region src/action/error-store.ts
@@ -560,7 +651,7 @@ function collectShellExtras(pageData, layoutDataList) {
 	};
 }
 async function renderPage(options) {
-	const { route, params = {}, searchParams = new URLSearchParams(), config, importer = defaultImport$1, actions, request } = options;
+	const { route, params = {}, searchParams = new URLSearchParams(), config, importer = defaultImport$2, actions, request } = options;
 	const { default: PageComponent, generateMetadata } = await importer(route.pagePath);
 	let data;
 	let revalidate;
@@ -667,6 +758,16 @@ async function renderPage(options) {
 	});
 	if (!metadata) metadata = extractMetadata(data) ?? extractMetadataFromList(layoutDataList);
 	const resolvedTitle = metadata?.title ?? title;
+	const hasIslands = body.includes(ISLAND_MARKER_ATTR);
+	const routerCfg = config.router;
+	const routerEnabled = routerCfg?.enabled !== false;
+	let clientEntry;
+	let routerEntry;
+	if (!routerCfg || config.js === "legacy") clientEntry = config.clientEntry;
+	else if (routerCfg.entry) {
+		if (hasIslands) clientEntry = config.clientEntry;
+		if (routerEnabled) routerEntry = routerCfg.entry;
+	} else if (hasIslands || routerEnabled) clientEntry = config.clientEntry;
 	const html = documentShell({
 		title: resolvedTitle,
 		lang: config.lang,
@@ -677,7 +778,10 @@ async function renderPage(options) {
 		headScripts,
 		headLinks,
 		metadata,
-		clientEntry: config.clientEntry,
+		clientEntry,
+		routerEntry,
+		routerEnabled: routerCfg ? routerEnabled : void 0,
+		speculation: routerCfg?.speculation,
 		renderEndpoint: config.renderEndpoint
 	});
 	const head = metadata ? buildHeadTags(metadata, resolvedTitle) : "";
@@ -687,7 +791,8 @@ async function renderPage(options) {
 		clearActionErrorCookie,
 		head,
 		resolvedTitle,
-		cachePolicy
+		cachePolicy,
+		data
 	};
 }
 /** Extracts a `metadata` field from a loader data object, if present. */
@@ -725,13 +830,14 @@ async function renderErrorPage(options) {
 		return;
 	}
 }
-var defaultImport$1;
+var defaultImport$2;
 var init_render = __esmMin((() => {
 	init_render_to_string();
 	init_document_shell();
+	init_island();
 	init_error_store();
 	init_policy();
-	defaultImport$1 = (path) => import(path);
+	defaultImport$2 = (path) => import(path);
 }));
 //#endregion
 //#region src/action/scan.ts
@@ -770,6 +876,14 @@ function actionNames(actions) {
 }
 var init_scan = __esmMin((() => {}));
 //#endregion
+//#region __vite-optional-peer-dep:sharp:@elurjs/kit
+var kit_exports = /* @__PURE__ */ __exportAll({ default: () => kit_default });
+var kit_default;
+var init_kit = __esmMin((() => {
+	kit_default = {};
+	throw new Error(`Could not resolve "sharp" imported by "@elurjs/kit". Is it installed?`);
+}));
+//#endregion
 //#region src/image/service.ts
 init_render();
 init_scan();
@@ -783,7 +897,7 @@ async function loadSharp() {
 	if (sharpLoader === null) return null;
 	if (sharpLoader) return sharpLoader();
 	try {
-		const sharp = (await import("sharp")).default;
+		const sharp = (await Promise.resolve().then(() => (init_kit(), kit_exports))).default;
 		if (typeof sharp !== "function") {
 			sharpLoader = null;
 			return null;
@@ -1041,6 +1155,132 @@ async function runIntegrationHook(integrations, hook, args) {
 	}
 }
 //#endregion
+//#region src/seo/index.ts
+/**
+* SEO utilities — sitemap.xml and robots.txt generation.
+*
+* @module
+*/
+/**
+* Generates a `sitemap.xml` file from a list of URLs.
+*
+* @example
+* ```ts
+* import { generateSitemap } from "@elurjs/kit/seo";
+*
+* await generateSitemap({
+*   siteUrl: "https://elur-kit.dev",
+*   outDir: "./dist",
+*   urls: [
+*     "/",
+*     "/docs/introduction",
+*     { url: "/docs/routing", changefreq: "weekly", priority: 0.8 },
+*   ],
+* });
+* ```
+*/
+async function generateSitemap(config) {
+	const { siteUrl, urls, outDir } = config;
+	const base = siteUrl.replace(/\/$/, "");
+	const xml = `<?xml version="1.0" encoding="UTF-8"?>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+${urls.map((entry) => {
+		const e = typeof entry === "string" ? { url: entry } : entry;
+		const lines = [`  <url>`, `    <loc>${escapeXml$1(`${base}${e.url.startsWith("/") ? "" : "/"}${e.url}`)}</loc>`];
+		if (e.lastmod) lines.push(`    <lastmod>${e.lastmod}</lastmod>`);
+		if (e.changefreq) lines.push(`    <changefreq>${e.changefreq}</changefreq>`);
+		if (e.priority !== void 0) lines.push(`    <priority>${e.priority.toFixed(1)}</priority>`);
+		lines.push(`  </url>`);
+		return lines.join("\n");
+	}).join("\n")}
+</urlset>
+`;
+	const filePath = join(outDir, "sitemap.xml");
+	await mkdir(dirname(filePath), { recursive: true });
+	await writeFile(filePath, xml, "utf8");
+	return filePath;
+}
+function escapeXml$1(str) {
+	return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+//#endregion
+//#region src/seo/sitemap-from-routes.ts
+/**
+* Generates a sitemap.xml from the route manifest.
+*
+* Static routes are included automatically. Dynamic routes require the author
+* to provide URLs via `extraUrls` or a `generateSitemapUrls()` export.
+*
+* For large sites (>50,000 URLs), a sitemap index is generated.
+*/
+async function generateSitemapFromRoutes(options) {
+	const { siteUrl, outDir, routes, extraUrls = [], maxUrlsPerSitemap = 5e4 } = options;
+	const routeUrls = [];
+	for (const page of routes.pages) {
+		if (page.params.length > 0) continue;
+		if (page.path === "/404" || page.path === "/500") continue;
+		if (page.path.startsWith("/_elur") || page.path.startsWith("/__elur-js")) continue;
+		routeUrls.push({
+			url: page.path,
+			changefreq: options.defaultChangefreq,
+			priority: options.defaultPriority
+		});
+	}
+	const allUrls = [...routeUrls, ...extraUrls];
+	if (allUrls.length <= maxUrlsPerSitemap) return [await generateSitemap({
+		siteUrl,
+		outDir,
+		urls: allUrls
+	})];
+	return generateSitemapIndex({
+		siteUrl,
+		outDir,
+		urls: allUrls,
+		maxUrlsPerSitemap
+	});
+}
+/**
+* Generates a sitemap index file that references multiple sitemap files.
+* Used for large sites (>50,000 URLs).
+*/
+async function generateSitemapIndex(options) {
+	const { siteUrl, outDir, urls, maxUrlsPerSitemap } = options;
+	const base = siteUrl.replace(/\/$/, "");
+	const files = [];
+	const sitemapUrls = [];
+	for (let i = 0; i < urls.length; i += maxUrlsPerSitemap) {
+		const chunk = urls.slice(i, i + maxUrlsPerSitemap);
+		const filename = `sitemap-${Math.floor(i / maxUrlsPerSitemap) + 1}.xml`;
+		const { writeFile, mkdir } = await import("node:fs/promises");
+		const { join, dirname } = await import("node:path");
+		const xml = `<?xml version="1.0" encoding="UTF-8"?>\n<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n${chunk.map((entry) => {
+			const e = typeof entry === "string" ? { url: entry } : entry;
+			const lines = [`  <url>`, `    <loc>${escapeXml(`${base}${e.url.startsWith("/") ? "" : "/"}${e.url}`)}</loc>`];
+			if (e.lastmod) lines.push(`    <lastmod>${e.lastmod}</lastmod>`);
+			if (e.changefreq) lines.push(`    <changefreq>${e.changefreq}</changefreq>`);
+			if (e.priority !== void 0) lines.push(`    <priority>${e.priority.toFixed(1)}</priority>`);
+			lines.push(`  </url>`);
+			return lines.join("\n");
+		}).join("\n")}\n</urlset>\n`;
+		const filePath = join(outDir, filename);
+		await mkdir(dirname(filePath), { recursive: true });
+		await writeFile(filePath, xml, "utf8");
+		files.push(filePath);
+		sitemapUrls.push(`${base}/${filename}`);
+	}
+	const { writeFile, mkdir } = await import("node:fs/promises");
+	const { join, dirname } = await import("node:path");
+	const indexXml = `<?xml version="1.0" encoding="UTF-8"?>\n<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n${sitemapUrls.map((url) => `  <sitemap>\n    <loc>${escapeXml(url)}</loc>\n  </sitemap>`).join("\n")}\n</sitemapindex>\n`;
+	const indexPath = join(outDir, "sitemap.xml");
+	await mkdir(dirname(indexPath), { recursive: true });
+	await writeFile(indexPath, indexXml, "utf8");
+	files.push(indexPath);
+	return files;
+}
+function escapeXml(str) {
+	return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+//#endregion
 //#region src/build/build.ts
 init_route_scanner();
 function urlToFilePath(outDir, urlPath) {
@@ -1077,8 +1317,14 @@ async function build$1(config) {
 	} catch (error) {
 		if (error.code !== "ENOENT") throw error;
 	}
+	const reportPhase = (name, start) => {
+		config.onPhase?.(name, performance.now() - start);
+	};
+	let phaseStart = performance.now();
 	const routes = await scanRoutes(config.appDir);
-	const publicActions = actionNames(await scanActions(config.appDir));
+	const actions = await scanActions(config.appDir);
+	reportPhase("scan", phaseStart);
+	const publicActions = actionNames(actions);
 	const result = {
 		pages: 0,
 		skipped: [],
@@ -1092,8 +1338,17 @@ async function build$1(config) {
 		islands: result.islands,
 		outFile: config.generatedEntry,
 		hydrateImport: config.hydrateImport,
-		routerImport: config.routerImport
+		routerImport: config.routerImport,
+		router: config.router ? {
+			enabled: config.router.enabled !== false,
+			prefetch: config.router.prefetch,
+			morph: config.router.morph,
+			loadingIndicator: config.router.loadingIndicator,
+			separate: config.router.separate === true && config.js !== "legacy",
+			outFile: config.router.outFile
+		} : void 0
 	});
+	phaseStart = performance.now();
 	for (const route of routes.pages) {
 		if (!isDynamic(route.path)) {
 			const filePath = await buildPage(config, route, publicActions);
@@ -1111,7 +1366,9 @@ async function build$1(config) {
 	const errorConfig = {
 		lang: config.lang,
 		clientEntry: config.clientEntry,
-		renderEndpoint: false
+		renderEndpoint: false,
+		router: pageRouterConfig(config),
+		js: config.js
 	};
 	if (routes.error404) {
 		const result404 = await renderErrorPage({
@@ -1141,9 +1398,11 @@ async function build$1(config) {
 			result.files.push(filePath);
 		}
 	}
+	reportPhase("pages", phaseStart);
 	const registeredImages = consumeImageRegistry();
 	let manifest = null;
 	if (registeredImages.length > 0 && config.publicDir) {
+		phaseStart = performance.now();
 		const manifestPath = join(config.outDir, ".elur", "image-manifest.json");
 		const processResult = await processImageBatch(registeredImages, {
 			publicDir: config.publicDir,
@@ -1200,12 +1459,33 @@ async function build$1(config) {
 				}
 			}
 		}
+		reportPhase("images", phaseStart);
 	}
 	setImageManifest(null);
-	if (config.integrations && config.integrations.length > 0) await runIntegrationHook(config.integrations, "build", [result, {
-		root: config.root ?? config.outDir,
-		command: "build"
-	}]);
+	if (config.integrations && config.integrations.length > 0) {
+		phaseStart = performance.now();
+		await runIntegrationHook(config.integrations, "build", [result, {
+			root: config.root ?? config.outDir,
+			command: "build"
+		}]);
+		reportPhase("integrations", phaseStart);
+	}
+	if (config.site) {
+		phaseStart = performance.now();
+		let sitemapExists = false;
+		try {
+			sitemapExists = (await stat(join(config.outDir, "sitemap.xml"))).isFile();
+		} catch {}
+		if (!sitemapExists) {
+			const sitemapFiles = await generateSitemapFromRoutes({
+				siteUrl: config.site,
+				outDir: config.outDir,
+				routes
+			});
+			result.files.push(...sitemapFiles);
+		}
+		reportPhase("sitemap", phaseStart);
+	}
 	return result;
 }
 async function buildPage(config, route, actions) {
@@ -1228,7 +1508,9 @@ async function buildConcretePage(config, route, params, actions) {
 		config: {
 			lang: config.lang,
 			clientEntry: config.clientEntry,
-			renderEndpoint: false
+			renderEndpoint: false,
+			router: pageRouterConfig(config),
+			js: config.js
 		},
 		actions
 	});
@@ -1238,6 +1520,20 @@ async function buildConcretePage(config, route, params, actions) {
 	await writeFile(filePath, htmlOut, "utf8");
 	return filePath;
 }
+/**
+* The router slice of the per-page render config: `enabled` gates script/meta
+* emission, `entry` is advertised only for split bundles, and `speculation`
+* produces the Speculation Rules block on static pages.
+*/
+function pageRouterConfig(config) {
+	if (!config.router) return void 0;
+	const separate = config.router.separate === true && config.js !== "legacy";
+	return {
+		enabled: config.router.enabled !== false,
+		entry: separate ? config.router.entry ?? "/_elur/router.js" : void 0,
+		speculation: config.router.speculation
+	};
+}
 //#endregion
 //#region src/vite/interpolation-plugin.ts
 function warnLegacyOnce() {
@@ -1792,402 +2088,830 @@ async function transformProjectFiles(options) {
 	}
 }
 //#endregion
-//#region src/errors.ts
-/**
-* Type guard for action failures. Uses the marker field so it works across
-* bundling boundaries where `instanceof` fails.
-*/
-function isActionFailure(value) {
-	return typeof value === "object" && value !== null && value.__elur_js_action_failure === true;
-}
-/**
-* Type guard for redirects. Uses the marker field so it works across bundling
-* boundaries where `instanceof` fails.
-*/
-function isRedirectResponse(value) {
-	return typeof value === "object" && value !== null && value.__elur_js_action_redirect === true;
-}
-/**
-* Maps an arbitrary thrown value to a public-safe error info. By default the
-* public message is generic; `includeDetail` (dev/verbose mode) appends the
-* original `Error.message` for local debugging.
-*/
-function toPublicErrorInfo(error, options = {}) {
-	const code = "INTERNAL_SERVER_ERROR";
-	const status = 500;
-	if (options.includeDetail && error instanceof Error && error.message) return {
-		code,
-		status,
-		message: error.message
-	};
-	return {
-		code,
-		status,
-		message: "Internal Server Error"
+//#region src/runtime/node-http.ts
+var GlobalAbortController = globalThis.AbortController ?? AbortController;
+function incomingMessageToRequest(req, body) {
+	const headers = new Headers();
+	for (let index = 0; index < req.rawHeaders.length; index += 2) headers.append(req.rawHeaders[index], req.rawHeaders[index + 1]);
+	const controller = new GlobalAbortController();
+	req.once("aborted", () => controller.abort());
+	req.once("close", () => {
+		if (!req.complete) controller.abort();
+	});
+	const protocol = req.socket.encrypted ? "https" : "http";
+	const init = {
+		method: req.method ?? "GET",
+		headers,
+		signal: controller.signal
 	};
+	if (body !== void 0 && body !== null && init.method !== "GET" && init.method !== "HEAD") init.body = body;
+	return new Request(`${protocol}://${headers.get("host") ?? "localhost"}${req.url ?? "/"}`, init);
 }
 /**
-* Builds a production-safe JSON error Response. Logs the raw error separately
-* (never reflected in the response body) and keeps the request id header.
+* Writes a Web `Response` to a Node `ServerResponse`, streaming the body.
+*
+* Unlike `res.end(Buffer.from(await response.arrayBuffer()))`, this forwards
+* chunks as they are produced — required for streaming SSR responses to reach
+* the client progressively. Buffered (non-stream) bodies behave exactly as
+* before. Honors backpressure (`drain`) and cancels the upstream stream when
+* the client disconnects (`close` before `finish`).
 */
-function publicErrorResponse(error, options = {}) {
-	const info = toPublicErrorInfo(error, options);
-	const headers = {
-		"Content-Type": "application/json; charset=utf-8",
-		"Cache-Control": "no-store"
+async function sendWebResponse(res, response) {
+	const headers = Object.fromEntries(response.headers.entries());
+	if (response.body !== null) {
+		delete headers["content-length"];
+		delete headers["transfer-encoding"];
+	}
+	res.writeHead(response.status, headers);
+	const body = response.body;
+	if (!body) {
+		res.end();
+		return;
+	}
+	const reader = body.getReader();
+	let done = false;
+	const onClose = () => {
+		if (!done) reader.cancel().catch(() => {});
 	};
-	if (options.requestId) headers["X-Request-Id"] = options.requestId;
-	return new Response(JSON.stringify({ error: info }), {
-		status: info.status,
-		headers
-	});
+	res.once("close", onClose);
+	try {
+		for (;;) {
+			const { done: readDone, value } = await reader.read();
+			if (readDone) break;
+			if (value && value.byteLength > 0 && !res.write(value)) await new Promise((resolveDrain) => res.once("drain", resolveDrain));
+		}
+		done = true;
+		res.end();
+	} catch {
+		done = true;
+		res.destroy();
+	} finally {
+		res.removeListener("close", onClose);
+	}
 }
-var init_errors = __esmMin((() => {}));
 //#endregion
-//#region src/action/origin.ts
+//#region src/runtime/logger.ts
 /**
-* Returns the host:port of a URL string, or undefined if it cannot be parsed.
+* Redacts sensitive fields from a log fields object.
+* Recursively redacts keys that match sensitive header names.
 */
-function originOf(urlString) {
-	if (!urlString) return void 0;
-	try {
-		const url = new URL(urlString);
-		if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
-		return url.origin;
-	} catch {
-		return;
+function redactSensitive(fields) {
+	const result = {};
+	for (const [key, value] of Object.entries(fields)) {
+		const lowerKey = key.toLowerCase();
+		if (SENSITIVE_HEADERS.has(lowerKey)) result[key] = "[REDACTED]";
+		else if (typeof value === "object" && value !== null && !Array.isArray(value)) result[key] = redactSensitive(value);
+		else result[key] = value;
 	}
+	return result;
 }
 /**
-* Verifies that a request originates from the same host (or an allow-listed
-* origin). Returns an error message when the request must be rejected, or
-* undefined when it is allowed.
-*
-* @param request The incoming Request to actions.
-* @param options Origin check configuration.
+* Creates a logger for a request, optionally using the request's
+* X-Request-ID header if present.
 */
-function verifyOrigin(request, options = {}) {
-	const targetOrigin = originOf(request.url);
-	if (!targetOrigin) return "Invalid target URL";
-	const origin = request.headers.get("Origin");
-	const referer = request.headers.get("Referer");
-	if (!origin && !referer) return options.strictOrigin ? "Missing Origin and Referer headers" : void 0;
-	const sourceOrigin = origin ? originOf(origin) : originOf(referer);
-	if (!sourceOrigin) return origin ? "Invalid Origin header" : "Invalid Referer header";
-	if (sourceOrigin === targetOrigin) return void 0;
-	if (options.allowedOrigins?.some((allowed) => originOf(allowed) === sourceOrigin)) return void 0;
-	return `Cross-origin request blocked: source "${sourceOrigin}" != target "${targetOrigin}"`;
-}
-/** Builds a 403 Response for a rejected origin. */
-function originForbidden(message) {
-	return new Response(message, {
-		status: 403,
-		headers: { "Content-Type": "text/plain; charset=utf-8" }
+function createRequestLogger(request, minLevel) {
+	const requestId = request?.headers.get("X-Request-ID") ?? void 0;
+	return new StructuredLogger({
+		minLevel,
+		requestId
 	});
 }
-var init_origin = __esmMin((() => {}));
-//#endregion
-//#region src/action/server.ts
-/**
-* Reads the request body as text, enforcing a maximum size.
-* Returns a 413 response if the body exceeds the limit.
-*/
-async function readBodyWithLimit(request, limit) {
-	const contentLength = request.headers.get("Content-Length");
-	if (contentLength && parseInt(contentLength, 10) > limit) return {
-		ok: false,
-		response: new Response("Request body too large", {
-			status: 413,
-			headers: { "Content-Type": "text/plain" }
-		})
-	};
-	const reader = request.body?.getReader();
-	if (!reader) return {
-		ok: true,
-		text: ""
+var LEVEL_PRIORITY, SENSITIVE_HEADERS, StructuredLogger;
+var init_logger = __esmMin((() => {
+	LEVEL_PRIORITY = {
+		debug: 10,
+		info: 20,
+		warn: 30,
+		error: 40
 	};
-	const chunks = [];
-	let totalSize = 0;
-	try {
-		for (;;) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			totalSize += value.byteLength;
-			if (totalSize > limit) {
-				try {
-					reader.cancel();
-				} catch {}
-				return {
-					ok: false,
-					response: new Response("Request body too large", {
-						status: 413,
-						headers: { "Content-Type": "text/plain" }
-					})
-				};
+	SENSITIVE_HEADERS = /* @__PURE__ */ new Set([
+		"cookie",
+		"authorization",
+		"set-cookie",
+		"x-api-key",
+		"x-auth-token"
+	]);
+	StructuredLogger = class {
+		minLevel;
+		requestId;
+		timings = [];
+		entries = [];
+		constructor(options = {}) {
+			this.minLevel = options.minLevel ?? (process.env.NODE_ENV === "production" ? "info" : "debug");
+			this.requestId = options.requestId ?? randomUUID();
+		}
+		/** Returns the request ID for this logger instance. */
+		getRequestId() {
+			return this.requestId;
+		}
+		/** Logs a debug message. */
+		debug(message, fields) {
+			this.log("debug", message, fields);
+		}
+		/** Logs an info message. */
+		info(message, fields) {
+			this.log("info", message, fields);
+		}
+		/** Logs a warning. */
+		warn(message, fields) {
+			this.log("warn", message, fields);
+		}
+		/** Logs an error. */
+		error(message, fields) {
+			this.log("error", message, fields);
+		}
+		/** Records a Server-Timing metric. */
+		timing(name, durationMs, description) {
+			this.timings.push({
+				name,
+				durationMs,
+				description
+			});
+		}
+		/** Starts a timer and returns a function to stop it and record the timing. */
+		startTimer(name, description) {
+			const start = performance.now();
+			return () => {
+				this.timing(name, performance.now() - start, description);
+			};
+		}
+		/** Returns the Server-Timing header value. */
+		getServerTimingHeader() {
+			return this.timings.map((t) => {
+				const desc = t.description ? `;desc="${t.description}"` : "";
+				return `${t.name};dur=${t.durationMs.toFixed(1)}${desc}`;
+			}).join(", ");
+		}
+		/** Returns all log entries collected so far. */
+		getEntries() {
+			return this.entries;
+		}
+		log(level, message, fields) {
+			if (LEVEL_PRIORITY[level] < LEVEL_PRIORITY[this.minLevel]) return;
+			const entry = {
+				level,
+				message,
+				requestId: this.requestId,
+				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+				fields: fields ? redactSensitive(fields) : void 0
+			};
+			this.entries.push(entry);
+			if (process.env.NODE_ENV === "production") {
+				const output = JSON.stringify(entry);
+				if (level === "error") console.error(output);
+				else if (level === "warn") console.warn(output);
+				else console.log(output);
+			} else {
+				const output = `${`[${level.toUpperCase()}]`} ${message}${entry.fields ? " " + JSON.stringify(entry.fields) : ""}`;
+				if (level === "error") console.error(output);
+				else if (level === "warn") console.warn(output);
+				else console.log(output);
 			}
-			chunks.push(value);
 		}
-	} finally {
-		try {
-			reader.releaseLock();
-		} catch {}
-	}
-	const total = new Uint8Array(totalSize);
-	let offset = 0;
-	for (const chunk of chunks) {
-		total.set(chunk, offset);
-		offset += chunk.byteLength;
-	}
-	return {
-		ok: true,
-		text: new TextDecoder().decode(total)
 	};
+}));
+//#endregion
+//#region src/config/index.ts
+init_logger();
+async function loadElurConfig(options = {}) {
+	const initialRoot = resolve(options.root ?? process.cwd());
+	const configFile = options.configFile ? resolve(initialRoot, options.configFile) : await findConfigFile(initialRoot);
+	let loaded = {};
+	if (configFile) {
+		const result = await loadConfigFromFile({
+			command: options.command === "build" ? "build" : "serve",
+			mode: options.mode ?? "development"
+		}, configFile, initialRoot);
+		if (!result) throw new Error(`[elur-kit] Could not load config: ${configFile}`);
+		loaded = result.config;
+	}
+	const merged = mergeConfig(loaded, options.overrides ?? {});
+	const root = resolve(initialRoot, merged.root ?? ".");
+	const resolved = resolveConfig(root, merged, configFile);
+	await runIntegrationHook(resolved.integrations, "config", [resolved, {
+		root,
+		command: options.command ?? "dev"
+	}]);
+	return resolved;
 }
-function parseFormBody(body) {
-	const params = new URLSearchParams(body);
-	const result = {};
-	for (const [key, value] of params) if (result[key] === void 0) result[key] = value;
-	else if (Array.isArray(result[key])) result[key].push(value);
-	else result[key] = [result[key], value];
-	return result;
+function resolveConfig(root, config, configFile) {
+	if (config.site) new URL(config.site);
+	const base = normalizeBase(config.base ?? "/");
+	const imageQuality = config.images?.quality ?? 80;
+	if (!Number.isFinite(imageQuality) || imageQuality < 1 || imageQuality > 100) throw new Error("[elur-kit] images.quality must be between 1 and 100");
+	return {
+		root,
+		appDir: resolveInside(root, config.appDir ?? "src/app", "appDir"),
+		islandsDir: resolveInside(root, config.islandsDir ?? "src/islands", "islandsDir"),
+		contentDir: resolveInside(root, config.contentDir ?? "src/content", "contentDir"),
+		publicDir: resolveInside(root, config.publicDir ?? "public", "publicDir"),
+		outDir: resolveInside(root, config.outDir ?? "dist", "outDir"),
+		site: config.site,
+		base,
+		trailingSlash: config.trailingSlash ?? "ignore",
+		output: config.output ?? "static",
+		adapter: config.adapter,
+		images: {
+			formats: config.images?.formats ?? ["webp", "avif"],
+			quality: imageQuality,
+			strict: config.images?.strict ?? false
+		},
+		cache: {
+			dir: resolveInside(root, config.cache?.dir ?? ".elur/cache", "cache.dir"),
+			defaultRevalidate: config.cache?.defaultRevalidate,
+			adapter: config.cache?.adapter
+		},
+		security: {
+			allowedOrigins: config.security?.allowedOrigins ?? [],
+			strictOrigin: config.security?.strictOrigin ?? false,
+			bodyLimit: config.security?.bodyLimit ?? 1048576,
+			headers: config.security?.headers === false ? false : config.security?.headers ?? {}
+		},
+		router: {
+			enabled: config.router?.enabled ?? true,
+			prefetch: config.router?.prefetch ?? true,
+			morph: config.router?.morph ?? false,
+			speculation: config.router?.speculation,
+			loadingIndicator: config.router?.loadingIndicator ?? false
+		},
+		js: config.js ?? "modern",
+		logger: { level: config.logger?.level },
+		redirects: config.redirects ?? [],
+		rewrites: config.rewrites ?? [],
+		streaming: config.streaming ?? false,
+		headers: config.headers ?? [],
+		integrations: config.integrations ?? [],
+		configFile
+	};
 }
-async function parseActionRequest(request, bodyLimit = DEFAULT_BODY_LIMIT) {
-	if (request.method !== "POST") return {
-		ok: false,
-		response: new Response("Method not allowed", {
-			status: 405,
-			headers: { "Content-Type": "text/plain" }
-		})
+function mergeConfig(base, override) {
+	return {
+		...base,
+		...override,
+		images: {
+			...base.images,
+			...override.images
+		},
+		cache: {
+			...base.cache,
+			...override.cache
+		},
+		security: {
+			...base.security,
+			...override.security
+		},
+		router: {
+			...base.router,
+			...override.router
+		},
+		logger: {
+			...base.logger,
+			...override.logger
+		},
+		redirects: [...override.redirects ?? [], ...base.redirects ?? []],
+		rewrites: [...override.rewrites ?? [], ...base.rewrites ?? []],
+		headers: [...override.headers ?? [], ...base.headers ?? []],
+		integrations: override.integrations ?? base.integrations
 	};
-	const contentType = request.headers.get("Content-Type") ?? "";
-	const wantsJson = (request.headers.get("Accept") ?? "").includes("application/json");
-	let name;
-	let page;
-	let args = [];
-	if (contentType.includes("application/json")) {
-		const bodyResult = await readBodyWithLimit(request, bodyLimit);
-		if (!bodyResult.ok) return {
-			ok: false,
-			response: bodyResult.response
-		};
-		let body;
+}
+function resolveInside(root, path, name) {
+	const resolved = isAbsolute(path) ? resolve(path) : resolve(root, path);
+	const rel = relative(root, resolved);
+	if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) throw new Error(`[elur-kit] ${name} must stay inside root: ${resolved}`);
+	return resolved;
+}
+function normalizeBase(base) {
+	if (!base.startsWith("/")) throw new Error("[elur-kit] base must start with /");
+	return base === "/" ? base : `${base.replace(/\/+$/, "")}/`;
+}
+var PREFERRED_CONFIG_FILES = [
+	"elur.config.ts",
+	"elur.config.js",
+	"elur.config.mjs"
+];
+async function findConfigFile(root) {
+	for (const name of PREFERRED_CONFIG_FILES) {
+		const path = resolve(root, name);
 		try {
-			body = JSON.parse(bodyResult.text);
-		} catch {
-			return {
-				ok: false,
-				response: new Response("Invalid JSON body", {
-					status: 400,
-					headers: { "Content-Type": "text/plain" }
-				})
-			};
-		}
-		name = body.name;
-		page = body.page;
-		args = Array.isArray(body.args) ? body.args : [];
-	} else if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-		if (contentType.includes("multipart/form-data")) {
-			const contentLength = request.headers.get("Content-Length");
-			if (contentLength && parseInt(contentLength, 10) > bodyLimit) return {
-				ok: false,
-				response: new Response("Request body too large", {
-					status: 413,
-					headers: { "Content-Type": "text/plain" }
-				})
-			};
-			let form;
-			try {
-				form = await request.formData();
-			} catch {
-				return {
-					ok: false,
-					response: new Response("Invalid form body", {
-						status: 400,
-						headers: { "Content-Type": "text/plain" }
-					})
-				};
-			}
-			name = form.get("__elur_js_action_name") ?? void 0;
-			page = form.get("__elur_js_action_page") ?? void 0;
-			const input = {};
-			for (const [key, value] of form) {
-				if (key === "__elur_js_action_name" || key === "__elur_js_action_page") continue;
-				input[key] = value;
-			}
-			args = [input];
-		} else {
-			const bodyResult = await readBodyWithLimit(request, bodyLimit);
-			if (!bodyResult.ok) return {
-				ok: false,
-				response: bodyResult.response
-			};
-			const form = parseFormBody(bodyResult.text);
-			name = form.__elur_js_action_name;
-			page = form.__elur_js_action_page;
-			const input = {};
-			for (const [key, value] of Object.entries(form)) {
-				if (key === "__elur_js_action_name" || key === "__elur_js_action_page") continue;
-				input[key] = value;
+			await access(path);
+			return path;
+		} catch {}
+	}
+}
+//#endregion
+//#region src/manifest/index.ts
+init_scan();
+init_route_scanner();
+async function createAppManifest(config) {
+	const [routes, actions, islands] = await Promise.all([
+		scanRoutes(config.appDir),
+		scanActions(config.appDir),
+		scanIslands(config.islandsDir)
+	]);
+	validateManifestRoutes(routes);
+	validateIslands(islands);
+	const manifest = {
+		version: 1,
+		root: config.root,
+		routes,
+		actions,
+		islands,
+		base: config.base,
+		output: config.output
+	};
+	await runIntegrationHook(config.integrations, "routes", [manifest, {
+		root: config.root,
+		command: "build"
+	}]);
+	return manifest;
+}
+async function writeAppManifest(manifest, path) {
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, JSON.stringify(toPortableManifest(manifest), null, 2), "utf8");
+}
+async function writeRouteTypes(manifest, path) {
+	const routePaths = manifest.routes.pages.map((route) => JSON.stringify(route.path));
+	const actionNames = Object.values(manifest.actions).flatMap((actions) => Object.keys(actions)).filter((name, index, names) => names.indexOf(name) === index).map((name) => JSON.stringify(name));
+	const source = [
+		`export type ElurRoutePath = ${routePaths.length ? routePaths.join(" | ") : "never"};`,
+		`export type ElurActionName = ${actionNames.length ? actionNames.join(" | ") : "never"};`,
+		"export interface ElurRouteParams { [name: string]: string | string[] | undefined }",
+		""
+	].join("\n");
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, source, "utf8");
+}
+function validateManifestRoutes(routes) {
+	const seen = /* @__PURE__ */ new Map();
+	for (const route of routes.pages) {
+		registerRoute(seen, route.path, route.pagePath, "page");
+		assertNotReserved(route.path, route.pagePath);
+	}
+	for (const route of routes.api) {
+		registerRoute(seen, route.path, route.routePath, "API");
+		assertNotReserved(route.path, route.routePath);
+	}
+}
+function registerRoute(seen, path, file, kind) {
+	const existing = seen.get(path);
+	if (existing) throw new Error(`[elur-kit] Duplicate ${kind} route "${path}": ${existing} and ${file}`);
+	seen.set(path, file);
+}
+function assertNotReserved(path, file) {
+	if (path === "/__elur-js" || path.startsWith("/__elur-js/") || path === "/_elur" || path.startsWith("/_elur/")) throw new Error(`[elur-kit] Reserved route "${path}" declared by ${file}`);
+}
+function validateIslands(islands) {
+	const names = /* @__PURE__ */ new Set();
+	for (const island of islands) {
+		if (names.has(island.name)) throw new Error(`[elur-kit] Duplicate island name: ${island.name}`);
+		names.add(island.name);
+	}
+}
+function toPortableManifest(manifest) {
+	const relativePath = (path) => path ? relative(manifest.root, path).split("\\").join("/") : void 0;
+	const routes = {
+		pages: manifest.routes.pages.map((route) => ({
+			...route,
+			pagePath: relativePath(route.pagePath),
+			dataPath: relativePath(route.dataPath),
+			actionPath: relativePath(route.actionPath),
+			loadingPath: relativePath(route.loadingPath),
+			layouts: route.layouts.map((layout) => relativePath(layout))
+		})),
+		api: manifest.routes.api.map((route) => ({
+			...route,
+			routePath: relativePath(route.routePath)
+		})),
+		error404: manifest.routes.error404 ? {
+			...manifest.routes.error404,
+			pagePath: relativePath(manifest.routes.error404.pagePath),
+			dataPath: relativePath(manifest.routes.error404.dataPath),
+			actionPath: relativePath(manifest.routes.error404.actionPath),
+			loadingPath: relativePath(manifest.routes.error404.loadingPath),
+			layouts: manifest.routes.error404.layouts.map((layout) => relativePath(layout))
+		} : void 0,
+		error500: manifest.routes.error500 ? {
+			...manifest.routes.error500,
+			pagePath: relativePath(manifest.routes.error500.pagePath),
+			dataPath: relativePath(manifest.routes.error500.dataPath),
+			actionPath: relativePath(manifest.routes.error500.actionPath),
+			loadingPath: relativePath(manifest.routes.error500.loadingPath),
+			layouts: manifest.routes.error500.layouts.map((layout) => relativePath(layout))
+		} : void 0
+	};
+	const actions = {};
+	for (const [page, pageActions] of Object.entries(manifest.actions)) actions[page] = Object.fromEntries(Object.entries(pageActions).map(([name, path]) => [name, relativePath(path)]));
+	return {
+		...manifest,
+		root: ".",
+		routes,
+		actions,
+		islands: manifest.islands.map((island) => ({
+			...island,
+			filePath: relativePath(island.filePath)
+		}))
+	};
+}
+//#endregion
+//#region src/runtime/capabilities.ts
+/** True when the host supports streaming responses (streaming !== false). */
+function supportsStreaming(capabilities = { streaming: true }) {
+	return capabilities.streaming !== false;
+}
+/** True when the host can write to persistent storage (for ISR/cache/image writes). */
+function supportsPersistentStorage(capabilities) {
+	return capabilities.filesystem === "persistent";
+}
+/**
+* Validates a capability declaration and reports incompatible combinations.
+* Used by the build pipeline so invalid hosts fail at build time instead of
+* producing a broken runtime.
+*/
+function validateCapabilities(capabilities, features = {}) {
+	const problems = [];
+	if (features.isr && !supportsPersistentStorage(capabilities)) problems.push(`ISR requires a persistent filesystem; the host declares filesystem="${capabilities.filesystem}".`);
+	if (features.images && capabilities.imageRuntime === false && capabilities.filesystem === "none") problems.push("On-demand image transforms require either imageRuntime=true or a readable filesystem; the host has neither.");
+	if (features.streaming && capabilities.streaming === false) problems.push("Streaming was requested but the host declares streaming=false.");
+	return {
+		ok: problems.length === 0,
+		problems
+	};
+}
+var DEFAULT_CAPABILITIES, SERVERLESS_CAPABILITIES;
+var init_capabilities = __esmMin((() => {
+	DEFAULT_CAPABILITIES = {
+		streaming: true,
+		filesystem: "persistent",
+		imageRuntime: true,
+		backgroundWork: true
+	};
+	SERVERLESS_CAPABILITIES = {
+		streaming: true,
+		filesystem: "ephemeral",
+		imageRuntime: false,
+		backgroundWork: false,
+		maxBodySize: 1048576
+	};
+}));
+//#endregion
+//#region src/cli/output.ts
+var useColor = Boolean(process.stdout.isTTY) && !process.env.NO_COLOR;
+function paint(code, text) {
+	return useColor ? `\x1b[${code}m${text}\x1b[0m` : text;
+}
+var bold = (text) => paint(1, text);
+var dim = (text) => paint(2, text);
+var red = (text) => paint(31, text);
+var green = (text) => paint(32, text);
+var yellow = (text) => paint(33, text);
+var cyan = (text) => paint(36, text);
+var quiet = false;
+/** Enables quiet mode: only errors are printed. */
+function setQuiet(value) {
+	quiet = value;
+}
+/** Success message with a green check. */
+function success(message) {
+	if (quiet) return;
+	console.log(`${green("✓")} ${message}`);
+}
+/** Indented info line with a cyan arrow. */
+function info(message) {
+	if (quiet) return;
+	console.log(`  ${cyan("→")} ${message}`);
+}
+/** Indented detail line (file lists, sub-items). */
+function detail(message) {
+	if (quiet) return;
+	console.log(dim(`  - ${message}`));
+}
+/** Lifecycle event with a dim bracket tag, e.g. [dev], [change]. */
+function event(tag, message) {
+	if (quiet) return;
+	console.log(`${dim(`[${tag}]`)} ${message}`);
+}
+/** Warning; suppressed in quiet mode. */
+function warn(message) {
+	if (quiet) return;
+	console.warn(`${yellow("!")} ${message}`);
+}
+/** Error; always printed, even in quiet mode. */
+function error(message) {
+	console.error(`${red("✗")} ${message}`);
+}
+/** Formats a byte count as "640 B", "1.5 kB", "2.3 MB". */
+function formatBytes(bytes) {
+	if (bytes < 1024) return `${bytes} B`;
+	if (bytes < 1048576) return `${(bytes / 1024).toFixed(1)} kB`;
+	return `${(bytes / 1048576).toFixed(1)} MB`;
+}
+/** Formats a duration as "45ms" or "1.23s". */
+function formatDuration(ms) {
+	if (ms < 1e3) return `${Math.round(ms)}ms`;
+	return `${(ms / 1e3).toFixed(2)}s`;
+}
+/** Build phase line: checkmark + label + dim duration. */
+function phase(label, durationMs) {
+	if (quiet) return;
+	console.log(`  ${green("✓")} ${label} ${dim(formatDuration(durationMs))}`);
+}
+var MAX_FILE_ROWS = 20;
+var SHOWN_FILE_ROWS = 10;
+/**
+* Renders the generated-file list as aligned "path  size" rows (plain text,
+* no color). With more than MAX_FILE_ROWS entries, shows the SHOWN_FILE_ROWS
+* largest plus a "… and N more" line.
+*/
+function fileRows(files, max = MAX_FILE_ROWS, shown = SHOWN_FILE_ROWS) {
+	const sorted = files.length > max ? [...files].sort((a, b) => b.bytes - a.bytes) : files;
+	const visible = sorted.slice(0, files.length > max ? shown : sorted.length);
+	const pathWidth = Math.max(...visible.map((f) => f.path.length), 0);
+	const sizeWidth = Math.max(...visible.map((f) => formatBytes(f.bytes).length), 0);
+	const rows = visible.map((f) => `${f.path.padEnd(pathWidth)}  ${formatBytes(f.bytes).padStart(sizeWidth)}`);
+	const hidden = files.length - visible.length;
+	if (hidden > 0) rows.push(`… and ${hidden} more`);
+	return rows;
+}
+/** Prints the generated-file list: dim paths, aligned sizes. */
+function fileList(files) {
+	if (quiet || files.length === 0) return;
+	for (const row of fileRows(files)) {
+		const sizeMatch = /^(.*?)(  \S+)$/.exec(row);
+		if (sizeMatch) console.log(`  ${dim(sizeMatch[1])} ${dim(sizeMatch[2])}`);
+		else console.log(`  ${dim(row)}`);
+	}
+}
+/**
+* Plain-text lines of the server startup banner (Astro-style, no box):
+*
+*   elur-kit v2.4.10 dev server running at:
+*     → Local:    http://localhost:3000/
+*     → Network:  http://192.168.1.20:3000/
+*/
+function serverBannerLines(options) {
+	const lines = [`${options.name} ${options.version} ${options.command} server running at:`, ""];
+	const labelWidth = options.networkUrl ? 8 : 6;
+	lines.push(`  → ${"Local:".padEnd(labelWidth)} ${options.localUrl}`);
+	if (options.networkUrl) lines.push(`  → ${"Network:".padEnd(labelWidth)} ${options.networkUrl}`);
+	return lines;
+}
+/** Prints the server startup banner with brand colors. */
+function serverBanner(options) {
+	if (quiet) return;
+	const [title, blank, ...urls] = serverBannerLines(options);
+	console.log();
+	console.log(`  ${bold(cyan(title))}`);
+	console.log(blank);
+	for (const line of urls) {
+		const arrowEnd = line.indexOf("→") + 1;
+		console.log(`  ${cyan("→")}${dim(line.slice(arrowEnd))}`);
+	}
+}
+/** First external (LAN) IPv4 address, for the Network URL. */
+function getNetworkAddress() {
+	for (const infos of Object.values(networkInterfaces())) for (const info of infos ?? []) if (info.family === "IPv4" && !info.internal) return info.address;
+}
+/**
+* Listens on host:port, falling back to the next port while the failure is
+* EADDRINUSE. Resolves with the port actually bound. Rejects with the
+* original error for non-port failures or when the range is exhausted.
+*/
+function listenWithFallback(server, host, port, options = {}) {
+	const maxTries = options.maxTries ?? 20;
+	return new Promise((resolvePromise, reject) => {
+		let attempt = 0;
+		let candidate = port;
+		const onListening = () => {
+			server.removeListener("error", onError);
+			resolvePromise(candidate);
+		};
+		const onError = (err) => {
+			server.removeListener("listening", onListening);
+			if (err.code === "EADDRINUSE" && attempt < maxTries) {
+				attempt++;
+				const nextPort = port + attempt;
+				options.onFallback?.(nextPort - 1, nextPort);
+				tryListen(nextPort);
+				return;
 			}
-			args = [input];
-		}
-	} else {
-		const bodyResult = await readBodyWithLimit(request, bodyLimit);
-		if (!bodyResult.ok) return {
-			ok: false,
-			response: bodyResult.response
+			reject(err);
 		};
-		const form = parseFormBody(bodyResult.text);
-		name = form.__elur_js_action_name;
-		page = form.__elur_js_action_page;
-		const input = {};
-		for (const [key, value] of Object.entries(form)) {
-			if (key === "__elur_js_action_name" || key === "__elur_js_action_page") continue;
-			input[key] = value;
+		const tryListen = (next) => {
+			candidate = next;
+			server.once("error", onError);
+			server.once("listening", onListening);
+			server.listen(candidate, host);
+		};
+		tryListen(port);
+	});
+}
+//#endregion
+//#region src/build/vite-build.ts
+var vite_build_exports = /* @__PURE__ */ __exportAll({
+	beginAtomicStage: () => beginAtomicStage,
+	buildClientBundle: () => buildClientBundle,
+	copyPublicAssets: () => copyPublicAssets,
+	loadUserConfig: () => loadUserConfig,
+	resolveClientInputs: () => resolveClientInputs
+});
+/**
+* Build the client hydration bundle using the Vite JavaScript API.
+*
+* The user's config is loaded programmatically and the elur interpolation
+* plugin is injected so partial attribute interpolations inside islands are
+* transformed before reaching the browser.
+*/
+async function buildClientBundle(options) {
+	const log = options.logPrefix ?? "[client]";
+	const quiet = options.quiet ?? false;
+	if (!quiet) console.log(`${log} Building hydration bundle...`);
+	const userConfig = options.userConfigPath ? await loadUserConfig(options.userConfigPath, options.root) : defaultClientConfig(options.defaultInputs);
+	const pluginOptions = shouldUseLegacyInterpolation(options.interpolation ?? "auto") ? elurJsInterpolationPlugin({
+		appDir: options.appDir,
+		islandsDir: options.islandsDir
+	}) : [];
+	const config = {
+		...userConfig,
+		root: options.root,
+		base: options.base ?? userConfig.base ?? "/",
+		logLevel: quiet ? "silent" : userConfig.logLevel,
+		build: {
+			...userConfig.build ?? {},
+			outDir: options.outDir,
+			emptyOutDir: true
+		},
+		plugins: [...userConfig.plugins ?? [], pluginOptions],
+		configFile: false
+	};
+	const result = await build(config);
+	const outputCount = (Array.isArray(result) ? result : [result]).reduce((n, r) => n + ("output" in r ? r.output?.length ?? 0 : 0), 0);
+	if (!quiet) console.log(`${log} ✓ ${outputCount} asset(s) emitted → ${relative(options.root, options.outDir)}`);
+	return {
+		outDir: options.outDir,
+		outputCount
+	};
+}
+async function loadUserConfig(path, _root) {
+	const mod = await import(path);
+	const raw = mod.default ?? mod;
+	const resolved = typeof raw === "function" ? await raw({
+		command: "build",
+		mode: "production"
+	}) : raw;
+	return (resolved && typeof resolved.then === "function" ? await resolved : resolved) ?? {};
+}
+/**
+* Resolves a user Vite config's `build.rollupOptions.input` to a list of
+* absolute entry paths. Used to detect whether the bundle will emit the
+* generated router module as its own chunk (split build) or not (legacy
+* single-entry bundle — the router stays embedded in the entry).
+*/
+async function resolveClientInputs(userConfigPath, root) {
+	const input = (await loadUserConfig(userConfigPath, root)).build?.rollupOptions?.input;
+	if (!input || typeof input === "string") return input ? [resolve(root, input)] : [];
+	return (Array.isArray(input) ? input : Object.values(input)).filter((v) => typeof v === "string").map((v) => resolve(root, v));
+}
+/**
+* The synthesized client bundle config used when the project does not ship
+* its own `vite.client.config.*`: named inputs with `[name].js` filenames in
+* ES format — the same contract the docs give to hand-written client
+* configs, so `entry-client` → `entry-client.js` and `router` → `router.js`.
+*/
+function defaultClientConfig(defaultInputs) {
+	return { build: { rollupOptions: {
+		input: defaultInputs ?? {},
+		output: {
+			entryFileNames: "[name].js",
+			format: "es"
 		}
-		args = [input];
-	}
-	if (!name || typeof name !== "string") return {
-		ok: false,
-		response: new Response("Missing action name", {
-			status: 400,
-			headers: { "Content-Type": "text/plain" }
-		})
+	} } };
+}
+/**
+* Prepare an atomic staging directory for build output.
+*
+* Usage:
+*   const stage = await beginAtomicStage({ outDir });
+*   try {
+*     await buildInto(stage.tempDir);
+*     await stage.commit();
+*   } catch (err) {
+*     await stage.rollback();
+*     throw err;
+*   }
+*/
+async function beginAtomicStage(options) {
+	const outDir = resolve(options.outDir);
+	const tempDir = resolve(options.tempDir ?? join(dirname(outDir), `.${basename$1(outDir)}.tmp-${process.pid}`));
+	await rm(tempDir, {
+		recursive: true,
+		force: true
+	});
+	await mkdir(tempDir, { recursive: true });
+	const commit = async () => {
+		const backup = options.keepExisting && existsSync(outDir) ? `${outDir}.bak-${process.pid}` : void 0;
+		if (backup) {
+			await rm(backup, {
+				recursive: true,
+				force: true
+			});
+			await safeRename(outDir, backup);
+		}
+		try {
+			await safeRename(tempDir, outDir);
+		} catch (err) {
+			if (isCrossDevice(err)) {
+				await cp(tempDir, outDir, {
+					recursive: true,
+					force: true
+				});
+				await rm(tempDir, {
+					recursive: true,
+					force: true
+				});
+			} else {
+				if (backup) await safeRename(backup, outDir);
+				throw err;
+			}
+		}
+		if (backup) await rm(backup, {
+			recursive: true,
+			force: true
+		});
+	};
+	const rollback = async () => {
+		await rm(tempDir, {
+			recursive: true,
+			force: true
+		});
 	};
 	return {
-		ok: true,
-		name,
-		page,
-		args,
-		wantsJson
+		tempDir,
+		commit,
+		rollback
 	};
 }
-/**
-* Handles a POST request to the server action endpoint.
-*
-* Accepts both JSON requests (`{ name, page?, args }`) and HTML form submissions
-* for progressive enhancement. The provided resolver looks up the action
-* implementation, invokes it with the supplied arguments and returns the result
-* as JSON or redirects back to the request origin for form submissions.
-*
-* Origin verification (CSRF protection) runs before parsing the body: any
-* cross-origin POST is rejected with 403 unless its origin is allow-listed via
-* `security.allowedOrigins`.
-*
-* For progressive-enhancement form submissions that fail, the failure payload
-* is relayed back via a short-lived `__elur_js_action_error` cookie (SameSite=Lax,
-* Max-Age=15s) instead of a query param, so errors do not leak into browser
-* history, server logs or third-party Referer headers.
-*/
-async function handleActionRequest(request, resolveAction, security = {}) {
-	const originError = verifyOrigin(request, security);
-	if (originError) return originForbidden(originError);
-	const parsed = await parseActionRequest(request, security.bodyLimit ?? DEFAULT_BODY_LIMIT);
-	if (!parsed.ok) return parsed.response;
-	const { name, page, args, wantsJson } = parsed;
+function basename$1(path) {
+	const parts = path.split(/[\\/]+/).filter(Boolean);
+	return parts[parts.length - 1] ?? "output";
+}
+async function safeRename(src, dest) {
+	await rm(dest, {
+		recursive: true,
+		force: true
+	});
 	try {
-		const action = await resolveAction(name, page);
-		if (!action) {
-			const message = page ? `Action not found: ${name} (page: ${page})` : `Action not found: ${name}`;
-			return new Response(message, {
-				status: 404,
-				headers: { "Content-Type": "text/plain" }
-			});
-		}
-		const result = await action(...args);
-		if (isActionFailure(result)) {
-			if (wantsJson) return new Response(JSON.stringify({
-				__elur_js_action_failure: true,
-				status: result.status,
-				data: result.data
-			}), {
-				status: result.status,
-				headers: { "Content-Type": "application/json" }
-			});
-			const referer = request.headers.get("Referer") ?? "/";
-			const url = new URL(referer, "http://localhost");
-			const { value } = encodeActionErrorCookie(result.data, result.status);
-			return new Response(null, {
-				status: 303,
-				headers: {
-					Location: url.pathname + url.search,
-					"Content-Type": "text/plain",
-					"Set-Cookie": setActionErrorCookieHeader(value)
-				}
-			});
-		}
-		if (isRedirectResponse(result)) {
-			if (wantsJson) return new Response(JSON.stringify({
-				__elur_js_action_redirect: true,
-				status: result.status,
-				location: result.location
-			}), {
-				status: 200,
-				headers: { "Content-Type": "application/json" }
+		await rename(src, dest);
+	} catch (err) {
+		if (isCrossDevice(err)) {
+			await cp(src, dest, {
+				recursive: true,
+				force: true
 			});
-			return new Response(null, {
-				status: result.status,
-				headers: {
-					Location: result.location,
-					"Content-Type": "text/plain"
-				}
+			await rm(src, {
+				recursive: true,
+				force: true
 			});
-		}
-		if (wantsJson) return new Response(JSON.stringify(result ?? null), {
-			status: 200,
-			headers: { "Content-Type": "application/json" }
-		});
-		const referer = request.headers.get("Referer") ?? "/";
-		return new Response(null, {
-			status: 303,
-			headers: {
-				Location: typeof result === "string" ? result : referer,
-				"Content-Type": "text/plain"
-			}
-		});
-	} catch (err) {
-		console.error("[elur-kit] Action error:", err);
-		return publicErrorResponse(err, { includeDetail: false });
+		} else throw err;
 	}
 }
-var DEFAULT_BODY_LIMIT;
-var init_server = __esmMin((() => {
-	init_errors();
-	init_origin();
-	init_error_store();
-	DEFAULT_BODY_LIMIT = 1048576;
-}));
-//#endregion
-//#region src/cache.ts
-function cachePath(cacheDir, pathname) {
-	const key = createHash("sha256").update(pathname).digest("hex");
-	return join(cacheDir, `${key}.html.json`);
+function isCrossDevice(err) {
+	return err?.code === "EXDEV";
 }
-async function getCachedHtml(cacheDir, pathname) {
-	const path = cachePath(cacheDir, pathname);
+/**
+* Copy the public directory into the output directory.
+* Returns the number of files copied.
+*/
+async function copyPublicAssets(options) {
 	try {
-		const raw = await readFile(path, "utf8");
-		const entry = JSON.parse(raw);
-		if (Date.now() - entry.generatedAt < entry.revalidate * 1e3) return entry;
-	} catch {}
+		await access(options.publicDir);
+		if (!(await stat(options.publicDir)).isDirectory()) return 0;
+	} catch {
+		return 0;
+	}
+	await mkdir(options.outDir, { recursive: true });
+	await cp(options.publicDir, options.outDir, {
+		recursive: true,
+		force: true
+	});
+	return countFiles(options.outDir);
 }
-async function setCachedHtml(cacheDir, pathname, html, revalidate) {
-	const path = cachePath(cacheDir, pathname);
-	await mkdir(dirname(path), { recursive: true });
-	const entry = {
-		html,
-		generatedAt: Date.now(),
-		revalidate
-	};
-	const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
-	try {
-		await writeFile(temporaryPath, JSON.stringify(entry), "utf8");
-		await rename(temporaryPath, path);
-	} finally {
-		await rm(temporaryPath, { force: true });
+async function countFiles(dir) {
+	const { readdir } = await import("node:fs/promises");
+	let count = 0;
+	async function walk(d) {
+		const entries = await readdir(d, { withFileTypes: true });
+		for (const entry of entries) {
+			const path = join(d, entry.name);
+			if (entry.isDirectory()) await walk(path);
+			else count++;
+		}
 	}
+	await walk(dir);
+	return count;
 }
-var init_cache = __esmMin((() => {}));
+var init_vite_build = __esmMin((() => {
+	init_interpolation_plugin();
+}));
 //#endregion
 //#region src/ssr/match.ts
 /**
@@ -2228,174 +2952,53 @@ function matchApiRoute(pathname, routes) {
 * Safely decodes a URI component. If decoding fails (malformed % sequences),
 * returns the original string rather than throwing (runtime-security §10).
 */
-function safeDecodeURIComponent(segment) {
-	try {
-		return decodeURIComponent(segment);
-	} catch {
-		return segment;
-	}
-}
-function specificity(path) {
-	return path.split("/").filter(Boolean).reduce((score, segment) => {
-		if (segment.endsWith("*")) return score;
-		if (segment.startsWith(":")) return score + 1;
-		return score + 2;
-	}, 0);
-}
-function tryMatch(requestSegments, routeSegments, optionalCatchAll = false) {
-	const params = {};
-	let i = 0;
-	for (let r = 0; r < routeSegments.length; r++) {
-		const routeSeg = routeSegments[r];
-		if (routeSeg.endsWith("*")) {
-			const name = routeSeg.slice(1, -1);
-			const rest = requestSegments.slice(i);
-			if (rest.length === 0 && !optionalCatchAll) return void 0;
-			params[name] = rest.length > 0 ? rest : [];
-			return params;
-		}
-		if (routeSeg.startsWith(":")) {
-			const requestSeg = requestSegments[i];
-			if (requestSeg === void 0) return void 0;
-			params[routeSeg.slice(1)] = requestSeg;
-			i++;
-			continue;
-		}
-		if (routeSeg !== requestSegments[i]) return;
-		i++;
-	}
-	if (i !== requestSegments.length) return void 0;
-	return params;
-}
-var init_match = __esmMin((() => {}));
-//#endregion
-//#region src/ssr/stream.ts
-/** Builds the concrete URL path for a route pattern given matched params. */
-function buildConcretePath(routePath, params) {
-	return routePath.replace(/:([a-zA-Z0-9_]+)(\*)?/g, (_m, name, catchAll) => {
-		const value = params[name];
-		if (value === void 0 || value === null) return "";
-		return catchAll ? Array.isArray(value) ? value.join("/") : String(value) : String(value);
-	});
-}
-function streamingScript(page, search) {
-	return `<script type="module">${`
-    async function __elurJsStreamRender() {
-      try {
-        const url = "/__elur-js/render?page=" + encodeURIComponent(${JSON.stringify(page)}) + "&search=" + encodeURIComponent(${JSON.stringify(search)});
-        const res = await fetch(url);
-        if (!res.ok) throw new Error("Streaming render failed: " + res.status);
-        const html = await res.text();
-        const app = document.getElementById("app");
-        if (app) app.innerHTML = html;
-        document.dispatchEvent(new CustomEvent("elur:rendered"));
-      } catch (err) {
-        console.error("[elur-kit] streaming render failed", err);
-      }
-    }
-    __elurJsStreamRender();
-  `}<\/script>`;
-}
-/**
-* Render a page shell that shows the loading boundary while the real content
-* is fetched and injected by the client.
-*/
-async function renderStreamingPage(options) {
-	const { route, params, searchParams, config, importer = defaultImport, actions } = options;
-	if (!route.loadingPath) throw new Error("Cannot stream a page without a loading.ts boundary");
-	const { default: Loading } = await importer(route.loadingPath);
-	const body = `<div id="elur-loading">${await renderToString$1(() => Loading())}</div>${streamingScript(buildConcretePath(route.path, params), searchParams.toString())}`;
-	const htmlAttributes = {};
-	const headScripts = [];
-	const headLinks = [];
-	if (route.layouts.length > 0) {
-		const rootLayout = route.layouts[0];
-		const dataPath = rootLayout.replace(/layout\.ts$/, "layout.data.ts");
-		if (dataPath !== rootLayout) try {
-			const mod = await importer(dataPath);
-			const layoutData = mod.load ? await mod.load({
-				params,
-				searchParams,
-				request: options.request
-			}) : void 0;
-			if (layoutData && typeof layoutData === "object") {
-				const attrs = layoutData.htmlAttributes;
-				if (attrs) Object.assign(htmlAttributes, attrs);
-				const scripts = layoutData.headScripts;
-				if (Array.isArray(scripts)) headScripts.push(...scripts);
-				const links = layoutData.headLinks;
-				if (Array.isArray(links)) headLinks.push(...links);
-			}
-		} catch {}
-	}
-	return documentShell({
-		title: "Loading...",
-		lang: config.lang,
-		body,
-		data: {
-			__elur_js_streaming: true,
-			page: route.path
-		},
-		actions,
-		htmlAttributes,
-		headScripts,
-		headLinks,
-		clientEntry: config.clientEntry
-	});
-}
-/**
-* Render only the inner HTML body for a page. Used by the streaming endpoint
-* to inject the real content into the shell.
-*/
-async function renderPageBody(options) {
-	const { routes, pathname, searchParams, config, actions, importer = defaultImport, request } = options;
-	const match = matchRoute(pathname, routes.pages);
-	if (!match) throw new RouteNotFoundError(pathname);
-	const result = await renderPage({
-		route: match.route,
-		params: match.params,
-		searchParams,
-		config,
-		actions,
-		importer,
-		request
-	});
-	if (result.response) return {
-		body: "",
-		title: "",
-		response: result.response
-	};
-	const bodyMatch = result.html.match(/<div id="app">([\s\S]*)<\/div>\s*(<script|$)/);
-	const body = bodyMatch ? bodyMatch[1].trim() : result.html;
-	const titleMatch = result.html.match(/<title[^>]*>([^<]*)<\/title>/);
-	return {
-		body,
-		title: titleMatch ? titleMatch[1] : result.resolvedTitle ?? "",
-		fullHtml: result.html,
-		clearActionErrorCookie: result.clearActionErrorCookie,
-		head: result.head
-	};
+function safeDecodeURIComponent(segment) {
+	try {
+		return decodeURIComponent(segment);
+	} catch {
+		return segment;
+	}
 }
-var defaultImport, RouteNotFoundError;
-var init_stream = __esmMin((() => {
-	init_render_to_string();
-	init_document_shell();
-	init_match();
-	init_render();
-	defaultImport = (path) => import(path);
-	RouteNotFoundError = class extends Error {
-		constructor(pathname) {
-			super(`No route found for ${pathname}`);
-			this.name = "RouteNotFoundError";
+function specificity(path) {
+	return path.split("/").filter(Boolean).reduce((score, segment) => {
+		if (segment.endsWith("*")) return score;
+		if (segment.startsWith(":")) return score + 1;
+		return score + 2;
+	}, 0);
+}
+function tryMatch(requestSegments, routeSegments, optionalCatchAll = false) {
+	const params = {};
+	let i = 0;
+	for (let r = 0; r < routeSegments.length; r++) {
+		const routeSeg = routeSegments[r];
+		if (routeSeg.endsWith("*")) {
+			const name = routeSeg.slice(1, -1);
+			const rest = requestSegments.slice(i);
+			if (rest.length === 0 && !optionalCatchAll) return void 0;
+			params[name] = rest.length > 0 ? rest : [];
+			return params;
 		}
-	};
-}));
+		if (routeSeg.startsWith(":")) {
+			const requestSeg = requestSegments[i];
+			if (requestSeg === void 0) return void 0;
+			params[routeSeg.slice(1)] = requestSeg;
+			i++;
+			continue;
+		}
+		if (routeSeg !== requestSegments[i]) return;
+		i++;
+	}
+	if (i !== requestSegments.length) return void 0;
+	return params;
+}
+var init_match = __esmMin((() => {}));
 //#endregion
 //#region src/middleware/index.ts
-init_server();
-init_cache();
-init_stream();
-init_match();
+var middleware_exports = /* @__PURE__ */ __exportAll({
+	loadMiddleware: () => loadMiddleware,
+	matchesMiddleware: () => matchesMiddleware,
+	runMiddleware: () => runMiddleware
+});
 /**
 * Loads the user's `src/middleware.ts` module. Returns `null` if no middleware
 * file exists. Distinguishes "file not found" from "file has errors" (§6):
@@ -2484,854 +3087,731 @@ async function runMiddleware(middleware, request, params) {
 		}
 	}
 }
+var init_middleware = __esmMin((() => {
+	init_match();
+}));
 //#endregion
-//#region src/runtime/node-http.ts
-var GlobalAbortController = globalThis.AbortController ?? AbortController;
-function incomingMessageToRequest(req, body) {
-	const headers = new Headers();
-	for (let index = 0; index < req.rawHeaders.length; index += 2) headers.append(req.rawHeaders[index], req.rawHeaders[index + 1]);
-	const controller = new GlobalAbortController();
-	req.once("aborted", () => controller.abort());
-	req.once("close", () => {
-		if (!req.complete) controller.abort();
-	});
-	const protocol = req.socket.encrypted ? "https" : "http";
-	const init = {
-		method: req.method ?? "GET",
-		headers,
-		signal: controller.signal
-	};
-	if (body !== void 0 && body !== null && init.method !== "GET" && init.method !== "HEAD") init.body = body;
-	return new Request(`${protocol}://${headers.get("host") ?? "localhost"}${req.url ?? "/"}`, init);
-}
-//#endregion
-//#region src/runtime/static.ts
-function isInside(root, candidate) {
-	return candidate === root || candidate.startsWith(`${root}${sep}`);
-}
-function decodePathname(pathname) {
-	try {
-		const decoded = decodeURIComponent(pathname);
-		if (decoded.includes("\0") || decoded.includes("\\") || /%(?:00|2e|2f|5c)/i.test(decoded)) return null;
-		if (decoded.split("/").some((segment) => segment === "..")) return null;
-		return decoded;
-	} catch {
-		return null;
-	}
-}
-async function resolveStaticFile(root, pathname) {
-	const decoded = decodePathname(pathname);
-	if (decoded === null) return null;
-	const resolvedRoot = resolve(root);
-	const relativePath = decoded.replace(/^\/+/, "");
-	let candidate = resolve(resolvedRoot, relativePath);
-	if (!isInside(resolvedRoot, candidate)) return null;
-	try {
-		if ((await stat(candidate)).isDirectory()) candidate = resolve(candidate, "index.html");
-	} catch {
-		if (decoded.endsWith("/") || extname(decoded) === "") candidate = resolve(candidate, "index.html");
-	}
-	if (!isInside(resolvedRoot, candidate)) return null;
-	try {
-		const [canonicalRoot, canonicalCandidate, candidateStat] = await Promise.all([
-			realpath(resolvedRoot),
-			realpath(candidate),
-			stat(candidate)
-		]);
-		if (!candidateStat.isFile() || !isInside(canonicalRoot, canonicalCandidate)) return null;
-		return canonicalCandidate;
-	} catch {
-		return null;
-	}
-}
-var init_static = __esmMin((() => {}));
-//#endregion
-//#region src/ssr/server.ts
-init_route_scanner();
-init_scan();
-init_match();
-init_render();
-init_static();
-init_errors();
+//#region src/errors.ts
 /**
-* Create an SSR server that renders pages on demand and serves static files.
+* Type guard for action failures. Uses the marker field so it works across
+* bundling boundaries where `instanceof` fails.
 */
-async function createSsrServer(options) {
-	const routes = await scanRoutes(options.appDir);
-	const actions = await scanActions(options.appDir);
-	const publicActions = actionNames(actions);
-	const middleware = options.root ? await loadMiddleware(options.root) : null;
-	const resolveAction = async (name, page) => {
-		const pageKey = resolveActionPageKey(page, routes);
-		const pageActions = pageKey ? actions[pageKey] : Object.values(actions).find((p) => p[name]) ?? void 0;
-		const actionPath = pageActions ? pageActions[name] : void 0;
-		if (!actionPath) return void 0;
-		const action = (await import(actionPath))[name];
-		if (typeof action === "function") return action;
-	};
-	const server = createServer(async (req, res) => {
-		let urlPath = req.url ?? "/";
-		if (urlPath.includes("?")) urlPath = urlPath.split("?")[0];
-		if (urlPath === "/__elur-js/actions" && req.method === "POST") {
-			try {
-				const response = await handleActionRequest(incomingMessageToRequest(req, await readRequestBody$1(req)), resolveAction, options.actionSecurity);
-				res.writeHead(response.status, Object.fromEntries(response.headers.entries()));
-				res.end(await response.text());
-			} catch (err) {
-				console.error("[action] error handling", err);
-				res.writeHead(500, { "Content-Type": "text/plain; charset=utf-8" });
-				res.end(toPublicErrorInfo(err).message);
-			}
-			return;
-		}
-		if (urlPath === "/__elur-js/render") {
-			const renderUrl = new URL(req.url ?? "/", "http://localhost");
-			const page = renderUrl.searchParams.get("page") ?? "/";
-			const search = renderUrl.searchParams.get("search") ?? "";
-			const wantsJson = (req.headers["accept"] ?? "").includes("application/json");
-			try {
-				const request = incomingMessageToRequest(req);
-				let body;
-				let title;
-				let lastRenderedCookie;
-				let lastRenderedHead;
-				const ttl = await resolveTtl(options, page, routes);
-				const cacheKey = `/__elur-js/render${page}?${search}`;
-				if (options.cacheDir && typeof ttl === "number" && canUsePublicCache(request)) {
-					const cached = await getCachedHtml(options.cacheDir, cacheKey);
-					if (cached) {
-						body = extractBody(cached.html);
-						title = extractTitle(cached.html);
-					} else {
-						const rendered = await renderPageBody({
-							routes,
-							pathname: page,
-							searchParams: new URLSearchParams(search),
-							config: {
-								lang: options.lang ?? "es",
-								clientEntry: options.clientEntry
-							},
-							actions: publicActions,
-							request
-						});
-						body = rendered.body;
-						title = rendered.title;
-						lastRenderedCookie = rendered.clearActionErrorCookie;
-						lastRenderedHead = rendered.head;
-						await setCachedHtml(options.cacheDir, cacheKey, rendered.fullHtml ?? "", ttl);
-					}
-				} else {
-					const rendered = await renderPageBody({
-						routes,
-						pathname: page,
-						searchParams: new URLSearchParams(search),
-						config: {
-							lang: options.lang ?? "es",
-							clientEntry: options.clientEntry
-						},
-						actions: publicActions,
-						request
-					});
-					body = rendered.body;
-					title = rendered.title;
-					lastRenderedCookie = rendered.clearActionErrorCookie;
-					lastRenderedHead = rendered.head;
-				}
-				if (wantsJson) {
-					const headers = { "Content-Type": "application/json; charset=utf-8" };
-					const setCookie = lastRenderedCookie;
-					if (setCookie) headers["X-Elur-Action-Clear-Cookie"] = setCookie;
-					res.writeHead(200, headers);
-					res.end(JSON.stringify({
-						title,
-						body,
-						head: lastRenderedHead,
-						clearActionErrorCookie: setCookie
-					}));
-				} else {
-					const headers = { "Content-Type": "text/html; charset=utf-8" };
-					if (lastRenderedCookie) headers["Set-Cookie"] = lastRenderedCookie;
-					res.writeHead(200, headers);
-					res.end(body);
-				}
-			} catch (err) {
-				if (err instanceof RouteNotFoundError) {
-					console.log(`[ssr] render endpoint: no route for ${page}`);
-					res.writeHead(404, { "Content-Type": "text/plain" });
-					res.end("Not Found");
-					return;
-				}
-				console.error("[ssr] streaming render error", err);
-				res.writeHead(500, { "Content-Type": "text/plain" });
-				res.end("Internal Server Error");
-			}
-			return;
-		}
-		let middlewareHeaders;
-		if (middleware && matchesMiddleware(urlPath, middleware.config)) {
-			const mwResult = await runMiddleware(middleware, incomingMessageToRequest(req));
-			if (mwResult.kind === "response") {
-				res.writeHead(mwResult.response.status, Object.fromEntries(mwResult.response.headers.entries()));
-				res.end(Buffer.from(await mwResult.response.arrayBuffer()));
-				return;
-			}
-			middlewareHeaders = mwResult.headers;
-		}
-		const apiMatch = matchApiRoute(urlPath, routes.api);
-		if (apiMatch) {
-			try {
-				const handler = (await import(apiMatch.route.routePath))[req.method ?? "GET"];
-				if (typeof handler !== "function") {
-					res.writeHead(405, { "Content-Type": "text/plain" });
-					res.end(`Method not allowed: ${req.method}`);
-					return;
-				}
-				const request = incomingMessageToRequest(req, req.method && req.method !== "GET" && req.method !== "HEAD" ? await readRequestBody$1(req) : void 0);
-				applyHeaders(request.headers, middlewareHeaders);
-				const response = await handler(request, { params: apiMatch.params });
-				res.writeHead(response.status, Object.fromEntries(response.headers.entries()));
-				res.end(Buffer.from(await response.arrayBuffer()));
-			} catch (err) {
-				console.error("[api] error handling", urlPath, err);
-				res.writeHead(500, { "Content-Type": "text/plain; charset=utf-8" });
-				res.end(toPublicErrorInfo(err).message);
-			}
-			return;
-		}
-		if (options.publicDir) try {
-			if (await tryServeStatic(res, options.publicDir, urlPath)) return;
-		} catch (err) {
-			console.error("[static] error serving", urlPath, err);
-		}
-		const match = matchRoute(urlPath, routes.pages);
-		const config = {
-			lang: options.lang ?? "es",
-			clientEntry: options.clientEntry
-		};
-		if (match) try {
-			const request = incomingMessageToRequest(req);
-			applyHeaders(request.headers, middlewareHeaders);
-			let html;
-			let clearActionErrorCookie;
-			const ttl = (match.route.dataPath ? (await import(match.route.dataPath)).revalidate : void 0) ?? options.defaultRevalidate;
-			if (options.streaming !== false && match.route.loadingPath) html = await renderStreamingPage({
-				route: match.route,
-				params: match.params,
-				searchParams: new URLSearchParams(req.url?.split("?")[1] ?? ""),
-				config,
-				actions: publicActions,
-				request
-			});
-			else if (options.cacheDir && typeof ttl === "number" && canUsePublicCache(request)) {
-				const cacheKey = new URL(request.url).pathname + new URL(request.url).search;
-				const cached = await getCachedHtml(options.cacheDir, cacheKey);
-				if (cached) html = cached.html;
-				else {
-					const result = await renderPage({
-						route: match.route,
-						params: match.params,
-						searchParams: new URLSearchParams(req.url?.split("?")[1] ?? ""),
-						config,
-						actions: publicActions,
-						request
-					});
-					html = result.html;
-					clearActionErrorCookie = result.clearActionErrorCookie;
-					await setCachedHtml(options.cacheDir, cacheKey, html, ttl);
-				}
-			} else {
-				const result = await renderPage({
-					route: match.route,
-					params: match.params,
-					searchParams: new URLSearchParams(req.url?.split("?")[1] ?? ""),
-					config,
-					actions: publicActions,
-					request
-				});
-				html = result.html;
-				clearActionErrorCookie = result.clearActionErrorCookie;
-			}
-			const responseHeaders = { "Content-Type": "text/html; charset=utf-8" };
-			if (clearActionErrorCookie) responseHeaders["Set-Cookie"] = clearActionErrorCookie;
-			res.writeHead(200, responseHeaders);
-			res.end(html);
-			return;
-		} catch (err) {
-			console.error("[ssr] error rendering", urlPath, err);
-			const errorResult = await renderErrorPage({
-				routes,
-				status: 500,
-				error: err,
-				config,
-				actions: publicActions
-			});
-			if (errorResult) {
-				res.writeHead(errorResult.status, { "Content-Type": "text/html; charset=utf-8" });
-				res.end(errorResult.html);
-			} else {
-				res.writeHead(500, { "Content-Type": "text/plain; charset=utf-8" });
-				res.end(toPublicErrorInfo(err).message);
-			}
-			return;
-		}
-		const errorResult = await renderErrorPage({
-			routes,
-			status: 404,
-			config,
-			actions: publicActions
-		});
-		if (errorResult) {
-			res.writeHead(errorResult.status, { "Content-Type": "text/html; charset=utf-8" });
-			res.end(errorResult.html);
-			return;
-		}
-		res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
-		res.end(`Not found: ${req.url}`);
-	});
-	return {
-		server,
-		listen() {
-			return new Promise((resolve) => {
-				server.listen(options.port ?? 3e3, options.host ?? "127.0.0.1", () => {
-					console.log(`\n  → SSR server http://${options.host ?? "127.0.0.1"}:${options.port ?? 3e3}`);
-					resolve();
-				});
-			});
-		},
-		close() {
-			return new Promise((resolve, reject) => {
-				server.close((err) => err ? reject(err) : resolve());
-			});
-		}
-	};
-}
-async function tryServeStatic(res, publicDir, urlPath) {
-	const filePath = await resolveStaticFile(publicDir, urlPath);
-	if (!filePath) return false;
-	const contentType = guessContentType$1(filePath);
-	let data = await readFile(filePath);
-	if (contentType.includes("text/html")) data = data.toString("utf8").replace("<meta name=\"elur:render-endpoint\" content=\"off\" />", "<meta name=\"elur:render-endpoint\" content=\"on\" />");
-	res.writeHead(200, {
-		"Content-Type": contentType,
-		"Content-Length": Buffer.byteLength(data)
-	});
-	res.end(data);
-	return true;
-}
-function canUsePublicCache(request) {
-	return !request.headers.has("cookie") && !request.headers.has("authorization");
-}
-function applyHeaders(headers, values) {
-	if (!values) return;
-	for (const [name, value] of Object.entries(values)) headers.set(name, value);
-}
-function readRequestBody$1(req) {
-	return new Promise((resolve, reject) => {
-		let body = "";
-		req.setEncoding("utf8");
-		req.on("data", (chunk) => {
-			body += chunk;
-		});
-		req.on("end", () => resolve(body));
-		req.on("error", reject);
-	});
-}
-function guessContentType$1(filePath) {
-	switch (extname(filePath)) {
-		case ".html": return "text/html; charset=utf-8";
-		case ".js":
-		case ".mjs": return "application/javascript; charset=utf-8";
-		case ".css": return "text/css; charset=utf-8";
-		case ".json": return "application/json; charset=utf-8";
-		case ".svg": return "image/svg+xml";
-		case ".png": return "image/png";
-		case ".jpg":
-		case ".jpeg": return "image/jpeg";
-		case ".webp": return "image/webp";
-		case ".avif": return "image/avif";
-		case ".ico": return "image/x-icon";
-		case ".woff": return "font/woff";
-		case ".woff2": return "font/woff2";
-		case ".wasm": return "application/wasm";
-		default: return "application/octet-stream";
-	}
+function isActionFailure(value) {
+	return typeof value === "object" && value !== null && value.__elur_js_action_failure === true;
 }
 /**
-* Maps a concrete page path (e.g. `/movies/inception`) to the route pattern
-* key used by the action registry (e.g. `/movies/:slug`). Falls back to the
-* path itself when it matches an exact registry key.
+* Type guard for redirects. Uses the marker field so it works across bundling
+* boundaries where `instanceof` fails.
 */
-function resolveActionPageKey(page, routes) {
-	if (!page) return void 0;
-	if (routes.pages.some((route) => route.path === page)) return page;
-	const match = matchRoute(page, routes.pages);
-	return match ? match.route.path : page;
-}
-/** Resolves the ISR TTL for a page: route `revalidate` or the default. */
-async function resolveTtl(options, pathname, routes) {
-	const match = matchRoute(pathname, routes.pages);
-	if (!match) return void 0;
-	return (match.route.dataPath ? (await import(match.route.dataPath)).revalidate : void 0) ?? options.defaultRevalidate;
-}
-function extractBody(fullHtml) {
-	const match = fullHtml.match(/<div id="app">([\s\S]*)<\/div>\s*(<script|$)/);
-	return match ? match[1].trim() : fullHtml;
-}
-function extractTitle(fullHtml) {
-	const match = fullHtml.match(/<title>([^<]*)<\/title>/);
-	return match ? match[1] : "";
-}
-//#endregion
-//#region src/config/index.ts
-async function loadElurConfig(options = {}) {
-	const initialRoot = resolve(options.root ?? process.cwd());
-	const configFile = options.configFile ? resolve(initialRoot, options.configFile) : await findConfigFile(initialRoot);
-	let loaded = {};
-	if (configFile) {
-		const result = await loadConfigFromFile({
-			command: options.command === "build" ? "build" : "serve",
-			mode: options.mode ?? "development"
-		}, configFile, initialRoot);
-		if (!result) throw new Error(`[elur-kit] Could not load config: ${configFile}`);
-		loaded = result.config;
-	}
-	const merged = mergeConfig(loaded, options.overrides ?? {});
-	const root = resolve(initialRoot, merged.root ?? ".");
-	const resolved = resolveConfig(root, merged, configFile);
-	await runIntegrationHook(resolved.integrations, "config", [resolved, {
-		root,
-		command: options.command ?? "dev"
-	}]);
-	return resolved;
+function isRedirectResponse(value) {
+	return typeof value === "object" && value !== null && value.__elur_js_action_redirect === true;
 }
-function resolveConfig(root, config, configFile) {
-	if (config.site) new URL(config.site);
-	const base = normalizeBase(config.base ?? "/");
-	const imageQuality = config.images?.quality ?? 80;
-	if (!Number.isFinite(imageQuality) || imageQuality < 1 || imageQuality > 100) throw new Error("[elur-kit] images.quality must be between 1 and 100");
+/**
+* Maps an arbitrary thrown value to a public-safe error info. By default the
+* public message is generic; `includeDetail` (dev/verbose mode) appends the
+* original `Error.message` for local debugging.
+*/
+function toPublicErrorInfo(error, options = {}) {
+	const code = "INTERNAL_SERVER_ERROR";
+	const status = 500;
+	if (options.includeDetail && error instanceof Error && error.message) return {
+		code,
+		status,
+		message: error.message
+	};
 	return {
-		root,
-		appDir: resolveInside(root, config.appDir ?? "src/app", "appDir"),
-		islandsDir: resolveInside(root, config.islandsDir ?? "src/islands", "islandsDir"),
-		contentDir: resolveInside(root, config.contentDir ?? "src/content", "contentDir"),
-		publicDir: resolveInside(root, config.publicDir ?? "public", "publicDir"),
-		outDir: resolveInside(root, config.outDir ?? "dist", "outDir"),
-		site: config.site,
-		base,
-		trailingSlash: config.trailingSlash ?? "ignore",
-		output: config.output ?? "static",
-		adapter: config.adapter,
-		images: {
-			formats: config.images?.formats ?? ["webp", "avif"],
-			quality: imageQuality,
-			strict: config.images?.strict ?? false
-		},
-		cache: {
-			dir: resolveInside(root, config.cache?.dir ?? ".elur/cache", "cache.dir"),
-			defaultRevalidate: config.cache?.defaultRevalidate
-		},
-		security: {
-			allowedOrigins: config.security?.allowedOrigins ?? [],
-			strictOrigin: config.security?.strictOrigin ?? false,
-			bodyLimit: config.security?.bodyLimit ?? 1048576,
-			headers: config.security?.headers === false ? false : config.security?.headers ?? {}
-		},
-		router: {
-			enabled: config.router?.enabled ?? true,
-			prefetch: config.router?.prefetch ?? true
-		},
-		integrations: config.integrations ?? [],
-		configFile
+		code,
+		status,
+		message: "Internal Server Error"
 	};
 }
-function mergeConfig(base, override) {
-	return {
-		...base,
-		...override,
-		images: {
-			...base.images,
-			...override.images
-		},
-		cache: {
-			...base.cache,
-			...override.cache
-		},
-		security: {
-			...base.security,
-			...override.security
-		},
-		router: {
-			...base.router,
-			...override.router
-		},
-		integrations: override.integrations ?? base.integrations
+/**
+* Builds a production-safe JSON error Response. Logs the raw error separately
+* (never reflected in the response body) and keeps the request id header.
+*/
+function publicErrorResponse(error, options = {}) {
+	const info = toPublicErrorInfo(error, options);
+	const headers = {
+		"Content-Type": "application/json; charset=utf-8",
+		"Cache-Control": "no-store"
 	};
+	if (options.requestId) headers["X-Request-Id"] = options.requestId;
+	return new Response(JSON.stringify({ error: info }), {
+		status: info.status,
+		headers
+	});
 }
-function resolveInside(root, path, name) {
-	const resolved = isAbsolute(path) ? resolve(path) : resolve(root, path);
-	const rel = relative(root, resolved);
-	if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) throw new Error(`[elur-kit] ${name} must stay inside root: ${resolved}`);
-	return resolved;
+var init_errors = __esmMin((() => {}));
+//#endregion
+//#region src/action/origin.ts
+/**
+* Returns the host:port of a URL string, or undefined if it cannot be parsed.
+*/
+function originOf(urlString) {
+	if (!urlString) return void 0;
+	try {
+		const url = new URL(urlString);
+		if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
+		return url.origin;
+	} catch {
+		return;
+	}
 }
-function normalizeBase(base) {
-	if (!base.startsWith("/")) throw new Error("[elur-kit] base must start with /");
-	return base === "/" ? base : `${base.replace(/\/+$/, "")}/`;
+/**
+* Verifies that a request originates from the same host (or an allow-listed
+* origin). Returns an error message when the request must be rejected, or
+* undefined when it is allowed.
+*
+* @param request The incoming Request to actions.
+* @param options Origin check configuration.
+*/
+function verifyOrigin(request, options = {}) {
+	const targetOrigin = originOf(request.url);
+	if (!targetOrigin) return "Invalid target URL";
+	const origin = request.headers.get("Origin");
+	const referer = request.headers.get("Referer");
+	if (!origin && !referer) return options.strictOrigin ? "Missing Origin and Referer headers" : void 0;
+	const sourceOrigin = origin ? originOf(origin) : originOf(referer);
+	if (!sourceOrigin) return origin ? "Invalid Origin header" : "Invalid Referer header";
+	if (sourceOrigin === targetOrigin) return void 0;
+	if (options.allowedOrigins?.some((allowed) => originOf(allowed) === sourceOrigin)) return void 0;
+	return `Cross-origin request blocked: source "${sourceOrigin}" != target "${targetOrigin}"`;
 }
-var PREFERRED_CONFIG_FILES = [
-	"elur.config.ts",
-	"elur.config.js",
-	"elur.config.mjs"
-];
-var LEGACY_CONFIG_FILES = [
-	"elur.config.ts",
-	"elur.config.js",
-	"elur.config.mjs"
-];
-async function findConfigFile(root) {
-	for (const name of PREFERRED_CONFIG_FILES) {
-		const path = resolve(root, name);
+/** Builds a 403 Response for a rejected origin. */
+function originForbidden(message) {
+	return new Response(message, {
+		status: 403,
+		headers: { "Content-Type": "text/plain; charset=utf-8" }
+	});
+}
+var init_origin = __esmMin((() => {}));
+//#endregion
+//#region src/cache/adapter.ts
+var adapter_exports = /* @__PURE__ */ __exportAll({
+	cacheKey: () => cacheKey,
+	createFsCacheAdapter: () => createFsCacheAdapter,
+	getWithSWR: () => getWithSWR
+});
+/** Computes a SHA-256 key from a normalized identity string. */
+function cacheKey(...parts) {
+	return createHash("sha256").update(parts.join("\n")).digest("hex");
+}
+function createFsCacheAdapter(options) {
+	const { cacheDir } = options;
+	const maxEntries = options.maxEntries ?? 1e3;
+	const maxAgeMs = options.maxAgeMs ?? 864e5;
+	const inFlight = /* @__PURE__ */ new Map();
+	const tagIndexPath = join(cacheDir, "_tag-index.json");
+	async function loadTagIndex() {
 		try {
-			await access(path);
-			return path;
-		} catch {}
+			const raw = await readFile(tagIndexPath, "utf8");
+			return JSON.parse(raw);
+		} catch {
+			return {};
+		}
 	}
-	for (const name of LEGACY_CONFIG_FILES) {
-		const path = resolve(root, name);
+	async function saveTagIndex(index) {
+		await mkdir(dirname(tagIndexPath), { recursive: true });
+		const tmp = `${tagIndexPath}.${process.pid}.${randomUUID()}.tmp`;
 		try {
-			await access(path);
-			console.warn(`[elur-kit] "${name}" is deprecated and will be removed in a future release. Rename it to "elur.config.${name.split(".").slice(1).join(".")}" to keep your config working.`);
-			return path;
-		} catch {}
-	}
-}
-//#endregion
-//#region src/manifest/index.ts
-init_scan();
-init_route_scanner();
-async function createAppManifest(config) {
-	const [routes, actions, islands] = await Promise.all([
-		scanRoutes(config.appDir),
-		scanActions(config.appDir),
-		scanIslands(config.islandsDir)
-	]);
-	validateManifestRoutes(routes);
-	validateIslands(islands);
-	const manifest = {
-		version: 1,
-		root: config.root,
-		routes,
-		actions,
-		islands,
-		base: config.base,
-		output: config.output
-	};
-	await runIntegrationHook(config.integrations, "routes", [manifest, {
-		root: config.root,
-		command: "build"
-	}]);
-	return manifest;
-}
-async function writeAppManifest(manifest, path) {
-	await mkdir(dirname(path), { recursive: true });
-	await writeFile(path, JSON.stringify(toPortableManifest(manifest), null, 2), "utf8");
-}
-async function writeRouteTypes(manifest, path) {
-	const routePaths = manifest.routes.pages.map((route) => JSON.stringify(route.path));
-	const actionNames = Object.values(manifest.actions).flatMap((actions) => Object.keys(actions)).filter((name, index, names) => names.indexOf(name) === index).map((name) => JSON.stringify(name));
-	const source = [
-		`export type ElurRoutePath = ${routePaths.length ? routePaths.join(" | ") : "never"};`,
-		`export type ElurActionName = ${actionNames.length ? actionNames.join(" | ") : "never"};`,
-		"export interface ElurRouteParams { [name: string]: string | string[] | undefined }",
-		""
-	].join("\n");
-	await mkdir(dirname(path), { recursive: true });
-	await writeFile(path, source, "utf8");
-}
-function validateManifestRoutes(routes) {
-	const seen = /* @__PURE__ */ new Map();
-	for (const route of routes.pages) {
-		registerRoute(seen, route.path, route.pagePath, "page");
-		assertNotReserved(route.path, route.pagePath);
+			await writeFile(tmp, JSON.stringify(index), "utf8");
+			await rename(tmp, tagIndexPath);
+		} finally {
+			await rm(tmp, { force: true });
+		}
 	}
-	for (const route of routes.api) {
-		registerRoute(seen, route.path, route.routePath, "API");
-		assertNotReserved(route.path, route.routePath);
+	function entryPath(key) {
+		return join(cacheDir, `${key}.html.json`);
 	}
-}
-function registerRoute(seen, path, file, kind) {
-	const existing = seen.get(path);
-	if (existing) throw new Error(`[elur-kit] Duplicate ${kind} route "${path}": ${existing} and ${file}`);
-	seen.set(path, file);
-}
-function assertNotReserved(path, file) {
-	if (path === "/__elur-js" || path.startsWith("/__elur-js/") || path === "/_elur" || path.startsWith("/_elur/")) throw new Error(`[elur-kit] Reserved route "${path}" declared by ${file}`);
-}
-function validateIslands(islands) {
-	const names = /* @__PURE__ */ new Set();
-	for (const island of islands) {
-		if (names.has(island.name)) throw new Error(`[elur-kit] Duplicate island name: ${island.name}`);
-		names.add(island.name);
+	async function get(key) {
+		const existing = inFlight.get(key);
+		if (existing) return existing;
+		const promise = (async () => {
+			try {
+				const raw = await readFile(entryPath(key), "utf8");
+				return JSON.parse(raw);
+			} catch {
+				return null;
+			}
+		})();
+		inFlight.set(key, promise);
+		try {
+			return await promise;
+		} finally {
+			inFlight.delete(key);
+		}
+	}
+	async function set(key, value, opts) {
+		const path = entryPath(key);
+		await mkdir(dirname(path), { recursive: true });
+		const entry = {
+			html: value.html,
+			generatedAt: value.generatedAt ?? Date.now(),
+			revalidate: opts.revalidate,
+			tags: opts.tags,
+			version: opts.version
+		};
+		const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+		try {
+			await writeFile(tmp, JSON.stringify(entry), "utf8");
+			await rename(tmp, path);
+		} finally {
+			await rm(tmp, { force: true });
+		}
+		if (opts.tags && opts.tags.length > 0) {
+			const index = await loadTagIndex();
+			for (const tag of opts.tags) {
+				if (!index[tag]) index[tag] = [];
+				if (!index[tag].includes(key)) index[tag].push(key);
+			}
+			await saveTagIndex(index);
+		}
+		await maybeCleanup();
+	}
+	async function del(key) {
+		await rm(entryPath(key), { force: true });
+	}
+	async function invalidateTags(tags) {
+		if (tags.length === 0) return;
+		const index = await loadTagIndex();
+		const keysToDelete = /* @__PURE__ */ new Set();
+		for (const tag of tags) {
+			const keys = index[tag];
+			if (keys) {
+				for (const key of keys) keysToDelete.add(key);
+				delete index[tag];
+			}
+		}
+		await Promise.all([...keysToDelete].map((key) => del(key)));
+		await saveTagIndex(index);
+	}
+	let lastCleanup = 0;
+	async function maybeCleanup() {
+		const now = Date.now();
+		if (now - lastCleanup < 6e4) return;
+		lastCleanup = now;
+		try {
+			const files = await readdir(cacheDir);
+			let entryCount = 0;
+			const toDelete = [];
+			for (const file of files) {
+				if (!file.endsWith(".html.json")) continue;
+				entryCount++;
+				const filePath = join(cacheDir, file);
+				try {
+					if (now - (await stat(filePath)).mtimeMs > maxAgeMs) toDelete.push(filePath);
+				} catch {}
+			}
+			if (entryCount - toDelete.length > maxEntries) {
+				const candidates = [];
+				for (const file of files) {
+					if (!file.endsWith(".html.json")) continue;
+					const filePath = join(cacheDir, file);
+					if (toDelete.includes(filePath)) continue;
+					try {
+						const stats = await stat(filePath);
+						candidates.push({
+							path: filePath,
+							mtime: stats.mtimeMs
+						});
+					} catch {}
+				}
+				candidates.sort((a, b) => a.mtime - b.mtime);
+				const excess = entryCount - toDelete.length - maxEntries;
+				for (let i = 0; i < excess && i < candidates.length; i++) toDelete.push(candidates[i].path);
+			}
+			await Promise.all(toDelete.map((p) => rm(p, { force: true })));
+		} catch {}
 	}
-}
-function toPortableManifest(manifest) {
-	const relativePath = (path) => path ? relative(manifest.root, path).split("\\").join("/") : void 0;
-	const routes = {
-		pages: manifest.routes.pages.map((route) => ({
-			...route,
-			pagePath: relativePath(route.pagePath),
-			dataPath: relativePath(route.dataPath),
-			actionPath: relativePath(route.actionPath),
-			loadingPath: relativePath(route.loadingPath),
-			layouts: route.layouts.map((layout) => relativePath(layout))
-		})),
-		api: manifest.routes.api.map((route) => ({
-			...route,
-			routePath: relativePath(route.routePath)
-		})),
-		error404: manifest.routes.error404 ? {
-			...manifest.routes.error404,
-			pagePath: relativePath(manifest.routes.error404.pagePath),
-			dataPath: relativePath(manifest.routes.error404.dataPath),
-			actionPath: relativePath(manifest.routes.error404.actionPath),
-			loadingPath: relativePath(manifest.routes.error404.loadingPath),
-			layouts: manifest.routes.error404.layouts.map((layout) => relativePath(layout))
-		} : void 0,
-		error500: manifest.routes.error500 ? {
-			...manifest.routes.error500,
-			pagePath: relativePath(manifest.routes.error500.pagePath),
-			dataPath: relativePath(manifest.routes.error500.dataPath),
-			actionPath: relativePath(manifest.routes.error500.actionPath),
-			loadingPath: relativePath(manifest.routes.error500.loadingPath),
-			layouts: manifest.routes.error500.layouts.map((layout) => relativePath(layout))
-		} : void 0
-	};
-	const actions = {};
-	for (const [page, pageActions] of Object.entries(manifest.actions)) actions[page] = Object.fromEntries(Object.entries(pageActions).map(([name, path]) => [name, relativePath(path)]));
 	return {
-		...manifest,
-		root: ".",
-		routes,
-		actions,
-		islands: manifest.islands.map((island) => ({
-			...island,
-			filePath: relativePath(island.filePath)
-		}))
+		get,
+		set,
+		delete: del,
+		invalidateTags
 	};
 }
-//#endregion
-//#region src/runtime/capabilities.ts
-/** True when the host can write to persistent storage (for ISR/cache/image writes). */
-function supportsPersistentStorage(capabilities) {
-	return capabilities.filesystem === "persistent";
-}
 /**
-* Validates a capability declaration and reports incompatible combinations.
-* Used by the build pipeline so invalid hosts fail at build time instead of
-* producing a broken runtime.
+* Gets a cached entry. If the entry is stale (past revalidate), serves it
+* immediately and triggers a background revalidation.
+*
+* @param adapter The cache adapter.
+* @param key The cache key.
+* @param revalidate The revalidation function (called if stale or missing).
+* @returns The cache entry (fresh or stale), or null if missing.
 */
-function validateCapabilities(capabilities, features = {}) {
-	const problems = [];
-	if (features.isr && !supportsPersistentStorage(capabilities)) problems.push(`ISR requires a persistent filesystem; the host declares filesystem="${capabilities.filesystem}".`);
-	if (features.images && capabilities.imageRuntime === false && capabilities.filesystem === "none") problems.push("On-demand image transforms require either imageRuntime=true or a readable filesystem; the host has neither.");
-	if (features.streaming && capabilities.streaming === false) problems.push("Streaming was requested but the host declares streaming=false.");
+async function getWithSWR(adapter, key, revalidate) {
+	const entry = await adapter.get(key);
+	if (!entry) return {
+		entry: await revalidate(),
+		stale: false
+	};
+	if (Date.now() - entry.generatedAt >= entry.revalidate * 1e3) {
+		revalidate().then((fresh) => {
+			if (fresh) adapter.set(key, fresh, {
+				revalidate: entry.revalidate,
+				tags: entry.tags,
+				version: entry.version
+			}).catch((err) => {
+				console.error("[elur-kit] background cache write failed:", err);
+			});
+		}, (err) => {
+			console.error("[elur-kit] background revalidation failed:", err);
+		});
+		return {
+			entry,
+			stale: true
+		};
+	}
 	return {
-		ok: problems.length === 0,
-		problems
+		entry,
+		stale: false
 	};
 }
-var DEFAULT_CAPABILITIES, SERVERLESS_CAPABILITIES;
-var init_capabilities = __esmMin((() => {
-	DEFAULT_CAPABILITIES = {
-		streaming: true,
-		filesystem: "persistent",
-		imageRuntime: true,
-		backgroundWork: true
-	};
-	SERVERLESS_CAPABILITIES = {
-		streaming: true,
-		filesystem: "ephemeral",
-		imageRuntime: false,
-		backgroundWork: false,
-		maxBodySize: 1048576
+var init_adapter = __esmMin((() => {}));
+//#endregion
+//#region src/cache/invalidation.ts
+/**
+* Connects a CacheAdapter to the default invalidator so that tag/path
+* invalidation events from actions are dispatched to the cache.
+*
+* Returns an unsubscribe function.
+*/
+function connectCacheAdapter(adapter, invalidator = defaultInvalidator) {
+	return invalidator.on(async (event) => {
+		if (event.tags && event.tags.length > 0) await adapter.invalidateTags(event.tags);
+		if (event.paths && event.paths.length > 0 && adapter.delete) {
+			const { cacheKey } = await Promise.resolve().then(() => (init_adapter(), adapter_exports));
+			await Promise.all(event.paths.map((p) => adapter.delete(cacheKey(p))));
+		}
+	});
+}
+var CacheInvalidator, defaultInvalidator;
+var init_invalidation = __esmMin((() => {
+	CacheInvalidator = class {
+		listeners = /* @__PURE__ */ new Set();
+		/** Registers a listener for invalidation events. Returns an unsubscribe function. */
+		on(listener) {
+			this.listeners.add(listener);
+			return () => this.listeners.delete(listener);
+		}
+		/** Emits an invalidation event to all listeners. */
+		async emit(event) {
+			const promises = [];
+			for (const listener of this.listeners) try {
+				const result = listener(event);
+				if (result instanceof Promise) promises.push(result.catch((err) => {
+					console.error("[elur-kit] invalidation listener error:", err);
+				}));
+			} catch (err) {
+				console.error("[elur-kit] invalidation listener error:", err);
+			}
+			await Promise.all(promises);
+		}
+		/** Convenience: invalidate by tags. */
+		async invalidateTags(tags, source) {
+			if (tags.length === 0) return;
+			await this.emit({
+				tags,
+				source
+			});
+		}
+		/** Convenience: invalidate by paths. */
+		async invalidatePaths(paths, source) {
+			if (paths.length === 0) return;
+			await this.emit({
+				paths,
+				source
+			});
+		}
+		/** Removes all listeners. */
+		clear() {
+			this.listeners.clear();
+		}
 	};
+	defaultInvalidator = new CacheInvalidator();
 }));
 //#endregion
-//#region src/build/vite-build.ts
-var vite_build_exports = /* @__PURE__ */ __exportAll({
-	beginAtomicStage: () => beginAtomicStage,
-	buildClientBundle: () => buildClientBundle,
-	copyPublicAssets: () => copyPublicAssets
-});
+//#region src/action/server.ts
 /**
-* Build the client hydration bundle using the Vite JavaScript API.
-*
-* The user's config is loaded programmatically and the elur interpolation
-* plugin is injected so partial attribute interpolations inside islands are
-* transformed before reaching the browser.
+* Reads the request body as text, enforcing a maximum size.
+* Returns a 413 response if the body exceeds the limit.
 */
-async function buildClientBundle(options) {
-	const log = options.logPrefix ?? "[client]";
-	console.log(`${log} Building hydration bundle...`);
-	const userConfig = await loadUserConfig(options.userConfigPath, options.root);
-	const pluginOptions = shouldUseLegacyInterpolation(options.interpolation ?? "auto") ? elurJsInterpolationPlugin({
-		appDir: options.appDir,
-		islandsDir: options.islandsDir
-	}) : [];
-	const config = {
-		...userConfig,
-		root: options.root,
-		base: options.base ?? userConfig.base ?? "/",
-		build: {
-			...userConfig.build ?? {},
-			outDir: options.outDir,
-			emptyOutDir: true
-		},
-		plugins: [...userConfig.plugins ?? [], pluginOptions],
-		configFile: false
+async function readBodyWithLimit(request, limit) {
+	const contentLength = request.headers.get("Content-Length");
+	if (contentLength && parseInt(contentLength, 10) > limit) return {
+		ok: false,
+		response: new Response("Request body too large", {
+			status: 413,
+			headers: { "Content-Type": "text/plain" }
+		})
+	};
+	const reader = request.body?.getReader();
+	if (!reader) return {
+		ok: true,
+		text: ""
+	};
+	const chunks = [];
+	let totalSize = 0;
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			totalSize += value.byteLength;
+			if (totalSize > limit) {
+				try {
+					reader.cancel();
+				} catch {}
+				return {
+					ok: false,
+					response: new Response("Request body too large", {
+						status: 413,
+						headers: { "Content-Type": "text/plain" }
+					})
+				};
+			}
+			chunks.push(value);
+		}
+	} finally {
+		try {
+			reader.releaseLock();
+		} catch {}
+	}
+	const total = new Uint8Array(totalSize);
+	let offset = 0;
+	for (const chunk of chunks) {
+		total.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return {
+		ok: true,
+		text: new TextDecoder().decode(total)
+	};
+}
+function parseFormBody(body) {
+	const params = new URLSearchParams(body);
+	const result = {};
+	for (const [key, value] of params) if (result[key] === void 0) result[key] = value;
+	else if (Array.isArray(result[key])) result[key].push(value);
+	else result[key] = [result[key], value];
+	return result;
+}
+async function parseActionRequest(request, bodyLimit = DEFAULT_BODY_LIMIT) {
+	if (request.method !== "POST") return {
+		ok: false,
+		response: new Response("Method not allowed", {
+			status: 405,
+			headers: { "Content-Type": "text/plain" }
+		})
+	};
+	const contentType = request.headers.get("Content-Type") ?? "";
+	const wantsJson = (request.headers.get("Accept") ?? "").includes("application/json");
+	let name;
+	let page;
+	let args = [];
+	if (contentType.includes("application/json")) {
+		const bodyResult = await readBodyWithLimit(request, bodyLimit);
+		if (!bodyResult.ok) return {
+			ok: false,
+			response: bodyResult.response
+		};
+		let body;
+		try {
+			body = JSON.parse(bodyResult.text);
+		} catch {
+			return {
+				ok: false,
+				response: new Response("Invalid JSON body", {
+					status: 400,
+					headers: { "Content-Type": "text/plain" }
+				})
+			};
+		}
+		name = body.name;
+		page = body.page;
+		args = Array.isArray(body.args) ? body.args : [];
+	} else if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+		if (contentType.includes("multipart/form-data")) {
+			const contentLength = request.headers.get("Content-Length");
+			if (contentLength && parseInt(contentLength, 10) > bodyLimit) return {
+				ok: false,
+				response: new Response("Request body too large", {
+					status: 413,
+					headers: { "Content-Type": "text/plain" }
+				})
+			};
+			let form;
+			try {
+				form = await request.formData();
+			} catch {
+				return {
+					ok: false,
+					response: new Response("Invalid form body", {
+						status: 400,
+						headers: { "Content-Type": "text/plain" }
+					})
+				};
+			}
+			name = form.get("__elur_js_action_name") ?? void 0;
+			page = form.get("__elur_js_action_page") ?? void 0;
+			const input = {};
+			for (const [key, value] of form) {
+				if (key === "__elur_js_action_name" || key === "__elur_js_action_page") continue;
+				input[key] = value;
+			}
+			args = [input];
+		} else {
+			const bodyResult = await readBodyWithLimit(request, bodyLimit);
+			if (!bodyResult.ok) return {
+				ok: false,
+				response: bodyResult.response
+			};
+			const form = parseFormBody(bodyResult.text);
+			name = form.__elur_js_action_name;
+			page = form.__elur_js_action_page;
+			const input = {};
+			for (const [key, value] of Object.entries(form)) {
+				if (key === "__elur_js_action_name" || key === "__elur_js_action_page") continue;
+				input[key] = value;
+			}
+			args = [input];
+		}
+	} else {
+		const bodyResult = await readBodyWithLimit(request, bodyLimit);
+		if (!bodyResult.ok) return {
+			ok: false,
+			response: bodyResult.response
+		};
+		const form = parseFormBody(bodyResult.text);
+		name = form.__elur_js_action_name;
+		page = form.__elur_js_action_page;
+		const input = {};
+		for (const [key, value] of Object.entries(form)) {
+			if (key === "__elur_js_action_name" || key === "__elur_js_action_page") continue;
+			input[key] = value;
+		}
+		args = [input];
+	}
+	if (!name || typeof name !== "string") return {
+		ok: false,
+		response: new Response("Missing action name", {
+			status: 400,
+			headers: { "Content-Type": "text/plain" }
+		})
 	};
-	const result = await build(config);
-	const outputCount = (Array.isArray(result) ? result : [result]).reduce((n, r) => n + ("output" in r ? r.output?.length ?? 0 : 0), 0);
-	console.log(`${log} ✓ ${outputCount} asset(s) emitted → ${relative(options.root, options.outDir)}`);
 	return {
-		outDir: options.outDir,
-		outputCount
+		ok: true,
+		name,
+		page,
+		args,
+		wantsJson
 	};
 }
-async function loadUserConfig(path, _root) {
-	const mod = await import(path);
-	const raw = mod.default ?? mod;
-	const resolved = typeof raw === "function" ? await raw({
-		command: "build",
-		mode: "production"
-	}) : raw;
-	return (resolved && typeof resolved.then === "function" ? await resolved : resolved) ?? {};
-}
 /**
-* Prepare an atomic staging directory for build output.
+* Handles a POST request to the server action endpoint.
 *
-* Usage:
-*   const stage = await beginAtomicStage({ outDir });
-*   try {
-*     await buildInto(stage.tempDir);
-*     await stage.commit();
-*   } catch (err) {
-*     await stage.rollback();
-*     throw err;
-*   }
+* Accepts both JSON requests (`{ name, page?, args }`) and HTML form submissions
+* for progressive enhancement. The provided resolver looks up the action
+* implementation, invokes it with the supplied arguments and returns the result
+* as JSON or redirects back to the request origin for form submissions.
+*
+* Origin verification (CSRF protection) runs before parsing the body: any
+* cross-origin POST is rejected with 403 unless its origin is allow-listed via
+* `security.allowedOrigins`.
+*
+* For progressive-enhancement form submissions that fail, the failure payload
+* is relayed back via a short-lived `__elur_js_action_error` cookie (SameSite=Lax,
+* Max-Age=15s) instead of a query param, so errors do not leak into browser
+* history, server logs or third-party Referer headers.
 */
-async function beginAtomicStage(options) {
-	const outDir = resolve(options.outDir);
-	const tempDir = resolve(options.tempDir ?? join(dirname(outDir), `.${basename$1(outDir)}.tmp-${process.pid}`));
-	await rm(tempDir, {
-		recursive: true,
-		force: true
-	});
-	await mkdir(tempDir, { recursive: true });
-	const commit = async () => {
-		const backup = options.keepExisting && existsSync(outDir) ? `${outDir}.bak-${process.pid}` : void 0;
-		if (backup) {
-			await rm(backup, {
-				recursive: true,
-				force: true
+async function handleActionRequest(request, resolveAction, security = {}) {
+	const originError = verifyOrigin(request, security);
+	if (originError) return originForbidden(originError);
+	const parsed = await parseActionRequest(request, security.bodyLimit ?? DEFAULT_BODY_LIMIT);
+	if (!parsed.ok) return parsed.response;
+	const { name, page, args, wantsJson } = parsed;
+	try {
+		const action = await resolveAction(name, page);
+		if (!action) {
+			const message = page ? `Action not found: ${name} (page: ${page})` : `Action not found: ${name}`;
+			return new Response(message, {
+				status: 404,
+				headers: { "Content-Type": "text/plain" }
 			});
-			await safeRename(outDir, backup);
 		}
-		try {
-			await safeRename(tempDir, outDir);
-		} catch (err) {
-			if (isCrossDevice(err)) {
-				await cp(tempDir, outDir, {
-					recursive: true,
-					force: true
-				});
-				await rm(tempDir, {
-					recursive: true,
-					force: true
-				});
-			} else {
-				if (backup) await safeRename(backup, outDir);
-				throw err;
-			}
+		const actionMeta = action.__elurAction;
+		let result;
+		if (actionMeta) {
+			const ctx = {
+				request,
+				signal: request.signal,
+				idempotencyKey: request.headers.get("Idempotency-Key") ?? void 0,
+				params: {},
+				locals: {}
+			};
+			result = await action(args[0], ctx);
+		} else result = await action(...args);
+		if (!isActionFailure(result) && actionMeta) {
+			const tags = actionMeta.invalidateTags ?? [];
+			const paths = actionMeta.invalidatePaths ?? [];
+			if (tags.length > 0 || paths.length > 0) await defaultInvalidator.emit({
+				tags,
+				paths,
+				source: name
+			});
 		}
-		if (backup) await rm(backup, {
-			recursive: true,
-			force: true
+		if (isActionFailure(result)) {
+			if (wantsJson) return new Response(JSON.stringify({
+				__elur_js_action_failure: true,
+				status: result.status,
+				data: result.data
+			}), {
+				status: result.status,
+				headers: { "Content-Type": "application/json" }
+			});
+			const referer = request.headers.get("Referer") ?? "/";
+			const url = new URL(referer, "http://localhost");
+			const { value } = encodeActionErrorCookie(result.data, result.status);
+			return new Response(null, {
+				status: 303,
+				headers: {
+					Location: url.pathname + url.search,
+					"Content-Type": "text/plain",
+					"Set-Cookie": setActionErrorCookieHeader(value)
+				}
+			});
+		}
+		if (isRedirectResponse(result)) {
+			if (wantsJson) return new Response(JSON.stringify({
+				__elur_js_action_redirect: true,
+				status: result.status,
+				location: result.location
+			}), {
+				status: 200,
+				headers: { "Content-Type": "application/json" }
+			});
+			return new Response(null, {
+				status: result.status,
+				headers: {
+					Location: result.location,
+					"Content-Type": "text/plain"
+				}
+			});
+		}
+		if (wantsJson) return new Response(JSON.stringify(result ?? null), {
+			status: 200,
+			headers: { "Content-Type": "application/json" }
 		});
-	};
-	const rollback = async () => {
-		await rm(tempDir, {
-			recursive: true,
-			force: true
+		const referer = request.headers.get("Referer") ?? "/";
+		return new Response(null, {
+			status: 303,
+			headers: {
+				Location: typeof result === "string" ? result : referer,
+				"Content-Type": "text/plain"
+			}
 		});
-	};
-	return {
-		tempDir,
-		commit,
-		rollback
-	};
-}
-function basename$1(path) {
-	const parts = path.split(/[\\/]+/).filter(Boolean);
-	return parts[parts.length - 1] ?? "output";
-}
-async function safeRename(src, dest) {
-	await rm(dest, {
-		recursive: true,
-		force: true
-	});
-	try {
-		await rename(src, dest);
 	} catch (err) {
-		if (isCrossDevice(err)) {
-			await cp(src, dest, {
-				recursive: true,
-				force: true
-			});
-			await rm(src, {
-				recursive: true,
-				force: true
-			});
-		} else throw err;
+		console.error("[elur-kit] Action error:", err);
+		return publicErrorResponse(err, { includeDetail: false });
 	}
 }
-function isCrossDevice(err) {
-	return err?.code === "EXDEV";
-}
+var DEFAULT_BODY_LIMIT;
+var init_server = __esmMin((() => {
+	init_errors();
+	init_origin();
+	init_invalidation();
+	init_error_store();
+	DEFAULT_BODY_LIMIT = 1048576;
+}));
+//#endregion
+//#region src/ssr/stream.ts
 /**
-* Copy the public directory into the output directory.
-* Returns the number of files copied.
+* Render only the inner HTML body for a page. Used by the streaming endpoint
+* to inject the real content into the shell.
 */
-async function copyPublicAssets(options) {
+async function renderPageBody(options) {
+	const { routes, pathname, searchParams, config, actions, importer = defaultImport$1, request } = options;
+	const match = matchRoute(pathname, routes.pages);
+	if (!match) throw new RouteNotFoundError(pathname);
+	const result = await renderPage({
+		route: match.route,
+		params: match.params,
+		searchParams,
+		config,
+		actions,
+		importer,
+		request
+	});
+	if (result.response) return {
+		body: "",
+		title: "",
+		response: result.response
+	};
+	const body = extractAppBody(result.html)?.trim() ?? result.html.match(/<div id="app">([\s\S]*)<\/div>\s*(<script|$)/)?.[1]?.trim() ?? result.html;
+	const titleMatch = result.html.match(/<title[^>]*>([^<]*)<\/title>/);
+	return {
+		body,
+		title: titleMatch ? titleMatch[1] : result.resolvedTitle ?? "",
+		fullHtml: result.html,
+		clearActionErrorCookie: result.clearActionErrorCookie,
+		head: result.head,
+		data: result.data !== void 0 ? serializeData(result.data) : void 0,
+		actions: actions && Object.keys(actions).length > 0 ? serializeData(actions) : void 0
+	};
+}
+var defaultImport$1, RouteNotFoundError;
+var init_stream = __esmMin((() => {
+	init_document_shell();
+	init_match();
+	init_render();
+	defaultImport$1 = (path) => import(path);
+	RouteNotFoundError = class extends Error {
+		constructor(pathname) {
+			super(`No route found for ${pathname}`);
+			this.name = "RouteNotFoundError";
+		}
+	};
+}));
+//#endregion
+//#region src/runtime/static.ts
+function isInside(root, candidate) {
+	return candidate === root || candidate.startsWith(`${root}${sep}`);
+}
+function decodePathname(pathname) {
 	try {
-		await access(options.publicDir);
-		if (!(await stat(options.publicDir)).isDirectory()) return 0;
+		const decoded = decodeURIComponent(pathname);
+		if (decoded.includes("\0") || decoded.includes("\\") || /%(?:00|2e|2f|5c)/i.test(decoded)) return null;
+		if (decoded.split("/").some((segment) => segment === "..")) return null;
+		return decoded;
 	} catch {
-		return 0;
+		return null;
 	}
-	await mkdir(options.outDir, { recursive: true });
-	await cp(options.publicDir, options.outDir, {
-		recursive: true,
-		force: true
-	});
-	return countFiles(options.outDir);
 }
-async function countFiles(dir) {
-	const { readdir } = await import("node:fs/promises");
-	let count = 0;
-	async function walk(d) {
-		const entries = await readdir(d, { withFileTypes: true });
-		for (const entry of entries) {
-			const path = join(d, entry.name);
-			if (entry.isDirectory()) await walk(path);
-			else count++;
-		}
+async function resolveStaticFile(root, pathname) {
+	const decoded = decodePathname(pathname);
+	if (decoded === null) return null;
+	const resolvedRoot = resolve(root);
+	const relativePath = decoded.replace(/^\/+/, "");
+	let candidate = resolve(resolvedRoot, relativePath);
+	if (!isInside(resolvedRoot, candidate)) return null;
+	try {
+		if ((await stat(candidate)).isDirectory()) candidate = resolve(candidate, "index.html");
+	} catch {
+		if (decoded.endsWith("/") || extname(decoded) === "") candidate = resolve(candidate, "index.html");
+	}
+	if (!isInside(resolvedRoot, candidate)) return null;
+	try {
+		const [canonicalRoot, canonicalCandidate, candidateStat] = await Promise.all([
+			realpath(resolvedRoot),
+			realpath(candidate),
+			stat(candidate)
+		]);
+		if (!candidateStat.isFile() || !isInside(canonicalRoot, canonicalCandidate)) return null;
+		return canonicalCandidate;
+	} catch {
+		return null;
 	}
-	await walk(dir);
-	return count;
 }
-var init_vite_build = __esmMin((() => {
-	init_interpolation_plugin();
-}));
+var init_static = __esmMin((() => {}));
 //#endregion
 //#region src/runtime/context.ts
 function htmlResponse(body, status = 200, headers) {
@@ -3567,6 +4047,213 @@ var init_security_headers = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region src/router/redirects.ts
+/**
+* Checks if a pathname matches a redirect rule and returns the redirect
+* Response if so.
+*/
+function matchRedirect(pathname, rules) {
+	for (const rule of rules) {
+		const params = matchPattern(pathname, rule.from);
+		if (params) {
+			const location = interpolatePath(rule.to, params);
+			const status = rule.status ?? 308;
+			return new Response(null, {
+				status,
+				headers: { Location: location }
+			});
+		}
+	}
+}
+/**
+* Checks if a pathname matches a rewrite rule and returns the rewritten
+* pathname if so.
+*/
+function matchRewrite(pathname, rules) {
+	for (const rule of rules) {
+		const params = matchPattern(pathname, rule.from);
+		if (params) return interpolatePath(rule.to, params);
+	}
+}
+/**
+* Returns headers that should be applied to a response for the given pathname.
+*/
+function matchRouteHeaders(pathname, rules) {
+	for (const rule of rules) if (matchPattern(pathname, rule.path)) return rule.headers;
+}
+/**
+* Matches a pathname against a pattern with :param and * wildcards.
+* Returns the extracted params, or undefined if no match.
+*/
+function matchPattern(pathname, pattern) {
+	const requestSegments = pathname.split("?")[0].split("/").filter(Boolean);
+	const patternSegments = pattern.split("/").filter(Boolean);
+	const params = {};
+	let i = 0;
+	for (let r = 0; r < patternSegments.length; r++) {
+		const seg = patternSegments[r];
+		if (seg === "*") return params;
+		if (seg.endsWith("*")) {
+			const name = seg.slice(1, -1);
+			params[name] = requestSegments.slice(i).join("/");
+			return params;
+		}
+		if (seg.startsWith(":")) {
+			const name = seg.slice(1);
+			if (requestSegments[i] === void 0) return void 0;
+			params[name] = requestSegments[i];
+			i++;
+			continue;
+		}
+		if (seg !== requestSegments[i]) return void 0;
+		i++;
+	}
+	if (i !== requestSegments.length) return void 0;
+	return params;
+}
+/**
+* Interpolates :param placeholders in a path with actual values.
+*/
+function interpolatePath(template, params) {
+	return template.replace(/:(\w+)\*?/g, (_match, name) => {
+		return params[name] ?? "";
+	});
+}
+var init_redirects = __esmMin((() => {}));
+//#endregion
+//#region src/middleware/stream-boundary.ts
+/**
+* Builds the resolved content chunk for a boundary ID.
+* Emits a `<template>` element with the resolved content, followed by a
+* `<script>` that replaces the fallback div with the template content
+* in-place. This is real Suspense streaming — the browser swaps the DOM
+* node without a full re-render.
+*
+* (v2.1 — Fix #4: real Suspense streaming with `<template>` replacement)
+*/
+function buildResolvedChunk(boundaryId, resolvedHtml) {
+	return `<template id="${boundaryId}-tpl">${resolvedHtml}</template><script>(function(){var t=document.getElementById(${JSON.stringify(boundaryId + "-tpl")});var f=document.getElementById(${JSON.stringify(boundaryId)});if(t&&f){f.replaceWith(t.content.cloneNode(true));}document.dispatchEvent(new CustomEvent("elur:rendered"));})();<\/script>`;
+}
+var init_stream_boundary = __esmMin((() => {
+	new AsyncLocalStorage();
+}));
+//#endregion
+//#region src/ssr/stream-response.ts
+/**
+* Mid-stream error notice swapped into the loading boundary when the
+* background render fails after the shell was already sent. Inline styles
+* keep it self-contained (the page's CSS may assume the final layout).
+*/
+function buildErrorNotice() {
+	return "<div role=\"alert\" style=\"margin:2rem auto;max-width:32rem;padding:1rem 1.25rem;border:1px solid #e5484d;border-radius:8px;color:#b3373c;font-family:system-ui,sans-serif\"><strong style=\"display:block;margin-bottom:.25rem\">No se pudo cargar el contenido.</strong><span>Recarga la página para intentarlo de nuevo.</span></div>";
+}
+/**
+* Creates a streaming Response that sends the shell + loading fallback first,
+* then appends the resolved content.
+*
+* If the route has no loading boundary, falls back to a normal renderPage.
+*/
+async function createStreamingResponse(options) {
+	const { route, params, searchParams, config, actions, importer = defaultImport, request, signal } = options;
+	if (!route.loadingPath) {
+		const result = await renderPage({
+			route,
+			params,
+			searchParams,
+			config,
+			actions,
+			importer,
+			request
+		});
+		if (result.response) return result.response;
+		return new Response(result.html, { headers: { "Content-Type": "text/html; charset=utf-8" } });
+	}
+	if (signal?.aborted) return new Response("Client Closed Request", { status: 499 });
+	const loadingHtml = await renderToString$1((await importer(route.loadingPath)).default);
+	const boundaryId = `elur-stream-${randomUUID().slice(0, 8)}`;
+	const routerCfg = config.router;
+	const routerEnabled = routerCfg?.enabled !== false;
+	const routerEntry = routerCfg?.entry && routerEnabled && config.js !== "legacy" ? routerCfg.entry : void 0;
+	const shellHtml = documentShell({
+		title: "Loading...",
+		lang: config.lang,
+		body: `<div id="${boundaryId}">${loadingHtml}</div>`,
+		data: {
+			__elur_js_streaming: true,
+			page: route.path
+		},
+		actions,
+		clientEntry: config.clientEntry,
+		routerEntry,
+		routerEnabled: routerCfg ? routerEnabled : void 0,
+		renderEndpoint: config.renderEndpoint
+	});
+	let aborted = false;
+	const stream = new ReadableStream({
+		async start(controller) {
+			const encoder = new TextEncoder();
+			const onAbort = () => {
+				aborted = true;
+				try {
+					controller.close();
+				} catch {}
+			};
+			signal?.addEventListener("abort", onAbort, { once: true });
+			/** Enqueue unless the client went away mid-render. */
+			const send = (html) => {
+				if (aborted) return;
+				controller.enqueue(encoder.encode(html));
+			};
+			try {
+				send(shellHtml);
+				const result = await renderPage({
+					route,
+					params,
+					searchParams,
+					config,
+					actions,
+					importer,
+					request
+				});
+				if (aborted) return;
+				if (result.response) {
+					const status = result.response.status;
+					const location = result.response.headers.get("Location");
+					if (location && (status === 301 || status === 302 || status === 307 || status === 308)) send(`<script>window.location.href=${JSON.stringify(location)};<\/script>`);
+					else send(buildResolvedChunk(boundaryId, buildErrorNotice()) + `<script>console.error(${JSON.stringify(`Loader responded with status ${status}`)});<\/script>`);
+					return;
+				}
+				const innerBody = extractAppBody(result.html) ?? result.html.match(/<div id="app">([\s\S]*)<\/div>\s*(<script|$)/)?.[1]?.trim() ?? result.html;
+				send(buildResolvedChunk(boundaryId, innerBody));
+			} catch (err) {
+				const errorMsg = err instanceof Error ? err.message : String(err);
+				send(buildResolvedChunk(boundaryId, buildErrorNotice()) + `<script>console.error(${JSON.stringify(errorMsg)});<\/script>`);
+			} finally {
+				signal?.removeEventListener("abort", onAbort);
+				if (!aborted) controller.close();
+			}
+		},
+		cancel() {
+			aborted = true;
+		}
+	});
+	return new Response(stream, { headers: STREAM_HEADERS });
+}
+var STREAM_HEADERS, defaultImport;
+var init_stream_response = __esmMin((() => {
+	init_render_to_string();
+	init_document_shell();
+	init_render();
+	init_stream_boundary();
+	init_capabilities();
+	STREAM_HEADERS = {
+		"Content-Type": "text/html; charset=utf-8",
+		"X-Accel-Buffering": "no",
+		"Cache-Control": "no-store"
+	};
+	defaultImport = (path) => import(path);
+}));
+//#endregion
 //#region src/runtime/handler.ts
 var handler_exports = /* @__PURE__ */ __exportAll({ createWebHandler: () => createWebHandler });
 /**
@@ -3580,14 +4267,28 @@ function createWebHandler(routes, actions, options) {
 	const clientEntry = options.clientEntry;
 	const renderEndpoint = options.renderEndpoint ?? true;
 	const noCache = options.noCache ?? false;
-	const cacheDir = options.cacheDir;
 	const defaultRevalidate = options.defaultRevalidate;
 	const renderConfig = {
 		lang,
 		clientEntry,
-		renderEndpoint
+		renderEndpoint,
+		router: options.router ? {
+			enabled: options.router.enabled !== false,
+			entry: options.router.entry
+		} : void 0,
+		js: options.js
 	};
 	const securityHeadersConfig = options.securityHeaders ?? {};
+	const redirectRules = options.redirects ?? [];
+	const rewriteRules = options.rewrites ?? [];
+	const routeHeaderRules = options.routeHeaders ?? [];
+	const capabilities = options.capabilities ?? DEFAULT_CAPABILITIES;
+	const streamingEnabled = options.streaming === true && supportsStreaming(capabilities);
+	const cacheAdapter = resolveCacheAdapter(options);
+	if (cacheAdapter && !invalidatorConnectedAdapters.has(cacheAdapter)) {
+		invalidatorConnectedAdapters.add(cacheAdapter);
+		connectCacheAdapter(cacheAdapter);
+	}
 	function createActionResolver() {
 		return async (name, page) => {
 			const pageKey = page ? routes.pages.some((route) => route.path === page) ? page : matchRoute(page, routes.pages)?.route.path ?? page : void 0;
@@ -3604,20 +4305,29 @@ function createWebHandler(routes, actions, options) {
 		};
 	}
 	const actionResolver = createActionResolver();
-	async function handleActions(request) {
+	async function handleActions(request, logger) {
+		const stopTimer = logger.startTimer("action", "Server action");
 		try {
 			return await handleActionRequest(request, actionResolver);
 		} catch (err) {
-			console.error("[elur-kit] action error:", err);
+			logger.error("[elur-kit] action error", {
+				path: new URL(request.url).pathname,
+				method: request.method,
+				error: errorMessage(err),
+				stack: errorStack(err)
+			});
 			return publicErrorResponse(err, { includeDetail: noCache });
+		} finally {
+			stopTimer();
 		}
 	}
-	async function handleRenderEndpoint(request, url) {
+	async function handleRenderEndpoint(request, url, logger) {
 		const page = url.searchParams.get("page") ?? "/";
 		const search = url.searchParams.get("search") ?? "";
 		const wantsJson = (request.headers.get("Accept") ?? "").includes("application/json");
+		const stopTimer = logger.startTimer("render-endpoint", "SPA render endpoint");
 		try {
-			const { body, title } = await renderPageBody({
+			const result = await renderPageBody({
 				routes,
 				pathname: page,
 				searchParams: new URLSearchParams(search),
@@ -3626,21 +4336,39 @@ function createWebHandler(routes, actions, options) {
 				request,
 				importer: options.importer
 			});
-			if (wantsJson) return jsonResponse({
-				title,
-				body
-			});
-			return htmlResponse(body);
+			if (result.response) return result.response;
+			const { body, title, head, clearActionErrorCookie, data, actions } = result;
+			if (wantsJson) {
+				const headers = {};
+				if (clearActionErrorCookie) headers["X-Elur-Action-Clear-Cookie"] = clearActionErrorCookie;
+				return jsonResponse({
+					title,
+					body,
+					head: head ?? null,
+					data: data ?? null,
+					actions: actions ?? null,
+					clearActionErrorCookie: clearActionErrorCookie ?? null
+				}, 200, headers);
+			}
+			return htmlResponse(body, 200, clearActionErrorCookie ? { "Set-Cookie": clearActionErrorCookie } : void 0);
 		} catch (err) {
 			if (err instanceof RouteNotFoundError) return notFound("Not Found");
 			if (err instanceof Response) return err;
-			console.error("[elur-kit] render endpoint error:", err);
+			logger.error("[elur-kit] render endpoint error", {
+				path: url.pathname,
+				page,
+				error: errorMessage(err),
+				stack: errorStack(err)
+			});
 			return publicErrorResponse(err, { includeDetail: noCache });
+		} finally {
+			stopTimer();
 		}
 	}
-	async function handleApiRoute(request, pathname) {
+	async function handleApiRoute(request, pathname, logger, middlewareLocals) {
 		const apiMatch = matchApiRoute(pathname, routes.api);
 		if (!apiMatch) return null;
+		const stopTimer = logger.startTimer("api", "API route");
 		try {
 			let mod;
 			if (options.importer) mod = await options.importer(apiMatch.route.routePath);
@@ -3649,11 +4377,19 @@ function createWebHandler(routes, actions, options) {
 			if (typeof handler !== "function") return methodNotAllowed(request.method ?? "GET");
 			return await handler(request, {
 				params: apiMatch.params,
-				locals: {}
+				locals: middlewareLocals ?? {}
 			});
 		} catch (err) {
-			console.error("[elur-kit] API route error:", err);
+			logger.error("[elur-kit] API route error", {
+				path: pathname,
+				method: request.method,
+				route: apiMatch.route.path,
+				error: errorMessage(err),
+				stack: errorStack(err)
+			});
 			return publicErrorResponse(err, { includeDetail: noCache });
+		} finally {
+			stopTimer();
 		}
 	}
 	async function handleStatic(pathname, request) {
@@ -3698,7 +4434,7 @@ function createWebHandler(routes, actions, options) {
 		}
 		return response;
 	}
-	async function handleDynamicRender(request, pathname) {
+	async function handleDynamicRender(request, pathname, logger) {
 		const match = matchRoute(pathname, routes.pages);
 		if (!match) {
 			const errorResult = await renderErrorPage({
@@ -3711,12 +4447,44 @@ function createWebHandler(routes, actions, options) {
 			if (errorResult) return htmlResponse(errorResult.html, errorResult.status);
 			return notFound(`Not found: ${pathname}`);
 		}
-		const cacheable = !noCache && cacheDir && isCacheable(request);
-		if (cacheable && cacheDir) {
-			const cached = await getCachedHtml(cacheDir, pathname);
-			if (cached) return htmlResponse(cached.html);
+		if (streamingEnabled && match.route.loadingPath) {
+			const stopStreamTimer = logger.startTimer("ssr", "SSR stream shell");
+			try {
+				return await createStreamingResponse({
+					route: match.route,
+					params: match.params,
+					searchParams: new URLSearchParams(request.url.split("?")[1] ?? ""),
+					config: renderConfig,
+					actions: publicActions,
+					importer: options.importer,
+					request,
+					signal: request.signal
+				});
+			} catch (err) {
+				if (err instanceof Response) return err;
+				logger.error("[elur-kit] SSR stream error", {
+					path: pathname,
+					route: match.route.path,
+					error: errorMessage(err),
+					stack: errorStack(err)
+				});
+				const errorResult = await renderErrorPage({
+					routes,
+					status: 500,
+					error: err,
+					config: renderConfig,
+					actions: publicActions,
+					importer: options.importer
+				}).catch(() => void 0);
+				if (errorResult) return htmlResponse(errorResult.html, errorResult.status);
+				return publicErrorResponse(err, { includeDetail: noCache });
+			} finally {
+				stopStreamTimer();
+			}
 		}
-		try {
+		const cacheable = !noCache && cacheAdapter && isCacheable(request);
+		const pageCacheKey = cacheable ? cacheKey(pathname) : void 0;
+		const renderAndStore = async () => {
 			const result = await renderPage({
 				route: match.route,
 				params: match.params,
@@ -3727,14 +4495,43 @@ function createWebHandler(routes, actions, options) {
 				importer: options.importer
 			});
 			if (result.response) return result.response;
-			if (cacheable && cacheDir && isResultCacheable(result, request)) {
+			if (cacheable && cacheAdapter && pageCacheKey && isResultCacheable(result, request)) {
 				const revalidateSeconds = result.revalidate ?? defaultRevalidate ?? 0;
-				if (revalidateSeconds > 0) await setCachedHtml(cacheDir, pathname, result.html, revalidateSeconds);
+				if (revalidateSeconds > 0) await cacheAdapter.set(pageCacheKey, {
+					html: result.html,
+					generatedAt: Date.now(),
+					revalidate: revalidateSeconds
+				}, {
+					revalidate: revalidateSeconds,
+					tags: result.cachePolicy?.tags
+				});
 			}
 			return htmlResponse(result.html);
+		};
+		if (cacheable && cacheAdapter && pageCacheKey) {
+			const cached = await cacheAdapter.get(pageCacheKey);
+			if (cached) {
+				if (Date.now() - cached.generatedAt >= cached.revalidate * 1e3) renderAndStore().catch((err) => {
+					logger.error("[elur-kit] background cache revalidation failed", {
+						path: pathname,
+						error: errorMessage(err),
+						stack: errorStack(err)
+					});
+				});
+				return htmlResponse(cached.html);
+			}
+		}
+		const stopTimer = logger.startTimer("ssr", "SSR render");
+		try {
+			return await renderAndStore();
 		} catch (err) {
 			if (err instanceof Response) return err;
-			console.error("[elur-kit] SSR render error:", err);
+			logger.error("[elur-kit] SSR render error", {
+				path: pathname,
+				route: match.route.path,
+				error: errorMessage(err),
+				stack: errorStack(err)
+			});
 			const errorResult = await renderErrorPage({
 				routes,
 				status: 500,
@@ -3745,22 +4542,83 @@ function createWebHandler(routes, actions, options) {
 			}).catch(() => void 0);
 			if (errorResult) return htmlResponse(errorResult.html, errorResult.status);
 			return publicErrorResponse(err, { includeDetail: noCache });
+		} finally {
+			stopTimer();
 		}
 	}
+	function finalizeResponse(response, logger, secHeaders, routeHeaders) {
+		const secured = applySecurityHeaders(response, secHeaders);
+		const headers = new Headers(secured.headers);
+		if (routeHeaders) for (const [key, value] of Object.entries(routeHeaders)) headers.set(key, value);
+		const timing = logger.getServerTimingHeader();
+		if (timing) headers.set("Server-Timing", timing);
+		headers.set("X-Request-ID", logger.getRequestId());
+		return new Response(secured.body, {
+			status: secured.status,
+			statusText: secured.statusText,
+			headers
+		});
+	}
 	return async function handler(request) {
+		const logger = createRequestLogger(request, options.logLevel);
 		const url = new URL(request.url);
-		const pathname = url.pathname;
+		const originalPathname = url.pathname;
 		const isHttps = url.protocol === "https:";
 		const secHeaders = securityHeadersConfig === false ? {} : buildSecurityHeaders(securityHeadersConfig, isHttps);
-		if (pathname === "/__elur-js/actions" && request.method === "POST") return applySecurityHeaders(await handleActions(request), secHeaders);
-		if (pathname === "/__elur-js/render" && renderEndpoint) return applySecurityHeaders(await handleRenderEndpoint(request, url), secHeaders);
-		const apiResponse = await handleApiRoute(request, pathname);
-		if (apiResponse) return applySecurityHeaders(apiResponse, secHeaders);
+		if (redirectRules.length > 0) {
+			const redirect = matchRedirect(originalPathname, redirectRules);
+			if (redirect) return finalizeResponse(redirect, logger, secHeaders, matchRouteHeaders(originalPathname, routeHeaderRules));
+		}
+		let pathname = originalPathname;
+		if (rewriteRules.length > 0) pathname = matchRewrite(originalPathname, rewriteRules) ?? originalPathname;
+		const routeHeaders = matchRouteHeaders(originalPathname, routeHeaderRules);
+		if (pathname === "/__elur-js/actions" && request.method === "POST") return finalizeResponse(await handleActions(request, logger), logger, secHeaders, routeHeaders);
+		if (pathname === "/__elur-js/render" && renderEndpoint) return finalizeResponse(await handleRenderEndpoint(request, url, logger), logger, secHeaders, routeHeaders);
+		let middlewareLocals;
+		const middleware = options.middleware;
+		if (middleware && matchesMiddleware(pathname, middleware.config)) {
+			let mwResult;
+			try {
+				mwResult = await runMiddleware(middleware, request);
+			} catch (err) {
+				logger.error("[elur-kit] middleware error", {
+					path: pathname,
+					error: errorMessage(err),
+					stack: errorStack(err)
+				});
+				return finalizeResponse(publicErrorResponse(err, { includeDetail: noCache }), logger, secHeaders, routeHeaders);
+			}
+			if (mwResult.kind === "response") return finalizeResponse(mwResult.response, logger, secHeaders, routeHeaders);
+			middlewareLocals = mwResult.locals;
+			if (mwResult.headers) {
+				const merged = new Headers(request.headers);
+				for (const [key, value] of Object.entries(mwResult.headers)) merged.set(key, value);
+				request = new Request(request, { headers: merged });
+			}
+		}
+		const apiResponse = await handleApiRoute(request, pathname, logger, middlewareLocals);
+		if (apiResponse) return finalizeResponse(apiResponse, logger, secHeaders, routeHeaders);
 		const staticResponse = await handleStatic(pathname, request);
-		if (staticResponse) return applySecurityHeaders(staticResponse, secHeaders);
-		return applySecurityHeaders(await handleDynamicRender(request, pathname), secHeaders);
+		if (staticResponse) return finalizeResponse(staticResponse, logger, secHeaders, routeHeaders);
+		return finalizeResponse(await handleDynamicRender(request, pathname, logger), logger, secHeaders, routeHeaders);
 	};
 }
+function resolveCacheAdapter(options) {
+	if (options.cacheAdapter) return options.cacheAdapter;
+	if (!options.cacheDir) return void 0;
+	let adapter = defaultCacheAdapters.get(options.cacheDir);
+	if (!adapter) {
+		adapter = createFsCacheAdapter({ cacheDir: options.cacheDir });
+		defaultCacheAdapters.set(options.cacheDir, adapter);
+	}
+	return adapter;
+}
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+function errorStack(err) {
+	return err instanceof Error ? err.stack : void 0;
+}
 function isCacheable(request) {
 	if (request.method !== "GET" && request.method !== "HEAD") return false;
 	if (request.headers.get("Cookie")) return false;
@@ -3780,6 +4638,7 @@ function isResultCacheable(result, request) {
 	if (request.headers.get("Authorization")) return false;
 	return true;
 }
+var defaultCacheAdapters, invalidatorConnectedAdapters;
 var init_handler = __esmMin((() => {
 	init_match();
 	init_server();
@@ -3788,9 +4647,16 @@ var init_handler = __esmMin((() => {
 	init_scan();
 	init_context();
 	init_errors();
-	init_cache();
+	init_adapter();
+	init_invalidation();
 	init_policy();
 	init_security_headers();
+	init_redirects();
+	init_middleware();
+	init_stream_response();
+	init_capabilities();
+	defaultCacheAdapters = /* @__PURE__ */ new Map();
+	invalidatorConnectedAdapters = /* @__PURE__ */ new WeakSet();
 }));
 //#endregion
 //#region src/adapters/shared.ts
@@ -3878,8 +4744,10 @@ async function buildSsrEntry(routes, options, entryDir) {
 		}
 		if (names.length > 0) actionsRegistry[page.path] = names;
 	}
+	const routerEnabled = options.router?.enabled !== false;
+	const routerEntry = routerEnabled && options.js !== "legacy" && existsSync(resolve(options.root, options.outDir, "_elur", "router.js")) ? "/_elur/router.js" : null;
 	return `// AUTO-GENERATED by @elurjs/kit. Do not edit.
-import { handleActionRequest, matchApiRoute, matchRoute, renderPage, renderErrorPage } from "@elurjs/kit";
+import { handleActionRequest, matchApiRoute, matchRoute, renderPage, renderPageBody, renderErrorPage, createStreamingResponse } from "@elurjs/kit";
 ${imports}
 
 const registry = new Map<string, unknown>([
@@ -3909,6 +4777,15 @@ const routes = {
 
 const clientEntry = ${JSON.stringify(options.clientEntry)};
 const lang = ${JSON.stringify(options.lang)};
+// Client router/JS emission rules baked at adapter build time.
+const router = ${JSON.stringify({
+		enabled: routerEnabled,
+		entry: routerEntry
+	})};
+const jsMode = ${JSON.stringify(options.js === "legacy" ? "legacy" : "modern")};
+// Opt-in streaming SSR (experimental): routes with a loading boundary stream
+// the shell first and swap in the resolved content as a follow-up chunk.
+const streaming = ${options.streaming === true};
 
 function loadModule(path: string) {
   const mod = registry.get(path);
@@ -3957,37 +4834,38 @@ export default async function handler(request: Request): Promise<Response> {
     const search = url.searchParams.get("search") ?? "";
     const wantsJson = (request.headers.get("Accept") ?? "").includes("application/json");
     try {
-      const match = matchRoute(page, routes.pages);
-      if (!match) throw new Error(\`No route found for \${page}\`);
-      const { html } = await renderPage({
-        route: match.route,
-        params: match.params,
+      const result = await renderPageBody({
+        routes,
+        pathname: page,
         searchParams: new URLSearchParams(search),
-        config: { lang, clientEntry },
+        config: { lang, clientEntry, router, js: jsMode },
         importer: loadModule,
         actions,
         request,
       });
-      const bodyStart = html.indexOf('<div id="app">');
-      const bodyEnd = html.lastIndexOf("</div>");
-      const body = bodyStart >= 0 && bodyEnd > bodyStart
-        ? html.slice(bodyStart + 13, bodyEnd).trim()
-        : html;
-      const titleStart = html.indexOf("<title>");
-      const titleEnd = html.indexOf("</title>");
-      const title = titleStart >= 0 && titleEnd > titleStart
-        ? html.slice(titleStart + 7, titleEnd)
-        : "";
+      // A thrown Response from a loader is a first-class response (A-22).
+      if (result.response) return result.response;
+      const { body, title, head, clearActionErrorCookie, data, actions: actionsPayload } = result;
       if (wantsJson) {
-        return new Response(JSON.stringify({ title, body }), {
-          status: 200,
-          headers: { "Content-Type": "application/json; charset=utf-8" },
-        });
+        const headers = { "Content-Type": "application/json; charset=utf-8" };
+        if (clearActionErrorCookie) headers["X-Elur-Action-Clear-Cookie"] = clearActionErrorCookie;
+        // The ?? null fallbacks keep every key present — JSON.stringify drops
+        // undefined and the SPA payload shape must be stable across runtimes.
+        return new Response(
+          JSON.stringify({
+            title,
+            body,
+            head: head ?? null,
+            data: data ?? null,
+            actions: actionsPayload ?? null,
+            clearActionErrorCookie: clearActionErrorCookie ?? null,
+          }),
+          { status: 200, headers },
+        );
       }
-      return new Response(body, {
-        status: 200,
-        headers: { "Content-Type": "text/html; charset=utf-8" },
-      });
+      const headers = { "Content-Type": "text/html; charset=utf-8" };
+      if (clearActionErrorCookie) headers["Set-Cookie"] = clearActionErrorCookie;
+      return new Response(body, { status: 200, headers });
     } catch (err) {
       if ((err as { name?: string }).name === "RouteNotFoundError") {
         return new Response("Not Found", {
@@ -4018,7 +4896,7 @@ export default async function handler(request: Request): Promise<Response> {
 
   const match = matchRoute(url.pathname, routes.pages);
   if (!match) {
-    const errorResult = await renderErrorPage({ routes, status: 404, config: { lang, clientEntry }, actions, importer: loadModule });
+    const errorResult = await renderErrorPage({ routes, status: 404, config: { lang, clientEntry, router, js: jsMode }, actions, importer: loadModule });
     if (errorResult) {
       return new Response(errorResult.html, { status: errorResult.status, headers: { "Content-Type": "text/html; charset=utf-8" } });
     }
@@ -4026,19 +4904,37 @@ export default async function handler(request: Request): Promise<Response> {
   }
 
   try {
-    const { html } = await renderPage({
+    if (streaming && match.route.loadingPath) {
+      // Streaming SSR: shell + loading boundary first, resolved content as a
+      // follow-up chunk. Streamed pages are rendered live (no cache).
+      return createStreamingResponse({
+        route: match.route,
+        params: match.params,
+        searchParams: new URLSearchParams(url.search),
+        config: { lang, clientEntry, router, js: jsMode },
+        importer: loadModule,
+        actions,
+        request,
+        signal: request.signal,
+      });
+    }
+    const result = await renderPage({
       route: match.route,
       params: match.params,
       searchParams: new URLSearchParams(url.search),
-      config: { lang, clientEntry },
+      config: { lang, clientEntry, router, js: jsMode },
       importer: loadModule,
       actions,
       request,
     });
-    return new Response(html, { status: 200, headers: { "Content-Type": "text/html; charset=utf-8" } });
+    // A thrown Response from a loader is a first-class response (A-22).
+    if (result.response) return result.response;
+    const headers = { "Content-Type": "text/html; charset=utf-8" };
+    if (result.clearActionErrorCookie) headers["Set-Cookie"] = result.clearActionErrorCookie;
+    return new Response(result.html, { status: 200, headers });
   } catch (err) {
     console.error("[elur-kit] SSR render error:", err);
-    const errorResult = await renderErrorPage({ routes, status: 500, error: err, config: { lang, clientEntry }, actions, importer: loadModule });
+    const errorResult = await renderErrorPage({ routes, status: 500, error: err, config: { lang, clientEntry, router, js: jsMode }, actions, importer: loadModule });
     if (errorResult) {
       return new Response(errorResult.html, { status: errorResult.status, headers: { "Content-Type": "text/html; charset=utf-8" } });
     }
@@ -4201,6 +5097,15 @@ var init_netlify = __esmMin((() => {
 //#region src/adapters/bun.ts
 var bun_exports = /* @__PURE__ */ __exportAll({ bunAdapter: () => bunAdapter });
 function buildBunServerSource(outDirUrl, options) {
+	const logLevelOption = options.logLevel ? `, logLevel: ${JSON.stringify(options.logLevel)}` : "";
+	const routingOptions = [
+		"redirects",
+		"rewrites",
+		"routeHeaders"
+	].map((key) => {
+		const rules = options[key];
+		return rules && rules.length > 0 ? `, ${key}: ${JSON.stringify(rules)}` : "";
+	}).join("");
 	return `// AUTO-GENERATED by @elurjs/kit. Do not edit.
 import { fileURLToPath } from "node:url";
 import { createWebHandler } from "@elurjs/kit/runtime";
@@ -4212,7 +5117,7 @@ const port = Number(process.env.PORT) || ${options.port ?? 3e3};
 const webHandler = createWebHandler(
   { pages: [], api: [], error404: undefined, error500: undefined },
   {},
-  { staticRoot: outDir, lang: ${JSON.stringify(options.lang)}, clientEntry: ${JSON.stringify(options.clientEntry)} },
+  { staticRoot: outDir, lang: ${JSON.stringify(options.lang)}, clientEntry: ${JSON.stringify(options.clientEntry)}${logLevelOption}${routingOptions} },
 );
 
 Bun.serve({
@@ -4268,11 +5173,20 @@ var init_bun = __esmMin((() => {
 //#region src/adapters/node.ts
 var node_exports = /* @__PURE__ */ __exportAll({ nodeAdapter: () => nodeAdapter });
 function buildNodeServerSource(outDirUrl, options) {
+	const logLevelOption = options.logLevel ? `, logLevel: ${JSON.stringify(options.logLevel)}` : "";
+	const routingOptions = [
+		"redirects",
+		"rewrites",
+		"routeHeaders"
+	].map((key) => {
+		const rules = options[key];
+		return rules && rules.length > 0 ? `, ${key}: ${JSON.stringify(rules)}` : "";
+	}).join("");
 	return `// AUTO-GENERATED by @elurjs/kit. Do not edit.
 import { createServer } from "node:http";
 import { fileURLToPath } from "node:url";
 import { createWebHandler } from "@elurjs/kit/runtime";
-import { incomingMessageToRequest } from "@elurjs/kit/runtime";
+import { incomingMessageToRequest, sendWebResponse } from "@elurjs/kit/runtime";
 import handler from "./node-index.ts";
 
 const outDir = fileURLToPath(new URL(${JSON.stringify(outDirUrl)}, import.meta.url));
@@ -4284,7 +5198,7 @@ const port = Number(process.env.PORT) || ${options.port ?? 3e3};
 const webHandler = createWebHandler(
   { pages: [], api: [], error404: undefined, error500: undefined },
   {},
-  { staticRoot: outDir, lang: ${JSON.stringify(options.lang)}, clientEntry: ${JSON.stringify(options.clientEntry)} },
+  { staticRoot: outDir, lang: ${JSON.stringify(options.lang)}, clientEntry: ${JSON.stringify(options.clientEntry)}${logLevelOption}${routingOptions} },
 );
 
 createServer(async (req, res) => {
@@ -4298,8 +5212,8 @@ createServer(async (req, res) => {
   if (response.status === 404) {
     response = await handler(request);
   }
-  res.writeHead(response.status, Object.fromEntries(response.headers.entries()));
-  res.end(Buffer.from(await response.arrayBuffer()));
+  // Streams the body: streaming SSR chunks flush as they are produced.
+  await sendWebResponse(res, response);
 }).listen(port, () => {
   console.log(\`Node server running at http://localhost:\${port}\`);
 });
@@ -4621,6 +5535,7 @@ var init_commands = __esmMin((() => {
 //#region src/cli.ts
 init_scan();
 init_route_scanner();
+init_logger();
 init_capabilities();
 function parseArgs(argv) {
 	const args = argv.slice(2);
@@ -4649,6 +5564,7 @@ function parseArgs(argv) {
 	let cacheDir;
 	let defaultRevalidate;
 	let configFile;
+	let logLevel;
 	for (let i = optionStart; i < args.length; i++) {
 		const arg = args[i];
 		const next = args[i + 1];
@@ -4716,6 +5632,12 @@ function parseArgs(argv) {
 				defaultRevalidate = Number(next);
 				i++;
 				break;
+			case "--verbose":
+				if (logLevel !== "error") logLevel = "debug";
+				break;
+			case "--quiet":
+				logLevel = "error";
+				break;
 			case "--help":
 			case "-?":
 				printHelp();
@@ -4741,7 +5663,8 @@ function parseArgs(argv) {
 		clientConfig: clientConfig ? resolve(root, clientConfig) : void 0,
 		cacheDir: cacheDir ? resolve(root, cacheDir) : void 0,
 		defaultRevalidate,
-		configFile: configFile ? resolve(root, configFile) : void 0
+		configFile: configFile ? resolve(root, configFile) : void 0,
+		logLevel
 	};
 }
 function printHelp() {
@@ -4773,8 +5696,23 @@ Options:
   --config <path>           Elur config file (default: elur.config.ts/js/mjs)
   --cache-dir <dir>         Directory for ISR cache (only used by start)
   --default-revalidate <s>  Default ISR revalidate interval in seconds
+  --verbose                 Debug logging (overrides logger.level)
+  --quiet                   Only errors are printed (overrides logger.level)
 `);
 }
+/**
+* Reads the kit's own version from package.json. The CLI runs from two
+* layouts: src/cli.ts in the repo (../package.json) and dist/lib/cli.js when
+* installed (../../package.json).
+*/
+function getKitVersion() {
+	const require = createRequire(import.meta.url);
+	for (const rel of ["../package.json", "../../package.json"]) try {
+		const pkg = require(rel);
+		if (typeof pkg.version === "string") return pkg.version;
+	} catch {}
+	return "unknown";
+}
 function toBuildConfig(options) {
 	return {
 		root: options.root,
@@ -4788,58 +5726,96 @@ function toBuildConfig(options) {
 		hydrateImport: options.hydrateImport,
 		routerImport: options.routerImport,
 		imageFormats: options.resolvedConfig?.images.formats,
-		integrations: options.resolvedConfig?.integrations
+		integrations: options.resolvedConfig?.integrations,
+		site: options.resolvedConfig?.site,
+		js: options.resolvedConfig?.js,
+		router: options.resolvedConfig ? {
+			enabled: options.resolvedConfig.router.enabled,
+			prefetch: options.resolvedConfig.router.prefetch,
+			morph: options.resolvedConfig.router.morph,
+			loadingIndicator: options.resolvedConfig.router.loadingIndicator,
+			speculation: options.resolvedConfig.router.speculation,
+			separate: options.routerSeparate,
+			entry: "/_elur/router.js",
+			outFile: join(dirname(options.generatedEntry), "router.ts")
+		} : void 0
 	};
 }
 async function doBuild(options) {
+	const buildStart = Date.now();
 	const transformedRoot = join(options.root, ".elur", "transformed");
 	const transformedAppDir$1 = transformedAppDir(options.root, options.appDir, options.islandsDir, transformedRoot);
+	let phaseStart = performance.now();
 	await transformProjectFiles({
 		root: options.root,
 		appDir: options.appDir,
 		islandsDir: options.islandsDir,
 		outDir: transformedRoot
 	});
+	phase("transform", performance.now() - phaseStart);
 	const { beginAtomicStage } = await Promise.resolve().then(() => (init_vite_build(), vite_build_exports));
 	const stage = await beginAtomicStage({ outDir: options.outDir });
 	const tempOutDir = stage.tempDir;
+	if (options.islandsDir && !options.clientConfig) {
+		const autoConfig = await findClientConfig(options.root);
+		if (autoConfig) options.clientConfig = autoConfig;
+	}
+	options.routerSeparate = await resolveRouterSeparate(options);
 	try {
 		const buildConfig = toBuildConfig(options);
 		buildConfig.appDir = transformedAppDir$1;
 		buildConfig.outDir = tempOutDir;
+		buildConfig.onPhase = (name, ms) => phase(name, ms);
 		const result = await build$1(buildConfig);
-		if (options.resolvedConfig) try {
-			const manifest = await createAppManifest(options.resolvedConfig);
-			await writeAppManifest(manifest, join(tempOutDir, ".elur", "manifest.json"));
-			await writeRouteTypes(manifest, join(options.root, ".elur", "routes.d.ts"));
-			console.log(`  - manifest: ${relative(options.root, join(options.outDir, ".elur", "manifest.json"))}`);
-		} catch (err) {
-			console.warn("[elur-kit] manifest generation failed:", err);
-		}
-		if (options.islandsDir && !options.clientConfig) {
-			const autoConfig = await findClientConfig(options.root);
-			if (autoConfig) options.clientConfig = autoConfig;
+		options.hasIslands = result.islands.length > 0;
+		if (options.resolvedConfig) {
+			phaseStart = performance.now();
+			try {
+				const manifest = await createAppManifest(options.resolvedConfig);
+				await writeAppManifest(manifest, join(tempOutDir, ".elur", "manifest.json"));
+				await writeRouteTypes(manifest, join(options.root, ".elur", "routes.d.ts"));
+				phase("manifest", performance.now() - phaseStart);
+			} catch (err) {
+				warn(`manifest generation failed: ${err instanceof Error ? err.message : String(err)}`);
+			}
 		}
-		if (options.clientConfig) {
+		const routerEnabled = options.resolvedConfig?.router.enabled !== false;
+		if (options.clientConfig || options.hasIslands || routerEnabled) {
 			const originalOutDir = options.outDir;
 			options.outDir = tempOutDir;
 			try {
+				phaseStart = performance.now();
 				await buildClient(options);
+				phase("client bundle", performance.now() - phaseStart);
 			} finally {
 				options.outDir = originalOutDir;
 			}
 		}
 		await stage.commit();
-		console.log(`✓ Build completo: ${result.pages} páginas generadas`);
-		for (const file of result.files) console.log("  -", relative(options.root, file));
+		const elapsed = ((Date.now() - buildStart) / 1e3).toFixed(2);
+		success(`${bold("Build completo")} ${dim(`en ${elapsed}s`)}`);
+		info(`${result.pages} página(s), ${result.islands.length} island(s), ${result.files.length} archivo(s)`);
+		const fileEntries = [];
+		for (const file of result.files) {
+			const finalPath = join(options.outDir, relative(tempOutDir, file));
+			let bytes = 0;
+			try {
+				bytes = (await stat(finalPath)).size;
+			} catch {}
+			fileEntries.push({
+				path: relative(options.root, finalPath),
+				bytes
+			});
+		}
+		fileList(fileEntries);
 		if (result.islands.length > 0) {
-			console.log(`\n✓ ${result.islands.length} island(s) detectada(s):`);
-			for (const island of result.islands) console.log("  -", island.name);
-			if (result.generatedEntry) console.log("  entry:", relative(options.root, result.generatedEntry));
+			success(`${result.islands.length} island(s) detectada(s):`);
+			for (const island of result.islands) detail(island.name);
+			if (result.generatedEntry) detail(`entry: ${relative(options.root, result.generatedEntry)}`);
 		}
 		if (result.skipped.length > 0) {
-			console.log("\nRutas dinámicas omitidas (necesitan generateStaticParams):");
-			for (const path of result.skipped) console.log("  -", path);
+			warn("Rutas dinámicas omitidas (necesitan generateStaticParams):");
+			for (const path of result.skipped) detail(path);
 		}
 	} catch (err) {
 		await stage.rollback();
@@ -4859,16 +5835,32 @@ async function doDev(options) {
 	});
 	const actions = await scanActions(transformedAppDir$2);
 	const routes = await scanRoutes(transformedAppDir$2);
-	const server = createServer((req, res) => handleRequest(req, res, options, actions, routes, true));
+	const middleware = await loadUserMiddleware(options.root);
+	options.routerEntry = detectRouterEntry(options);
+	const server = createServer((req, res) => handleRequest(req, res, options, actions, routes, true, middleware));
 	const shutdown = () => {
 		server.close(() => process.exit(0));
 		setTimeout(() => process.exit(0), 2e3).unref();
 	};
 	process.on("SIGTERM", shutdown);
 	process.on("SIGINT", shutdown);
-	server.listen(options.port, options.host, () => {
-		console.log(`\n  → Dev server http://${options.host}:${options.port}`);
-	});
+	try {
+		const usedPort = await listenWithFallback(server, options.host, options.port, { onFallback: (busyPort, nextPort) => warn(`Puerto ${busyPort} ocupado, usando ${nextPort}`) });
+		const network = getNetworkAddress();
+		serverBanner({
+			name: "elur-kit",
+			version: `v${getKitVersion()}`,
+			command: "dev",
+			localUrl: `http://${options.host}:${usedPort}/`,
+			networkUrl: network ? `http://${network}:${usedPort}/` : void 0
+		});
+	} catch (err) {
+		if (err.code === "EADDRINUSE") {
+			error(`No hay puerto disponible entre ${options.port} y ${options.port + 20}.`);
+			process.exit(78);
+		}
+		throw err;
+	}
 }
 /**
 * Dev supervisor: runs the actual dev server in a child process and restarts
@@ -4886,7 +5878,8 @@ async function doDevSupervisor(options) {
 	let respawnTimer = null;
 	const startWorker = () => {
 		intentional = false;
-		console.log("\n[dev] Starting dev server...");
+		console.log();
+		event("dev", "Starting dev server...");
 		child = spawn(process.execPath, [spawnPath, ...args], {
 			env: {
 				...process.env,
@@ -4902,7 +5895,11 @@ async function doDevSupervisor(options) {
 				return;
 			}
 			if (code !== 0) {
-				console.error(`[dev] Dev server exited with code ${code}; restarting...`);
+				if (code === 78) {
+					error("[dev] Stopping: no available port.");
+					process.exit(code);
+				}
+				error(`[dev] Dev server exited with code ${code}; restarting...`);
 				respawnTimer = setTimeout(startWorker, 600);
 			}
 		});
@@ -4916,7 +5913,8 @@ async function doDevSupervisor(options) {
 	if (watchedDirs.length > 0) {
 		let timer = null;
 		const scheduleRestart = () => {
-			console.log("\n[change] Restarting dev server...");
+			console.log();
+			event("change", "Restarting dev server...");
 			if (timer) clearTimeout(timer);
 			timer = setTimeout(() => restart(), 150);
 		};
@@ -4926,7 +5924,7 @@ async function doDevSupervisor(options) {
 				else if (filename && /\.ts$/.test(filename)) scheduleRestart();
 			});
 		} catch (err) {
-			console.error(`[dev] failed to watch ${dir}:`, err);
+			error(`[dev] failed to watch ${dir}: ${err instanceof Error ? err.message : String(err)}`);
 		}
 	}
 	const cleanup = () => {
@@ -4940,14 +5938,20 @@ async function doDevSupervisor(options) {
 	process.on("SIGTERM", cleanup);
 	startWorker();
 }
-async function doPreview(options) {
+/**
+* Shared production-serving path for `preview` and `start`: serves the build
+* output plus dynamic SSR through the unified Web handler, with middleware,
+* streaming, port fallback and the startup banner. Both commands behave
+* identically; the label only differs in the banner.
+*/
+async function startProductionServer(options, command) {
 	try {
 		if (!(await stat(options.outDir)).isDirectory()) throw new Error(`Output path is not a directory: ${options.outDir}`);
 	} catch (err) {
 		if (err.code === "ENOENT") throw new Error(`No build output found at ${options.outDir}. Run \`elur-kit build\` first.`);
 		throw err;
 	}
-	const transformedRoot = join(options.root, ".elur", "preview-transformed");
+	const transformedRoot = join(options.root, ".elur", command === "preview" ? "preview-transformed" : "transformed");
 	const transformedAppDir$3 = transformedAppDir(options.root, options.appDir, options.islandsDir, transformedRoot);
 	await transformProjectFiles({
 		root: options.root,
@@ -4957,32 +5961,25 @@ async function doPreview(options) {
 	});
 	const actions = await scanActions(transformedAppDir$3);
 	const routes = await scanRoutes(transformedAppDir$3);
-	const server = createServer((req, res) => handleRequest(req, res, options, actions, routes));
-	server.listen(options.port, options.host, () => {
-		console.log(`\n  → Preview server http://${options.host}:${options.port}`);
+	const middleware = await loadUserMiddleware(options.root);
+	options.routerEntry = detectRouterEntry(options);
+	const server = createServer((req, res) => handleRequest(req, res, options, actions, routes, false, middleware));
+	const usedPort = await listenWithFallback(server, options.host, options.port, { onFallback: (busyPort, nextPort) => warn(`Puerto ${busyPort} ocupado, usando ${nextPort}`) });
+	const network = getNetworkAddress();
+	serverBanner({
+		name: "elur-kit",
+		version: `v${getKitVersion()}`,
+		command,
+		localUrl: `http://${options.host}:${usedPort}/`,
+		networkUrl: network ? `http://${network}:${usedPort}/` : void 0
 	});
 	return server;
 }
+async function doPreview(options) {
+	return startProductionServer(options, "preview");
+}
 async function doStart(options) {
-	const transformedRoot = join(options.root, ".elur", "transformed");
-	const transformedAppDir$4 = transformedAppDir(options.root, options.appDir, options.islandsDir, transformedRoot);
-	await transformProjectFiles({
-		root: options.root,
-		appDir: options.appDir,
-		islandsDir: options.islandsDir,
-		outDir: transformedRoot
-	});
-	await (await createSsrServer({
-		root: options.root,
-		appDir: transformedAppDir$4,
-		publicDir: options.outDir,
-		clientEntry: options.clientEntry,
-		lang: options.lang,
-		port: options.port,
-		host: options.host,
-		cacheDir: options.cacheDir,
-		defaultRevalidate: options.defaultRevalidate
-	})).listen();
+	await startProductionServer(options, "start");
 }
 async function findClientConfig(root) {
 	for (const name of [
@@ -4996,21 +5993,71 @@ async function findClientConfig(root) {
 		} catch {}
 	}
 }
+/**
+* Decides whether the client bundle emits the router as its own chunk.
+*
+* - `js: "legacy"` or `router.enabled: false` → never split (the entry is
+*   hydrate-only when the router is off; legacy embeds the router).
+* - A user-provided client config splits only when it declares the generated
+*   router module (`.elur/router.ts`) as a bundle input — a single input is
+*   "legacy de facto": the router stays embedded in `entry-client.js`.
+* - Without a user config, the kit synthesizes a default two-input config →
+*   split.
+*/
+async function resolveRouterSeparate(options) {
+	const rc = options.resolvedConfig;
+	if (!rc || rc.js === "legacy" || rc.router.enabled === false) return false;
+	const routerFile = join(dirname(options.generatedEntry), "router.ts");
+	if (!options.clientConfig) return true;
+	try {
+		const { resolveClientInputs } = await Promise.resolve().then(() => (init_vite_build(), vite_build_exports));
+		return (await resolveClientInputs(options.clientConfig, options.root)).includes(routerFile);
+	} catch {
+		return false;
+	}
+}
+/**
+* Public URL of the router chunk when the built bundle actually contains it.
+* The file check keeps `preview`/`start` consistent with whatever layout the
+* last build produced (split or legacy single-entry).
+*/
+function detectRouterEntry(options) {
+	const rc = options.resolvedConfig;
+	if (!rc || rc.js === "legacy" || rc.router.enabled === false) return void 0;
+	return existsSync(join(options.outDir, "_elur", "router.js")) ? "/_elur/router.js" : void 0;
+}
 async function buildClient(options) {
-	if (!options.clientConfig) return;
 	const { buildClientBundle } = await Promise.resolve().then(() => (init_vite_build(), vite_build_exports));
 	const clientOutDir = join(options.outDir, "_elur");
+	const clientBase = "/_elur/";
+	const defaultInputs = { "entry-client": options.generatedEntry };
+	if (options.routerSeparate) defaultInputs.router = join(dirname(options.generatedEntry), "router.ts");
 	await buildClientBundle({
 		root: options.root,
-		userConfigPath: resolve(options.clientConfig),
+		userConfigPath: options.clientConfig ? resolve(options.clientConfig) : void 0,
+		defaultInputs,
 		appDir: join(options.root, "src", "app"),
 		islandsDir: join(options.root, "src", "islands"),
 		outDir: clientOutDir,
-		base: "/_elur/",
-		logPrefix: "[client]"
+		base: clientBase,
+		logPrefix: "[client]",
+		quiet: options.logLevel === "error"
 	});
 }
-async function handleRequest(req, res, options, actions, routes, noCache = false) {
+/**
+* Loads the project's `src/middleware.ts` for dev/preview/start. A missing
+* file is fine; a broken one warns but does not stop the server.
+*/
+async function loadUserMiddleware(root) {
+	const { loadMiddleware } = await Promise.resolve().then(() => (init_middleware(), middleware_exports));
+	try {
+		return await loadMiddleware(root);
+	} catch (err) {
+		warn(err instanceof Error ? err.message : String(err));
+		return null;
+	}
+}
+async function handleRequest(req, res, options, actions, routes, noCache = false, middleware) {
 	const { createWebHandler } = await Promise.resolve().then(() => (init_handler(), handler_exports));
 	const securityHeaders = options.resolvedConfig?.security?.headers;
 	const webHandler = createWebHandler(routes, actions, {
@@ -5021,20 +6068,36 @@ async function handleRequest(req, res, options, actions, routes, noCache = false
 		lang: options.lang,
 		clientEntry: options.clientEntry,
 		renderEndpoint: true,
-		securityHeaders: securityHeaders === void 0 ? false : securityHeaders
+		router: {
+			enabled: options.resolvedConfig?.router.enabled ?? true,
+			entry: options.routerEntry
+		},
+		js: options.resolvedConfig?.js,
+		securityHeaders: securityHeaders === void 0 ? false : securityHeaders,
+		logLevel: options.resolvedConfig?.logger?.level,
+		cacheAdapter: options.resolvedConfig?.cache?.adapter,
+		redirects: options.resolvedConfig?.redirects,
+		rewrites: options.resolvedConfig?.rewrites,
+		routeHeaders: options.resolvedConfig?.headers,
+		streaming: options.resolvedConfig?.streaming,
+		middleware: middleware ?? void 0
 	});
 	const request = incomingMessageToRequest(req, req.method && req.method !== "GET" && req.method !== "HEAD" ? await readRequestBody(req) : void 0);
 	let response;
 	try {
 		response = await webHandler(request);
 	} catch (err) {
-		console.error("[elur-kit] request error:", err);
+		createRequestLogger(request, options.resolvedConfig?.logger?.level).error("[elur-kit] request error", {
+			path: new URL(request.url).pathname,
+			method: request.method,
+			error: err instanceof Error ? err.message : String(err),
+			stack: err instanceof Error ? err.stack : void 0
+		});
 		res.writeHead(500, { "Content-Type": "text/plain; charset=utf-8" });
 		res.end("Internal Server Error");
 		return;
 	}
-	res.writeHead(response.status, Object.fromEntries(response.headers.entries()));
-	res.end(Buffer.from(await response.arrayBuffer()));
+	await sendWebResponse(res, response);
 }
 function readRequestBody(req) {
 	return new Promise((resolve, reject) => {
@@ -5056,34 +6119,47 @@ async function doAdapter(options) {
 		publicDir: options.publicDir,
 		clientEntry: options.clientEntry,
 		lang: options.lang,
-		hydrateImport: options.hydrateImport
+		hydrateImport: options.hydrateImport,
+		logLevel: options.resolvedConfig?.logger?.level,
+		cacheAdapter: options.resolvedConfig?.cache?.adapter,
+		redirects: options.resolvedConfig?.redirects,
+		rewrites: options.resolvedConfig?.rewrites,
+		routeHeaders: options.resolvedConfig?.headers,
+		streaming: options.resolvedConfig?.streaming,
+		router: { enabled: options.resolvedConfig?.router.enabled ?? true },
+		js: options.resolvedConfig?.js
 	};
 	const resolvedConfig = options.resolvedConfig;
 	const features = {
 		isr: typeof resolvedConfig?.cache?.defaultRevalidate === "number" && resolvedConfig.cache.defaultRevalidate > 0,
-		images: resolvedConfig?.images?.strict === true
+		images: resolvedConfig?.images?.strict === true,
+		streaming: resolvedConfig?.streaming === true
 	};
 	let adapterName = options.adapterName;
 	if (adapterName === "vercel") {
 		const { vercelAdapter } = await Promise.resolve().then(() => (init_vercel(), vercel_exports));
 		assertCapabilities(vercelAdapter, features, adapterName);
 		await vercelAdapter.build(adapterOptions);
-		console.log("\n  → Vercel output generated at .vercel/output");
+		console.log();
+		info("Vercel output generated at .vercel/output");
 	} else if (adapterName === "netlify") {
 		const { netlifyAdapter } = await Promise.resolve().then(() => (init_netlify(), netlify_exports));
 		assertCapabilities(netlifyAdapter, features, adapterName);
 		await netlifyAdapter.build(adapterOptions);
-		console.log("\n  → Netlify output generated at netlify/functions/__elur-js-kit.mjs");
+		console.log();
+		info("Netlify output generated at netlify/functions/__elur-js-kit.mjs");
 	} else if (adapterName === "bun") {
 		const { bunAdapter } = await Promise.resolve().then(() => (init_bun(), bun_exports));
 		assertCapabilities(bunAdapter, features, adapterName);
 		await bunAdapter.build(adapterOptions);
-		console.log("\n  → Bun server generated at .elur/bun-server.ts");
+		console.log();
+		info("Bun server generated at .elur/bun-server.ts");
 	} else if (adapterName === "node") {
 		const { nodeAdapter } = await Promise.resolve().then(() => (init_node(), node_exports));
 		assertCapabilities(nodeAdapter, features, adapterName);
 		await nodeAdapter.build(adapterOptions);
-		console.log("\n  → Node server generated at .elur/node-server.mjs");
+		console.log();
+		info("Node server generated at .elur/node-server.mjs");
 	}
 }
 function assertCapabilities(adapter, features, adapterName) {
@@ -5107,11 +6183,13 @@ async function applyProjectConfig(options, argv) {
 	if (!has("--public")) options.publicDir = config.publicDir;
 	if (!has("--cache-dir")) options.cacheDir = config.cache.dir;
 	if (!has("--default-revalidate")) options.defaultRevalidate = config.cache.defaultRevalidate;
+	if (options.logLevel) config.logger.level = options.logLevel;
 	options.generatedEntry = resolve(config.root, ".elur/entry-client.ts");
 	options.resolvedConfig = config;
 }
 async function run(argv) {
 	const options = parseArgs(argv);
+	if (options.logLevel === "error") setQuiet(true);
 	if (options.command === "doctor") {
 		const { doDoctor } = await Promise.resolve().then(() => (init_commands(), commands_exports));
 		const code = await doDoctor(options);