@ilha/router 0.10.4 → 0.11.1

package/dist/{plugin-BQil-7B_.js → plugin-C3AAI3e_.js}

@@ -1,6 +1,7 @@
-import { E as runWithIslandRequest, S as setFrameGuard, _ as parseFrameProps, b as renderServerIsland, c as frameEnvelope, m as isSafeFramePath, n as FrameError, o as authorizeFrameRequest, u as getFrameGuard, w as setLoaderGuard, x as setFrameAuth } from "./ssr-BTmqfAp9.js";
+import { C as runWithIslandRequest, a as authorizeFrameRequest, b as setFrameAuth, c as frameScopedUrl, f as isSafeFramePath, h as parseFrameProps, n as FrameError, s as frameEnvelope, u as getFrameGuard, x as setFrameGuard, y as renderServerIslandResult } from "./ssr-WA3bSsCo.js";
 import { existsSync, readFileSync, statSync, watch } from "node:fs";
 import { basename, dirname, extname, join, relative, resolve, sep } from "node:path";
+import * as Result from "effect/Result";
 import { createUnplugin } from "unplugin";
 import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { createHash } from "node:crypto";
@@ -21,9 +22,8 @@ function rewriteServerActions(code, rpcActions) {
 	});
 }
 const EXPORT_RE = /(?:^|\n)\s*export\s+(?:declare\s+)?(?:async\s+)?(?:function\s*\*?|const|let|var|class)\s+([A-Za-z_$][\w$]*)/g;
-const ISLAND_EXPORT_RE = /(?:^|\n)\s*export\s+(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*ilha\b/g;
-const DEFAULT_ISLAND_RE = /export\s+default\s+ilha\b/;
-const AS_RES = [/\{\s*as:\s*["'`]([a-z][a-z0-9-]*)["'`]\s*[,}]?/];
+const ISLAND_EXPORT_RE = /(?:^|\n)\s*export\s+(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s+function|function\s*\*)/g;
+const DEFAULT_ISLAND_RE = /export\s+default\s+(?:async\s+function|function\s*\*|function\b)/;
 function clientRefPublicId(spec, imported) {
 	return createHash("sha256").update(`${spec}#${imported}`).digest("base64url");
 }
@@ -102,32 +102,20 @@ function scanServerIslands(source) {
 	const islands = [];
 	const collect = (name, start, sliceEnd) => {
 		const slice = source.slice(start, sliceEnd);
-		let as = "div";
-		for (const re of AS_RES) {
-			const hit = slice.match(re)?.[1];
-			if (hit) {
-				as = hit;
-				break;
-			}
-		}
+		const as = "div";
 		const streams = {};
 		const actions = {};
 		let actionOrder = 0;
 		let streamOrder = 0;
-		for (const kind of ["action", "derived"]) {
-			const re = new RegExp(kind === "action" ? "[A-Za-z0-9_$]*[Aa]ction\\s*\\(" : "\\bderived\\s*\\(", "g");
-			for (const match of slice.matchAll(re)) {
-				const args = extractCallArgs(slice, match.index + match[0].indexOf("("));
-				if (!args) continue;
-				if (kind === "derived") {
-					if (!/(async\s+function\s*\*|yield\b|for\s+await)/.test(args)) continue;
-					const target = referencedExports(args, candidates);
-					if (target) streams[`d${streamOrder++}`] = target;
-					continue;
-				}
-				const target = referencedExports(args, candidates);
-				actions[`a${actionOrder++}`] = target ?? "";
-			}
+		for (const match of slice.matchAll(/[A-Za-z0-9_$]*[Aa]ction\s*\(/g)) {
+			const args = extractCallArgs(slice, match.index + match[0].indexOf("("));
+			if (!args) continue;
+			const target = referencedExports(args, candidates);
+			actions[`a${actionOrder++}`] = target ?? "";
+		}
+		for (const match of slice.matchAll(/fromAsyncIterable\(\s*([A-Za-z_$][\w$]*)\s*\(/g)) {
+			const target = match[1];
+			if (candidates.has(target) && !Object.values(streams).includes(target)) streams[`d${streamOrder++}`] = target;
 		}
 		islands.push({
 			name,
@@ -152,8 +140,7 @@ function scanServerIslands(source) {
 		islands,
 		exports,
 		rpcActions,
-		clientRefs: scanClientRefs(source),
-		clientLoader: /(^|\n)\s*export\s+(?:const|let|var)\s+load\b\s*=\s*loader\.client\b/.test(source)
+		clientRefs: scanClientRefs(source)
 	};
 }
 function loadServerModuleScan(path) {
@@ -198,8 +185,7 @@ function generateServerIslandModule(spec, scan) {
 		if (actions.length) wiring.push(`actions: { ${actions.join(", ")} }`);
 		if (scan.clientRefs.length) wiring.push(`children: { ${scan.clientRefs.map((ref, index) => `${JSON.stringify(ref.id)}: $$child${index}`).join(", ")} }`);
 		const id = serverIslandPublicId(spec, island.name);
-		wiring.push(`frame: (props) => fetch("/__ilha/frame", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ id: ${JSON.stringify(id)}, path: location.pathname + location.search, props }) }).then((r) => { if (!r.ok) throw new Error("frame failed"); return r.json(); }).then((j) => { if (j.redirect) { location.assign(j.redirect); throw new Error("frame redirected"); } __ilhaApplyHead(j.head); return j.html; })`);
-		if (scan.clientLoader) wiring.push(`clientLoader: () => $$call("load", [])`);
+		wiring.push(`frame: (props) => fetch("/__ilha/frame", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ id: ${JSON.stringify(id)}, path: location.pathname + location.search, props }) }).then((r) => { if (!r.ok) throw new Error("frame failed"); return r.json(); }).then((j) => { if (j.redirect) { try { const u = new URL(j.redirect, location.href); if (u.origin === location.origin) location.assign(u.pathname + u.search + u.hash); } catch {} throw new Error("frame redirected"); } __ilhaApplyHead(j.head); return j.html; })`);
 		const call = `__ilhaServerIsland(${JSON.stringify(id)}, ${JSON.stringify(island.as)}, { ${wiring.join(", ")} })`;
 		if (island.name === "default") lines.push(`export default ${call};`);
 		else lines.push(`export const ${island.name} = ${call};`);
@@ -274,32 +260,6 @@ function toPosix(p) {
 const EXCLUDED_RE = /\.(test|spec|d)\.(ts|tsx)$/;
 /** Server pages: `foo.server.tsx` routes `/foo`, rendered through the frame protocol. */
 const SERVER_PAGE_RE = /\.server\.(ts|tsx)$/;
-/**
-* Match a top-of-statement `export const load`, `export let load`,
-* `export function load`, or `export async function load`. Intentionally
-* conservative: `export { load } from "./x"` re-exports are NOT detected
-* in v1. Declare `load` directly in the file to be picked up.
-*/
-const LOADER_EXPORT_RE = /^\s*export\s+(?:const|let|var|async\s+function|function)\s+load\b/m;
-/** `export const load = loader.client(…)` — the only client-loader form. */
-/** `export const load = loader.client(…)` — client loader under the server name. */
-const LOAD_CLIENT_EXPORT_RE = /(^|\n)\s*export\s+(?:const|let|var)\s+load\b\s*=\s*loader\.client\b/m;
-async function detectLoaderExports(file) {
-	try {
-		const stripped = (await readFile(file, "utf8")).replace(/^\s*\/\/.*$/gm, "");
-		const isClientLoader = LOAD_CLIENT_EXPORT_RE.test(stripped);
-		return {
-			load: LOADER_EXPORT_RE.test(stripped) && !isClientLoader,
-			isClientLoader
-		};
-	} catch (err) {
-		if (err?.code !== "ENOENT") console.warn(`[ilha-router] failed to read ${file} while detecting loader exports:`, err);
-		return {
-			load: false,
-			isClientLoader: false
-		};
-	}
-}
 function fileToSegment(name) {
 	if (name.startsWith("[...") && name.endsWith("]")) return `**:${name.slice(4, -1)}`;
 	if (name.startsWith("[") && name.endsWith("]")) return `:${name.slice(1, -1)}`;
@@ -374,37 +334,17 @@ async function collectFiles(dir, depth = 0) {
 async function scanPages(pagesDir) {
 	const all = await collectFiles(pagesDir);
 	const allSet = new Set(all);
-	const pages = all.filter((f) => !basename(f).startsWith("+"));
-	const layoutLoaderCache = /* @__PURE__ */ new Map();
-	const getLayoutExports = (file) => {
-		let cached = layoutLoaderCache.get(file);
-		if (!cached) {
-			cached = detectLoaderExports(file);
-			layoutLoaderCache.set(file, cached);
-		}
-		return cached;
-	};
-	return Promise.all(pages.map(async (file) => {
-		const server = SERVER_PAGE_RE.test(basename(file));
+	return all.filter((f) => !basename(f).startsWith("+")).map((file) => {
 		const pattern = fileToPattern(pagesDir, file);
-		const layouts = chainForFile(pagesDir, file, allSet, "+layout");
-		const errors = chainForFile(pagesDir, file, allSet, "+error");
-		const [pageExports, ...layoutExports] = await Promise.all([detectLoaderExports(file), ...layouts.map(getLayoutExports)]);
-		const loaderLayouts = layouts.filter((_, i) => layoutExports[i].load);
-		const clientLoaderLayouts = layouts.filter((_, i) => layoutExports[i].isClientLoader);
 		return {
 			file,
 			pattern,
 			name: patternToName(pattern),
-			layouts,
-			errors,
-			hasLoader: pageExports.load,
-			loaderLayouts,
-			hasClientLoader: pageExports.isClientLoader,
-			clientLoaderLayouts,
-			server
+			layouts: chainForFile(pagesDir, file, allSet, "+layout"),
+			errors: chainForFile(pagesDir, file, allSet, "+error"),
+			server: SERVER_PAGE_RE.test(basename(file))
 		};
-	}));
+	});
 }
 function validateEntries(entries, pagesDir, strict) {
 	if (entries.length === 0) {
@@ -416,7 +356,8 @@ function validateEntries(entries, pagesDir, strict) {
 	const problems = [];
 	for (const entry of entries) {
 		if (entry.server) try {
-			if (!loadServerModuleScan(entry.file).islands.some((island) => island.name === "default")) throw new Error(`[ilha:pages] Server page ${entry.file} has no default island export.\n  A .server page must "export default ilha…" so it can be rendered server-side.`);
+			const scan = loadServerModuleScan(entry.file);
+			if (!scan.islands.some((island) => island.name === "default") && !scan.exports.includes("default")) throw new Error(`[ilha:pages] Server page ${entry.file} has no default export.`);
 		} catch (err) {
 			if (err instanceof Error && err.message.includes("[ilha:pages]")) throw err;
 			throw new Error(`[ilha:pages] Server page ${entry.file} could not be scanned for island exports.`);
@@ -435,8 +376,7 @@ function validateEntries(entries, pagesDir, strict) {
 function resolveGeneratedPaths(outDir) {
 	return {
 		serverFile: join(outDir, "pages.server.ts"),
-		clientFile: join(outDir, "pages.client.ts"),
-		loadersFile: join(outDir, "loaders.ts")
+		clientFile: join(outDir, "pages.client.ts")
 	};
 }
 async function generate(pagesDir, outDir, options = {}) {
@@ -446,13 +386,13 @@ async function generate(pagesDir, outDir, options = {}) {
 	const entries = sortEntries(await scanPages(pagesDir));
 	validateEntries(entries, pagesDir, options.strict === true);
 	await mkdir(outDir, { recursive: true });
-	const { serverFile, clientFile, loadersFile } = resolveGeneratedPaths(outDir);
+	const { serverFile, clientFile } = resolveGeneratedPaths(outDir);
 	const serverChanged = await writeIfChanged(serverFile, buildServerFile(entries, serverFile));
 	const clientChanged = await writeIfChanged(clientFile, buildClientFile(entries, clientFile, {
 		isStatic,
 		interceptLinks
 	}));
-	if (!isStatic) await writeIfChanged(loadersFile, buildLoadersFile(entries, loadersFile, serverFile));
+	if (!isStatic) {}
 	if (serverChanged || clientChanged) await generateTypes(outDir);
 }
 function buildServerFile(entries, serverFile) {
@@ -474,7 +414,7 @@ function buildServerFile(entries, serverFile) {
 		const wrappedId = `_wrapped${i}`;
 		wrappedIslandLines.push(`const ${wrappedId} = ${expr};`);
 		registryLines.push(`  ${JSON.stringify(entry.name)}: ${wrappedId}` + (i < entries.length - 1 ? "," : ""));
-		routeLines.push(`  .route(${JSON.stringify(entry.pattern)}, ${wrappedId})` + (entry.hasLoader || entry.loaderLayouts.length > 0 ? `.markLoader(${JSON.stringify(entry.pattern)})` : ""));
+		routeLines.push(`  .route(${JSON.stringify(entry.pattern)}, ${wrappedId})`);
 		if (entry.errors.length > 0) routeLines.push(`  .errorBoundary(${JSON.stringify(entry.pattern)}, _error${i}_${entry.errors.length - 1})`);
 	}
 	return [
@@ -483,7 +423,6 @@ function buildServerFile(entries, serverFile) {
 		`// Import via: import { pageRouter, registry } from "ilha:pages/server";`,
 		``,
 		...imports,
-		...entries.some((e) => e.hasLoader || e.loaderLayouts.length > 0) ? [`import { setFrameLoaderRunner } from "@ilha/router/ssr";`, `setFrameLoaderRunner((path, request) => pageRouter.runLoader(path, request));`] : [],
 		``,
 		...wrappedIslandLines,
 		``,
@@ -503,8 +442,6 @@ function buildClientFile(entries, clientFile, opts) {
 		return r.startsWith(".") ? r : `./${r}`;
 	};
 	const clientImport = (abs) => `${rel(abs)}?client`;
-	const clientLoaderImport = (abs) => `${rel(abs)}?client-loader`;
-	let needsComposeLoaders = false;
 	const imports = isStatic ? [`import { router as _router, wrapLayout, wrapError } from "@ilha/router";`, `import type { Island } from "ilha";`] : [`import { router, wrapLayout, wrapError } from "@ilha/router";`, `import type { Island } from "ilha";`];
 	const wrappedIslandLines = [];
 	const registryLines = [];
@@ -536,27 +473,10 @@ function buildClientFile(entries, clientFile, opts) {
 		wrappedIslandLines.push(`const ${wrappedId} = ${expr};`);
 		registryLines.push(`  ${JSON.stringify(entry.name)}: ${wrappedId}` + (i < entries.length - 1 ? "," : ""));
 		if (!isStatic) {
-			routeLines.push(`  .route(${JSON.stringify(entry.pattern)}, ${wrappedId})` + (entry.hasLoader || entry.loaderLayouts.length > 0 ? `.markLoader(${JSON.stringify(entry.pattern)})` : ""));
-			const clientLoaderIds = [];
-			for (const [j, layout] of entry.clientLoaderLayouts.entries()) {
-				const id = `_cl${i}_l${j}`;
-				imports.push(`import { load as ${id} } from ${JSON.stringify(clientLoaderImport(layout))};`);
-				clientLoaderIds.push(id);
-			}
-			if (entry.hasClientLoader) {
-				const id = `_cl${i}`;
-				imports.push(`import { load as ${id} } from ${JSON.stringify(clientLoaderImport(entry.file))};`);
-				clientLoaderIds.push(id);
-			}
-			if (clientLoaderIds.length > 0) {
-				const expr = clientLoaderIds.length === 1 ? clientLoaderIds[0] : `composeLoaders([${clientLoaderIds.join(", ")}])`;
-				if (clientLoaderIds.length > 1) needsComposeLoaders = true;
-				routeLines.push(`  .clientLoader(${JSON.stringify(entry.pattern)}, ${expr})`);
-			}
+			routeLines.push(`  .route(${JSON.stringify(entry.pattern)}, ${wrappedId})`);
 			if (entry.errors.length > 0) routeLines.push(`  .errorBoundary(${JSON.stringify(entry.pattern)}, _error${i}_${entry.errors.length - 1})`);
 		}
 	}
-	if (needsComposeLoaders) imports[0] = imports[0].replace("{ router", "{ composeLoaders, router");
 	const routerExpr = isStatic ? `_router({ mode: "static" })` : `router(${interceptLinks === false ? `{ interceptLinks: false }` : ""})`;
 	const lines = [
 		`// @generated by @ilha/router — do not edit`,
@@ -576,52 +496,6 @@ function buildClientFile(entries, clientFile, opts) {
 	else lines.push(`export const pageRouter = ${routerExpr}`, ...routeLines, `  ;`);
 	return lines.join("\n");
 }
-function buildLoadersFile(entries, loadersFile, serverFile) {
-	const relFromLoaders = (abs) => {
-		const r = toPosix(relative(dirname(loadersFile), abs));
-		return r.startsWith(".") ? r : `./${r}`;
-	};
-	const withLoaders = entries.filter((e) => e.hasLoader || e.loaderLayouts.length > 0);
-	if (withLoaders.length === 0) return [
-		`// @generated by @ilha/router — do not edit`,
-		`// This project has no loader exports; this file is intentionally empty.`,
-		``,
-		`export {};`,
-		``
-	].join("\n");
-	const serverRel = relFromLoaders(serverFile).replace(/\.tsx?$/, "");
-	const imports = [`import { pageRouter } from ${JSON.stringify(serverRel)};`];
-	let needsComposeLoaders = false;
-	const attachLines = [];
-	for (const [i, entry] of withLoaders.entries()) {
-		const loaderIds = [];
-		for (const [j, layout] of entry.loaderLayouts.entries()) {
-			const id = `_p${i}_l${j}`;
-			imports.push(`import { load as ${id} } from ${JSON.stringify(relFromLoaders(layout))};`);
-			loaderIds.push(id);
-		}
-		if (entry.hasLoader) {
-			const id = `_p${i}`;
-			imports.push(`import { load as ${id} } from ${JSON.stringify(relFromLoaders(entry.file))};`);
-			loaderIds.push(id);
-		}
-		const loadersExpr = loaderIds.length === 1 ? loaderIds[0] : `composeLoaders([${loaderIds.join(", ")}])`;
-		if (loaderIds.length > 1) needsComposeLoaders = true;
-		attachLines.push(`pageRouter.attachLoader(${JSON.stringify(entry.pattern)}, ${loadersExpr});`);
-	}
-	if (needsComposeLoaders) imports.unshift(`import { composeLoaders } from "@ilha/router";`);
-	return [
-		`// @generated by @ilha/router — do not edit`,
-		`// Server-only. Import this module from your SSR entry to wire loaders`,
-		`// onto pageRouter. Importing it from the client is a no-op but wastes`,
-		`// bundle size — rely on the default build pipeline to keep it out.`,
-		``,
-		...imports,
-		``,
-		...attachLines,
-		``
-	].join("\n");
-}
 async function writeIfChanged(file, content) {
 	try {
 		if (await readFile(file, "utf8") === content) return false;
@@ -648,7 +522,7 @@ async function generateTypes(outDir) {
 		`}`,
 		``,
 		`declare module "ilha:loaders" {`,
-		`  // Side-effect-only module. Importing it attaches loaders to pageRouter.`,
+		`  // Side-effect-only module. oxidejs imports it alongside @ilha/router/ssr.`,
 		`}`,
 		``
 	].join("\n"));
@@ -656,6 +530,14 @@ async function generateTypes(outDir) {
 
 //#endregion
 //#region src/plugin.ts
+function devServerOrigin(server) {
+	const configured = server.config.server.origin;
+	if (configured) return new URL(typeof configured === "string" ? configured : String(configured)).origin;
+	const local = server.resolvedUrls?.local?.[0];
+	if (local) return new URL(local).origin;
+	const { host, port, https } = server.config.server;
+	return `${https ? "https" : "http"}://${host === true || host === void 0 || host === "" ? "localhost" : host === false ? "localhost" : String(host)}:${typeof port === "number" ? port : port ? Number(port) : 5173}`;
+}
 const VIRTUAL_PAGES_SERVER = "ilha:pages/server";
 const VIRTUAL_PAGES_CLIENT = "ilha:pages/client";
 const VIRTUAL_LOADERS = "ilha:loaders";
@@ -669,8 +551,6 @@ const RESOLVED_VIRTUAL_IDS = [
 ];
 /** Query suffix used on page/layout imports in the client file. */
 const CLIENT_QUERY = "?client";
-/** Query suffix that re-exports a page/layout's `load` (loader.client) for the browser bundle. */
-const CLIENT_LOADER_QUERY = "?client-loader";
 function decodeServerIslandId(id) {
 	if (!id.startsWith("\0ilha:server-island:")) return null;
 	try {
@@ -750,13 +630,12 @@ function detectIlhaConsumers(root) {
 function resolvePluginPaths(root, options) {
 	const pagesDir = resolve(root, options.dir ?? "src/pages");
 	const outDir = resolve(root, options.outDir ?? ".ilha");
-	const { serverFile, clientFile, loadersFile } = resolveGeneratedPaths(outDir);
+	const { serverFile, clientFile } = resolveGeneratedPaths(outDir);
 	return {
 		pagesDir,
 		outDir,
 		serverFile,
-		clientFile,
-		loadersFile
+		clientFile
 	};
 }
 function createPagesPluginState(options) {
@@ -764,9 +643,8 @@ function createPagesPluginState(options) {
 	let outDir;
 	let serverFile;
 	let clientFile;
-	let loadersFile;
 	const setPaths = (root) => {
-		({pagesDir, outDir, serverFile, clientFile, loadersFile} = resolvePluginPaths(root, options));
+		({pagesDir, outDir, serverFile, clientFile} = resolvePluginPaths(root, options));
 	};
 	const regen = async () => {
 		try {
@@ -799,9 +677,6 @@ function createPagesPluginState(options) {
 		get clientFile() {
 			return clientFile;
 		},
-		get loadersFile() {
-			return loadersFile;
-		},
 		setPaths,
 		regen,
 		shouldRegenOnChange,
@@ -816,7 +691,7 @@ function resolvePagesId(state, id, importer) {
 	if (id === "ilha:pages/server") return RESOLVED_PAGES_SERVER;
 	if (id === "ilha:pages/client") return RESOLVED_PAGES_CLIENT;
 	if (id === "ilha:loaders") return RESOLVED_LOADERS;
-	for (const query of [CLIENT_LOADER_QUERY, CLIENT_QUERY]) {
+	for (const query of [CLIENT_QUERY]) {
 		if (!id.endsWith(query)) continue;
 		const bare = id.slice(0, -query.length);
 		const resolved = importer ? resolve(importer.replace(/\?.*$/, ""), "..", bare) : resolve(bare);
@@ -833,14 +708,7 @@ function loadPagesModule(state, id) {
 		const spec = state.clientFile.replace(/\.tsx?$/, "");
 		return `export { pageRouter, registry } from ${JSON.stringify(spec)};`;
 	}
-	if (id === "\0ilha:loaders") {
-		const spec = state.loadersFile.replace(/\.tsx?$/, "");
-		return `import ${JSON.stringify(spec)};`;
-	}
-	if (id.endsWith("?client-loader")) {
-		const bare = id.slice(0, -14);
-		return `export { load } from ${JSON.stringify(bare)};`;
-	}
+	if (id === "\0ilha:loaders") return `// @generated by @ilha/router — do not edit\nexport {};\n`;
 	if (id.endsWith("?client")) {
 		const bare = id.slice(0, -7);
 		return `export { default } from ${JSON.stringify(bare)};`;
@@ -914,7 +782,6 @@ const pagesFactory = (options = {}) => {
 				const singletonPeers = [
 					"ilha",
 					"@ilha/router",
-					"alien-signals",
 					...detectIlhaConsumers(userConfig.root ? resolve(userConfig.root) : process.cwd())
 				];
 				const existingNoExternal = userConfig.ssr?.noExternal;
@@ -928,8 +795,7 @@ const pagesFactory = (options = {}) => {
 							...userConfig.optimizeDeps?.include ?? [],
 							"ilha",
 							"ilha/jsx-runtime",
-							"ilha/jsx-dev-runtime",
-							"alien-signals"
+							"ilha/jsx-dev-runtime"
 						])]
 					}
 				};
@@ -949,11 +815,7 @@ const pagesFactory = (options = {}) => {
 						if (Object.keys(scan.rpcActions).length > 0) lines.unshift(`import { __ilhaServerAction } from "@ilha/router/ssr";`);
 						lines.unshift(`import * as __ilhaSelf from ${JSON.stringify(file)};`);
 						lines.unshift(`import { registerServerIsland } from "@ilha/router/ssr";`);
-						for (const island of scan.islands) {
-							const id2 = serverIslandPublicId(file, island.name);
-							const isServerPage = SERVER_PAGE_RE.test(file) && state.isUnderPagesDir(file) && scan.exports.includes("load") ? `, { load: __ilhaSelf.load, pattern: ${JSON.stringify(fileToPattern(state.pagesDir, file))} }` : "";
-							lines.push(`registerServerIsland(${JSON.stringify(id2)}, () => __ilhaSelf[${JSON.stringify(island.name)}]?.[Symbol.for("ilha.renderState")]${isServerPage});`);
-						}
+						for (const island of scan.islands) lines.push(`registerServerIsland(${JSON.stringify(serverIslandPublicId(file, island.name))}, () => __ilhaSelf[${JSON.stringify(island.name)}]);`);
 					}
 					const base = rewriteServerActions(code, scan?.rpcActions ?? {});
 					if (base === code && lines.length === 0) return null;
@@ -1001,7 +863,6 @@ const pagesFactory = (options = {}) => {
 			configureServer(server) {
 				server.watcher.add(state.pagesDir);
 				if (options.frameGuard) setFrameGuard(options.frameGuard);
-				if (options.loaderGuard) setLoaderGuard(options.loaderGuard);
 				setFrameAuth({
 					trustedOrigins: options.trustedOrigins,
 					csrf: options.csrf,
@@ -1019,7 +880,8 @@ const pagesFactory = (options = {}) => {
 						res.end();
 						return;
 					}
-					const frameUrl = `http://${req.headers.host ?? "localhost"}${req.url ?? "/"}`;
+					const serverOrigin = devServerOrigin(server);
+					const frameUrl = `${serverOrigin}${req.url ?? "/"}`;
 					const authorized = await authorizeFrameRequest(new Request(frameUrl, {
 						method: req.method,
 						headers: new Headers(req.headers)
@@ -1061,19 +923,31 @@ const pagesFactory = (options = {}) => {
 							framePath = body.path;
 						}
 						await server.ssrLoadModule(VIRTUAL_PAGES_SERVER);
-						if (typeof (await server.ssrLoadModule(target.file))[target.name]?.[Symbol.for("ilha.renderState")] !== "function") throw new Error("unknown island");
+						await server.ssrLoadModule(target.file);
 						const headers = authorized.identityHeaders;
-						const requestOrigin = `http://${req.headers.host ?? "localhost"}`;
-						const request = new Request(new URL(framePath, requestOrigin), {
+						const request = new Request(frameScopedUrl(req.url ?? "/", framePath, serverOrigin), {
 							method: "POST",
 							headers
 						});
-						let head;
-						const html = await renderServerIsland(body.id ?? "", request, (r, fn) => runWithIslandRequest(r, fn), (entries) => head = entries, incomingProps);
-						const env = frameEnvelope(200, {
-							html: String(html),
-							head
-						});
+						const result = await renderServerIslandResult(body.id ?? "", request, (r, fn) => runWithIslandRequest(r, fn), incomingProps);
+						if (Result.isFailure(result)) {
+							const err = result.failure;
+							if (err.redirect) {
+								const env = frameEnvelope(err.status, { redirect: err.redirect });
+								res.statusCode = env.status;
+								for (const [k, v] of Object.entries(env.headers)) res.setHeader(k, v);
+								res.end(env.body);
+								return;
+							}
+							const status = err.status;
+							if (status >= 500) console.error("[ilha-router] frame render failed:", err);
+							const env = frameEnvelope(status, { error: "frame failed" });
+							res.statusCode = env.status;
+							for (const [k, v] of Object.entries(env.headers)) res.setHeader(k, v);
+							res.end(env.body);
+							return;
+						}
+						const env = frameEnvelope(200, { html: result.success });
 						res.statusCode = env.status;
 						for (const [k, v] of Object.entries(env.headers)) res.setHeader(k, v);
 						res.end(env.body);

package/dist/plugin.d.ts

@@ -8,8 +8,6 @@ export declare const RESOLVED_LOADERS = "\0ilha:loaders";
 export declare const RESOLVED_VIRTUAL_IDS: readonly ["\0ilha:pages/server", "\0ilha:pages/client", "\0ilha:loaders"];
 /** Query suffix used on page/layout imports in the client file. */
 export declare const CLIENT_QUERY = "?client";
-/** Query suffix that re-exports a page/layout's `load` (loader.client) for the browser bundle. */
-export declare const CLIENT_LOADER_QUERY = "?client-loader";
 export interface IlhaPagesOptions {
     /** Directory containing page files. Default: `src/pages` */
     dir?: string;
@@ -36,12 +34,6 @@ export interface IlhaPagesOptions {
      * `setFrameGuard()` from `@ilha/router/ssr`.
      */
     frameGuard?: (request: Request) => Response | void | Promise<Response | void>;
-    /**
-     * Guard consulted only by `GET /__ilha/loader` in production. When absent,
-     * the loader endpoint falls back to the frame guard for backwards
-     * compatibility. Mirrors `setLoaderGuard()`.
-     */
-    loaderGuard?: (request: Request) => Response | void | Promise<Response | void>;
     /**
      * Explicit trusted origins for frame/loader requests (e.g. a `.vercel.app`
      * or custom domain). When unset, origin checks compare the `Origin` header
@@ -64,14 +56,12 @@ export declare function resolvePluginPaths(root: string, options: IlhaPagesOptio
     outDir: string;
     serverFile: string;
     clientFile: string;
-    loadersFile: string;
 };
 export interface PagesPluginState {
     pagesDir: string;
     outDir: string;
     serverFile: string;
     clientFile: string;
-    loadersFile: string;
     setPaths(root: string): void;
     regen(): Promise<void>;
     shouldRegenOnChange(file: string): boolean;

package/dist/request-scope.d.ts

@@ -13,8 +13,9 @@
  * storage without importing `node:async_hooks`; this node-only module is the
  * sole place that constructs it.
  */
+import { REQUEST_ALS_KEY } from "./als-key";
 import type { IslandContext } from "./index";
-export declare const REQUEST_ALS_KEY: unique symbol;
+export { REQUEST_ALS_KEY };
 /** Run `fn` with `request` available to `useContext().request`. When oxidejs
  * is loaded, its action scope is entered too, so `useRequest()` works in
  * island renders and streamed frames. */

package/dist/rsbuild.js

@@ -1,4 +1,4 @@
-import { t as ilhaPages } from "./plugin-BQil-7B_.js";
+import { t as ilhaPages } from "./plugin-C3AAI3e_.js";
 
 //#region src/rsbuild.ts
 /** Rsbuild plugin — use via `@ilha/router/rsbuild`. */

package/dist/server-island.d.ts

@@ -24,9 +24,6 @@ export interface ServerIslandWiring {
     actions?: Record<string, (payload?: unknown) => unknown>;
     /** Frame transport: re-renders the island with the latest parent props. */
     frame?: (props?: Record<string, unknown>) => unknown;
-    /** RPC transport for the module's `loader.client` export — invoked once
-     * when the view hydrates. Side-effect loader on server pages. */
-    clientLoader?: () => unknown;
     /** Client-capable islands nested in the server render, keyed by opaque ref. */
     children?: Record<string, unknown>;
 }

package/dist/server-island.js

@@ -1,5 +1,5 @@
-import { n as applyHeadEntriesToDocument, t as parseSnapshotAttr } from "./snapshot-CsEaY6h_.js";
-import { morph } from "ilha";
+import { t as applyHeadEntriesToDocument } from "./head-DpYV3bHH.js";
+import { t as parseSnapshotAttr } from "./snapshot-C0E2OGwL.js";
 
 //#region src/server-island.ts
 /**
@@ -43,7 +43,8 @@ function assertValidTag(tag) {
 function belongsToHost(host, candidate) {
 	let el = candidate.parentElement;
 	while (el && el !== host) {
-		if (el.hasAttribute("data-ilha") || el.hasAttribute("data-ilha-slot")) return false;
+		if (el.hasAttribute("data-ilha")) return false;
+		if (el.hasAttribute("data-ilha-slot") && el.style.display !== "contents") return false;
 		el = el.parentElement;
 	}
 	return el === host;
@@ -106,7 +107,8 @@ function hydrateServerIsland(host, id, wiring, props) {
 			if (controller.signal.aborted || !host.isConnected) return;
 			const html = await frame(sent);
 			if (controller.signal.aborted || typeof html !== "string") return;
-			morph(host, html);
+			const parsed = new DOMParser().parseFromString(`<div>${html}</div>`, "text/html");
+			host.replaceChildren(...Array.from(parsed.body.firstElementChild?.childNodes ?? []));
 			syncChildren();
 			wireEvents();
 		}).catch((err) => {
@@ -115,7 +117,7 @@ function hydrateServerIsland(host, id, wiring, props) {
 	};
 	const attached = [];
 	const readManifest = () => {
-		const raw = Array.from(host.children).find((c) => c.matches(`template[${ACTIONS_ATTR}]`))?.getAttribute(ACTIONS_ATTR) ?? host.getAttribute(ACTIONS_ATTR) ?? null;
+		const raw = host.querySelector(`:scope > template[${ACTIONS_ATTR}], template[${ACTIONS_ATTR}]`)?.getAttribute(ACTIONS_ATTR) ?? host.getAttribute(ACTIONS_ATTR) ?? null;
 		return raw ? parseSnapshotAttr(raw) : void 0;
 	};
 	const wireEvents = () => {
@@ -215,9 +217,6 @@ function hydrateServerIsland(host, id, wiring, props) {
 		}
 	})();
 	if (frame && !host.hasAttribute(STATE_ATTR) && host.childNodes.length === 0) scheduleRepaint();
-	if (wiring.clientLoader) Promise.resolve(wiring.clientLoader()).catch((err) => {
-		if (!controller.signal.aborted) console.error(`[ilha-router] client loader failed for "${id}":`, err);
-	});
 	return {
 		unmount: () => {
 			for (const { el, type, listener } of attached) el.removeEventListener(type, listener);

package/dist/server-islands.d.ts

@@ -42,9 +42,6 @@ export interface ServerModuleScan {
     rpcActions: Record<string, string>;
     /** Imported JSX components that must hydrate inside the server island. */
     clientRefs: ClientIslandRef[];
-    /** True when the module declares `export const load = loader.client(…)` —
-     * the proxy wires it as an RPC call invoked when the view hydrates. */
-    clientLoader?: boolean;
 }
 export declare function clientRefPublicId(spec: string, imported: string): string;
 /** Scan a `*.server.ts(x)` module source for island exports and their

package/dist/snapshot-C0E2OGwL.js

@@ -0,0 +1,55 @@
+//#region src/snapshot.ts
+/**
+* Defensive parser for `data-ilha-state` / `data-ilha-props` snapshot
+* attributes on the router side. Mirrors the core ilha guards: size cap,
+* plain-object check, depth cap, and prototype-key stripping. Returns
+* undefined (degrade gracefully) on any failure.
+*/
+const MAX_SNAPSHOT_CHARS = 262144;
+const MAX_SNAPSHOT_DEPTH = 32;
+const UNSAFE_SNAPSHOT_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function stripUnsafeKeys(value) {
+	if (value === null || typeof value !== "object") return;
+	if (Array.isArray(value)) {
+		for (const item of value) stripUnsafeKeys(item);
+		return;
+	}
+	for (const key of Object.getOwnPropertyNames(value)) if (UNSAFE_SNAPSHOT_KEYS.has(key)) delete value[key];
+	else stripUnsafeKeys(value[key]);
+}
+function exceedsDepth(value, depth) {
+	if (depth > MAX_SNAPSHOT_DEPTH) return true;
+	if (value === null || typeof value !== "object") return false;
+	if (Array.isArray(value)) {
+		for (const item of value) if (exceedsDepth(item, depth + 1)) return true;
+		return false;
+	}
+	for (const key in value) {
+		if (!Object.hasOwn(value, key)) continue;
+		if (exceedsDepth(value[key], depth + 1)) return true;
+	}
+	return false;
+}
+function sanitizeSnapshotObject(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	if (exceedsDepth(value, 1)) return void 0;
+	stripUnsafeKeys(value);
+	return value;
+}
+function parseSnapshotAttr(raw) {
+	if (raw.length > MAX_SNAPSHOT_CHARS) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	return sanitizeSnapshotObject(parsed);
+}
+
+//#endregion
+export { sanitizeSnapshotObject as n, parseSnapshotAttr as t };