@ilha/router 0.11.3 → 0.11.5

package/dist/server-islands.d.ts

@@ -7,9 +7,9 @@
  * through oxidejs's tacho stub replacement.
  */
 /** Oxide RPC client key — basename without `.server.*` (oxide indexes by module name). */
-export declare function serverModuleRpcKey(spec: string): string;
+export declare const serverModuleRpcKey: (spec: string) => string;
 /** Client repaint group key — full normalized path so same-basename files stay distinct. */
-export declare function serverModuleRepaintKey(spec: string): string;
+export declare const serverModuleRepaintKey: (spec: string) => string;
 export interface ScannedServerIsland {
     /** Export binding name, or `"default"` for `export default ilha…`. */
     name: string;
@@ -31,7 +31,7 @@ export interface ClientIslandRef {
  * capture-aware shim on ALREADY-COMPILED module code. Must run inside the
  * SSR transform so upstream JSX/TS output is preserved.
  */
-export declare function rewriteServerActions(code: string, rpcActions: Record<string, string>): string;
+export declare const rewriteServerActions: (code: string, rpcActions: Record<string, string>) => string;
 export interface ServerModuleScan {
     islands: ScannedServerIsland[];
     /** All value-export names of the module (transport candidates). */
@@ -47,36 +47,37 @@ export interface ServerModuleScan {
     /** Imported JSX components that must hydrate inside the server island. */
     clientRefs: ClientIslandRef[];
 }
-export declare function clientRefPublicId(spec: string, imported: string): string;
+export declare const clientRefPublicId: (spec: string, imported: string) => string;
 /** Scan a `*.server.ts(x)` module source for island exports and their
- * declarative wiring. Convention: islands start with `ilha` — both builder
- * function components (`ilha(() => …)`) and `ilha(schema, component)`. */
-export declare function scanServerIslands(source: string): ServerModuleScan;
-export declare function loadServerModuleScan(path: string): ServerModuleScan;
+ * declarative wiring. Islands are `export const Name = [async] function[*]`
+ * (and the `export default` form); stream/action transports are discovered
+ * from calls inside each island body. */
+export declare const scanServerIslands: (source: string) => ServerModuleScan;
+export declare const loadServerModuleScan: (filePath: string) => ServerModuleScan;
 /** Virtual-module id prefix for generated client proxies of server islands.
  * The file path rides base64url-encoded: a raw suffix like
  * `\0…:…/tasks.server.tsx` would end in `.server.*` and oxidejs's client-stub
  * loader would claim the virtual module before us. */
 export declare const SERVER_ISLAND_PREFIX = "\0ilha:server-island:";
 /** Virtual-module specifier serving the client proxy for one server island file. */
-export declare function serverIslandVirtualSpec(file: string): string;
+export declare const serverIslandVirtualSpec: (file: string) => string;
 /** Emit the client virtual module for one scanned server file. Plain JS —
  * `\0` virtual modules bypass Vite's built-in TS transform, so type-only
  * constructs here would reach the browser unparsed. Editor types are
  * unaffected: TS resolves the ORIGINAL specifier (the real server module);
  * this module exists only inside the client bundle. Frames are fetched from
  * the plugin's `/__ilha/frame` dev middleware. */
-export declare function serverIslandPublicId(spec: string, name: string): string;
-export declare function generateServerIslandModule(spec: string, scan: ServerModuleScan): string;
+export declare const serverIslandPublicId: (spec: string, name: string) => string;
+export declare const generateServerIslandModule: (spec: string, scan: ServerModuleScan) => string;
 export interface SplitContext {
     /** Resolved absolute path of the imported specifier, when it's a scanned
      * server module carrying islands; null otherwise. */
-    islandNamesFor(spec: string): {
+    islandNamesFor: (spec: string) => {
         islands: Set<string>;
         hasDefault: boolean;
     } | null;
     /** Virtual module specifier that provides the island bindings. */
-    virtualSpecFor(spec: string): string;
+    virtualSpecFor: (spec: string) => string;
 }
 /**
  * Rewrite import sites whose specifier targets a server module containing
@@ -84,4 +85,4 @@ export interface SplitContext {
  * bindings stay on the original specifier (oxidejs replaces them with tacho
  * stubs). Returns null when no statement needed rewriting.
  */
-export declare function splitServerImports(code: string, ctx: SplitContext): string | null;
+export declare const splitServerImports: (code: string, ctx: SplitContext) => string | null;

package/dist/snapshot-XpAkSV8s.js

@@ -0,0 +1,57 @@
+//#region src/snapshot.ts
+/**
+* Defensive parser for `data-ilha-state` / `data-ilha-props` snapshot
+* attributes on the router side. Mirrors the core ilha guards: size cap,
+* plain-object check, depth cap, and prototype-key stripping. Returns
+* undefined (degrade gracefully) on any failure.
+*/
+const MAX_SNAPSHOT_CHARS = 262144;
+const MAX_SNAPSHOT_DEPTH = 32;
+const objectTag = (value) => Object.prototype.toString.call(value);
+const isObject = (value) => value !== null && objectTag(value) === "[object Object]";
+const exceedsMaxDepth = (value, depth) => {
+	if (depth > MAX_SNAPSHOT_DEPTH) return true;
+	if (value === null || !isObject(value)) {
+		if (Array.isArray(value)) {
+			for (const item of value) if (exceedsMaxDepth(item, depth + 1)) return true;
+		}
+		return false;
+	}
+	const obj = value;
+	for (const key of Object.keys(obj)) if (exceedsMaxDepth(obj[key], depth + 1)) return true;
+	return false;
+};
+const deleteUnsafeKey = (obj, key) => {
+	if (Object.hasOwn(obj, key)) Reflect.deleteProperty(obj, key);
+};
+const stripUnsafeKeys = (value) => {
+	if (Array.isArray(value)) {
+		for (const item of value) stripUnsafeKeys(item);
+		return;
+	}
+	if (value === null || !isObject(value)) return;
+	const obj = value;
+	deleteUnsafeKey(obj, "__proto__");
+	deleteUnsafeKey(obj, "constructor");
+	deleteUnsafeKey(obj, "prototype");
+	for (const key of Object.getOwnPropertyNames(obj)) stripUnsafeKeys(obj[key]);
+};
+const sanitizeSnapshotObject = (value) => {
+	if (!isObject(value) || Array.isArray(value)) return;
+	if (exceedsMaxDepth(value, 1)) return;
+	stripUnsafeKeys(value);
+	return value;
+};
+const parseSnapshotAttr = (raw) => {
+	if (raw.length > MAX_SNAPSHOT_CHARS) return;
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	return sanitizeSnapshotObject(parsed);
+};
+
+//#endregion
+export { sanitizeSnapshotObject as n, parseSnapshotAttr as t };

package/dist/snapshot.d.ts

@@ -1,2 +1,15 @@
-export declare function sanitizeSnapshotObject(value: unknown): Record<string, unknown> | undefined;
-export declare function parseSnapshotAttr(raw: string): Record<string, unknown> | undefined;
+/**
+ * Defensive parser for `data-ilha-state` / `data-ilha-props` snapshot
+ * attributes on the router side. Mirrors the core ilha guards: size cap,
+ * plain-object check, depth cap, and prototype-key stripping. Returns
+ * undefined (degrade gracefully) on any failure.
+ */
+/** JSON leaf values accepted in SSR hydrate snapshots. */
+export type SnapshotLeaf = string | number | boolean | null;
+/** JSON values accepted in SSR hydrate snapshots. */
+export type SnapshotValue = SnapshotLeaf | SnapshotObject | readonly SnapshotValue[];
+export interface SnapshotObject {
+    readonly [key: string]: SnapshotValue | undefined;
+}
+export declare const sanitizeSnapshotObject: <T>(value: T) => SnapshotObject | undefined;
+export declare const parseSnapshotAttr: (raw: string) => SnapshotObject | undefined;

package/dist/{ssr-CV_vNpS3.js → ssr-Dvq_qXs4.js}

@@ -1,5 +1,6 @@
 import { t as REQUEST_ALS_KEY } from "./als-key-CVxbuM3z.js";
-import { n as sanitizeSnapshotObject } from "./snapshot-C0E2OGwL.js";
+import { a as withHeadStore } from "./head-BLtm0xtK.js";
+import { n as sanitizeSnapshotObject } from "./snapshot-XpAkSV8s.js";
 import { renderToString } from "ilha";
 import * as Result from "effect/Result";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -29,12 +30,19 @@ const OXIDE_RUN_WITH_REQUEST = Symbol.for("oxidejs.runWithRequest");
 /** Run `fn` with `request` available to `useContext().request`. When oxidejs
 * is loaded, its action scope is entered too, so `useRequest()` works in
 * island renders and streamed frames. */
-function runWithIslandRequest(request, fn) {
+const runWithIslandRequest = (request, fn) => {
 	const g = globalThis;
-	const als = g[REQUEST_ALS_KEY] ??= new AsyncLocalStorage();
-	const oxide = g[OXIDE_RUN_WITH_REQUEST];
+	const existing = g[REQUEST_ALS_KEY];
+	let als;
+	if (existing instanceof AsyncLocalStorage) als = existing;
+	else {
+		als = new AsyncLocalStorage();
+		g[REQUEST_ALS_KEY] = als;
+	}
+	const oxideSlot = g[OXIDE_RUN_WITH_REQUEST];
+	const oxide = oxideSlot === void 0 ? void 0 : oxideSlot;
 	return als.run(request, () => oxide ? oxide(request, fn) : fn());
-}
+};
 
 //#endregion
 //#region src/ssr.ts
@@ -53,16 +61,36 @@ function runWithIslandRequest(request, fn) {
 * in, `{ html }` out). Renderers come from the process-global registry
 * populated by self-registration code appended to `.server` modules.
 */
+/**
+* Server-frame state shared by the dev middleware and the production
+* `@ilha/router/ssr` handler: the renderers registry (keyed by the public
+* island id, `sha256(file#name)`, see `serverIslandPublicId`), frame/loader
+* guards and auth policy, and the loader runner. Lives on `globalThis` so
+* every module copy (plugin bundle, SSR graph, frame entry) shares one
+* instance — same pattern as `request-scope.ts`.
+*
+* `.server` modules self-register when the plugin appends registration code
+* to their server-graph copy; the `/__ilha/frame` handler below consumes the
+* registry to re-render an island from a client state snapshot. Server pages
+* additionally register their `load` and route pattern so frame handlers can
+* run the loader with matched params.
+*/
+const objectTag = (value) => Object.prototype.toString.call(value);
+const isString = (value) => objectTag(value) === "[object String]";
+const isFunction = (value) => {
+	const tag = objectTag(value);
+	return tag === "[object Function]" || tag === "[object AsyncFunction]" || tag === "[object GeneratorFunction]";
+};
+const isObject = (value) => value !== null && objectTag(value) === "[object Object]";
 const REGISTRY_KEY = Symbol.for("ilha.serverIslandRenderers");
-function registry() {
+const registry = () => {
 	const g = globalThis;
-	let map = g[REGISTRY_KEY];
-	if (!map) {
-		map = /* @__PURE__ */ new Map();
-		g[REGISTRY_KEY] = map;
-	}
+	const existing = g[REGISTRY_KEY];
+	if (existing instanceof Map) return existing;
+	const map = /* @__PURE__ */ new Map();
+	g[REGISTRY_KEY] = map;
 	return map;
-}
+};
 const GUARD_KEY = Symbol.for("ilha.frameGuard");
 /**
 * Install a guard consulted by every `/__ilha/frame` request (dev middleware
@@ -71,33 +99,36 @@ const GUARD_KEY = Symbol.for("ilha.frameGuard");
 * allow. Island state is world-readable through frames unless you gate them,
 * so apps serving private data should install a session check here.
 */
-function setFrameGuard(guard) {
+const setFrameGuard = (guard) => {
 	const g = globalThis;
 	g[GUARD_KEY] = guard;
-}
-function getFrameGuard() {
-	return globalThis[GUARD_KEY];
-}
+};
+const getFrameGuard = () => {
+	const slot = globalThis[GUARD_KEY];
+	if (!isFunction(slot)) return;
+	return slot;
+};
 const AUTH_KEY = Symbol.for("ilha.frameAuth");
 /**
 * Install the frame-authorization policy consumed by the production
 * `@ilha/router/ssr` handler. `trustedOrigins` and `csrf` are also applied by
 * the dev middleware (via `IlhaPagesOptions`).
 */
-function setFrameAuth(policy) {
+const setFrameAuth = (policy) => {
 	const g = globalThis;
 	g[AUTH_KEY] = policy;
-}
-function getFrameAuth() {
-	return globalThis[AUTH_KEY];
-}
-function normalizeOrigin(value) {
+};
+const getFrameAuth = () => {
+	const slot = globalThis[AUTH_KEY];
+	return isObject(slot) ? slot : void 0;
+};
+const normalizeOrigin = (value) => {
 	try {
 		return new URL(value).origin;
 	} catch {
 		return null;
 	}
-}
+};
 /**
 * Same-origin check for frame/loader requests. Browsers always send `Origin`
 * on cross-origin and same-origin `POST`; its absence implies a non-browser
@@ -105,7 +136,7 @@ function normalizeOrigin(value) {
 * present it must match the configured trusted origins, else the request's
 * own `Host`.
 */
-function isTrustedOrigin(request, policy) {
+const isTrustedOrigin = (request, policy) => {
 	const originHeader = request.headers.get("origin");
 	if (originHeader === null) return true;
 	const origin = normalizeOrigin(originHeader);
@@ -115,40 +146,38 @@ function isTrustedOrigin(request, policy) {
 	const host = request.headers.get("host");
 	if (!host) return false;
 	return origin === `https://${host}` || origin === `http://${host}`;
-}
+};
 /**
 * Path-only route context for frame/loader scoped requests. Leading slash,
 * no `//` or backslash (WHATWG URLs treat `\` as `/` for http(s), so a
 * `\evil.com` prefix would smuggle a foreign authority past a plain `//`
 * check), bounded length. `false` for anything else.
 */
-function isSafeFramePath(path) {
-	return path.startsWith("/") && !path.includes("//") && !path.includes("\\") && path.length <= 2048;
-}
+const isSafeFramePath = (framePath) => framePath.startsWith("/") && !framePath.includes("//") && !framePath.includes("\\") && framePath.length <= 2048;
+const parseServerOrigin = (value) => {
+	if (!value.includes("://")) throw new Error("frameScopedUrl: serverOrigin must be an absolute URL");
+	const parsed = new URL(value);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error("frameScopedUrl: serverOrigin must be http(s)");
+	return parsed.origin;
+};
 /**
 * Build the scoped frame render URL from the incoming request URL and frame
 * path. Absolute `incomingUrl` values supply the origin. Relative values (for
 * example Vite's `req.url`) require an explicit trusted `serverOrigin` — never
 * a client `Host` header.
 */
-function frameScopedUrl(incomingUrl, framePath, serverOrigin) {
+const frameScopedUrl = (incomingUrl, framePath, serverOrigin) => {
 	let origin;
 	try {
 		const incoming = new URL(incomingUrl);
 		if (incoming.protocol !== "http:" && incoming.protocol !== "https:") throw new TypeError("unsupported protocol");
-		origin = incoming.origin;
+		({origin} = incoming);
 	} catch {
-		if (serverOrigin == null) throw new Error("frameScopedUrl: relative incomingUrl requires serverOrigin");
+		if (serverOrigin === null || serverOrigin === void 0) throw new Error("frameScopedUrl: relative incomingUrl requires serverOrigin");
 		origin = parseServerOrigin(serverOrigin);
 	}
 	return new URL(framePath, origin).href;
-}
-function parseServerOrigin(value) {
-	if (!value.includes("://")) throw new Error("frameScopedUrl: serverOrigin must be an absolute URL");
-	const parsed = new URL(value);
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error("frameScopedUrl: serverOrigin must be http(s)");
-	return parsed.origin;
-}
+};
 /** Identity headers forwarded onto scoped render/loader requests. */
 const FORWARD_IDENTITY_HEADERS = [
 	"cookie",
@@ -161,11 +190,10 @@ const FORWARD_IDENTITY_HEADERS = [
 * object. Client-supplied `x-forwarded-for` is deliberately NOT forwarded —
 * it is spoofable and must not be trusted by loaders for IP checks.
 */
-function forwardIdentityHeaders(source) {
+const forwardIdentityHeaders = (source) => {
 	const out = new Headers();
 	const read = (name) => {
-		const s = source;
-		if (typeof s.get === "function") return s.get(name);
+		if (source instanceof Headers) return source.get(name);
 		const v = source[name];
 		return Array.isArray(v) ? v[0] : v;
 	};
@@ -174,28 +202,24 @@ function forwardIdentityHeaders(source) {
 		if (v !== null && v !== void 0) out.set(name, v);
 	}
 	return out;
-}
-function frameEnvelope(status, body) {
-	return {
-		status,
-		headers: {
-			"cache-control": "no-store",
-			"content-type": "application/json;charset=utf-8"
-		},
-		body: JSON.stringify(body)
-	};
-}
-/** @internal Brand an exported server action with its generated RPC transport key. */
-function __ilhaServerAction(key, fn) {
-	const handle = typeof fn === "function" && fn.$$atom === 1 ? fn : action(fn);
+};
+const frameEnvelope = (status, body) => ({
+	body: JSON.stringify(body),
+	headers: {
+		"cache-control": "no-store",
+		"content-type": "application/json;charset=utf-8"
+	},
+	status
+});
+/** Brand an exported server action with its generated RPC transport key. */
+const __ilhaServerAction = (key, fn) => {
+	const handle = fn.$$atom === 1 ? fn : action(fn);
 	return brandServerAction(key, handle);
-}
-function registerServerIsland(id, render) {
+};
+const registerServerIsland = (id, render) => {
 	registry().set(id, { render });
-}
-function getServerIslandEntry(id) {
-	return registry().get(id);
-}
+};
+const getServerIslandEntry = (id) => registry().get(id);
 /** Client-facing frame failure. `redirect` carries a same-origin redirect target. */
 var FrameError = class extends Data.TaggedError("FrameError") {};
 /**
@@ -205,87 +229,86 @@ var FrameError = class extends Data.TaggedError("FrameError") {};
 * failures; loader redirects surface via `FrameError.redirect`.
 */
 const frameFail = (status, message) => new FrameError({
-	status,
-	message: message ?? "frame failed"
+	message: message ?? "frame failed",
+	status
 });
+const renderToStringOf = async (render, props) => {
+	const out = render(props);
+	const view = await Promise.resolve(out);
+	if (isString(view)) return view;
+	return renderToString(() => view, {
+		captureActions: true,
+		markers: false
+	});
+};
 /**
 * Render a registered server island. Typed error channel: the only failure is
 * `FrameError`; everything else is a defect surfaced as a 400 to the client.
 */
-function renderServerIsland(id, request, runWithScope, incomingProps) {
-	return Effect.gen(function* () {
-		const entry = registry().get(id);
-		if (!entry) return yield* Effect.fail(frameFail(400, "unknown island"));
-		const render = entry.render();
-		if (typeof render !== "function") return yield* Effect.fail(frameFail(400, "unknown island"));
-		return yield* Effect.tryPromise({
-			try: async () => {
-				return await runWithScope(request, () => renderToStringOf(render, incomingProps));
-			},
-			catch: (error) => error instanceof FrameError ? error : frameFail(400, error instanceof Error ? error.message : void 0)
-		});
+const renderServerIsland = (id, request, runWithScope, incomingProps) => Effect.gen(function* renderIsland() {
+	const entry = registry().get(id);
+	if (!entry) return yield* Effect.fail(frameFail(400, "unknown island"));
+	const render = entry.render();
+	if (!isFunction(render)) return yield* Effect.fail(frameFail(400, "unknown island"));
+	return yield* Effect.tryPromise({
+		catch: (error) => error instanceof FrameError ? error : frameFail(400, error instanceof Error ? error.message : void 0),
+		try: async () => await runWithScope(request, () => withHeadStore({ entries: [] }, () => renderToStringOf(render, incomingProps)))
 	});
-}
+});
 /** Convenience for non-Effect callers: run the render and resolve to a Result. */
-function renderServerIslandResult(id, request, runWithScope, incomingProps) {
-	return Effect.runPromise(Effect.result(renderServerIsland(id, request, runWithScope, incomingProps)));
-}
-function renderToStringOf(render, props) {
-	const out = render(props);
-	return Promise.resolve(out).then((view) => typeof view === "string" ? view : renderToString(() => view, {
-		captureActions: true,
-		markers: false
-	}));
-}
+const renderServerIslandResult = (id, request, runWithScope, incomingProps) => Effect.runPromise(Effect.result(renderServerIsland(id, request, runWithScope, incomingProps)));
 const FRAME_ENDPOINT = "/__ilha/frame";
 /** Max request body size — matches the dev middleware cap. */
 const MAX_BODY = 16384;
 /** Parent-island props on a frame POST. Missing is fine; anything else is 400. */
-function parseFrameProps(value) {
-	if (value == null) return void 0;
-	if (typeof value !== "object" || Array.isArray(value)) throw new FrameError({
-		status: 400,
-		message: "frame failed"
+const parseFrameProps = (value) => {
+	if (value === null || value === void 0) return;
+	if (!isObject(value) || Array.isArray(value)) throw new FrameError({
+		message: "frame failed",
+		status: 400
 	});
 	const sanitized = sanitizeSnapshotObject(value);
 	if (!sanitized) throw new FrameError({
-		status: 400,
-		message: "frame failed"
+		message: "frame failed",
+		status: 400
 	});
 	return sanitized;
-}
-function json(status, body) {
+};
+const json = (status, body) => {
 	const env = frameEnvelope(status, body);
 	return new Response(env.body, {
-		status: env.status,
-		headers: env.headers
+		headers: env.headers,
+		status: env.status
 	});
-}
+};
+const readChunksBounded = async (reader, maxBytes, chunks, size) => {
+	const { done, value } = await reader.read();
+	if (done) return chunks;
+	const nextSize = size + (value?.byteLength ?? 0);
+	if (nextSize > maxBytes) {
+		try {
+			await reader.cancel();
+		} catch {}
+		return null;
+	}
+	if (value) chunks.push(value);
+	return readChunksBounded(reader, maxBytes, chunks, nextSize);
+};
 /**
 * Read a request body as UTF-8, streaming it with a hard byte cap. Returns
 * `null` when the body exceeds `maxBytes` (the reader is cancelled before the
 * cap is far exceeded) or when decoding fails.
 */
-async function readBodyBounded(request, maxBytes) {
+const readBodyBounded = async (request, maxBytes) => {
 	const contentLength = request.headers.get("content-length");
 	if (contentLength !== null && Number(contentLength) > maxBytes) return null;
 	const reader = request.body?.getReader();
 	if (!reader) return "";
-	const chunks = [];
-	let size = 0;
-	for (;;) {
-		const { done, value } = await reader.read();
-		if (done) break;
-		size += value?.byteLength ?? 0;
-		if (size > maxBytes) {
-			await reader.cancel().catch(() => {});
-			return null;
-		}
-		chunks.push(value);
-	}
+	const chunks = await readChunksBounded(reader, maxBytes, [], 0);
+	if (chunks === null) return null;
 	const decoder = new TextDecoder();
 	return chunks.map((c) => decoder.decode(c, { stream: true })).join("") + decoder.decode();
-}
+};
 /**
 * Shared frame-request authorization used by both the production handler
 * below and the Vite/Rsbuild dev middleware: same-origin check against the
@@ -296,7 +319,7 @@ async function readBodyBounded(request, maxBytes) {
 * Returns the forwarded identity headers on success so callers render frames
 * with cookie/auth/UA context, or the HTTP status to reject with.
 */
-async function authorizeFrameRequest(request, options) {
+const authorizeFrameRequest = async (request, options) => {
 	const auth = getFrameAuth();
 	if (!isTrustedOrigin(request, auth)) return {
 		ok: false,
@@ -332,65 +355,71 @@ async function authorizeFrameRequest(request, options) {
 		};
 	}
 	return {
-		ok: true,
-		identityHeaders: forwardIdentityHeaders(request.headers)
+		identityHeaders: forwardIdentityHeaders(request.headers),
+		ok: true
 	};
-}
-async function ssr(request) {
+};
+const copyFrameworkSymbols = (from, to) => {
+	for (const sym of Object.getOwnPropertySymbols(from)) {
+		if (Symbol.keyFor(sym) === void 0) continue;
+		const desc = Object.getOwnPropertyDescriptor(from, sym);
+		if (!desc) continue;
+		try {
+			Object.defineProperty(to, sym, desc);
+		} catch {}
+	}
+};
+const ssr = async (request) => {
 	let url;
 	try {
 		url = new URL(request.url);
 	} catch {
 		return json(400, { error: "frame failed" });
 	}
-	if (url.pathname !== "/__ilha/frame") return void 0;
-	const program = Effect.gen(function* () {
+	if (url.pathname !== "/__ilha/frame") return;
+	const program = Effect.gen(function* handleFrame() {
 		const auth = getFrameAuth();
 		if (!isTrustedOrigin(request, auth)) return yield* Effect.fail(frameFail(403));
 		if (request.method !== "POST") return yield* Effect.fail(frameFail(405));
 		if (!(request.headers.get("content-type") ?? "").startsWith("application/json")) return yield* Effect.fail(frameFail(415));
 		const authorized = yield* Effect.tryPromise({
+			catch: () => frameFail(403),
 			try: () => authorizeFrameRequest(request, {
 				defaultAction: auth?.defaultAction ?? "deny",
 				onGuardError: (error) => console.error("[ilha-router] frame guard failed:", error)
-			}),
-			catch: () => frameFail(403)
+			})
 		});
 		if (!authorized.ok) return yield* Effect.fail(frameFail(authorized.status));
 		let id;
-		let path = "/";
+		let framePath = "/";
 		let incomingProps;
 		{
 			const text = yield* Effect.tryPromise({
-				try: () => readBodyBounded(request, MAX_BODY),
-				catch: () => frameFail(400)
+				catch: () => frameFail(400),
+				try: () => readBodyBounded(request, MAX_BODY)
 			});
 			if (text === null) return yield* Effect.fail(frameFail(413));
 			try {
 				const body = JSON.parse(text);
 				id = String(body.id ?? "");
 				incomingProps = parseFrameProps(body.props);
-				if (typeof body.path === "string") {
+				if (isString(body.path)) {
 					if (!isSafeFramePath(body.path)) return yield* Effect.fail(frameFail(400));
-					path = body.path;
+					framePath = body.path;
 				}
 			} catch {
 				return yield* Effect.fail(frameFail(400));
 			}
 		}
-		const scoped = new Request(frameScopedUrl(url.href, path), {
-			method: "POST",
-			headers: forwardIdentityHeaders(request.headers)
+		const scoped = new Request(frameScopedUrl(url.href, framePath), {
+			headers: forwardIdentityHeaders(request.headers),
+			method: "POST"
 		});
-		for (const sym of Object.getOwnPropertySymbols(request)) {
-			if (Symbol.keyFor(sym) === void 0) continue;
-			try {
-				scoped[sym] = request[sym];
-			} catch {}
-		}
-		return json(200, { html: yield* renderServerIsland(id, scoped, (scopedRequest, fn) => Promise.resolve(runWithIslandRequest(scopedRequest, fn)), incomingProps) });
+		copyFrameworkSymbols(request, scoped);
+		const html = yield* renderServerIsland(id, scoped, (scopedRequest, fn) => Promise.resolve(runWithIslandRequest(scopedRequest, fn)), incomingProps);
+		return json(200, { html });
 	});
-	return Effect.runPromise(Effect.map(Effect.result(program), Result.match({
+	return await Effect.runPromise(Effect.map(Effect.result(program), Result.match({
 		onFailure: (error) => {
 			if (error.redirect) return json(error.status, { redirect: error.redirect });
 			if (error.status >= 500) console.error("[ilha-router] frame render failed:", error);
@@ -398,9 +427,8 @@ async function ssr(request) {
 		},
 		onSuccess: (response) => response
 	})));
-}
-/** Side-effect imports required alongside this handler. */
-ssr.imports = ["ilha:pages/server"];
+};
+const ssrWithImports = Object.assign(ssr, { imports: ["ilha:pages/server"] });
 
 //#endregion
-export { runWithIslandRequest as C, ssr as S, registerServerIsland as _, authorizeFrameRequest as a, setFrameAuth as b, frameScopedUrl as c, getServerIslandEntry as d, isSafeFramePath as f, readBodyBounded as g, parseFrameProps as h, __ilhaServerAction as i, getFrameAuth as l, json as m, FrameError as n, forwardIdentityHeaders as o, isTrustedOrigin as p, MAX_BODY as r, frameEnvelope as s, FRAME_ENDPOINT as t, getFrameGuard as u, renderServerIsland as v, setFrameGuard as x, renderServerIslandResult as y };
+export { runWithIslandRequest as C, ssrWithImports as S, registerServerIsland as _, authorizeFrameRequest as a, setFrameAuth as b, frameScopedUrl as c, getServerIslandEntry as d, isSafeFramePath as f, readBodyBounded as g, parseFrameProps as h, __ilhaServerAction as i, getFrameAuth as l, json as m, FrameError as n, forwardIdentityHeaders as o, isTrustedOrigin as p, MAX_BODY as r, frameEnvelope as s, FRAME_ENDPOINT as t, getFrameGuard as u, renderServerIsland as v, setFrameGuard as x, renderServerIslandResult as y };