@ilha/router 0.8.13 → 0.9.1

package/dist/{plugin-DdquB3Nf.js → plugin-DogkskcY.js}

@@ -1,14 +1,268 @@
-import { existsSync, readFileSync, watch } from "node:fs";
+import { t as runWithIslandRequest } from "./request-scope-C4reU4v0.js";
+import { FrameError, getFrameGuard, renderServerIsland, setFrameGuard } from "./server-island-registry.js";
+import { existsSync, readFileSync, statSync, watch } from "node:fs";
 import { basename, dirname, extname, join, relative, resolve, sep } from "node:path";
 import { createUnplugin } from "unplugin";
 import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
 
+//#region src/server-islands.ts
+const EXPORT_RE = /(?:^|\n)\s*export\s+(?:declare\s+)?(?:async\s+)?(?:function\s*\*?|const|let|var|class)\s+([A-Za-z_$][\w$]*)/g;
+const ISLAND_EXPORT_RE = /(?:^|\n)\s*export\s+(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*ilha\b/g;
+const DEFAULT_ISLAND_RE = /export\s+default\s+ilha\b/;
+const AS_RE = /\.as\(\s*["'`]([a-z][a-z0-9-]*)["'`]\s*\)/;
+function clientRefPublicId(spec, imported) {
+	return createHash("sha256").update(`${spec}#${imported}`).digest("base64url");
+}
+function scanClientRefs(source) {
+	const used = new Set(Array.from(source.matchAll(/<([A-Z][\w$]*)\b/g), (match) => match[1]));
+	const refs = [];
+	for (const match of source.matchAll(/(?:^|\n)\s*import\s+(?!type\b)([^'"\n]+?)\s+from\s+["']([^"']+)["']/g)) {
+		const clause = match[1].trim();
+		const spec = match[2];
+		const brace = clause.match(/\{([^}]+)\}/)?.[1];
+		if (brace) for (const part of brace.split(",")) {
+			const binding = part.trim().match(/^([A-Za-z_$][\w$]*)(?:\s+as\s+([A-Za-z_$][\w$]*))?$/);
+			if (!binding) continue;
+			const imported = binding[1];
+			const local = binding[2] ?? imported;
+			if (used.has(local)) refs.push({
+				id: clientRefPublicId(spec, imported),
+				local,
+				imported,
+				spec
+			});
+		}
+		const defaultLocal = clause.split(",", 1)[0].trim();
+		if (/^[A-Za-z_$][\w$]*$/.test(defaultLocal) && used.has(defaultLocal)) refs.push({
+			id: clientRefPublicId(spec, "default"),
+			local: defaultLocal,
+			imported: "default",
+			spec
+		});
+	}
+	return refs;
+}
+/** Extract the balanced-paren argument list starting at the "(" following
+* `from` index. String literals are skipped so parens inside them don't count.
+* Returns the inner text, or null when unbalanced within `limit` chars. */
+function extractCallArgs(source, openParen, limit = 4e3) {
+	let depth = 0;
+	let quote = null;
+	for (let i = openParen; i < Math.min(source.length, openParen + limit); i++) {
+		const ch = source[i];
+		if (quote !== null) {
+			if (ch === "\\") i++;
+			else if (ch === quote) quote = null;
+			continue;
+		}
+		if (ch === "\"" || ch === "'" || ch === "`") {
+			quote = ch;
+			continue;
+		}
+		if (ch === "(") depth++;
+		else if (ch === ")") {
+			depth--;
+			if (depth === 0) return source.slice(openParen + 1, i);
+		}
+	}
+	console.warn("[ilha-router] scanServerIslands: argument list exceeded the scan limit — call skipped.");
+	return null;
+}
+/** First callback body inside an args list: everything after the first top-level
+* comma. Used to scan which module exports a stream/action closure references. */
+function callbackBody(args) {
+	let depth = 0;
+	let quote = null;
+	for (let i = 0; i < args.length; i++) {
+		const ch = args[i];
+		if (quote !== null) {
+			if (ch === "\\") i++;
+			else if (ch === quote) quote = null;
+			continue;
+		}
+		if (ch === "\"" || ch === "'" || ch === "`") {
+			quote = ch;
+			continue;
+		}
+		if (ch === "(" || ch === "{" || ch === "[") depth++;
+		else if (ch === ")" || ch === "}" || ch === "]") depth--;
+		else if (ch === "," && depth === 0) return args.slice(i + 1);
+	}
+	return "";
+}
+/** Identifiers in `body` that are members of `candidates`, excluding keywords. */
+function referencedExports(body, candidates) {
+	for (const match of body.matchAll(/([A-Za-z_$][\w$]*)\s*\(/g)) if (candidates.has(match[1])) return match[1];
+}
+/** Scan a `*.server.ts(x)` module source for island exports and their
+* declarative wiring. Convention: islands start with `ilha` — both builder
+* chains (`ilha.state()…render()`) and direct factories (`ilha(() => …)`). */
+function scanServerIslands(source) {
+	const exports = [];
+	for (const match of source.matchAll(EXPORT_RE)) exports.push(match[1]);
+	for (const match of source.matchAll(/export\s*\{([^}]*)\}/g)) for (const part of match[1].split(",")) {
+		const parts2 = part.trim().split(/\s+as\s+/);
+		const name = (parts2.length === 2 ? parts2[1] : parts2[0])?.trim();
+		if (name && /^[A-Za-z_$][\w$]*$/.test(name) && !exports.includes(name)) exports.push(name);
+	}
+	const candidates = new Set(exports);
+	const islands = [];
+	const collect = (name, start, sliceEnd) => {
+		const slice = source.slice(start, sliceEnd);
+		const as = slice.match(AS_RE)?.[1] ?? "div";
+		const streams = {};
+		const actions = {};
+		for (const kind of ["stream", "action"]) {
+			const re = new RegExp(`\\.${kind}\\s*\\(\\s*["'\`](\\w+)["'\`]\\s*,`, "g");
+			for (const match of slice.matchAll(re)) {
+				const key = match[1];
+				const args = extractCallArgs(slice, (match.index ?? 0) + match[0].indexOf("("));
+				if (!args) continue;
+				const target = referencedExports(callbackBody(args), candidates);
+				if (target) (kind === "stream" ? streams : actions)[key] = target;
+			}
+		}
+		islands.push({
+			name,
+			as,
+			streams,
+			actions
+		});
+	};
+	for (const match of source.matchAll(ISLAND_EXPORT_RE)) {
+		const name = match[1];
+		const rest = source.slice((match.index ?? 0) + match[0].length);
+		const nextExport = rest.search(/\nexport\b/);
+		collect(name, match.index ?? 0, (match.index ?? 0) + match[0].length + (nextExport === -1 ? rest.length : nextExport));
+	}
+	const defaultMatch = source.match(DEFAULT_ISLAND_RE);
+	if (defaultMatch && defaultMatch.index !== void 0) {
+		const rest = source.slice(defaultMatch.index + defaultMatch[0].length);
+		const nextExport = rest.search(/\nexport\b/);
+		collect("default", defaultMatch.index, defaultMatch.index + defaultMatch[0].length + (nextExport === -1 ? rest.length : nextExport));
+	}
+	return {
+		islands,
+		exports,
+		clientRefs: scanClientRefs(source),
+		clientLoader: /(^|\n)\s*export\s+(?:const|let|var)\s+load\b\s*=\s*loader\.client\b/.test(source)
+	};
+}
+function loadServerModuleScan(path) {
+	return scanServerIslands(readFileSync(path, "utf8"));
+}
+/** Virtual-module id prefix for generated client proxies of server islands.
+* The file path rides base64url-encoded: a raw suffix like
+* `\0…:…/tasks.server.tsx` would end in `.server.*` and oxidejs's client-stub
+* loader would claim the virtual module before us. */
+const SERVER_ISLAND_PREFIX = "\0ilha:server-island:";
+/** Virtual-module specifier serving the client proxy for one server island file. */
+function serverIslandVirtualSpec(file) {
+	return SERVER_ISLAND_PREFIX + Buffer.from(file).toString("base64url");
+}
+/** Emit the client virtual module for one scanned server file. Plain JS —
+* `\0` virtual modules bypass Vite's built-in TS transform, so type-only
+* constructs here would reach the browser unparsed. Editor types are
+* unaffected: TS resolves the ORIGINAL specifier (the real server module);
+* this module exists only inside the client bundle. Frames are fetched from
+* the plugin's `/__ilha/frame` dev middleware. */
+function serverIslandPublicId(spec, name) {
+	return createHash("sha256").update(`${spec}#${name}`).digest("base64url");
+}
+function generateServerIslandModule(spec, scan) {
+	const moduleKey = basename(spec).replace(/\.server\.(?:[jt]sx?)$/i, "");
+	const lines = [
+		`import { client as $$rpc } from "virtual:oxide/client";`,
+		`import { __ilhaServerIsland } from "@ilha/router/server-island";`,
+		`const $$call = (method, args) => { const opts = args.at(-1); return opts && typeof opts === "object" && opts.signal instanceof AbortSignal && Object.keys(opts).length === 1 ? $$rpc[${JSON.stringify(moduleKey)}][method](args.slice(0, -1), opts) : $$rpc[${JSON.stringify(moduleKey)}][method](args); };`,
+		...scan.clientRefs.map((ref, index) => ref.imported === "default" ? `import $$child${index} from ${JSON.stringify(ref.spec)};` : `import { ${ref.imported} as $$child${index} } from ${JSON.stringify(ref.spec)};`)
+	];
+	for (const name of scan.exports) if (!scan.islands.some((island) => island.name === name)) lines.push(`export const ${name} = (...args) => $$call(${JSON.stringify(name)}, args);`);
+	for (const island of scan.islands) {
+		const wiring = [];
+		const streams = Object.entries(island.streams).map(([key, target]) => `${JSON.stringify(key)}: (signal) => $$call(${JSON.stringify(target)}, [{ signal }])`);
+		const actions = Object.entries(island.actions).map(([key, target]) => `${JSON.stringify(key)}: (...args) => $$call(${JSON.stringify(target)}, args)`);
+		if (streams.length) wiring.push(`streams: { ${streams.join(", ")} }`);
+		if (actions.length) wiring.push(`actions: { ${actions.join(", ")} }`);
+		if (scan.clientRefs.length) wiring.push(`children: { ${scan.clientRefs.map((ref, index) => `${JSON.stringify(ref.id)}: $$child${index}`).join(", ")} }`);
+		const id = serverIslandPublicId(spec, island.name);
+		wiring.push(`frame: () => fetch("/__ilha/frame", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ id: ${JSON.stringify(id)}, path: location.pathname + location.search }) }).then((r) => { if (!r.ok) throw new Error("frame failed"); return r.json(); }).then((j) => { if (j.redirect) { location.assign(j.redirect); throw new Error("frame redirected"); } return j.html; })`);
+		if (scan.clientLoader) wiring.push(`clientLoader: () => $$call("load", [])`);
+		const call = `__ilhaServerIsland(${JSON.stringify(id)}, ${JSON.stringify(island.as)}, { ${wiring.join(", ")} })`;
+		if (island.name === "default") lines.push(`export default ${call};`);
+		else lines.push(`export const ${island.name} = ${call};`);
+	}
+	return lines.join("\n");
+}
+function parseImportClause(clause) {
+	const result = { named: [] };
+	let rest = clause.trim();
+	const nsMatch = rest.match(/\*\s+as\s+([A-Za-z_$][\w$]*)/);
+	if (nsMatch) {
+		result.namespace = nsMatch[1];
+		rest = rest.replace(nsMatch[0], "").replace(/,/g, "").trim();
+	}
+	const braceStart = rest.indexOf("{");
+	if (braceStart !== -1) {
+		const before = rest.slice(0, braceStart).replace(/,/g, "").trim();
+		if (before) result.defaultLocal = before;
+		const inner = rest.slice(braceStart + 1, rest.lastIndexOf("}"));
+		for (const item of inner.split(",")) {
+			const trimmed = item.trim();
+			if (!trimmed || trimmed.startsWith("type ")) continue;
+			const asMatch = trimmed.match(/^([A-Za-z_$][\w$]*)(?:\s+as\s+([A-Za-z_$][\w$]*))?$/);
+			if (asMatch) result.named.push({
+				imported: asMatch[1],
+				local: asMatch[2] ?? asMatch[1]
+			});
+		}
+	} else if (rest && !result.namespace) result.defaultLocal = rest.replace(/,/g, "").trim();
+	return result;
+}
+/**
+* Rewrite import sites whose specifier targets a server module containing
+* island exports. Island bindings move to the virtual proxy module; all other
+* bindings stay on the original specifier (oxidejs replaces them with tacho
+* stubs). Returns null when no statement needed rewriting.
+*/
+function splitServerImports(code, ctx) {
+	const IMPORT_RE = /(^|\n)import\s+(?!type\b)([^'"\n]+?)\s*from\s*(["'])([^"'\n]+)\3;?/g;
+	let changed = false;
+	const out = code.replace(IMPORT_RE, (statement, lead, clause, _q, spec) => {
+		const info = ctx.islandNamesFor(spec);
+		if (!info) return statement;
+		const parsed = parseImportClause(clause);
+		const routed = [];
+		const kept = [];
+		for (const binding of parsed.named) routed.push(binding);
+		const routeDefault = parsed.defaultLocal !== void 0 && info.hasDefault;
+		if (routed.length === 0 && !routeDefault) return statement;
+		changed = true;
+		const parts = [];
+		const keptBits = [];
+		if (!routeDefault && parsed.defaultLocal) keptBits.push(parsed.defaultLocal);
+		if (kept.length) keptBits.push(`{ ${kept.map((b) => b.local === b.imported ? b.imported : `${b.imported} as ${b.local}`).join(", ")} }`);
+		if (keptBits.length) parts.push(`import ${keptBits.join(", ")} from ${JSON.stringify(spec)};`);
+		if (parsed.namespace) parts.push(`import * as ${parsed.namespace} from ${JSON.stringify(spec)};`);
+		const routedBits = [];
+		if (routeDefault) routedBits.push(parsed.defaultLocal);
+		if (routed.length) routedBits.push(`{ ${routed.map((b) => b.local === b.imported ? b.imported : `${b.imported} as ${b.local}`).join(", ")} }`);
+		parts.push(`import ${routedBits.join(", ")} from ${JSON.stringify(ctx.virtualSpecFor(spec))};`);
+		return lead + parts.join("\n");
+	});
+	return changed ? out : null;
+}
+
+//#endregion
 //#region src/codegen.ts
 function toPosix(p) {
 	return p.replace(/\\/g, "/");
 }
 /** Files that should never be treated as pages even if they match the ts/tsx extension. */
 const EXCLUDED_RE = /\.(test|spec|d)\.(ts|tsx)$/;
+/** Server pages: `foo.server.tsx` routes `/foo`, rendered through the frame protocol. */
+const SERVER_PAGE_RE = /\.server\.(ts|tsx)$/;
 /**
 * Match a top-of-statement `export const load`, `export let load`,
 * `export function load`, or `export async function load`. Intentionally
@@ -16,20 +270,22 @@ const EXCLUDED_RE = /\.(test|spec|d)\.(ts|tsx)$/;
 * in v1. Declare `load` directly in the file to be picked up.
 */
 const LOADER_EXPORT_RE = /^\s*export\s+(?:const|let|var|async\s+function|function)\s+load\b/m;
-/** Same shape for `clientLoad` — a loader executed in the browser on client navigations. */
-const CLIENT_LOADER_EXPORT_RE = /^\s*export\s+(?:const|let|var|async\s+function|function)\s+clientLoad\b/m;
+/** `export const load = loader.client(…)` — the only client-loader form. */
+/** `export const load = loader.client(…)` — client loader under the server name. */
+const LOAD_CLIENT_EXPORT_RE = /(^|\n)\s*export\s+(?:const|let|var)\s+load\b\s*=\s*loader\.client\b/m;
 async function detectLoaderExports(file) {
 	try {
 		const stripped = (await readFile(file, "utf8")).replace(/^\s*\/\/.*$/gm, "");
+		const isClientLoader = LOAD_CLIENT_EXPORT_RE.test(stripped);
 		return {
-			load: LOADER_EXPORT_RE.test(stripped),
-			clientLoad: CLIENT_LOADER_EXPORT_RE.test(stripped)
+			load: LOADER_EXPORT_RE.test(stripped) && !isClientLoader,
+			isClientLoader
 		};
 	} catch (err) {
 		if (err?.code !== "ENOENT") console.warn(`[ilha-router] failed to read ${file} while detecting loader exports:`, err);
 		return {
 			load: false,
-			clientLoad: false
+			isClientLoader: false
 		};
 	}
 }
@@ -45,7 +301,9 @@ function dirToSegment(name) {
 }
 function fileToPattern(pagesDir, file) {
 	const rel = toPosix(relative(pagesDir, file));
-	const parts = rel.slice(0, -extname(rel).length).split("/");
+	let noExt = rel.slice(0, -extname(rel).length);
+	if (SERVER_PAGE_RE.test(rel)) noExt = noExt.replace(/\.server$/, "");
+	const parts = noExt.split("/");
 	const segments = [...parts.slice(0, -1).map(dirToSegment), fileToSegment(parts.at(-1))];
 	if (segments.at(-1) === "index") segments.pop();
 	return "/" + segments.filter(Boolean).join("/") || "/";
@@ -116,12 +374,13 @@ async function scanPages(pagesDir) {
 		return cached;
 	};
 	return Promise.all(pages.map(async (file) => {
+		const server = SERVER_PAGE_RE.test(basename(file));
 		const pattern = fileToPattern(pagesDir, file);
 		const layouts = chainForFile(pagesDir, file, allSet, "+layout");
 		const errors = chainForFile(pagesDir, file, allSet, "+error");
 		const [pageExports, ...layoutExports] = await Promise.all([detectLoaderExports(file), ...layouts.map(getLayoutExports)]);
 		const loaderLayouts = layouts.filter((_, i) => layoutExports[i].load);
-		const clientLoaderLayouts = layouts.filter((_, i) => layoutExports[i].clientLoad);
+		const clientLoaderLayouts = layouts.filter((_, i) => layoutExports[i].isClientLoader);
 		return {
 			file,
 			pattern,
@@ -130,8 +389,9 @@ async function scanPages(pagesDir) {
 			errors,
 			hasLoader: pageExports.load,
 			loaderLayouts,
-			hasClientLoader: pageExports.clientLoad,
-			clientLoaderLayouts
+			hasClientLoader: pageExports.isClientLoader,
+			clientLoaderLayouts,
+			server
 		};
 	}));
 }
@@ -144,6 +404,12 @@ function validateEntries(entries, pagesDir, strict) {
 	const seenNames = /* @__PURE__ */ new Map();
 	const problems = [];
 	for (const entry of entries) {
+		if (entry.server) try {
+			if (!loadServerModuleScan(entry.file).islands.some((island) => island.name === "default")) throw new Error(`[ilha:pages] Server page ${entry.file} has no default island export.\n  A .server page must "export default ilha…" so it can be rendered server-side.`);
+		} catch (err) {
+			if (err instanceof Error && err.message.includes("[ilha:pages]")) throw err;
+			throw new Error(`[ilha:pages] Server page ${entry.file} could not be scanned for island exports.`);
+		}
 		const existingPattern = seenPatterns.get(entry.pattern);
 		if (existingPattern) problems.push(`Duplicate route pattern "${entry.pattern}"\n  first:  ${existingPattern}\n  second: ${entry.file}\n  The first match wins — the second page will never be reached.`);
 		else seenPatterns.set(entry.pattern, entry.file);
@@ -206,6 +472,7 @@ function buildServerFile(entries, serverFile) {
 		`// Import via: import { pageRouter, registry } from "ilha:pages/server";`,
 		``,
 		...imports,
+		...entries.some((e) => e.hasLoader || e.loaderLayouts.length > 0) ? [`import { setFrameLoaderRunner } from "@ilha/router/server-island-registry";`, `setFrameLoaderRunner((path) => pageRouter.runLoader(path));`] : [],
 		``,
 		...wrappedIslandLines,
 		``,
@@ -232,6 +499,22 @@ function buildClientFile(entries, clientFile, opts) {
 	const registryLines = [];
 	const routeLines = [];
 	for (const [i, entry] of entries.entries()) {
+		if (entry.server) {
+			imports.push(`import { default as _page${i} } from ${JSON.stringify(serverIslandVirtualSpec(entry.file))};`);
+			for (const [j, l] of entry.layouts.entries()) imports.push(`import { default as _layout${i}_${j} } from ${JSON.stringify(clientImport(l))};`);
+			for (const [j, e] of entry.errors.entries()) imports.push(`import { default as _error${i}_${j} } from ${JSON.stringify(clientImport(e))};`);
+			let serverExpr = `_page${i}`;
+			for (let j = entry.errors.length - 1; j >= 0; j--) serverExpr = `wrapError(_error${i}_${j}, ${serverExpr})`;
+			for (let j = entry.layouts.length - 1; j >= 0; j--) serverExpr = `wrapLayout(_layout${i}_${j}, ${serverExpr})`;
+			const wrappedServerId = `_wrapped${i}`;
+			wrappedIslandLines.push(`const ${wrappedServerId} = ${serverExpr};`);
+			registryLines.push(`  ${JSON.stringify(entry.name)}: ${wrappedServerId}` + (i < entries.length - 1 ? "," : ""));
+			if (!isStatic) {
+				routeLines.push(`  .route(${JSON.stringify(entry.pattern)}, ${wrappedServerId})`);
+				if (entry.errors.length > 0) routeLines.push(`  .errorBoundary(${JSON.stringify(entry.pattern)}, _error${i}_${entry.errors.length - 1})`);
+			}
+			continue;
+		}
 		imports.push(`import { default as _page${i} } from ${JSON.stringify(clientImport(entry.file))};`);
 		for (const [j, l] of entry.layouts.entries()) imports.push(`import { default as _layout${i}_${j} } from ${JSON.stringify(clientImport(l))};`);
 		for (const [j, e] of entry.errors.entries()) imports.push(`import { default as _error${i}_${j} } from ${JSON.stringify(clientImport(e))};`);
@@ -246,12 +529,12 @@ function buildClientFile(entries, clientFile, opts) {
 			const clientLoaderIds = [];
 			for (const [j, layout] of entry.clientLoaderLayouts.entries()) {
 				const id = `_cl${i}_l${j}`;
-				imports.push(`import { clientLoad as ${id} } from ${JSON.stringify(clientLoaderImport(layout))};`);
+				imports.push(`import { load as ${id} } from ${JSON.stringify(clientLoaderImport(layout))};`);
 				clientLoaderIds.push(id);
 			}
 			if (entry.hasClientLoader) {
 				const id = `_cl${i}`;
-				imports.push(`import { clientLoad as ${id} } from ${JSON.stringify(clientLoaderImport(entry.file))};`);
+				imports.push(`import { load as ${id} } from ${JSON.stringify(clientLoaderImport(entry.file))};`);
 				clientLoaderIds.push(id);
 			}
 			if (clientLoaderIds.length > 0) {
@@ -375,8 +658,38 @@ const RESOLVED_VIRTUAL_IDS = [
 ];
 /** Query suffix used on page/layout imports in the client file. */
 const CLIENT_QUERY = "?client";
-/** Query suffix that re-exports a page/layout's `clientLoad` for the browser bundle. */
+/** Query suffix that re-exports a page/layout's `load` (loader.client) for the browser bundle. */
 const CLIENT_LOADER_QUERY = "?client-loader";
+function decodeServerIslandId(id) {
+	if (!id.startsWith("\0ilha:server-island:")) return null;
+	try {
+		return Buffer.from(id.slice(SERVER_ISLAND_PREFIX.length), "base64url").toString();
+	} catch {
+		return null;
+	}
+}
+const SERVER_FILE_RE = /\.server\.(ts|tsx|js|jsx)$/;
+/** Cheap prefilter — most modules never mention a server import. Extension
+* optional: aliases like `$lib/tasks.server` resolve to `.server.tsx` later. */
+const SERVER_SPEC_HINT_RE = /["'][^"']*\.server(\.[cm]?[jt]sx?)?["']/;
+/** mtime-keyed scan cache so repeated transforms don't re-read/re-parse. */
+const scanCache = /* @__PURE__ */ new Map();
+function scanFor(path) {
+	try {
+		const mtimeMs = statSync(path).mtimeMs;
+		const cached = scanCache.get(path);
+		if (cached && cached.mtimeMs === mtimeMs) return cached.scan;
+		const scan = loadServerModuleScan(path);
+		if (scan.islands.length === 0) return null;
+		scanCache.set(path, {
+			mtimeMs,
+			scan
+		});
+		return scan;
+	} catch {
+		return null;
+	}
+}
 /** Read & parse a package.json, returning null on any error. */
 function readJson(path) {
 	try {
@@ -515,7 +828,7 @@ function loadPagesModule(state, id) {
 	}
 	if (id.endsWith("?client-loader")) {
 		const bare = id.slice(0, -14);
-		return `export { clientLoad } from ${JSON.stringify(bare)};`;
+		return `export { load } from ${JSON.stringify(bare)};`;
 	}
 	if (id.endsWith("?client")) {
 		const bare = id.slice(0, -7);
@@ -558,6 +871,7 @@ function setupRspackPagesWatcher(state, structuralInvalidate) {
 }
 const pagesFactory = (options = {}) => {
 	const state = createPagesPluginState(options);
+	const serverIslands = /* @__PURE__ */ new Map();
 	return {
 		name: "ilha:pages",
 		async buildStart() {
@@ -569,9 +883,19 @@ const pagesFactory = (options = {}) => {
 			await regenFromPagesChange(state, file, (f) => state.shouldRegenOnChange(f));
 		},
 		resolveId(id, importer) {
+			if (id.startsWith("\0ilha:server-island:")) return id;
 			return resolvePagesId(state, id, importer);
 		},
 		load(id) {
+			const islandFile = decodeServerIslandId(id);
+			if (islandFile !== null) {
+				const scan = loadServerModuleScan(islandFile);
+				for (const island of scan.islands) serverIslands.set(serverIslandPublicId(islandFile, island.name), {
+					file: islandFile,
+					name: island.name
+				});
+				return generateServerIslandModule(islandFile, scan);
+			}
 			return loadPagesModule(state, id);
 		},
 		vite: {
@@ -584,7 +908,7 @@ const pagesFactory = (options = {}) => {
 					...detectIlhaConsumers(userConfig.root ? resolve(userConfig.root) : process.cwd())
 				];
 				const existingNoExternal = userConfig.ssr?.noExternal;
-				const noExternal = existingNoExternal === true ? true : [.../* @__PURE__ */ new Set([...Array.isArray(existingNoExternal) ? existingNoExternal : existingNoExternal != null ? [existingNoExternal] : [], ...singletonPeers])];
+				const noExternal = existingNoExternal === true ? true : [.../* @__PURE__ */ new Set([...Array.isArray(existingNoExternal) ? existingNoExternal : existingNoExternal == null ? [] : [existingNoExternal], ...singletonPeers])];
 				return {
 					resolve: { dedupe: [.../* @__PURE__ */ new Set([...userConfig.resolve?.dedupe ?? [], ...singletonPeers])] },
 					ssr: { noExternal },
@@ -604,8 +928,165 @@ const pagesFactory = (options = {}) => {
 			configResolved(config) {
 				state.setPaths(config.root);
 			},
+			async transform(code, id, opts) {
+				const file = id.replace(/\?.*$/, "");
+				const serverFile = SERVER_FILE_RE.test(file);
+				if (opts?.ssr) {
+					if (!serverFile) return null;
+					const scan = scanFor(file);
+					const lines = [];
+					for (const ref of scan?.clientRefs ?? []) lines.push(`if (${ref.local}?.[Symbol.for("ilha.island")]) ${ref.local}[Symbol.for("ilha.clientRef")] = ${JSON.stringify(ref.id)};`);
+					if (scan && scan.islands.length > 0 && !code.startsWith("// oxidejs:client-stub")) {
+						lines.unshift(`import * as __ilhaSelf from ${JSON.stringify(file)};`);
+						lines.unshift(`import { registerServerIsland } from "@ilha/router/server-island-registry";`);
+						for (const island of scan.islands) {
+							const id2 = serverIslandPublicId(file, island.name);
+							const isServerPage = SERVER_PAGE_RE.test(file) && state.isUnderPagesDir(file) && scan.exports.includes("load") ? `, { load: __ilhaSelf.load, pattern: ${JSON.stringify(fileToPattern(state.pagesDir, file))} }` : "";
+							lines.push(`registerServerIsland(${JSON.stringify(id2)}, () => __ilhaSelf[${JSON.stringify(island.name)}]?.[Symbol.for("ilha.renderState")]${isServerPage});`);
+						}
+					}
+					if (lines.length === 0) return null;
+					return `${code}\n${lines.join("\n")}`;
+				}
+				if (id.startsWith("\0") || id.includes("node_modules")) return null;
+				if (serverFile) return null;
+				if (!SERVER_SPEC_HINT_RE.test(code)) return null;
+				const SPEC_RE = /(?:^|\n)\s*import\s+(?:type\s+)?[^'"\n]+?\s*from\s*["']([^"']+)["']/g;
+				const specs = /* @__PURE__ */ new Set();
+				for (const match of code.matchAll(SPEC_RE)) specs.add(match[1]);
+				if (specs.size === 0) return null;
+				const scanned = /* @__PURE__ */ new Map();
+				for (const spec of specs) {
+					let file;
+					try {
+						const resolved = await this.resolve?.(spec, id);
+						file = resolved?.path ?? resolved?.id;
+					} catch {
+						file = void 0;
+					}
+					if (!file && spec.startsWith("/")) file = spec;
+					if (!file || !SERVER_FILE_RE.test(file.replace(/\?.*$/, ""))) continue;
+					const scan = scanFor(file);
+					if (!scan) continue;
+					scanned.set(spec, {
+						file,
+						islands: new Set(scan.islands.filter((i) => i.name !== "default").map((i) => i.name)),
+						hasDefault: scan.islands.some((i) => i.name === "default")
+					});
+				}
+				if (scanned.size === 0) return null;
+				return splitServerImports(code, {
+					islandNamesFor: (spec) => {
+						const entry = scanned.get(spec);
+						return entry ? {
+							islands: entry.islands,
+							hasDefault: entry.hasDefault
+						} : null;
+					},
+					virtualSpecFor: (spec) => serverIslandVirtualSpec(scanned.get(spec).file)
+				});
+			},
 			configureServer(server) {
 				server.watcher.add(state.pagesDir);
+				if (options.frameGuard) setFrameGuard(options.frameGuard);
+				server.middlewares.use(async (req, res, next) => {
+					if ((req.url ?? "").split("?")[0] !== "/__ilha/frame") return next();
+					if (req.method !== "POST") {
+						res.statusCode = 405;
+						res.end();
+						return;
+					}
+					if (!(req.headers["content-type"] ?? "").startsWith("application/json")) {
+						res.statusCode = 415;
+						res.end();
+						return;
+					}
+					try {
+						const guardHeaders = new Headers();
+						for (const name of [
+							"cookie",
+							"authorization",
+							"x-forwarded-for"
+						]) {
+							const v = req.headers[name];
+							if (typeof v === "string") guardHeaders.set(name, v);
+						}
+						const denied = await getFrameGuard()?.(new Request(`http://${req.headers.host ?? "localhost"}${req.url ?? "/"}`, {
+							method: req.method,
+							headers: guardHeaders
+						}));
+						if (denied) {
+							res.statusCode = denied.status;
+							res.setHeader("cache-control", "no-store");
+							res.end();
+							return;
+						}
+					} catch {
+						res.statusCode = 403;
+						res.end();
+						return;
+					}
+					const origin = req.headers.origin;
+					const host = req.headers.host;
+					if (origin && origin !== `http://${host}` && origin !== `https://${host}`) {
+						res.statusCode = 403;
+						res.end();
+						return;
+					}
+					const chunks = [];
+					let size = 0;
+					for await (const chunk of req) {
+						size += chunk.length;
+						if (size > 16384) {
+							res.statusCode = 413;
+							res.end();
+							return;
+						}
+						chunks.push(chunk);
+					}
+					try {
+						const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+						const target = serverIslands.get(body.id ?? "");
+						if (!target) throw new Error("unknown island");
+						let framePath = "/__ilha/frame";
+						if (typeof body.path === "string" && body.path.startsWith("/") && !body.path.includes("//") && body.path.length <= 2048) framePath = body.path;
+						await server.ssrLoadModule(VIRTUAL_PAGES_SERVER);
+						if (typeof (await server.ssrLoadModule(target.file))[target.name]?.[Symbol.for("ilha.renderState")] !== "function") throw new Error("unknown island");
+						const headers = new Headers();
+						for (const name of [
+							"cookie",
+							"authorization",
+							"user-agent",
+							"x-forwarded-for"
+						]) {
+							const value = req.headers[name];
+							if (typeof value === "string") headers.set(name, value);
+						}
+						const requestOrigin = `http://${req.headers.host ?? "localhost"}`;
+						const request = new Request(new URL(framePath, requestOrigin), {
+							method: "POST",
+							headers
+						});
+						const html = await renderServerIsland(body.id ?? "", request, (r, fn) => runWithIslandRequest(r, fn));
+						res.setHeader("cache-control", "no-store");
+						res.setHeader("content-type", "application/json;charset=utf-8");
+						res.end(JSON.stringify({ html: String(html) }));
+					} catch (err) {
+						if (err instanceof FrameError && err.redirect) {
+							res.statusCode = err.status;
+							res.setHeader("cache-control", "no-store");
+							res.setHeader("content-type", "application/json;charset=utf-8");
+							res.end(JSON.stringify({ redirect: err.redirect }));
+							return;
+						}
+						const status = err instanceof FrameError ? err.status : 400;
+						if (!(err instanceof FrameError) || err.status >= 500) console.error("[ilha-router] frame render failed:", err);
+						res.statusCode = status;
+						res.setHeader("cache-control", "no-store");
+						res.setHeader("content-type", "application/json;charset=utf-8");
+						res.end(JSON.stringify({ error: "frame failed" }));
+					}
+				});
 				const structuralInvalidate = createStructuralInvalidate(state, async () => {
 					for (const id of RESOLVED_VIRTUAL_IDS) {
 						const mod = server.moduleGraph.getModuleById(id);
@@ -618,6 +1099,20 @@ const pagesFactory = (options = {}) => {
 				server.watcher.on("unlink", structuralInvalidate);
 				server.watcher.on("change", async (file) => {
 					if (state.shouldRegenOnChange(file)) await structuralInvalidate(file);
+					if (!SERVER_FILE_RE.test(file.replace(/\?.*$/, ""))) return;
+					scanCache.delete(file);
+					const graph = server.moduleGraph;
+					let touched = false;
+					graph.forEachModule?.((mod) => {
+						if (mod.id.startsWith("\0ilha:server-island:")) {
+							const m = server.moduleGraph.getModuleById(mod.id);
+							if (m) {
+								server.moduleGraph.invalidateModule(m);
+								touched = true;
+							}
+						}
+					});
+					if (touched) server.hot.send({ type: "full-reload" });
 				});
 			}
 		},