@jasonshimmy/vite-plugin-cer-app 0.20.3 → 0.20.5

package/dist/runtime/entry-server-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entry-server-template.d.ts","sourceRoot":"","sources":["../../src/runtime/entry-server-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,kzrBAybjC,CAAA"}
+{"version":3,"file":"entry-server-template.d.ts","sourceRoot":"","sources":["../../src/runtime/entry-server-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB,wzuBA8cjC,CAAA"}

package/dist/runtime/entry-server-template.js

@@ -214,8 +214,10 @@ function _mergeWithClientTemplate(ssrHtml, clientTemplate) {
 
 // Per-request async setup: initialize a fresh router, resolve the matched
 // route and layout, pre-load the page module, and call the data loader.
-// Loader data is scoped to the current AsyncLocalStorage context via enterWith()
-// so concurrent renders never share state.
+// Loader data is returned so the handler can scope it to _cerDataStore.run()
+// during rendering. (AsyncLocalStorage.enterWith() inside an awaited child
+// function does not propagate back to the parent continuation, so run() is
+// the only reliable approach.)
 const _prepareRequest = async (req) => {
   await _pluginsReady
   const router = initRouter({ routes, initialUrl: req.url ?? '/' })
@@ -236,6 +238,9 @@ const _prepareRequest = async (req) => {
   // and breaks Declarative Shadow DOM on initial parse).
   let pageVnode = { tag: 'div', props: {}, children: [] }
   let head
+  // Loader data to pass to usePageData() during rendering. Declared here
+  // (outside try/catch) so it's visible in all return paths.
+  let loaderData = null
   if (route?.load) {
     try {
       const mod = await route.load()
@@ -262,9 +267,11 @@ const _prepareRequest = async (req) => {
         const query = current.query ?? {}
         const data = await mod.loader({ params, query, req })
         if (data !== undefined && data !== null) {
-          // enterWith() scopes the value to the current async context so
-          // concurrent renders (SSG concurrency > 1) never share data.
-          _cerDataStore.enterWith(data)
+          // Store loader data so the handler can pass it to _cerDataStore.run()
+          // below. Using enterWith() here doesn't work because it only modifies
+          // the async context *inside* this awaited function, not the outer
+          // handler's continuation where renderToStreamWithJITCSSDSD runs.
+          loaderData = data
           head = \`<script>window.__CER_DATA__ = \${JSON.stringify(data)}</script>\`
           // Expose primitive loader values as element attributes so useProps()
           // can read them.  Complex objects are only accessible via usePageData().
@@ -311,7 +318,7 @@ const _prepareRequest = async (req) => {
   // If the request matched a catch-all route (user-defined 404.ts or [...all].ts),
   // return HTTP 404 so browsers and crawlers treat it as a not-found response.
   const isCatchAll = route?.path === '/:all*'
-  return { vnode, router, head, status: isCatchAll ? 404 : null }
+  return { vnode, router, head, status: isCatchAll ? 404 : null, loaderData }
 }
 
 export const handler = async (req, res) => {
@@ -332,10 +339,17 @@ export const handler = async (req, res) => {
     try { _authUser = await useSession({ name: _authSessionKey }).get() } catch { /* no session secret */ }
   }
   await _cerAuthStore.run(_authUser, async () => {
-    const { vnode, router, head, status } = await _prepareRequest(req)
+    const { vnode, router, head, status, loaderData } = await _prepareRequest(req)
     if (status != null) res.statusCode = status
 
     let _headCollectionOpen = false
+    // Wrap the entire render pass in _cerDataStore.run(loaderData) so that
+    // usePageData() inside component renderFn calls sees the correct store
+    // value. AsyncLocalStorage.enterWith() inside _prepareRequest does NOT
+    // propagate back to this outer async continuation — it only affects the
+    // async chain inside _prepareRequest itself. Using run() here is the only
+    // reliable way to scope the data store to the synchronous render pass.
+    await _cerDataStore.run(loaderData ?? null, async () => {
     try {
       // Begin collecting useHead() calls made during the synchronous render pass.
       // IMPORTANT: the stream's start() function runs synchronously on construction,
@@ -394,8 +408,14 @@ export const handler = async (req, res) => {
       // (loader data script, useHead() tags, JIT styles). No polyfill in body yet.
       const ssrHtml = \`<!DOCTYPE html><html><head>\${headContent}</head><body>\${firstChunk}</body></html>\`
 
-      const merged = _clientTemplate
-        ? _mergeWithClientTemplate(ssrHtml, _clientTemplate)
+      // In dev mode the module-level _clientTemplate is null (only the
+      // production dist/client/index.html path is searched at init time).
+      // The dev server sets (globalThis).__CER_CLIENT_TEMPLATE__ per-request
+      // after running server.transformIndexHtml so the Vite client scripts
+      // (/@vite/client, HMR) are included in every SSR response.
+      const _resolvedClientTemplate = (globalThis).__CER_CLIENT_TEMPLATE__ ?? _clientTemplate
+      const merged = _resolvedClientTemplate
+        ? _mergeWithClientTemplate(ssrHtml, _resolvedClientTemplate)
         : ssrHtml
 
       // Split at </body> so async swap scripts and the DSD polyfill can be streamed
@@ -439,6 +459,7 @@ export const handler = async (req, res) => {
         try { void _hooks.onResponse({ path: _requestPath, method: req.method ?? 'GET', statusCode: res.statusCode, duration: Date.now() - _requestStart, req }) } catch { /* ignore */ }
       }
     }
+    }) // _cerDataStore.run(loaderData)
   })  // _cerAuthStore.run
   })  // _cerFetchStore.run
   })  // _cerDataStore.run

package/dist/runtime/entry-server-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"entry-server-template.js","sourceRoot":"","sources":["../../src/runtime/entry-server-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAybpC,CAAA"}
+{"version":3,"file":"entry-server-template.js","sourceRoot":"","sources":["../../src/runtime/entry-server-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8cpC,CAAA"}

package/e2e/cypress/e2e/group-meta.cy.ts

@@ -25,8 +25,11 @@ describe('Group meta from _layout.ts (P2-1)', () => {
 
   context('layout inheritance', () => {
     it('pages in a group directory use the layout declared in _layout.ts', () => {
-      cy.visit('/group-meta-test/page')
-      // The group layout wraps the page
+      // Use the page that overrides the blocking group middleware so this
+      // assertion isolates layout inheritance from the redirect behavior.
+      cy.visit('/group-meta-test/custom-mw')
+      cy.get('[data-cy=custom-mw-marker]', { timeout: 5000 }).should('exist')
+      // The group layout still wraps the page.
       cy.get('[data-cy=group-layout]', { timeout: 5000 }).should('exist')
     })
   })

package/e2e/cypress/e2e/preview-hardening.cy.ts

@@ -5,33 +5,40 @@
  * Security headers and Cache-Control are server-level concerns, so these
  * tests only run in SSR and SSG modes (both use `cer-app preview`).
  * SPA mode also runs through the preview server, so the tests apply there too.
+ * Dev mode uses the Vite dev server which does not set these headers.
  */
 
-describe('Preview server — security headers', () => {
-  it('responds with X-Content-Type-Options: nosniff', () => {
-    cy.request('/').then((response) => {
-      expect(response.headers['x-content-type-options']).to.eq('nosniff')
+const mode = Cypress.env('mode') as 'spa' | 'ssr' | 'ssg' | 'dev'
+
+// Security headers and Cache-Control are only set by the production preview server.
+// Skip these tests in dev mode (Vite dev server does not set them).
+if (mode !== 'dev') {
+  describe('Preview server — security headers', () => {
+    it('responds with X-Content-Type-Options: nosniff', () => {
+      cy.request('/').then((response) => {
+        expect(response.headers['x-content-type-options']).to.eq('nosniff')
+      })
     })
-  })
 
-  it('responds with X-Frame-Options: DENY', () => {
-    cy.request('/').then((response) => {
-      expect(response.headers['x-frame-options']).to.eq('DENY')
+    it('responds with X-Frame-Options: DENY', () => {
+      cy.request('/').then((response) => {
+        expect(response.headers['x-frame-options']).to.eq('DENY')
+      })
     })
-  })
 
-  it('responds with Referrer-Policy: strict-origin-when-cross-origin', () => {
-    cy.request('/').then((response) => {
-      expect(response.headers['referrer-policy']).to.eq('strict-origin-when-cross-origin')
+    it('responds with Referrer-Policy: strict-origin-when-cross-origin', () => {
+      cy.request('/').then((response) => {
+        expect(response.headers['referrer-policy']).to.eq('strict-origin-when-cross-origin')
+      })
     })
-  })
 
-  it('includes security headers on 404 responses', () => {
-    cy.request({ url: '/definitely-not-a-real-page-xyz', failOnStatusCode: false }).then((response) => {
-      expect(response.headers['x-content-type-options']).to.eq('nosniff')
+    it('includes security headers on 404 responses', () => {
+      cy.request({ url: '/definitely-not-a-real-page-xyz', failOnStatusCode: false }).then((response) => {
+        expect(response.headers['x-content-type-options']).to.eq('nosniff')
+      })
     })
   })
-})
+}
 
 describe('Preview server — path traversal protection', () => {
   // HTTP clients (including Cypress/got) normalize `..` segments before sending,
@@ -55,25 +62,27 @@ describe('Preview server — path traversal protection', () => {
   // src/__tests__/cli/preview-isr.test.ts. No additional e2e assertion is needed.
 })
 
-describe('Preview server — Cache-Control', () => {
-  it('serves HTML with Cache-Control: no-cache', () => {
-    cy.request('/').then((response) => {
-      expect(response.headers['cache-control']).to.include('no-cache')
+if (mode !== 'dev') {
+  describe('Preview server — Cache-Control', () => {
+    it('serves HTML with Cache-Control: no-cache', () => {
+      cy.request('/').then((response) => {
+        expect(response.headers['cache-control']).to.include('no-cache')
+      })
     })
-  })
 
-  it('serves content-hashed assets with immutable Cache-Control', () => {
-    // Get the page to discover an actual asset URL (Vite hashes asset filenames)
-    cy.request('/').then((htmlResponse) => {
-      const assetMatch = htmlResponse.body.match(/\/assets\/[^"'\s]+\.js/)
-      if (!assetMatch) return  // no JS asset found in this page, skip
+    it('serves content-hashed assets with immutable Cache-Control', () => {
+      // Get the page to discover an actual asset URL (Vite hashes asset filenames)
+      cy.request('/').then((htmlResponse) => {
+        const assetMatch = htmlResponse.body.match(/\/assets\/[^"'\s]+\.js/)
+        if (!assetMatch) return  // no JS asset found in this page, skip
 
-      const assetUrl = assetMatch[0]
-      cy.request(assetUrl).then((assetResponse) => {
-        const cc = assetResponse.headers['cache-control'] as string
-        expect(cc).to.include('max-age=31536000')
-        expect(cc).to.include('immutable')
+        const assetUrl = assetMatch[0]
+        cy.request(assetUrl).then((assetResponse) => {
+          const cc = assetResponse.headers['cache-control'] as string
+          expect(cc).to.include('max-age=31536000')
+          expect(cc).to.include('immutable')
+        })
       })
     })
   })
-})
+}

package/e2e/cypress/e2e/use-page-data.cy.ts

@@ -0,0 +1,122 @@
+/**
+ * usePageData() timing regression tests — proves the queueMicrotask fix.
+ *
+ * Background:
+ *   _doHydrate() runs _loadPageForPath (sets __CER_DATA__) then _replace(),
+ *   which causes cer-layout-view to create a NEW page element via a queued
+ *   microtask. That new element's setup() calls usePageData() to read __CER_DATA__.
+ *
+ *   Pre-fix:  delete __CER_DATA__ was synchronous → ran before the queued render
+ *             → usePageData() saw undefined → returned null.
+ *   Post-fix: queueMicrotask(() => delete __CER_DATA__) → delete is queued AFTER
+ *             the render microtask → usePageData() reads the data correctly.
+ *
+ * Proof mechanism:
+ *   Each blog page component captures `ssrData ? 'ssr' : 'client'` once, at the
+ *   moment the element is created during hydration. In SSR/SSG/dev modes this
+ *   value must always be 'ssr'. If it is 'client' the timing bug has regressed.
+ */
+
+export {}
+
+const mode = Cypress.env('mode') as 'spa' | 'ssr' | 'ssg' | 'dev'
+
+// ─── Blog list — hard refresh ─────────────────────────────────────────────
+
+describe('usePageData() — blog list hard refresh', () => {
+  if (mode !== 'spa') {
+    it('server response embeds __CER_DATA__ with both post titles', () => {
+      cy.request('/blog').then((res) => {
+        expect(res.body).to.include('__CER_DATA__')
+        expect(res.body).to.include('First Post')
+        expect(res.body).to.include('Second Post')
+      })
+    })
+
+    it('usePageData() is non-null during hydration re-render (data-source = "ssr")', () => {
+      cy.visit('/blog')
+      // Scope to the live shadow DOM (not the DSD pre-render copy) so the assertion
+      // targets the element created during hydration where usePageData() was called.
+      // 'ssr' proves queueMicrotask deferred the delete until after the render ran.
+      cy.get('cer-layout-view').shadow().find('page-blog').shadow()
+        .find('[data-cy=blog-data-source]').should('have.text', 'ssr')
+    })
+  }
+
+  // In SSR and dev modes the /api/posts route exists on the server.
+  // If usePageData() is non-null, the blog page's useOnConnected guard
+  // (`if (ssrData) return`) skips the fetch entirely.
+  if (mode === 'ssr' || mode === 'dev') {
+    it('no /api/posts network request is made — usePageData() skips client fetch', () => {
+      cy.intercept('GET', '/api/posts').as('apiFetch')
+      cy.visit('/blog')
+      // Wait for the page component to fully hydrate before asserting no requests.
+      cy.get('cer-layout-view').shadow().find('page-blog').shadow()
+        .find('[data-cy=blog-list]').should('exist')
+      cy.get('@apiFetch.all').should('have.length', 0)
+    })
+  }
+
+  it('blog posts are visible after hydration (all modes)', () => {
+    cy.visit('/blog')
+    cy.get('[data-cy=blog-item]', { timeout: 8000 }).should('have.length.at.least', 2)
+  })
+})
+
+// ─── Blog detail — hard refresh ───────────────────────────────────────────
+
+describe('usePageData() — blog detail hard refresh', () => {
+  if (mode !== 'spa') {
+    it('server response embeds __CER_DATA__ with post detail', () => {
+      cy.request('/blog/first-post').then((res) => {
+        expect(res.body).to.include('__CER_DATA__')
+        expect(res.body).to.include('First Post')
+      })
+    })
+
+    it('usePageData() is non-null during hydration re-render on detail page', () => {
+      cy.visit('/blog/first-post')
+      cy.get('cer-layout-view').shadow().find('page-blog-slug').shadow()
+        .find('[data-cy=blog-detail-data-source]').should('have.text', 'ssr')
+    })
+  }
+
+  if (mode === 'ssr' || mode === 'dev') {
+    it('no /api/posts/:slug network request is made — usePageData() skips client fetch', () => {
+      cy.intercept('GET', '/api/posts/*').as('apiPostDetail')
+      cy.visit('/blog/first-post')
+      cy.get('cer-layout-view').shadow().find('page-blog-slug').shadow()
+        .find('[data-cy=post-title]').should('exist')
+      cy.get('@apiPostDetail.all').should('have.length', 0)
+    })
+  }
+
+  it('"First Post" title renders on hard refresh (all modes)', () => {
+    cy.visit('/blog/first-post')
+    cy.get('[data-cy=post-title]', { timeout: 8000 }).should('contain', 'First Post')
+  })
+
+  it('"Second Post" title renders on hard refresh (all modes)', () => {
+    cy.visit('/blog/second-post')
+    cy.get('[data-cy=post-title]', { timeout: 8000 }).should('contain', 'Second Post')
+  })
+})
+
+// ─── Client-side navigation (post-hydration data loading) ─────────────────
+
+describe('usePageData() — client-side navigation', () => {
+  it('navigating to blog from home shows posts', () => {
+    cy.visit('/')
+    cy.get('[data-cy=page-nav]').find('a[href="/blog"]').first().click({ force: true })
+    cy.get('[data-cy=blog-item]', { timeout: 8000 }).should('have.length.at.least', 2)
+  })
+
+  it('navigating between blog posts loads correct data each time', () => {
+    cy.visit('/blog/first-post')
+    cy.get('[data-cy=post-title]', { timeout: 8000 }).should('contain', 'First Post')
+    cy.get('[data-cy=post-back]').first().click({ force: true })
+    cy.url().should('include', '/blog')
+    cy.get('[data-cy=blog-link-second-post]', { timeout: 8000 }).first().click({ force: true })
+    cy.get('[data-cy=post-title]', { timeout: 8000 }).should('contain', 'Second Post')
+  })
+})

package/e2e/kitchen-sink/app/pages/blog/[slug].ts

@@ -7,6 +7,9 @@ interface Post {
 component('page-blog-slug', () => {
   const props = useProps<{ slug: string }>({ slug: '' })
   const ssrData = usePageData<Post>()
+  // Captured once at element-creation time (during the hydration re-render).
+  // 'ssr' proves usePageData() was non-null — the queueMicrotask timing fix works.
+  const dataSource = ssrData ? 'ssr' : 'client'
 
   const title = ref(ssrData?.title ?? '')
   const body = ref(ssrData?.body ?? '')
@@ -29,6 +32,7 @@ component('page-blog-slug', () => {
 
   return html`
     <div>
+      <span data-cy="blog-detail-data-source" hidden>${dataSource}</span>
       <h1 data-cy="post-title">${title.value || props.slug}</h1>
       <p data-cy="post-slug"><em>slug: <code>${props.slug}</code></em></p>
       <div data-cy="post-body">${body.value}</div>

package/e2e/kitchen-sink/app/pages/blog/index.ts

@@ -9,6 +9,10 @@ component('page-blog', () => {
 
   const ssrData = usePageData<{ posts: Post[] }>()
   const posts = ref<Post[]>(ssrData?.posts ?? [])
+  // Captured once at element-creation time (during the hydration re-render).
+  // 'ssr' proves usePageData() was non-null — the queueMicrotask timing fix works.
+  // 'client' means __CER_DATA__ was deleted before setup ran (regression).
+  const dataSource = ssrData ? 'ssr' : 'client'
 
   useOnConnected(async () => {
     if (ssrData) return  // already hydrated — skip client fetch
@@ -28,6 +32,7 @@ component('page-blog', () => {
     <div>
       <h1 data-cy="blog-heading">Blog</h1>
       <p>Posts are loaded via a page <strong>loader</strong> (SSR/SSG) or client-side fetch (SPA).</p>
+      <span data-cy="blog-data-source" hidden>${dataSource}</span>
       <ul data-cy="blog-list">
         ${posts.value.map(post => html`
           <li data-cy="blog-item">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jasonshimmy/vite-plugin-cer-app",
-  "version": "0.20.3",
+  "version": "0.20.5",
   "description": "Nuxt-style meta-framework for @jasonshimmy/custom-elements-runtime",
   "type": "module",
   "keywords": [
@@ -72,13 +72,16 @@
     "e2e:serve:spa": "node dist/cli/index.js preview --root e2e/kitchen-sink --port 4174",
     "e2e:serve:ssr": "node dist/cli/index.js preview --root e2e/kitchen-sink --port 4175 --ssr",
     "e2e:serve:ssg": "node dist/cli/index.js preview --root e2e/kitchen-sink --port 4176",
+    "e2e:serve:dev": "node dist/cli/index.js dev --root e2e/kitchen-sink --port 4177 --mode ssr",
     "e2e:run:spa": "cypress run --config baseUrl=http://localhost:4174 --env mode=spa",
     "e2e:run:ssr": "cypress run --config baseUrl=http://localhost:4175 --env mode=ssr",
     "e2e:run:ssg": "cypress run --config baseUrl=http://localhost:4176 --env mode=ssg",
+    "e2e:run:dev": "cypress run --config baseUrl=http://localhost:4177 --env mode=dev",
     "e2e:spa": "npm run e2e:build:spa && start-server-and-test e2e:serve:spa http://localhost:4174 e2e:run:spa",
     "e2e:ssr": "npm run e2e:build:ssr && start-server-and-test e2e:serve:ssr http://localhost:4175 e2e:run:ssr",
     "e2e:ssg": "npm run e2e:build:ssg && start-server-and-test e2e:serve:ssg http://localhost:4176 e2e:run:ssg",
-    "e2e": "npm run e2e:ssr && npm run e2e:ssg && npm run e2e:spa",
+    "e2e:dev": "npm run e2e:clean && start-server-and-test e2e:serve:dev http://localhost:4177 e2e:run:dev",
+    "e2e": "npm run e2e:ssr && npm run e2e:ssg && npm run e2e:spa && npm run e2e:dev",
     "cypress:open": "cypress open"
   },
   "peerDependencies": {

package/src/__tests__/plugin/build-ssg.test.ts

@@ -137,8 +137,8 @@ describe('buildSSG — path collection', () => {
   it('calls fg when pagesDir exists and no explicit routes', async () => {
     vi.mocked(existsSync).mockReturnValue(true)
     await buildSSG(makeConfig())
-    // fg is called once for page discovery and once by loadContentStore (content scan)
-    expect(fg).toHaveBeenCalledTimes(2)
+    // fg is called once for page discovery
+    expect(fg).toHaveBeenCalledTimes(1)
   })
 
   it('skips Vite dev server when all discovered pages are static', async () => {

package/src/__tests__/plugin/content/loader.test.ts

@@ -79,38 +79,37 @@ describe('resolveContentDir', () => {
 
 describe('loadContentStore — nonexistent dir', () => {
   it('returns empty array when contentDir does not exist', async () => {
-    const items = await loadContentStore('/path/does/not/exist', false, false)
+    const items = await loadContentStore('/path/does/not/exist', false)
     expect(items).toEqual([])
   })
 })
 
-describe('loadContentStore — dev mode (isProduction=false)', () => {
-  it('loads all files including drafts', async () => {
-    const items = await loadContentStore(contentDir, false, false)
+describe('loadContentStore — drafts excluded by default (includeDrafts=false)', () => {
+  it('loads all non-draft files', async () => {
+    const items = await loadContentStore(contentDir, false)
     const paths = items.map((i) => i._path).sort()
-    // Root, about, blog/hello, blog/secret, data/products
+    // Root, about, blog/hello (not secret — it is a draft), data/products
     expect(paths).toContain('/')
     expect(paths).toContain('/about')
     expect(paths).toContain('/blog/hello')
-    expect(paths).toContain('/blog/secret')
+    expect(paths).not.toContain('/blog/secret')
     expect(paths).toContain('/data/products')
   })
 
-  it('includes draft items', async () => {
-    const items = await loadContentStore(contentDir, false, false)
+  it('excludes draft items', async () => {
+    const items = await loadContentStore(contentDir, false)
     const secret = items.find((i) => i._path === '/blog/secret')
-    expect(secret).toBeDefined()
-    expect(secret?.draft).toBe(true)
+    expect(secret).toBeUndefined()
   })
 
   it('strips date prefix from slug', async () => {
-    const items = await loadContentStore(contentDir, false, false)
+    const items = await loadContentStore(contentDir, false)
     expect(items.find((i) => i._path === '/blog/hello')).toBeDefined()
     expect(items.find((i) => i._path === '/blog/2026-04-03-hello')).toBeUndefined()
   })
 
   it('each item has required ContentItem fields', async () => {
-    const items = await loadContentStore(contentDir, false, false)
+    const items = await loadContentStore(contentDir, false)
     for (const item of items) {
       expect(typeof item._path).toBe('string')
       expect(typeof item._file).toBe('string')
@@ -121,7 +120,7 @@ describe('loadContentStore — dev mode (isProduction=false)', () => {
   })
 
   it('normalises date fields to strings (not Date objects)', async () => {
-    const items = await loadContentStore(contentDir, false, false)
+    const items = await loadContentStore(contentDir, false)
     const about = items.find((i) => i._path === '/about')
     expect(about).toBeDefined()
     expect(typeof about?.date).toBe('string')
@@ -129,31 +128,24 @@ describe('loadContentStore — dev mode (isProduction=false)', () => {
   })
 })
 
-describe('loadContentStore — production mode (isProduction=true, isDraft=false)', () => {
-  it('excludes draft items', async () => {
-    const items = await loadContentStore(contentDir, false, true)
+describe('loadContentStore — drafts included (includeDrafts=true)', () => {
+  it('includes draft items when includeDrafts=true', async () => {
+    const items = await loadContentStore(contentDir, true)
     const secret = items.find((i) => i._path === '/blog/secret')
-    expect(secret).toBeUndefined()
+    expect(secret).toBeDefined()
+    expect(secret?.draft).toBe(true)
   })
 
   it('includes non-draft items', async () => {
-    const items = await loadContentStore(contentDir, false, true)
+    const items = await loadContentStore(contentDir, true)
     expect(items.find((i) => i._path === '/blog/hello')).toBeDefined()
     expect(items.find((i) => i._path === '/about')).toBeDefined()
   })
 })
 
-describe('loadContentStore — production mode with drafts enabled (isDraft=true)', () => {
-  it('includes draft items when isDraft=true in production', async () => {
-    const items = await loadContentStore(contentDir, true, true)
-    const secret = items.find((i) => i._path === '/blog/secret')
-    expect(secret).toBeDefined()
-  })
-})
-
 describe('loadContentStore — JSON files', () => {
   it('includes JSON files with _type json', async () => {
-    const items = await loadContentStore(contentDir, false, false)
+    const items = await loadContentStore(contentDir, false)
     const products = items.find((i) => i._path === '/data/products')
     expect(products).toBeDefined()
     expect(products?._type).toBe('json')

package/src/__tests__/plugin/entry-server-template.test.ts

@@ -62,8 +62,13 @@ describe('entry-server-template (ENTRY_SERVER_TEMPLATE content)', () => {
     expect(src).toContain('_cerDataStore.run(')
   })
 
-  it('uses _cerDataStore.enterWith() to scope loader data', () => {
-    expect(src).toContain('_cerDataStore.enterWith(data)')
+  it('scopes loader data in _cerDataStore.run(loaderData) for rendering', () => {
+    // enterWith() does not propagate across await boundaries to a parent
+    // async continuation; run() is used instead so usePageData() in
+    // renderToStreamWithJITCSSDSD sees the correct store value.
+    expect(src).toContain('_cerDataStore.run(loaderData')
+    expect(src).toContain('loaderData = data')
+    expect(src).not.toContain('_cerDataStore.enterWith(data)')
   })
 
   it('initializes plugins and sets globalThis.__cerPluginProvides', () => {
@@ -117,7 +122,10 @@ describe('entry-server-template (ENTRY_SERVER_TEMPLATE content)', () => {
   })
 
   it('merges SSR html with client template when available', () => {
-    expect(src).toContain('_mergeWithClientTemplate(ssrHtml, _clientTemplate)')
+    // Dev mode: per-request global takes precedence over module-level _clientTemplate
+    expect(src).toContain('_resolvedClientTemplate')
+    expect(src).toContain('(globalThis).__CER_CLIENT_TEMPLATE__ ?? _clientTemplate')
+    expect(src).toContain('_mergeWithClientTemplate(ssrHtml, _resolvedClientTemplate)')
   })
 
   it('exports handler as both named and default export', () => {

package/src/__tests__/plugin/virtual/routes.test.ts

@@ -738,6 +738,32 @@ describe('generateRoutesCode — synthetic 404 catch-all (P1-1)', () => {
   })
 })
 
+// ─── hydration middleware replay skip ───────────────────────────────────────
+
+describe('generateRoutesCode — hydration middleware replay skip', () => {
+  beforeEach(() => {
+    vi.mocked(existsSync).mockReturnValue(true)
+    vi.mocked(scanDirectory).mockResolvedValue([])
+    vi.mocked(readFile).mockResolvedValue('' as never)
+  })
+
+  it('emits a one-shot hydration replay skip before importing middleware', async () => {
+    vi.mocked(scanDirectory).mockResolvedValue([`${PAGES}/dashboard.ts`])
+    vi.mocked(readFile).mockResolvedValue(
+      `export const meta = { middleware: ['auth'] }` as never,
+    )
+    const code = await generateRoutesCode(PAGES)
+    expect(code).toContain(`const _hydrationEntry = (globalThis).__CER_HYDRATION_ENTRY__`)
+    expect(code).toContain(`from.path === to.path`)
+    expect(code).toContain(`_hydrationEntry.path === to.path`)
+    expect(code).toContain(`delete (globalThis).__CER_HYDRATION_ENTRY__`)
+    const hydrationIdx = code.indexOf(`const _hydrationEntry = (globalThis).__CER_HYDRATION_ENTRY__`)
+    const importIdx = code.indexOf(`const { middleware } = await import('virtual:cer-middleware')`)
+    expect(hydrationIdx).toBeGreaterThanOrEqual(0)
+    expect(importIdx).toBeGreaterThan(hydrationIdx)
+  })
+})
+
 // ─── P2-1: _layout.ts group meta inheritance ─────────────────────────────────
 
 describe('generateRoutesCode — group meta from _layout.ts (P2-1)', () => {