@pracht/core 0.2.6 → 0.3.0

package/dist/index.mjs

@@ -1,7 +1,252 @@
-import { a as matchApiRoute, c as resolveApp, i as group, l as route, n as buildPathFromSegments, o as matchAppRoute, r as defineApp, s as resolveApiRoutes, u as timeRevalidate } from "./app-CUL3q2ZA.mjs";
 import { createContext, h, hydrate, options, render } from "preact";
 import { useContext, useEffect, useMemo, useState } from "preact/hooks";
 import { Suspense, lazy } from "preact-suspense";
+//#region src/app.ts
+function timeRevalidate(seconds) {
+	if (!Number.isInteger(seconds) || seconds <= 0) throw new Error("timeRevalidate expects a positive integer number of seconds.");
+	return {
+		kind: "time",
+		seconds
+	};
+}
+function route(path, fileOrConfig, meta = {}) {
+	if (typeof fileOrConfig === "string" || typeof fileOrConfig === "function") return {
+		kind: "route",
+		path: normalizeRoutePath(path),
+		file: resolveModuleRef(fileOrConfig),
+		...meta
+	};
+	const { component, loader, ...routeMeta } = fileOrConfig;
+	return {
+		kind: "route",
+		path: normalizeRoutePath(path),
+		file: resolveModuleRef(component),
+		loaderFile: resolveModuleRef(loader),
+		...routeMeta
+	};
+}
+function resolveModuleRef(ref) {
+	if (ref === void 0) return void 0;
+	if (typeof ref === "string") return ref;
+	return "";
+}
+function group(meta, routes) {
+	return {
+		kind: "group",
+		meta,
+		routes
+	};
+}
+function defineApp(config) {
+	return {
+		shells: resolveModuleRefRecord(config.shells ?? {}),
+		middleware: resolveModuleRefRecord(config.middleware ?? {}),
+		api: config.api ?? {},
+		routes: config.routes
+	};
+}
+function resolveModuleRefRecord(record) {
+	const result = {};
+	for (const [key, value] of Object.entries(record)) result[key] = resolveModuleRef(value);
+	return result;
+}
+function resolveApp(app) {
+	const routes = [];
+	const inherited = {
+		pathPrefix: "/",
+		middleware: []
+	};
+	for (const node of app.routes) flattenRouteNode(app, node, inherited, routes);
+	return {
+		shells: app.shells,
+		middleware: app.middleware,
+		api: app.api,
+		routes,
+		apiRoutes: []
+	};
+}
+function matchAppRoute(app, pathname) {
+	const resolved = isResolvedApp(app) ? app : resolveApp(app);
+	const normalizedPathname = normalizeRoutePath(pathname);
+	const targetSegments = splitPathSegments(normalizedPathname);
+	for (const currentRoute of resolved.routes) {
+		const params = matchRouteSegments(currentRoute.segments, targetSegments);
+		if (params) return {
+			route: currentRoute,
+			params,
+			pathname: normalizedPathname
+		};
+	}
+}
+function flattenRouteNode(app, node, inherited, routes) {
+	if (node.kind === "group") {
+		const nextInherited = {
+			pathPrefix: mergeRoutePaths(inherited.pathPrefix, node.meta.pathPrefix),
+			shell: node.meta.shell ?? inherited.shell,
+			render: node.meta.render ?? inherited.render,
+			middleware: [...inherited.middleware, ...node.meta.middleware ?? []]
+		};
+		for (const child of node.routes) flattenRouteNode(app, child, nextInherited, routes);
+		return;
+	}
+	const fullPath = mergeRoutePaths(inherited.pathPrefix, node.path);
+	const shell = node.shell ?? inherited.shell;
+	const middleware = [...inherited.middleware, ...node.middleware ?? []];
+	routes.push({
+		id: node.id ?? createRouteId(fullPath),
+		path: fullPath,
+		file: node.file,
+		loaderFile: node.loaderFile,
+		shell,
+		shellFile: shell ? app.shells[shell] : void 0,
+		render: node.render ?? inherited.render,
+		middleware,
+		middlewareFiles: middleware.flatMap((name) => {
+			const middlewareFile = app.middleware[name];
+			return middlewareFile ? [middlewareFile] : [];
+		}),
+		revalidate: node.revalidate,
+		segments: parseRouteSegments(fullPath)
+	});
+}
+function isResolvedApp(app) {
+	return app.routes.length === 0 || "segments" in app.routes[0];
+}
+function matchRouteSegments(routeSegments, targetSegments) {
+	const params = {};
+	let routeIndex = 0;
+	let targetIndex = 0;
+	while (routeIndex < routeSegments.length) {
+		const currentSegment = routeSegments[routeIndex];
+		if (currentSegment.type === "catchall") {
+			params[currentSegment.name] = targetSegments.slice(targetIndex).join("/");
+			return params;
+		}
+		const targetSegment = targetSegments[targetIndex];
+		if (typeof targetSegment === "undefined") return null;
+		if (currentSegment.type === "static") {
+			if (currentSegment.value !== targetSegment) return null;
+		} else try {
+			params[currentSegment.name] = decodeURIComponent(targetSegment);
+		} catch {
+			return null;
+		}
+		routeIndex += 1;
+		targetIndex += 1;
+	}
+	return targetIndex === targetSegments.length ? params : null;
+}
+function parseRouteSegments(path) {
+	return splitPathSegments(path).map((segment) => {
+		if (segment === "*") return {
+			type: "catchall",
+			name: "*"
+		};
+		if (segment.startsWith(":")) return {
+			type: "param",
+			name: segment.slice(1)
+		};
+		return {
+			type: "static",
+			value: segment
+		};
+	});
+}
+function splitPathSegments(path) {
+	return normalizeRoutePath(path).split("/").filter(Boolean);
+}
+function mergeRoutePaths(prefix, path) {
+	if (!path) return normalizeRoutePath(prefix);
+	const normalizedPrefix = normalizeRoutePath(prefix);
+	const normalizedPath = normalizeRoutePath(path);
+	if (normalizedPrefix === "/") return normalizedPath;
+	if (normalizedPath === "/") return normalizedPrefix;
+	return normalizeRoutePath(`${normalizedPrefix}/${normalizedPath.slice(1)}`);
+}
+function normalizeRoutePath(path) {
+	if (!path || path === "/") return "/";
+	const collapsed = (path.startsWith("/") ? path : `/${path}`).replace(/\/{2,}/g, "/");
+	return collapsed.length > 1 && collapsed.endsWith("/") ? collapsed.slice(0, -1) : collapsed;
+}
+function buildPathFromSegments(segments, params) {
+	return normalizeRoutePath("/" + segments.map((segment) => {
+		if (segment.type === "static") return segment.value;
+		if (segment.type === "param") return encodeURIComponent(params[segment.name] ?? "");
+		return (params["*"] ?? "").split("/").map((part) => encodeCatchAllSegment(part)).join("/");
+	}).join("/"));
+}
+/**
+* Encode a single path segment for a catch-all route. `encodeURIComponent`
+* leaves unreserved characters (including `.`) intact, so `..` would
+* round-trip unchanged and still resolve as parent-dir in `path.join`.
+* Explicitly percent-encode `.` / `..` segments to neutralise them.
+*/
+function encodeCatchAllSegment(part) {
+	if (part === ".") return "%2E";
+	if (part === "..") return "%2E%2E";
+	return encodeURIComponent(part);
+}
+/**
+* Convert a list of file paths from `import.meta.glob` into resolved API routes.
+*
+* Example: `"/src/api/health.ts"` → path `/api/health`
+*          `"/src/api/users/[id].ts"` → path `/api/users/:id`
+*          `"/src/api/index.ts"` → path `/api`
+*/
+function resolveApiRoutes(files, apiDir = "/src/api") {
+	const normalizedDir = apiDir.replace(/\/$/, "");
+	return files.map((file) => {
+		let relative = file;
+		if (relative.startsWith(normalizedDir)) relative = relative.slice(normalizedDir.length);
+		relative = relative.replace(/\.(ts|tsx|js|jsx)$/, "");
+		if (relative.endsWith("/index")) relative = relative.slice(0, -6) || "/";
+		relative = relative.replace(/\[([^\]]+)\]/g, ":$1");
+		const path = normalizeRoutePath(`/api${relative}`);
+		return {
+			path,
+			file,
+			segments: parseRouteSegments(path)
+		};
+	}).sort(compareResolvedApiRoutes);
+}
+function matchApiRoute(apiRoutes, pathname) {
+	const normalizedPathname = normalizeRoutePath(pathname);
+	const targetSegments = splitPathSegments(normalizedPathname);
+	for (const route of apiRoutes) {
+		const params = matchRouteSegments(route.segments, targetSegments);
+		if (params) return {
+			route,
+			params,
+			pathname: normalizedPathname
+		};
+	}
+}
+function createRouteId(path) {
+	if (path === "/") return "index";
+	return path.slice(1).split("/").map((segment) => {
+		if (segment === "*") return "splat";
+		return segment.startsWith(":") ? segment.slice(1) : segment;
+	}).join("-").replace(/[^a-zA-Z0-9-]/g, "-");
+}
+function compareResolvedApiRoutes(left, right) {
+	const length = Math.max(left.segments.length, right.segments.length);
+	for (let index = 0; index < length; index += 1) {
+		const leftSegment = left.segments[index];
+		const rightSegment = right.segments[index];
+		if (!leftSegment) return 1;
+		if (!rightSegment) return -1;
+		const leftScore = getRouteSegmentSpecificity(leftSegment);
+		const rightScore = getRouteSegmentSpecificity(rightSegment);
+		if (leftScore !== rightScore) return rightScore - leftScore;
+	}
+	return left.path.localeCompare(right.path);
+}
+function getRouteSegmentSpecificity(segment) {
+	if (segment.type === "static") return 3;
+	if (segment.type === "param") return 2;
+	return 1;
+}
+//#endregion
 //#region src/forwardRef.ts
 let oldDiffHook = options.__b;
 options.__b = (vnode) => {
@@ -75,356 +320,418 @@ function useIsHydrated() {
 	return hydrated;
 }
 //#endregion
-//#region src/runtime.ts
+//#region src/runtime-constants.ts
 const SAFE_METHODS = new Set(["GET", "HEAD"]);
 const HYDRATION_STATE_ELEMENT_ID = "pracht-state";
 const ROUTE_STATE_REQUEST_HEADER = "x-pracht-route-state-request";
 const ROUTE_STATE_CACHE_CONTROL = "no-store";
-let _renderToStringAsync;
-async function getRenderToStringAsync() {
-	if (_renderToStringAsync) return _renderToStringAsync;
-	_renderToStringAsync = (await import("preact-render-to-string")).renderToStringAsync;
-	return _renderToStringAsync;
-}
-const RouteDataContext = createContext(void 0);
-function PrachtRuntimeProvider({ children, data, params = {}, routeId, url }) {
-	const [routeData, setRouteData] = useState(data);
-	useEffect(() => {
-		setRouteData(data);
-	}, [
-		data,
-		routeId,
-		url
-	]);
-	const context = useMemo(() => ({
-		data: routeData,
-		params,
-		routeId,
-		setData: setRouteData,
-		url
-	}), [
-		routeData,
-		params,
-		routeId,
-		url
-	]);
-	return h(RouteDataContext.Provider, {
-		value: context,
-		children
-	});
-}
-function startApp(options = {}) {
-	if (typeof window === "undefined") return options.initialData;
-	if (typeof options.initialData !== "undefined") return options.initialData;
-	return readHydrationState()?.data;
+const EMPTY_ROUTE_PARAMS = {};
+//#endregion
+//#region src/runtime-errors.ts
+function isPrachtHttpError(error) {
+	return error instanceof Error && error.name === "PrachtHttpError" && "status" in error;
 }
-function readHydrationState() {
-	if (typeof window === "undefined") return;
-	if (window.__PRACHT_STATE__) return window.__PRACHT_STATE__;
-	const element = document.getElementById(HYDRATION_STATE_ELEMENT_ID);
-	if (!(element instanceof HTMLScriptElement)) return;
-	const raw = element.textContent;
-	if (!raw) return;
-	try {
-		const state = JSON.parse(raw);
-		window.__PRACHT_STATE__ = state;
-		return state;
-	} catch {
-		return;
+let warnedAboutProductionDebugErrors = false;
+/**
+* `debugErrors: true` opts into surfacing stack traces, module paths,
+* and middleware names in error responses. That is great in dev and
+* dangerous in production — a misconfigured deploy would leak internals
+* to the public. When `NODE_ENV === "production"` we refuse to honor
+* the flag and emit a single console warning so the misconfiguration
+* is visible in logs.
+*/
+function shouldExposeServerErrors(options) {
+	if (options.debugErrors !== true) return false;
+	if ((typeof process !== "undefined" && process.env ? process.env.NODE_ENV : typeof globalThis !== "undefined" && globalThis.process ? globalThis.process?.env?.NODE_ENV : void 0) === "production") {
+		if (!warnedAboutProductionDebugErrors) {
+			warnedAboutProductionDebugErrors = true;
+			console.warn("[pracht] debugErrors is ignored in production builds. Remove it to silence this warning.");
+		}
+		return false;
 	}
+	return true;
 }
-function useRouteData() {
-	return useContext(RouteDataContext)?.data;
-}
-function useLocation() {
-	return parseLocation(useContext(RouteDataContext)?.url ?? (typeof window !== "undefined" ? window.location.pathname + window.location.search : "/"));
-}
-function useParams() {
-	return useContext(RouteDataContext)?.params ?? {};
-}
-function useRevalidate() {
-	const runtime = useContext(RouteDataContext);
-	return async () => {
-		if (typeof window === "undefined") return;
-		const result = await fetchPrachtRouteState(runtime?.url || window.location.pathname + window.location.search);
-		if (result.type === "redirect") {
-			await navigateToClientLocation(result.location);
-			return;
-		}
-		if (result.type === "error") throw deserializeRouteError$1(result.error);
-		runtime?.setData(result.data);
-		return result.data;
+function createSerializedRouteError(message, status, options = {}) {
+	return {
+		message,
+		name: options.name ?? "Error",
+		status,
+		...options.diagnostics ? { diagnostics: options.diagnostics } : {}
 	};
 }
-/** @deprecated Use useRevalidate instead. */
-const useRevalidateRoute = useRevalidate;
-function Form(props) {
-	const { onSubmit, method, ...rest } = props;
-	return h("form", {
-		...rest,
-		method,
-		onSubmit: async (event) => {
-			onSubmit?.(event);
-			if (event.defaultPrevented) return;
-			const form = event.currentTarget;
-			if (!(form instanceof HTMLFormElement)) return;
-			const formMethod = (method ?? form.method ?? "post").toUpperCase();
-			if (SAFE_METHODS.has(formMethod)) return;
-			event.preventDefault();
-			const response = await fetch(props.action ?? form.action, {
-				method: formMethod,
-				body: new FormData(form),
-				redirect: "manual"
-			});
-			if (response.type === "opaqueredirect" || response.status >= 300 && response.status < 400) {
-				const location = response.headers.get("location");
-				if (location) {
-					await navigateToClientLocation(location);
-					return;
-				}
-				window.location.href = props.action ?? form.action;
-			}
-		}
-	});
-}
-async function fetchPrachtRouteState(url) {
-	const response = await fetch(url, {
-		headers: {
-			[ROUTE_STATE_REQUEST_HEADER]: "1",
-			"Cache-Control": "no-cache"
-		},
-		redirect: "manual"
-	});
-	if (response.type === "opaqueredirect" || response.status >= 300 && response.status < 400) return {
-		location: response.headers.get("location") ?? url,
-		type: "redirect"
-	};
-	const json = await response.json();
-	if (json.redirect) return {
-		location: json.redirect,
-		type: "redirect"
+function buildRuntimeDiagnostics(options) {
+	const route = options.route;
+	const routeId = route && "id" in route ? route.id : void 0;
+	return {
+		phase: options.phase,
+		routeId,
+		routePath: route?.path,
+		routeFile: route?.file,
+		loaderFile: options.loaderFile,
+		shellFile: options.shellFile,
+		middlewareFiles: options.middlewareFiles ? [...options.middlewareFiles] : [],
+		status: options.status
 	};
-	if (!response.ok) {
-		if (json.error) return {
-			error: json.error,
-			type: "error"
+}
+function normalizeRouteError(error, options) {
+	if (isPrachtHttpError(error)) {
+		const status = typeof error.status === "number" ? error.status : 500;
+		if (status >= 400 && status < 500) return {
+			message: error.message,
+			name: error.name,
+			status
+		};
+		if (options.exposeDetails) return {
+			message: error.message || "Internal Server Error",
+			name: error.name || "Error",
+			status
+		};
+		return {
+			message: "Internal Server Error",
+			name: "Error",
+			status
+		};
+	}
+	if (error instanceof Error) {
+		if (options.exposeDetails) return {
+			message: error.message || "Internal Server Error",
+			name: error.name || "Error",
+			status: 500
+		};
+		return {
+			message: "Internal Server Error",
+			name: "Error",
+			status: 500
 		};
-		throw new Error(`Failed to fetch route state (${response.status})`);
 	}
+	if (options.exposeDetails) return {
+		message: typeof error === "string" && error ? error : "Internal Server Error",
+		name: "Error",
+		status: 500
+	};
 	return {
-		data: json.data,
-		type: "data"
+		message: "Internal Server Error",
+		name: "Error",
+		status: 500
 	};
 }
-async function handlePrachtRequest(options) {
-	const url = new URL(options.request.url);
-	const requestPath = getRequestPath(url);
-	const registry = options.registry ?? {};
-	const isRouteStateRequest = options.request.headers.get(ROUTE_STATE_REQUEST_HEADER) === "1";
-	const exposeDiagnostics = shouldExposeServerErrors(options);
-	if (options.apiRoutes?.length) {
-		const apiMatch = matchApiRoute(options.apiRoutes, url.pathname);
-		if (apiMatch) {
-			const apiMiddlewareFiles = (options.app.api.middleware ?? []).flatMap((name) => {
-				const middlewareFile = options.app.middleware[name];
-				return middlewareFile ? [middlewareFile] : [];
-			});
-			let currentPhase = "middleware";
-			try {
-				const middlewareResult = await runMiddlewareChain({
-					context: options.context ?? {},
-					middlewareFiles: apiMiddlewareFiles,
-					params: apiMatch.params,
-					registry,
-					request: options.request,
-					route: apiMatch.route,
-					url
-				});
-				if (middlewareResult.response) return middlewareResult.response;
-				currentPhase = "api";
-				const apiModule = await resolveRegistryModule(registry.apiModules, apiMatch.route.file);
-				if (!apiModule) throw new Error("API route module not found");
-				const handler = apiModule[options.request.method.toUpperCase()] ?? apiModule.default;
-				if (!handler) return withDefaultSecurityHeaders(new Response("Method not allowed", {
-					status: 405,
-					headers: { "content-type": "text/plain; charset=utf-8" }
-				}));
-				return withDefaultSecurityHeaders(await handler({
-					request: options.request,
-					params: apiMatch.params,
-					context: middlewareResult.context,
-					signal: AbortSignal.timeout(3e4),
-					url,
-					route: apiMatch.route
-				}));
-			} catch (error) {
-				return renderApiErrorResponse({
-					error,
-					middlewareFiles: apiMiddlewareFiles,
-					options,
-					phase: currentPhase,
-					route: apiMatch.route
-				});
-			}
-		}
+function deserializeRouteError(error) {
+	const result = new Error(error.message);
+	result.name = error.name;
+	result.status = error.status;
+	result.diagnostics = error.diagnostics;
+	return result;
+}
+//#endregion
+//#region src/runtime-headers.ts
+const HEADER_CRLF_RE = /[\r\n]/;
+/**
+* Reject header values containing CR/LF. Some runtimes (Node `undici`
+* Headers) throw on their own, but Web-runtime fetch implementations
+* vary, and a user-supplied `headers()` value is never trusted input.
+* Keeping the check here means response-splitting can't slip through on
+* any adapter.
+*/
+function assertSafeHeaderValue(name, value) {
+	if (HEADER_CRLF_RE.test(value)) throw new Error(`Refused to set header "${name}": value contains CR or LF`);
+}
+function applyHeaders(headers, init) {
+	for (const [key, value] of iterateHeaderInit(init)) assertSafeHeaderValue(key, value);
+	new Headers(init).forEach((value, key) => {
+		headers.set(key, value);
+	});
+}
+function* iterateHeaderInit(init) {
+	if (init instanceof Headers) {
+		for (const entry of init.entries()) yield entry;
+		return;
 	}
-	const match = matchAppRoute(options.app, url.pathname);
-	if (!match) {
-		if (isRouteStateRequest) return jsonErrorResponse(createSerializedRouteError("Not found", 404, {
-			diagnostics: exposeDiagnostics ? buildRuntimeDiagnostics({
-				phase: "match",
-				status: 404
-			}) : void 0,
-			name: "Error"
-		}), { isRouteStateRequest: true });
-		return withDefaultSecurityHeaders(new Response("Not found", {
-			status: 404,
-			headers: { "content-type": "text/plain; charset=utf-8" }
-		}));
+	if (Array.isArray(init)) {
+		for (const entry of init) if (entry && entry.length >= 2) yield [entry[0], entry[1]];
+		return;
 	}
-	if (!SAFE_METHODS.has(options.request.method)) {
-		if (isRouteStateRequest) return jsonErrorResponse(createSerializedRouteError("Method not allowed", 405, {
-			diagnostics: exposeDiagnostics ? buildRuntimeDiagnostics({
-				middlewareFiles: match.route.middlewareFiles,
-				phase: "action",
-				route: match.route,
-				shellFile: match.route.shellFile,
-				status: 405
-			}) : void 0,
-			name: "Error"
-		}), { isRouteStateRequest: true });
-		return withRouteResponseHeaders(new Response("Method not allowed", {
-			status: 405,
-			headers: { "content-type": "text/plain; charset=utf-8" }
-		}), { isRouteStateRequest });
+	for (const [key, value] of Object.entries(init)) yield [key, value];
+}
+function applyDefaultSecurityHeaders(headers) {
+	if (!headers.has("permissions-policy")) headers.set("permissions-policy", "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()");
+	if (!headers.has("referrer-policy")) headers.set("referrer-policy", "strict-origin-when-cross-origin");
+	if (!headers.has("x-content-type-options")) headers.set("x-content-type-options", "nosniff");
+	if (!headers.has("x-frame-options")) headers.set("x-frame-options", "SAMEORIGIN");
+	return headers;
+}
+function applySecurityAndRouteHeaders(headers, options) {
+	applyDefaultSecurityHeaders(headers);
+	if (options) {
+		appendVaryHeader(headers, ROUTE_STATE_REQUEST_HEADER);
+		if (options.isRouteStateRequest && !headers.has("cache-control")) headers.set("cache-control", ROUTE_STATE_CACHE_CONTROL);
 	}
-	let routeArgs = {
-		request: options.request,
-		params: match.params,
-		context: options.context ?? {},
-		signal: AbortSignal.timeout(3e4),
-		url,
-		route: match.route
-	};
-	let routeModule;
-	let shellModule;
-	let loaderFile;
-	let currentPhase = "middleware";
-	try {
-		const middlewareResult = await runMiddlewareChain({
-			context: routeArgs.context,
-			middlewareFiles: match.route.middlewareFiles,
-			params: match.params,
-			registry,
-			request: options.request,
-			route: match.route,
-			url
-		});
-		if (middlewareResult.response) return normalizePageResponse(middlewareResult.response, { isRouteStateRequest });
-		routeArgs = {
-			...routeArgs,
-			context: middlewareResult.context
-		};
-		currentPhase = "render";
-		routeModule = await resolveRegistryModule(registry.routeModules, match.route.file);
-		if (!routeModule) throw new Error("Route module not found");
-		currentPhase = "loader";
-		const { loader, loaderFile: resolvedLoaderFile } = await resolveDataFunctions(match.route, routeModule, registry);
-		loaderFile = resolvedLoaderFile;
-		const loaderResult = loader ? await loader(routeArgs) : void 0;
-		if (loaderResult instanceof Response) return normalizePageResponse(loaderResult, { isRouteStateRequest });
-		const data = loaderResult;
-		if (isRouteStateRequest) return withRouteResponseHeaders(Response.json({ data }), { isRouteStateRequest: true });
-		currentPhase = "render";
-		shellModule = match.route.shellFile ? await resolveRegistryModule(registry.shellModules, match.route.shellFile) : void 0;
-		const head = await mergeHeadMetadata(shellModule, routeModule, routeArgs, data);
-		const documentHeaders = await mergeDocumentHeaders(shellModule, routeModule, routeArgs, data);
-		const cssUrls = resolvePageCssUrls(options, match.route.shellFile, match.route.file);
-		const modulePreloadUrls = resolvePageJsUrls(options, match.route.shellFile, match.route.file);
-		if (match.route.render === "spa") {
-			let body = "";
-			if (shellModule?.Shell || shellModule?.Loading) {
-				const Shell = shellModule?.Shell;
-				const Loading = shellModule?.Loading;
-				const loadingTree = Shell != null ? h(Shell, null, Loading ? h(Loading, null) : null) : Loading ? h(Loading, null) : null;
-				if (loadingTree) body = await (await getRenderToStringAsync())(loadingTree);
-			}
-			return htmlResponse(buildHtmlDocument({
-				head,
-				body,
-				hydrationState: {
-					url: requestPath,
-					routeId: match.route.id ?? "",
-					data: null,
-					error: null,
-					pending: true
-				},
-				clientEntryUrl: options.clientEntryUrl,
-				cssUrls,
-				modulePreloadUrls
-			}), 200, documentHeaders);
-		}
-		const DefaultComponent = typeof routeModule.default === "function" ? routeModule.default : void 0;
-		const Component = routeModule.Component ?? DefaultComponent;
-		if (!Component) throw new Error("Route has no Component or default export");
-		const Shell = shellModule?.Shell;
-		const componentProps = {
-			data,
-			params: match.params
-		};
-		const componentTree = Shell ? h(Shell, null, h(Component, componentProps)) : h(Component, componentProps);
-		const tree = h(PrachtRuntimeProvider, {
-			data,
-			params: match.params,
-			routeId: match.route.id ?? "",
-			url: requestPath
-		}, componentTree);
-		return htmlResponse(buildHtmlDocument({
-			head,
-			body: await (await getRenderToStringAsync())(tree),
-			hydrationState: {
-				url: requestPath,
-				routeId: match.route.id ?? "",
-				data,
-				error: null
-			},
-			clientEntryUrl: options.clientEntryUrl,
-			cssUrls,
-			modulePreloadUrls
-		}), 200, documentHeaders);
-	} catch (error) {
-		return renderRouteErrorResponse({
-			error,
-			isRouteStateRequest,
-			loaderFile,
-			options,
-			phase: currentPhase,
-			routeArgs,
-			routeId: match.route.id ?? "",
-			routeModule,
-			shellFile: match.route.shellFile,
-			shellModule,
-			requestPath
-		});
+	return headers;
+}
+function withDefaultSecurityHeaders(response) {
+	const headers = new Headers(response.headers);
+	applySecurityAndRouteHeaders(headers);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+function withRouteResponseHeaders(response, options) {
+	const headers = new Headers(response.headers);
+	applySecurityAndRouteHeaders(headers, options);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+function appendVaryHeader(headers, value) {
+	const current = headers.get("vary");
+	if (!current) {
+		headers.set("vary", value);
+		return;
 	}
+	const values = current.split(",").map((part) => part.trim().toLowerCase()).filter(Boolean);
+	if (values.includes("*") || values.includes(value.toLowerCase())) return;
+	headers.set("vary", `${current}, ${value}`);
 }
-function parseLocation(value) {
+//#endregion
+//#region src/runtime-client-fetch.ts
+const SAFE_NAVIGATION_PROTOCOLS = new Set(["http:", "https:"]);
+/**
+* Parse a possibly-server-supplied redirect target against a base URL and
+* return it only if it uses a safe navigation scheme (`http:` or `https:`).
+*
+* `javascript:`, `data:`, `vbscript:`, `blob:`, `file:` and similar schemes
+* can execute script or bypass same-origin assumptions when assigned to
+* `window.location.href` — a server-controlled redirect (from a loader,
+* middleware, form action response, or API route) must never be able to
+* trigger them. Returns `null` for unsafe or unparseable inputs.
+*/
+function parseSafeNavigationUrl(location, base) {
+	let targetUrl;
 	try {
-		const url = new URL(value, "http://pracht.local");
-		return {
-			pathname: url.pathname,
-			search: url.search
-		};
+		targetUrl = new URL(location, base);
 	} catch {
-		return {
-			pathname: value || "/",
-			search: ""
+		return null;
+	}
+	if (!SAFE_NAVIGATION_PROTOCOLS.has(targetUrl.protocol)) return null;
+	return targetUrl;
+}
+function buildRouteStateUrl(url) {
+	return `${url}${url.includes("?") ? "&" : "?"}_data=1`;
+}
+async function fetchPrachtRouteState(url, options) {
+	const fetchUrl = options?.useDataParam ? buildRouteStateUrl(url) : url;
+	const response = await fetch(fetchUrl, {
+		headers: options?.useDataParam ? {} : {
+			[ROUTE_STATE_REQUEST_HEADER]: "1",
+			"Cache-Control": "no-cache"
+		},
+		redirect: "manual"
+	});
+	if (response.type === "opaqueredirect" || response.status >= 300 && response.status < 400) return {
+		location: response.headers.get("location") ?? url,
+		type: "redirect"
+	};
+	const json = await response.json();
+	if (json.redirect) return {
+		location: json.redirect,
+		type: "redirect"
+	};
+	if (!response.ok) {
+		if (json.error) return {
+			error: json.error,
+			type: "error"
 		};
+		throw new Error(`Failed to fetch route state (${response.status})`);
 	}
+	return {
+		data: json.data,
+		type: "data"
+	};
 }
-function getRequestPath(url) {
-	return `${url.pathname}${url.search}`;
+async function navigateToClientLocation(location, options) {
+	if (typeof window === "undefined") return;
+	const targetUrl = parseSafeNavigationUrl(location, window.location.href);
+	if (!targetUrl) {
+		console.error(`[pracht] refused to navigate to unsafe URL: ${location}`);
+		return;
+	}
+	const target = targetUrl.pathname + targetUrl.search + targetUrl.hash;
+	if (targetUrl.origin === window.location.origin && window.__PRACHT_NAVIGATE__) {
+		await window.__PRACHT_NAVIGATE__(target, options);
+		return;
+	}
+	if (options?.replace) {
+		window.location.replace(targetUrl.toString());
+		return;
+	}
+	window.location.href = targetUrl.toString();
 }
+//#endregion
+//#region src/runtime-hooks.ts
+const RouteDataContext = createContext(void 0);
+function PrachtRuntimeProvider({ children, data, params = EMPTY_ROUTE_PARAMS, routeId, stateVersion = 0, url }) {
+	const [routeDataState, setRouteDataState] = useState({
+		data,
+		stateVersion
+	});
+	const routeData = routeDataState.stateVersion === stateVersion ? routeDataState.data : data;
+	useEffect(() => {
+		setRouteDataState({
+			data,
+			stateVersion
+		});
+	}, [
+		data,
+		routeId,
+		stateVersion,
+		url
+	]);
+	const context = useMemo(() => ({
+		data: routeData,
+		params,
+		routeId,
+		setData: (nextData) => setRouteDataState({
+			data: nextData,
+			stateVersion
+		}),
+		url
+	}), [
+		routeData,
+		params,
+		routeId,
+		stateVersion,
+		url
+	]);
+	return h(RouteDataContext.Provider, {
+		value: context,
+		children
+	});
+}
+function startApp(options = {}) {
+	if (typeof window === "undefined") return options.initialData;
+	if (typeof options.initialData !== "undefined") return options.initialData;
+	return readHydrationState()?.data;
+}
+function readHydrationState() {
+	if (typeof window === "undefined") return;
+	if (window.__PRACHT_STATE__) return window.__PRACHT_STATE__;
+	const element = document.getElementById(HYDRATION_STATE_ELEMENT_ID);
+	if (!(element instanceof HTMLScriptElement)) return;
+	const raw = element.textContent;
+	if (!raw) return;
+	const state = JSON.parse(raw);
+	window.__PRACHT_STATE__ = state;
+	return state;
+}
+function useRouteData() {
+	return useContext(RouteDataContext)?.data;
+}
+function useLocation() {
+	return parseLocation(useContext(RouteDataContext)?.url ?? (typeof window !== "undefined" ? window.location.pathname + window.location.search : "/"));
+}
+function useParams() {
+	return useContext(RouteDataContext)?.params ?? {};
+}
+function useRevalidate() {
+	const runtime = useContext(RouteDataContext);
+	return async () => {
+		if (typeof window === "undefined") return;
+		const result = await fetchPrachtRouteState(runtime?.url || window.location.pathname + window.location.search);
+		if (result.type === "redirect") {
+			await navigateToClientLocation(result.location);
+			return;
+		}
+		if (result.type === "error") throw deserializeRouteError(result.error);
+		runtime?.setData(result.data);
+		return result.data;
+	};
+}
+function Form(props) {
+	const { onSubmit, method, ...rest } = props;
+	return h("form", {
+		...rest,
+		method,
+		onSubmit: async (event) => {
+			onSubmit?.(event);
+			if (event.defaultPrevented) return;
+			const form = event.currentTarget;
+			if (!(form instanceof HTMLFormElement)) return;
+			const formMethod = (method ?? form.method ?? "post").toUpperCase();
+			if (SAFE_METHODS.has(formMethod)) return;
+			event.preventDefault();
+			const response = await fetch(props.action ?? form.action, {
+				method: formMethod,
+				body: new FormData(form),
+				redirect: "manual"
+			});
+			if (response.type === "opaqueredirect" || response.status >= 300 && response.status < 400) {
+				const location = response.headers.get("location");
+				if (location) {
+					await navigateToClientLocation(location);
+					return;
+				}
+				window.location.href = props.action ?? form.action;
+			}
+		}
+	});
+}
+function parseLocation(value) {
+	const url = new URL(value, "http://pracht.local");
+	return {
+		pathname: url.pathname,
+		search: url.search
+	};
+}
+//#endregion
+//#region src/runtime-html.ts
+function escapeHtml(str) {
+	return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function serializeJsonForHtml(value) {
+	return JSON.stringify(value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+function buildHtmlDocument(options) {
+	const { head, body, hydrationState, clientEntryUrl, cssUrls = [], modulePreloadUrls = [], routeStatePreloadUrl } = options;
+	const titleTag = head.title ? `<title>${escapeHtml(head.title)}</title>` : "";
+	const metaTags = (head.meta ?? []).map((m) => `<meta ${Object.entries(m).map(([k, v]) => `${k}="${escapeHtml(v)}"`).join(" ")}>`).join("\n    ");
+	const linkTags = (head.link ?? []).map((l) => `<link ${Object.entries(l).map(([k, v]) => `${k}="${escapeHtml(v)}"`).join(" ")}>`).join("\n    ");
+	const cssTags = cssUrls.map((url) => `<link rel="stylesheet" href="${escapeHtml(url)}">`).join("\n    ");
+	const modulePreloadTags = modulePreloadUrls.map((url) => `<link rel="modulepreload" href="${escapeHtml(url)}">`).join("\n    ");
+	const routeStatePreloadTag = routeStatePreloadUrl ? `<link rel="preload" as="fetch" href="${escapeHtml(routeStatePreloadUrl)}" crossorigin="anonymous">` : "";
+	const stateScript = `<script id="${HYDRATION_STATE_ELEMENT_ID}" type="application/json">${serializeJsonForHtml(hydrationState)}<\/script>`;
+	const entryScript = clientEntryUrl ? `<script type="module" src="${escapeHtml(clientEntryUrl)}"><\/script>` : "";
+	return `<!DOCTYPE html>
+<html${head.lang ? ` lang="${escapeHtml(head.lang)}"` : ""}>
+  <head>
+    <meta charset="utf-8">
+    ${titleTag}
+    ${metaTags}
+    ${linkTags}
+    ${cssTags}
+    ${modulePreloadTags}
+    ${routeStatePreloadTag}
+  </head>
+  <body>
+    <div id="pracht-root">${body}</div>
+    ${stateScript}
+    ${entryScript}
+  </body>
+</html>`;
+}
+function htmlResponse(html, status = 200, initHeaders) {
+	const headers = new Headers({ "content-type": "text/html; charset=utf-8" });
+	if (initHeaders) applyHeaders(headers, initHeaders);
+	applySecurityAndRouteHeaders(headers, { isRouteStateRequest: false });
+	return new Response(html, {
+		status,
+		headers
+	});
+}
+//#endregion
+//#region src/runtime-manifest.ts
 /** Strip leading `./` and `/` so all module paths share one canonical form. */
 function normalizeModulePath(path) {
 	return path.replace(/^\.?\//, "");
@@ -445,128 +752,142 @@ function buildSuffixIndex(manifest) {
 const suffixIndexCache = /* @__PURE__ */ new WeakMap();
 function getSuffixIndex(manifest) {
 	let index = suffixIndexCache.get(manifest);
-	if (index) return index;
-	index = buildSuffixIndex(manifest);
-	suffixIndexCache.set(manifest, index);
-	return index;
-}
-function resolveManifestEntries(manifest, file) {
-	if (file in manifest) return manifest[file];
-	const resolved = getSuffixIndex(manifest).get(normalizeModulePath(file));
-	if (resolved) return manifest[resolved];
-}
-function resolvePageCssUrls(options, shellFile, routeFile) {
-	if (!options.cssManifest) return options.cssUrls ?? [];
-	const css = /* @__PURE__ */ new Set();
-	function addFromManifest(file) {
-		const entries = resolveManifestEntries(options.cssManifest, file);
-		if (entries) for (const c of entries) css.add(c);
-	}
-	if (shellFile) addFromManifest(shellFile);
-	addFromManifest(routeFile);
-	return [...css];
-}
-function resolvePageJsUrls(options, shellFile, routeFile) {
-	if (!options.jsManifest) return [];
-	const js = /* @__PURE__ */ new Set();
-	function addFromManifest(file) {
-		const entries = resolveManifestEntries(options.jsManifest, file);
-		if (entries) for (const j of entries) js.add(j);
-	}
-	if (shellFile) addFromManifest(shellFile);
-	addFromManifest(routeFile);
-	return [...js];
-}
-async function navigateToClientLocation(location, options) {
-	if (typeof window === "undefined") return;
-	const targetUrl = new URL(location, window.location.href);
-	const target = targetUrl.pathname + targetUrl.search + targetUrl.hash;
-	if (targetUrl.origin === window.location.origin && window.__PRACHT_NAVIGATE__) {
-		await window.__PRACHT_NAVIGATE__(target, options);
-		return;
-	}
-	if (options?.replace) {
-		window.location.replace(targetUrl.toString());
-		return;
-	}
-	window.location.href = targetUrl.toString();
-}
-function isPrachtHttpError(error) {
-	return error instanceof Error && error.name === "PrachtHttpError" && "status" in error;
+	if (index) return index;
+	index = buildSuffixIndex(manifest);
+	suffixIndexCache.set(manifest, index);
+	return index;
 }
-function shouldExposeServerErrors(options) {
-	return options.debugErrors === true;
+function resolveManifestEntries(manifest, file) {
+	if (file in manifest) return manifest[file];
+	const resolved = getSuffixIndex(manifest).get(normalizeModulePath(file));
+	if (resolved) return manifest[resolved];
 }
-function createSerializedRouteError(message, status, options = {}) {
-	return {
-		message,
-		name: options.name ?? "Error",
-		status,
-		...options.diagnostics ? { diagnostics: options.diagnostics } : {}
+function resolvePageUrlsFromManifest(manifest, shellFile, routeFile) {
+	const urls = /* @__PURE__ */ new Set();
+	const add = (file) => {
+		const entries = resolveManifestEntries(manifest, file);
+		if (entries) for (const url of entries) urls.add(url);
 	};
+	if (shellFile) add(shellFile);
+	add(routeFile);
+	return [...urls];
 }
-function buildRuntimeDiagnostics(options) {
-	const route = options.route;
-	const routeId = route && "id" in route ? route.id : void 0;
+function resolvePageCssUrls(cssManifest, shellFile, routeFile) {
+	if (!cssManifest) return [];
+	return resolvePageUrlsFromManifest(cssManifest, shellFile, routeFile);
+}
+function resolvePageJsUrls(jsManifest, shellFile, routeFile) {
+	if (!jsManifest) return [];
+	return resolvePageUrlsFromManifest(jsManifest, shellFile, routeFile);
+}
+async function resolveRegistryModule(modules, file) {
+	if (!modules) return void 0;
+	if (file in modules) return modules[file]();
+	const resolved = getSuffixIndex(modules).get(normalizeModulePath(file));
+	if (resolved) return modules[resolved]();
+}
+async function resolveDataFunctions(route, routeModule, registry) {
+	let loader = routeModule?.loader;
+	let loaderFile = routeModule?.loader ? route.file : void 0;
+	if (route.loaderFile) {
+		const dataModule = await resolveRegistryModule(registry.dataModules, route.loaderFile);
+		if (dataModule?.loader) {
+			loader = dataModule.loader;
+			loaderFile = route.loaderFile;
+		}
+	}
 	return {
-		phase: options.phase,
-		routeId,
-		routePath: route?.path,
-		routeFile: route?.file,
-		loaderFile: options.loaderFile,
-		shellFile: options.shellFile,
-		middlewareFiles: options.middlewareFiles ? [...options.middlewareFiles] : [],
-		status: options.status
+		loader,
+		loaderFile
 	};
 }
-function normalizeRouteError(error, options) {
-	if (isPrachtHttpError(error)) {
-		const status = typeof error.status === "number" ? error.status : 500;
-		if (status >= 400 && status < 500) return {
-			message: error.message,
-			name: error.name,
-			status
-		};
-		if (options.exposeDetails) return {
-			message: error.message || "Internal Server Error",
-			name: error.name || "Error",
-			status
-		};
-		return {
-			message: "Internal Server Error",
-			name: "Error",
-			status
-		};
-	}
-	if (error instanceof Error) {
-		if (options.exposeDetails) return {
-			message: error.message || "Internal Server Error",
-			name: error.name || "Error",
-			status: 500
-		};
-		return {
-			message: "Internal Server Error",
-			name: "Error",
-			status: 500
+//#endregion
+//#region src/runtime-middleware.ts
+const DEFAULT_REDIRECT_STATUS_SAFE = 302;
+const DEFAULT_REDIRECT_STATUS_UNSAFE = 303;
+/**
+* Build a safe redirect response from middleware/loader output. Rejects
+* non-http(s) schemes (no `javascript:`/`data:`/etc.) and CR/LF injection
+* against the `Location` header. When status is omitted, non-GET/HEAD
+* requests default to 303 so the browser does not resend the body to the
+* redirect target; safe methods default to 302.
+*
+* The original `target` string is preserved on success (relative paths
+* stay relative) — we only parse it to validate scheme, not to rewrite
+* it. Both the original input and its resolved URL must be CR/LF-free.
+*/
+function buildRedirectResponse(target, options) {
+	if (/[\r\n]/.test(target)) throw new Error("Refused redirect target containing CR/LF");
+	if (!parseSafeNavigationUrl(target, options.baseUrl)) throw new Error("Refused unsafe redirect target");
+	const method = (options.method ?? "GET").toUpperCase();
+	const defaultStatus = SAFE_METHODS.has(method) ? DEFAULT_REDIRECT_STATUS_SAFE : DEFAULT_REDIRECT_STATUS_UNSAFE;
+	const status = options.status ?? defaultStatus;
+	return new Response(null, {
+		status,
+		headers: { location: target }
+	});
+}
+async function runMiddlewareChain(options) {
+	let context = options.context;
+	const modulePromises = options.middlewareFiles.map((mwFile) => resolveRegistryModule(options.registry.middlewareModules, mwFile));
+	for (const p of modulePromises) p.catch(() => {});
+	for (const modulePromise of modulePromises) {
+		const mwModule = await modulePromise;
+		if (!mwModule?.middleware) continue;
+		const result = await mwModule.middleware({
+			request: options.request,
+			params: options.params,
+			context,
+			signal: AbortSignal.timeout(3e4),
+			url: options.url,
+			route: options.route
+		});
+		if (!result) continue;
+		if (result instanceof Response) return { response: withDefaultSecurityHeaders(result) };
+		if ("redirect" in result) {
+			const status = "status" in result ? result.status : void 0;
+			return { response: withDefaultSecurityHeaders(buildRedirectResponse(result.redirect, {
+				baseUrl: options.request.url,
+				method: options.request.method,
+				status
+			})) };
+		}
+		if ("context" in result) context = {
+			...context,
+			...result.context
 		};
 	}
-	if (options.exposeDetails) return {
-		message: typeof error === "string" && error ? error : "Internal Server Error",
-		name: "Error",
-		status: 500
-	};
+	return { context };
+}
+async function mergeHeadMetadata(shellModule, routeModule, routeArgs, data) {
+	const [shellHead, routeHead] = await Promise.all([shellModule?.head ? shellModule.head(routeArgs) : Promise.resolve({}), routeModule?.head ? routeModule.head({
+		...routeArgs,
+		data
+	}) : Promise.resolve({})]);
 	return {
-		message: "Internal Server Error",
-		name: "Error",
-		status: 500
+		title: routeHead.title ?? shellHead.title,
+		lang: routeHead.lang ?? shellHead.lang,
+		meta: [...shellHead.meta ?? [], ...routeHead.meta ?? []],
+		link: [...shellHead.link ?? [], ...routeHead.link ?? []]
 	};
 }
-function deserializeRouteError$1(error) {
-	const result = new Error(error.message);
-	result.name = error.name;
-	result.status = error.status;
-	result.diagnostics = error.diagnostics;
-	return result;
+async function mergeDocumentHeaders(shellModule, routeModule, routeArgs, data) {
+	const headers = new Headers();
+	const [shellHeaders, routeHeaders] = await Promise.all([shellModule?.headers ? shellModule.headers(routeArgs) : Promise.resolve(void 0), routeModule?.headers ? routeModule.headers({
+		...routeArgs,
+		data
+	}) : Promise.resolve(void 0)]);
+	if (shellHeaders) applyHeaders(headers, shellHeaders);
+	if (routeHeaders) applyHeaders(headers, routeHeaders);
+	return headers;
+}
+//#endregion
+//#region src/runtime-response.ts
+let _renderToStringAsync;
+async function getRenderToStringAsync() {
+	if (_renderToStringAsync) return _renderToStringAsync;
+	_renderToStringAsync = (await import("preact-render-to-string")).renderToStringAsync;
+	return _renderToStringAsync;
 }
 function jsonErrorResponse(routeError, options) {
 	const headers = applySecurityAndRouteHeaders(new Headers({ "content-type": "application/json; charset=utf-8" }), options.isRouteStateRequest ? { isRouteStateRequest: true } : void 0);
@@ -638,12 +959,12 @@ async function renderRouteErrorResponse(options) {
 	const shellModule = options.shellModule ?? (options.shellFile ? await resolveRegistryModule(options.options.registry?.shellModules, options.shellFile) : void 0);
 	const head = shellModule?.head ? await shellModule.head(options.routeArgs) : {};
 	const documentHeaders = await mergeDocumentHeaders(shellModule, void 0, options.routeArgs, void 0);
-	const cssUrls = resolvePageCssUrls(options.options, options.shellFile, options.routeArgs.route.file);
-	const modulePreloadUrls = resolvePageJsUrls(options.options, options.shellFile, options.routeArgs.route.file);
+	const cssUrls = resolvePageCssUrls(options.options.cssManifest, options.shellFile, options.routeArgs.route.file);
+	const modulePreloadUrls = resolvePageJsUrls(options.options.jsManifest, options.shellFile, options.routeArgs.route.file);
 	const renderToString = await getRenderToStringAsync();
 	const ErrorBoundary = options.routeModule.ErrorBoundary;
 	const Shell = shellModule?.Shell;
-	const errorValue = deserializeRouteError$1(routeErrorWithDiagnostics);
+	const errorValue = deserializeRouteError(routeErrorWithDiagnostics);
 	const componentTree = Shell ? h(Shell, null, h(ErrorBoundary, { error: errorValue })) : h(ErrorBoundary, { error: errorValue });
 	return htmlResponse(buildHtmlDocument({
 		head,
@@ -663,168 +984,325 @@ async function renderRouteErrorResponse(options) {
 		modulePreloadUrls
 	}), routeErrorWithDiagnostics.status, documentHeaders);
 }
-async function runMiddlewareChain(options) {
-	let context = options.context;
-	for (const mwFile of options.middlewareFiles) {
-		const mwModule = await resolveRegistryModule(options.registry.middlewareModules, mwFile);
-		if (!mwModule?.middleware) continue;
-		const result = await mwModule.middleware({
-			request: options.request,
-			params: options.params,
-			context,
-			signal: AbortSignal.timeout(3e4),
-			url: options.url,
-			route: options.route
-		});
-		if (!result) continue;
-		if (result instanceof Response) return { response: withDefaultSecurityHeaders(result) };
-		if ("redirect" in result) return { response: withDefaultSecurityHeaders(new Response(null, {
-			status: 302,
-			headers: { location: result.redirect }
-		})) };
-		if ("context" in result) context = {
-			...context,
-			...result.context
-		};
-	}
-	return { context };
-}
-async function resolveDataFunctions(route, routeModule, registry) {
-	let loader = routeModule?.loader;
-	let loaderFile = routeModule?.loader ? route.file : void 0;
-	if (route.loaderFile) {
-		const dataModule = await resolveRegistryModule(registry.dataModules, route.loaderFile);
-		if (dataModule?.loader) {
-			loader = dataModule.loader;
-			loaderFile = route.loaderFile;
-		}
-	}
-	return {
-		loader,
-		loaderFile
-	};
-}
-async function resolveRegistryModule(modules, file) {
-	if (!modules) return void 0;
-	if (file in modules) return modules[file]();
-	const resolved = getSuffixIndex(modules).get(normalizeModulePath(file));
-	if (resolved) return modules[resolved]();
-}
-async function mergeHeadMetadata(shellModule, routeModule, routeArgs, data) {
-	const shellHead = shellModule?.head ? await shellModule.head(routeArgs) : {};
-	const routeHead = routeModule?.head ? await routeModule.head({
-		...routeArgs,
-		data
-	}) : {};
-	return {
-		title: routeHead.title ?? shellHead.title,
-		lang: routeHead.lang ?? shellHead.lang,
-		meta: [...shellHead.meta ?? [], ...routeHead.meta ?? []],
-		link: [...shellHead.link ?? [], ...routeHead.link ?? []]
-	};
-}
-async function mergeDocumentHeaders(shellModule, routeModule, routeArgs, data) {
-	const headers = new Headers();
-	const shellHeaders = shellModule?.headers ? await shellModule.headers(routeArgs) : void 0;
-	if (shellHeaders) applyHeaders(headers, shellHeaders);
-	const routeHeaders = routeModule?.headers ? await routeModule.headers({
-		...routeArgs,
-		data
-	}) : void 0;
-	if (routeHeaders) applyHeaders(headers, routeHeaders);
-	return headers;
-}
-function applyHeaders(headers, init) {
-	new Headers(init).forEach((value, key) => {
-		headers.set(key, value);
-	});
-}
-function buildHtmlDocument(options) {
-	const { head, body, hydrationState, clientEntryUrl, cssUrls = [], modulePreloadUrls = [] } = options;
-	const titleTag = head.title ? `<title>${escapeHtml(head.title)}</title>` : "";
-	const metaTags = (head.meta ?? []).map((m) => `<meta ${Object.entries(m).map(([k, v]) => `${k}="${escapeHtml(v)}"`).join(" ")}>`).join("\n    ");
-	const linkTags = (head.link ?? []).map((l) => `<link ${Object.entries(l).map(([k, v]) => `${k}="${escapeHtml(v)}"`).join(" ")}>`).join("\n    ");
-	const cssTags = cssUrls.map((url) => `<link rel="stylesheet" href="${escapeHtml(url)}">`).join("\n    ");
-	const modulePreloadTags = modulePreloadUrls.map((url) => `<link rel="modulepreload" href="${escapeHtml(url)}">`).join("\n    ");
-	const stateScript = `<script id="${HYDRATION_STATE_ELEMENT_ID}" type="application/json">${serializeJsonForHtml(hydrationState)}<\/script>`;
-	const entryScript = clientEntryUrl ? `<script type="module" src="${escapeHtml(clientEntryUrl)}"><\/script>` : "";
-	return `<!DOCTYPE html>
-<html${head.lang ? ` lang="${escapeHtml(head.lang)}"` : ""}>
-  <head>
-    <meta charset="utf-8">
-    ${titleTag}
-    ${metaTags}
-    ${linkTags}
-    ${cssTags}
-    ${modulePreloadTags}
-  </head>
-  <body>
-    <div id="pracht-root">${body}</div>
-    ${stateScript}
-    ${entryScript}
-  </body>
-</html>`;
-}
-function htmlResponse(html, status = 200, initHeaders) {
-	const headers = new Headers({ "content-type": "text/html; charset=utf-8" });
-	if (initHeaders) applyHeaders(headers, initHeaders);
-	applySecurityAndRouteHeaders(headers, { isRouteStateRequest: false });
-	return new Response(html, {
-		status,
-		headers
-	});
-}
-function applyDefaultSecurityHeaders(headers) {
-	if (!headers.has("permissions-policy")) headers.set("permissions-policy", "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()");
-	if (!headers.has("referrer-policy")) headers.set("referrer-policy", "strict-origin-when-cross-origin");
-	if (!headers.has("x-content-type-options")) headers.set("x-content-type-options", "nosniff");
-	if (!headers.has("x-frame-options")) headers.set("x-frame-options", "SAMEORIGIN");
-	return headers;
-}
-function applySecurityAndRouteHeaders(headers, options) {
-	applyDefaultSecurityHeaders(headers);
-	if (options) {
-		appendVaryHeader(headers, ROUTE_STATE_REQUEST_HEADER);
-		if (options.isRouteStateRequest && !headers.has("cache-control")) headers.set("cache-control", ROUTE_STATE_CACHE_CONTROL);
-	}
-	return headers;
-}
-function withDefaultSecurityHeaders(response) {
-	const headers = new Headers(response.headers);
-	applySecurityAndRouteHeaders(headers);
-	return new Response(response.body, {
-		status: response.status,
-		statusText: response.statusText,
-		headers
-	});
+//#endregion
+//#region src/runtime-negotiation.ts
+const MARKDOWN_MEDIA_TYPE = "text/markdown";
+function parseAccept(header) {
+	if (!header) return [];
+	const entries = [];
+	for (const raw of header.split(",")) {
+		const parts = raw.trim().split(";");
+		const type = parts.shift()?.trim().toLowerCase();
+		if (!type) continue;
+		let quality = 1;
+		for (const param of parts) {
+			const [key, value] = param.split("=").map((p) => p.trim());
+			if (key === "q" && value != null) {
+				const parsed = Number.parseFloat(value);
+				if (!Number.isNaN(parsed)) quality = parsed;
+			}
+		}
+		entries.push({
+			type,
+			quality
+		});
+	}
+	return entries;
 }
-function withRouteResponseHeaders(response, options) {
-	const headers = new Headers(response.headers);
-	applySecurityAndRouteHeaders(headers, options);
-	return new Response(response.body, {
-		status: response.status,
-		statusText: response.statusText,
+function prefersMarkdown(accept) {
+	const entries = parseAccept(accept);
+	if (!entries.length) return false;
+	const md = entries.find((e) => e.type === MARKDOWN_MEDIA_TYPE);
+	if (!md || md.quality === 0) return false;
+	const html = entries.find((e) => e.type === "text/html");
+	if (!html) return true;
+	return md.quality >= html.quality;
+}
+function markdownResponse(source) {
+	const headers = new Headers({
+		"content-type": "text/markdown; charset=utf-8",
+		"cache-control": "public, max-age=0, must-revalidate"
+	});
+	appendVaryHeader(headers, "Accept");
+	applyDefaultSecurityHeaders(headers);
+	return new Response(source, {
+		status: 200,
 		headers
 	});
 }
-function appendVaryHeader(headers, value) {
-	const current = headers.get("vary");
-	if (!current) {
-		headers.set("vary", value);
-		return;
+//#endregion
+//#region src/runtime.ts
+const FIRST_PARTY_FETCH_SITES = new Set(["same-origin", "same-site"]);
+/**
+* Stricter variant of first-party detection used for CSRF protection on
+* state-changing API requests. Unlike `isFirstPartyFetch`, this *only*
+* accepts explicit positive evidence that the request came from this
+* origin — a cross-origin form POST will send `Origin` from the
+* attacker, and a missing `Origin` on POST is unusual enough to block.
+* Non-browser callers (curl, server-to-server) should set the header
+* explicitly or pre-flight via middleware.
+*/
+function isSameOriginMutation(request, url) {
+	const site = request.headers.get("sec-fetch-site");
+	if (site) return FIRST_PARTY_FETCH_SITES.has(site);
+	const origin = request.headers.get("origin");
+	if (origin) try {
+		return new URL(origin).origin === url.origin;
+	} catch {
+		return false;
 	}
-	const values = current.split(",").map((part) => part.trim().toLowerCase()).filter(Boolean);
-	if (values.includes("*") || values.includes(value.toLowerCase())) return;
-	headers.set("vary", `${current}, ${value}`);
+	const referer = request.headers.get("referer");
+	if (referer) try {
+		return new URL(referer).origin === url.origin;
+	} catch {
+		return false;
+	}
+	return true;
 }
-function escapeHtml(str) {
-	return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+/**
+* Heuristic "this request came from our own page" check. Used to gate
+* the `_data=1` query-param form of the route-state endpoint, which is
+* otherwise reachable via any cross-origin `<a href>` / redirect.
+*
+* Accepts a request as first-party when:
+*   - Sec-Fetch-Site is `same-origin` or `same-site` (modern browsers),
+*   - OR Sec-Fetch-Site is absent AND the Origin header matches the
+*     request URL's origin (older clients that still send Origin),
+*   - OR no Origin/Sec-Fetch-Site is present AND there is no Referer
+*     (non-browser clients like curl — CSRF is not the threat model
+*     there; blocking would break tests and CLIs).
+*
+* Cross-origin browser navigations set Sec-Fetch-Site to `cross-site`
+* or `none` (for user-typed URLs Sec-Fetch-Site: none, Referer absent,
+* Origin absent — handled by the "no headers → allow" branch since that
+* matches a first-party typed URL too).
+*/
+function isFirstPartyFetch(request) {
+	const site = request.headers.get("sec-fetch-site");
+	if (site) return FIRST_PARTY_FETCH_SITES.has(site);
+	const origin = request.headers.get("origin");
+	if (origin) try {
+		return new URL(origin).origin === new URL(request.url).origin;
+	} catch {
+		return false;
+	}
+	return true;
 }
-function serializeJsonForHtml(value) {
-	return JSON.stringify(value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+async function handlePrachtRequest(options) {
+	const url = new URL(options.request.url);
+	const hasDataParam = url.searchParams.get("_data") === "1";
+	if (hasDataParam) url.searchParams.delete("_data");
+	const requestPath = getRequestPath(url);
+	const registry = options.registry ?? {};
+	const headerSignalsRouteState = options.request.headers.get(ROUTE_STATE_REQUEST_HEADER) === "1";
+	const dataParamIsFirstParty = hasDataParam && isFirstPartyFetch(options.request);
+	const isRouteStateRequest = headerSignalsRouteState || dataParamIsFirstParty;
+	const exposeDiagnostics = shouldExposeServerErrors(options);
+	if (options.apiRoutes?.length) {
+		const apiMatch = matchApiRoute(options.apiRoutes, url.pathname);
+		if (apiMatch) {
+			const apiMiddlewareFiles = (options.app.api.middleware ?? []).flatMap((name) => {
+				const middlewareFile = options.app.middleware[name];
+				return middlewareFile ? [middlewareFile] : [];
+			});
+			let currentPhase = "middleware";
+			if ((options.app.api.requireSameOrigin ?? true) && !SAFE_METHODS.has(options.request.method) && !isSameOriginMutation(options.request, url)) return withDefaultSecurityHeaders(new Response("Cross-origin request blocked", {
+				status: 403,
+				headers: { "content-type": "text/plain; charset=utf-8" }
+			}));
+			try {
+				const middlewareResult = await runMiddlewareChain({
+					context: options.context ?? {},
+					middlewareFiles: apiMiddlewareFiles,
+					params: apiMatch.params,
+					registry,
+					request: options.request,
+					route: apiMatch.route,
+					url
+				});
+				if (middlewareResult.response) return middlewareResult.response;
+				currentPhase = "api";
+				const apiModule = await resolveRegistryModule(registry.apiModules, apiMatch.route.file);
+				if (!apiModule) throw new Error("API route module not found");
+				const handler = apiModule[options.request.method.toUpperCase()] ?? apiModule.default;
+				if (!handler) return withDefaultSecurityHeaders(new Response("Method not allowed", {
+					status: 405,
+					headers: { "content-type": "text/plain; charset=utf-8" }
+				}));
+				return withDefaultSecurityHeaders(await handler({
+					request: options.request,
+					params: apiMatch.params,
+					context: middlewareResult.context,
+					signal: AbortSignal.timeout(3e4),
+					url,
+					route: apiMatch.route
+				}));
+			} catch (error) {
+				return renderApiErrorResponse({
+					error,
+					middlewareFiles: apiMiddlewareFiles,
+					options,
+					phase: currentPhase,
+					route: apiMatch.route
+				});
+			}
+		}
+	}
+	const match = matchAppRoute(options.app, url.pathname);
+	if (!match) {
+		if (isRouteStateRequest) return jsonErrorResponse(createSerializedRouteError("Not found", 404, {
+			diagnostics: exposeDiagnostics ? buildRuntimeDiagnostics({
+				phase: "match",
+				status: 404
+			}) : void 0,
+			name: "Error"
+		}), { isRouteStateRequest: true });
+		return withDefaultSecurityHeaders(new Response("Not found", {
+			status: 404,
+			headers: { "content-type": "text/plain; charset=utf-8" }
+		}));
+	}
+	if (!SAFE_METHODS.has(options.request.method)) {
+		if (isRouteStateRequest) return jsonErrorResponse(createSerializedRouteError("Method not allowed", 405, {
+			diagnostics: exposeDiagnostics ? buildRuntimeDiagnostics({
+				middlewareFiles: match.route.middlewareFiles,
+				phase: "action",
+				route: match.route,
+				shellFile: match.route.shellFile,
+				status: 405
+			}) : void 0,
+			name: "Error"
+		}), { isRouteStateRequest: true });
+		return withRouteResponseHeaders(new Response("Method not allowed", {
+			status: 405,
+			headers: { "content-type": "text/plain; charset=utf-8" }
+		}), { isRouteStateRequest });
+	}
+	let routeArgs = {
+		request: options.request,
+		params: match.params,
+		context: options.context ?? {},
+		signal: AbortSignal.timeout(3e4),
+		url,
+		route: match.route
+	};
+	let routeModule;
+	let shellModule;
+	let loaderFile;
+	let currentPhase = "middleware";
+	try {
+		const middlewarePromise = runMiddlewareChain({
+			context: routeArgs.context,
+			middlewareFiles: match.route.middlewareFiles,
+			params: match.params,
+			registry,
+			request: options.request,
+			route: match.route,
+			url
+		});
+		const routeModulePromise = resolveRegistryModule(registry.routeModules, match.route.file);
+		const shellModulePromise = match.route.shellFile ? resolveRegistryModule(registry.shellModules, match.route.shellFile) : Promise.resolve(void 0);
+		const dataFunctionsPromise = routeModulePromise.then((mod) => resolveDataFunctions(match.route, mod, registry));
+		routeModulePromise.catch(() => {});
+		shellModulePromise.catch(() => {});
+		dataFunctionsPromise.catch(() => {});
+		const middlewareResult = await middlewarePromise;
+		if (middlewareResult.response) return normalizePageResponse(middlewareResult.response, { isRouteStateRequest });
+		routeArgs = {
+			...routeArgs,
+			context: middlewareResult.context
+		};
+		currentPhase = "render";
+		routeModule = await routeModulePromise;
+		if (!routeModule) throw new Error("Route module not found");
+		if (!isRouteStateRequest && typeof routeModule.markdown === "string" && prefersMarkdown(options.request.headers.get("accept"))) return markdownResponse(routeModule.markdown);
+		currentPhase = "loader";
+		const { loader, loaderFile: resolvedLoaderFile } = await dataFunctionsPromise;
+		loaderFile = resolvedLoaderFile;
+		const loaderResult = loader ? await loader(routeArgs) : void 0;
+		if (loaderResult instanceof Response) return normalizePageResponse(loaderResult, { isRouteStateRequest });
+		const data = loaderResult;
+		if (isRouteStateRequest) return withRouteResponseHeaders(Response.json({ data }), { isRouteStateRequest: true });
+		currentPhase = "render";
+		shellModule = await shellModulePromise;
+		const [head, documentHeaders] = await Promise.all([mergeHeadMetadata(shellModule, routeModule, routeArgs, data), mergeDocumentHeaders(shellModule, routeModule, routeArgs, data)]);
+		const cssUrls = resolvePageCssUrls(options.cssManifest, match.route.shellFile, match.route.file);
+		const modulePreloadUrls = resolvePageJsUrls(options.jsManifest, match.route.shellFile, match.route.file);
+		if (match.route.render === "spa") {
+			let body = "";
+			if (shellModule?.Shell || shellModule?.Loading) {
+				const Shell = shellModule?.Shell;
+				const Loading = shellModule?.Loading;
+				const loadingTree = Shell != null ? h(Shell, null, Loading ? h(Loading, null) : null) : Loading ? h(Loading, null) : null;
+				if (loadingTree) body = await (await getRenderToStringAsync())(loadingTree);
+			}
+			return htmlResponse(buildHtmlDocument({
+				head,
+				body,
+				hydrationState: {
+					url: requestPath,
+					routeId: match.route.id ?? "",
+					data: null,
+					error: null,
+					pending: true
+				},
+				clientEntryUrl: options.clientEntryUrl,
+				cssUrls,
+				modulePreloadUrls,
+				routeStatePreloadUrl: loader ? buildRouteStateUrl(requestPath) : void 0
+			}), 200, documentHeaders);
+		}
+		const DefaultComponent = typeof routeModule.default === "function" ? routeModule.default : void 0;
+		const Component = routeModule.Component ?? DefaultComponent;
+		if (!Component) throw new Error("Route has no Component or default export");
+		const Shell = shellModule?.Shell;
+		const Comp = Component;
+		const componentProps = {
+			data,
+			params: match.params
+		};
+		const componentTree = Shell ? h(Shell, null, h(Comp, componentProps)) : h(Comp, componentProps);
+		const tree = h(PrachtRuntimeProvider, {
+			data,
+			params: match.params,
+			routeId: match.route.id ?? "",
+			url: requestPath
+		}, componentTree);
+		return htmlResponse(buildHtmlDocument({
+			head,
+			body: await (await getRenderToStringAsync())(tree),
+			hydrationState: {
+				url: requestPath,
+				routeId: match.route.id ?? "",
+				data,
+				error: null
+			},
+			clientEntryUrl: options.clientEntryUrl,
+			cssUrls,
+			modulePreloadUrls
+		}), 200, documentHeaders);
+	} catch (error) {
+		return renderRouteErrorResponse({
+			error,
+			isRouteStateRequest,
+			loaderFile,
+			options,
+			phase: currentPhase,
+			routeArgs,
+			routeId: match.route.id ?? "",
+			routeModule,
+			shellFile: match.route.shellFile,
+			shellModule,
+			requestPath
+		});
+	}
+}
+function getRequestPath(url) {
+	return `${url.pathname}${url.search}`;
 }
+//#endregion
+//#region src/prerender.ts
 async function prerenderApp(options) {
-	const { resolveApp } = await import("./app-CUL3q2ZA.mjs").then((n) => n.t);
 	const resolved = resolveApp(options.app);
 	const results = [];
 	const isgManifest = {};
@@ -886,7 +1364,6 @@ async function collectSSGPaths(route, registry) {
 		console.warn(`  Warning: SSG route "${route.path}" has dynamic segments but no getStaticPaths() export, skipping.`);
 		return [];
 	}
-	const { buildPathFromSegments } = await import("./app-CUL3q2ZA.mjs").then((n) => n.t);
 	return (await routeModule.getStaticPaths()).map((params) => buildPathFromSegments(route.segments, params));
 }
 //#endregion
@@ -939,7 +1416,6 @@ function setupPrefetching(app, warmModules) {
 		const match = matchAppRoute(app, routePathname);
 		if (!match) return "none";
 		if (match.route.prefetch) return match.route.prefetch;
-		if (match.route.render === "spa") return "none";
 		return "intent";
 	}
 	document.addEventListener("mouseenter", (e) => {
@@ -1041,7 +1517,30 @@ async function initClientRouter(options) {
 		if (!shellKey) return null;
 		return loadModule(shellModules, shellKey);
 	}
-	async function buildRouteTree(match, state, currentUrl, routeModPromise, shellModPromise) {
+	let updateRouteState = null;
+	let routeStateVersion = 0;
+	function RouterRoot({ initialState }) {
+		const [routeState, setRouteState] = useState(initialState);
+		updateRouteState = setRouteState;
+		const navigateValue = useMemo(() => navigate, []);
+		const { Shell, Component, componentProps, data, params, routeId, url, version } = routeState;
+		const componentTree = Shell ? h(Shell, null, h(Component, componentProps)) : h(Component, componentProps);
+		return h(NavigateContext.Provider, { value: navigateValue }, h(PrachtRuntimeProvider, {
+			data,
+			params,
+			routeId,
+			stateVersion: version,
+			url
+		}, componentTree));
+	}
+	function applyRouteState(routeState) {
+		if (updateRouteState) {
+			updateRouteState(routeState);
+			return;
+		}
+		render(h(RouterRoot, { initialState: routeState }), root);
+	}
+	async function resolveRouteState(match, state, currentUrl, routeModPromise, shellModPromise) {
 		const routeMod = await (routeModPromise ?? startRouteImport(match));
 		if (!routeMod) return null;
 		let Shell = null;
@@ -1050,34 +1549,44 @@ async function initClientRouter(options) {
 		const DefaultComponent = typeof routeMod.default === "function" ? routeMod.default : void 0;
 		const Component = state.error ? routeMod.ErrorBoundary : routeMod.Component ?? DefaultComponent;
 		if (!Component) return null;
-		const props = state.error ? { error: deserializeRouteError(state.error) } : {
+		const componentProps = state.error ? { error: deserializeRouteError(state.error) } : {
 			data: state.data,
 			params: match.params
 		};
-		const componentTree = Shell ? h(Shell, null, h(Component, props)) : h(Component, props);
-		return h(NavigateContext.Provider, { value: navigate }, h(PrachtRuntimeProvider, {
+		return {
+			Shell,
+			Component,
+			componentProps,
 			data: state.data,
 			params: match.params,
 			routeId: match.route.id ?? "",
-			url: currentUrl
-		}, componentTree));
+			url: currentUrl,
+			version: ++routeStateVersion
+		};
 	}
-	async function buildSpaPendingTree(match, currentUrl, shellModPromise) {
+	async function resolveSpaPendingState(match, currentUrl, shellModPromise) {
 		const resolvedShell = await (shellModPromise ?? startShellImport(match));
 		if (!resolvedShell) return null;
-		const Shell = resolvedShell.Shell;
+		const Shell = resolvedShell.Shell ?? null;
 		const Loading = resolvedShell.Loading;
-		const componentTree = Shell != null ? h(Shell, null, Loading ? h(Loading, null) : null) : Loading ? h(Loading, null) : null;
-		if (!componentTree) return null;
-		return h(NavigateContext.Provider, { value: navigate }, h(PrachtRuntimeProvider, {
+		if (!Shell && !Loading) return null;
+		return {
+			Shell,
+			Component: Loading ?? (() => null),
+			componentProps: {},
 			data: void 0,
 			params: match.params,
 			routeId: match.route.id ?? "",
-			url: currentUrl
-		}, componentTree));
+			url: currentUrl,
+			version: ++routeStateVersion
+		};
 	}
 	function resolveRedirectTarget(location) {
-		const targetUrl = new URL(location, window.location.href);
+		const targetUrl = parseSafeNavigationUrl(location, window.location.href);
+		if (!targetUrl) return {
+			isCurrentLocation: false,
+			unsafe: true
+		};
 		const fullInternalTarget = targetUrl.pathname + targetUrl.search + targetUrl.hash;
 		const internalPath = targetUrl.pathname + targetUrl.search;
 		const currentPath = window.location.pathname + window.location.search + window.location.hash;
@@ -1118,6 +1627,10 @@ async function initClientRouter(options) {
 			if (result.type === "redirect") {
 				if (result.location) {
 					const redirect = resolveRedirectTarget(result.location);
+					if (redirect.unsafe) {
+						console.error(`[pracht] refused to navigate to unsafe URL: ${result.location}`);
+						return;
+					}
 					if (redirect.externalUrl) {
 						window.location.href = redirect.externalUrl;
 						return;
@@ -1131,7 +1644,7 @@ async function initClientRouter(options) {
 						await navigate(redirect.internalPath, opts);
 						return;
 					}
-					window.location.href = result.location;
+					window.location.href = target.browserUrl;
 					return;
 				}
 				window.location.href = target.browserUrl;
@@ -1151,21 +1664,12 @@ async function initClientRouter(options) {
 		}
 		if (!opts?._popstate) if (opts?.replace) history.replaceState(null, "", target.browserUrl);
 		else history.pushState(null, "", target.browserUrl);
-		const tree = await buildRouteTree(match, state, target.requestUrl, routeModPromise, shellModPromise);
-		if (tree) {
-			render(tree, root);
+		const routeState = await resolveRouteState(match, state, target.requestUrl, routeModPromise, shellModPromise);
+		if (routeState) {
+			applyRouteState(routeState);
 			window.scrollTo(0, 0);
 		} else window.location.href = target.browserUrl;
 	}
-	if (import.meta.env?.DEV) {
-		const prev = options.__m;
-		options.__m = (vnode, s) => {
-			const message = `Hydration mismatch in <${(typeof vnode.type === "function" ? vnode.type.displayName || vnode.type.name : vnode.type) || "Unknown"}>: ${s}`;
-			console.warn(`[pracht] ${message}`);
-			appendHydrationWarning(message);
-			if (prev) prev(vnode, s);
-		};
-	}
 	const initialTarget = resolveBrowserRouteTarget(options.initialState.url);
 	const initialRequestUrl = initialTarget?.requestUrl ?? options.initialState.url;
 	const initialBrowserUrl = initialTarget?.browserUrl ?? options.initialState.url;
@@ -1177,13 +1681,18 @@ async function initClientRouter(options) {
 			error: options.initialState.error ?? null
 		};
 		if (initialMatch.route.render === "spa" && options.initialState.pending) {
-			const dataPromise = fetchPrachtRouteState(initialRequestUrl);
-			const pendingTree = await buildSpaPendingTree(initialMatch, initialRequestUrl, initialShellPromise);
-			if (pendingTree) hydrate(pendingTree, root);
+			const dataPromise = fetchPrachtRouteState(initialRequestUrl, { useDataParam: true });
+			const pendingState = await resolveSpaPendingState(initialMatch, initialRequestUrl, initialShellPromise);
+			if (pendingState) hydrate(h(RouterRoot, { initialState: pendingState }), root);
 			try {
 				const result = await dataPromise;
 				if (result.type === "redirect") {
-					window.location.href = result.location;
+					const safeRedirect = parseSafeNavigationUrl(result.location, window.location.href);
+					if (!safeRedirect) {
+						console.error(`[pracht] refused to navigate to unsafe URL: ${result.location}`);
+						return;
+					}
+					window.location.href = safeRedirect.toString();
 					return;
 				}
 				if (result.type === "error") state = {
@@ -1198,12 +1707,15 @@ async function initClientRouter(options) {
 				window.location.href = initialBrowserUrl;
 				return;
 			}
-		}
-		const tree = await buildRouteTree(initialMatch, state, initialRequestUrl, void 0, initialShellPromise);
-		if (tree) if (initialMatch.route.render === "spa") render(tree, root);
-		else {
-			markHydrating();
-			hydrate(tree, root);
+			const resolvedState = await resolveRouteState(initialMatch, state, initialRequestUrl, void 0, initialShellPromise);
+			if (resolvedState) applyRouteState(resolvedState);
+		} else {
+			const initialRouteState = await resolveRouteState(initialMatch, state, initialRequestUrl, void 0, initialShellPromise);
+			if (initialRouteState) if (initialMatch.route.render === "spa") render(h(RouterRoot, { initialState: initialRouteState }), root);
+			else {
+				markHydrating();
+				hydrate(h(RouterRoot, { initialState: initialRouteState }), root);
+			}
 		}
 	}
 	document.addEventListener("click", (e) => {
@@ -1238,61 +1750,6 @@ async function initClientRouter(options) {
 	};
 	setupPrefetching(app, warmModules);
 }
-const HYDRATION_BANNER_ID = "__pracht_hydration_warnings__";
-function appendHydrationWarning(message) {
-	let container = document.getElementById(HYDRATION_BANNER_ID);
-	if (!container) {
-		container = document.createElement("div");
-		container.id = HYDRATION_BANNER_ID;
-		Object.assign(container.style, {
-			position: "fixed",
-			bottom: "0",
-			left: "0",
-			right: "0",
-			maxHeight: "30vh",
-			overflow: "auto",
-			background: "#2d1b00",
-			borderTop: "2px solid #f0ad4e",
-			color: "#ffc107",
-			fontFamily: "ui-monospace, Consolas, monospace",
-			fontSize: "13px",
-			padding: "12px 16px",
-			zIndex: "2147483647"
-		});
-		const header = document.createElement("div");
-		Object.assign(header.style, {
-			display: "flex",
-			justifyContent: "space-between",
-			alignItems: "center",
-			marginBottom: "8px"
-		});
-		header.innerHTML = "<strong style=\"color:#f0ad4e\">⚠ Hydration Mismatches</strong>";
-		const close = document.createElement("button");
-		close.textContent = "×";
-		Object.assign(close.style, {
-			background: "none",
-			border: "none",
-			color: "#f0ad4e",
-			fontSize: "18px",
-			cursor: "pointer"
-		});
-		close.onclick = () => container.remove();
-		header.appendChild(close);
-		container.appendChild(header);
-		document.body.appendChild(container);
-	}
-	const entry = document.createElement("div");
-	entry.textContent = message;
-	Object.assign(entry.style, { padding: "2px 0" });
-	container.appendChild(entry);
-}
-function deserializeRouteError(error) {
-	const result = new Error(error.message);
-	result.name = error.name;
-	result.status = error.status;
-	result.diagnostics = error.diagnostics;
-	return result;
-}
 function resolveBrowserRouteTarget(to) {
 	if (typeof window === "undefined") return null;
 	try {
@@ -1318,4 +1775,4 @@ var PrachtHttpError = class extends Error {
 	}
 };
 //#endregion
-export { Form, PrachtHttpError, PrachtRuntimeProvider, Suspense, applyDefaultSecurityHeaders, buildPathFromSegments, defineApp, forwardRef, group, handlePrachtRequest, initClientRouter, lazy, matchApiRoute, matchAppRoute, prerenderApp, readHydrationState, resolveApiRoutes, resolveApp, route, startApp, timeRevalidate, useIsHydrated, useLocation, useNavigate, useParams, useRevalidate, useRevalidateRoute, useRouteData };
+export { Form, PrachtHttpError, PrachtRuntimeProvider, Suspense, applyDefaultSecurityHeaders, buildPathFromSegments, defineApp, forwardRef, group, handlePrachtRequest, initClientRouter, lazy, matchApiRoute, matchAppRoute, prerenderApp, readHydrationState, resolveApiRoutes, resolveApp, route, startApp, timeRevalidate, useIsHydrated, useLocation, useNavigate, useParams, useRevalidate, useRouteData };