@pracht/vite-plugin 0.7.6 → 0.9.0

package/dist/index.mjs

@@ -1,14 +1,16 @@
-import { i as scanPagesDirectory, n as generatePagesManifestSource, o as createRouteLoaderHints } from "./pages-router-CStJY2Zp.mjs";
-import { createRequire } from "node:module";
+import { c as createRouteStaticPathsHints, d as extensionGlob, f as normalizeAdditionalExtensions, i as scanPagesDirectory, l as DEFAULT_ROUTE_EXTENSIONS, n as generatePagesManifestSource, o as createRouteHeadHints, p as withAdditionalExtensions, s as createRouteLoaderHints, u as LEGACY_BARE_ROUTE_EXTENSIONS } from "./pages-router-KcCRkhnf.mjs";
+import { createRequire, isBuiltin } from "node:module";
 import { preactSsrPrecompile } from "@pracht/preact-ssr-precompile";
 import preact from "@preact/preset-vite";
 import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 import { dirname, extname, join, resolve } from "node:path";
 import { loadEnv, parseAst } from "vite";
+import { PRACHT_GRAPH_ONLY_ENV } from "@pracht/core/server";
 import { CAPABILITY_SETTLED_EVENT, CAPABILITY_TRANSPORT_HEADER, CONFIRMATION_HEADER } from "@pracht/capabilities";
-import { extractCapabilityProjection, extractCapabilityRegistrations } from "@pracht/capabilities/static";
+import { extractCapabilityProjection, extractCapabilityRegistrations, extractDefineAppObjectBody, scanTopLevelProperties } from "@pracht/capabilities/static";
 import { createNodeServerEntryModule } from "@pracht/adapter-node";
-import { resolveRegistryModule } from "@pracht/core";
+import { Readable } from "node:stream";
+import { applyDefaultSecurityHeaders, resolveRegistryModule } from "@pracht/core";
 //#region src/client-module-query.ts
 const CLIENT_MODULE_QUERY = "pracht-client";
 const PRACHT_CLIENT_MODULE_QUERY = `?${CLIENT_MODULE_QUERY}`;
@@ -27,7 +29,6 @@ function stripPrachtClientModuleQuery(id) {
 function getRolldownLang(id) {
 	const path = stripPrachtClientModuleQuery(id).split("?")[0];
 	if (/\.(c|m)?tsx$/i.test(path)) return "tsx";
-	if (/\.tsrx$/i.test(path)) return "tsx";
 	if (/\.(c|m)?ts$/i.test(path)) return "ts";
 	if (/\.(c|m)?jsx$/i.test(path)) return "jsx";
 	if (/\.mdx?$/i.test(path)) return "jsx";
@@ -1257,7 +1258,15 @@ const PRACHT_CAPABILITIES_MODULE_ID = "virtual:pracht/capabilities";
 const PRACHT_WEBMCP_MODULE_ID = "virtual:pracht/webmcp";
 const CLIENT_BROWSER_PATH = "/@pracht/client.js";
 const ISLANDS_CLIENT_BROWSER_PATH = "/@pracht/islands.js";
-function readClientBuildAssets(root = process.cwd()) {
+/**
+* `base` prefixes every emitted asset URL. Vite normalizes it to leading and
+* trailing slashes; a CDN base (absolute or protocol-relative) is used as-is,
+* so the manifest paths still resolve.
+*/
+function assetUrl(file, base) {
+	return `${base}${file}`;
+}
+function readClientBuildAssets(root = process.cwd(), base = "/") {
 	const manifestPath = ["dist/client/.vite/manifest.json", "dist/.vite/manifest.json"].map((candidate) => resolve(root, candidate)).find((candidate) => existsSync(candidate));
 	if (!manifestPath) return {
 		clientEntryUrl: null,
@@ -1275,22 +1284,22 @@ function readClientBuildAssets(root = process.cwd()) {
 		if (!entry.src) continue;
 		const deps = collectTransitiveDeps(manifest, key);
 		const manifestKey = stripPrachtClientModuleQuery(entry.src);
-		if (deps.css.length > 0) cssManifest[manifestKey] = deps.css.map((f) => `/${f}`);
-		if (deps.js.length > 0) jsManifest[manifestKey] = deps.js.map((f) => `/${f}`);
+		if (deps.css.length > 0) cssManifest[manifestKey] = deps.css.map((f) => assetUrl(f, base));
+		if (deps.js.length > 0) jsManifest[manifestKey] = deps.js.map((f) => assetUrl(f, base));
 	}
-	addEntryDeps(manifest, jsManifest, PRACHT_CLIENT_MODULE_ID, clientEntry);
-	addEntryDeps(manifest, jsManifest, PRACHT_ISLANDS_CLIENT_MODULE_ID, islandsEntry);
+	addEntryDeps(manifest, jsManifest, PRACHT_CLIENT_MODULE_ID, clientEntry, base);
+	addEntryDeps(manifest, jsManifest, PRACHT_ISLANDS_CLIENT_MODULE_ID, islandsEntry, base);
 	return {
-		clientEntryUrl: clientEntry ? `/${clientEntry.file}` : null,
-		islandsEntryUrl: islandsEntry ? `/${islandsEntry.file}` : null,
+		clientEntryUrl: clientEntry ? assetUrl(clientEntry.file, base) : null,
+		islandsEntryUrl: islandsEntry ? assetUrl(islandsEntry.file, base) : null,
 		cssManifest,
 		jsManifest
 	};
 }
-function addEntryDeps(manifest, jsManifest, entryKey, entry) {
+function addEntryDeps(manifest, jsManifest, entryKey, entry, base) {
 	if (!entry) return;
 	const deps = collectTransitiveDeps(manifest, entryKey).js.filter((file) => file !== entry.file);
-	if (deps.length > 0) jsManifest[entryKey] = deps.map((file) => `/${file}`);
+	if (deps.length > 0) jsManifest[entryKey] = deps.map((file) => assetUrl(file, base));
 }
 function collectTransitiveDeps(manifest, key) {
 	const css = /* @__PURE__ */ new Set();
@@ -1349,6 +1358,7 @@ const DEFAULTS = {
 	shellsDir: "/src/shells",
 	apiDir: "/src/api",
 	serverDir: "/src/server",
+	additionalExtensions: [],
 	islandsDir: "/src/islands",
 	capabilitiesDir: "/src/capabilities",
 	adapter: createDefaultNodeAdapter(),
@@ -1367,6 +1377,13 @@ function resolveOptions(options) {
 		...options
 	};
 	if (resolved.llmsTxt === void 0) resolved.llmsTxt = false;
+	resolved.additionalExtensions = normalizeAdditionalExtensions(resolved.additionalExtensions);
+	if (!new Set([
+		"spa",
+		"ssr",
+		"ssg",
+		"isg"
+	]).has(resolved.pagesDefaultRender)) throw new Error("pracht({ pagesDefaultRender }) expects \"spa\", \"ssr\", \"ssg\", or \"isg\".");
 	if (!Number.isInteger(resolved.prerenderConcurrency) || resolved.prerenderConcurrency <= 0) throw new Error("pracht({ prerenderConcurrency }) expects a positive integer.");
 	if (!Number.isInteger(resolved.maxBodySize) || resolved.maxBodySize <= 0) throw new Error("pracht({ maxBodySize }) expects a positive integer number of bytes.");
 	validateBudgets(resolved.budgets);
@@ -1416,6 +1433,82 @@ function validateBudgets(budgets) {
 * rather than silently dropping an endpoint.
 */
 /**
+* Whether the app can reach the agent surface at all — registered capabilities
+* or a `defineApp({ agents })` config. Drives the `__PRACHT_AGENT_SURFACE__`
+* define, which lets the bundler drop the capability and Web Bot Auth runtimes
+* from the server bundle of apps that use neither.
+*
+* Deliberately one-sided: it only answers `false` when the manifest is readable
+* and provably free of both. An unreadable manifest, a parse failure, or any
+* spread inside the manifest file (which could carry registrations this
+* analyzer cannot see) answers `true`, so the runtime keeps deciding for
+* itself. Being wrong the other way would 404 a capability in production that
+* works in dev.
+*/
+function hasAgentSurface(options = {}, root = process.cwd()) {
+	const resolved = resolveOptions(options);
+	if (resolved.pagesDir) return false;
+	const appFileAbs = resolve(root, resolved.appFile.replace(/^\//, ""));
+	let manifestSource;
+	try {
+		manifestSource = readFileSync(appFileAbs, "utf-8");
+	} catch {
+		return true;
+	}
+	const appBody = extractDefineAppObjectBody(manifestSource);
+	if (appBody === null) return true;
+	const properties = scanTopLevelProperties(appBody);
+	if (properties.has("agents") || properties.has("capabilities")) return true;
+	if (/\b(?:agents|capabilities)\b/.test(appBody)) return true;
+	if (appBody.includes("...") || hasOpaqueTopLevelProperty(appBody)) return true;
+	try {
+		return extractCapabilityRegistrations(manifestSource).length > 0;
+	} catch {
+		return true;
+	}
+}
+/** Whether an object literal body contains an opaque key at its top level. */
+function hasOpaqueTopLevelProperty(objectBody) {
+	let braces = 0;
+	let brackets = 0;
+	let parentheses = 0;
+	let expectingKey = true;
+	for (let index = 0; index < objectBody.length; index += 1) {
+		const char = objectBody[index];
+		const next = objectBody[index + 1];
+		if (char === "\"" || char === "'" || char === "`") {
+			const quote = char;
+			for (index += 1; index < objectBody.length; index += 1) if (objectBody[index] === "\\") index += 1;
+			else if (objectBody[index] === quote) break;
+			continue;
+		}
+		if (char === "/" && next === "/") {
+			index = objectBody.indexOf("\n", index + 2);
+			if (index === -1) break;
+			continue;
+		}
+		if (char === "/" && next === "*") {
+			const end = objectBody.indexOf("*/", index + 2);
+			if (end === -1) return true;
+			index = end + 1;
+			continue;
+		}
+		if (char === "/") return true;
+		const atTopLevel = braces === 0 && brackets === 0 && parentheses === 0;
+		if (atTopLevel && expectingKey && char === "[") return true;
+		if (atTopLevel && expectingKey && char === "\\") return true;
+		if (atTopLevel && char === ":") expectingKey = false;
+		if (atTopLevel && char === ",") expectingKey = true;
+		if (char === "{") braces += 1;
+		else if (char === "}") braces -= 1;
+		else if (char === "[") brackets += 1;
+		else if (char === "]") brackets -= 1;
+		else if (char === "(") parentheses += 1;
+		else if (char === ")") parentheses -= 1;
+	}
+	return false;
+}
+/**
 * Extract capability registrations (name → module path) from the app
 * manifest source and their exposure metadata from each capability source.
 * Pages-router apps have no manifest, so capabilities are manifest-mode only.
@@ -1489,7 +1582,7 @@ function extractCapabilityMetadata(name, file, source) {
 */
 function createPrachtCapabilitiesClientModuleSource(options = {}, buildOptions = {}) {
 	const capabilities = extractCapabilities(options, buildOptions.root);
-	const endpoints = {};
+	const endpoints = Object.create(null);
 	for (const capability of capabilities) if (capability.httpPath) endpoints[capability.name] = {
 		method: "POST",
 		path: capability.httpPath,
@@ -1499,7 +1592,9 @@ function createPrachtCapabilitiesClientModuleSource(options = {}, buildOptions =
 		"// Generated by @pracht/vite-plugin from the app manifest capability registrations.",
 		"// Contains only http-exposed capability names, endpoints, and effects —",
 		"// capability modules themselves are server-only and never reach the client graph.",
-		`const endpoints = ${JSON.stringify(endpoints)};`,
+		"import { createUseCapability, withBase } from \"@pracht/core\";",
+		"",
+		`const endpoints = Object.assign(Object.create(null), JSON.parse(${JSON.stringify(JSON.stringify(endpoints))}));`,
 		"",
 		"export const capabilityEndpoints = endpoints;",
 		"",
@@ -1508,10 +1603,12 @@ function createPrachtCapabilitiesClientModuleSource(options = {}, buildOptions =
 		"  try {",
 		"    const headers = new Headers(opts && opts.headers);",
 		"    headers.set(\"content-type\", \"application/json\");",
-		"    if (opts && opts.confirm) {",
+		"    if (opts && opts.prepare) {",
+		`      headers.delete(${JSON.stringify(CONFIRMATION_HEADER)});`,
+		"    } else if (opts && opts.confirm) {",
 		`      headers.set(${JSON.stringify(CONFIRMATION_HEADER)}, opts.confirm);`,
 		"    }",
-		"    response = await fetch(endpoint.path, {",
+		"    response = await fetch(withBase(endpoint.path), {",
 		"      method: endpoint.method,",
 		"      headers,",
 		"      body: JSON.stringify(input === undefined ? {} : input),",
@@ -1524,8 +1621,9 @@ function createPrachtCapabilitiesClientModuleSource(options = {}, buildOptions =
 		"      error: { code: \"network_error\", message: String((error && error.message) || error) },",
 		"    };",
 		"  }",
+		"  let result;",
 		"  try {",
-		"    return await response.json();",
+		"    result = await response.json();",
 		"  } catch {",
 		"    return {",
 		"      ok: false,",
@@ -1535,6 +1633,23 @@ function createPrachtCapabilitiesClientModuleSource(options = {}, buildOptions =
 		"      },",
 		"    };",
 		"  }",
+		"  if (",
+		"    !result || typeof result !== \"object\" ||",
+		"    (result.ok !== true && result.ok !== false) ||",
+		"    (result.ok === true && !(\"data\" in result)) ||",
+		"    (result.ok === false &&",
+		"      (!result.error || typeof result.error !== \"object\" ||",
+		"        typeof result.error.code !== \"string\" || typeof result.error.message !== \"string\"))",
+		"  ) {",
+		"    return {",
+		"      ok: false,",
+		"      error: {",
+		"        code: \"invalid_response\",",
+		"        message: `Capability endpoint returned an invalid envelope (status ${response.status}).`,",
+		"      },",
+		"    };",
+		"  }",
+		"  return result;",
 		"}",
 		"",
 		"export async function callCapability(name, input, opts) {",
@@ -1565,6 +1680,38 @@ function createPrachtCapabilitiesClientModuleSource(options = {}, buildOptions =
 		"  } catch {}",
 		"  return result;",
 		"}",
+		"",
+		"// Nested client: dotted capability names become object paths, so",
+		"// `capabilities.notes.search(input)` calls `callCapability(\"notes.search\", input)`.",
+		"// Built from the same endpoint table, so there is one dispatch path.",
+		"function buildCapabilityClient(names) {",
+		"  const root = Object.create(null);",
+		"  for (const name of names) {",
+		"    const segments = name.split(\".\");",
+		"    const leaf = segments.pop();",
+		"    let node = root;",
+		"    for (const segment of segments) {",
+		"      // A name that is both a namespace and a leaf (`a` plus `a.b`) would",
+		"      // collide; the namespace wins and the leaf stays reachable through",
+		"      // callCapability(). `pracht verify` reports the shadowed name.",
+		"      if (typeof node[segment] !== \"object\" || node[segment] === null) {",
+		"        node[segment] = Object.create(null);",
+		"      }",
+		"      node = node[segment];",
+		"    }",
+		"    if (typeof node[leaf] !== \"object\") {",
+		"      node[leaf] = (input, opts) => callCapability(name, input, opts);",
+		"    }",
+		"  }",
+		"  return root;",
+		"}",
+		"",
+		"export const capabilities = /*@__PURE__*/ buildCapabilityClient(Object.keys(endpoints));",
+		"",
+		"// The hook's implementation lives in @pracht/core (typed and unit-tested);",
+		"// only the app-specific dispatch is bound here, so every projection shares",
+		"// one call path. Pure-annotated: apps that never call it pay nothing.",
+		"export const useCapability = /*@__PURE__*/ createUseCapability(callCapability);",
 		""
 	].join("\n");
 }
@@ -1654,15 +1801,6 @@ function hasWebmcpCapabilities(options = {}, root = process.cwd()) {
 }
 //#endregion
 //#region src/plugin-codegen.ts
-const ROUTE_MODULE_EXTENSIONS = new Set([
-	".ts",
-	".tsx",
-	".js",
-	".jsx",
-	".md",
-	".mdx",
-	".tsrx"
-]);
 const NON_FULL_HYDRATION_RE = /hydration\s*:\s*["'](?:islands|none)["']/;
 const FULL_HYDRATION_RE = /hydration\s*:\s*["']full["']/;
 const PAGES_NON_FULL_HYDRATION_RE = /export\s+const\s+HYDRATION\s*=\s*["'](?:islands|none)["']/;
@@ -1681,7 +1819,7 @@ function findMatching(source, start, open, close) {
 	}
 	return -1;
 }
-function scanFiles(dir, files) {
+function scanFiles(dir, files, extensions) {
 	let entries;
 	try {
 		entries = readdirSync(dir);
@@ -1696,15 +1834,15 @@ function scanFiles(dir, files) {
 		} catch {
 			continue;
 		}
-		if (stat.isDirectory()) scanFiles(abs, files);
-		else if (ROUTE_MODULE_EXTENSIONS.has(extname(entry))) files.push(abs);
+		if (stat.isDirectory()) scanFiles(abs, files, extensions);
+		else if (extensions.has(extname(entry))) files.push(abs);
 	}
 }
 function createNonFullHydrationExcludes(resolved, root = process.cwd()) {
 	const excludes = /* @__PURE__ */ new Set();
 	if (resolved.pagesDir) {
 		const files = [];
-		scanFiles(resolve(root, resolved.pagesDir.replace(/^\//, "")), files);
+		scanFiles(resolve(root, resolved.pagesDir.replace(/^\//, "")), files, withAdditionalExtensions(DEFAULT_ROUTE_EXTENSIONS, resolved.additionalExtensions));
 		for (const file of files) try {
 			if (PAGES_NON_FULL_HYDRATION_RE.test(readFileSync(file, "utf-8"))) excludes.add(`!/${toPosixPath$1(file).replace(toPosixPath$1(root).replace(/\/$/, "") + "/", "")}`);
 		} catch {}
@@ -1754,15 +1892,18 @@ function createPrachtClientModuleSource(options = {}, buildOptions = {}) {
 	const resolved = resolveOptions(options);
 	const isPagesMode = !!resolved.pagesDir;
 	const routeLoaderHints = createRouteLoaderHintsForVirtualModules(resolved, buildOptions.root);
+	const routeHeadHints = createRouteHeadHintsForVirtualModules(resolved, buildOptions.root);
+	const routeStaticPathsHints = createRouteStaticPathsHintsForVirtualModules(resolved, buildOptions.root);
 	const appImport = isPagesMode ? generatePagesAppInlineSource(resolved, buildOptions.root) : `import { app } from ${JSON.stringify(resolved.appFile)};`;
+	const bareRouteExtensions = [...withAdditionalExtensions(LEGACY_BARE_ROUTE_EXTENSIONS, resolved.additionalExtensions)];
 	const dirPrefix = isPagesMode ? resolved.pagesDir : resolved.routesDir;
 	const routeGlob = `${dirPrefix}/**/*.{ts,tsx,js,jsx,md,mdx}`;
-	const routeTsrxGlob = `${dirPrefix}/**/*.tsrx`;
+	const additionalRouteGlob = `${dirPrefix}/**/*.${extensionGlob(bareRouteExtensions)}`;
 	const routeExcludes = createNonFullHydrationExcludes(resolved, buildOptions.root);
 	const routeGlobPattern = routeExcludes.length > 0 ? [routeGlob, ...routeExcludes] : routeGlob;
-	const routeTsrxGlobPattern = routeExcludes.length > 0 ? [routeTsrxGlob, ...routeExcludes] : routeTsrxGlob;
+	const additionalRouteGlobPattern = additionalRouteGlob && routeExcludes.length > 0 ? [additionalRouteGlob, ...routeExcludes] : additionalRouteGlob;
 	const shellGlob = isPagesMode ? `${resolved.pagesDir}/**/_app.{ts,tsx,js,jsx}` : `${resolved.shellsDir}/**/*.{ts,tsx,js,jsx,md,mdx}`;
-	const shellTsrxGlob = isPagesMode ? `${resolved.pagesDir}/**/_app.tsrx` : `${resolved.shellsDir}/**/*.tsrx`;
+	const additionalShellGlob = isPagesMode ? `${resolved.pagesDir}/**/_app.${extensionGlob(bareRouteExtensions)}` : `${resolved.shellsDir}/**/*.${extensionGlob(bareRouteExtensions)}`;
 	const appFilePosix = resolved.appFile.replace(/\\/g, "/").replace(/^\.\//, "");
 	const appDir = (appFilePosix.startsWith("/") ? appFilePosix : `/${appFilePosix}`).replace(/\/[^/]*$/, "") || "/";
 	return [
@@ -1770,17 +1911,19 @@ function createPrachtClientModuleSource(options = {}, buildOptions = {}) {
 		appImport,
 		"",
 		`const routeLoaderHints = ${JSON.stringify(routeLoaderHints)};`,
+		`const routeHeadHints = ${JSON.stringify(routeHeadHints)};`,
+		`const routeStaticPathsHints = ${JSON.stringify(routeStaticPathsHints)};`,
 		`const routeModules = {`,
 		`  ...import.meta.glob(${JSON.stringify(routeGlobPattern)}, { query: ${JSON.stringify(PRACHT_CLIENT_MODULE_QUERY)} }),`,
-		`  ...import.meta.glob(${JSON.stringify(routeTsrxGlobPattern)}),`,
+		`  ...import.meta.glob(${JSON.stringify(additionalRouteGlobPattern)}),`,
 		`};`,
 		`const shellModules = {`,
 		`  ...import.meta.glob(${JSON.stringify(shellGlob)}, { query: ${JSON.stringify(PRACHT_CLIENT_MODULE_QUERY)} }),`,
-		`  ...import.meta.glob(${JSON.stringify(shellTsrxGlob)}),`,
+		`  ...import.meta.glob(${JSON.stringify(additionalShellGlob)}),`,
 		`};`,
 		"",
 		"const resolvedApp = resolveApp(app);",
-		"applyRouteLoaderHints(resolvedApp, routeLoaderHints);",
+		"applyRouteHints(resolvedApp, routeLoaderHints, routeHeadHints, routeStaticPathsHints);",
 		"",
 		...createApplyRouteLoaderHintsSource(),
 		`const APP_DIR = ${JSON.stringify(appDir)};`,
@@ -1876,7 +2019,9 @@ function createPrachtServerModuleSource(options = {}, buildOptions = {}) {
 	const isPagesMode = !!resolved.pagesDir;
 	const registrySource = createPrachtRegistryModuleSource(resolved);
 	const routeLoaderHints = createRouteLoaderHintsForVirtualModules(resolved, buildOptions.root);
-	const clientBuild = buildOptions.isBuild ? readClientBuildAssets(buildOptions.root) : {
+	const routeHeadHints = createRouteHeadHintsForVirtualModules(resolved, buildOptions.root);
+	const routeStaticPathsHints = createRouteStaticPathsHintsForVirtualModules(resolved, buildOptions.root);
+	const clientBuild = buildOptions.isBuild ? readClientBuildAssets(buildOptions.root, buildOptions.base ?? "/") : {
 		clientEntryUrl: null,
 		islandsEntryUrl: null,
 		cssManifest: {},
@@ -1884,10 +2029,14 @@ function createPrachtServerModuleSource(options = {}, buildOptions = {}) {
 	};
 	const adapter = resolved.adapter;
 	const llmsTxtConfig = resolveLlmsTxtConfig(resolved, buildOptions.root);
+	const islandsBootstrapRequired = hasWebmcpCapabilities(resolved, buildOptions.root);
 	let prachtImports = adapter?.serverImports ? adapter.serverImports + "\nimport { prerenderApp } from \"@pracht/core/server\";" : "import { resolveApp, resolveApiRoutes, prerenderApp } from \"@pracht/core/server\";";
 	if (llmsTxtConfig) prachtImports += "\nimport { buildLlmsTxt } from \"@pracht/core/server\";";
 	const appImport = isPagesMode ? generatePagesAppInlineSource(resolved, buildOptions.root) : `import { app } from ${JSON.stringify(resolved.appFile)};`;
-	const islandsEntryUrl = buildOptions.isBuild ? clientBuild.islandsEntryUrl : ISLANDS_CLIENT_BROWSER_PATH;
+	const devBase = buildOptions.base ?? "/";
+	const withDevBase = (path) => devBase === "/" ? path : `${devBase}${path.slice(1)}`;
+	const clientEntryUrl = buildOptions.isBuild ? clientBuild.clientEntryUrl : withDevBase(CLIENT_BROWSER_PATH);
+	const islandsEntryUrl = buildOptions.isBuild ? clientBuild.islandsEntryUrl : withDevBase(ISLANDS_CLIENT_BROWSER_PATH);
 	const islandsGlob = `${resolved.islandsDir}/**/*.{ts,tsx,js,jsx}`;
 	const source = [
 		prachtImports,
@@ -1895,6 +2044,8 @@ function createPrachtServerModuleSource(options = {}, buildOptions = {}) {
 		appImport,
 		"",
 		`const routeLoaderHints = ${JSON.stringify(routeLoaderHints)};`,
+		`const routeHeadHints = ${JSON.stringify(routeHeadHints)};`,
+		`const routeStaticPathsHints = ${JSON.stringify(routeStaticPathsHints)};`,
 		...createApplyRouteLoaderHintsSource(),
 		registrySource,
 		"",
@@ -1906,11 +2057,15 @@ function createPrachtServerModuleSource(options = {}, buildOptions = {}) {
 		"export const islandFiles = Object.keys(islandModules);",
 		"",
 		"export const resolvedApp = resolveApp(app);",
-		"applyRouteLoaderHints(resolvedApp, routeLoaderHints);",
+		"applyRouteHints(resolvedApp, routeLoaderHints, routeHeadHints, routeStaticPathsHints);",
 		`export const apiRoutes = resolveApiRoutes(Object.keys(apiModules), ${JSON.stringify(resolved.apiDir)});`,
 		`export const buildTarget = ${JSON.stringify(adapter?.id ?? "node")};`,
-		`export const clientEntryUrl = ${JSON.stringify(clientBuild.clientEntryUrl ?? "/@pracht/client.js")};`,
+		`export const staticTarget = ${JSON.stringify(adapter?.staticTarget === true)};`,
+		`export const buildBase = ${JSON.stringify(buildOptions.base ?? "/")};`,
+		`export const configuredBase = ${JSON.stringify(buildOptions.configuredBase)};`,
+		`export const clientEntryUrl = ${JSON.stringify(clientEntryUrl ?? "/@pracht/client.js")};`,
 		`export const islandsEntryUrl = ${JSON.stringify(islandsEntryUrl ?? null)};`,
+		`export const islandsBootstrapRequired = ${JSON.stringify(islandsBootstrapRequired)};`,
 		`export const cssManifest = ${JSON.stringify(clientBuild.cssManifest)};`,
 		`export const jsManifest = ${JSON.stringify(clientBuild.jsManifest)};`,
 		`export const prerenderConcurrency = ${JSON.stringify(resolved.prerenderConcurrency)};`,
@@ -1936,15 +2091,25 @@ function createPrachtServerModuleSource(options = {}, buildOptions = {}) {
 */
 function createPrachtDevModuleSource(options = {}, buildOptions = {}) {
 	const resolved = resolveOptions(options);
+	const routeLoaderHints = createRouteLoaderHintsForVirtualModules(resolved, buildOptions.root);
+	const routeHeadHints = createRouteHeadHintsForVirtualModules(resolved, buildOptions.root);
+	const routeStaticPathsHints = createRouteStaticPathsHintsForVirtualModules(resolved, buildOptions.root);
 	return [
 		"import { resolveApp, resolveApiRoutes } from \"@pracht/core/server\";",
 		resolved.pagesDir ? generatePagesAppInlineSource(resolved, buildOptions.root) : `import { app } from ${JSON.stringify(resolved.appFile)};`,
 		"",
+		`const routeLoaderHints = ${JSON.stringify(routeLoaderHints)};`,
+		`const routeHeadHints = ${JSON.stringify(routeHeadHints)};`,
+		`const routeStaticPathsHints = ${JSON.stringify(routeStaticPathsHints)};`,
+		...createApplyRouteLoaderHintsSource(),
 		createPrachtRegistryModuleSource(resolved),
 		"",
 		"export const resolvedApp = resolveApp(app);",
+		"applyRouteHints(resolvedApp, routeLoaderHints, routeHeadHints, routeStaticPathsHints);",
 		`export const apiRoutes = resolveApiRoutes(Object.keys(apiModules), ${JSON.stringify(resolved.apiDir)});`,
 		`export const buildTarget = ${JSON.stringify(resolved.adapter?.id ?? "node")};`,
+		`export const staticTarget = ${JSON.stringify(resolved.adapter?.staticTarget === true)};`,
+		`export const buildBase = ${JSON.stringify(buildOptions.base ?? "/")};`,
 		""
 	].join("\n");
 }
@@ -1964,11 +2129,12 @@ function resolveLlmsTxtConfig(resolved, root = process.cwd()) {
 	if (description) config.description = description;
 	if (resolved.llmsTxt.origin) config.origin = resolved.llmsTxt.origin;
 	if (resolved.llmsTxt.include) config.include = resolved.llmsTxt.include;
+	if (resolved.llmsTxt.exclude?.length) config.exclude = resolved.llmsTxt.exclude;
 	return config;
 }
 function createApplyRouteLoaderHintsSource() {
 	return [
-		"function applyRouteLoaderHints(resolvedApp, routeLoaderHints) {",
+		"function applyRouteHints(resolvedApp, routeLoaderHints, routeHeadHints, routeStaticPathsHints) {",
 		"  for (const route of resolvedApp.routes) {",
 		"    const hint = routeLoaderHints[route.file];",
 		"    if (hint === true) {",
@@ -1976,14 +2142,52 @@ function createApplyRouteLoaderHintsSource() {
 		"    } else if (typeof route.hasLoader === 'undefined' && typeof hint === 'boolean') {",
 		"      route.hasLoader = hint;",
 		"    }",
+		"    const routeHeadHint = routeHeadHints[route.file];",
+		"    const shellHeadHint = route.shellFile ? routeHeadHints[route.shellFile] : undefined;",
+		"    const hasCompleteHeadHints = typeof routeHeadHint === 'boolean' &&",
+		"      (!route.shellFile || typeof shellHeadHint === 'boolean');",
+		"    if (routeHeadHint === true || shellHeadHint === true) {",
+		"      route.hasHead = true;",
+		"    } else if (typeof route.hasHead === 'undefined' && hasCompleteHeadHints) {",
+		"      route.hasHead = routeHeadHint === true || shellHeadHint === true;",
+		"    }",
+		"    // Only ever narrows to false, and only when the scan actually saw the",
+		"    // module: an unknown route file keeps today's conservative behavior.",
+		"    const staticPathsHint = routeStaticPathsHints[route.file];",
+		"    if (typeof route.hasStaticPaths === 'undefined' && typeof staticPathsHint === 'boolean') {",
+		"      route.hasStaticPaths = staticPathsHint;",
+		"    }",
 		"  }",
 		"}",
 		""
 	];
 }
+function createRouteHeadHintsForVirtualModules(options, root = process.cwd()) {
+	const appFileDir = dirname(resolve(root, options.appFile.slice(1)));
+	const directories = options.pagesDir ? [[options.pagesDir, resolve(root, options.pagesDir.slice(1))]] : [[options.routesDir, resolve(root, options.routesDir.slice(1))], [options.shellsDir, resolve(root, options.shellsDir.slice(1))]];
+	return Object.assign({}, ...directories.map(([prefix, directory]) => createRouteHeadHints(directory, {
+		additionalExtensions: options.additionalExtensions,
+		appFileDir,
+		rootRelativePrefix: prefix
+	})));
+}
+/**
+* `getStaticPaths()` presence per route file. Only routes matter — a shell
+* cannot enumerate paths — so unlike the head hints this skips the shells
+* directory.
+*/
+function createRouteStaticPathsHintsForVirtualModules(options, root = process.cwd()) {
+	const appFileDir = dirname(resolve(root, options.appFile.slice(1)));
+	const routesPrefix = options.pagesDir || options.routesDir;
+	return createRouteStaticPathsHints(resolve(root, routesPrefix.slice(1)), {
+		additionalExtensions: options.additionalExtensions,
+		appFileDir,
+		rootRelativePrefix: routesPrefix
+	});
+}
 function createRouteLoaderHintsForVirtualModules(options, root = process.cwd()) {
 	if (options.pagesDir) {
-		const pages = scanPagesDirectory(resolve(root, options.pagesDir.slice(1)));
+		const pages = scanPagesDirectory(resolve(root, options.pagesDir.slice(1)), options.additionalExtensions);
 		const hints = {};
 		for (const page of pages) {
 			const key = `${options.pagesDir}/${page.relativePath.replace(/\\/g, "/")}`;
@@ -1993,28 +2197,31 @@ function createRouteLoaderHintsForVirtualModules(options, root = process.cwd())
 	}
 	const appFileDir = dirname(resolve(root, options.appFile.slice(1)));
 	return createRouteLoaderHints(resolve(root, options.routesDir.slice(1)), {
+		additionalExtensions: options.additionalExtensions,
 		appFileDir,
 		rootRelativePrefix: options.routesDir
 	});
 }
 function createPrachtRegistryModuleSource(options = {}) {
 	const resolved = resolveOptions(options);
+	const apiGlobs = [`${resolved.apiDir}/**/*.{ts,js,tsx,jsx}`, `!${resolved.apiDir}/**/*.d.ts`];
 	const isPagesMode = !!resolved.pagesDir;
+	const bareRouteExtensions = [...withAdditionalExtensions(LEGACY_BARE_ROUTE_EXTENSIONS, resolved.additionalExtensions)];
 	const routeGlob = isPagesMode ? `${resolved.pagesDir}/**/*.{ts,tsx,js,jsx,md,mdx}` : `${resolved.routesDir}/**/*.{ts,tsx,js,jsx,md,mdx}`;
-	const routeTsrxGlob = isPagesMode ? `${resolved.pagesDir}/**/*.tsrx` : `${resolved.routesDir}/**/*.tsrx`;
+	const additionalRouteGlob = `${isPagesMode ? resolved.pagesDir : resolved.routesDir}/**/*.${extensionGlob(bareRouteExtensions)}`;
 	const shellGlob = isPagesMode ? `${resolved.pagesDir}/**/_app.{ts,tsx,js,jsx}` : `${resolved.shellsDir}/**/*.{ts,tsx,js,jsx,md,mdx}`;
-	const shellTsrxGlob = isPagesMode ? `${resolved.pagesDir}/**/_app.tsrx` : `${resolved.shellsDir}/**/*.tsrx`;
+	const additionalShellGlob = isPagesMode ? `${resolved.pagesDir}/**/_app.${extensionGlob(bareRouteExtensions)}` : `${resolved.shellsDir}/**/*.${extensionGlob(bareRouteExtensions)}`;
 	return [
 		`export const routeModules = {`,
 		`  ...import.meta.glob(${JSON.stringify(routeGlob)}),`,
-		`  ...import.meta.glob(${JSON.stringify(routeTsrxGlob)}),`,
+		`  ...import.meta.glob(${JSON.stringify(additionalRouteGlob)}),`,
 		`};`,
 		`export const shellModules = {`,
 		`  ...import.meta.glob(${JSON.stringify(shellGlob)}),`,
-		`  ...import.meta.glob(${JSON.stringify(shellTsrxGlob)}),`,
+		`  ...import.meta.glob(${JSON.stringify(additionalShellGlob)}),`,
 		`};`,
 		`export const middlewareModules = import.meta.glob(${JSON.stringify(`${resolved.middlewareDir}/**/*.{ts,tsx,js,jsx}`)});`,
-		`export const apiModules = import.meta.glob(${JSON.stringify(`${resolved.apiDir}/**/*.{ts,js,tsx,jsx}`)});`,
+		`export const apiModules = import.meta.glob(${JSON.stringify(apiGlobs)});`,
 		`export const dataModules = import.meta.glob(${JSON.stringify(`${resolved.serverDir}/**/*.{ts,js,tsx,jsx}`)});`,
 		`export const capabilityModules = import.meta.glob(${JSON.stringify(`${resolved.capabilitiesDir}/**/*.{ts,js,tsx,jsx}`)});`,
 		"",
@@ -2035,13 +2242,15 @@ function clearPagesAppSourceCache() {
 function generatePagesAppInlineSource(options, root = process.cwd()) {
 	const absPagesDir = resolve(root, options.pagesDir.slice(1));
 	const cacheKey = JSON.stringify({
+		additionalExtensions: options.additionalExtensions,
 		absPagesDir,
 		pagesDefaultRender: options.pagesDefaultRender,
 		pagesDirPrefix: options.pagesDir
 	});
 	const cached = pagesAppSourceCache.get(cacheKey);
 	if (cached) return cached;
-	const source = generatePagesManifestSource(scanPagesDirectory(absPagesDir), {
+	const source = generatePagesManifestSource(scanPagesDirectory(absPagesDir, options.additionalExtensions), {
+		additionalExtensions: options.additionalExtensions,
 		pagesDir: absPagesDir,
 		pagesDefaultRender: options.pagesDefaultRender,
 		pagesDirPrefix: options.pagesDir
@@ -2056,8 +2265,46 @@ const DEFAULT_MAX_BODY_SIZE = 1024 * 1024;
 const CSS_MODULE_URL_RE = /\.(?:css|less|sass|scss|styl|stylus|pcss|postcss|sss)(?:$|\?)/;
 const DEVTOOLS_JSON_PATH = "/_pracht.json";
 const LLMS_TXT_PATH = "/llms.txt";
+function isEventStreamContentType(contentType) {
+	return contentType.split(";", 1)[0]?.trim().toLowerCase() === "text/event-stream";
+}
+/**
+* Adapter-owned dev servers can route every browser request through their
+* platform runtime before Vite's transform middleware gets a chance to serve
+* Pracht's stable virtual client entries. Serve those two entries at their
+* public, base-prefixed URLs while leaving every other request to the adapter.
+*/
+function createOwnedDevEntryMiddleware(server) {
+	const base = server.config.base || "/";
+	return async (req, res, next) => {
+		const method = (req.method ?? "GET").toUpperCase();
+		if (method !== "GET" && method !== "HEAD") return next();
+		const requestUrl = new URL(req.url ?? "/", "http://localhost");
+		const pathname = base === "/" ? requestUrl.pathname : requestUrl.pathname.startsWith(base) ? `/${requestUrl.pathname.slice(base.length)}` : null;
+		if (pathname !== "/@pracht/client.js" && pathname !== "/@pracht/islands.js") return next();
+		try {
+			const result = await server.transformRequest(`${pathname}${requestUrl.search}`);
+			if (!result) return next();
+			if (result.etag && req.headers["if-none-match"] === result.etag) {
+				res.statusCode = 304;
+				res.end();
+				return;
+			}
+			res.statusCode = 200;
+			res.setHeader("content-type", "text/javascript");
+			res.setHeader("cache-control", "no-cache");
+			if (result.etag) res.setHeader("etag", result.etag);
+			for (const [name, value] of Object.entries(server.config.server.headers ?? {})) if (value !== void 0) res.setHeader(name, value);
+			res.end(method === "HEAD" ? void 0 : result.code);
+		} catch (error) {
+			next(error);
+		}
+	};
+}
 function createDevSSRMiddleware(server, options = {}) {
 	const maxBodySize = options.maxBodySize ?? DEFAULT_MAX_BODY_SIZE;
+	const devBase = server.config.base || "/";
+	const withDevBase = (path) => devBase === "/" || !path.startsWith("/") ? path : `${devBase}${path.slice(1)}`;
 	let warnedDevtoolsCollision = false;
 	let warnedLlmsTxtCollision = false;
 	if (options.llmsTxt && typeof server.config.publicDir === "string") {
@@ -2082,6 +2329,7 @@ function createDevSSRMiddleware(server, options = {}) {
 				await serveDevtools(server, res, {
 					apiRoutes: serverMod.apiRoutes ?? [],
 					app: serverMod.resolvedApp,
+					base: devBase,
 					url,
 					wantsJson: requestUrl.pathname === DEVTOOLS_JSON_PATH
 				});
@@ -2095,14 +2343,17 @@ function createDevSSRMiddleware(server, options = {}) {
 				const llmsTxt = await serverMod.generateLlmsTxt();
 				res.statusCode = 200;
 				res.setHeader("content-type", "text/plain; charset=utf-8");
+				applyDefaultSecurityHeaders(new Headers()).forEach((value, key) => {
+					res.setHeader(key, value);
+				});
 				res.end(llmsTxt);
 				return;
 			}
 			if (shouldBypassDevSSR(requestUrl, req, routeMatchers)) return next();
-			if (isDevNotFoundRequest(requestUrl, req, routeMatchers)) return serveDevNotFound(server, res, next, url, requestUrl.pathname, routeMatchers);
+			if (isDevNotFoundRequest(requestUrl, req, routeMatchers)) return serveDevNotFound(server, res, next, url, requestUrl.pathname, routeMatchers, devBase);
 			let webRequest;
 			try {
-				webRequest = await nodeToWebRequest(req, maxBodySize);
+				webRequest = await nodeToWebRequest(req, maxBodySize, devBase);
 			} catch (err) {
 				if (err instanceof Error && err.message === "Request body too large") {
 					res.statusCode = 413;
@@ -2117,15 +2368,36 @@ function createDevSSRMiddleware(server, options = {}) {
 				registry: serverMod.registry,
 				request: webRequest,
 				debugErrors: true,
-				clientEntryUrl: CLIENT_BROWSER_PATH,
+				clientEntryUrl: withDevBase(CLIENT_BROWSER_PATH),
+				islandsEntryUrl: withDevBase(ISLANDS_CLIENT_BROWSER_PATH),
+				islandsBootstrapRequired: serverMod.islandsBootstrapRequired === true,
 				apiRoutes: serverMod.apiRoutes,
 				timings
 			});
 			const responseContentType = response.headers.get("content-type") ?? "";
 			if (response.status === 404 && !responseContentType.includes("application/json") && !routeMatchers.app?.notFound) return next();
-			const contentType = response.headers.get("content-type") ?? "text/html";
+			const contentType = response.headers.get("content-type") ?? "";
+			if (response.body && isEventStreamContentType(contentType)) {
+				res.statusCode = response.status;
+				response.headers.forEach((value, key) => {
+					res.setHeader(key, value);
+				});
+				const source = Readable.fromWeb(response.body);
+				if (res.destroyed || res.writableEnded) {
+					source.destroy();
+					return;
+				}
+				res.on("close", () => {
+					if (!res.writableFinished) source.destroy();
+				});
+				source.on("error", () => {
+					res.destroy();
+				});
+				source.pipe(res);
+				return;
+			}
 			let body = await response.text();
-			if (contentType.includes("text/html")) body = await server.transformIndexHtml(url, body);
+			if (contentType.includes("text/html")) body = await transformDevHtml(server, url, body, devBase);
 			res.statusCode = response.status;
 			response.headers.forEach((value, key) => {
 				res.setHeader(key, value);
@@ -2134,7 +2406,56 @@ function createDevSSRMiddleware(server, options = {}) {
 			if (serverTiming) res.setHeader("Server-Timing", serverTiming);
 			res.end(body);
 		} catch (error) {
-			await handleDevError(server, req, res, next, url, error);
+			await handleDevError(server, req, res, next, url, error, devBase);
+		}
+	};
+}
+/**
+* Vite's HTML transform adds `config.base` to root-absolute asset attributes.
+* Pracht's runtime has already added it to URLs produced by `withBase()` — the
+* client entry, route-state preloads, image endpoints, and user-authored asset
+* URLs — while Vite-owned or module-graph URLs still need the transform. Hide
+* the already-based strings while the hooks run, then restore them afterward,
+* so each producer applies the deploy base exactly once.
+*/
+async function transformDevHtml(server, url, html, base) {
+	if (base === "/") return server.transformIndexHtml(url, html);
+	const assetUrls = protectRootAbsoluteAssetAttributes(html);
+	let placeholder = "https://pracht.invalid/__PRACHT_DEV_BASE_PLACEHOLDER__/";
+	while (assetUrls.html.includes(placeholder)) placeholder += "_";
+	const protectedHtml = assetUrls.html.replaceAll(base, placeholder);
+	const transformedHtml = await server.transformIndexHtml(url, protectedHtml);
+	return assetUrls.restore(transformedHtml.replaceAll(placeholder, base));
+}
+const HTML_ASSET_URL_ATTRIBUTE_RE = /(\s(?:src|href|xlink:href|data|srcset|imagesrcset|poster|content)\s*=\s*)(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+))/gi;
+/**
+* Runtime-rendered root-absolute asset URLs have already reached their final
+* public meaning: raw `/logo.svg` deliberately stays at the origin root,
+* while `withBase("/logo.svg")` is already under the deploy base. Vite's dev
+* HTML pass prefixes both, unlike production SSR, so hide complete attribute
+* values behind inert external URLs until that pass finishes.
+*/
+function protectRootAbsoluteAssetAttributes(html) {
+	let markerPrefix = "https://pracht.invalid/__PRACHT_DEV_ASSET_PLACEHOLDER__/";
+	while (html.includes(markerPrefix)) markerPrefix += "_";
+	const replacements = [];
+	return {
+		html: html.replace(HTML_ASSET_URL_ATTRIBUTE_RE, (match, prefix, doubleQuoted, singleQuoted, unquoted) => {
+			const value = doubleQuoted ?? singleQuoted ?? unquoted ?? "";
+			if (!(/(?:srcset)\s*=\s*$/i.test(prefix) ? /(?:^|,)\s*\/(?!\/)/.test(value) : /^\s*\/(?!\/)/.test(value))) return match;
+			const marker = `${markerPrefix}${replacements.length}`;
+			replacements.push({
+				marker,
+				value
+			});
+			if (doubleQuoted !== void 0) return `${prefix}"${marker}"`;
+			if (singleQuoted !== void 0) return `${prefix}'${marker}'`;
+			return `${prefix}${marker}`;
+		}),
+		restore(transformedHtml) {
+			let restoredHtml = transformedHtml;
+			for (const { marker, value } of replacements) restoredHtml = restoredHtml.replaceAll(marker, value);
+			return restoredHtml;
 		}
 	};
 }
@@ -2146,7 +2467,7 @@ function createDevSSRMiddleware(server, options = {}) {
 * avoid a first-paint FOUC.
 */
 async function createDevCssManifest(server, options) {
-	const route = options.matchAppRoute(options.app, options.pathname)?.route ?? options.app.notFound;
+	const route = options.pathname === null ? void 0 : options.matchAppRoute(options.app, options.pathname)?.route ?? options.app.notFound;
 	if (!route) return {};
 	const manifest = {};
 	const modules = [...route.shellFile ? [{
@@ -2195,18 +2516,19 @@ function collectDevCssUrls(entry) {
 	}
 	return [...urls];
 }
-function injectDevCssLinks(html, manifest) {
+function injectDevCssLinks(html, manifest, base = "/") {
 	if (!html.includes("</head>")) return html;
-	const tags = [...new Set(Object.values(manifest).flat())].map((url) => escapeHtmlAttribute(url)).filter((escapedUrl) => !html.includes(`href="${escapedUrl}"`)).map((escapedUrl) => `<link rel="stylesheet" href="${escapedUrl}">`);
+	const tags = [...new Set(Object.values(manifest).flat().map((url) => base === "/" || !url.startsWith("/") ? url : `${base}${url.slice(1)}`))].map((url) => escapeHtmlAttribute(url)).filter((escapedUrl) => !html.includes(`href="${escapedUrl}"`)).map((escapedUrl) => `<link rel="stylesheet" href="${escapedUrl}">`);
 	if (tags.length === 0) return html;
 	return html.replace("</head>", `    ${tags.join("\n    ")}\n  </head>`);
 }
-async function injectDevCssForPath(server, path, html) {
-	return injectDevCssLinks(html, await createDevCssManifest(server, await resolveDevCssContextForPath(server, path)));
+async function injectDevCssForPath(server, path, html, options = {}) {
+	return injectDevCssLinks(html, await createDevCssManifest(server, await resolveDevCssContextForPath(server, path, options)), server.config.base || "/");
 }
-async function resolveDevCssContextForPath(server, path) {
+async function resolveDevCssContextForPath(server, path, options = {}) {
 	const [framework, serverMod] = await Promise.all([server.ssrLoadModule("@pracht/core/server"), server.ssrLoadModule(PRACHT_DEV_MODULE_ID)]);
-	const pathname = new URL(path, "http://localhost").pathname;
+	const publicPathname = new URL(path, "http://localhost").pathname;
+	const pathname = options.basePathRetained ? framework.stripBase(publicPathname) : publicPathname;
 	return {
 		app: serverMod.resolvedApp,
 		matchAppRoute: framework.matchAppRoute,
@@ -2228,7 +2550,7 @@ function createDevCssInjectionMiddleware(server) {
 			next();
 			return;
 		}
-		const contextPromise = resolveDevCssContextForPath(server, req.url ?? "/").catch((error) => {
+		const contextPromise = resolveDevCssContextForPath(server, req.url ?? "/", { basePathRetained: true }).catch((error) => {
 			if (!warned) {
 				warned = true;
 				server.config.logger.warn(`[pracht] Could not discover development stylesheets: ${error instanceof Error ? error.message : String(error)}`);
@@ -2259,7 +2581,7 @@ function createDevCssInjectionMiddleware(server) {
 				try {
 					const context = await contextPromise;
 					const manifest = context ? await createDevCssManifest(server, context) : null;
-					originalEnd(manifest ? injectDevCssLinks(body.toString("utf-8"), manifest) : body.toString("utf-8"), done);
+					originalEnd(manifest ? injectDevCssLinks(body.toString("utf-8"), manifest, server.config.base || "/") : body.toString("utf-8"), done);
 				} catch {
 					originalEnd(body, done);
 				}
@@ -2307,13 +2629,13 @@ async function serveDevtools(server, res, options) {
 		res.end(JSON.stringify(graph, null, 2));
 		return;
 	}
-	let html = devtools.buildDevtoolsHtml(graph);
+	let html = devtools.buildDevtoolsHtml(graph, { base: options.base });
 	html = await server.transformIndexHtml(options.url, html);
 	res.statusCode = 200;
 	res.setHeader("content-type", "text/html; charset=utf-8");
 	res.end(html);
 }
-async function handleDevError(server, req, res, next, url, error) {
+async function handleDevError(server, req, res, next, url, error, base) {
 	if (error instanceof Error) server.ssrFixStacktrace(error);
 	if (req.headers["x-pracht-route-state-request"] === "1") {
 		res.statusCode = 500;
@@ -2330,7 +2652,8 @@ async function handleDevError(server, req, res, next, url, error) {
 		let html = buildErrorOverlayHtml({
 			message: error instanceof Error ? error.message : String(error),
 			stack: error instanceof Error ? error.stack : void 0,
-			root: server.config.root
+			root: server.config.root,
+			base
 		});
 		html = await server.transformIndexHtml(url, html);
 		res.statusCode = 500;
@@ -2359,11 +2682,12 @@ function isDevNotFoundRequest(requestUrl, req, options = {}) {
 	if (!accept.includes("text/html") && !accept.includes("application/xhtml+xml")) return false;
 	return !matchesResolvedRoute(url.pathname, options);
 }
-async function serveDevNotFound(server, res, next, url, pathname, options) {
+async function serveDevNotFound(server, res, next, url, pathname, options, base) {
 	try {
 		const { buildDevNotFoundHtml } = await server.ssrLoadModule("@pracht/core/dev-404");
 		let html = buildDevNotFoundHtml({
 			apiRoutes: options.apiRoutes.map((route) => ({ path: route.path })),
+			base,
 			requestedPath: pathname,
 			routes: options.app.routes.map((route) => ({
 				path: route.path,
@@ -2444,6 +2768,8 @@ const DEV_ASSET_EXTENSIONS = new Set([
 	".js",
 	".json",
 	".map",
+	".markdown",
+	".md",
 	".mjs",
 	".pdf",
 	".png",
@@ -2456,10 +2782,11 @@ const DEV_ASSET_EXTENSIONS = new Set([
 	".woff2",
 	".xml"
 ]);
-async function nodeToWebRequest(req, maxBodySize) {
+async function nodeToWebRequest(req, maxBodySize, base = "/") {
 	const protocol = "http";
 	const host = req.headers.host ?? "localhost";
-	const url = new URL(req.url ?? "/", `${protocol}://${host}`);
+	const path = req.url ?? "/";
+	const url = new URL(base === "/" || !path.startsWith("/") ? path : `${base}${path.slice(1)}`, `${protocol}://${host}`);
 	const method = req.method ?? "GET";
 	const headers = new Headers();
 	for (const [key, value] of Object.entries(req.headers)) {
@@ -2487,14 +2814,34 @@ async function nodeToWebRequest(req, maxBodySize) {
 }
 //#endregion
 //#region src/index.ts
+function reachesHeadBearingModule(modules, serverRoot, headHints) {
+	const pending = [...modules];
+	const seen = /* @__PURE__ */ new Set();
+	while (pending.length > 0) {
+		const module = pending.pop();
+		if (!module || seen.has(module)) continue;
+		seen.add(module);
+		const modulePath = module.file ?? module.id?.split("?", 1)[0];
+		if (modulePath) {
+			const normalizedPath = toPosixPath(modulePath);
+			if (headHints[normalizedPath.startsWith(serverRoot) ? normalizedPath.slice(serverRoot.length) : normalizedPath] === true) return true;
+		}
+		if (module.importers) pending.push(...module.importers);
+	}
+	return false;
+}
 function pracht(options = {}) {
 	const resolved = resolveOptions(options);
 	const isPagesMode = !!resolved.pagesDir;
 	let root = process.cwd();
 	let routeFileDirs = [];
+	let clientRouteHeadHints = {};
+	const routeFileExtensions = withAdditionalExtensions(DEFAULT_ROUTE_EXTENSIONS, resolved.additionalExtensions);
 	let capabilityModulePaths = /* @__PURE__ */ new Set();
 	if (isPagesMode && options.appFile) console.warn("[pracht] Both `pagesDir` and `appFile` are set. `pagesDir` takes precedence — `appFile` will be ignored.");
 	let isBuild = false;
+	let base = "/";
+	let configuredBase;
 	const prachtPlugin = {
 		name: "pracht",
 		enforce: "pre",
@@ -2502,13 +2849,20 @@ function pracht(options = {}) {
 			const isEdge = resolved.adapter.edge === true;
 			const isSSRBuild = env.isSsrBuild;
 			const configRoot = _config.root ?? process.cwd();
-			const wantsIslandsEntry = env.command === "build" && !isSSRBuild && existsSync(resolveConfigPath(configRoot, resolved.islandsDir));
+			const wantsIslandsEntry = env.command === "build" && !isSSRBuild && (existsSync(resolveConfigPath(configRoot, resolved.islandsDir)) || hasWebmcpCapabilities(resolved, configRoot));
 			const envDir = _config.envDir ? resolve(configRoot, _config.envDir) : configRoot;
 			const publicEnvDefine = JSON.stringify(loadEnv(env.mode, envDir, PUBLIC_ENV_PREFIX));
+			const agentSurfaceDefine = env.command === "build" ? String(hasAgentSurface(resolved, configRoot)) : "true";
+			const staticTargetDefine = String(env.command === "build" && resolved.adapter.staticTarget === true);
 			return {
 				appType: "custom",
 				envPrefix: ["VITE_", PUBLIC_ENV_PREFIX],
-				define: { __PRACHT_PUBLIC_ENV__: publicEnvDefine },
+				resolve: { dedupe: PREACT_DEDUPE },
+				define: {
+					__PRACHT_PUBLIC_ENV__: publicEnvDefine,
+					__PRACHT_AGENT_SURFACE__: agentSurfaceDefine,
+					__PRACHT_STATIC_TARGET__: staticTargetDefine
+				},
 				...isSSRBuild ? {} : { build: { rollupOptions: {
 					...wantsIslandsEntry ? { input: [PRACHT_ISLANDS_CLIENT_MODULE_ID] } : {},
 					output: { manualChunks(id) {
@@ -2520,13 +2874,25 @@ function pracht(options = {}) {
 						noExternal: true,
 						target: "webworker"
 					},
+					environments: { ssr: { resolve: {
+						conditions: [
+							"worker",
+							"module",
+							"browser",
+							"development|production"
+						],
+						external: ["node:module"]
+					} } },
 					build: { rollupOptions: { external: [/^cloudflare:/] } }
-				} : {}
+				} : {},
+				...!isEdge && isSSRBuild ? { ssr: { noExternal: [PRACHT_SSR_NO_EXTERNAL] } } : {}
 			};
 		},
 		configResolved(config) {
+			assertSafeRootAbsoluteDeployBase(config.base);
 			root = config.root;
 			isBuild = config.command === "build";
+			base = config.base;
 			routeFileDirs = computeRouteFileDirs(root, resolved);
 			capabilityModulePaths = new Set(resolveCapabilityModulePaths(resolved, root).map(canonicalFilePath));
 		},
@@ -2542,11 +2908,19 @@ function pracht(options = {}) {
 		},
 		load(id) {
 			if (isIslandsClientModule(id)) return createPrachtIslandsClientModuleSource(resolved, { root });
-			if (isClientModule(id)) return createPrachtClientModuleSource(resolved, { root });
-			if (isDevModule(id)) return createPrachtDevModuleSource(resolved, { root });
+			if (isClientModule(id)) {
+				clientRouteHeadHints = createRouteHeadHintsForVirtualModules(resolved, root);
+				return createPrachtClientModuleSource(resolved, { root });
+			}
+			if (isDevModule(id)) return createPrachtDevModuleSource(resolved, {
+				root,
+				base
+			});
 			if (isServerModule(id)) return createPrachtServerModuleSource(resolved, {
 				root,
-				isBuild
+				isBuild,
+				base,
+				configuredBase
 			});
 			if (isCapabilitiesModule(id)) return createPrachtCapabilitiesClientModuleSource(resolved, { root });
 			if (isWebmcpModule(id)) return createPrachtWebmcpModuleSource(resolved, { root });
@@ -2565,6 +2939,7 @@ function pracht(options = {}) {
 		configureServer(server) {
 			if (isPagesMode) watchPagesDirectory(server, resolved, root);
 			if (resolved.adapter.ownsDevServer) {
+				server.middlewares.use(createOwnedDevEntryMiddleware(server));
 				server.middlewares.use(createDevCssInjectionMiddleware(server));
 				return;
 			}
@@ -2583,14 +2958,29 @@ function pracht(options = {}) {
 				return html;
 			}
 		},
-		handleHotUpdate({ file, server }) {
+		handleHotUpdate({ file, modules = [], server }) {
 			const serverRoot = toPosixPath(server.config.root);
 			const normalizedFile = toPosixPath(file);
 			const relative = normalizedFile.startsWith(serverRoot) ? normalizedFile.slice(serverRoot.length) : normalizedFile;
+			const changesRouteHeadSource = isPagesMode ? relative.startsWith(resolved.pagesDir) : relative.startsWith(resolved.routesDir) || relative.startsWith(resolved.shellsDir);
+			const changesRouteHeadDependency = reachesHeadBearingModule(modules, serverRoot, clientRouteHeadHints);
+			let shouldReloadClientHead = changesRouteHeadDependency;
+			let clientHeadModule;
+			if (changesRouteHeadSource || changesRouteHeadDependency) clientHeadModule = server.moduleGraph.getModuleById(PRACHT_CLIENT_MODULE_ID);
+			if (changesRouteHeadSource) {
+				const previousHint = clientRouteHeadHints[relative];
+				try {
+					const nextHints = createRouteHeadHintsForVirtualModules(resolved, root);
+					shouldReloadClientHead ||= previousHint === true || nextHints[relative] === true;
+					clientRouteHeadHints = nextHints;
+				} catch {
+					shouldReloadClientHead = true;
+				}
+			} else if (changesRouteHeadDependency && clientHeadModule) server.moduleGraph.invalidateModule(clientHeadModule);
 			if (isPagesMode && relative.startsWith(resolved.pagesDir)) {
 				clearPagesAppSourceCache();
 				invalidateVirtualModules(server);
-				sendServerOnlyFullReload(server, file);
+				if (!sendServerOnlyFullReload(server, file) && shouldReloadClientHead && clientHeadModule) return [...new Set([...modules, clientHeadModule])];
 				return;
 			}
 			if (!isPagesMode && relative === resolved.appFile) {
@@ -2610,7 +3000,7 @@ function pracht(options = {}) {
 				if (serverMod) server.moduleGraph.invalidateModule(serverMod);
 				const devMod = server.moduleGraph.getModuleById(PRACHT_DEV_MODULE_ID);
 				if (devMod) server.moduleGraph.invalidateModule(devMod);
-				if (relative.startsWith(resolved.routesDir)) {
+				if (relative.startsWith(resolved.routesDir) || relative.startsWith(resolved.shellsDir)) {
 					const clientMod = server.moduleGraph.getModuleById(PRACHT_CLIENT_MODULE_ID);
 					if (clientMod) server.moduleGraph.invalidateModule(clientMod);
 				}
@@ -2628,7 +3018,16 @@ function pracht(options = {}) {
 					if (capabilityMod) server.moduleGraph.invalidateModule(capabilityMod);
 				}
 			}
-			sendServerOnlyFullReload(server, file);
+			if (!sendServerOnlyFullReload(server, file) && shouldReloadClientHead && clientHeadModule) return [...new Set([...modules, clientHeadModule])];
+		}
+	};
+	const configuredBasePlugin = {
+		name: "pracht:configured-base",
+		config: {
+			order: "post",
+			handler(config) {
+				configuredBase = typeof config.base === "string" ? config.base : void 0;
+			}
 		}
 	};
 	const clientModuleTransformPlugin = {
@@ -2636,7 +3035,7 @@ function pracht(options = {}) {
 		enforce: "post",
 		transform(code, id, transformOptions) {
 			if (!transformOptions?.ssr && isCapabilityModule(id, capabilityModulePaths)) throw new Error(`[pracht] Capability module ${JSON.stringify(toPosixPath(id))} was imported by client code. Capability modules are server-only — their run() implementation and its imports would be bundled for every visitor. Call the capability instead: \`callCapability\`/\`capabilities\` from "virtual:pracht/capabilities" in the browser, or \`invokeCapability\` from "@pracht/core/server" in loaders, middleware, and API routes.`);
-			if (!(isPrachtClientModuleId(id) || !transformOptions?.ssr && isRouteOrShellFile(id, routeFileDirs))) return null;
+			if (!(isPrachtClientModuleId(id) || !transformOptions?.ssr && isRouteOrShellFile(id, routeFileDirs, routeFileExtensions))) return null;
 			const transformed = stripServerOnlyExportsForClient(code, id);
 			if (transformed === code) return null;
 			return {
@@ -2645,11 +3044,12 @@ function pracht(options = {}) {
 			};
 		}
 	};
+	const edgeRuntimeSafetyPlugin = resolved.adapter.edge ? createEdgeRuntimeSafetyPlugin() : null;
 	const optimizeDepsEntriesPlugin = {
 		name: "pracht:optimize-deps-entries",
 		enforce: "post",
 		config(config) {
-			return withPrachtOptimizeDepsEntries(config, createPrachtOptimizeDepsEntries(resolved), createPrachtOptimizeDepsInclude(config.root ?? process.cwd()));
+			return withPrachtOptimizeDepsEntries(config, resolved, createPrachtOptimizeDepsInclude(config.root ?? process.cwd()));
 		}
 	};
 	const precompilePlugin = resolved.precompileSsrJsx ? preactSsrPrecompile({
@@ -2660,14 +3060,99 @@ function pracht(options = {}) {
 		...precompilePlugin ? [precompilePlugin] : [],
 		...preact(),
 		prachtPlugin,
+		configuredBasePlugin,
 		clientModuleTransformPlugin,
+		...edgeRuntimeSafetyPlugin ? [edgeRuntimeSafetyPlugin] : [],
 		createEnvSafetyPlugin(resolved.envSafety)
 	];
-	const adapterPlugins = resolved.adapter.vitePlugins?.();
+	const adapterPlugins = isGraphOnlyMode() ? resolved.adapter.graphVitePlugins?.() : resolved.adapter.vitePlugins?.();
 	if (adapterPlugins?.length) plugins.push(...adapterPlugins);
 	plugins.push(optimizeDepsEntriesPlugin);
 	return plugins;
 }
+function assertSafeRootAbsoluteDeployBase(base) {
+	if (typeof base !== "string" || !base.startsWith("/") || base.startsWith("//")) return;
+	let safe = !base.includes("?") && !base.includes("#");
+	if (safe) try {
+		const segments = base.split("/");
+		safe = segments.every((segment, index) => {
+			if (segment === "" && index !== 0 && index !== segments.length - 1) return false;
+			const decoded = decodeURIComponent(segment);
+			if (decoded === "." || decoded === "..") return false;
+			for (const character of decoded) {
+				const codePoint = character.codePointAt(0);
+				if (character === "/" || character === "\\" || codePoint === 0 || codePoint !== void 0 && (codePoint <= 31 || codePoint === 127)) return false;
+			}
+			return true;
+		});
+	} catch {
+		safe = false;
+	}
+	if (!safe) throw new Error(`[pracht] Vite \`base\` is set to ${JSON.stringify(base)}, but root-absolute deploy bases must contain safe URL segments. Repeated slashes, malformed escapes, and segments that decode to a path separator, \`.\`, \`..\`, NUL, or another control character are not allowed.`);
+}
+function isGraphOnlyMode() {
+	return process.env[PRACHT_GRAPH_ONLY_ENV] === "1";
+}
+function createEdgeRuntimeSafetyPlugin() {
+	let isSsrBuild = false;
+	return {
+		name: "pracht:edge-runtime-safety",
+		apply: "build",
+		enforce: "post",
+		configResolved(config) {
+			isSsrBuild = !!config.build.ssr;
+		},
+		generateBundle(_options, bundle) {
+			const consumer = this.environment?.config?.consumer;
+			if (!(consumer ? consumer === "server" : isSsrBuild)) return;
+			const survivors = [];
+			for (const [fileName, output] of Object.entries(bundle)) {
+				if (output.type !== "chunk") continue;
+				for (const specifier of collectNodeBuiltinImports(this.parse(output.code))) survivors.push({
+					chunk: fileName,
+					specifier
+				});
+			}
+			if (survivors.length === 0) return;
+			this.error([
+				"[pracht] Edge server bundle retains Node.js builtin imports that are unavailable at runtime:",
+				...survivors.map(({ chunk, specifier }) => `  - ${specifier} in ${chunk}`),
+				"Remove the Node-only dependency or move that route to a Node deployment target."
+			].join("\n"));
+		}
+	};
+}
+function collectNodeBuiltinImports(program) {
+	const imports = /* @__PURE__ */ new Set();
+	function sourceValue(node) {
+		if (!node || typeof node !== "object" || !("value" in node)) return null;
+		return typeof node.value === "string" ? node.value : null;
+	}
+	function visit(node) {
+		if (Array.isArray(node)) {
+			for (const item of node) visit(item);
+			return;
+		}
+		if (!node || typeof node !== "object") return;
+		const record = node;
+		const type = record.type;
+		if (type === "ImportDeclaration" || type === "ExportAllDeclaration" || type === "ExportNamedDeclaration" || type === "ImportExpression") {
+			const specifier = sourceValue(record.source);
+			if (specifier && isBuiltin(specifier)) imports.add(specifier);
+		} else if (type === "CallExpression") {
+			const callee = record.callee;
+			const isImport = callee?.type === "Import";
+			const isRequire = callee?.type === "Identifier" && callee.name === "require";
+			if (isImport || isRequire) {
+				const specifier = sourceValue(record.arguments?.[0]);
+				if (specifier && isBuiltin(specifier)) imports.add(specifier);
+			}
+		}
+		for (const value of Object.values(record)) visit(value);
+	}
+	visit(program);
+	return imports;
+}
 const MANIFEST_CORE_IMPORTS = new Set([
 	"defineApp",
 	"group",
@@ -2687,6 +3172,8 @@ const PRACHT_OPTIMIZE_DEPS_INCLUDE = [
 	"@pracht/core/islands-client",
 	"@pracht/core/manifest"
 ];
+const PREACT_DEDUPE = ["preact", "preact-render-to-string"];
+const PRACHT_SSR_NO_EXTERNAL = /^@pracht\//;
 function createPrachtOptimizeDepsInclude(root) {
 	try {
 		if (!toPosixPath(createRequire(join(root, "package.json")).resolve("@pracht/core/package.json")).includes("/node_modules/")) return [];
@@ -2695,8 +3182,9 @@ function createPrachtOptimizeDepsInclude(root) {
 		return [];
 	}
 }
-function withPrachtOptimizeDepsEntries(config, prachtEntries, prachtInclude) {
-	const environments = Object.fromEntries(Object.entries(config.environments ?? {}).map(([name, environment]) => [name, { optimizeDeps: { entries: mergeOptimizeDepsEntries(environment.optimizeDeps?.entries, prachtEntries) } }]));
+function withPrachtOptimizeDepsEntries(config, resolved, prachtInclude) {
+	const prachtEntries = createPrachtOptimizeDepsEntries(resolved, config.optimizeDeps?.extensions);
+	const environments = Object.fromEntries(Object.entries(config.environments ?? {}).map(([name, environment]) => [name, { optimizeDeps: { entries: mergeOptimizeDepsEntries(environment.optimizeDeps?.entries, createPrachtOptimizeDepsEntries(resolved, environment.optimizeDeps?.extensions ?? config.optimizeDeps?.extensions)) } }]));
 	return {
 		optimizeDeps: {
 			entries: mergeOptimizeDepsEntries(config.optimizeDeps?.entries, prachtEntries),
@@ -2705,13 +3193,30 @@ function withPrachtOptimizeDepsEntries(config, prachtEntries, prachtInclude) {
 		...Object.keys(environments).length > 0 ? { environments } : {}
 	};
 }
-function createPrachtOptimizeDepsEntries(resolved) {
+const VITE_SCANNABLE_ROUTE_EXTENSIONS = new Set([
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mts",
+	".mjs",
+	".cts",
+	".cjs",
+	".vue",
+	".svelte",
+	".astro",
+	".imba"
+]);
+function createPrachtOptimizeDepsEntries(resolved, optimizerExtensions) {
 	const scriptExtensions = "{ts,tsx,js,jsx}";
-	const routeExtensions = "{ts,tsx,js,jsx,md,mdx,tsrx}";
+	const explicitlyScannable = new Set(optimizerExtensions ?? []);
+	const routeExtensions = extensionGlob([...new Set([...DEFAULT_ROUTE_EXTENSIONS, ...resolved.additionalExtensions])].filter((extension) => VITE_SCANNABLE_ROUTE_EXTENSIONS.has(extension) || explicitlyScannable.has(extension)));
+	const apiDir = toOptimizeDepsEntry(resolved.apiDir);
+	const apiEntries = [`${apiDir}/**/*.{ts,js,tsx,jsx}`, `!${apiDir}/**/*.d.ts`];
 	const entries = resolved.pagesDir ? [
 		`${toOptimizeDepsEntry(resolved.pagesDir)}/**/*.${routeExtensions}`,
 		`${toOptimizeDepsEntry(resolved.middlewareDir)}/**/*.${scriptExtensions}`,
-		`${toOptimizeDepsEntry(resolved.apiDir)}/**/*.{ts,js,tsx,jsx}`,
+		...apiEntries,
 		`${toOptimizeDepsEntry(resolved.serverDir)}/**/*.{ts,js,tsx,jsx}`,
 		`${toOptimizeDepsEntry(resolved.islandsDir)}/**/*.${scriptExtensions}`
 	] : [
@@ -2719,7 +3224,7 @@ function createPrachtOptimizeDepsEntries(resolved) {
 		`${toOptimizeDepsEntry(resolved.routesDir)}/**/*.${routeExtensions}`,
 		`${toOptimizeDepsEntry(resolved.shellsDir)}/**/*.${routeExtensions}`,
 		`${toOptimizeDepsEntry(resolved.middlewareDir)}/**/*.${scriptExtensions}`,
-		`${toOptimizeDepsEntry(resolved.apiDir)}/**/*.{ts,js,tsx,jsx}`,
+		...apiEntries,
 		`${toOptimizeDepsEntry(resolved.serverDir)}/**/*.{ts,js,tsx,jsx}`,
 		`${toOptimizeDepsEntry(resolved.islandsDir)}/**/*.${scriptExtensions}`,
 		`${toOptimizeDepsEntry(resolved.capabilitiesDir)}/**/*.{ts,js,tsx,jsx}`
@@ -2755,15 +3260,6 @@ function invalidateVirtualModules(server) {
 	if (serverMod) server.moduleGraph.invalidateModule(serverMod);
 	if (devMod) server.moduleGraph.invalidateModule(devMod);
 }
-const ROUTE_FILE_EXTENSIONS = new Set([
-	".ts",
-	".tsx",
-	".js",
-	".jsx",
-	".md",
-	".mdx",
-	".tsrx"
-]);
 function computeRouteFileDirs(root, resolved) {
 	return (resolved.pagesDir ? [resolved.pagesDir] : [resolved.routesDir, resolved.shellsDir]).map((dir) => canonicalFilePath(resolveConfigPath(root, dir))).map(withTrailingSep);
 }
@@ -2794,7 +3290,7 @@ function canonicalFilePath(path) {
 		return toPosixPath(path);
 	}
 }
-function isRouteOrShellFile(id, dirs) {
+function isRouteOrShellFile(id, dirs, extensions) {
 	if (dirs.length === 0) return false;
 	const queryStart = id.indexOf("?");
 	const path = queryStart === -1 ? id : id.slice(0, queryStart);
@@ -2802,7 +3298,7 @@ function isRouteOrShellFile(id, dirs) {
 	const extIndex = path.lastIndexOf(".");
 	if (extIndex === -1) return false;
 	const ext = path.slice(extIndex);
-	if (!ROUTE_FILE_EXTENSIONS.has(ext)) return false;
+	if (!extensions.has(ext)) return false;
 	const normalized = toPosixPath(path);
 	return dirs.some((dir) => normalized.startsWith(dir));
 }