@pyreon/zero 0.21.0 → 0.23.0

package/README.md

@@ -1,6 +1,8 @@
 # @pyreon/zero
 
-Core meta-framework for building full-stack apps with [Pyreon](https://github.com/pyreon/pyreon) and [Vite](https://vite.dev).
+Zero-config full-stack meta-framework — file-system routing, SSR/SSG/ISR/SPA, deploy adapters.
+
+`@pyreon/zero` wraps `@pyreon/server` + `@pyreon/router` + `@pyreon/head` + `@pyreon/vite-plugin` into a single Vite plugin and a conventions-based project layout: `src/routes/` is the route tree (`[param]`, `[...catchAll]`, `_layout`, `_404`, `_loading`, `_error`, `(groups)`), per-file `export const { loader, meta, middleware, getStaticPaths, revalidate, renderMode }` opts into capabilities, and `mode: 'ssr' | 'ssg' | 'isr' | 'spa'` picks the rendering strategy. Production builds run through one of six deploy adapters (Vercel / Cloudflare Pages / Netlify / Node / Bun / static). The main entry is **client-safe**; server-only APIs live at `@pyreon/zero/server`.
 
 ## Install
 
@@ -8,70 +10,222 @@ Core meta-framework for building full-stack apps with [Pyreon](https://github.co
 bun add @pyreon/zero
 ```
 
-## Features
-
-- **File-based routing** — `[param]`, `[...catchAll]`, `_layout`, `_error`, `_loading`, `(groups)`
-- **Rendering modes** — SSR (streaming + string), SSG, ISR, SPA (per-route configurable via `renderMode` export)
-- **API routes** — `.ts` files in `src/routes/api/` export HTTP method handlers (`GET`, `POST`, `PUT`, `DELETE`)
-- **Server actions** — `defineAction()` for mutations with automatic client/server boundary detection
-- **Per-route middleware** — route files export `middleware` using `@pyreon/server`'s signature
-- **Components** — `<Image>` (lazy load, srcset, blur-up), `<Link>` (prefetch, active state), `<Script>` (loading strategies)
-- **Theme** — Dark/light/system with `theme` signal, `<ThemeToggle>`, and anti-flash inline script
-- **Fonts** — Google Fonts self-hosting at build time, local fonts, size-adjusted fallbacks
-- **Image optimization** — Build-time processing via `?optimize` imports (WebP/AVIF, blur placeholders). Type the custom queries with one line — `/// <reference types="@pyreon/zero/image-types" />` — which ships ambient `declare module "*?optimize"` / `"*?component"` / `"*?raw"` reusing the plugin's own `ProcessedImage`.
-- **SEO** — Sitemap, robots.txt, JSON-LD helpers (Vite plugin + dev middleware)
-- **Middleware** — `cacheMiddleware()`, `securityHeaders()`, `corsMiddleware()`, `rateLimitMiddleware()`, `compressionMiddleware()`
-- **Adapters** — Node.js, Bun, static, Vercel, Cloudflare Pages, Netlify Functions
-- **Testing** — `createTestContext()`, `testMiddleware()`, `createTestApiServer()`, `createMockHandler()`
-- **Dev overlay** — Styled error overlay with source-mapped stack traces for SSR errors
-- **CSP middleware** — `cspMiddleware({ directives })` with `useNonce()` for inline scripts
-- **Env validation** — `validateEnv()` with type coercion, `schema()` for custom parsers, `publicEnv()`
-- **Request logging** — `loggerMiddleware()` with structured output
-- **AI integration** — `aiPlugin()` for llms.txt, JSON-LD inference, AI plugin manifest
-- **useRequestLocals()** — Bridge middleware locals into components
-- **Locale-aware favicons** — Per-locale favicon generation from source SVG/PNG
-- **OG image generation** — Build-time Open Graph image rendering
-- **Reactive favicon** — Theme-synced light/dark favicon switching
-- **Client-safe entry** — `@pyreon/zero` = client-safe, `@pyreon/zero/server` = server-only
-
-## Usage
+`sharp` is an optional peer dep — install it (`bun add -D sharp`) only if you use `imagePlugin` / `faviconPlugin` / `ogImagePlugin`.
+
+## Quick start
 
 ```ts
 // vite.config.ts
+import { defineConfig } from 'vite'
 import pyreon from '@pyreon/vite-plugin'
-import zero from '@pyreon/zero'
+import zero from '@pyreon/zero/server'
+
+export default defineConfig({
+  plugins: [
+    pyreon({ islands: true }),
+    zero({
+      mode: 'ssr',             // 'ssr' | 'ssg' | 'isr' | 'spa'
+      ssr: { mode: 'stream' }, // 'string' | 'stream'
+      adapter: 'node',         // 'vercel' | 'cloudflare' | 'netlify' | 'node' | 'bun' | 'static'
+    }),
+  ],
+})
+```
+
+```tsx
+// src/routes/index.tsx — the homepage
+import { useLoaderData } from '@pyreon/router'
 
-export default {
-  plugins: [pyreon(), zero({ mode: 'ssr', ssr: { mode: 'stream' } })],
+export const loader = async () => fetch('/api/hello').then((r) => r.json())
+
+export default function Home() {
+  const data = useLoaderData<{ message: string }>()
+  return <h1>{data.message}</h1>
 }
 ```
 
-## Subpath Exports
-
-| Export                      | Description                                           |
-| --------------------------- | ----------------------------------------------------- |
-| `@pyreon/zero`              | Client-safe: components, middleware, adapters, theme, SEO, fonts |
-| `@pyreon/zero/client`       | Client-side entry (`startClient`)                     |
-| `@pyreon/zero/config`       | `defineConfig`, `resolveConfig`                       |
-| `@pyreon/zero/image`        | `<Image>` component                                   |
-| `@pyreon/zero/link`         | `<Link>`, `useLink`, `createLink`                     |
-| `@pyreon/zero/script`       | `<Script>` component                                  |
-| `@pyreon/zero/theme`        | Theme system and `<ThemeToggle>`                      |
-| `@pyreon/zero/font`         | Font optimization plugin                              |
-| `@pyreon/zero/cache`        | Cache and security middleware                         |
-| `@pyreon/zero/seo`          | SEO plugin, sitemap, robots.txt                       |
-| `@pyreon/zero/image-plugin` | Image optimization Vite plugin                        |
-| `@pyreon/zero/actions`      | `defineAction`, `createActionMiddleware`              |
-| `@pyreon/zero/api-routes`   | API route utilities and middleware                    |
-| `@pyreon/zero/cors`         | CORS middleware                                       |
-| `@pyreon/zero/rate-limit`   | Rate limiting middleware                              |
-| `@pyreon/zero/compression`  | Compression middleware                                |
-| `@pyreon/zero/testing`      | Test utilities for middleware and API routes          |
-| `@pyreon/zero/server`       | Server-only: `createServer`, `validateEnv`, `useNonce`, `useRequestLocals` |
-| `@pyreon/zero/adapter-vercel` | Vercel serverless deployment adapter               |
-| `@pyreon/zero/adapter-cloudflare` | Cloudflare Pages deployment adapter           |
-| `@pyreon/zero/adapter-netlify` | Netlify Functions deployment adapter              |
+```tsx
+// src/routes/_layout.tsx — wraps every route in this subtree
+import { Link, Meta } from '@pyreon/zero'
+
+export default function Layout({ children }) {
+  return (
+    <>
+      <Meta title="My App" description="..." />
+      <nav><Link to="/">Home</Link> <Link to="/posts">Posts</Link></nav>
+      <main>{children}</main>
+    </>
+  )
+}
+```
+
+## File-system routing
+
+| File                       | Role                                                              |
+|----------------------------|-------------------------------------------------------------------|
+| `src/routes/index.tsx`     | `/` — homepage                                                    |
+| `src/routes/about.tsx`     | `/about`                                                          |
+| `src/routes/[id].tsx`      | `/:id` — dynamic param                                            |
+| `src/routes/[...slug].tsx` | `/*` — catch-all                                                  |
+| `src/routes/_layout.tsx`   | Wraps the whole subtree                                           |
+| `src/routes/_404.tsx`      | Not-found page (auto-emitted as `dist/404.html` in SSG)           |
+| `src/routes/_error.tsx`    | Route-level error boundary                                        |
+| `src/routes/_loading.tsx`  | Loader-in-flight component                                        |
+| `src/routes/(group)/x.tsx` | `/x` — group prefix is stripped from the URL                      |
+| `src/routes/api/*.ts`      | API routes — `export function GET / POST / PUT / DELETE / …`      |
+
+Each route file may also export `loader`, `meta`, `middleware`, `guard`, `getStaticPaths`, `revalidate`, and `renderMode`.
+
+## Rendering modes
+
+```ts
+zero({ mode: 'ssr' })  // server-rendered per request (default)
+zero({ mode: 'ssg' })  // prerender every static path at build time → dist/<path>/index.html
+zero({ mode: 'isr' })  // SSR + in-memory LRU cache, on-demand revalidation
+zero({ mode: 'spa' })  // client-only — single dist/index.html shell
+```
+
+Per-route override: `export const renderMode = 'ssg'`.
+
+## SSG
+
+```tsx
+// src/routes/posts/[slug].tsx — enumerate static paths at build time
+import type { GetStaticPaths } from '@pyreon/zero/server'
+
+export const getStaticPaths: GetStaticPaths<{ slug: string }> = async () => {
+  const posts = await loadAllPosts()
+  return posts.map((p) => ({ params: { slug: p.slug } }))
+}
+
+export const revalidate = 3600 // optional — build-time ISR (per platform adapter)
+
+export const loader = ({ params }) => fetchPost(params.slug)
+export default function Post() { /* ... */ }
+```
+
+SSG features (all on by default; opt out via `ssg: { ... }`):
+
+- `_404.tsx` → `dist/404.html` (per-locale variants if i18n configured)
+- Loader-thrown `redirect()` → `dist/_redirects` (Netlify/Cloudflare) + `_redirects.json` (Vercel)
+- Sitemap auto-emit (via `seoPlugin({ sitemap: { useSsgPaths: true } })`)
+- Concurrent rendering (`ssg.concurrency`, default 4) + per-path `onProgress` callbacks
+- Render-error fallback via `ssg.onPathError`; structured `_pyreon-ssg-errors.json` artifact
+- Path-collision detection (loud build failure on duplicate URLs)
+
+## ISR
+
+```ts
+zero({ mode: 'isr', isr: { revalidate: 60, maxEntries: 1000 } })
+```
+
+In-memory LRU SSR cache with TTL revalidation. **Default keys cache by `url.pathname` only** — for auth-gated pages, supply `cacheKey: (req) => …` that varies on session cookie / user-id header to avoid serving one user's HTML to another.
+
+## Built-in components
+
+```tsx
+import { Image, Link, Script, Meta, Icon, createIcon, createNamedIcon, ThemeToggle } from '@pyreon/zero'
+
+<Image src="/hero.jpg" width={1200} height={600} placeholder="blur" />
+<Link to="/about" prefetch="intent">About</Link>
+<Script strategy="afterInteractive" src="https://analytics.example.com/script.js" />
+<Meta title="..." description="..." />
+<Icon as={MyIconSvgComponent} />          {/* loaded via `?component` */}
+<ThemeToggle />                            {/* light/dark/system mode */}
+```
+
+`<Image>` ships with `imagePlugin` (build-time WebP/AVIF + blur/color placeholders). `<Link>` is `@pyreon/router`'s `RouterLink` re-exported. `<Meta>` writes via `@pyreon/head`.
+
+## Vite plugins (server-only)
+
+```ts
+import { faviconPlugin, iconsPlugin, ogImagePlugin, seoPlugin, aiPlugin } from '@pyreon/zero/server'
+
+// vite.config.ts
+plugins: [
+  zero({ /* ... */ }),
+  iconsPlugin({
+    sets: {
+      ui: { dir: './src/icons/ui' },
+      brand: { dir: './src/icons/brand', mode: 'image' },
+    },
+  }),
+  faviconPlugin({ source: './src/favicon.svg' }),
+  ogImagePlugin({ templates: { default: { /* ... */ } } }),
+  seoPlugin({ sitemap: { useSsgPaths: true }, robots: true }),
+  aiPlugin(), // generates llms.txt + JSON-LD inference + AI plugin manifest
+]
+```
+
+## Deploy adapters
+
+```ts
+import { vercelAdapter, cloudflareAdapter, netlifyAdapter, nodeAdapter, bunAdapter, staticAdapter } from '@pyreon/zero/server'
+
+zero({ adapter: vercelAdapter() })
+// or by string id:
+zero({ adapter: 'cloudflare' })
+```
+
+Each adapter writes its own platform config (`.vercel/output/config.json`, `_routes.json`, `netlify.toml`, etc.) during `closeBundle`. Adapters with revalidation support (`vercel` / `cloudflare` / `netlify`) implement `Adapter.revalidate(path)` — pair with `vercelRevalidateHandler` for the canonical webhook scaffold.
+
+## Server middleware
+
+```ts
+import { compose } from '@pyreon/zero/server'
+import { cspMiddleware, useNonce } from '@pyreon/zero/csp'
+import { loggerMiddleware } from '@pyreon/zero/logger'
+import { corsMiddleware } from '@pyreon/zero/cors'
+import { rateLimitMiddleware } from '@pyreon/zero/rate-limit'
+import { compressionMiddleware } from '@pyreon/zero/compression'
+
+const handler = compose([
+  loggerMiddleware(),
+  corsMiddleware({ origin: 'https://app.example.com' }),
+  rateLimitMiddleware({ windowMs: 60_000, max: 100 }),
+  cspMiddleware({ directives: { 'script-src': ["'self'", "'nonce-{nonce}'"] } }),
+  compressionMiddleware(),
+])
+```
+
+## i18n routing
+
+```ts
+zero({
+  i18n: { locales: ['en', 'de', 'cs'], defaultLocale: 'en', strategy: 'prefix-except-default' },
+})
+```
+
+Routes are duplicated per locale at build time. `prefix-except-default` keeps the default locale unprefixed (`/about`) and prefixes others (`/de/about`); `prefix` prefixes every locale including the default. Loader context + sitemap hreflang siblings + per-locale `_404.tsx` all compose automatically.
+
+## Subpath exports (server-only)
+
+| Subpath                       | Notes                                                                                |
+|-------------------------------|--------------------------------------------------------------------------------------|
+| `@pyreon/zero/server`         | `createServer`, `createApp`, `createISRHandler`, adapters, plugins, `vercelRevalidateHandler` |
+| `@pyreon/zero/client`         | `startClient`, `hydrateIslands*` re-exports                                          |
+| `@pyreon/zero/config`         | `defineConfig`, `resolveConfig`                                                      |
+| `@pyreon/zero/env`            | `validateEnv`, `publicEnv`, `schema`                                                 |
+| `@pyreon/zero/middleware`     | Generic `Middleware` helpers                                                         |
+| `@pyreon/zero/testing`        | `createTestContext`, `testMiddleware`, `createTestApiServer`                         |
+
+The main entry (`@pyreon/zero`) re-exports browser-safe pieces only — components, theme, i18n helpers. Server APIs imported from the main entry throw a clear error pointing at the right subpath.
+
+## Gotchas
+
+- `@pyreon/zero` ≠ `@pyreon/zero/server` — the main entry is client-safe. Server plugins (`faviconPlugin`, `seoPlugin`, `createServer`) MUST be imported from `/server`. Importing them from the main entry throws at module-load with a pointer to the right path.
+- ISR with auth-gated pages needs `cacheKey: (req) => …` that varies on session — the default keys by `url.pathname` only and will serve one user's HTML to another.
+- `_404.tsx` rendered HTML is emitted by SSG, but **static hosts must be configured to serve it** for unmatched URLs (most managed hosts do this by convention; bare S3 / nginx / Caddy need explicit per-locale `try_files` / `[[redirects]]`).
+- `getStaticPaths` / `revalidate` literal-extraction skips re-exports + non-literal expressions. Inline the value (`export const revalidate = 60`), don't reference a const.
+- `sharp` is optional. Without it, `imagePlugin` falls back to a soft warning in dev and a HARD `vite build` error in prod (never silently ships an image-broken site).
+- Never pass `layout` to `startClient` when using fs-router's `_layout.tsx` convention — the route tree already wraps every page in the layout, and the explicit option double-mounts.
+
+## Documentation
+
+Full docs: [docs.pyreon.dev/docs/zero](https://docs.pyreon.dev/docs/zero) (or `docs/docs/zero.md` in this repo).
+
+SSG-specific guide: [docs.pyreon.dev/docs/ssg](https://docs.pyreon.dev/docs/ssg).
 
 ## License
 
-[MIT](LICENSE)
+MIT

package/lib/_chunks/app-BbPT0Y5M.js

@@ -0,0 +1,36 @@
+import { Fragment, h } from "@pyreon/core";
+import { RouterProvider, RouterView, createRouter } from "@pyreon/router";
+import { HeadProvider } from "@pyreon/head";
+
+//#region src/app.ts
+/**
+* Create a full Zero app — assembles router, head provider, and root layout.
+*
+* Used internally by entry-server and entry-client.
+*/
+function createApp(options) {
+	const router = createRouter({
+		routes: options.routes,
+		mode: options.routerMode ?? "history",
+		...options.url ? { url: options.url } : {},
+		...options.base && options.base !== "/" ? { base: options.base } : {},
+		scrollBehavior: "top"
+	});
+	const hasLayoutInRoutes = options.layout !== void 0 && options.routes.some((r) => r.component === options.layout);
+	if (hasLayoutInRoutes && process.env.NODE_ENV !== "production") console.warn("[Pyreon] `createApp({ layout })` was passed a component that is ALSO a parent route in the matched chain (likely an fs-router `_layout.tsx`). The explicit `layout` option is being ignored to prevent double-mount. Remove the `layout` argument from `createApp`/`startClient` — the fs-router-emitted route handles it.");
+	const Layout = hasLayoutInRoutes ? DefaultLayout : options.layout ?? DefaultLayout;
+	function App() {
+		return h(HeadProvider, null, h(RouterProvider, { router }, h(Layout, null, h(RouterView, null))));
+	}
+	return {
+		App,
+		router
+	};
+}
+function DefaultLayout(props) {
+	return h(Fragment, null, ...Array.isArray(props.children) ? props.children : [props.children]);
+}
+
+//#endregion
+export { createApp as t };
+//# sourceMappingURL=app-BbPT0Y5M.js.map

package/lib/{fs-router-Bacdhsq-.js → _chunks/fs-router-DvBlRzmP.js}

@@ -1,7 +1,23 @@
-import { t as __exportAll } from "./rolldown-runtime-CjeV3_4I.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) {
+		__defProp(target, name, {
+			get: all[name],
+			enumerable: true
+		});
+	}
+	if (!no_symbols) {
+		__defProp(target, Symbol.toStringTag, { value: "Module" });
+	}
+	return target;
+};
+
+//#endregion
 //#region src/fs-router.ts
 var fs_router_exports = /* @__PURE__ */ __exportAll({
 	detectRouteExports: () => detectRouteExports,
@@ -752,7 +768,7 @@ function generateRouteModuleFromRoutes(routes, routesDir, options) {
 		if (errorName) opts.push(`error: ${errorName}`);
 		opts.push(`hmrId: ${JSON.stringify(fullPath)}`);
 		const optsStr = `, { ${opts.join(", ")} }`;
-		imports.push(`const ${name} = lazy(() => import("${fullPath}")${optsStr})`);
+		imports.push(`const ${name} = lazy(() => import(${JSON.stringify(fullPath)})${optsStr})`);
 		return name;
 	}
 	/**
@@ -969,7 +985,7 @@ async function scanRouteFiles(routesDir) {
 */
 async function scanRouteFilesWithExports(routesDir, defaultMode = "ssr") {
 	const { readFile } = await import("node:fs/promises");
-	const { isApiRoute } = await import("./api-routes-CMsLztoj.js").then((n) => n.t);
+	const { isApiRoute } = await import("../api-routes.js");
 	const files = (await scanRouteFiles(routesDir)).filter((f) => !isApiRoute(f));
 	const exportsMap = /* @__PURE__ */ new Map();
 	await Promise.all(files.map(async (filePath) => {
@@ -984,5 +1000,5 @@ async function scanRouteFilesWithExports(routesDir, defaultMode = "ssr") {
 }
 
 //#endregion
-export { generateRouteModuleFromRoutes as a, scanRouteFilesWithExports as c, generateRouteModule as i, fs_router_exports as n, parseFileRoutes as o, generateMiddlewareModule as r, scanRouteFiles as s, filePathToUrlPath as t };
-//# sourceMappingURL=fs-router-Bacdhsq-.js.map
+export { generateRouteModuleFromRoutes as a, scanRouteFilesWithExports as c, generateRouteModule as i, __exportAll as l, fs_router_exports as n, parseFileRoutes as o, generateMiddlewareModule as r, scanRouteFiles as s, filePathToUrlPath as t };
+//# sourceMappingURL=fs-router-DvBlRzmP.js.map

package/lib/_chunks/use-intersection-observer-C6opeplh.js

@@ -0,0 +1,29 @@
+import { onMount, onUnmount } from "@pyreon/core";
+
+//#region src/utils/use-intersection-observer.ts
+/**
+* Observes an element and calls `onIntersect` once it enters the viewport.
+* Automatically disconnects after the first intersection.
+*
+* @param getElement - Getter for the target element (may be undefined before mount).
+* @param onIntersect - Callback fired when the element becomes visible.
+* @param rootMargin - IntersectionObserver rootMargin. Default: "200px".
+*/
+function useIntersectionObserver(getElement, onIntersect, rootMargin = "200px") {
+	onMount(() => {
+		const el = getElement();
+		if (!el) return void 0;
+		const observer = new IntersectionObserver((entries) => {
+			for (const entry of entries) if (entry.isIntersecting) {
+				onIntersect();
+				observer.disconnect();
+			}
+		}, { rootMargin });
+		observer.observe(el);
+		onUnmount(() => observer.disconnect());
+	});
+}
+
+//#endregion
+export { useIntersectionObserver as t };
+//# sourceMappingURL=use-intersection-observer-C6opeplh.js.map

package/lib/actions.js

@@ -1,4 +1,19 @@
 //#region src/actions.ts
+/**
+* Module-level registry of every `defineAction()` call. Lookup is by the
+* `action_<uuid>` string the client sends in `POST /_zero/actions/<id>`.
+*
+* **HMR caveat (dev-only):** the registry uses fresh `crypto.randomUUID()`
+* per `defineAction()` invocation. When Vite hot-replaces a module that
+* calls `defineAction()`, the module re-runs and a NEW entry is inserted
+* — the OLD entry stays in the Map until the dev process exits. Each
+* entry holds `{ id, handler }` (~80 bytes). Bounded by the count of
+* distinct UUIDs minted in the session; a realistic dev session sees
+* <50 entries, so total dev-memory cost stays under ~5KB. Production
+* registers each module exactly once at startup — no leak. A
+* FinalizationRegistry-based purge is tracked as a follow-up; the
+* current cost is too small to justify the WeakRef/finalizer complexity.
+*/
 const actionRegistry = /* @__PURE__ */ new Map();
 /**
 * Define a server action. Returns a callable function that:
@@ -73,12 +88,17 @@ function createActionMiddleware() {
 	};
 }
 async function executeAction(action, req) {
+	const contentType = req.headers.get("content-type") ?? "";
+	let formData = null;
+	let json = null;
 	try {
-		const contentType = req.headers.get("content-type") ?? "";
-		let formData = null;
-		let json = null;
 		if (contentType.includes("application/json")) json = await req.json();
 		else if (contentType.includes("multipart/form-data") || contentType.includes("application/x-www-form-urlencoded")) formData = await req.formData();
+	} catch (err) {
+		console.error("[Pyreon Action] failed to parse request body:", err);
+		return Response.json({ error: "Invalid request body" }, { status: 400 });
+	}
+	try {
 		const result = await action.handler({
 			request: req,
 			formData,
@@ -87,6 +107,7 @@ async function executeAction(action, req) {
 		});
 		return Response.json(result ?? null);
 	} catch (err) {
+		console.error("[Pyreon Action] handler failed:", err);
 		const message = err instanceof Error ? err.message : "Internal server error";
 		return Response.json({ error: message }, { status: 500 });
 	}

package/lib/ai.js

@@ -1,106 +1,5 @@
-//#region src/fs-router.ts
-const ROUTE_EXTENSIONS = [
-	".tsx",
-	".jsx",
-	".ts",
-	".js"
-];
-/**
-* Parse a set of file paths (relative to routes dir) into FileRoute objects.
-*
-* @param files Array of file paths like ["index.tsx", "users/[id].tsx"]
-* @param defaultMode Default rendering mode from config
-* @param exportsMap Optional map of filePath → detected exports. When
-*   provided, the resulting FileRoute objects carry export info that the
-*   code generator uses to optimize imports (skip metadata namespace
-*   imports for routes that only export `default`).
-*/
-function parseFileRoutes(files, defaultMode = "ssr", exportsMap) {
-	return files.filter((f) => ROUTE_EXTENSIONS.some((ext) => f.endsWith(ext))).map((filePath) => {
-		const route = parseFilePath(filePath, defaultMode);
-		const exp = exportsMap?.get(filePath);
-		return exp ? {
-			...route,
-			exports: exp
-		} : route;
-	}).sort(sortRoutes);
-}
-function parseFilePath(filePath, defaultMode) {
-	let route = filePath;
-	for (const ext of ROUTE_EXTENSIONS) if (route.endsWith(ext)) {
-		route = route.slice(0, -ext.length);
-		break;
-	}
-	const fileName = getFileName(route);
-	const isLayout = fileName === "_layout";
-	const isError = fileName === "_error";
-	const isLoading = fileName === "_loading";
-	const isNotFound = fileName === "_404" || fileName === "_not-found";
-	const isCatchAll = route.includes("[...");
-	const parts = route.split("/");
-	parts.pop();
-	const dirPath = parts.filter((s) => !(s.startsWith("(") && s.endsWith(")"))).join("/");
-	const urlPath = filePathToUrlPath(route);
-	return {
-		filePath,
-		urlPath,
-		dirPath,
-		depth: urlPath === "/" ? 0 : urlPath.split("/").filter(Boolean).length,
-		isLayout,
-		isError,
-		isLoading,
-		isNotFound,
-		isCatchAll,
-		renderMode: defaultMode
-	};
-}
-/**
-* Convert a file path (without extension) to a URL path pattern.
-*
-* Examples:
-*   "index"            → "/"
-*   "about"            → "/about"
-*   "users/index"      → "/users"
-*   "users/[id]"       → "/users/:id"
-*   "blog/[...slug]"   → "/blog/:slug*"
-*   "(auth)/login"     → "/login"         (group stripped)
-*   "_layout"          → "/"              (layout marker)
-*/
-function filePathToUrlPath(filePath) {
-	const segments = filePath.split("/");
-	const urlSegments = [];
-	for (const seg of segments) {
-		if (seg.startsWith("(") && seg.endsWith(")")) continue;
-		if (seg === "_layout" || seg === "_error" || seg === "_loading" || seg === "_404" || seg === "_not-found") continue;
-		if (seg === "index") continue;
-		const catchAll = seg.match(/^\[\.\.\.(\w+)\]$/);
-		if (catchAll) {
-			urlSegments.push(`:${catchAll[1]}*`);
-			continue;
-		}
-		const dynamic = seg.match(/^\[(\w+)\]$/);
-		if (dynamic) {
-			urlSegments.push(`:${dynamic[1]}`);
-			continue;
-		}
-		urlSegments.push(seg);
-	}
-	return `/${urlSegments.join("/")}` || "/";
-}
-/** Sort routes: static before dynamic, catch-all last. */
-function sortRoutes(a, b) {
-	if (a.isCatchAll !== b.isCatchAll) return a.isCatchAll ? 1 : -1;
-	if (a.isLayout !== b.isLayout) return a.isLayout ? -1 : 1;
-	const aDynamic = a.urlPath.includes(":");
-	if (aDynamic !== b.urlPath.includes(":")) return aDynamic ? 1 : -1;
-	return a.urlPath.localeCompare(b.urlPath);
-}
-function getFileName(filePath) {
-	const parts = filePath.split("/");
-	return parts[parts.length - 1] ?? "";
-}
+import { o as parseFileRoutes } from "./_chunks/fs-router-DvBlRzmP.js";
 
-//#endregion
 //#region src/ai.ts
 /**
 * Generate llms.txt content from route files and config.

package/lib/client.js

@@ -1,38 +1,8 @@
-import { Fragment, h } from "@pyreon/core";
-import { RouterProvider, RouterView, createRouter, hydrateLoaderData } from "@pyreon/router";
+import { t as createApp } from "./_chunks/app-BbPT0Y5M.js";
+import { h } from "@pyreon/core";
+import { hydrateLoaderData } from "@pyreon/router";
 import { hydrateRoot, mount } from "@pyreon/runtime-dom";
-import { HeadProvider } from "@pyreon/head";
 
-//#region src/app.ts
-/**
-* Create a full Zero app — assembles router, head provider, and root layout.
-*
-* Used internally by entry-server and entry-client.
-*/
-function createApp(options) {
-	const router = createRouter({
-		routes: options.routes,
-		mode: options.routerMode ?? "history",
-		...options.url ? { url: options.url } : {},
-		...options.base && options.base !== "/" ? { base: options.base } : {},
-		scrollBehavior: "top"
-	});
-	const hasLayoutInRoutes = options.layout !== void 0 && options.routes.some((r) => r.component === options.layout);
-	if (hasLayoutInRoutes && process.env.NODE_ENV !== "production") console.warn("[Pyreon] `createApp({ layout })` was passed a component that is ALSO a parent route in the matched chain (likely an fs-router `_layout.tsx`). The explicit `layout` option is being ignored to prevent double-mount. Remove the `layout` argument from `createApp`/`startClient` — the fs-router-emitted route handles it.");
-	const Layout = hasLayoutInRoutes ? DefaultLayout : options.layout ?? DefaultLayout;
-	function App() {
-		return h(HeadProvider, null, h(RouterProvider, { router }, h(Layout, null, h(RouterView, null))));
-	}
-	return {
-		App,
-		router
-	};
-}
-function DefaultLayout(props) {
-	return h(Fragment, null, ...Array.isArray(props.children) ? props.children : [props.children]);
-}
-
-//#endregion
 //#region src/client.ts
 /**
 * Start the client-side app — hydrates SSR content or mounts fresh for SPA.

package/lib/csp.js

@@ -1,14 +1,20 @@
 import { useRequestLocals } from "@pyreon/server";
 
 //#region src/csp.ts
-/** Client-side fallback nonce (dev server, SPA). */
-let _clientNonce = "";
 /**
 * Read the current CSP nonce in a component.
 *
 * SSR: reads from per-request `ctx.locals.cspNonce` via Pyreon's context
 * system — fully isolated between concurrent requests via AsyncLocalStorage.
-* Client/dev: falls back to module-level variable set by middleware.
+*
+* Returns `''` outside an active request context (client-side after
+* hydration, dev preview, or any render path that bypassed the CSP
+* middleware). Nonces are SSR-only by design: a client-side nonce
+* mirrored from the last SSR request is a cross-request bleed waiting
+* to happen, and a build-time-baked nonce would defeat the entire CSP
+* mechanism. If you need a script-tag nonce, render the script during
+* SSR through `useNonce()` so the value the browser sees IS the value
+* the response's `Content-Security-Policy` header authorized.
 *
 * @example
 * ```tsx
@@ -23,7 +29,7 @@ let _clientNonce = "";
 function useNonce() {
 	const locals = useRequestLocals();
 	if (locals.cspNonce) return locals.cspNonce;
-	return _clientNonce;
+	return "";
 }
 const DIRECTIVE_MAP = {
 	defaultSrc: "default-src",
@@ -112,12 +118,9 @@ function cspMiddleware(config) {
 	const headerName = config.reportOnly ? "Content-Security-Policy-Report-Only" : "Content-Security-Policy";
 	const staticHeader = Object.values(config.directives).some((v) => Array.isArray(v) && v.includes("'nonce'")) ? null : buildCspHeader(config.directives);
 	return (ctx) => {
-		if (staticHeader) {
-			_clientNonce = "";
-			ctx.headers.set(headerName, staticHeader);
-		} else {
+		if (staticHeader) ctx.headers.set(headerName, staticHeader);
+		else {
 			const nonce = generateNonce();
-			_clientNonce = nonce;
 			ctx.locals.cspNonce = nonce;
 			ctx.headers.set(headerName, buildCspHeader(config.directives, nonce));
 		}

package/lib/favicon.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
-import { readFile } from "node:fs/promises";
 import { join } from "node:path";
+import { readFile } from "node:fs/promises";
 
 //#region src/favicon.ts
 /**