@stopnetic/js 0.0.4-pilot → 0.0.6-pilot

package/README.md

@@ -6,18 +6,23 @@ frontend build. No React/Vue/Angular dependency or version upgrade is required.
 The hosting server must run Node.js 22 or newer. This is an MIT-licensed pilot SDK;
 hosted production/provider validation is still required before paid rollout.
 
-Version **0.0.4-pilot is prepared locally; it is not published yet**. It adds
-complete copyable React Router, Angular Router/HttpClient, Vue Router, Svelte,
-Solid Router and plain JavaScript examples to the generated guide and package.
-Unchanged 0.0.2/0.0.3 guides migrate safely; custom edits require merging.
+Version **0.0.6-pilot is prepared locally; it is not published yet**. It adds
+framework-specific SSR instructions and a dashboard SSR selector for Angular,
+React Router, custom React SSR, Nuxt, custom Vue SSR, SvelteKit, Astro, SolidStart
+and custom Node servers. Examples identify the actual server entry, prerender
+settings, deployed Node runtime and context/body preservation. Next.js uses its
+dedicated adapter; other languages/Edge are explicitly outside this Node SDK.
+Unchanged 0.0.2/0.0.3/0.0.4/0.0.5 guides migrate safely; custom edits require merging.
+SSR and static rendering remain separate choices, with document navigation
+default and no global checking screen. Optional browser demos remain available.
 Angular, React, Vue, Svelte, Solid and plain JavaScript share the browser/server
 contracts; no React dependency is required. See the
 [complete generated guide](dist/client-guide.md) for SSR, static builds, frameworks,
 client navigation, API protection and runtime restrictions.
 
-The currently published **0.0.3-pilot** includes the framework-independent
-server/browser setup, complete Node application wrapper and older-guide
-migration. Version 0.0.2 added the reusable browser/server setup for Netlify, Vercel
+The currently published **0.0.5-pilot** clarifies rendering/navigation and includes full frontend examples and the
+framework-independent server/browser setup, complete Node application wrapper
+and older-guide migration. Version 0.0.2 added the reusable browser/server setup for Netlify, Vercel
 and Node/Express, a browser access check and optional React boundary. It also
 normalizes public PEM formatting and rejects placeholder or reused installation
 keys as cookie secrets. Install the published pilot with:
@@ -28,7 +33,44 @@ npm install @stopnetic/js@pilot
 
 ## Framework implementation examples
 
-The guide and `examples/frontend` contain complete, locally tested examples:
+SSR apps use the **SSR framework** selector, not the optional browser-demo
+selector. [Framework SSR instructions](dist/client-guide.md#ssr-framework-instructions)
+and `examples/ssr` contain matching server code:
+
+| SSR app | Server connection |
+| --- | --- |
+| Angular | AngularAppEngine Fetch entry or Express before AngularNodeAppEngine |
+| React Router | Existing Express entry; single-fetch `.data` aliases use page policy |
+| Custom React / Vue | Guard before the existing Node renderer; keep hydration |
+| Nuxt 3/4 (Nitro 2/H3 1) | Root Node server middleware before rendering/APIs |
+| SvelteKit | `handle` before `resolve(event)`; canonical page check for data requests |
+| Astro | `onRequest` before `next()` with an existing Node adapter |
+| SolidStart 1 / 2 | Version-specific request middleware before continuation |
+| Custom Node / plain JavaScript | Root Express middleware or complete Fetch wrapper |
+| Next.js | Dedicated `@stopnetic/next` guide |
+
+Merge existing files/context, preserve public routes and keep protected output
+out of prerender/static/CDN caches. These manual snippets are not automatic
+framework installers. Node compatibility does not validate a live provider.
+Only dashboard rules decide verification; Angular-specific flags are not instructions
+for other frameworks. React/Vue libraries without a server use the static option.
+
+To test server continuation contracts after `npm run build`, run
+`node tests/prepare-ssr-guide-tests.mjs`, then `node tests/ssr-guide-check.mjs`.
+Dependencies remain in ignored test-results. Native H3 1/2 and Express exercise
+signed access, control isolation, data aliases and unread POST bodies. Astro,
+SvelteKit and SolidStart factory imports use contract shims, not full framework
+builds. Angular's separate fixture compiles/renders real SSR. Live routing,
+prerender/cache behavior and complete framework/provider builds still need validation.
+
+The guide and `examples/frontend` contain complete, locally tested OPTIONAL
+browser-only SPA examples. The default document-navigation integration needs
+the server guard and normal links, not these full-layout browser gates. Keep SSR
+and hydration; do not apply the browser demos to an existing SSR root. A runtime
+incompatibility needs a deployment decision, not an automatic conversion to CSR.
+Dashboard policies decide which paths require verification; demo paths are not
+instructions to protect every page. SPA checks still evaluate public targets
+asynchronously and can show a brief empty pending state. The examples are:
 
 | Frontend | Example |
 | --- | --- |
@@ -40,7 +82,7 @@ The guide and `examples/frontend` contain complete, locally tested examples:
 | Plain JavaScript | DOM rendering, checked navigation and API loading |
 
 Each example includes initial access, later navigation, verification redirect,
-pending/denied UI and cancellation. Backend page/API guards remain necessary.
+empty pending content, denied UI and cancellation. Backend page/API guards remain necessary.
 No framework library is added as a required SDK dependency. The generated guide
 embeds the source; use its file paths and helper instructions when copying it.
 The dashboard's frontend selector shows the same files. For maintenance, run
@@ -62,7 +104,7 @@ npm run build
 npm pack
 ```
 
-Install the resulting `stopnetic-js-0.0.4-pilot.tgz` into the website project using
+Install the resulting `stopnetic-js-0.0.6-pilot.tgz` into the website project using
 `npm install <absolute-path-to-tarball>`. The installed package has no Next.js or
 other runtime dependency. The build packages the same signed decision implementation
 as the Next.js adapter. Keep `@stopnetic/next` for its Next.js 16 guided installer.
@@ -98,7 +140,8 @@ preserved. Vercel configuration is preserved. Put runtime settings in the hostin
 provider's server/Functions environment; plain `netlify.toml` build env is not a
 Functions secret store. Copy the generated cookie secret without committing it.
 
-Wire browser route checks and EACH protected API following the generated guide.
+Wire the server page guard and EACH protected API following the generated guide.
+Browser route checks are optional for retained SPA navigation.
 Run `npm exec --no -- stopnetic-js check` after setting credentials (`--local-http`
 for a loopback pilot). This check validates configuration and generated files
 offline; it cannot prove deployment routing, API coverage or browser integration.
@@ -111,12 +154,11 @@ server environment loader. Production credentials belong in runtime settings.
 
 ### Shared browser startup and Node SSR
 
-The generated [framework-independent guide](src/client-guide.md) gives one
-browser entry that calls `checkAccess` before importing the application's
-existing bootstrap. Keep Angular's bootstrapApplication, React's createRoot,
-Vue's createApp, Svelte's mount, Solid's render or plain DOM startup unchanged
-in that bootstrap module. Use document links for server-checked navigation,
-or recheck target access in the client router. A browser-only check is UI behavior.
+The generated [framework-independent guide](dist/client-guide.md) defaults to
+server document navigation: leave browser startup/layout intact, use normal
+links, and let the server apply dashboard policies. It also gives an OPTIONAL
+browser startup gate and separate OPTIONAL SPA router demos. Do not combine
+the alternatives or apply browser-only gates to an SSR hydration root.
 
 For Node SSR use the generated Express helper before static files/rendering,
 or `createStopneticAppHandler` around a Fetch-style application entry (0.0.3).
@@ -128,15 +170,17 @@ adapted; accepting Request/Response does not make an Edge runtime supported.
 The guide includes Angular SSR/rendering and client router examples. Angular
 SSR compiled with the installed Angular 22 dependencies and served real HTML
 after verification in an isolated local fixture. That does not validate a live
-provider deployment. Netlify's automatic Angular SSR uses Edge; choose Node SSR,
-a Node gateway or a deliberate static build. Do not publish protected prerendered
+provider deployment. Netlify's automatic Angular SSR uses Edge; the Node SDK
+has no drop-in integration for that runtime. Preserve SSR and obtain a supported
+Node deployment/gateway decision instead of silently converting the app. Do not publish protected prerendered
 HTML. For other frameworks use the same Node server entry and verify their
 actual deployed runtime. React's boundary remains an optional convenience.
 
 ### Optional React Router boundary
 
 The optional React entry uses Hooks. The core/browser modules need no React.
-Place this component inside BrowserRouter, wrapping your Routes:
+Use this only for explicitly retained browser SPA navigation, inside BrowserRouter,
+around the full target layout. Server document navigation does not require it:
 
 ```jsx
 import { useLocation } from 'react-router-dom';
@@ -144,11 +188,12 @@ import { StopneticBoundary } from '@stopnetic/js/react';
 
 function RouteGuard({ children }) {
   const location = useLocation();
-  return <StopneticBoundary path={location.pathname + location.search}>
+  return <StopneticBoundary path={location.pathname + location.search} pending={null}>
     {children}
   </StopneticBoundary>;
 }
-// <BrowserRouter><RouteGuard><Routes>...</Routes></RouteGuard></BrowserRouter>
+// <BrowserRouter><RouteGuard><Layout/></RouteGuard></BrowserRouter>
+// Layout includes the target header, routes and footer.
 ```
 
 The boundary hides children while checking, ignores canceled/stale checks and

package/dist/client-guide.md

@@ -2,9 +2,11 @@
 
 Angular, React, Vue, Svelte, Solid and plain JavaScript use the same server guard
 and browser access check. React is optional. Install `@stopnetic/js` in the
-website project; choose a hosting platform, not a frontend framework.
+website project. The CLI chooses hosting files; choose your actual SSR framework
+in the instructions below to see where its server guard belongs.
 
-Jump to your implementation: [React Router](#react-router),
+Start with [SSR framework instructions](#ssr-framework-instructions) if the app
+renders on the server. Optional browser-only demos: [React Router](#react-router),
 [Angular Router](#angular-router), [Vue Router](#vue-router),
 [Svelte](#svelte-navigation), [Solid Router](#solid-router),
 [plain JavaScript](#plain-javascript-navigation). Each section includes the
@@ -13,8 +15,61 @@ layout, navigation and protected API example, not just the startup function.
 The generated control endpoint is only part of installation. It does not
 automatically intercept pages, edit your router or protect existing APIs.
 
+## Integration contract — read before editing an existing app
+
+1. Inspect the existing server entry, rendering modes, hosting adapter and router.
+   Preserve SSR, hydration, public pages, routes and application features.
+   Installing Stopnetic is not authorization to convert SSR to CSR, delete server
+   files, replace the application's router or copy the demo over an existing app.
+2. Choose ONE of the two rendering paths below. Keep the app's current rendering
+   by default. A hosting/runtime incompatibility must be explained to the owner;
+   do not resolve it by silently removing SSR or changing hosting.
+3. Install the guard before the existing server renders or serves HTML. Keep the
+   existing browser bootstrap unchanged for the default document-navigation mode.
+   Do not add a global `Checking access...` screen or a browser startup gate.
+4. Save protected paths in Stopnetic Policies. Do not add the demo paths, protect
+   every page, copy dashboard rules into a frontend path list, or change defaults
+   without the owner's instruction. Guards evaluate requests; they do not make
+   every evaluated request require verification.
+5. Use normal document navigation for the simplest server-enforced integration.
+   If retaining client-side SPA navigation is required, use the OPTIONAL router
+   examples and explain their asynchronous checks before adding them.
+6. Independently guard private API handlers. Validate public, protected and denied
+   pages plus SSR output before declaring integration complete.
+
+## What visitors should see
+
+For example, suppose only `/members` is Page / Automatic browser flow:
+
+| Request | Normal behavior |
+| --- | --- |
+| `/`, `/about`, `/contact` with no matching rule | Public page; normal layout, no Stopnetic checking screen or verification |
+| `/members` without a valid session | Server verification flow before returning the page |
+| `/members` with a valid session | Normal page content |
+| A Page / Block route | Empty HTTP 404 before any site layout renders |
+| A protected API without a valid session | HTTP 404; no JSON data and no browser challenge |
+
+Generated site mode leaves unmatched paths public; explicit broader rules can
+change that. Public requests still need a valid signed policy response. A service
+failure returns 503 rather than bypassing policy. Rules belong in the dashboard;
+the browser cannot know whether a target is public until the server checks it.
+
 ## 1. Choose the actual rendering and server runtime
 
+**Option A — preserve SSR.** Keep the existing renderer, server entry and
+hydration. Add the Node guard before the renderer (section 3). Use server
+document navigation (section 4). Public pages render normally; protected pages
+render only after the dashboard decision permits them.
+
+**Option B — retain a static/CSR frontend.** Keep the existing browser bootstrap
+and build. Add a Node hosting page guard before HTML (section 3), then use server
+document navigation (section 4). A Node function serving built `index.html` is
+static page handling, not SSR. Choose this option for an existing static app or
+only after an explicit decision to convert rendering.
+
+Neither option requires a global browser boundary. Optional SPA navigation is
+a separate choice, not a third rendering mode.
+
 | Application | Where the shared guard belongs |
 | --- | --- |
 | Node/Express SSR or static-file server | Before body parsers, static files, API handlers and rendering |
@@ -95,11 +150,57 @@ the shared guard before its `resolve`, `next` or renderer. A Fetch wrapper is
 for a complete handler returning a Response, not every framework middleware
 signature. Node/Express can mount the generated helper around any renderer.
 
+<!-- BEGIN SSR EXAMPLES -->
+
+### SSR framework instructions
+
+Choose the actual SSR framework, not just the browser UI library. Angular
+instructions apply ONLY to Angular. Each section below identifies the server
+file, integration steps, prerender constraints and runtime. The same sections
+appear in the dashboard SSR framework selector. Merge examples into existing
+entries; do not replace SSR, hydration, context or application features.
+
+Use your selected framework hook OR the shared Node wrapper above. Do not
+stack both or mount the generated Express helper as an additional guard.
+
+| Your app | Choose |
+| --- | --- |
+| Angular with SSR | Angular SSR |
+| React Router framework/server mode | React Router SSR |
+| React plus your own Node renderer | React custom SSR |
+| Nuxt | Nuxt (Vue SSR) |
+| Vue plus your own Node renderer | Vue custom SSR |
+| SvelteKit | SvelteKit SSR |
+| Astro on-demand rendering | Astro SSR |
+| SolidStart | SolidStart SSR; match the installed major version |
+| Other Node renderer / plain JavaScript server | Other Node SSR |
+| Next.js | Dedicated @stopnetic/next guide; do not install the JS control files |
+| React/Vue/Svelte/Solid UI without an SSR server | Option B: static/browser app |
+| PHP, Python, Ruby, C#, Java or Edge/Deno | No native adapter in this Node npm SDK; a separate runtime adapter/gateway is needed |
+
+All snippets require SDK 0.0.3-pilot or newer and six SERVER settings. They
+are manual integration examples, not automatic installers for each framework.
+Validate the actual deployed adapter, versions, internal data endpoints and
+cache/static aliases. Hook-contract checks do not prove provider deployment.
+
 ### Angular SSR on Node
 
-For a Fetch-style Angular SSR entry in `src/server.ts`:
+**Where:** src/server.ts (Fetch entry), or your existing Express server.ts before AngularNodeAppEngine.handle.
+
+1. Keep server.ts, main.server.ts, server providers, host configuration and hydration. Merge the guard into the existing request entry; preserve extra framework context.
+2. Use the Fetch example only for an AngularAppEngine Request/Response entry. An Express entry instead mounts the Node helper before express.static and AngularNodeAppEngine.handle.
+3. Protected paths use RenderMode.Server. The wildcard below is an example, not a replacement for existing public/hybrid route configuration.
+
+**Prerendering and caches:** Do not publish protected RenderMode.Prerender output to a public CDN. Retain public rendering modes only where they cannot bypass future protection. Any path the dashboard may protect must reach the server guard before HTML.
+
+**Hosting runtime:** Node.js 22+ only. Keep the existing Node hosting adapter; check the deployed runtime, not just the hosting brand. Edge/Deno deployments need a separate supported adapter or a gateway decision. Do not convert SSR to static rendering automatically.
+
+**Netlify Angular only:** Netlify’s automatic Angular SSR uses Edge Functions. The current Node SDK has no drop-in integration for that combination. Keep SSR; obtain a supported Node deployment or gateway decision. A static index.html function is not an Angular SSR adapter.
+
+#### src/server.ts
 
 ```ts
+// Merge into your existing Node SSR entry; retain host settings and context.
 import { AngularAppEngine, createRequestHandler } from '@angular/ssr';
 import { createStopneticAppHandler } from '@stopnetic/js/server';
 
@@ -113,26 +214,364 @@ async function handle(request: Request): Promise<Response> {
 export const reqHandler = createRequestHandler(handle);
 ```
 
-Keep existing Angular host configuration and request context if your entry
-uses them. For an Express-based Angular entry, mount `installStopnetic(app)`
-before `express.static` and `AngularNodeAppEngine.handle` instead.
-
-Protected routes in `src/app/app.routes.server.ts` must use request-time
-rendering rather than `RenderMode.Prerender`:
+#### src/app/app.routes.server.ts
 
 ```ts
 import { RenderMode, ServerRoute } from '@angular/ssr';
 export const serverRoutes: ServerRoute[] = [
-  // All routes are rendered on incoming requests in this example.
+  // Demo only: merge with existing hybrid modes rather than replacing them.
   { path: '**', renderMode: RenderMode.Server },
 ];
 ```
 
-Netlify's automatic Angular SSR adapter currently uses Edge Functions. Do not
-import this Node SDK into that Edge entry, and do not assume a Netlify Node
-function runs before the Edge renderer. Use a Node SSR deployment, a Node
-gateway that cannot be bypassed, or a static Angular build with Node page
-handling. Switching to static rendering changes SSR behavior; choose deliberately.
+Framework references: [Angular SSR](https://angular.dev/guide/ssr), [Netlify Angular runtime](https://docs.netlify.com/build/frameworks/framework-setup-guides/angular/).
+
+### React Router framework mode on Node
+
+**Where:** Existing Express entry before @react-router/express createRequestHandler.
+
+1. React Router framework mode supplies the SSR server. Keep its server build, loaders/actions, getLoadContext and hydration; BrowserRouter alone is not an SSR backend.
+2. Copy the helper, then import and call it at the application root before parsers/assets and the existing createRequestHandler. Do not place it after the renderer or mount it at a stripped URL prefix.
+3. The helper checks React Router 7 .data requests against their page path, including /_root.data. The actual router still receives its original URL and unread body. This example uses the default / basename; custom basenames and other router versions need alias mapping review.
+
+**Prerendering and caches:** Keep ssr enabled in react-router.config.ts. Exclude protected paths from prerender output and CDN caches. Direct .data requests must not expose private loaders merely because the document path is guarded. Independently authorize resource routes, actions and server functions.
+
+**Hosting runtime:** Node.js 22+ only. Keep the existing Node hosting adapter; check the deployed runtime, not just the hosting brand. Edge/Deno deployments need a separate supported adapter or a gateway decision. Do not convert SSR to static rendering automatically.
+
+#### stopnetic-react-router.mjs
+
+```js
+// Call installStopneticReactRouter(app) before parsers, assets and the existing
+// @react-router/express createRequestHandler. Keep that handler/context intact.
+import { createStopneticServer } from '@stopnetic/js/server';
+
+export function installStopneticReactRouter(app) {
+  let server;
+  app.use((req, res, next) => {
+    server ??= createStopneticServer();
+    return server.access(req, res, () => {
+      // React Router 7 single-fetch data URLs must use the page's policy.
+      // The renderer still receives the original request and unread body.
+      const url = new URL(req.originalUrl || req.url, 'https://example.invalid');
+      let checked = req;
+      if (url.pathname.endsWith('.data')) {
+        url.pathname = url.pathname === '/_root.data' ? '/' : url.pathname.slice(0, -5);
+        checked = Object.create(req);
+        checked.originalUrl = url.pathname + url.search;
+      }
+      return server.guard(checked, res, next);
+    });
+  });
+}
+```
+
+#### Existing Express entry (merge fragment)
+
+```js
+// In your EXISTING Express entry, before parsers, static files and rendering:
+import { installStopneticReactRouter } from './stopnetic-react-router.mjs';
+installStopneticReactRouter(app);
+// Keep the existing renderer, application routes and server startup below.
+```
+
+Framework references: [React Router server adapters](https://reactrouter.com/api/other-api/adapter), [React Router prerendering](https://reactrouter.com/how-to/pre-rendering).
+
+### React with an existing custom SSR server
+
+**Where:** Existing Node/Express server before React rendering and any private data handler.
+
+1. React is a UI library; this option assumes you already have a Node SSR server. Keep renderToPipeableStream/renderToReadableStream, request context and hydrateRoot.
+2. Copy the helper and call it before the existing assets/API/renderer middleware. For a Fetch-style server use the custom Node Fetch wrapper instead.
+3. A Vite React SPA without a server uses Option B: static/browser app. Next.js and React Router SSR have their own selector entries. Do not add a second renderer or replace the app with the browser demo.
+
+**Prerendering and caches:** Do not statically publish protected HTML or embed private data in public bundles. Keep guarded rendering at request time, retaining public prerendering only with correct server/CDN coverage.
+
+**Hosting runtime:** Node.js 22+ only. Keep the existing Node hosting adapter; check the deployed runtime, not just the hosting brand. Edge/Deno deployments need a separate supported adapter or a gateway decision. Do not convert SSR to static rendering automatically.
+
+#### stopnetic-react-ssr.mjs
+
+```js
+// Existing custom React SSR server: call before assets, APIs and React rendering.
+// Keep renderToPipeableStream/renderToReadableStream and hydration unchanged.
+import { createStopneticServer } from '@stopnetic/js/server';
+export function installStopneticReactSSR(app) {
+  let server;
+  app.use((req, res, next) => {
+    server ??= createStopneticServer();
+    return server.access(req, res, () => server.guard(req, res, next));
+  });
+}
+```
+
+#### Existing Express entry (merge fragment)
+
+```js
+// In your EXISTING Express entry, before parsers, static files and rendering:
+import { installStopneticReactSSR } from './stopnetic-react-ssr.mjs';
+installStopneticReactSSR(app);
+// Keep the existing renderer, application routes and server startup below.
+```
+
+Framework references: [React Node SSR](https://react.dev/reference/react-dom/server/renderToPipeableStream).
+
+### Nuxt 3/4 with Nitro 2 and H3 1 on Node
+
+**Where:** server/middleware/00-stopnetic.mjs; runs before Nitro renders pages and serves API handlers.
+
+1. Keep Nuxt SSR, its app, pages, hydration and existing Node Nitro preset. Check the installed Nitro/H3 versions; this example uses H3 1 fromNodeMiddleware, not the H3 2 API.
+2. Add this server middleware before other body readers and handlers. app/middleware and defineNuxtRouteMiddleware are navigation UI hooks and cannot replace this server guard.
+3. Keep the private environment settings in the deployed Node process. Do not use runtimeConfig.public. Test the built server and separate provider functions, not only Nuxt dev.
+
+**Prerendering and caches:** Do not use nuxt generate or prerender/SWR/ISR/cached route rules for protected paths. Protected _payload.json files must not be generated into public output. Keep public route rules only where they cannot expose protected content through CDN/cache aliases.
+
+**Hosting runtime:** Node.js 22+ only. Keep the existing Node hosting adapter; check the deployed runtime, not just the hosting brand. Edge/Deno deployments need a separate supported adapter or a gateway decision. Do not convert SSR to static rendering automatically.
+
+#### server/middleware/00-stopnetic.mjs
+
+```js
+// server/middleware/00-stopnetic.mjs. Nuxt 3/4, Nitro 2, H3 1, NODE only.
+// Use server middleware, not app/middleware or defineNuxtRouteMiddleware.
+import { fromNodeMiddleware } from 'h3';
+import { createStopneticServer } from '@stopnetic/js/server';
+
+let server;
+export default fromNodeMiddleware((req, res, next) => {
+  server ??= createStopneticServer();
+  return server.access(req, res, () => server.guard(req, res, next));
+});
+```
+
+Framework references: [Nuxt server middleware](https://nuxt.com/docs/4.x/directory-structure/server), [H3 1 Node middleware adapter](https://v1.h3.dev/examples/from-expressjs-to-h3).
+
+### Vue with an existing custom SSR server
+
+**Where:** Existing Node/Express server before Vue rendering and private APIs.
+
+1. Vue alone is a UI library. Keep the existing createSSRApp/renderToString server, request context and client hydration.
+2. Copy and mount the helper before the existing parsers/assets/API/renderer middleware. For a Request/Response server use the custom Node Fetch wrapper.
+3. A Vue SPA uses Option B. A Nuxt app uses the Nuxt entry; do not replace either with a newly invented Express renderer.
+
+**Prerendering and caches:** Protected HTML and private serialized state must be produced only after the server check. Avoid publicly cached/prerendered output for protected paths.
+
+**Hosting runtime:** Node.js 22+ only. Keep the existing Node hosting adapter; check the deployed runtime, not just the hosting brand. Edge/Deno deployments need a separate supported adapter or a gateway decision. Do not convert SSR to static rendering automatically.
+
+#### stopnetic-vue-ssr.mjs
+
+```js
+// Existing custom Vue SSR server: call before assets, APIs and Vue rendering.
+// Keep createSSRApp/renderToString and client hydration unchanged.
+import { createStopneticServer } from '@stopnetic/js/server';
+export function installStopneticVueSSR(app) {
+  let server;
+  app.use((req, res, next) => {
+    server ??= createStopneticServer();
+    return server.access(req, res, () => server.guard(req, res, next));
+  });
+}
+```
+
+#### Existing Express entry (merge fragment)
+
+```js
+// In your EXISTING Express entry, before parsers, static files and rendering:
+import { installStopneticVueSSR } from './stopnetic-vue-ssr.mjs';
+installStopneticVueSSR(app);
+// Keep the existing renderer, application routes and server startup below.
+```
+
+Framework references: [Vue SSR](https://vuejs.org/guide/scaling-up/ssr.html).
+
+### SvelteKit server hooks on Node
+
+**Where:** src/hooks.server.js, before resolve(event) and any existing application hooks.
+
+1. Keep the existing Node adapter, SSR pages, loads/actions and hydration. Merge this handle into existing hooks; put Stopnetic first and retain other hooks in its continuation.
+2. The guard receives the original request and per-request continuation. Data requests are checked against event.url, the canonical page path, then resolve receives the original event and body.
+3. Merge prerender=false into each protected +page.server.js or a covering server layout. building skips runtime enforcement only during build; no protected path may be prerendered. Test with the full adapter server.
+
+**Prerendering and caches:** Keep SSR enabled. The runtime handle hook does not protect files already served statically. Exclude protected routes from prerender output, including __data.json. Do not rely on a page rule alone for separately exposed endpoints or remote functions.
+
+**Hosting runtime:** Node.js 22+ only. Keep the existing Node hosting adapter; check the deployed runtime, not just the hosting brand. Edge/Deno deployments need a separate supported adapter or a gateway decision. Do not convert SSR to static rendering automatically.
+
+#### src/hooks.server.js
+
+```js
+import { building } from '$app/environment';
+import { createStopneticAppHandler } from '@stopnetic/js/server';
+
+let guarded;
+// When merging existing hooks, run this first and put them in the continuation.
+export async function handle({ event, resolve }) {
+  // Build-time public prerendering only. Protected routes must have prerender=false.
+  if (building) return resolve(event);
+  guarded ??= createStopneticAppHandler((_request, run) => run());
+  // SvelteKit exposes the canonical page URL on data requests. Check that page
+  // rather than allowing an unmatched /members/__data.json alias through.
+  const checked = event.isDataRequest
+    ? new Request(event.url, { method: event.request.method, headers: event.request.headers })
+    : event.request;
+  return guarded(checked, () => resolve(event));
+}
+```
+
+#### src/routes/members/+page.server.js (merge example)
+
+```js
+// Merge into the PROTECTED route's +page.server.js, retaining loads/actions.
+export const prerender = false;
+export const ssr = true;
+```
+
+Framework references: [SvelteKit server hooks](https://svelte.dev/docs/kit/hooks), [SvelteKit page options](https://svelte.dev/docs/kit/page-options).
+
+### Astro request middleware on Node
+
+**Where:** src/middleware.js, before next() renders a page or executes an endpoint.
+
+1. Keep the existing compatible Node adapter and Astro renderer. If middleware exists, merge/sequence this guard first, preserving locals and the existing continuation.
+2. Use context.request and next(), not a browser startup gate. The isPrerendered branch is build-only public rendering; protected pages must never enter it.
+3. Set prerender=false on protected .astro pages/endpoints. Keep their existing content. For @astrojs/node middleware mode, an outer Express guard before static files is also available; do not install both patterns unnecessarily.
+
+**Prerendering and caches:** Protected pages need on-demand rendering with a Node adapter. Public prerendered pages can remain public, but files bypassing request middleware cannot acquire protection through a dashboard rule alone.
+
+**Hosting runtime:** Node.js 22+ only. Keep the existing Node hosting adapter; check the deployed runtime, not just the hosting brand. Edge/Deno deployments need a separate supported adapter or a gateway decision. Do not convert SSR to static rendering automatically.
+
+#### src/middleware.js
+
+```js
+// src/middleware.js. Keep the existing Node deployment adapter.
+import { defineMiddleware } from 'astro:middleware';
+import { createStopneticAppHandler } from '@stopnetic/js/server';
+
+let guarded;
+export const onRequest = defineMiddleware(async (context, next) => {
+  // Public prerender builds only; protected pages must export prerender=false.
+  if (context.isPrerendered) return next();
+  guarded ??= createStopneticAppHandler((_request, run) => run());
+  return guarded(context.request, () => next());
+});
+```
+
+#### src/pages/members.astro (frontmatter flag)
+
+```astro
+---
+// Merge this flag into a protected page, preserving its existing content.
+export const prerender = false;
+---
+```
+
+Framework references: [Astro middleware](https://docs.astro.build/en/guides/middleware/), [Astro Node adapter](https://docs.astro.build/en/guides/integrations-guide/node/).
+
+### SolidStart request middleware on Node
+
+**Where:** src/middleware.js, registered in the existing SolidStart config before rendering and API execution.
+
+1. Choose the snippet matching your installed major version. SolidStart 2 uses createMiddleware([...]) and H3 event.req/event.res; SolidStart 1 uses onRequest and event.request/event.response.
+2. For v2 register solidStart({ middleware: "./src/middleware.js" }) in existing vite.config.ts. For v1 register middleware in existing defineConfig in app.config.ts. Keep all other settings and the SSR entry-server.tsx.
+3. A per-request allowed marker distinguishes an authorized continuation from a verification 204. The framework continues only when the marker is set; no renderer runs on challenge/block/outage. Server functions still require their own permissions and policy checks for their actual endpoint paths.
+
+**Prerendering and caches:** Keep SSR enabled and protected routes out of prerender/static/ISR output. Use the existing Node server plugin/preset; do not assume a middleware export changes an Edge deployment into Node.
+
+**Hosting runtime:** Node.js 22+ only. Keep the existing Node hosting adapter; check the deployed runtime, not just the hosting brand. Edge/Deno deployments need a separate supported adapter or a gateway decision. Do not convert SSR to static rendering automatically.
+
+#### src/middleware.js — SolidStart 2
+
+```js
+// SolidStart 2: register this module using solidStart({ middleware: ... }).
+import { createMiddleware } from '@solidjs/start/middleware';
+import { createStopneticAppHandler } from '@stopnetic/js/server';
+
+let check;
+export default createMiddleware([
+  async (event, next) => {
+    check ??= createStopneticAppHandler((_request, state) => {
+      state.allowed = true;
+      return new Response(null, { status: 204 });
+    });
+    // Per-request state: a verification 204 must NEVER be mistaken for permission.
+    const state = { allowed: false };
+    const response = await check(event.req, state);
+    if (!state.allowed) return response;
+    event.res.headers.set('cache-control', 'private, no-store');
+    const result = await next(); // Preserve H3/SolidStart context and raw results.
+    if (!(result instanceof Response)) return result;
+    const headers = new Headers(result.headers);
+    headers.set('cache-control', 'private, no-store');
+    return new Response(result.body, {
+      status: result.status, statusText: result.statusText, headers,
+    });
+  },
+]);
+```
+
+#### src/middleware.js — SolidStart 1 alternative
+
+```js
+// SolidStart 1: register using defineConfig({ middleware: './src/middleware.js' }).
+// Keep the existing entry-server.tsx renderer. This is NOT SolidStart 2 config.
+import { createMiddleware } from '@solidjs/start/middleware';
+import { createStopneticAppHandler } from '@stopnetic/js/server';
+
+let check;
+export default createMiddleware({
+  onRequest: async event => {
+    check ??= createStopneticAppHandler((_request, state) => {
+      state.allowed = true;
+      return new Response(null, { status: 204 });
+    });
+    const state = { allowed: false };
+    const response = await check(event.request, state);
+    if (!state.allowed) return response;
+    event.response.headers.set('cache-control', 'private, no-store');
+    // undefined continues to SolidStart; preserve its rendering and API handling.
+  },
+});
+```
+
+Framework references: [SolidStart 2 middleware](https://docs.solidjs.com/solid-start/v2/reference/server/create-middleware), [SolidStart 1 middleware](https://docs.solidjs.com/solid-start/v1/reference/server/create-middleware).
+
+### Custom Node SSR or plain JavaScript server
+
+**Where:** Existing root request entry, before static HTML, API data or rendering.
+
+1. Use the Express helper OR the Fetch wrapper according to the existing server signature. Do not replace the renderer or introduce a second server.
+2. Call installStopneticSSR(app) first for Express. For Fetch, export the protected version of the existing handler using protectSSR(renderApplication); all context arguments are retained.
+3. Keep the canonical Host and private environment in the Node service. Only expose the guarded entry. Independently guard separately deployed API functions.
+
+**Prerendering and caches:** Static HTML/cache aliases must not bypass the guard. Preserve existing public routes and apply protection only through dashboard policies.
+
+**Hosting runtime:** Node.js 22+ only. Keep the existing Node hosting adapter; check the deployed runtime, not just the hosting brand. Edge/Deno deployments need a separate supported adapter or a gateway decision. Do not convert SSR to static rendering automatically.
+
+#### stopnetic-ssr.mjs
+
+```js
+// Call before parsers, static files, APIs and your existing Node SSR renderer.
+import { createStopneticServer } from '@stopnetic/js/server';
+export function installStopneticSSR(app) {
+  let server;
+  app.use((req, res, next) => {
+    server ??= createStopneticServer();
+    return server.access(req, res, () => server.guard(req, res, next));
+  });
+}
+```
+
+#### stopnetic-fetch-ssr.mjs
+
+```js
+// Wrap your existing Node Request -> Response renderer; retain all context.
+import { createStopneticAppHandler } from '@stopnetic/js/server';
+export function protectSSR(renderApplication) {
+  let guarded;
+  return (request, ...context) => {
+    guarded ??= createStopneticAppHandler(renderApplication);
+    return guarded(request, ...context);
+  };
+}
+```
+
+<!-- END SSR EXAMPLES -->
 
 ### Static apps on Netlify / Vercel
 
@@ -148,7 +587,55 @@ root rather than `/assets`. Bundle the correct HTML and assets, preserve their
 MIME types, and do not use the Vite-only file paths unchanged for Angular.
 Reject direct entry-HTML and function aliases that would bypass protected paths.
 
-## 4. Browser startup: the same code for every frontend
+## 4. Navigation — server enforcement by default
+
+For BOTH rendering options, leave the existing browser entry and app layout
+alone. Use document links for page navigation so every target reaches the
+guarded server before rendering. No global `checkAccess`, `StopneticBoundary`,
+startup import gate, root access service or loading message is required.
+
+| Frontend | Document navigation |
+| --- | --- |
+| Angular | `<a href="/members">Members</a>` instead of `routerLink` for this navigation |
+| React | `<a href="/members">Members</a>` instead of router `<Link>` |
+| Vue | `<a href="/members">Members</a>` instead of `<RouterLink>` |
+| Svelte / SvelteKit | `<a href="/members" data-sveltekit-reload>Members</a>`; disable any custom interception |
+| Solid | `<a href="/members" target="_self">Members</a>` instead of router `<A>` |
+| Plain JavaScript | `<a href="/members">Members</a>`; do not intercept it with `pushState` |
+
+Replace programmatic SPA transitions with `location.assign('/members')` when
+using this mode. Turn off router prefetch/preload of protected page data that
+would bypass the guarded document request. Existing routers may still resolve
+the current URL after loading. Normal pages keep their usual loading behavior;
+Stopnetic's verification HTML is sent only when the server decision requires it.
+
+For SSR, hydrate the HTML already authorized by the server. Do not replace it
+with a browser-only loading screen or run a redundant startup check. Private API
+requests remain independently checked by their server handler.
+
+### Optional SPA navigation — explicit asynchronous tradeoff
+
+Retain SPA navigation only when needed. SPA transitions do not make a new
+document request, so check each target in the router before showing its content.
+The current browser API returns access after a server request; it does not
+provide a synchronous dashboard route manifest. Public transitions also need
+that check to discover the current policy. A brief empty pending state is
+possible; it is not a challenge and is not advertised as instant public rendering.
+Use document navigation above if this delay is unacceptable. Do not bypass
+checks with a hardcoded public/protected list, cached `allowed` flag, or client
+user-agent detection. Keep full target content hidden until the check succeeds.
+
+The six optional demos below intentionally check their sample router targets.
+They are not instructions to protect all those paths in Policies. Their pending
+state contains no `Checking access...` text. They do not provide server SSR
+integration or HTTP status changes. Do not install both a startup check and a
+router gate; do not apply these browser demos to an existing hydrated SSR root.
+
+### Optional browser startup gate for a browser-only app
+
+This alternative is useful only if browser mounting must wait for an access
+check. Skip it when the server already guards HTML and document navigation is
+used. It is not required by either rendering option above.
 
 For a browser-only/static app, move the existing startup code from `src/main.ts`
 or `src/main.js` into `src/bootstrap.ts` or `src/bootstrap.js`. Keep its original
@@ -186,26 +673,26 @@ This is browser code, not a server hook. The startup file can use any framework:
 | Solid | Your existing `render(...)` |
 | Plain JavaScript | Your existing DOM rendering code |
 
-Use ordinary `<a href>` document links for guarded navigation: each navigation
-then reaches the server before a new page is shown. Client router navigation
-does not rerun the startup file. If keeping SPA navigation, call `checkAccess`
-in that router's before-navigation guard for every target and handle denial,
-verification redirects, outages and stale/cancelled requests. A UI check cannot
-set the original HTTP status or make public bundles private.
+Client router navigation does not rerun this optional startup file. A UI check
+cannot set the original HTTP status or make public bundles private.
 
 <!-- BEGIN FRONTEND EXAMPLES -->
 
-### Choose your frontend implementation
+### Optional SPA demos — choose your frontend implementation
 
 The package includes copyable source files in `examples/frontend`. The same
-examples appear below and in the dashboard frontend selector. Choose the
-example for your app; the shared startup above is an alternative. These are
-complete small layouts with sample routes. Merge the guard into your own
-layout and replace the sample pages/paths with your actual pages. Keep all
-navigation, routes and footer inside the gate. The server setup remains required.
-
-These router/layout examples run in the browser. Framework SSR request
-handlers remain in section 3; keep browser checks out of server rendering.
+examples appear below and in the dashboard frontend selector. Skip this
+section for the default server/document-navigation integration. These are
+optional browser-only demos, not replacements for an existing app or SSR
+entry. Retaining SPA navigation requires asynchronous target checks, even
+for public targets. Pending content is empty; no global checking text is
+required. Keep the target layout hidden until allowed to avoid exposing it
+on denial. Only dashboard rules decide which paths require verification.
+
+If explicitly choosing this mode, merge the relevant hooks into your own
+browser router and adapt the sample paths. Do not add every demo path to
+Policies. Do not combine these gates with the optional startup gate or
+apply them to a hydrated SSR root. SSR uses section 3 and document navigation.
 
 Copy the selected folder under `src/<frontend>/` and the shared data helper
 to `src/load-private-data.js` (plus its `.d.ts` file for TypeScript). This keeps
@@ -261,7 +748,7 @@ import { loadPrivateData } from '../load-private-data.js';
 function RouteGuard({ children }: { children: ReactNode }) {
   const location = useLocation();
   return <StopneticBoundary path={location.pathname + location.search}
-    pending={<p>Checking access...</p>}
+    pending={null}
     blocked={<p>Access unavailable.</p>}>
     {children}
   </StopneticBoundary>;
@@ -314,7 +801,7 @@ createRoot(document.getElementById('app')!).render(<App/>);
 
 ### Angular Router
 
-The service records checking/allowed/denied state. Apply the route guard to every page and gate the full layout. Members uses HttpClient after route access succeeds. Merge providers into your existing appConfig, keeping SSR/hydration settings. This standalone example uses modern Angular syntax.
+Optional browser-only SPA demo: the service records checking/allowed/denied state. Checks evaluate policy; only dashboard rules require verification. Members uses HttpClient after route access succeeds. Merge providers into your existing browser appConfig. Preserve SSR/hydration with the server/document-navigation option instead of applying this demo to a hydrated root. Modern standalone Angular syntax.
 
 #### src/angular/app/app.config.ts
 
@@ -375,9 +862,7 @@ import { StopneticAccess } from './stopnetic-access.service';
       </nav></header>
       <router-outlet/>
       <footer>Example site</footer>
-    } @else if (access.state() === 'checking') {
-      <p role="status">Checking access...</p>
-    } @else {
+    } @else if (access.state() === 'denied') {
       <p role="alert">Access unavailable.</p>
     }
   `,
@@ -478,8 +963,7 @@ import { accessState } from './router.js';
     <RouterView/>
     <footer>Example site</footer>
   </template>
-  <p v-else-if="accessState === 'checking'" role="status">Checking access...</p>
-  <p v-else role="alert">Access unavailable.</p>
+  <p v-else-if="accessState === 'denied'" role="alert">Access unavailable.</p>
 </template>
 ```
 
@@ -620,9 +1104,7 @@ Svelte 5 example with onMount, History API navigation, popstate and abort cleanu
   </nav></header>
   <main><h1>{path === '/members' ? 'Members' : path === '/' ? 'Home' : path === '/slow' ? 'Slow' : 'Not found'}</h1><p>{data}</p></main>
   <footer>Example site</footer>
-{:else if state === 'checking'}
-  <p role="status">Checking access...</p>
-{:else}
+{:else if state === 'denied'}
   <p role="alert">Access unavailable.</p>
 {/if}
 ```
@@ -668,8 +1150,8 @@ const GuardedLayout: ParentComponent = props => {
     onCleanup(() => controller.abort());
   });
   return <Show when={result().allowed && result().path === path() ? result() : undefined}
-    fallback={<Show when={result().pending || result().path !== path()}
-      fallback={<p role="alert">Access unavailable.</p>}><p role="status">Checking access...</p></Show>}>
+    fallback={<Show when={!result().pending && result().path === path()}>
+      <p role="alert">Access unavailable.</p></Show>}>
     {_checked => <>
       <header><nav><A href="/">Home</A>{' '}<A href="/members">Members</A>{' '}
         <A href="/slow">Slow</A>{' '}<A href="/blocked">Blocked</A>{' '}<A href="/offline">Offline</A>
@@ -725,7 +1207,7 @@ let current;
 async function showPage() {
   current?.abort();
   const controller = new AbortController(); current = controller;
-  root.replaceChildren(document.createTextNode('Checking access...'));
+  root.replaceChildren();
   try {
     const path = location.pathname;
     const result = await checkAccess(path + location.search, { signal: controller.signal });
@@ -810,6 +1292,14 @@ client navigation, entry HTML, aliases, prerender outputs and caches. A denied
 request must not execute the renderer or data handler. The offline CLI check
 validates configuration and generated files, not deployed coverage.
 
+With only `/members` protected, confirm `/about` and `/contact` render without
+a Stopnetic checking screen. Change a dashboard rule and make a new document
+request: the change must apply without editing a client route list. For SSR,
+confirm permitted HTML contains server-rendered page content before JavaScript
+runs, hydration still works, and the renderer is never called on denial. Verify
+the deployed request actually reaches Node; an SSR build alone proves nothing
+about a provider's deployed runtime. Optional SPA checks may have a pending delay.
+
 Ordinary policy changes apply on subsequent guarded requests without reinstalling
 or redeploying. Already loaded content is not recalled. Public HTML/JS/assets and
 content bundled into frontend code remain public; keep private data in guarded
@@ -818,7 +1308,7 @@ server endpoints.
 ## Updating an existing generated guide
 
 After installing the new SDK, rerun `stopnetic-js init --platform <same-platform>`
-(preview with `--dry-run`). An unchanged 0.0.2/0.0.3 generated guide is upgraded
+(preview with `--dry-run`). An unchanged 0.0.2/0.0.3/0.0.4/0.0.5 generated guide is upgraded
 with its setup manifest. Your key, cookie secret and server files are preserved.
 Customized guides or handlers require manual merging; switching platforms also
 requires review. This command does not publish, deploy or contact Stopnetic.

package/dist/setup.js

@@ -38,6 +38,8 @@ function platformFor(root, supplied) {
 const legacyGuideDigests = new Set([
   'b1f149af44f9ceb08fb80c18cb5d4b521620196f536d8ad422ab94d15d1d125d', // 0.0.2
   '55e36295b6aa87ad9558cde29786998483095adeae74e149ff5c7fe78507fad7', // published 0.0.3
+  '08f919257d8c85af4e56e842705825832ae2810ed68d5c1dfc8405c8f7be7610', // published 0.0.4
+  '45bd696f196c3d1447a978987a787755b239f75e9e6a3697f4efbb210ce75597', // published 0.0.5
 ]);
 const clientGuide = readFileSync(new URL('./client-guide.md', import.meta.url), 'utf8');
 
@@ -119,5 +121,5 @@ export function checkSetup(input, { localHttp = false } = {}) {
     if (!localHttp && !options.apiUrl?.startsWith('https:')) throw new Error();
     createStopneticAccessHandler(options);
   } catch { throw new SetupError('Check server settings, HTTPS URLs, installation/signing keys and the separate cookie secret. No secret values are displayed.'); }
-  return `Checked ${manifest.platform} generated files and server configuration offline. Confirm the browser boundary, API wrappers and hosting routing with a deployed test. This does not prove coverage or start a trial.`;
+  return `Checked ${manifest.platform} generated files and server configuration offline. Confirm server page enforcement, your chosen navigation mode, API wrappers and hosting routing with a deployed test. Preserve existing SSR; browser gates are optional. This does not prove coverage or start a trial.`;
 }

package/examples/frontend/angular/app/app.ts

@@ -13,9 +13,7 @@ import { StopneticAccess } from './stopnetic-access.service';
       </nav></header>
       <router-outlet/>
       <footer>Example site</footer>
-    } @else if (access.state() === 'checking') {
-      <p role="status">Checking access...</p>
-    } @else {
+    } @else if (access.state() === 'denied') {
       <p role="alert">Access unavailable.</p>
     }
   `,

package/examples/frontend/react/App.tsx

@@ -6,7 +6,7 @@ import { loadPrivateData } from '../load-private-data.js';
 function RouteGuard({ children }: { children: ReactNode }) {
   const location = useLocation();
   return <StopneticBoundary path={location.pathname + location.search}
-    pending={<p>Checking access...</p>}
+    pending={null}
     blocked={<p>Access unavailable.</p>}>
     {children}
   </StopneticBoundary>;

package/examples/frontend/solid/App.tsx

@@ -21,8 +21,8 @@ const GuardedLayout: ParentComponent = props => {
     onCleanup(() => controller.abort());
   });
   return <Show when={result().allowed && result().path === path() ? result() : undefined}
-    fallback={<Show when={result().pending || result().path !== path()}
-      fallback={<p role="alert">Access unavailable.</p>}><p role="status">Checking access...</p></Show>}>
+    fallback={<Show when={!result().pending && result().path === path()}>
+      <p role="alert">Access unavailable.</p></Show>}>
     {_checked => <>
       <header><nav><A href="/">Home</A>{' '}<A href="/members">Members</A>{' '}
         <A href="/slow">Slow</A>{' '}<A href="/blocked">Blocked</A>{' '}<A href="/offline">Offline</A>

package/examples/frontend/svelte/App.svelte

@@ -51,8 +51,6 @@
   </nav></header>
   <main><h1>{path === '/members' ? 'Members' : path === '/' ? 'Home' : path === '/slow' ? 'Slow' : 'Not found'}</h1><p>{data}</p></main>
   <footer>Example site</footer>
-{:else if state === 'checking'}
-  <p role="status">Checking access...</p>
-{:else}
+{:else if state === 'denied'}
   <p role="alert">Access unavailable.</p>
 {/if}

package/examples/frontend/vanilla/main.js

@@ -5,7 +5,7 @@ let current;
 async function showPage() {
   current?.abort();
   const controller = new AbortController(); current = controller;
-  root.replaceChildren(document.createTextNode('Checking access...'));
+  root.replaceChildren();
   try {
     const path = location.pathname;
     const result = await checkAccess(path + location.search, { signal: controller.signal });

package/examples/frontend/vue/App.vue

@@ -13,6 +13,5 @@ import { accessState } from './router.js';
     <RouterView/>
     <footer>Example site</footer>
   </template>
-  <p v-else-if="accessState === 'checking'" role="status">Checking access...</p>
-  <p v-else role="alert">Access unavailable.</p>
+  <p v-else-if="accessState === 'denied'" role="alert">Access unavailable.</p>
 </template>

package/examples/ssr/angular/app.routes.server.ts

@@ -0,0 +1,5 @@
+import { RenderMode, ServerRoute } from '@angular/ssr';
+export const serverRoutes: ServerRoute[] = [
+  // Demo only: merge with existing hybrid modes rather than replacing them.
+  { path: '**', renderMode: RenderMode.Server },
+];

package/examples/ssr/angular/server.ts

@@ -0,0 +1,12 @@
+// Merge into your existing Node SSR entry; retain host settings and context.
+import { AngularAppEngine, createRequestHandler } from '@angular/ssr';
+import { createStopneticAppHandler } from '@stopnetic/js/server';
+
+const engine = new AngularAppEngine();
+let guarded: ReturnType<typeof createStopneticAppHandler> | undefined;
+async function handle(request: Request): Promise<Response> {
+  guarded ??= createStopneticAppHandler(async checked =>
+    await engine.handle(checked) ?? new Response(null, { status: 404 }));
+  return guarded(request);
+}
+export const reqHandler = createRequestHandler(handle);

package/examples/ssr/astro/middleware.js

@@ -0,0 +1,11 @@
+// src/middleware.js. Keep the existing Node deployment adapter.
+import { defineMiddleware } from 'astro:middleware';
+import { createStopneticAppHandler } from '@stopnetic/js/server';
+
+let guarded;
+export const onRequest = defineMiddleware(async (context, next) => {
+  // Public prerender builds only; protected pages must export prerender=false.
+  if (context.isPrerendered) return next();
+  guarded ??= createStopneticAppHandler((_request, run) => run());
+  return guarded(context.request, () => next());
+});

package/examples/ssr/astro/page.astro

@@ -0,0 +1,4 @@
+---
+// Merge this flag into a protected page, preserving its existing content.
+export const prerender = false;
+---

package/examples/ssr/node/fetch.mjs

@@ -0,0 +1,9 @@
+// Wrap your existing Node Request -> Response renderer; retain all context.
+import { createStopneticAppHandler } from '@stopnetic/js/server';
+export function protectSSR(renderApplication) {
+  let guarded;
+  return (request, ...context) => {
+    guarded ??= createStopneticAppHandler(renderApplication);
+    return guarded(request, ...context);
+  };
+}

package/examples/ssr/node/install.mjs

@@ -0,0 +1,9 @@
+// Call before parsers, static files, APIs and your existing Node SSR renderer.
+import { createStopneticServer } from '@stopnetic/js/server';
+export function installStopneticSSR(app) {
+  let server;
+  app.use((req, res, next) => {
+    server ??= createStopneticServer();
+    return server.access(req, res, () => server.guard(req, res, next));
+  });
+}

package/examples/ssr/nuxt/middleware.mjs

@@ -0,0 +1,10 @@
+// server/middleware/00-stopnetic.mjs. Nuxt 3/4, Nitro 2, H3 1, NODE only.
+// Use server middleware, not app/middleware or defineNuxtRouteMiddleware.
+import { fromNodeMiddleware } from 'h3';
+import { createStopneticServer } from '@stopnetic/js/server';
+
+let server;
+export default fromNodeMiddleware((req, res, next) => {
+  server ??= createStopneticServer();
+  return server.access(req, res, () => server.guard(req, res, next));
+});

package/examples/ssr/react/install.mjs

@@ -0,0 +1,10 @@
+// Existing custom React SSR server: call before assets, APIs and React rendering.
+// Keep renderToPipeableStream/renderToReadableStream and hydration unchanged.
+import { createStopneticServer } from '@stopnetic/js/server';
+export function installStopneticReactSSR(app) {
+  let server;
+  app.use((req, res, next) => {
+    server ??= createStopneticServer();
+    return server.access(req, res, () => server.guard(req, res, next));
+  });
+}

package/examples/ssr/react-router/install.mjs

@@ -0,0 +1,22 @@
+// Call installStopneticReactRouter(app) before parsers, assets and the existing
+// @react-router/express createRequestHandler. Keep that handler/context intact.
+import { createStopneticServer } from '@stopnetic/js/server';
+
+export function installStopneticReactRouter(app) {
+  let server;
+  app.use((req, res, next) => {
+    server ??= createStopneticServer();
+    return server.access(req, res, () => {
+      // React Router 7 single-fetch data URLs must use the page's policy.
+      // The renderer still receives the original request and unread body.
+      const url = new URL(req.originalUrl || req.url, 'https://example.invalid');
+      let checked = req;
+      if (url.pathname.endsWith('.data')) {
+        url.pathname = url.pathname === '/_root.data' ? '/' : url.pathname.slice(0, -5);
+        checked = Object.create(req);
+        checked.originalUrl = url.pathname + url.search;
+      }
+      return server.guard(checked, res, next);
+    });
+  });
+}

package/examples/ssr/solidstart/middleware-v1.js

@@ -0,0 +1,19 @@
+// SolidStart 1: register using defineConfig({ middleware: './src/middleware.js' }).
+// Keep the existing entry-server.tsx renderer. This is NOT SolidStart 2 config.
+import { createMiddleware } from '@solidjs/start/middleware';
+import { createStopneticAppHandler } from '@stopnetic/js/server';
+
+let check;
+export default createMiddleware({
+  onRequest: async event => {
+    check ??= createStopneticAppHandler((_request, state) => {
+      state.allowed = true;
+      return new Response(null, { status: 204 });
+    });
+    const state = { allowed: false };
+    const response = await check(event.request, state);
+    if (!state.allowed) return response;
+    event.response.headers.set('cache-control', 'private, no-store');
+    // undefined continues to SolidStart; preserve its rendering and API handling.
+  },
+});

package/examples/ssr/solidstart/middleware-v2.js

@@ -0,0 +1,25 @@
+// SolidStart 2: register this module using solidStart({ middleware: ... }).
+import { createMiddleware } from '@solidjs/start/middleware';
+import { createStopneticAppHandler } from '@stopnetic/js/server';
+
+let check;
+export default createMiddleware([
+  async (event, next) => {
+    check ??= createStopneticAppHandler((_request, state) => {
+      state.allowed = true;
+      return new Response(null, { status: 204 });
+    });
+    // Per-request state: a verification 204 must NEVER be mistaken for permission.
+    const state = { allowed: false };
+    const response = await check(event.req, state);
+    if (!state.allowed) return response;
+    event.res.headers.set('cache-control', 'private, no-store');
+    const result = await next(); // Preserve H3/SolidStart context and raw results.
+    if (!(result instanceof Response)) return result;
+    const headers = new Headers(result.headers);
+    headers.set('cache-control', 'private, no-store');
+    return new Response(result.body, {
+      status: result.status, statusText: result.statusText, headers,
+    });
+  },
+]);

package/examples/ssr/sveltekit/hooks.server.js

@@ -0,0 +1,16 @@
+import { building } from '$app/environment';
+import { createStopneticAppHandler } from '@stopnetic/js/server';
+
+let guarded;
+// When merging existing hooks, run this first and put them in the continuation.
+export async function handle({ event, resolve }) {
+  // Build-time public prerendering only. Protected routes must have prerender=false.
+  if (building) return resolve(event);
+  guarded ??= createStopneticAppHandler((_request, run) => run());
+  // SvelteKit exposes the canonical page URL on data requests. Check that page
+  // rather than allowing an unmatched /members/__data.json alias through.
+  const checked = event.isDataRequest
+    ? new Request(event.url, { method: event.request.method, headers: event.request.headers })
+    : event.request;
+  return guarded(checked, () => resolve(event));
+}

package/examples/ssr/sveltekit/page.server.js

@@ -0,0 +1,3 @@
+// Merge into the PROTECTED route's +page.server.js, retaining loads/actions.
+export const prerender = false;
+export const ssr = true;

package/examples/ssr/vue/install.mjs

@@ -0,0 +1,10 @@
+// Existing custom Vue SSR server: call before assets, APIs and Vue rendering.
+// Keep createSSRApp/renderToString and client hydration unchanged.
+import { createStopneticServer } from '@stopnetic/js/server';
+export function installStopneticVueSSR(app) {
+  let server;
+  app.use((req, res, next) => {
+    server ??= createStopneticServer();
+    return server.access(req, res, () => server.guard(req, res, next));
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stopnetic/js",
-  "version": "0.0.4-pilot",
+  "version": "0.0.6-pilot",
   "description": "Server-side Stopnetic guard for JavaScript websites, Node.js and Express-compatible servers.",
   "type": "module",
   "license": "MIT",
@@ -20,7 +20,8 @@
   "files": [
     "dist",
     "bin",
-    "examples/frontend"
+    "examples/frontend",
+    "examples/ssr"
   ],
   "bin": { "stopnetic-js": "./bin/stopnetic-js.js" },
   "exports": {