@vertz/ui-server 0.2.24 → 0.2.26

package/dist/bun-dev-server.js

@@ -9,7 +9,7 @@ import {
 
 // src/bun-dev-server.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, watch as watch2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync2, mkdirSync, readdirSync as readdirSync2, readFileSync as readFileSync2, watch as watch2, writeFileSync as writeFileSync2 } from "fs";
 import { dirname, normalize, resolve } from "path";
 
 // src/debug-logger.ts
@@ -592,6 +592,47 @@ function createSourceMapResolver(projectRoot) {
   };
 }
 
+// src/ssr-access-evaluator.ts
+function toPrefetchSession(ssrAuth) {
+  if (!ssrAuth || ssrAuth.status !== "authenticated" || !ssrAuth.user) {
+    return { status: "unauthenticated" };
+  }
+  const roles = ssrAuth.user.role ? [ssrAuth.user.role] : undefined;
+  return {
+    status: "authenticated",
+    roles,
+    tenantId: ssrAuth.user.tenantId
+  };
+}
+function evaluateAccessRule(rule, session) {
+  switch (rule.type) {
+    case "public":
+      return true;
+    case "authenticated":
+      return session.status === "authenticated";
+    case "role":
+      if (session.status !== "authenticated")
+        return false;
+      return session.roles?.some((r) => rule.roles.includes(r)) === true;
+    case "entitlement":
+      if (session.status !== "authenticated")
+        return false;
+      return session.entitlements?.[rule.value] === true;
+    case "where":
+      return true;
+    case "fva":
+      return session.status === "authenticated";
+    case "deny":
+      return false;
+    case "all":
+      return rule.rules.every((r) => evaluateAccessRule(r, session));
+    case "any":
+      return rule.rules.some((r) => evaluateAccessRule(r, session));
+    default:
+      return false;
+  }
+}
+
 // src/ssr-access-set.ts
 function createAccessSetScript(accessSet, nonce) {
   const json = JSON.stringify(accessSet);
@@ -603,6 +644,304 @@ function escapeAttr(s) {
   return s.replace(/[&"'<>]/g, (c) => `&#${c.charCodeAt(0)};`);
 }
 
+// src/ssr-aot-manifest-dev.ts
+import { compileForSSRAot } from "@vertz/ui-compiler";
+
+// src/ssr-aot-diagnostics.ts
+var MAX_DIVERGENCES = 20;
+
+class AotDiagnostics {
+  _components = new Map;
+  _divergences = [];
+  recordCompilation(components) {
+    for (const comp of components) {
+      this._components.set(comp.name, {
+        tier: comp.tier,
+        holes: comp.holes
+      });
+    }
+  }
+  recordDivergence(component, aotHtml, domHtml) {
+    this._divergences.push({
+      component,
+      aotHtml,
+      domHtml,
+      timestamp: new Date().toISOString()
+    });
+    if (this._divergences.length > MAX_DIVERGENCES) {
+      this._divergences = this._divergences.slice(this._divergences.length - MAX_DIVERGENCES);
+    }
+  }
+  clear() {
+    this._components.clear();
+    this._divergences = [];
+  }
+  clearComponents() {
+    this._components.clear();
+  }
+  getClassificationLog() {
+    const lines = [];
+    for (const [name, comp] of this._components) {
+      let line = `${name}: ${comp.tier}`;
+      if (comp.holes.length > 0) {
+        line += `, ${comp.holes.length} hole${comp.holes.length > 1 ? "s" : ""} (${comp.holes.join(", ")})`;
+      }
+      lines.push(line);
+    }
+    const snapshot = this.getSnapshot();
+    const { total, aot, percentage } = snapshot.coverage;
+    if (total > 0) {
+      lines.push(`Coverage: ${aot}/${total} components (${percentage}%)`);
+    }
+    return lines;
+  }
+  getSnapshot() {
+    let aot = 0;
+    let runtime = 0;
+    for (const comp of this._components.values()) {
+      if (comp.tier === "runtime-fallback") {
+        runtime++;
+      } else {
+        aot++;
+      }
+    }
+    const total = aot + runtime;
+    return {
+      components: Object.fromEntries(this._components),
+      coverage: {
+        total,
+        aot,
+        runtime,
+        percentage: total === 0 ? 0 : Math.round(aot / total * 100)
+      },
+      divergences: [...this._divergences]
+    };
+  }
+}
+
+// src/ssr-aot-manifest-dev.ts
+function createAotManifestManager(options) {
+  const { readFile: readFile2, listFiles } = options;
+  let currentManifest = null;
+  const diagnostics = new AotDiagnostics;
+  let rebuildCount = 0;
+  let lastRebuildMs = null;
+  let lastRebuildAt = null;
+  function compileFile(filePath, source) {
+    try {
+      const result = compileForSSRAot(source, { filename: filePath });
+      return result.components.map((comp) => ({
+        name: comp.name,
+        entry: {
+          tier: comp.tier,
+          holes: comp.holes,
+          file: filePath
+        }
+      }));
+    } catch {
+      return [];
+    }
+  }
+  function updateDiagnostics(manifest, isFullBuild) {
+    if (isFullBuild) {
+      diagnostics.clear();
+    } else {
+      diagnostics.clearComponents();
+    }
+    const entries = Object.entries(manifest.components).map(([name, entry]) => ({
+      name,
+      tier: entry.tier,
+      holes: entry.holes
+    }));
+    diagnostics.recordCompilation(entries);
+  }
+  function fullBuild() {
+    const start = performance.now();
+    const files = listFiles();
+    const components = {};
+    for (const filePath of files) {
+      if (!filePath.endsWith(".tsx"))
+        continue;
+      const source = readFile2(filePath);
+      if (!source)
+        continue;
+      const entries = compileFile(filePath, source);
+      for (const { name, entry } of entries) {
+        components[name] = entry;
+      }
+    }
+    currentManifest = { components };
+    updateDiagnostics(currentManifest, true);
+    rebuildCount++;
+    lastRebuildMs = Math.round(performance.now() - start);
+    lastRebuildAt = new Date().toISOString();
+  }
+  function incrementalUpdate(filePath, sourceText) {
+    if (!currentManifest)
+      return;
+    const start = performance.now();
+    const newComponents = { ...currentManifest.components };
+    for (const [name, entry] of Object.entries(newComponents)) {
+      if (entry.file === filePath) {
+        delete newComponents[name];
+      }
+    }
+    if (sourceText.trim()) {
+      const entries = compileFile(filePath, sourceText);
+      for (const { name, entry } of entries) {
+        newComponents[name] = entry;
+      }
+    }
+    currentManifest = { components: newComponents };
+    updateDiagnostics(currentManifest, false);
+    rebuildCount++;
+    lastRebuildMs = Math.round(performance.now() - start);
+    lastRebuildAt = new Date().toISOString();
+  }
+  return {
+    build() {
+      fullBuild();
+    },
+    onFileChange(filePath, sourceText) {
+      if (!filePath.endsWith(".tsx"))
+        return;
+      incrementalUpdate(filePath, sourceText);
+    },
+    getManifest() {
+      return currentManifest;
+    },
+    getSnapshot() {
+      return {
+        manifest: currentManifest,
+        rebuildCount,
+        lastRebuildMs,
+        lastRebuildAt
+      };
+    },
+    getDiagnostics() {
+      return diagnostics;
+    }
+  };
+}
+
+// src/ssr-prefetch-dev.ts
+import {
+  analyzeComponentQueries,
+  generatePrefetchManifest
+} from "@vertz/ui-compiler";
+function createPrefetchManifestManager(options) {
+  const { routerPath, readFile: readFile2, resolveImport } = options;
+  let currentManifest = null;
+  let currentSSRManifest;
+  let rebuildCount = 0;
+  let lastRebuildMs = null;
+  let lastRebuildAt = null;
+  let fileToRouteIndices = new Map;
+  function buildFileIndex(routes) {
+    const index = new Map;
+    for (let i = 0;i < routes.length; i++) {
+      const file = routes[i]?.file;
+      if (file) {
+        const existing = index.get(file) ?? [];
+        existing.push(i);
+        index.set(file, existing);
+      }
+    }
+    return index;
+  }
+  function toSSRManifest(manifest) {
+    const routeEntries = {};
+    for (const route of manifest.routes) {
+      const existing = routeEntries[route.pattern];
+      if (existing) {
+        existing.queries.push(...route.queries);
+      } else {
+        routeEntries[route.pattern] = { queries: [...route.queries] };
+      }
+    }
+    return {
+      routePatterns: [...new Set(manifest.routes.map((r) => r.pattern))],
+      routeEntries
+    };
+  }
+  function fullBuild(routerSourceOverride) {
+    const start = performance.now();
+    const routerSource = routerSourceOverride ?? readFile2(routerPath);
+    if (!routerSource) {
+      return;
+    }
+    try {
+      const manifest = generatePrefetchManifest({
+        routerSource,
+        routerPath,
+        readFile: readFile2,
+        resolveImport
+      });
+      currentManifest = manifest;
+      currentSSRManifest = toSSRManifest(manifest);
+      fileToRouteIndices = buildFileIndex(manifest.routes);
+      rebuildCount++;
+      lastRebuildMs = Math.round(performance.now() - start);
+      lastRebuildAt = new Date().toISOString();
+    } catch {}
+  }
+  function incrementalUpdate(filePath, sourceText) {
+    if (!currentManifest)
+      return;
+    const indices = fileToRouteIndices.get(filePath);
+    if (!indices || indices.length === 0)
+      return;
+    const start = performance.now();
+    try {
+      const analysis = analyzeComponentQueries(sourceText, filePath);
+      const newRoutes = [...currentManifest.routes];
+      for (const idx of indices) {
+        const existing = newRoutes[idx];
+        if (existing) {
+          newRoutes[idx] = {
+            ...existing,
+            queries: analysis.queries,
+            params: analysis.params
+          };
+        }
+      }
+      const newManifest = {
+        ...currentManifest,
+        routes: newRoutes,
+        generatedAt: new Date().toISOString()
+      };
+      currentManifest = newManifest;
+      currentSSRManifest = toSSRManifest(newManifest);
+      rebuildCount++;
+      lastRebuildMs = Math.round(performance.now() - start);
+      lastRebuildAt = new Date().toISOString();
+    } catch {}
+  }
+  return {
+    build() {
+      fullBuild();
+    },
+    onFileChange(filePath, sourceText) {
+      if (filePath === routerPath) {
+        fullBuild(sourceText);
+      } else {
+        incrementalUpdate(filePath, sourceText);
+      }
+    },
+    getSSRManifest() {
+      return currentSSRManifest;
+    },
+    getSnapshot() {
+      return {
+        manifest: currentManifest,
+        rebuildCount,
+        lastRebuildMs,
+        lastRebuildAt
+      };
+    }
+  };
+}
+
 // src/ssr-render.ts
 import { compileTheme } from "@vertz/ui";
 import { EntityStore, MemoryCache, QueryEnvelopeStore } from "@vertz/ui/internals";
@@ -612,6 +951,7 @@ import { setAdapter } from "@vertz/ui/internals";
 
 // src/dom-shim/ssr-node.ts
 class SSRNode {
+  nodeType = 1;
   childNodes = [];
   parentNode = null;
   get firstChild() {
@@ -657,6 +997,7 @@ class SSRNode {
 
 // src/dom-shim/ssr-comment.ts
 class SSRComment extends SSRNode {
+  nodeType = 8;
   text;
   constructor(text) {
     super();
@@ -680,6 +1021,7 @@ function rawHtml(html) {
 
 // src/dom-shim/ssr-text-node.ts
 class SSRTextNode extends SSRNode {
+  nodeType = 3;
   text;
   constructor(text) {
     super();
@@ -695,6 +1037,7 @@ class SSRTextNode extends SSRNode {
 
 // src/dom-shim/ssr-fragment.ts
 class SSRDocumentFragment extends SSRNode {
+  nodeType = 11;
   children = [];
   appendChild(child) {
     if (child instanceof SSRTextNode) {
@@ -1695,6 +2038,426 @@ function escapeAttr3(s) {
   return s.replace(/[&"'<>]/g, (c) => `&#${c.charCodeAt(0)};`);
 }
 
+// src/ssr-single-pass.ts
+import { compileTheme as compileTheme2 } from "@vertz/ui";
+
+// src/ssr-manifest-prefetch.ts
+function reconstructDescriptors(queries, routeParams, apiClient) {
+  if (!apiClient)
+    return [];
+  const result = [];
+  for (const query of queries) {
+    const descriptor = reconstructSingle(query, routeParams, apiClient);
+    if (descriptor) {
+      result.push(descriptor);
+    }
+  }
+  return result;
+}
+function reconstructSingle(query, routeParams, apiClient) {
+  const { entity, operation } = query;
+  if (!entity || !operation)
+    return;
+  const entitySdk = apiClient[entity];
+  if (!entitySdk)
+    return;
+  const method = entitySdk[operation];
+  if (typeof method !== "function")
+    return;
+  const args = buildFactoryArgs(query, routeParams);
+  if (args === undefined)
+    return;
+  try {
+    const descriptor = method(...args);
+    if (!descriptor || typeof descriptor._key !== "string" || typeof descriptor._fetch !== "function") {
+      return;
+    }
+    return { key: descriptor._key, fetch: descriptor._fetch };
+  } catch {
+    return;
+  }
+}
+function buildFactoryArgs(query, routeParams) {
+  const { operation, idParam, queryBindings } = query;
+  if (operation === "get") {
+    if (idParam) {
+      const id = routeParams[idParam];
+      if (!id)
+        return;
+      const options = resolveQueryBindings(queryBindings, routeParams);
+      if (options === undefined && queryBindings)
+        return;
+      return options ? [id, options] : [id];
+    }
+    return;
+  }
+  if (!queryBindings)
+    return [];
+  const resolved = resolveQueryBindings(queryBindings, routeParams);
+  if (resolved === undefined)
+    return;
+  return [resolved];
+}
+function resolveQueryBindings(bindings, routeParams) {
+  if (!bindings)
+    return;
+  const resolved = {};
+  if (bindings.where) {
+    const where = {};
+    for (const [key, value] of Object.entries(bindings.where)) {
+      if (value === null)
+        return;
+      if (typeof value === "string" && value.startsWith("$")) {
+        const paramName = value.slice(1);
+        const paramValue = routeParams[paramName];
+        if (!paramValue)
+          return;
+        where[key] = paramValue;
+      } else {
+        where[key] = value;
+      }
+    }
+    resolved.where = where;
+  }
+  if (bindings.select)
+    resolved.select = bindings.select;
+  if (bindings.include)
+    resolved.include = bindings.include;
+  if (bindings.orderBy)
+    resolved.orderBy = bindings.orderBy;
+  if (bindings.limit !== undefined)
+    resolved.limit = bindings.limit;
+  return resolved;
+}
+
+// src/ssr-route-matcher.ts
+function matchUrlToPatterns(url, patterns) {
+  const path = (url.split("?")[0] ?? "").split("#")[0] ?? "";
+  const matches = [];
+  for (const pattern of patterns) {
+    const result = matchPattern(path, pattern);
+    if (result) {
+      matches.push(result);
+    }
+  }
+  matches.sort((a, b) => {
+    const aSegments = a.pattern.split("/").length;
+    const bSegments = b.pattern.split("/").length;
+    return aSegments - bSegments;
+  });
+  return matches;
+}
+function matchPattern(path, pattern) {
+  const pathSegments = path.split("/").filter(Boolean);
+  const patternSegments = pattern.split("/").filter(Boolean);
+  if (patternSegments.length > pathSegments.length)
+    return;
+  const params = {};
+  for (let i = 0;i < patternSegments.length; i++) {
+    const seg = patternSegments[i];
+    const val = pathSegments[i];
+    if (seg.startsWith(":")) {
+      params[seg.slice(1)] = val;
+    } else if (seg !== val) {
+      return;
+    }
+  }
+  return { pattern, params };
+}
+
+// src/ssr-single-pass.ts
+async function ssrRenderSinglePass(module, url, options) {
+  if (options?.prefetch === false) {
+    return ssrRenderToString(module, url, options);
+  }
+  const normalizedUrl = url.endsWith("/index.html") ? url.slice(0, -"/index.html".length) || "/" : url;
+  const ssrTimeout = options?.ssrTimeout ?? 300;
+  ensureDomShim2();
+  const zeroDiscoveryData = attemptZeroDiscovery(normalizedUrl, module, options, ssrTimeout);
+  if (zeroDiscoveryData) {
+    return renderWithPrefetchedData(module, normalizedUrl, zeroDiscoveryData, options);
+  }
+  const discoveryCtx = createRequestContext(normalizedUrl);
+  if (options?.ssrAuth) {
+    discoveryCtx.ssrAuth = options.ssrAuth;
+  }
+  const discoveredData = await ssrStorage.run(discoveryCtx, async () => {
+    try {
+      setGlobalSSRTimeout(ssrTimeout);
+      const createApp = resolveAppFactory2(module);
+      createApp();
+      if (discoveryCtx.ssrRedirect) {
+        return { redirect: discoveryCtx.ssrRedirect };
+      }
+      if (discoveryCtx.pendingRouteComponents?.size) {
+        const entries = Array.from(discoveryCtx.pendingRouteComponents.entries());
+        const results = await Promise.allSettled(entries.map(([route, promise]) => Promise.race([
+          promise.then((mod) => ({ route, factory: mod.default })),
+          new Promise((_, reject) => setTimeout(() => reject(new Error("lazy route timeout")), ssrTimeout))
+        ])));
+        discoveryCtx.resolvedComponents = new Map;
+        for (const result of results) {
+          if (result.status === "fulfilled") {
+            const { route, factory } = result.value;
+            discoveryCtx.resolvedComponents.set(route, factory);
+          }
+        }
+        discoveryCtx.pendingRouteComponents = undefined;
+      }
+      const queries = getSSRQueries();
+      const eligibleQueries = filterByEntityAccess(queries, options?.manifest?.entityAccess, options?.prefetchSession);
+      const resolvedQueries = [];
+      if (eligibleQueries.length > 0) {
+        await Promise.allSettled(eligibleQueries.map(({ promise, timeout, resolve, key }) => Promise.race([
+          promise.then((data) => {
+            resolve(data);
+            resolvedQueries.push({ key, data });
+            return "resolved";
+          }),
+          new Promise((r) => setTimeout(r, timeout || ssrTimeout)).then(() => "timeout")
+        ])));
+      }
+      return {
+        resolvedQueries,
+        resolvedComponents: discoveryCtx.resolvedComponents
+      };
+    } finally {
+      clearGlobalSSRTimeout();
+    }
+  });
+  if ("redirect" in discoveredData) {
+    return {
+      html: "",
+      css: "",
+      ssrData: [],
+      headTags: "",
+      redirect: discoveredData.redirect
+    };
+  }
+  const renderCtx = createRequestContext(normalizedUrl);
+  if (options?.ssrAuth) {
+    renderCtx.ssrAuth = options.ssrAuth;
+  }
+  for (const { key, data } of discoveredData.resolvedQueries) {
+    renderCtx.queryCache.set(key, data);
+  }
+  renderCtx.resolvedComponents = discoveredData.resolvedComponents ?? new Map;
+  return ssrStorage.run(renderCtx, async () => {
+    try {
+      setGlobalSSRTimeout(ssrTimeout);
+      const createApp = resolveAppFactory2(module);
+      let themeCss = "";
+      let themePreloadTags = "";
+      if (module.theme) {
+        try {
+          const compiled = compileTheme2(module.theme, {
+            fallbackMetrics: options?.fallbackMetrics
+          });
+          themeCss = compiled.css;
+          themePreloadTags = compiled.preloadTags;
+        } catch (e) {
+          console.error("[vertz] Failed to compile theme export. Ensure your theme is created with defineTheme().", e);
+        }
+      }
+      const app = createApp();
+      const vnode = toVNode(app);
+      const stream = renderToStream(vnode);
+      const html = await streamToString(stream);
+      const css = collectCSS2(themeCss, module);
+      const ssrData = discoveredData.resolvedQueries.map(({ key, data }) => ({
+        key,
+        data: JSON.parse(JSON.stringify(data))
+      }));
+      return {
+        html,
+        css,
+        ssrData,
+        headTags: themePreloadTags,
+        discoveredRoutes: renderCtx.discoveredRoutes,
+        matchedRoutePatterns: renderCtx.matchedRoutePatterns
+      };
+    } finally {
+      clearGlobalSSRTimeout();
+    }
+  });
+}
+function attemptZeroDiscovery(url, module, options, ssrTimeout) {
+  const manifest = options?.manifest;
+  if (!manifest?.routeEntries || !module.api)
+    return null;
+  const matches = matchUrlToPatterns(url, manifest.routePatterns);
+  if (matches.length === 0)
+    return null;
+  const allQueries = [];
+  let mergedParams = {};
+  for (const match of matches) {
+    const entry = manifest.routeEntries[match.pattern];
+    if (entry) {
+      allQueries.push(...entry.queries);
+    }
+    mergedParams = { ...mergedParams, ...match.params };
+  }
+  if (allQueries.length === 0)
+    return null;
+  const descriptors = reconstructDescriptors(allQueries, mergedParams, module.api);
+  if (descriptors.length === 0)
+    return null;
+  return prefetchFromDescriptors(descriptors, ssrTimeout);
+}
+async function prefetchFromDescriptors(descriptors, ssrTimeout) {
+  const resolvedQueries = [];
+  await Promise.allSettled(descriptors.map(({ key, fetch: fetchFn }) => Promise.race([
+    fetchFn().then((result) => {
+      const data = unwrapResult(result);
+      resolvedQueries.push({ key, data });
+      return "resolved";
+    }),
+    new Promise((r) => setTimeout(r, ssrTimeout)).then(() => "timeout")
+  ])));
+  return { resolvedQueries };
+}
+function unwrapResult(result) {
+  if (result && typeof result === "object" && "ok" in result && "data" in result) {
+    const r = result;
+    if (r.ok)
+      return r.data;
+  }
+  return result;
+}
+async function renderWithPrefetchedData(module, normalizedUrl, prefetchedData, options) {
+  const data = await prefetchedData;
+  const ssrTimeout = options?.ssrTimeout ?? 300;
+  const renderCtx = createRequestContext(normalizedUrl);
+  if (options?.ssrAuth) {
+    renderCtx.ssrAuth = options.ssrAuth;
+  }
+  for (const { key, data: queryData } of data.resolvedQueries) {
+    renderCtx.queryCache.set(key, queryData);
+  }
+  renderCtx.resolvedComponents = new Map;
+  return ssrStorage.run(renderCtx, async () => {
+    try {
+      setGlobalSSRTimeout(ssrTimeout);
+      const createApp = resolveAppFactory2(module);
+      let themeCss = "";
+      let themePreloadTags = "";
+      if (module.theme) {
+        try {
+          const compiled = compileTheme2(module.theme, {
+            fallbackMetrics: options?.fallbackMetrics
+          });
+          themeCss = compiled.css;
+          themePreloadTags = compiled.preloadTags;
+        } catch (e) {
+          console.error("[vertz] Failed to compile theme export. Ensure your theme is created with defineTheme().", e);
+        }
+      }
+      const app = createApp();
+      const vnode = toVNode(app);
+      const stream = renderToStream(vnode);
+      const html = await streamToString(stream);
+      if (renderCtx.ssrRedirect) {
+        return {
+          html: "",
+          css: "",
+          ssrData: [],
+          headTags: "",
+          redirect: renderCtx.ssrRedirect,
+          discoveredRoutes: renderCtx.discoveredRoutes,
+          matchedRoutePatterns: renderCtx.matchedRoutePatterns
+        };
+      }
+      const css = collectCSS2(themeCss, module);
+      const ssrData = data.resolvedQueries.map(({ key, data: d }) => ({
+        key,
+        data: JSON.parse(JSON.stringify(d))
+      }));
+      return {
+        html,
+        css,
+        ssrData,
+        headTags: themePreloadTags,
+        discoveredRoutes: renderCtx.discoveredRoutes,
+        matchedRoutePatterns: renderCtx.matchedRoutePatterns
+      };
+    } finally {
+      clearGlobalSSRTimeout();
+    }
+  });
+}
+var domShimInstalled2 = false;
+function ensureDomShim2() {
+  if (domShimInstalled2 && typeof document !== "undefined")
+    return;
+  domShimInstalled2 = true;
+  installDomShim();
+}
+function resolveAppFactory2(module) {
+  const createApp = module.default || module.App;
+  if (typeof createApp !== "function") {
+    throw new Error("App entry must export a default function or named App function");
+  }
+  return createApp;
+}
+function filterByEntityAccess(queries, entityAccess, session) {
+  if (!entityAccess || !session)
+    return queries;
+  return queries.filter(({ key }) => {
+    const entity = extractEntityFromKey(key);
+    const method = extractMethodFromKey(key);
+    if (!entity)
+      return true;
+    const entityRules = entityAccess[entity];
+    if (!entityRules)
+      return true;
+    const rule = entityRules[method];
+    if (!rule)
+      return true;
+    return evaluateAccessRule(rule, session);
+  });
+}
+function extractEntityFromKey(key) {
+  const pathStart = key.indexOf(":/");
+  if (pathStart === -1)
+    return;
+  const path = key.slice(pathStart + 2);
+  const firstSlash = path.indexOf("/");
+  const questionMark = path.indexOf("?");
+  if (firstSlash === -1 && questionMark === -1)
+    return path;
+  if (firstSlash === -1)
+    return path.slice(0, questionMark);
+  if (questionMark === -1)
+    return path.slice(0, firstSlash);
+  return path.slice(0, Math.min(firstSlash, questionMark));
+}
+function extractMethodFromKey(key) {
+  const pathStart = key.indexOf(":/");
+  if (pathStart === -1)
+    return "list";
+  const path = key.slice(pathStart + 2);
+  const cleanPath = path.split("?")[0] ?? "";
+  const segments = cleanPath.split("/").filter(Boolean);
+  return segments.length > 1 ? "get" : "list";
+}
+function collectCSS2(themeCss, module) {
+  const alreadyIncluded = new Set;
+  if (themeCss)
+    alreadyIncluded.add(themeCss);
+  if (module.styles) {
+    for (const s of module.styles)
+      alreadyIncluded.add(s);
+  }
+  const componentCss = module.getInjectedCSS ? module.getInjectedCSS().filter((s) => !alreadyIncluded.has(s)) : [];
+  const themeTag = themeCss ? `<style data-vertz-css>${themeCss}</style>` : "";
+  const globalTag = module.styles && module.styles.length > 0 ? `<style data-vertz-css>${module.styles.join(`
+`)}</style>` : "";
+  const componentTag = componentCss.length > 0 ? `<style data-vertz-css>${componentCss.join(`
+`)}</style>` : "";
+  return [themeTag, globalTag, componentTag].filter(Boolean).join(`
+`);
+}
+
 // src/upstream-watcher.ts
 import { existsSync, lstatSync, readdirSync, realpathSync, watch } from "fs";
 import { join as join3 } from "path";
@@ -2143,6 +2906,18 @@ function clearSSRRequireCache() {
   }
   return keys.length;
 }
+function collectFiles(dir) {
+  const files = [];
+  for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+    const fullPath = resolve(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...collectFiles(fullPath));
+    } else {
+      files.push(fullPath);
+    }
+  }
+  return files;
+}
 function createBunDevServer(options) {
   const {
     entry,
@@ -2173,6 +2948,7 @@ function createBunDevServer(options) {
   mkdirSync(devDir, { recursive: true });
   const logger = createDebugLogger(devDir);
   const diagnostics = new DiagnosticsCollector;
+  let aotManifestManager = null;
   let server = null;
   let srcWatcherRef = null;
   let refreshTimeout = null;
@@ -2540,6 +3316,83 @@ function createBunDevServer(options) {
         console.warn("[Server] Failed to extract font metrics:", e);
       }
     }
+    let prefetchManager = null;
+    const srcDir = resolve(projectRoot, "src");
+    const routerCandidates = [resolve(srcDir, "router.tsx"), resolve(srcDir, "router.ts")];
+    const routerPath = routerCandidates.find((p) => existsSync2(p));
+    if (routerPath) {
+      prefetchManager = createPrefetchManifestManager({
+        routerPath,
+        readFile: (path) => {
+          try {
+            return readFileSync2(path, "utf-8");
+          } catch {
+            return;
+          }
+        },
+        resolveImport: (specifier, fromFile) => {
+          if (!specifier.startsWith("."))
+            return;
+          const dir = dirname(fromFile);
+          const base = resolve(dir, specifier);
+          for (const ext of [".tsx", ".ts", ".jsx", ".js"]) {
+            const candidate = `${base}${ext}`;
+            if (existsSync2(candidate))
+              return candidate;
+          }
+          for (const ext of [".tsx", ".ts"]) {
+            const candidate = resolve(base, `index${ext}`);
+            if (existsSync2(candidate))
+              return candidate;
+          }
+          return;
+        }
+      });
+      try {
+        const buildStart = performance.now();
+        prefetchManager.build();
+        const buildMs = Math.round(performance.now() - buildStart);
+        logger.log("prefetch", "initial-build", { routerPath, durationMs: buildMs });
+        if (logRequests) {
+          const manifest = prefetchManager.getSSRManifest();
+          const routeCount = manifest?.routePatterns.length ?? 0;
+          console.log(`[Server] Prefetch manifest built (${routeCount} routes, ${buildMs}ms)`);
+        }
+      } catch (e) {
+        console.warn("[Server] Failed to build prefetch manifest:", e instanceof Error ? e.message : e);
+        prefetchManager = null;
+      }
+    }
+    aotManifestManager = createAotManifestManager({
+      readFile: (path) => {
+        try {
+          return readFileSync2(path, "utf-8");
+        } catch {
+          return;
+        }
+      },
+      listFiles: () => {
+        try {
+          return collectFiles(srcDir);
+        } catch {
+          return [];
+        }
+      }
+    });
+    try {
+      const aotStart = performance.now();
+      aotManifestManager.build();
+      const aotMs = Math.round(performance.now() - aotStart);
+      logger.log("aot", "initial-build", { durationMs: aotMs });
+      if (logRequests) {
+        const manifest = aotManifestManager.getManifest();
+        const count = manifest ? Object.keys(manifest.components).length : 0;
+        console.log(`[Server] AOT manifest built (${count} components, ${aotMs}ms)`);
+      }
+    } catch (e) {
+      console.warn("[Server] Failed to build AOT manifest:", e instanceof Error ? e.message : e);
+      aotManifestManager = null;
+    }
     mkdirSync(devDir, { recursive: true });
     const frInitPath = resolve(devDir, "fast-refresh-init.ts");
     writeFileSync2(frInitPath, `import '@vertz/ui-server/fast-refresh-runtime';
@@ -2630,6 +3483,18 @@ if (import.meta.hot) import.meta.hot.accept();
         if (pathname === "/__vertz_diagnostics") {
           return Response.json(diagnostics.getSnapshot());
         }
+        if (pathname === "/__vertz_ssr_aot") {
+          if (!aotManifestManager) {
+            return Response.json({ error: "AOT manifest manager not available" }, { status: 404 });
+          }
+          return Response.json(aotManifestManager.getDiagnostics().getSnapshot());
+        }
+        if (pathname === "/__vertz_prefetch_manifest") {
+          if (!prefetchManager) {
+            return Response.json({ error: "No prefetch manifest available (router file not found)" }, { status: 404 });
+          }
+          return Response.json(prefetchManager.getSnapshot());
+        }
         if (pathname === "/_vertz/image") {
           return handleDevImageProxy(request);
         }
@@ -2756,10 +3621,12 @@ data: {}
           const doRender = async () => {
             logger.log("ssr", "render-start", { url: pathname });
             const ssrStart = performance.now();
-            const result = await ssrRenderToString(ssrMod, pathname + url.search, {
+            const result = await ssrRenderSinglePass(ssrMod, pathname + url.search, {
               ssrTimeout: 300,
               fallbackMetrics: fontFallbackMetrics,
-              ssrAuth
+              ssrAuth,
+              manifest: prefetchManager?.getSSRManifest(),
+              prefetchSession: toPrefetchSession(ssrAuth)
             });
             logger.log("ssr", "render-done", {
               url: pathname,
@@ -2969,7 +3836,6 @@ data: {}
         console.warn("[Server] Could not discover HMR bundled URL:", e);
       }
     }
-    const srcDir = resolve(projectRoot, "src");
     stopped = false;
     if (existsSync2(srcDir)) {
       srcWatcherRef = watch2(srcDir, { recursive: true }, (_event, filename) => {
@@ -3040,7 +3906,30 @@ data: {}
               const { changed } = updateServerManifest(changedFilePath, source);
               const manifestDurationMs = Math.round(performance.now() - manifestStartMs);
               diagnostics.recordManifestUpdate(lastChangedFile, changed, manifestDurationMs);
-            } catch {}
+              if (prefetchManager) {
+                const prefetchStart = performance.now();
+                prefetchManager.onFileChange(changedFilePath, source);
+                const prefetchMs = Math.round(performance.now() - prefetchStart);
+                logger.log("prefetch", "rebuild", {
+                  file: lastChangedFile,
+                  durationMs: prefetchMs,
+                  isRouter: changedFilePath === routerPath
+                });
+              }
+              if (aotManifestManager) {
+                const aotStart = performance.now();
+                aotManifestManager.onFileChange(changedFilePath, source);
+                const aotMs = Math.round(performance.now() - aotStart);
+                logger.log("aot", "rebuild", {
+                  file: lastChangedFile,
+                  durationMs: aotMs
+                });
+              }
+            } catch {
+              if (aotManifestManager) {
+                aotManifestManager.onFileChange(changedFilePath, "");
+              }
+            }
           }
           if (stopped)
             return;