@vesk/adapter 0.1.14 → 0.2.9

package/dist/api-function.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-function.d.ts","sourceRoot":"","sources":["../src/api-function.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAOhF,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,kBAAkB,GAC3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAuLtD"}
+{"version":3,"file":"api-function.d.ts","sourceRoot":"","sources":["../src/api-function.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAOhF,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,kBAAkB,GAC3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAyLtD"}

package/dist/api-function.js

@@ -1,6 +1,6 @@
 import { readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
-import { transformSync } from './esbuild-fallback.js';
+import { stripCodeTypes } from '@vesk/compiler/src/strip-ts';
 function apiRouteName(fullPath) {
     const parts = fullPath.split('/').filter(Boolean);
     return parts.map(s => s.startsWith(':') ? s.slice(1) || 'param' : s).join('_') || 'index';
@@ -10,6 +10,8 @@ export function generateApiFunction(apiNode, _apiDir, outDir, options) {
     const name = apiRouteName(apiNode.fullPath);
     const funcPath = resolve(outDir, 'server', 'api', `${name}.js`);
     const routeFilePath = apiNode.filePath;
+    if (!routeFilePath)
+        throw new Error(`api route ${apiNode.fullPath} has no filePath`);
     let routeSrc = readFileSync(routeFilePath, 'utf-8');
     routeSrc = routeSrc
         .replace(/from\s+['"]@vesk\/runtime['"]\s*;?/g, "from '../runtime.js';")
@@ -18,8 +20,7 @@ export function generateApiFunction(apiNode, _apiDir, outDir, options) {
     });
     if (routeFilePath.endsWith('.ts')) {
         try {
-            const result = transformSync(routeSrc, { loader: 'ts' });
-            routeSrc = result.code;
+            routeSrc = stripCodeTypes(routeSrc);
         }
         catch {
             // fall back to original source if stripping fails
@@ -57,12 +58,13 @@ export function generateApiFunction(apiNode, _apiDir, outDir, options) {
             '    get: () => Object.fromEntries(url.searchParams.entries()),',
             '    enumerable: true,',
             '  });',
+            "  const __rootLocals = (globalThis.__vesk_request && globalThis.__vesk_request.locals) || {};",
             '  // ── Middleware context ──',
             '  const __ctx = {',
             '    request,',
             '    params,',
             '    url,',
-            '    locals: {},',
+            '    locals: Object.assign({}, __rootLocals),',
             "    cookies: parseCookies(request.headers.get('cookie') || ''),",
             '    set(key, value) { this.locals[key] = value; },',
             '    get(key) { return this.locals[key]; },',
@@ -124,12 +126,13 @@ export function generateApiFunction(apiNode, _apiDir, outDir, options) {
             '    get: () => Object.fromEntries(url.searchParams.entries()),',
             '    enumerable: true,',
             '  });',
+            "  const __rootLocals = (globalThis.__vesk_request && globalThis.__vesk_request.locals) || {};",
             '  const ctx = {',
             "    headers: Object.fromEntries(request.headers.entries()),",
             '    url: request.url,',
             '    method,',
             "    cookies: parseCookies(request.headers.get('cookie') || ''),",
-            '    locals: {},',
+            '    locals: Object.assign({}, __rootLocals),',
             '  };',
             "  Object.defineProperty(request, 'locals', {",
             '    get: () => ctx.locals,',

package/dist/client-bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-bundle.d.ts","sourceRoot":"","sources":["../src/client-bundle.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAqC,MAAM,yBAAyB,CAAC;AA2BrI,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,SAAS,EAAE,EACtB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAqN7B;AAMD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA+B3D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAUlE;AAID;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA+BrG"}
+{"version":3,"file":"client-bundle.d.ts","sourceRoot":"","sources":["../src/client-bundle.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAqC,MAAM,yBAAyB,CAAC;AAoCrI,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,SAAS,EAAE,EACtB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAoT7B;AAMD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA+B3D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAUlE;AAID;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA+BrG"}

package/dist/client-bundle.js

@@ -1,11 +1,22 @@
-import { readFileSync, existsSync, writeFileSync, unlinkSync } from 'node:fs';
+import { readFileSync, existsSync, writeFileSync, unlinkSync, statSync } from 'node:fs';
 import { resolve, join, dirname, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { build, transformSync } from './esbuild-fallback.js';
-import { compileClient } from '@vesk/compiler/src/client-codegen';
+import { build } from './esbuild-fallback.js';
+import { stripCodeTypes } from '@vesk/compiler/src/strip-ts';
+import { compileClient, compileClientBoth } from '@vesk/compiler/src/client-codegen';
 import { resolveComponentName } from '@vesk/compiler/src/server-codegen';
 import { collectVskImportPaths, vskImportLines } from '@vesk/compiler/src/vsk-imports';
+import { inlineMdContentAttrs, guessProjectRoots } from '@vesk/compiler/src/md-inline';
 const __dirname = dirname(fileURLToPath(import.meta.url));
+function fileUnchanged(filePath, cached) {
+    try {
+        const st = statSync(filePath);
+        return st.mtimeMs === cached.mtimeMs && st.size === cached.size;
+    }
+    catch {
+        return false;
+    }
+}
 function buildRouterOpts(options) {
     const ttl = options?.routeDataCache;
     if (typeof ttl === 'number' && ttl > 0) {
@@ -33,8 +44,21 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
     const seen = new Set();
     const chunks = [];
     const runtimeImportNames = new Set();
+    const cache = options?.cache;
+    const only = options?.only && options.only.length > 0 ? new Set(options.only) : null;
+    const returnEdited = !!options?.returnEditedSources && !!only;
+    const editedSources = returnEdited ? new Map() : undefined;
+    const editedNames = returnEdited ? new Map() : undefined;
+    let cachedFileHits = 0;
+    let compiledFiles = 0;
+    let mainFromCache = false;
+    function mustReuseWithoutStat(filePath) {
+        return !!only && !only.has(filePath);
+    }
     function collectRuntimeImports(code) {
-        const re = /^import\s*\{([^}]*)\}\s*from\s*['"]@vesk\/runtime['"];?\s*\n?/gm;
+        // matches bare '@vesk/runtime' and any of its subpaths
+        // ('@vesk/runtime/router', '@vesk/runtime/server', …)
+        const re = /^import\s*\{([^}]*)\}\s*from\s*['"]@vesk\/runtime(\/[a-zA-Z0-9-]+)*['"];?\s*\n?/gm;
         for (const m of code.matchAll(re)) {
             for (const name of m[1].split(',')) {
                 const trimmed = name.trim().replace(/^(\w+)\s+as\s+.*$/, '$1');
@@ -45,7 +69,7 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
         }
     }
     function stripRuntimeImport(code) {
-        return code.replace(/^import\s*\{[^}]*\}\s*from\s*['"]@vesk\/runtime['"];?\s*\n?/gm, '')
+        return code.replace(/^import\s*\{[^}]*\}\s*from\s*['"]@vesk\/runtime(\/[a-zA-Z0-9-]+)*['"];?\s*\n?/gm, '')
             .replace(/const\s+__components\s*=\s*\{\};\s*\n?/g, '')
             .replace(/^function __cleanup\(start, end\) \{[\s\S]*?\n\}\s*\n?/gm, '')
             .replace(/^function __place\(start, end, nodes, fallback\) \{[\s\S]*?\n\}\s*\n?/gm, '');
@@ -55,16 +79,22 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
     }
     function resolveVskImports(filePath, compile) {
         const src = readFileSync(filePath, 'utf-8');
+        const resolved = [];
         for (const importPath of collectVskImportPaths(vskImportLines(src), filePath)) {
-            let importedName = null;
             try {
-                importedName = resolveComponentName(readFileSync(importPath, 'utf-8'));
+                readFileSync(importPath);
             }
             catch {
                 continue;
             }
-            compile(importPath, importedName);
+            // resolvedName is intentionally null: compileFile derives the same
+            // name from its own IR pass, and the alias branch is unreachable
+            // when resolvedName matches — this avoids a second full parse of
+            // every imported file.
+            resolved.push(importPath);
+            compile(importPath, null);
         }
+        return resolved;
     }
     function stripExports(code) {
         return code
@@ -75,26 +105,88 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
         if (seen.has(filePath))
             return;
         seen.add(filePath);
-        const src = readFileSync(filePath, 'utf-8');
-        resolveVskImports(filePath, (p, n) => compileFile(p, n || '', output));
-        const compCode = compileClient(src, null, { forceClient: true });
-        if (compCode) {
-            collectRuntimeImports(compCode);
-            const stripped = stripExports(stripVskImports(stripRuntimeImport(compCode)));
-            output.push(stripped.replace(/^\n+/, '').replace(/\n+$/, ''));
+        // Cache-hit fast path: replay the entry's recorded contribution with no
+        // file reads or parses. Deps recurse through the same path so each hit
+        // costs one stat call (zero with `only`).
+        const cachedEntry = cache?.files.get(filePath);
+        // If one of this file's .md dependencies was the edited target, its
+        // inlined content is stale by definition — force a recompile.
+        let dependsOnEdited = false;
+        if (cachedEntry && only && !only.has(filePath)) {
+            for (const p of only) {
+                if (cachedEntry.imports.includes(p)) {
+                    dependsOnEdited = true;
+                    break;
+                }
+            }
+        }
+        const cacheUsable = !!cachedEntry && !dependsOnEdited &&
+            (mustReuseWithoutStat(filePath) || fileUnchanged(filePath, cachedEntry));
+        const cached = cacheUsable ? cachedEntry : undefined;
+        if (cached && cacheUsable) {
+            cachedFileHits++;
+            for (const dep of cached.imports)
+                compileFile(dep, cache?.files.get(dep)?.actualName ?? '', output);
+            if (cached.compCode)
+                output.push(cached.compCode);
+            if (cached.hydCode)
+                output.push(cached.hydCode);
+            for (const n of cached.runtimeNames)
+                runtimeImportNames.add(n);
+            if (cached.actualName && resolvedName !== null && cached.actualName !== resolvedName) {
+                output.push(`Object.defineProperty(__components, ${JSON.stringify(resolvedName)}, { get: () => __components[${JSON.stringify(cached.actualName)}], configurable: true });`);
+                output.push(`Object.defineProperty(__hydrators, ${JSON.stringify(resolvedName)}, { get: () => __hydrators[${JSON.stringify(cached.actualName)}], configurable: true });`);
+            }
+            return;
+        }
+        compiledFiles++;
+        let src = readFileSync(filePath, 'utf-8');
+        if (/content=["'][^"']*\.md["']/i.test(src)) {
+            src = inlineMdContentAttrs(src, dirname(filePath), guessProjectRoots(appDir));
         }
-        const hydCode = compileClient(src, null, { hydrate: true, forceClient: true, includeTopLevel: false });
-        if (hydCode) {
-            collectRuntimeImports(hydCode);
-            const stripped = stripExports(stripVskImports(stripRuntimeImport(hydCode)))
-                .replace(/__components/g, '__hydrators');
-            output.push(stripped.replace(/^\n+/, '').replace(/\n+$/, ''));
+        const namesBefore = cache ? new Set(runtimeImportNames) : null;
+        const importedPaths = resolveVskImports(filePath, (p, n) => compileFile(p, n || '', output));
+        // One parse/IR pass feeds both client modes AND the component-name
+        // lookup — the dev hot path pays the acorn+TS parse once per edit
+        // instead of three times.
+        const { comp: rawComp, hyd: rawHyd, name: actualName } = compileClientBoth(src, null);
+        const compCode = rawComp ? stripExports(stripVskImports(stripRuntimeImport(rawComp))).replace(/^\n+/, '').replace(/\n+$/, '') : '';
+        const hydCode = rawHyd ? stripExports(stripVskImports(stripRuntimeImport(rawHyd))).replace(/__components/g, '__hydrators').replace(/^\n+/, '').replace(/\n+$/, '') : '';
+        if (rawComp)
+            collectRuntimeImports(rawComp);
+        if (rawHyd)
+            collectRuntimeImports(rawHyd);
+        if (returnEdited && only.has(filePath)) {
+            // Mirrors the HMR fnSources preparation in the dev servers: drop every
+            // remaining top-level import so the snippet can be eval'd in the page
+            // context where runtime globals already exist.
+            const bare = rawComp
+                ? stripExports(stripVskImports(stripRuntimeImport(rawComp)))
+                    .replace(/^import\s*[\s\S]*?from\s*['"][^'"]+['"];?\s*\n?/gm, '')
+                : '';
+            editedSources.set(filePath, bare);
+            editedNames.set(filePath, actualName);
         }
-        const actualName = resolveComponentName(src);
-        if (actualName && actualName !== resolvedName) {
+        if (compCode)
+            output.push(compCode);
+        if (hydCode)
+            output.push(hydCode);
+        if (actualName && resolvedName !== null && actualName !== resolvedName) {
             output.push(`Object.defineProperty(__components, ${JSON.stringify(resolvedName)}, { get: () => __components[${JSON.stringify(actualName)}], configurable: true });`);
             output.push(`Object.defineProperty(__hydrators, ${JSON.stringify(resolvedName)}, { get: () => __hydrators[${JSON.stringify(actualName)}], configurable: true });`);
         }
+        if (cache && namesBefore) {
+            const st = statSync(filePath);
+            cache.files.set(filePath, {
+                mtimeMs: st.mtimeMs,
+                size: st.size,
+                compCode,
+                hydCode,
+                actualName,
+                runtimeNames: [...runtimeImportNames].filter((n) => !namesBefore.has(n)),
+                imports: importedPaths,
+            });
+        }
     }
     function buildChunkName(node) {
         const dir = relative(appDir, node.sourceDir || '');
@@ -124,6 +216,14 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
                 if (node.notFound && existsSync(notFoundPath)) {
                     compileFile(notFoundPath, node.notFound, chunkCode);
                 }
+                const offlinePath = resolve(appDir, node.sourceDir, 'offline.vsk');
+                if (node.offline && existsSync(offlinePath)) {
+                    compileFile(offlinePath, node.offline, chunkCode);
+                }
+                const networkPath = resolve(appDir, node.sourceDir, 'network.vsk');
+                if (node.network && existsSync(networkPath)) {
+                    compileFile(networkPath, node.network, chunkCode);
+                }
                 const loadingPath = resolve(appDir, node.sourceDir, 'loading.vsk');
                 if (node.loading && existsSync(loadingPath)) {
                     compileFile(loadingPath, node.loading, chunkCode);
@@ -162,8 +262,18 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
             }
         }
         annotate(routeTree);
-        const main = await buildMainBundle(routeTree, runtimeDir, true, {}, !!options?.hmr, !!options?.importRuntime, runtimeImportNames, options?.routeDataCache);
-        return { main, chunks };
+        const mainKey = JSON.stringify(routeTree) + '|' + [...runtimeImportNames].sort().join(',') + `|${!!options?.hmr}|${!!options?.importRuntime}|${options?.routeDataCache ?? ''}`;
+        let main;
+        if (cache?.mainBundle && cache.mainBundle.key === mainKey) {
+            mainFromCache = true;
+            main = cache.mainBundle.code;
+        }
+        else {
+            main = await buildMainBundle(routeTree, runtimeDir, true, {}, !!options?.hmr, !!options?.importRuntime, runtimeImportNames, options?.routeDataCache);
+            if (cache)
+                cache.mainBundle = { key: mainKey, code: main };
+        }
+        return { main, chunks, cachedFileHits, compiledFiles, mainFromCache, editedSources, editedNames };
     }
     else {
         let componentLines = [];
@@ -209,6 +319,12 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
                 const notFoundPath = resolve(appDir, node.sourceDir, 'not-found.vsk');
                 if (node.notFound && existsSync(notFoundPath))
                     compileFileMono(notFoundPath, node.notFound);
+                const offlinePath = resolve(appDir, node.sourceDir, 'offline.vsk');
+                if (node.offline && existsSync(offlinePath))
+                    compileFileMono(offlinePath, node.offline);
+                const networkPath = resolve(appDir, node.sourceDir, 'network.vsk');
+                if (node.network && existsSync(networkPath))
+                    compileFileMono(networkPath, node.network);
                 const loadingPath = resolve(appDir, node.sourceDir, 'loading.vsk');
                 if (node.loading && existsSync(loadingPath))
                     compileFileMono(loadingPath, node.loading);
@@ -223,11 +339,12 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
         const main = await buildMainBundle(routeTree, runtimeDir, false, {
             componentLines, hydratorLines, aliasLines, hydratorAliasLines,
         }, !!options?.hmr, !!options?.importRuntime, runtimeImportNames, options?.routeDataCache);
+        // Mono (non-codeSplit) builds are the production path — no incremental cache.
         return { main, chunks: [] };
     }
 }
 function stripTypes(code) {
-    return transformSync(code, { loader: 'ts' }).code;
+    return stripCodeTypes(code);
 }
 export function buildRuntimeCode(runtimeDir) {
     const runtimeFiles = [
@@ -324,9 +441,22 @@ export async function buildTreeShakenRuntime(runtimeDir, usedNames) {
         catch { /* ignore */ }
     }
 }
+/**
+ * Appends the HMR eval hook to the dev client bundle.
+ *
+ * The gadget is gated by a per-server-session nonce: the dev server generates
+ * `globalThis.__vesk_hmr_nonce` at boot and broadcasts it inside every
+ * `update` message. The browser evaluates component sources only when the
+ * message nonce matches, so a cross-site WebSocket (or any other injection
+ * vector) cannot drive arbitrary eval without also reading the nonce from a
+ * same-origin page — which the WS origin check already blocks.
+ */
 function appendHmrGlobals(code) {
     return code +
-        "globalThis.__vesk_hmr_eval = (code) => eval(code);\n";
+        "globalThis.__vesk_hmr_eval = (code, n) => {\n" +
+        "  if (!n || n !== globalThis.__vesk_hmr_nonce) throw new Error('vesk hmr: invalid nonce');\n" +
+        "  return eval(code);\n" +
+        "};\n";
 }
 async function buildMainBundle(routeTree, runtimeDir, codeSplit, mono, hmr, importRuntime, runtimeImportNames, routeDataCache) {
     const baseRuntimeImports = ['createFileRouter', 'get', 'set', 'effect', 'track', 'destroy_block', 'getActiveComponent', 'setActiveComponent', 'NavLink', 'Link', 'reactiveProps', 'matchRoute', 'ensureChunk'];
@@ -366,6 +496,8 @@ async function buildMainBundle(routeTree, runtimeDir, codeSplit, mono, hmr, impo
         "    if (n._layoutName && __components[n._layoutName]) n.layout = __components[n._layoutName];\n" +
         "    if (n._errorName && __components[n._errorName]) n.error = __components[n._errorName];\n" +
         "    if (n._notFoundName && __components[n._notFoundName]) n.notFound = __components[n._notFoundName];\n" +
+        "    if (n._offlineName && __components[n._offlineName]) n.offline = __components[n._offlineName];\n" +
+        "    if (n._networkName && __components[n._networkName]) n.network = __components[n._networkName];\n" +
         '    if (n.children) __updateComponents(n.children);\n' +
         '  }\n' +
         '}\n';
@@ -379,6 +511,8 @@ async function buildMainBundle(routeTree, runtimeDir, codeSplit, mono, hmr, impo
             "    if (typeof n.layout === 'string') n._layoutName = n.layout;\n" +
             "    if (typeof n.error === 'string') n._errorName = n.error;\n" +
             "    if (typeof n.notFound === 'string') n._notFoundName = n.notFound;\n" +
+            "    if (typeof n.offline === 'string') n._offlineName = n.offline;\n" +
+            "    if (typeof n.network === 'string') n._networkName = n.network;\n" +
             '    if (n.children) __resolveNames(n.children);\n' +
             '  }\n' +
             '}\n';
@@ -464,6 +598,10 @@ async function buildMainBundle(routeTree, runtimeDir, codeSplit, mono, hmr, impo
         cleanupFn +
         placeFn +
         'globalThis.__components = __components;\n' +
+        'globalThis.__runtime_comps = __runtime_comps;\n' +
+        'globalThis.__cleanup = __cleanup;\n' +
+        'globalThis.__place = __place;\n' +
+        allRuntimeImports.map(n => `globalThis.${n} = ${n};\n`).join('') +
         'function __resolveNames(nodes) {\n' +
         '  for (const n of nodes) {\n' +
         "    if (typeof n.page === 'string') {\n" +
@@ -476,6 +614,8 @@ async function buildMainBundle(routeTree, runtimeDir, codeSplit, mono, hmr, impo
         '    }\n' +
         "    if (typeof n.error === 'string') n.error = __components[n.error];\n" +
         "    if (typeof n.notFound === 'string') n.notFound = __components[n.notFound];\n" +
+        "    if (typeof n.offline === 'string') n.offline = __components[n.offline];\n" +
+        "    if (typeof n.network === 'string') n.network = __components[n.network];\n" +
         '    if (n.children) __resolveNames(n.children);\n' +
         '  }\n' +
         '}\n' +

package/dist/dev-server.d.ts

@@ -1,4 +1,7 @@
 import { type Server } from 'node:http';
 import type { DevServerOptions } from '@vesk/adapter/src/types';
+export declare function bodyTooLarge(maxBytes: number): Error & {
+    status: number;
+};
 export declare function startDevServer(appDir: string, options?: DevServerOptions): Promise<Server | void>;
 //# sourceMappingURL=dev-server.d.ts.map

package/dist/dev-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../src/dev-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AAMjG,OAAO,KAAK,EAAa,gBAAgB,EAAY,MAAM,yBAAyB,CAAC;AAuDrF,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiTvG"}
+{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../src/dev-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AAQjG,OAAO,KAAK,EAAa,gBAAgB,EAAY,MAAM,yBAAyB,CAAC;AAWrF,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AA6DD,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoTvG"}

package/dist/dev-server.js

@@ -2,18 +2,34 @@ import { readFileSync, existsSync, watch, statSync } from 'node:fs';
 import { resolve, extname, dirname } from 'node:path';
 import { createServer } from 'node:http';
 import { fileURLToPath } from 'node:url';
-import { transformSync } from './esbuild-fallback.js';
+import { stripCodeTypes } from '@vesk/compiler/src/strip-ts';
+import { DEFAULT_MAX_BODY_BYTES } from '@vesk/compiler/src/server-codegen';
 import { build } from '@vesk/adapter/src/index';
 import { createHmrServer } from '@vesk/adapter/src/hmr';
 import { buildRuntimeCode } from '@vesk/adapter/src/client-bundle';
+import { resolveWithin } from '@vesk/adapter/src/paths';
 const __dirname = dirname(fileURLToPath(import.meta.url));
-async function readBody(req) {
+export function bodyTooLarge(maxBytes) {
+    const err = new Error(`Request body exceeds limit (${maxBytes} bytes)`);
+    err.status = 413;
+    return err;
+}
+function errorStatus(e, fallback) {
+    const s = e?.status ?? e?.statusCode;
+    return typeof s === 'number' && s >= 400 && s < 600 ? s : fallback;
+}
+async function readBody(req, maxBytes = DEFAULT_MAX_BODY_BYTES) {
     const chunks = [];
-    for await (const chunk of req)
+    let total = 0;
+    for await (const chunk of req) {
+        total += chunk.byteLength;
+        if (total > maxBytes)
+            throw bodyTooLarge(maxBytes);
         chunks.push(chunk);
+    }
     return Buffer.concat(chunks);
 }
-function makeWebRequest(nodeReq, url) {
+function makeWebRequest(nodeReq, url, maxBodyBytes = DEFAULT_MAX_BODY_BYTES) {
     const parsedUrl = new URL(url, `http://${nodeReq.headers.host || 'localhost'}`);
     const method = nodeReq.method || 'GET';
     let _bodyBuffer = null;
@@ -21,8 +37,13 @@ function makeWebRequest(nodeReq, url) {
         if (_bodyBuffer)
             return _bodyBuffer;
         const chunks = [];
-        for await (const chunk of nodeReq)
+        let total = 0;
+        for await (const chunk of nodeReq) {
+            total += chunk.byteLength;
+            if (total > maxBodyBytes)
+                throw bodyTooLarge(maxBodyBytes);
             chunks.push(Buffer.from(chunk));
+        }
         _bodyBuffer = Buffer.concat(chunks);
         return _bodyBuffer;
     }
@@ -59,6 +80,10 @@ const MIME = {
 };
 export async function startDevServer(appDir, options) {
     const port = options?.port || 3000;
+    const host = options?.host || '127.0.0.1';
+    const maxBodyBytes = options?.maxBodyBytes || DEFAULT_MAX_BODY_BYTES;
+    if (!process.env.NODE_ENV)
+        process.env.NODE_ENV = 'development';
     const devDir = resolve(appDir, '..', '.vesk', 'dev');
     const publicDir = options?.publicDir || resolve(appDir, '..', 'public');
     let componentMap = new Map();
@@ -110,7 +135,7 @@ export async function startDevServer(appDir, options) {
             if (hmrPath) {
                 let hmrContent = readFileSync(hmrPath, 'utf-8');
                 if (hmrPath.endsWith('.ts')) {
-                    hmrContent = transformSync(hmrContent, { loader: 'ts' }).code;
+                    hmrContent = stripCodeTypes(hmrContent);
                 }
                 res.writeHead(200, { 'Content-Type': 'application/javascript' });
                 res.end(hmrContent);
@@ -123,9 +148,9 @@ export async function startDevServer(appDir, options) {
             return;
         }
         if (url.pathname.startsWith('/_vesk/static/')) {
-            const relPath = url.pathname.replace('/_vesk/static/', '').replace(/\.\./g, '');
-            const staticPath = resolve(devDir, 'static', relPath);
-            if (!staticPath.startsWith(resolve(devDir, 'static'))) {
+            const relPath = url.pathname.slice('/_vesk/static/'.length);
+            const staticPath = resolveWithin(resolve(devDir, 'static'), relPath);
+            if (!staticPath) {
                 res.writeHead(403);
                 res.end('Forbidden');
                 return;
@@ -138,17 +163,16 @@ export async function startDevServer(appDir, options) {
             }
         }
         if (url.pathname !== '/') {
-            const sanitized = url.pathname.replace(/\.\./g, '');
-            const sourcePath = resolve(publicDir, sanitized.slice(1));
-            if (sourcePath.startsWith(publicDir) && existsSync(sourcePath) && statSync(sourcePath).isFile()) {
+            const sourcePath = url.pathname.length > 1 ? resolveWithin(publicDir, url.pathname.slice(1)) : null;
+            if (sourcePath && existsSync(sourcePath) && statSync(sourcePath).isFile()) {
                 const ext = extname(sourcePath);
                 res.writeHead(200, { 'Content-Type': MIME[ext] || 'application/octet-stream' });
                 res.end(readFileSync(sourcePath));
                 return;
             }
             const buildPublicDir = resolve(devDir, 'static', 'public');
-            const buildPath = resolve(buildPublicDir, sanitized.slice(1));
-            if (buildPath.startsWith(buildPublicDir) && existsSync(buildPath) && statSync(buildPath).isFile()) {
+            const buildPath = url.pathname.length > 1 ? resolveWithin(buildPublicDir, url.pathname.slice(1)) : null;
+            if (buildPath && existsSync(buildPath) && statSync(buildPath).isFile()) {
                 const ext = extname(buildPath);
                 res.writeHead(200, { 'Content-Type': MIME[ext] || 'application/octet-stream' });
                 res.end(readFileSync(buildPath));
@@ -164,7 +188,7 @@ export async function startDevServer(appDir, options) {
                     try {
                         const mod = await import(`${handlerPath}?t=${ssrVersion}`);
                         if (mod.handleAction) {
-                            const webRequest = makeWebRequest(req, url.href);
+                            const webRequest = makeWebRequest(req, url.href, maxBodyBytes);
                             const response = await mod.handleAction(webRequest, actionId);
                             const body = await response.text();
                             const headers = Object.fromEntries(response.headers);
@@ -179,7 +203,8 @@ export async function startDevServer(appDir, options) {
                         }
                     }
                     catch (e) {
-                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        const status = errorStatus(e, 500);
+                        res.writeHead(status, { 'Content-Type': 'application/json' });
                         res.end(JSON.stringify({ ok: false, error: e instanceof Error ? e.message : String(e) }));
                         return;
                     }
@@ -196,7 +221,7 @@ export async function startDevServer(appDir, options) {
                 if (existsSync(handlerPath)) {
                     try {
                         const mod = await import(`${handlerPath}?t=${ssrVersion}`);
-                        const webRequest = makeWebRequest(req, url.href);
+                        const webRequest = makeWebRequest(req, url.href, maxBodyBytes);
                         const response = await mod.handle(webRequest);
                         const body = await response.text();
                         res.writeHead(response.status, Object.fromEntries(response.headers));
@@ -218,7 +243,7 @@ export async function startDevServer(appDir, options) {
                 if (existsSync(handlerPath)) {
                     try {
                         const mod = await import(`${handlerPath}?t=${ssrVersion}`);
-                        const webRequest = makeWebRequest(req, url.href);
+                        const webRequest = makeWebRequest(req, url.href, maxBodyBytes);
                         const response = await mod.handle(webRequest);
                         const body = await response.text();
                         const headers = Object.fromEntries(response.headers);
@@ -245,7 +270,7 @@ export async function startDevServer(appDir, options) {
                 if (existsSync(handlerPath)) {
                     try {
                         const mod = await import(`${handlerPath}?t=${ssrVersion}`);
-                        const webRequest = makeWebRequest(req, url.href);
+                        const webRequest = makeWebRequest(req, url.href, maxBodyBytes);
                         const response = await mod.handle(webRequest);
                         const body = await response.text();
                         const headers = Object.fromEntries(response.headers);
@@ -320,15 +345,15 @@ export async function startDevServer(appDir, options) {
                 else if (files.length > 0) {
                     hmr.handleFileChange(files[0], doBuild, routeTree);
                 }
-            }, 200);
+            }, 40);
         });
     }
     catch (e) {
         console.error('vesk dev: file watching unavailable');
     }
     await new Promise(resolve => {
-        server.listen(port, () => {
-            console.error(`vesk dev server at http://localhost:${port}`);
+        server.listen(port, host, () => {
+            console.error(`vesk dev server at http://localhost:${port} (listening on ${host})`);
             resolve();
         });
     });

package/dist/esbuild-fallback.d.ts

@@ -1,3 +1,2 @@
 export declare function build(options: any): Promise<any>;
-export declare function transformSync(code: string, options?: any): any;
 //# sourceMappingURL=esbuild-fallback.d.ts.map

package/dist/esbuild-fallback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-fallback.d.ts","sourceRoot":"","sources":["../src/esbuild-fallback.ts"],"names":[],"mappings":"AA8BA,wBAAsB,KAAK,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAgBtD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,GAAG,CAa9D"}
+{"version":3,"file":"esbuild-fallback.d.ts","sourceRoot":"","sources":["../src/esbuild-fallback.ts"],"names":[],"mappings":"AAkCA,wBAAsB,KAAK,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAiBtD"}

package/dist/esbuild-fallback.js

@@ -1,17 +1,21 @@
+// esbuild access with a WASM fallback for machines where the native binary
+// cannot run (older CPUs raise SIGILL, unsupported platforms skip install).
+// Only `build()` is routed here: every synchronous TS-strip call site now uses
+// the compiler's dependency-free `stripCodeTypes` (acorn-based), so no
+// transformSync path exists anymore.
 let _nativeBuild = null;
-let _nativeTransform = null;
+let _nativeDead = false;
 let _wasm = null;
 let _wasmReady = null;
 async function loadNative() {
-    if (_nativeBuild && _nativeTransform)
+    if (_nativeBuild || _nativeDead)
         return;
     try {
         const m = await import('esbuild');
         _nativeBuild = m.build.bind(m);
-        _nativeTransform = m.transformSync.bind(m);
     }
     catch {
-        // native esbuild not installed
+        // native esbuild not installed — wasm handles it
     }
 }
 async function getWasm() {
@@ -23,7 +27,7 @@ async function getWasm() {
             return m;
         }).catch(() => {
             _wasmReady = null;
-            throw new Error('esbuild-wasm not available');
+            throw new Error('esbuild-wasm not available — install it with: npm install esbuild-wasm');
         });
     }
     return _wasmReady;
@@ -38,6 +42,7 @@ export async function build(options) {
             const msg = e instanceof Error ? e.message : String(e);
             if (msg.includes('SIGILL') || msg.includes('illegal hardware instruction') || msg.includes('cannot execute binary file')) {
                 console.warn('vesk: native esbuild failed, falling back to esbuild-wasm:', msg);
+                _nativeDead = true;
             }
             else {
                 throw e;
@@ -47,18 +52,3 @@ export async function build(options) {
     const wasm = await getWasm();
     return wasm.build(options);
 }
-export function transformSync(code, options) {
-    if (_nativeTransform) {
-        try {
-            return _nativeTransform(code, options);
-        }
-        catch (e) {
-            const msg = e instanceof Error ? e.message : String(e);
-            if (msg.includes('SIGILL') || msg.includes('illegal hardware instruction') || msg.includes('cannot execute binary file')) {
-                throw new Error('esbuild-wasm fallback for transformSync not yet implemented — use native esbuild or convert to async transform');
-            }
-            throw e;
-        }
-    }
-    throw new Error('esbuild not installed — run `npm install esbuild` or use `vesk build` which falls back to esbuild-wasm for bundling');
-}

package/dist/hmr.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hmr.d.ts","sourceRoot":"","sources":["../src/hmr.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAOxC,OAAO,KAAK,EAAE,SAAS,EAAkB,MAAM,yBAAyB,CAAC;AA6RzE,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC;IAAE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAAC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAkH/L"}
+{"version":3,"file":"hmr.d.ts","sourceRoot":"","sources":["../src/hmr.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAQxC,OAAO,KAAK,EAAE,SAAS,EAAkB,MAAM,yBAAyB,CAAC;AA6RzE,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC;IAAE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAAC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAmI/L"}