@vesk/adapter 0.2.50-canary.2 → 0.2.50-canary.4

package/dist/asset-hash.d.ts

@@ -0,0 +1,26 @@
+export interface AssetDigest {
+    /** `client.a1b2c3d4e5.js` */
+    fileName: string;
+    /** 10 hex chars of the content hash, safe in a URL and a filename. */
+    hash: string;
+    bytes: number;
+    /** `sha384-<base64>`, ready for an `integrity` attribute. */
+    integrity: string;
+}
+/** `client.js` + bytes -> `client.a1b2c3d4e5.js` (the extension is preserved). */
+export declare function hashedName(fileName: string, content: string | Buffer): string;
+export declare function hashOf(content: string | Buffer): string;
+export declare function integrityOf(content: string | Buffer): string;
+export declare function describeAsset(fileName: string, content: string | Buffer): AssetDigest;
+/** Does this name carry a content hash? Used to pick the cache policy. */
+export declare function isHashedName(fileName: string): boolean;
+/**
+ * Cache-Control for a served asset.
+ *
+ * A hashed name means the bytes behind that URL can never change, so it is
+ * immutable for a year. Anything else (dev bundles, `public/` files copied
+ * verbatim, the unhashed name a prerendered page may still reference) must be
+ * revalidated, or a deploy would serve stale code forever.
+ */
+export declare function cacheControlFor(fileName: string, isDev: boolean): string;
+//# sourceMappingURL=asset-hash.d.ts.map

package/dist/asset-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-hash.d.ts","sourceRoot":"","sources":["../src/asset-hash.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,WAAW;IAC1B,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,kFAAkF;AAClF,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAK7E;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEvD;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAOrF;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQtD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAKxE"}

package/dist/asset-hash.js

@@ -0,0 +1,63 @@
+/**
+ * Content-addressed asset names and Subresource Integrity digests.
+ *
+ * Production assets are emitted under a content hash — `client.a1b2c3d4.js` —
+ * so they can be served `immutable` and never go stale in a CDN, and so a
+ * deploy that changes the runtime cannot be served the previous one. Dev keeps
+ * the plain name: the dev server rewrites it on every edit and HMR needs a
+ * stable URL.
+ *
+ * The digest is also the SRI value. Both come from the same bytes, so a tag
+ * carrying `integrity` can only execute the file that was actually built.
+ */
+import { createHash } from 'node:crypto';
+const EXT_RE = /\.([a-z0-9]+)$/i;
+/** `client.js` + bytes -> `client.a1b2c3d4e5.js` (the extension is preserved). */
+export function hashedName(fileName, content) {
+    const m = EXT_RE.exec(fileName);
+    if (!m)
+        return fileName;
+    const base = fileName.slice(0, m.index);
+    return `${base}.${hashOf(content)}${m[0]}`;
+}
+export function hashOf(content) {
+    return createHash('sha256').update(content).digest('hex').slice(0, 10);
+}
+export function integrityOf(content) {
+    return `sha384-${createHash('sha384').update(content).digest('base64')}`;
+}
+export function describeAsset(fileName, content) {
+    return {
+        fileName: hashedName(fileName, content),
+        hash: hashOf(content),
+        bytes: typeof content === 'string' ? Buffer.byteLength(content) : content.length,
+        integrity: integrityOf(content),
+    };
+}
+/** Does this name carry a content hash? Used to pick the cache policy. */
+export function isHashedName(fileName) {
+    const m = EXT_RE.exec(fileName);
+    if (!m)
+        return false;
+    const base = fileName.slice(0, m.index);
+    const dot = base.lastIndexOf('.');
+    if (dot === -1)
+        return false;
+    const suffix = base.slice(dot + 1);
+    return suffix.length === 10 && /^[0-9a-f]{10}$/.test(suffix);
+}
+/**
+ * Cache-Control for a served asset.
+ *
+ * A hashed name means the bytes behind that URL can never change, so it is
+ * immutable for a year. Anything else (dev bundles, `public/` files copied
+ * verbatim, the unhashed name a prerendered page may still reference) must be
+ * revalidated, or a deploy would serve stale code forever.
+ */
+export function cacheControlFor(fileName, isDev) {
+    if (isDev)
+        return 'no-cache';
+    return isHashedName(fileName)
+        ? 'public, max-age=31536000, immutable'
+        : 'public, max-age=0, must-revalidate';
+}

package/dist/client-bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-bundle.d.ts","sourceRoot":"","sources":["../src/client-bundle.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAmF,MAAM,yBAAyB,CAAC;AAoCnL;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BhE;AAED;;;;;GAKG;AACH,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7B,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IACtH,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,YAAY,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,MAAM,CAAC,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;oBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;iBAAE,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC;KAC/F,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAmDD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAKzD;AAkCD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B7D;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAyBlD;AA4MD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASxD;AA4CD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,GAAG,MAAM,CAoBnG;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,SAAS,EAAE,EACtB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAoc7B;AAMD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA+B3D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAUlE;AAoCD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAI/F"}
+{"version":3,"file":"client-bundle.d.ts","sourceRoot":"","sources":["../src/client-bundle.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAmF,MAAM,yBAAyB,CAAC;AAoCnL;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BhE;AAED;;;;;GAKG;AACH,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7B,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IACtH,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,YAAY,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,MAAM,CAAC,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;oBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;iBAAE,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC;KAC/F,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAmDD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAKzD;AAkCD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B7D;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAyBlD;AA4MD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASxD;AA4CD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,GAAG,MAAM,CAoBnG;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,SAAS,EAAE,EACtB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CA6c7B;AAMD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA+B3D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAUlE;AAoCD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAI/F"}

package/dist/client-bundle.js

@@ -3,6 +3,7 @@ import { resolve, join, dirname, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { tmpdir } from 'node:os';
 import { build } from './esbuild-fallback.js';
+import { hashedName } from '@vesk/adapter/src/asset-hash';
 import { stripCodeTypes } from '@vesk/compiler/src/strip-ts';
 import { parse, parseGeneratedJs } from '@vesk/compiler/src/parser';
 import { compileClient, compileClientBoth, nameAllocFor, vskComponentNames } from '@vesk/compiler/src/client-codegen';
@@ -982,9 +983,17 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
         function annotate(nodes) {
             for (const node of nodes) {
                 const chunkName = `page-${buildChunkName(node)}.js`;
-                const hasEntry = chunkEntries.some(e => e.name === chunkName && e.code.trim());
-                if (hasEntry)
-                    node.chunk = `/_vesk/static/${chunkName}`;
+                // Production chunk names are content-hashed, and the ROUTER asks for
+                // chunks by the URL baked here — so the hash has to be applied to this
+                // reference, not just to the file on disk. Getting it wrong is silent
+                // and total: every chunk 404s, the server answers those requests with
+                // the SPA fallback (text/html), the browser refuses the script, and the
+                // page never hydrates at all.
+                const emitted = chunks.find((c) => c.name === chunkName && c.code.trim());
+                if (emitted) {
+                    const fileName = options?.hmr ? chunkName : hashedName(chunkName, emitted.code);
+                    node.chunk = `/_vesk/static/${fileName}`;
+                }
                 annotate(node.children || []);
             }
         }

package/dist/dev-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../src/dev-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AAOjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAK7C,OAAO,KAAK,EAAa,gBAAgB,EAAwB,MAAM,yBAAyB,CAAC;AAgBjG;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;IAC9C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxD,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB;+EAC2E;IAC3E,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,IAAI,WAAW,CAEhD;AAuCD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AAkBD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,mHAAmH;IACnH,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B;;8BAE0B;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,WAAW,CAAC;IAChC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG;IACvE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CAChH,CAUA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAa3C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIrD;AA8CD,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkqBvG"}
+{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../src/dev-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AASjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAK7C,OAAO,KAAK,EAAa,gBAAgB,EAAwB,MAAM,yBAAyB,CAAC;AAgBjG;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;IAC9C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxD,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB;+EAC2E;IAC3E,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,IAAI,WAAW,CAEhD;AAuCD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AAkBD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,mHAAmH;IACnH,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B;;8BAE0B;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,WAAW,CAAC;IAChC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG;IACvE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CAChH,CAUA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAa3C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIrD;AA8CD,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwqBvG"}

package/dist/dev-server.js

@@ -1,10 +1,12 @@
 import { readFileSync, existsSync, watch, statSync } from 'node:fs';
-import { resolve, extname, dirname } from 'node:path';
+import { resolve, extname, dirname, basename } from 'node:path';
 import { createServer } from 'node:http';
 import { fileURLToPath } from 'node:url';
 import { stripCodeTypes } from '@vesk/compiler/src/strip-ts';
 import { DEFAULT_MAX_BODY_BYTES, safeJsonForScript } from '@vesk/compiler/src/server-codegen';
 import { build } from '@vesk/adapter/src/index';
+import { cacheControlFor } from '@vesk/adapter/src/asset-hash';
+import { reportServerError, registerErrorHooks } from '@vesk/adapter/src/error-report';
 import { buildErrorPayload, createHmrServer } from './hmr';
 import * as hmrApi from './hmr';
 import { createDevApiRouter } from './dev-api';
@@ -205,6 +207,9 @@ export async function startDevServer(appDir, options) {
     const devDir = resolve(appDir, '..', '.vesk', 'dev');
     const publicDir = options?.publicDir || resolve(appDir, '..', 'public');
     installMdReadHook([publicDir, resolve(devDir, 'static', 'public')]);
+    // Plugin `onError` hooks only exist here (dev): in production there are no
+    // plugin objects, and `_events.ts` is the seam that ships.
+    registerErrorHooks(options?.plugins);
     // Dev-panel plugin list: plugin / module names declared in the dev server's own config.
     const configPluginNames = (options?.plugins || []).map((p) => {
         if (typeof p === 'string')
@@ -572,7 +577,9 @@ export async function startDevServer(appDir, options) {
             }
             if (existsSync(staticPath) && statSync(staticPath).isFile()) {
                 const ext = extname(staticPath);
-                res.writeHead(200, { 'Content-Type': MIME[ext] || 'application/octet-stream' });
+                // Dev names are stable so HMR can rewrite them, which means they must
+                // never be cached: the same URL has to serve the newest bytes.
+                res.writeHead(200, { 'Content-Type': MIME[ext] || 'application/octet-stream', 'Cache-Control': cacheControlFor(basename(staticPath), true) });
                 res.end(readFileSync(staticPath));
                 return;
             }
@@ -697,6 +704,7 @@ export async function startDevServer(appDir, options) {
                     }
                     catch (e) {
                         console.error('[vesk dev] SSR render failed:', e instanceof Error ? (e.stack || e.message) : String(e));
+                        await reportServerError(e, { url: url.href, target: 'dev', status: 500 });
                         res.writeHead(500, { 'Content-Type': 'text/html' });
                         res.end(renderSsrErrorPage(e, url.pathname));
                     }

package/dist/error-report.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The production error-reporting seam.
+ *
+ * Production never leaks a stack trace to the client (that is the right
+ * default), which used to mean an adopter had two bad options: show the stack,
+ * or replace the adapter's error handling. This is the supported middle: a
+ * plugin's `onError` hook receives the error, the route and the build id.
+ *
+ * Design rules:
+ *   - a hook that throws is caught and logged, never turned into a second
+ *     failure (a reporting outage must not take down the page that was already
+ *     failing);
+ *   - one failing hook does not stop the others;
+ *   - nothing is reported twice for one request.
+ */
+import type { ServerErrorContext, VeskPlugin } from '@vesk/types';
+export interface BuildConfigLike {
+    version?: number;
+    buildId?: string;
+    veskVersion?: string;
+    [key: string]: unknown;
+}
+export declare function registerErrorReporter(fn: (err: unknown, ctx: ServerErrorContext) => void | Promise<void>): void;
+export declare function clearErrorReporters(): void;
+export declare function errorReporterCount(): number;
+/** Register every plugin that declares `onError`. */
+export declare function registerErrorHooks(plugins: VeskPlugin[] | null | undefined): void;
+export interface ReportOptions {
+    url?: string;
+    routePath?: string;
+    target: ServerErrorContext['target'];
+    status?: number;
+    durationMs?: number;
+    buildConfig?: BuildConfigLike | null;
+    /** Suppress a duplicate report for the same error object. */
+    dedupe?: boolean;
+}
+/**
+ * Report a production failure. Never throws: a failure to report is logged and
+ * swallowed, because the caller is already handling a worse problem.
+ */
+export declare function reportServerError(err: unknown, options: ReportOptions): Promise<void>;
+//# sourceMappingURL=error-report.d.ts.map

package/dist/error-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-report.d.ts","sourceRoot":"","sources":["../src/error-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAElE,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAMD,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAE/G;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,qDAAqD;AACrD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAIjF;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACrC,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB3F"}

package/dist/error-report.js

@@ -0,0 +1,52 @@
+/** Process-wide hook list; the config's plugins are registered at boot. */
+const hooks = [];
+const reported = new WeakSet();
+export function registerErrorReporter(fn) {
+    if (typeof fn === 'function')
+        hooks.push(fn);
+}
+export function clearErrorReporters() {
+    hooks.length = 0;
+}
+export function errorReporterCount() {
+    return hooks.length;
+}
+/** Register every plugin that declares `onError`. */
+export function registerErrorHooks(plugins) {
+    for (const plugin of plugins || []) {
+        if (plugin && typeof plugin.onError === 'function')
+            registerErrorReporter(plugin.onError);
+    }
+}
+/**
+ * Report a production failure. Never throws: a failure to report is logged and
+ * swallowed, because the caller is already handling a worse problem.
+ */
+export async function reportServerError(err, options) {
+    if (options.dedupe !== false && err && typeof err === 'object') {
+        if (reported.has(err))
+            return;
+        reported.add(err);
+    }
+    const cfg = options.buildConfig || null;
+    const ctx = {
+        url: options.url,
+        routePath: options.routePath,
+        target: options.target,
+        status: options.status ?? 500,
+        durationMs: options.durationMs,
+        version: typeof cfg?.veskVersion === 'string' ? cfg.veskVersion : undefined,
+        buildId: typeof cfg?.buildId === 'string' ? cfg.buildId : undefined,
+        errorName: err instanceof Error ? err.name : typeof err,
+        message: err instanceof Error ? err.message : String(err),
+        stack: err instanceof Error ? err.stack : undefined,
+    };
+    for (const hook of hooks) {
+        try {
+            await hook(err, ctx);
+        }
+        catch (e) {
+            console.error('vesk: an onError hook threw and was ignored:', e?.message ?? e);
+        }
+    }
+}

package/dist/events.d.ts

@@ -1,3 +1,20 @@
+/**
+ * Wrapper module bundled into `server/events.js`. It lifts the user's
+ * `_events.ts` exports into `executeStart` / `executeRequest` / `executeStop`
+ * entry points with a context that routes `set`/`get` into the process-wide
+ * server context (`globalThis.__vesk_server_ctx`).
+ *
+ * The `__vesk_events_started` guard is global (not module-local) so lazy edge
+ * isolates and the Node prod server share one lifetime; `onStop` clears it so
+ * dev HMR reloads can boot a fresh module.
+ */
+export declare function buildEventsEntry(sourcePath: string): string;
+/**
+ * Report a production failure to `_events.ts`'s `onError`, if it exports one.
+ * Never throws: a reporting outage must not add a second failure to a request
+ * that already failed.
+ */
+export declare function executeError(err: unknown, base: Record<string, unknown>, mod: unknown): Promise<void>;
 /**
  * Compile the app's `_events.ts` (if present) into a self-contained
  * `server/events.js` next to the server runtime. Returns true when an events

package/dist/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAqEA;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiCpF"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAOA;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAuD3D;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiCpF"}

package/dist/events.js

@@ -13,14 +13,17 @@ let buildId = 0;
  * isolates and the Node prod server share one lifetime; `onStop` clears it so
  * dev HMR reloads can boot a fresh module.
  */
-function buildEntry(sourcePath) {
+export function buildEventsEntry(sourcePath) {
     return [
         `import * as __events from ${JSON.stringify(sourcePath)};`,
         '',
         'const __store = () => (globalThis.__vesk_server_ctx ||= {});',
         '',
         'const __handlers = {};',
-        "for (const __name of ['onStart', 'onRequest', 'onStop']) {",
+        // `onError` joins the server events: production has no plugin objects, so
+        // this is the seam an error reporter actually uses there (plugins carry
+        // their own `onError` in dev, where plugin objects do exist).
+        "for (const __name of ['onStart', 'onRequest', 'onStop', 'onError']) {",
         '  const __fn = __events[__name];',
         "  if (typeof __fn === 'function') __handlers[__name] = __fn;",
         '}',
@@ -61,9 +64,26 @@ function buildEntry(sourcePath) {
         'export const onStart = __handlers.onStart;',
         'export const onRequest = __handlers.onRequest;',
         'export const onStop = __handlers.onStop;',
+        'export const onError = __handlers.onError;',
         '',
     ].join('\n');
 }
+/**
+ * Report a production failure to `_events.ts`'s `onError`, if it exports one.
+ * Never throws: a reporting outage must not add a second failure to a request
+ * that already failed.
+ */
+export async function executeError(err, base, mod) {
+    const fn = mod?.onError;
+    if (typeof fn !== 'function')
+        return;
+    try {
+        await fn(err, base);
+    }
+    catch (e) {
+        console.error('vesk: _events onError threw and was ignored:', e instanceof Error ? e.message : e);
+    }
+}
 /**
  * Compile the app's `_events.ts` (if present) into a self-contained
  * `server/events.js` next to the server runtime. Returns true when an events
@@ -78,7 +98,7 @@ export async function compileEvents(appDir, outDir) {
     const serverDir = resolve(outDir, 'server');
     mkdirSync(serverDir, { recursive: true });
     const entryFile = resolve(serverDir, `.events-entry-${buildId++}.mjs`);
-    writeFileSync(entryFile, buildEntry(sourcePath), 'utf-8');
+    writeFileSync(entryFile, buildEventsEntry(sourcePath), 'utf-8');
     try {
         const result = await esbuild.build({
             entryPoints: [entryFile],

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EACe,YAAY,EAAE,WAAW,EAC7B,UAAU,EAChC,MAAM,yBAAyB,CAAC;AAiBjC;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;CACjB;AACD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,UAAU,EAAE,EACrB,OAAO,EAAE,iBAAiB,EAAE,GAAG,IAAI,GAAG,SAAS,GAC9C,UAAU,EAAE,CAQd;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,UAAU,EAAE,EACrB,KAAK,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,GACxC,UAAU,EAAE,CAGd;AAkDD,wBAAsB,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CA6UpG;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAIhE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,aAAa,GACd,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACe,YAAY,EAAE,WAAW,EAC7B,UAAU,EAChC,MAAM,yBAAyB,CAAC;AAiBjC;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;CACjB;AACD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,UAAU,EAAE,EACrB,OAAO,EAAE,iBAAiB,EAAE,GAAG,IAAI,GAAG,SAAS,GAC9C,UAAU,EAAE,CAQd;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,UAAU,EAAE,EACrB,KAAK,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,GACxC,UAAU,EAAE,CAGd;AAkDD,wBAAsB,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAqWpG;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAIhE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,aAAa,GACd,MAAM,2BAA2B,CAAC"}

package/dist/index.js

@@ -1,11 +1,16 @@
 import { mkdirSync, writeFileSync, existsSync, readFileSync } from 'node:fs';
-import { resolve, dirname, relative, basename } from 'node:path';
+import { resolve, dirname, relative, basename, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { bundleRuntime } from '@vesk/adapter/src/runtime-bundle';
 import { generateSsrFunction } from '@vesk/adapter/src/ssr-function';
 import { resolveUserCssPath, isTailwindPlugin, resolveCssUrls, hasBuiltGlobalCss } from '@vesk/adapter/src/css';
 import { collectActionIds } from '@vesk/compiler/src/actions';
 import { generateApiFunction } from '@vesk/adapter/src/api-function';
+import { describeAsset } from '@vesk/adapter/src/asset-hash';
+// The adapter's own package.json, for the version stamped into the manifest.
+function PACKAGES_DIR_SELF() {
+    return resolve(dirname(fileURLToPath(import.meta.url)), '..');
+}
 import { compileMiddleware, compileMiddlewareCode } from '@vesk/adapter/src/middleware';
 import { compileEvents } from '@vesk/adapter/src/events';
 import { generateClientBundle } from '@vesk/adapter/src/client-bundle';
@@ -219,6 +224,39 @@ export async function build(appDir, options) {
     const apiTree = existsSync(apiDir) ? scanApiRoutes(apiDir) : [];
     console.error(`vesk build: ${routeTree.length} root routes, ${apiTree.length} API routes`);
     markPhase('scan routes');
+    console.error('vesk build: bundling client runtime...');
+    const bundleOpts = {};
+    if (options?.codeSplit)
+        bundleOpts.codeSplit = true;
+    if (options?.hmr)
+        bundleOpts.hmr = true;
+    if (options?.routeDataCache !== undefined)
+        bundleOpts.routeDataCache = options.routeDataCache;
+    if (pluginsPipelines.length > 0)
+        bundleOpts.plugins = pluginsPipelines;
+    const { main, chunks } = await generateClientBundle(routeTree, appDir, componentMap, bundleOpts);
+    markPhase('client runtime + chunks');
+    // Content-hash every emitted browser asset. A hashed name can be served
+    // immutable and can never be stale in a CDN; the digest rides along as the
+    // SRI attribute, so a tag can only execute the bytes this build produced.
+    // Dev keeps the plain name — the dev server rewrites it on every edit and HMR
+    // needs a stable URL.
+    const staticDir = resolve(outDir, 'static');
+    const hashed = !options?.hmr;
+    const clientAsset = describeAsset('client.js', main);
+    const clientFileName = hashed ? clientAsset.fileName : 'client.js';
+    writeFileSync(resolve(staticDir, clientFileName), main, 'utf-8');
+    const clientUrl = `/_vesk/static/${clientFileName}`;
+    const mode = chunks.length > 0 ? 'code-split' : 'monolithic';
+    console.error(`vesk build: client → static/${clientFileName}  (${main.length} bytes, ${mode}${hashed ? `, ${clientAsset.hash}` : ''})`);
+    const emittedAssets = [clientAsset];
+    for (const chunk of chunks) {
+        const asset = describeAsset(chunk.name, chunk.code);
+        emittedAssets.push(asset);
+        writeFileSync(resolve(staticDir, hashed ? asset.fileName : chunk.name), chunk.code, 'utf-8');
+        console.error(`vesk build: chunk → static/${hashed ? asset.fileName : chunk.name}  (${chunk.code.length} bytes${hashed ? `, ${asset.hash}` : ''})`);
+    }
+    const clientIntegrity = hashed ? clientAsset.integrity : undefined;
     console.error('vesk build: bundling server runtime...');
     await bundleRuntime(appDir, outDir);
     const ssrRoutes = [];
@@ -242,7 +280,7 @@ export async function build(appDir, options) {
                 // For standalone routes the layout chain is cleared — only the
                 // standalone node's own layout (if any) applies, no root ancestors.
                 const ssrAncestorLayouts = isStandalone ? [] : ancestorLayouts;
-                const { funcPath, funcCode, name } = generateSsrFunction(node, appDir, outDir, componentMap, { ancestorLayouts: ssrAncestorLayouts, middlewareCode: mwCode, headExtra: pluginHeadExtra });
+                const { funcPath, funcCode, name } = generateSsrFunction(node, appDir, outDir, componentMap, { ancestorLayouts: ssrAncestorLayouts, middlewareCode: mwCode, headExtra: pluginHeadExtra, clientScriptUrl: clientUrl, clientScriptIntegrity: clientIntegrity });
                 writeFileSync(funcPath, funcCode, 'utf-8');
                 const pagePath = resolve(appDir, node.sourceDir, 'page.vsk');
                 if (existsSync(pagePath)) {
@@ -302,28 +340,6 @@ export async function build(appDir, options) {
     const hasEvents = await compileEvents(appDir, outDir);
     if (hasEvents)
         console.error('vesk build: evt  → server/events.js (onStart/onRequest/onStop)');
-    markPhase('api functions');
-    console.error('vesk build: bundling client runtime...');
-    const bundleOpts = {};
-    if (options?.codeSplit)
-        bundleOpts.codeSplit = true;
-    if (options?.hmr)
-        bundleOpts.hmr = true;
-    if (options?.routeDataCache !== undefined)
-        bundleOpts.routeDataCache = options.routeDataCache;
-    if (pluginsPipelines.length > 0)
-        bundleOpts.plugins = pluginsPipelines;
-    const { main, chunks } = await generateClientBundle(routeTree, appDir, componentMap, bundleOpts);
-    writeFileSync(resolve(outDir, 'static', 'client.js'), main, 'utf-8');
-    const mode = chunks.length > 0 ? 'code-split' : 'monolithic';
-    console.error(`vesk build: client → static/client.js  (${main.length} bytes, ${mode})`);
-    if (chunks.length > 0) {
-        const staticDir = resolve(outDir, 'static');
-        for (const chunk of chunks) {
-            writeFileSync(resolve(staticDir, chunk.name), chunk.code, 'utf-8');
-            console.error(`vesk build: chunk → static/${chunk.name}  (${chunk.code.length} bytes)`);
-        }
-    }
     copyStaticAssets(publicDir, outDir);
     markPhase('client runtime + chunks');
     console.error('vesk build: static → static/public/');
@@ -366,6 +382,17 @@ export async function build(appDir, options) {
     }
     markPhase('ssg+images+seo');
     const manifest = generateManifest(routeTree, ssrRoutes, apiRoutes, prerenderedRoutes, middlewareEnabled, actionMap, pluginHeadExtra, hasEvents);
+    // The asset map is what makes a deploy auditable: sizes, content hashes and
+    // the SRI digests a page can carry.
+    // The build id is the asset map's own fingerprint: same assets, same id.
+    const buildId = emittedAssets.map((a) => a.hash).join('-');
+    manifest.buildId = buildId.slice(0, 32);
+    manifest.veskVersion = JSON.parse(readFileSync(join(PACKAGES_DIR_SELF(), 'package.json'), 'utf-8')).version;
+    manifest.assets = {
+        hashed,
+        client: { file: clientFileName, url: clientUrl, hash: clientAsset.hash, bytes: clientAsset.bytes, integrity: clientAsset.integrity },
+        chunks: emittedAssets.slice(1).map((a) => ({ file: a.fileName, hash: a.hash, bytes: a.bytes, integrity: a.integrity })),
+    };
     writeFileSync(resolve(outDir, 'config.json'), JSON.stringify(manifest, null, 2) + '\n', 'utf-8');
     console.error('vesk build: config → config.json');
     {

package/dist/prod-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AA8CjG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AA+FD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA8bxI"}
+{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAiDjG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AAkGD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAwdxI"}

package/dist/prod-server.js

@@ -1,9 +1,12 @@
 import { readFileSync, existsSync, statSync } from 'node:fs';
-import { resolve, extname, dirname } from 'node:path';
+import { resolve, extname, dirname, basename } from 'node:path';
 import { createServer } from 'node:http';
 import { fileURLToPath } from 'node:url';
 import { createRateLimiter, resolveComponentName, safeJsonForScript, getClientProtocol, DEFAULT_MAX_BODY_BYTES } from '@vesk/compiler/src/server-codegen';
 import { securityHeaders } from '@vesk/compiler/src/server-utils';
+import { cacheControlFor } from '@vesk/adapter/src/asset-hash';
+import { reportServerError } from '@vesk/adapter/src/error-report';
+import { executeError } from '@vesk/adapter/src/events';
 import { resolveWithin, installMdReadHook } from '@vesk/adapter/src/paths';
 import { resolveCssUrls, hasBuiltGlobalCss } from '@vesk/adapter/src/css';
 import { loadVeskConfig } from '@vesk/adapter/src/load-config';
@@ -287,10 +290,16 @@ export async function startProdServer(outDir, options) {
             res.end(lines.join('\n') || '// no ssr data');
             return;
         }
+        // Stable alias for the client runtime: the file on disk is content-hashed in
+        // production, so the name is resolved from the manifest rather than assumed.
         if (url.pathname === '/_vesk/runtime.js') {
-            const clientPath = resolve(staticDir, 'client.js');
+            const clientFile = buildConfig?.assets?.client?.file || 'client.js';
+            const clientPath = resolve(staticDir, clientFile);
             if (existsSync(clientPath)) {
-                res.writeHead(200, { 'Content-Type': 'application/javascript' });
+                res.writeHead(200, {
+                    'Content-Type': 'application/javascript',
+                    'Cache-Control': cacheControlFor(clientFile, false),
+                });
                 res.end(readFileSync(clientPath));
                 return;
             }
@@ -305,7 +314,13 @@ export async function startProdServer(outDir, options) {
             }
             if (existsSync(staticPath) && statSync(staticPath).isFile()) {
                 const ext = extname(staticPath);
-                res.writeHead(200, { 'Content-Type': MIME[ext] || 'application/octet-stream' });
+                res.writeHead(200, {
+                    'Content-Type': MIME[ext] || 'application/octet-stream',
+                    // A content-hashed name can never change meaning, so it is immutable
+                    // for a year; anything unhashed must be revalidated or a deploy would
+                    // serve stale JS forever.
+                    'Cache-Control': cacheControlFor(basename(staticPath), false),
+                });
                 res.end(readFileSync(staticPath));
                 return;
             }
@@ -498,6 +513,19 @@ export async function startProdServer(outDir, options) {
                                 return;
                             }
                             console.error('vesk ssr error:', err.message);
+                            // Two seams, both best-effort: a plugin's `onError` (dev-style
+                            // plugin objects don't exist here) and `_events.ts`'s, which IS
+                            // baked into the production build.
+                            await reportServerError(err, {
+                                url: url.pathname + url.search,
+                                routePath: route.path,
+                                target: 'node',
+                                status: 500,
+                                buildConfig,
+                            });
+                            if (eventsMod) {
+                                await executeError(err, { url: url.href, routePath: route.path, target: 'node', status: 500 }, eventsMod);
+                            }
                             const errPath = resolve(appDir, 'error.vsk');
                             let errorHtml = null;
                             if (existsSync(errPath)) {
@@ -508,7 +536,7 @@ export async function startProdServer(outDir, options) {
                                     const compName = resolveComponentName(src) || 'Error';
                                     // never leak stack traces / internal messages to prod error pages
                                     const expose = process.env.NODE_ENV !== 'production';
-                                    errorHtml = await renderFullPage(src, compName, { error: expose ? err.message : 'Internal Server Error', stack: expose ? err.stack : '', statusCode: 500, url: url.pathname }, new Map(), { hydrate: true, cssUrls: pageCssUrls, clientScriptUrl: '/_vesk/static/client.js', security: securityConfig?.security || {}, externalDataScript: storeDataScriptGlobal, sourcePath: errPath, headExtra: bakedHeadExtra });
+                                    errorHtml = await renderFullPage(src, compName, { error: expose ? err.message : 'Internal Server Error', stack: expose ? err.stack : '', statusCode: 500, url: url.pathname }, new Map(), { hydrate: true, cssUrls: pageCssUrls, clientScriptUrl: buildConfig?.assets?.client?.url || '/_vesk/static/client.js', clientScriptIntegrity: buildConfig?.assets?.client?.integrity, security: securityConfig?.security || {}, externalDataScript: storeDataScriptGlobal, sourcePath: errPath, headExtra: bakedHeadExtra });
                                 }
                                 catch { }
                             }

package/dist/ssr-function.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-function.d.ts","sourceRoot":"","sources":["../src/ssr-function.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAkB,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAI7F,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQjF;AAgED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,kBAAkB,GAC3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAoZtD"}
+{"version":3,"file":"ssr-function.d.ts","sourceRoot":"","sources":["../src/ssr-function.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAkB,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAI7F,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQjF;AAgED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,kBAAkB,GAC3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAwZtD"}

package/dist/ssr-function.js

@@ -134,7 +134,10 @@ export function generateSsrFunction(routeNode, appDir, outDir, componentMap, opt
     const urlParts = routeNode.fullPath.split('/').filter(Boolean);
     const paramExprs = buildParamExtraction(routeNode, urlParts);
     const paramsCode = `function __paramsFor(pathname) {\n  const urlParts = pathname.split('/').filter(Boolean);\n  return { ${paramExprs.join(', ')} };\n}\n`;
-    const clientScriptOption = ', clientScriptUrl: "/_vesk/static/client.js"';
+    // Content-hashed in production (the build computes it before generating the
+    // functions), the stable name in dev.
+    const clientScriptOption = `, clientScriptUrl: ${JSON.stringify(options?.clientScriptUrl || '/_vesk/static/client.js')}` +
+        (options?.clientScriptIntegrity ? `, clientScriptIntegrity: ${JSON.stringify(options.clientScriptIntegrity)}` : '');
     const dataScriptOption = ', externalDataScript: storeDataScriptGlobal';
     let registryCode = '';
     const compRegEntries = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vesk/adapter",
-  "version": "0.2.50-canary.2",
+  "version": "0.2.50-canary.4",
   "type": "module",
   "description": "Vesk adapter — builds deployable .vesk/ output for Deno and Node serverless",
   "main": "./dist/index.js",
@@ -23,9 +23,9 @@
     "sharp": "^0.35.3"
   },
   "dependencies": {
-    "@vesk/compiler": "^0.2.50-canary.2",
-    "@vesk/runtime": "^0.2.50-canary.2",
-    "@vesk/types": "^0.2.50-canary.2"
+    "@vesk/compiler": "^0.2.50-canary.4",
+    "@vesk/runtime": "^0.2.50-canary.4",
+    "@vesk/types": "^0.2.50-canary.4"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1",