@vesk/adapter 0.2.68 → 0.2.70

package/dist/client-bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-bundle.d.ts","sourceRoot":"","sources":["../src/client-bundle.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAmF,MAAM,yBAAyB,CAAC;AAuEnL;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BhE;AAED;;;;;GAKG;AACH,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7B,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IACtH,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,YAAY,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,MAAM,CAAC,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;oBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;iBAAE,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC;KAC/F,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAmDD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAKzD;AAkCD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B7D;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAyBlD;AAuQD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASxD;AA4CD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,GAAG,MAAM,CAoBnG;AAED,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,MAAM,CAKtE;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,SAAS,EAAE,EACtB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CA2pB7B;AAMD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA+B3D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAUlE;AAoCD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAI/F"}
+{"version":3,"file":"client-bundle.d.ts","sourceRoot":"","sources":["../src/client-bundle.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAmF,MAAM,yBAAyB,CAAC;AAuEnL;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BhE;AAED;;;;;GAKG;AACH,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7B,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IACtH,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,YAAY,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,MAAM,CAAC,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;oBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;iBAAE,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC;KAC/F,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAmDD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAKzD;AAkCD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B7D;AAiCD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAyBlD;AAuQD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASxD;AA4CD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,GAAG,MAAM,CAoBnG;AAED,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,MAAM,CAKtE;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,SAAS,EAAE,EACtB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAysB7B;AAMD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA+B3D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAUlE;AAoCD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAI/F"}

package/dist/client-bundle.js

@@ -12,6 +12,7 @@ import { resolveComponentName } from '@vesk/compiler/src/server-codegen';
 import { collectVskImportPaths, vskImportLines } from '@vesk/compiler/src/vsk-imports';
 import { inlineMdContentAttrs, guessProjectRoots } from '@vesk/compiler/src/md-inline';
 import { resolveImportPath, findTsconfigPath } from '@vesk/compiler/src/module-imports';
+import { serverOnlyPlugin } from '@vesk/adapter/src/server-only-plugin';
 import { availableParallelism } from 'node:os';
 /**
  * Run `fn` over `items` with at most `limit` in flight, preserving input
@@ -256,6 +257,28 @@ export function nativeLibraryImportStubs(code) {
     });
     return lines.join('\n') + '\n\n';
 }
+/**
+ * Report, and under `--strict` fail on, a server-only package that reached a
+ * client chunk.
+ *
+ * Not an error by default: importing `../db.ts` from a page is the normal way
+ * to write a server-rendered page, and the import is harmless as long as the
+ * binding is only touched during SSR — which is the whole reason the bundler
+ * substitutes a throwing stub instead of breaking the module. `--strict` is the
+ * gate for authors who want the build to refuse it outright, the same bargain
+ * `--strict` already makes for unresolvable chunk imports.
+ */
+function reportServerOnlyImports(chunkName, hits, strict) {
+    const detail = [...new Set(hits.map(h => `"${h.binding}" from "${h.specifier}"`))].join(', ');
+    if (strict) {
+        throw new Error(`[vesk] ${chunkName} imports a server-only package in client code: ${detail}. ` +
+            'Move that work into an API route (app/api/**/route.ts) or a server action. ' +
+            'Pass without --strict to allow it (the binding is replaced by a throwing stub).');
+    }
+    console.error(`[vesk] ${chunkName}: removed server-only import from client code (${detail}). ` +
+        'It is replaced by a stub that throws if the component calls it at runtime — ' +
+        'server-only work belongs in an API route or a server action.');
+}
 /**
  * Demotes surviving value exports to plain declarations (`export const x`
  * becomes `const x`) and drops bare re-export lists (`export { x }`,
@@ -1008,7 +1031,7 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
                             console.error('[vesk] chunk import merge aborted for', chunkName + ':', chunkImports.reason);
                         const head = chunkImports.render();
                         const code = (head ? head + '\n\n' : '') + chunkCode.join('\n\n');
-                        chunkEntries.push({ name: chunkName, code, node, importsTable: chunkImports, imports: chunkHasImports(head.length, !chunkImports.ok) });
+                        chunkEntries.push({ name: chunkName, code, node, importsTable: chunkImports, imports: chunkHasImports(head.length, !chunkImports.ok), });
                     }
                 }
                 walkSplit(node.children || [], [..._chain, node]);
@@ -1027,7 +1050,7 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
                 console.error('[vesk] chunk import merge aborted for shared.js:', sharedImports.reason);
             const head = sharedImports.render();
             const code = (head ? head + '\n\n' : '') + sharedCode.join('\n\n');
-            chunkEntries.push({ name: SHARED_CHUNK_NAME, code, node: null, importsTable: sharedImports, imports: chunkHasImports(head.length, !sharedImports.ok) });
+            chunkEntries.push({ name: SHARED_CHUNK_NAME, code, node: null, importsTable: sharedImports, imports: chunkHasImports(head.length, !sharedImports.ok), });
         }
         const chunkIIFE = (body) => `(()=>{\nconst __components = globalThis.__components || (globalThis.__components = {});\nconst __hydrators = globalThis.__hydrators || (globalThis.__hydrators = {});\n${body}\n})();\n`;
         /**
@@ -1187,6 +1210,19 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
                 const tmpFile = join(tmpBase, 'entry.js');
                 const toBundle = `const __components = globalThis.__components || (globalThis.__components = {});\nconst __hydrators = globalThis.__hydrators || (globalThis.__hydrators = {});\n${entry.code}\n`;
                 writeFileSync(tmpFile, toBundle);
+                // Keeps a database driver out of a browser bundle. The interception has
+                // to be here, inside the bundler, because that is the only place the
+                // transitive import `db.ts → slintorm → pg` is ever visible: by now the
+                // chunk's own import list is merged, and the offender is almost never
+                // in it.
+                const serverOnlyHits = [];
+                const driverHits = [];
+                const eagerHits = [];
+                const serverOnlyGuard = serverOnlyPlugin({
+                    onStub: hit => serverOnlyHits.push(hit),
+                    onDriver: hit => driverHits.push(hit),
+                    onEager: hit => eagerHits.push(hit),
+                });
                 try {
                     // Pass the app tsconfig so esbuild resolves tsconfig `paths` aliases
                     // (`@/x`, `@app/x`) inside transitively bundled modules too.
@@ -1212,7 +1248,7 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
                         // shared-modules.js serves every route chunk. (esbuild's `alias`
                         // option only accepts bare package names, so this is a resolver
                         // rather than a map.)
-                        ...(sharedRedirectPlugin ? { plugins: [sharedRedirectPlugin] } : {}),
+                        ...(sharedRedirectPlugin ? { plugins: [sharedRedirectPlugin, serverOnlyGuard] } : { plugins: [serverOnlyGuard] }),
                         ...(appTsconfig ? { tsconfig: appTsconfig } : {}),
                     });
                     finalCode = result.outputFiles[0].text;
@@ -1247,6 +1283,35 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
                     }
                     catch { }
                 }
+                // Checked OUTSIDE the try above, deliberately. A TCP driver cannot be
+                // stubbed into a browser bundle — a page that looked fine and failed on
+                // its first query would be worse than a build error — and the catch
+                // block degrades every failure into "strip the imports and carry on",
+                // which is exactly the wrong outcome for this one.
+                if (eagerHits.length > 0) {
+                    // A stub would throw while the chunk is still evaluating, so the page
+                    // would die before a component existed. That is the worst place to
+                    // learn about it: refuse the build instead.
+                    const detail = eagerHits
+                        .map(h => `${h.importer} uses ${h.bindings.map(b => `"${b}"`).join(', ')} from "${h.specifier}" at module scope`)
+                        .join('; ');
+                    console.error('[vesk] server-only package used at module scope in client code', entry.name + ':', detail);
+                    throw new Error(`[vesk] ${entry.name}: ${detail}.\n` +
+                        'A module-scope statement runs the moment the browser evaluates the chunk, so a ' +
+                        'server-only package cannot be substituted there. Move that work into an API route ' +
+                        '(app/api/**/route.ts) or a server action — if the binding is only used from inside ' +
+                        'a function, this build already handles it.');
+                }
+                if (driverHits.length > 0) {
+                    const detail = [...new Set(driverHits.map(h => `${h.specifier} (from ${h.importer})`))].join(', ');
+                    console.error('[vesk] chunk bundle contains a TCP-only driver', entry.name + ':', detail);
+                    throw new Error(`[vesk] ${entry.name} pulls a TCP-only driver into the browser bundle: ${detail}. ` +
+                        "A browser cannot open a socket. Import the package's edge/browser-safe entry if it " +
+                        'ships one, or keep database access in an API route (app/api/**/route.ts) or a server action.');
+                }
+                if (serverOnlyHits.length > 0) {
+                    reportServerOnlyImports(entry.name, serverOnlyHits, options?.strict);
+                }
             }
             else {
                 // No-import chunk: wrap the compiled source in the registry IIFE. The

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACe,YAAY,EAAE,WAAW,EAC7B,UAAU,EAChC,MAAM,yBAAyB,CAAC;AAoDjC;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;CACjB;AACD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,UAAU,EAAE,EACrB,OAAO,EAAE,iBAAiB,EAAE,GAAG,IAAI,GAAG,SAAS,GAC9C,UAAU,EAAE,CAQd;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,UAAU,EAAE,EACrB,KAAK,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,GACxC,UAAU,EAAE,CAGd;AAkDD,wBAAsB,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAiXpG;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAIhE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,aAAa,GACd,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACe,YAAY,EAAE,WAAW,EAC7B,UAAU,EAChC,MAAM,yBAAyB,CAAC;AAoDjC;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;CACjB;AACD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,UAAU,EAAE,EACrB,OAAO,EAAE,iBAAiB,EAAE,GAAG,IAAI,GAAG,SAAS,GAC9C,UAAU,EAAE,CAQd;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,UAAU,EAAE,EACrB,KAAK,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,GACxC,UAAU,EAAE,CAGd;AAkDD,wBAAsB,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CA0XpG;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAIhE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,aAAa,GACd,MAAM,2BAA2B,CAAC"}

package/dist/index.js

@@ -15,6 +15,7 @@ import { compileMiddleware, compileMiddlewareCode } from '@vesk/adapter/src/midd
 import { compileEvents } from '@vesk/adapter/src/events';
 import { generateClientBundle } from '@vesk/adapter/src/client-bundle';
 import { generateManifest } from '@vesk/adapter/src/manifest';
+import { isSocketlessTarget, tcpDriverViolations, edgeDriverBuildError } from '@vesk/adapter/src/server-only';
 import { copyStaticAssets } from '@vesk/adapter/src/static';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 async function resolveCompilerApi(name) {
@@ -204,6 +205,15 @@ export async function build(appDir, options) {
     if (pluginHeadExtra)
         console.error('vesk build: baked plugin head → config.json + SSR functions');
     console.error(`vesk build: output → ${outDir}`);
+    // Socketless-target gate, before anything is compiled or bundled. An edge
+    // runtime has no TCP socket, so a build that imports a socket driver produces
+    // a function that fails on its first query — in production, from a log. Fail
+    // here instead, naming the file, the line and the driver.
+    if (isSocketlessTarget(options?.platform, options?.target)) {
+        const driverHits = tcpDriverViolations(appDir);
+        if (driverHits.length > 0)
+            throw edgeDriverBuildError(driverHits);
+    }
     const dirs = [
         resolve(outDir, 'server', 'functions'),
         resolve(outDir, 'server', 'api'),

package/dist/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAqE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAiCpK,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,EAAE,EACnB,SAAS,EAAE,SAAS,EAAE,EACtB,SAAS,EAAE,YAAY,EAAE,EACzB,YAAY,EAAE,cAAc,EAAE,EAC9B,iBAAiB,EAAE,OAAO,EAC1B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,CAAC,EAAE,MAAM,EAClB,aAAa,UAAQ,GACpB,QAAQ,CAuEV"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAqE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAiCpK,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,EAAE,EACnB,SAAS,EAAE,SAAS,EAAE,EACtB,SAAS,EAAE,YAAY,EAAE,EACzB,YAAY,EAAE,cAAc,EAAE,EAC9B,iBAAiB,EAAE,OAAO,EAC1B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,CAAC,EAAE,MAAM,EAClB,aAAa,UAAQ,GACpB,QAAQ,CA8EV"}

package/dist/manifest.js

@@ -44,6 +44,13 @@ export function generateManifest(routes, ssrRoutes, apiRoutes, staticRoutes, mid
             entry.tags = r._isrTags;
         routeEntries.push(entry);
     }
+    // Same precedence rule as the API entries below, and for the same reason:
+    // every consumer takes the FIRST exact-length match, so directory-scan order
+    // decides. `app/docs/[slug]/page.vsk` scanned before `app/docs/boom/page.vsk`
+    // left `/docs/boom` permanently served by the dynamic route — a static page
+    // that 404s or, worse, renders the wrong page's content. The API half of this
+    // fix landed earlier; SSR entries had the identical defect.
+    routeEntries.sort((a, b) => compareSpecificity(a.path, b.path));
     const apiEntries = [];
     for (const r of apiRoutes) {
         const urlParts = r.fullPath.split('/').filter(Boolean);

package/dist/prod-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAajG,OAAO,KAAK,EAAkB,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAuFpG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AA0FD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG;IAAE,WAAW,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAqlBvK"}
+{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAcjG,OAAO,KAAK,EAAkB,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAuFpG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AA0FD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG;IAAE,WAAW,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA6mBvK"}

package/dist/prod-server.js

@@ -12,6 +12,7 @@ import { resolveCssUrls, hasBuiltGlobalCss } from '@vesk/adapter/src/css';
 import { loadVeskConfig } from '@vesk/adapter/src/load-config';
 import { renderDefaultNotFoundPage, renderDefaultErrorPage } from '@vesk/adapter/src/default-pages';
 import { installResponsePipeline } from '@vesk/adapter/src/response-pipeline';
+import { resolveBoundaryFileForUrl } from '@vesk/adapter/src/ssr-function';
 import { mimeFor } from '@vesk/adapter/src/platform-output';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 async function readBody(req, maxBytes = DEFAULT_MAX_BODY_BYTES) {
@@ -600,17 +601,42 @@ export async function startProdServer(outDir, options) {
         const pageCssUrls = resolveCssUrls({
             enabled: hasBuiltGlobalCss(outDir),
         });
-        const nfPath = resolve(appDir, 'not-found.vsk');
-        let notFoundHtml = null;
-        if (existsSync(nfPath)) {
-            try {
-                const runtimePath = resolve(outDir, 'server', 'runtime.js');
-                const { renderFullPage, storeDataScriptGlobal } = await import(runtimePath);
-                const src = readFileSync(nfPath, 'utf-8');
-                const compName = resolveComponentName(src) || 'NotFound';
-                notFoundHtml = await renderFullPage(src, compName, { params: {}, url: url.pathname }, new Map(), { hydrate: true, cssUrls: pageCssUrls, security: securityConfig?.security || {}, externalDataScript: storeDataScriptGlobal, sourcePath: nfPath, headExtra: bakedHeadExtra });
+        /**
+         * Render the boundary that owns `url.pathname`.
+         *
+         * Deepest-match over the URL's directories, not a hard read of the root
+         * file: `app/admin/not-found.vsk` is the boundary for `/admin/*`, and the
+         * root one is the fallback. The generated SSR function does the same walk at
+         * build time (`resolveNotFoundFile`) and renders the boundary itself inside
+         * the layout stack; this path is what remains for an unmatched URL, for a
+         * route with no layout (which streams, so its status is already committed),
+         * and for an error thrown outside a page's own try block.
+         */
+        const boundaryCache = new Map();
+        async function renderBoundaryFile(file, pathname, props) {
+            const boundaryPath = resolveBoundaryFileForUrl(pathname, appDir, file);
+            if (!boundaryPath)
+                return null;
+            const key = `${file}:${boundaryPath}`;
+            let html = boundaryCache.has(key) ? boundaryCache.get(key) : null;
+            if (html === null) {
+                try {
+                    const runtimePath = resolve(outDir, 'server', 'runtime.js');
+                    const { renderFullPage, storeDataScriptGlobal } = await import(runtimePath);
+                    const src = readFileSync(boundaryPath, 'utf-8');
+                    const compName = resolveComponentName(src) || (file === 'error.vsk' ? 'Error' : 'NotFound');
+                    html = await renderFullPage(src, compName, props, new Map(), { hydrate: true, cssUrls: pageCssUrls, clientScriptUrl: buildConfig?.assets?.client?.url || '/_vesk/static/client.js', clientScriptIntegrity: buildConfig?.assets?.client?.integrity, security: securityConfig?.security || {}, externalDataScript: storeDataScriptGlobal, sourcePath: boundaryPath, headExtra: bakedHeadExtra });
+                }
+                catch {
+                    return null;
+                }
             }
-            catch { }
+            return html;
+        }
+        let notFoundHtml = null;
+        {
+            const rendered = await renderBoundaryFile('not-found.vsk', url.pathname, { params: {}, url: url.pathname });
+            notFoundHtml = rendered;
         }
         for (const route of buildConfig.routes) {
             if (route.type === 'ssr') {
@@ -686,20 +712,17 @@ export async function startProdServer(outDir, options) {
                             if (eventsMod) {
                                 await executeError(err, { url: url.href, routePath: route.path, target: 'node', status: 500 }, eventsMod);
                             }
-                            const errPath = resolve(appDir, 'error.vsk');
-                            let errorHtml = null;
-                            if (existsSync(errPath)) {
-                                try {
-                                    const runtimePath = resolve(outDir, 'server', 'runtime.js');
-                                    const { renderFullPage, storeDataScriptGlobal } = await import(runtimePath);
-                                    const src = readFileSync(errPath, 'utf-8');
-                                    const compName = resolveComponentName(src) || 'Error';
-                                    // never leak stack traces / internal messages to prod error pages
-                                    const expose = process.env.NODE_ENV !== 'production';
-                                    errorHtml = await renderFullPage(src, compName, { error: expose ? err.message : 'Internal Server Error', stack: expose ? err.stack : '', statusCode: 500, url: url.pathname }, new Map(), { hydrate: true, cssUrls: pageCssUrls, clientScriptUrl: buildConfig?.assets?.client?.url || '/_vesk/static/client.js', clientScriptIntegrity: buildConfig?.assets?.client?.integrity, security: securityConfig?.security || {}, externalDataScript: storeDataScriptGlobal, sourcePath: errPath, headExtra: bakedHeadExtra });
-                                }
-                                catch { }
-                            }
+                            // Same nearest-boundary walk as not-found above. This is the last resort for a
+                            // throw the generated function could not absorb — a layout render
+                            // failure, or the error boundary itself failing — and it must pick
+                            // the boundary that owns the URL, not the root one.
+                            const expose = process.env.NODE_ENV !== 'production';
+                            const errorHtml = await renderBoundaryFile('error.vsk', url.pathname, {
+                                error: expose ? err.message : 'Internal Server Error',
+                                stack: expose ? err.stack : '',
+                                statusCode: 500,
+                                url: url.pathname,
+                            });
                             res.writeHead(500, { 'Content-Type': 'text/html' });
                             res.end(errorHtml || renderDefaultErrorPage({ message: process.env.NODE_ENV !== 'production' ? err.message : undefined, url: url.pathname, headExtra: bakedHeadExtra }));
                             return;

package/dist/server-only-plugin.d.ts

@@ -0,0 +1,77 @@
+export interface ServerOnlyHit {
+    specifier: string;
+    binding: string;
+    importer: string;
+}
+export interface ServerOnlyPluginOptions {
+    /** One call per (specifier, binding) replaced by a throwing stub. */
+    onStub?: (hit: ServerOnlyHit) => void;
+    /** One call per TCP driver seen while bundling. Never stubbed. */
+    onDriver?: (hit: {
+        specifier: string;
+        importer: string;
+    }) => void;
+    /**
+     * One call per binding used at module-evaluation position, where a stub would
+     * throw while the chunk loads rather than at a call site. Reported, never
+     * stubbed — this is a build error.
+     */
+    onEager?: (hit: {
+        specifier: string;
+        bindings: string[];
+        importer: string;
+    }) => void;
+}
+/** The slice of esbuild's plugin API this uses, declared so the module needs no esbuild types. */
+export interface EsbuildPluginLike {
+    name: string;
+    setup: (build: {
+        onResolve: (opts: {
+            filter: RegExp;
+            namespace?: string;
+        }, cb: (args: {
+            path: string;
+            importer: string;
+        }) => unknown) => void;
+        onLoad: (opts: {
+            filter: RegExp;
+            namespace: string;
+        }, cb: (args: {
+            path: string;
+        }) => {
+            contents: string;
+            loader: string;
+        }) => void;
+    }) => void;
+}
+/**
+ * The export names one file asks for from `specifier`.
+ *
+ * Read from the importer's own source rather than guessed: a stub declaring the
+ * wrong set of names is either an unresolvable-import build failure or, worse,
+ * a silently undefined binding.
+ */
+export declare function importedNamesFor(code: string, specifier: string): string[];
+/** The shared throwing-proxy factory, emitted once per stubbed package. */
+export declare function stubFactorySource(specifier: string): string;
+/**
+ * Is `name` used at module-evaluation position — i.e. NOT inside a function?
+ *
+ * This is the difference between a stub that is fine and one that is a trap.
+ *
+ *   export function allRows() { return orm.getAll(); }   // never runs in the
+ *                                                      // browser → stub is fine
+ *   export const orm = createORM({});                   // runs the moment the
+ *                                                      // chunk evaluates
+ *
+ * The second form cannot be rescued by any amount of stubbing: the browser
+ * evaluates it while loading the chunk, so the page dies before a single
+ * component exists. A build error is the honest answer there, and it is
+ * decidable from the source alone — no types, no dataflow.
+ *
+ * Non-computed member keys (`obj.orm`) and object/class property keys are not
+ * references, for the same reason the reactivity diagnostics skip them.
+ */
+export declare function referencedAtTopLevel(code: string, name: string): boolean;
+export declare function serverOnlyPlugin(options?: ServerOnlyPluginOptions): EsbuildPluginLike;
+//# sourceMappingURL=server-only-plugin.d.ts.map

package/dist/server-only-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-only-plugin.d.ts","sourceRoot":"","sources":["../src/server-only-plugin.ts"],"names":[],"mappings":"AA0BA,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,IAAI,CAAC;IACtC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAClE;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACtF;AAED,kGAAkG;AAClG,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,CAAC,KAAK,EAAE;QACb,SAAS,EAAE,CACT,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,EAC5C,EAAE,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,KACtD,IAAI,CAAC;QACV,MAAM,EAAE,CACN,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,EAC3C,EAAE,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,KAAK;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,KACjE,IAAI,CAAC;KACX,KAAK,IAAI,CAAC;CACZ;AAMD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CA+C1E;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAmB3D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAoDxE;AAED,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,GAAG,iBAAiB,CAoDzF"}

package/dist/server-only-plugin.js

@@ -0,0 +1,233 @@
+/**
+ * esbuild plugin that keeps server-only packages out of a browser bundle.
+ *
+ * Why a plugin and not a filter on the chunk's own import list: by the time the
+ * bundler runs, the chunk's direct imports have already been merged, and the
+ * offender is almost never one of them. The shape that actually leaks is
+ * `page.vsk → app/db.ts → slintorm → pg`, and only the bundler's transitive
+ * resolution sees `pg` at all. Filtering the import list would have caught
+ * nothing.
+ *
+ * A resolved server-only package is replaced with a generated module whose
+ * every export is a Proxy that throws. A stub and not a deletion, because the
+ * binding is referenced by code that survives into the chunk: dropping it would
+ * produce `X is not defined` at hydration, pointing nowhere near the import that
+ * caused it. The export names come from the importing statement, read off the
+ * importer's own source, so the generated module declares exactly what the
+ * importer asked for and nothing is silently undefined.
+ *
+ * TCP drivers are NOT stubbed. A browser bundle cannot contain one under any
+ * circumstances, so a stub would ship a page that looks fine and fails at the
+ * first query; they are reported and left for esbuild to reject.
+ */
+import { readFileSync } from 'node:fs';
+import { parse } from '@vesk/compiler/src/parser';
+import { classifySpecifier } from '@vesk/adapter/src/server-only';
+const STUB_NAMESPACE = 'vesk-server-only';
+let stubCounter = 0;
+/**
+ * The export names one file asks for from `specifier`.
+ *
+ * Read from the importer's own source rather than guessed: a stub declaring the
+ * wrong set of names is either an unresolvable-import build failure or, worse,
+ * a silently undefined binding.
+ */
+export function importedNamesFor(code, specifier) {
+    let ast;
+    try {
+        ast = parse(code);
+    }
+    catch {
+        return [];
+    }
+    const names = [];
+    // The vsk parser flattens a module specifier to a bare string, while the TS
+    // parser keeps it as `{ value }`. Both shapes occur in practice.
+    const sourceOf = (node) => {
+        const src = node.source;
+        if (typeof src === 'string')
+            return src;
+        const v = src?.value;
+        return typeof v === 'string' ? v : null;
+    };
+    for (const node of ast.body ?? []) {
+        if (node?.type === 'ImportDeclaration') {
+            if (sourceOf(node) !== specifier)
+                continue;
+            for (const spec of node.specifiers ?? []) {
+                // `import * as x` has no names to declare — the namespace is made of
+                // whatever the importer reaches for, and each of those reads is what
+                // throws. Declaring guesses would be worse than declaring none.
+                if (spec.type === 'ImportNamespaceSpecifier')
+                    continue;
+                const local = spec.local?.name;
+                if (typeof local === 'string' && !names.includes(local))
+                    names.push(local);
+            }
+            continue;
+        }
+        if (node?.type === 'ExportAllDeclaration' || node?.type === 'ExportNamedDeclaration') {
+            if (sourceOf(node) !== specifier)
+                continue;
+            // `export * from 'pg'` names nothing at all, and `export { Client } from
+            // 'pg'` names only what this barrel happens to forward. Either way the
+            // honest stub declares what is written here.
+            for (const spec of node.specifiers ?? []) {
+                const imported = spec.imported?.name ?? spec.imported?.value ?? spec.local?.name;
+                if (typeof imported === 'string' && !names.includes(imported))
+                    names.push(imported);
+            }
+        }
+    }
+    return names;
+}
+/** The shared throwing-proxy factory, emitted once per stubbed package. */
+export function stubFactorySource(specifier) {
+    const template = '"$1" comes from "$0", which is server-only. It reached the browser bundle because a ' +
+        'component (or a module one imports) imported it — component code runs in the browser, ' +
+        'where this module cannot work. Move the server-only work into an API route ' +
+        '(app/api/**/route.ts) or a server action and call it over HTTP, or import the ' +
+        'edge/browser-safe entry if the package ships one.';
+    return [
+        'function __vesk_stub(binding) {',
+        '  var message = ' + JSON.stringify(template) + ';',
+        '  message = message.replace("$0", ' + JSON.stringify(specifier) + ').replace("$1", String(binding));',
+        '  var thrower = function () { throw Object.assign(new Error(message), { __veskServerOnly: ' + JSON.stringify(specifier) + ' }); };',
+        '  return new Proxy(function () {}, {',
+        '    get: thrower,',
+        '    apply: thrower,',
+        '    construct: thrower',
+        '  });',
+        '}',
+    ].join('\n');
+}
+/**
+ * Is `name` used at module-evaluation position — i.e. NOT inside a function?
+ *
+ * This is the difference between a stub that is fine and one that is a trap.
+ *
+ *   export function allRows() { return orm.getAll(); }   // never runs in the
+ *                                                      // browser → stub is fine
+ *   export const orm = createORM({});                   // runs the moment the
+ *                                                      // chunk evaluates
+ *
+ * The second form cannot be rescued by any amount of stubbing: the browser
+ * evaluates it while loading the chunk, so the page dies before a single
+ * component exists. A build error is the honest answer there, and it is
+ * decidable from the source alone — no types, no dataflow.
+ *
+ * Non-computed member keys (`obj.orm`) and object/class property keys are not
+ * references, for the same reason the reactivity diagnostics skip them.
+ */
+export function referencedAtTopLevel(code, name) {
+    let ast;
+    try {
+        ast = parse(code);
+    }
+    catch {
+        // Cannot prove it either way; assume the dangerous case so the build is
+        // never softened by an unparseable file.
+        return true;
+    }
+    let found = false;
+    const FUNCTION_TYPES = new Set([
+        'FunctionDeclaration', 'FunctionExpression', 'ArrowFunctionExpression',
+        'ClassMethod', 'ObjectMethod', 'ClassDeclaration', 'ClassExpression',
+    ]);
+    /** Never carries a reference: AST bookkeeping and source offsets. */
+    const SKIP_KEYS = new Set(['type', 'start', 'end', 'loc', 'range', 'raw', 'regex']);
+    /** A re-export's module specifier and specifier list name bindings, not use them. */
+    const SKIP_EXPORT_NAMED_KEYS = new Set([...SKIP_KEYS, 'source', 'specifiers', 'exportKind', 'attributes']);
+    const visit = (node, parentKey, fnDepth) => {
+        if (found || node === null || typeof node !== 'object')
+            return;
+        if (Array.isArray(node)) {
+            for (const child of node)
+                visit(child, parentKey, fnDepth);
+            return;
+        }
+        const n = node;
+        if (n.type === 'MemberExpression' || n.type === 'Property' || n.type === 'PropertyDefinition' || n.type === 'MethodDefinition') {
+            const prop = (n.property ?? n.key);
+            // `obj.orm` and `{ orm: 1 }` name a field, not the binding. `[orm]` does.
+            if (prop && typeof prop === 'object' && prop.name === name && n.computed !== true)
+                return;
+        }
+        // An import NAMES the binding without USING it. Walking into the specifiers
+        // made every imported name look top-level-referenced, which would have
+        // turned every server-only import into a build error.
+        if (n.type === 'ImportDeclaration' || n.type === 'ExportAllDeclaration' || n.type === 'ImportExpression')
+            return;
+        if (n.type === 'Identifier' && n.name === name) {
+            if (parentKey === 'local' || parentKey === 'id' || parentKey === 'params' || parentKey === 'key')
+                return;
+            if (fnDepth === 0)
+                found = true;
+            return;
+        }
+        // `export const orm = createORM({})` carries its USE inside the export
+        // declaration, so only the specifier list and module specifier are skipped.
+        const skip = n.type === 'ExportNamedDeclaration' ? SKIP_EXPORT_NAMED_KEYS : SKIP_KEYS;
+        const nextDepth = FUNCTION_TYPES.has(String(n.type)) ? fnDepth + 1 : fnDepth;
+        for (const [key, value] of Object.entries(n)) {
+            if (skip.has(key))
+                continue;
+            visit(value, key, nextDepth);
+        }
+    };
+    visit(ast.body, undefined, 0);
+    return found;
+}
+export function serverOnlyPlugin(options = {}) {
+    /** Generated stub id -> module source. */
+    const stubs = new Map();
+    return {
+        name: 'vesk-server-only',
+        setup(build) {
+            build.onResolve({ filter: /.*/ }, args => {
+                const kind = classifySpecifier(args.path);
+                if (!kind)
+                    return null;
+                if (kind === 'tcp-driver') {
+                    options.onDriver?.({ specifier: args.path, importer: args.importer });
+                    // Returning null lets esbuild resolve it normally, which in a browser
+                    // bundle fails with its own "Could not resolve" error. Substituting a
+                    // stub here would ship a page that looks fine and dies on first use.
+                    return null;
+                }
+                let names = [];
+                let importerCode = '';
+                try {
+                    importerCode = readFileSync(args.importer, 'utf-8');
+                    names = importedNamesFor(importerCode, args.path);
+                }
+                catch {
+                    /* importer unreadable — emit a default-only stub rather than crash */
+                }
+                // A stub only works if the browser never reaches the binding. A
+                // module-evaluation-position use means the browser reaches it while
+                // loading the chunk, before any component exists, so no stub can help
+                // and the build has to say so rather than ship a page that dies on load.
+                const eager = names.filter(n => referencedAtTopLevel(importerCode, n));
+                if (eager.length > 0) {
+                    options.onEager?.({ specifier: args.path, bindings: eager, importer: args.importer });
+                    return null;
+                }
+                const id = `vesk-stub-${stubCounter++}`;
+                stubs.set(id, [
+                    stubFactorySource(args.path),
+                    'export default __vesk_stub("default");',
+                    ...names.map(n => `export const ${n} = __vesk_stub(${JSON.stringify(n)});`),
+                ].join('\n'));
+                for (const binding of names) {
+                    options.onStub?.({ specifier: args.path, binding, importer: args.importer });
+                }
+                return { path: id, namespace: STUB_NAMESPACE };
+            });
+            build.onLoad({ filter: /.*/, namespace: STUB_NAMESPACE }, args => ({
+                contents: stubs.get(args.path) ?? stubFactorySource('unknown'),
+                loader: 'js',
+            }));
+        },
+    };
+}

package/dist/server-only.d.ts

@@ -0,0 +1,99 @@
+/**
+ * What may not cross the server/client line, and what may not be deployed to a
+ * socketless runtime.
+ *
+ * Vesk splits a `.vsk` file into two graphs without being told which side a
+ * given import belongs to: a page is *also* a client component, so the module
+ * a page imports for its `load()` ends up in the browser chunk closure. When
+ * that module reaches for a database driver, the browser bundler dutifully
+ * inlines the driver's Node implementation — `node:net`, `node:tls`,
+ * `node:stream` — and the client bundle grows by hundreds of kilobytes of code
+ * that cannot run and is never called.
+ *
+ * So the separation has to be enforced by the build rather than inferred from
+ * usage. Two distinct rules, because the failure modes are different:
+ *
+ * - **Server-only packages** (`slintorm`, `@vesk/adapter`) may legitimately be
+ *   imported by a page that only touches them during SSR. The import is removed
+ *   from the browser chunk and every binding it declared becomes a throwing
+ *   stub, so a build stays possible but a real client-side use fails loudly and
+ *   names itself. `--strict` turns the warning into a build failure.
+ * - **TCP-only drivers** (`pg`, `mysql2`, `mongodb`, `node:sqlite`) cannot run
+ *   anywhere a socket cannot be opened — not in a browser, and not on any edge
+ *   runtime. In an edge-targeted build that is not a degradation, it is a
+ *   guaranteed crash at the first query, so it is a hard build error with no
+ *   opt-out: the alternative is discovering it in a deployment log.
+ *
+ * AST-only throughout. No text scanning — see the module rules.
+ */
+export type ServerOnlyKind = 'server-only-package' | 'tcp-driver';
+/**
+ * Classify a bare import specifier. Returns null for anything that is fine on
+ * the client — including a subpath of a listed package that is itself a
+ * browser entry.
+ */
+export declare function classifySpecifier(spec: string): ServerOnlyKind | null;
+export declare function isServerOnlySpecifier(spec: string): boolean;
+export declare function isTcpDriverSpecifier(spec: string): boolean;
+/**
+ * Throwing stand-ins for the bindings a server-only import declared.
+ *
+ * A stub, not a removal: the binding is referenced by code that survives into
+ * the chunk, so dropping it would produce `X is not defined` at hydration — a
+ * ReferenceError pointing nowhere near the import that caused it. A Proxy that
+ * throws on any use keeps `typeof` truthful (so a feature check does not blow
+ * up during module evaluation) while failing at the exact call site with a
+ * message that names the package, the binding and the fix.
+ */
+export declare function serverOnlyStubs(notes: Array<{
+    specifier: string;
+    binding: string;
+}>): string;
+/**
+ * Same stubs, discovered by scanning source rather than from a recorded list —
+ * used by the edge gate, which sees `.vsk` sources before anything is compiled.
+ */
+export declare function serverOnlyImportStubs(code: string, classify?: (spec: string) => ServerOnlyKind | null): string;
+export interface ServerOnlyViolation {
+    kind: ServerOnlyKind;
+    specifier: string;
+    /** Absolute path of the file the import was written in. */
+    file: string;
+    /** 1-based line number when it could be determined. */
+    line: number | null;
+    /** What to do about it. */
+    remedy: string;
+}
+/**
+ * Every server-only / TCP-only import written across a set of files.
+ *
+ * Walks the whole set rather than a module graph, because the file that names
+ * the driver is rarely the file that matters: `app/db.ts` importing `slintorm`
+ * is the normal shape, and it is the *component* that transitively pulls it in.
+ * Callers pair this with their own reachability information.
+ */
+export declare function scanServerOnlyImports(files: Array<{
+    path: string;
+    code: string;
+}>): ServerOnlyViolation[];
+/**
+ * The build-time error for an edge-targeted build that imports a TCP driver.
+ *
+ * No opt-out by design: there is no configuration of an edge target under which
+ * a TCP driver works, so the only question is whether the author finds out here
+ * or from a production log.
+ */
+export declare function edgeDriverBuildError(violations: ServerOnlyViolation[]): Error;
+export declare function isSocketlessTarget(platform: string | null | undefined, target: string | null | undefined): boolean;
+/** Every app source file under `dir`, recursively. */
+export declare function collectAppSources(dir: string, out?: string[]): string[];
+/**
+ * TCP-driver imports anywhere under the app directory.
+ *
+ * Scans the whole tree rather than the client chunk closure: the driver is named
+ * in `app/db.ts`, which is correct, and what is wrong is that anything under it
+ * is reachable from a socketless runtime. Either way the build has to stop, and
+ * it has to stop before minutes of bundling have been spent.
+ */
+export declare function tcpDriverViolations(appDir: string): ServerOnlyViolation[];
+//# sourceMappingURL=server-only.d.ts.map

package/dist/server-only.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-only.d.ts","sourceRoot":"","sources":["../src/server-only.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAsCH,MAAM,MAAM,cAAc,GAAG,qBAAqB,GAAG,YAAY,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMrE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,MAAM,CAkB5F;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,cAAc,GAAG,IAAwB,GAAG,MAAM,CAoBjI;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB;AAWD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3C,mBAAmB,EAAE,CA8BvB;AAYD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAU7E;AAYD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGlH;AAMD,sDAAsD;AACtD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,EAAO,GAAG,MAAM,EAAE,CAwB3E;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAUzE"}

package/dist/server-only.js

@@ -0,0 +1,283 @@
+/**
+ * What may not cross the server/client line, and what may not be deployed to a
+ * socketless runtime.
+ *
+ * Vesk splits a `.vsk` file into two graphs without being told which side a
+ * given import belongs to: a page is *also* a client component, so the module
+ * a page imports for its `load()` ends up in the browser chunk closure. When
+ * that module reaches for a database driver, the browser bundler dutifully
+ * inlines the driver's Node implementation — `node:net`, `node:tls`,
+ * `node:stream` — and the client bundle grows by hundreds of kilobytes of code
+ * that cannot run and is never called.
+ *
+ * So the separation has to be enforced by the build rather than inferred from
+ * usage. Two distinct rules, because the failure modes are different:
+ *
+ * - **Server-only packages** (`slintorm`, `@vesk/adapter`) may legitimately be
+ *   imported by a page that only touches them during SSR. The import is removed
+ *   from the browser chunk and every binding it declared becomes a throwing
+ *   stub, so a build stays possible but a real client-side use fails loudly and
+ *   names itself. `--strict` turns the warning into a build failure.
+ * - **TCP-only drivers** (`pg`, `mysql2`, `mongodb`, `node:sqlite`) cannot run
+ *   anywhere a socket cannot be opened — not in a browser, and not on any edge
+ *   runtime. In an edge-targeted build that is not a degradation, it is a
+ *   guaranteed crash at the first query, so it is a hard build error with no
+ *   opt-out: the alternative is discovering it in a deployment log.
+ *
+ * AST-only throughout. No text scanning — see the module rules.
+ */
+import { parse } from '@vesk/compiler/src/parser';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * Packages that are server-side by construction.
+ *
+ * `slintorm` is here for a specific reason, and it is not a slur on the ORM:
+ * `slintorm` ships an edge-safe entry (`slintorm/edge` and `slintorm/browser`,
+ * which resolve to a bundle with no Node built-ins anywhere in its graph), and
+ * that entry is deliberately NOT matched. Only the bare `slintorm` specifier is
+ * server-only, because only that one pulls in the driver dispatch and the
+ * `node:fs` schema generator.
+ */
+const SERVER_ONLY_EXACT = new Set([
+    'slintorm',
+    '@vesk/adapter',
+]);
+/**
+ * Drivers that need a real socket. Anything here is a hard error in an
+ * edge-targeted build.
+ *
+ * `node:sqlite` is a Node built-in that appears only as an import specifier, so
+ * it is listed here alongside the packages for uniformity; it cannot appear in
+ * a browser chunk because the bundler already fails on it.
+ */
+const TCP_DRIVERS = new Set([
+    'pg',
+    'mysql2',
+    'mongodb',
+    'node:sqlite',
+    'node:net',
+    'node:tls',
+]);
+/**
+ * Classify a bare import specifier. Returns null for anything that is fine on
+ * the client — including a subpath of a listed package that is itself a
+ * browser entry.
+ */
+export function classifySpecifier(spec) {
+    if (typeof spec !== 'string' || spec.length === 0)
+        return null;
+    if (TCP_DRIVERS.has(spec))
+        return 'tcp-driver';
+    if (spec.startsWith('node:'))
+        return 'tcp-driver';
+    if (SERVER_ONLY_EXACT.has(spec))
+        return 'server-only-package';
+    return null;
+}
+export function isServerOnlySpecifier(spec) {
+    return classifySpecifier(spec) === 'server-only-package';
+}
+export function isTcpDriverSpecifier(spec) {
+    return classifySpecifier(spec) === 'tcp-driver';
+}
+/**
+ * Throwing stand-ins for the bindings a server-only import declared.
+ *
+ * A stub, not a removal: the binding is referenced by code that survives into
+ * the chunk, so dropping it would produce `X is not defined` at hydration — a
+ * ReferenceError pointing nowhere near the import that caused it. A Proxy that
+ * throws on any use keeps `typeof` truthful (so a feature check does not blow
+ * up during module evaluation) while failing at the exact call site with a
+ * message that names the package, the binding and the fix.
+ */
+export function serverOnlyStubs(notes) {
+    if (notes.length === 0)
+        return '';
+    const lines = notes.map(({ binding, specifier }) => {
+        const message = `"${binding}" comes from "${specifier}", which is server-only. It reached the client bundle ` +
+            'because a component (or a module one imports) imported it — component code runs in the ' +
+            'browser, where this module cannot work. Move the server-only work into an API route ' +
+            '(app/api/**/route.ts) or a server action and call it over HTTP, or import the ' +
+            'edge/browser-safe entry if the package ships one.';
+        const thrower = `throw Object.assign(new Error(${JSON.stringify(message)}), { __veskServerOnly: ${JSON.stringify(specifier)} })`;
+        return (`const ${binding} = new Proxy(function () {}, { ` +
+            `get: function () { ${thrower}; }, ` +
+            `apply: function () { ${thrower}; }, ` +
+            `construct: function () { ${thrower}; } });`);
+    });
+    return lines.join('\n') + '\n\n';
+}
+/**
+ * Same stubs, discovered by scanning source rather than from a recorded list —
+ * used by the edge gate, which sees `.vsk` sources before anything is compiled.
+ */
+export function serverOnlyImportStubs(code, classify = classifySpecifier) {
+    let ast;
+    try {
+        ast = parse(code);
+    }
+    catch {
+        return '';
+    }
+    const notes = [];
+    for (const node of ast.body ?? []) {
+        // Only ImportDeclaration here, unlike the scanner above: a re-export binds
+        // no local name, so there is nothing to replace — the scan still reports it.
+        if (node?.type !== 'ImportDeclaration')
+            continue;
+        const src = node.source?.value;
+        if (typeof src !== 'string' || classify(src) !== 'server-only-package')
+            continue;
+        for (const spec of node.specifiers ?? []) {
+            const local = spec?.local?.name;
+            if (typeof local === 'string')
+                notes.push({ specifier: src, binding: local });
+        }
+    }
+    return serverOnlyStubs(notes);
+}
+const REMEDY = {
+    'server-only-package': 'import it from an API route (app/api/**/route.ts) or a server action instead of a component, ' +
+        'or use the package\'s browser/edge entry point if it ships one.',
+    'tcp-driver': 'this driver opens a TCP socket, which no edge runtime provides. Use the driver\'s HTTP/HTTPS ' +
+        'transport (for SlintORM: `driver: "postgrest"`), or build for a Node target.',
+};
+/**
+ * Every server-only / TCP-only import written across a set of files.
+ *
+ * Walks the whole set rather than a module graph, because the file that names
+ * the driver is rarely the file that matters: `app/db.ts` importing `slintorm`
+ * is the normal shape, and it is the *component* that transitively pulls it in.
+ * Callers pair this with their own reachability information.
+ */
+export function scanServerOnlyImports(files) {
+    const out = [];
+    for (const file of files) {
+        let ast;
+        try {
+            ast = parse(file.code);
+        }
+        catch {
+            continue;
+        }
+        for (const node of ast.body ?? []) {
+            // Re-exports count. `export { Client } from 'pg'` is how a barrel file
+            // forwards a driver, and it is exactly the shape that slips past a scan
+            // looking only at imports.
+            if (node?.type !== 'ImportDeclaration'
+                && node?.type !== 'ExportNamedDeclaration'
+                && node?.type !== 'ExportAllDeclaration')
+                continue;
+            const spec = node.source?.value;
+            if (typeof spec !== 'string')
+                continue;
+            const kind = classifySpecifier(spec);
+            if (!kind)
+                continue;
+            out.push({
+                kind,
+                specifier: spec,
+                file: file.path,
+                line: lineOf(file.code, node.start),
+                remedy: REMEDY[kind],
+            });
+        }
+    }
+    return out;
+}
+/** 1-based line of a character offset. */
+function lineOf(code, offset) {
+    if (typeof offset !== 'number' || offset < 0 || offset > code.length)
+        return null;
+    let line = 1;
+    for (let i = 0; i < offset; i++) {
+        if (code.charCodeAt(i) === 10)
+            line++;
+    }
+    return line;
+}
+/**
+ * The build-time error for an edge-targeted build that imports a TCP driver.
+ *
+ * No opt-out by design: there is no configuration of an edge target under which
+ * a TCP driver works, so the only question is whether the author finds out here
+ * or from a production log.
+ */
+export function edgeDriverBuildError(violations) {
+    const detail = violations
+        .map(v => `  ${v.file}${v.line ? `:${v.line}` : ''} — import "${v.specifier}"\n    ${v.remedy}`)
+        .join('\n');
+    return new Error(`[vesk] edge-targeted build cannot include a TCP-only driver (${violations.length} found).\n` +
+        `${detail}\n\n` +
+        'This was a build error rather than a runtime one because an edge runtime has no socket: ' +
+        'the deployed function would fail on its first query.');
+}
+/**
+ * Platforms whose deployed functions have no socket.
+ *
+ * Derived from `platform-deploy.ts`'s `nodeBuiltins: false` shells — those are
+ * exactly the ones bundled with empty-Node-builtin stubs, which is the same
+ * reason they cannot open a TCP connection. `vercel`/`netlify`/`aws` run Node
+ * functions and are deliberately absent.
+ */
+const SOCKETLESS_PLATFORMS = new Set(['edge', 'cloudflare', 'deno', 'coxmos']);
+export function isSocketlessTarget(platform, target) {
+    if (target === 'edge')
+        return true;
+    return typeof platform === 'string' && SOCKETLESS_PLATFORMS.has(platform);
+}
+const SOURCE_EXTENSIONS = ['.vsk', '.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs'];
+const SKIPPED_DIRS = new Set(['node_modules', '.vesk', '.git', 'dist', '.next', '.output', 'coverage']);
+/** Every app source file under `dir`, recursively. */
+export function collectAppSources(dir, out = []) {
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return out;
+    }
+    for (const entry of entries) {
+        if (SKIPPED_DIRS.has(entry) || entry.startsWith('.'))
+            continue;
+        const full = join(dir, entry);
+        let st;
+        try {
+            st = statSync(full);
+        }
+        catch {
+            continue;
+        }
+        if (st.isDirectory())
+            collectAppSources(full, out);
+        else if (st.isFile()) {
+            const dot = entry.lastIndexOf('.');
+            if (dot === -1)
+                continue;
+            if (SOURCE_EXTENSIONS.includes(entry.slice(dot).toLowerCase()))
+                out.push(full);
+        }
+    }
+    return out;
+}
+/**
+ * TCP-driver imports anywhere under the app directory.
+ *
+ * Scans the whole tree rather than the client chunk closure: the driver is named
+ * in `app/db.ts`, which is correct, and what is wrong is that anything under it
+ * is reachable from a socketless runtime. Either way the build has to stop, and
+ * it has to stop before minutes of bundling have been spent.
+ */
+export function tcpDriverViolations(appDir) {
+    const files = [];
+    for (const path of collectAppSources(appDir)) {
+        try {
+            files.push({ path, code: readFileSync(path, 'utf-8') });
+        }
+        catch {
+            /* unreadable file — not a build blocker */
+        }
+    }
+    return scanServerOnlyImports(files).filter(v => v.kind === 'tcp-driver');
+}

package/dist/ssr-function.d.ts

@@ -1,5 +1,25 @@
 import type { RouteNode, SsrFunctionOptions } from '@vesk/adapter/src/types';
+/**
+ * The nearest `<file>` walking up from a route's own directory to the app root.
+ *
+ * This is the server-side twin of the client router's `findErrorComponent` /
+ * `findNotFoundComponent`, which walk the matched chain deepest-first. Same rule,
+ * same reason: an `error.vsk` (or `not-found.vsk`) inside `app/admin/` is the
+ * boundary for `/admin/*` and nothing else — the root file is the fallback, not
+ * the implementation.
+ */
+export declare function resolveBoundaryFile(sourceDir: string, appDir: string, file: string): string | null;
 export declare function resolveErrorFile(sourceDir: string, appDir: string): string | null;
+export declare function resolveNotFoundFile(sourceDir: string, appDir: string): string | null;
+/**
+ * The nearest `<file>` for a REQUESTED URL, used by the server when no SSR
+ * function ran (an unmatched path) or when one gave up.
+ *
+ * The walk is over URL segments, so a dynamic segment cannot be mapped back to a
+ * directory — `/users/42/edit` stops at `/users`. Static paths, which is what a
+ * `not-found.vsk` is written for, resolve exactly.
+ */
+export declare function resolveBoundaryFileForUrl(pathname: string, appDir: string, file: string): string | null;
 /** Shared persisted-store SSR helper block emitted into every generated SSR
  *  function (prod via ssr-function.ts, dev via hmr.ts — keep the two callers
  *  in sync by calling this). Emit it AFTER the function declarations so the

package/dist/ssr-function.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-function.d.ts","sourceRoot":"","sources":["../src/ssr-function.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAkB,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAI7F,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQjF;AAgED;;;2EAG2E;AAC3E,wBAAgB,qBAAqB,IAAI,MAAM,CA4C9C;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,kBAAkB,GAC3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA4btD"}
+{"version":3,"file":"ssr-function.d.ts","sourceRoot":"","sources":["../src/ssr-function.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAkB,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7F;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQlG;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEjF;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEpF;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQvG;AAgED;;;2EAG2E;AAC3E,wBAAgB,qBAAqB,IAAI,MAAM,CA4C9C;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,kBAAkB,GAC3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA6etD"}

package/dist/ssr-function.js

@@ -3,13 +3,44 @@ import { resolve, relative, join } from 'node:path';
 import { resolveComponentName, precompileFile } from '@vesk/compiler/src/server-codegen';
 import { resolveCssUrls, hasBuiltGlobalCss } from '@vesk/adapter/src/css';
 import { renderDefaultErrorFragment } from '@vesk/adapter/src/default-pages';
-// Finds the nearest error.vsk walking up from the route's own directory to the
-// app root, mirroring the router's findErrorComponent chain semantics.
-export function resolveErrorFile(sourceDir, appDir) {
+/**
+ * The nearest `<file>` walking up from a route's own directory to the app root.
+ *
+ * This is the server-side twin of the client router's `findErrorComponent` /
+ * `findNotFoundComponent`, which walk the matched chain deepest-first. Same rule,
+ * same reason: an `error.vsk` (or `not-found.vsk`) inside `app/admin/` is the
+ * boundary for `/admin/*` and nothing else — the root file is the fallback, not
+ * the implementation.
+ */
+export function resolveBoundaryFile(sourceDir, appDir, file) {
     const rel = relative(appDir, sourceDir).split('/').filter(Boolean);
     for (let depth = rel.length; depth >= 0; depth--) {
         const dir = depth === 0 ? appDir : join(appDir, ...rel.slice(0, depth));
-        const p = join(dir, 'error.vsk');
+        const p = join(dir, file);
+        if (existsSync(p))
+            return p;
+    }
+    return null;
+}
+export function resolveErrorFile(sourceDir, appDir) {
+    return resolveBoundaryFile(sourceDir, appDir, 'error.vsk');
+}
+export function resolveNotFoundFile(sourceDir, appDir) {
+    return resolveBoundaryFile(sourceDir, appDir, 'not-found.vsk');
+}
+/**
+ * The nearest `<file>` for a REQUESTED URL, used by the server when no SSR
+ * function ran (an unmatched path) or when one gave up.
+ *
+ * The walk is over URL segments, so a dynamic segment cannot be mapped back to a
+ * directory — `/users/42/edit` stops at `/users`. Static paths, which is what a
+ * `not-found.vsk` is written for, resolve exactly.
+ */
+export function resolveBoundaryFileForUrl(pathname, appDir, file) {
+    const segments = pathname.split('/').filter(Boolean);
+    for (let depth = segments.length; depth >= 0; depth--) {
+        const dir = join(appDir, ...segments.slice(0, depth));
+        const p = join(dir, file);
         if (existsSync(p))
             return p;
     }
@@ -168,18 +199,30 @@ export function generateSsrFunction(routeNode, appDir, outDir, componentMap, opt
     const errorVars = errorPath
         ? `const _errorComp = ${JSON.stringify(errorComp)};\nconst _errorCompiled = ${hydrateInvoke(precompilePlan(errorPath))};\n`
         : 'const _errorComp = null;\nconst _errorCompiled = null;\n';
+    // Not-found used to have no server-side resolution at all: a NotFoundError was
+    // re-thrown out of the function and the prod server answered with the ROOT
+    // not-found.vsk. A nested `app/admin/not-found.vsk` therefore did nothing on a
+    // hard load, while the client router — which walks the matched chain
+    // deepest-first — honoured it on SPA navigation. Same URL, two different
+    // pages depending on how you arrived.
+    const notFoundPath = resolveNotFoundFile(routeNode.sourceDir, appDir);
+    const notFoundSrc = notFoundPath ? readFileSync(notFoundPath, 'utf-8') : null;
+    const notFoundComp = notFoundPath ? (extractCompName(notFoundSrc) || 'NotFound') : null;
+    const notFoundVars = notFoundPath
+        ? `const _notFoundComp = ${JSON.stringify(notFoundComp)};\nconst _notFoundCompiled = ${hydrateInvoke(precompilePlan(notFoundPath))};\n`
+        : 'const _notFoundComp = null;\nconst _notFoundCompiled = null;\n';
     let src = '';
     if (layoutDecls.length > 0) {
         src = `const _pageComp = ${JSON.stringify(pageComp)};\n`;
         src += `const _pageCompiled = (() => { try { return hydratePrecompile(${pagePlan}); } catch { return null; } })();\n`;
         src += `const _layoutCompList = [${layoutDecls.map((d) => d.comp).join(', ')}];\n`;
         src += `const _layoutCompiledList = [\n${layoutDecls.map((d) => '  ' + d.compiled + ',').join('\n')}\n];\n`;
-        src += errorVars;
+        src += errorVars + notFoundVars;
     }
     else {
         src = `const _comp = ${JSON.stringify(pageComp)};\n`;
         src += `const _compiled = (() => { try { return hydratePrecompile(${pagePlan}); } catch { return null; } })();\n`;
-        src += errorVars;
+        src += errorVars + notFoundVars;
     }
     const urlParts = routeNode.fullPath.split('/').filter(Boolean);
     const paramExprs = buildParamExtraction(routeNode, urlParts);
@@ -215,30 +258,66 @@ export function generateSsrFunction(routeNode, appDir, outDir, componentMap, opt
             '  }',
             '}',
             '',
+            // Returns null rather than throwing when there is no boundary, so the
+            // caller can re-throw the original NotFoundError and let the server answer
+            // — a page with no not-found.vsk anywhere must still get a 404.
+            'async function __renderNotFoundBody(props) {',
+            '  if (!_notFoundComp) return null;',
+            '  try {',
+            '    const result = await renderPage(\'\', _notFoundComp, props, __componentRegistry, { hydrate: true, cached: _notFoundCompiled });',
+            '    return result.body;',
+            '  } catch {',
+            '    return null;',
+            '  }',
+            '}',
+            '',
+            // The layout wrap, shared by the page / error / not-found paths. Extracted
+            // because three call sites that each re-implemented it is three chances to
+            // forget the head merge.
+            'async function __wrapLayouts(params, body, head) {',
+            '  let _b = body;',
+            '  let _h = head || "";',
+            '  for (let _i = _layoutCompList.length - 1; _i > 0; _i--) {',
+            "    const _inner = await renderPage('', _layoutCompList[_i], { params, children: _b }, __componentRegistry, { hydrate: true, cached: _layoutCompiledList[_i] });",
+            '    _b = _inner.body;',
+            '    if (_inner.head) _h = _inner.head + _h;',
+            '  }',
+            "  return renderFullPage('', _layoutCompList[0], { params, children: _b }, __componentRegistry, { hydrate: true, cached: _layoutCompiledList[0]" + bakedOptions + clientScriptOption + dataScriptOption + ", pageHead: _h });",
+            '}',
+            '',
             'async function __renderHtml(params, requestUrl) {',
             '  return withSsrStore(async () => {',
             '  resetPersistedStoreKeys();',
             '  let page;',
             '  let caughtError = null;',
+            '  let notFound = false;',
             "  const __expose = process.env.NODE_ENV !== 'production';",
             '  try {',
             '    page = await renderPage(\'\', _pageComp, { params }, __componentRegistry, { hydrate: true, cached: _pageCompiled });',
             '  } catch (err) {',
-            '    if (err && (err.name === \'NotFoundError\' || err.name === \'Redirect\')) throw err;',
-            '    caughtError = err;',
-            "    const message = err && typeof err === 'object' && 'message' in err ? String(err.message) : String(err);",
-            "    const stack = err && typeof err === 'object' && 'stack' in err ? String(err.stack) : '';",
-            "    page = { body: await __renderErrorBody({ params, statusCode: 500, error: __expose ? message : 'Internal Server Error', stack: __expose ? stack : '', url: requestUrl || '' }), head: '' };",
-            '  }',
-            '  let _body = (caughtError ? \'<!--vesk-ssr-error:\' + (caughtError && typeof caughtError === \'object\' && \'message\' in caughtError ? encodeURIComponent(__expose ? String(caughtError.message) : \'Internal Server Error\') : \'\') + \'-->\' : \'\') + page.body;',
-            '  let _head = page.head || \'\';',
-            '  for (let _i = _layoutCompList.length - 1; _i > 0; _i--) {',
-            "    const _inner = await renderPage('', _layoutCompList[_i], { params, children: _body }, __componentRegistry, { hydrate: true, cached: _layoutCompiledList[_i] });",
-            '    _body = _inner.body;',
-            '    if (_inner.head) _head = _inner.head + _head;',
+            "    if (err && err.name === 'Redirect') throw err;",
+            "    if (err && err.name === 'NotFoundError') {",
+            // The boundary is chosen per-route at build time (resolveNotFoundFile walks
+            // this route's own directory up to the app root), so a nested
+            // app/admin/not-found.vsk answers /admin/* and the root one answers the
+            // rest — matching the client router's deepest-first chain walk.
+            '      const nfBody = await __renderNotFoundBody({ params, url: requestUrl || \'\' });',
+            '      if (nfBody !== null) {',
+            '        notFound = true;',
+            '        page = { body: nfBody, head: \'\' };',
+            '      } else {',
+            '        throw err;',
+            '      }',
+            '    } else {',
+            '      caughtError = err;',
+            "      const message = err && typeof err === 'object' && 'message' in err ? String(err.message) : String(err);",
+            "      const stack = err && typeof err === 'object' && 'stack' in err ? String(err.stack) : '';",
+            "      page = { body: await __renderErrorBody({ params, statusCode: 500, error: __expose ? message : 'Internal Server Error', stack: __expose ? stack : '', url: requestUrl || '' }), head: '' };",
+            '    }',
             '  }',
-            "  const html = await renderFullPage('', _layoutCompList[0], { params, children: _body }, __componentRegistry, { hydrate: true, cached: _layoutCompiledList[0]" + bakedOptions + clientScriptOption + dataScriptOption + ", pageHead: _head });",
-            "  return new Response(__injectStoreInit(html), { headers: { 'Content-Type': 'text/html' }, status: caughtError ? 500 : 200 });",
+            "  let _body = (caughtError ? '<!--vesk-ssr-error:' + (caughtError && typeof caughtError === 'object' && 'message' in caughtError ? encodeURIComponent(__expose ? String(caughtError.message) : 'Internal Server Error') : '') + '-->' : '') + page.body;",
+            '  const html = await __wrapLayouts(params, _body, page.head || \'\');',
+            "  return new Response(__injectStoreInit(html), { headers: { 'Content-Type': 'text/html' }, status: notFound ? 404 : (caughtError ? 500 : 200) });",
             '  });',
             '}',
             '',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vesk/adapter",
-  "version": "0.2.68",
+  "version": "0.2.70",
   "type": "module",
   "description": "Vesk adapter — builds deployable .vesk/ output for Deno and Node serverless",
   "main": "./dist/index.js",
@@ -23,9 +23,9 @@
     "sharp": "^0.35.3"
   },
   "dependencies": {
-    "@vesk/compiler": "^0.2.68",
-    "@vesk/runtime": "^0.2.68",
-    "@vesk/types": "^0.2.68"
+    "@vesk/compiler": "^0.2.70",
+    "@vesk/runtime": "^0.2.70",
+    "@vesk/types": "^0.2.70"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1",