@vesk/adapter 0.2.69 → 0.2.71

package/dist/dev-server.d.ts

@@ -19,9 +19,6 @@ export interface DevHmrState {
 }
 /** Default state when no HMR provider is available (no server). */
 export declare function defaultDevHmrState(): DevHmrState;
-export declare function bodyTooLarge(maxBytes: number): Error & {
-    status: number;
-};
 export interface DevPanelResponse {
     status: number;
     headers: Record<string, string>;

package/dist/dev-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../src/dev-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AASjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAM7C,OAAO,KAAK,EAAa,gBAAgB,EAAwB,MAAM,yBAAyB,CAAC;AAgBjG;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;IAC9C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxD,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB;+EAC2E;IAC3E,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,IAAI,WAAW,CAEhD;AAuCD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AAkBD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,mHAAmH;IACnH,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B;;8BAE0B;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,WAAW,CAAC;IAChC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG;IACvE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CAChH,CAUA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAa3C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIrD;AA8CD,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAorBvG"}
+{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../src/dev-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AASjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAO7C,OAAO,KAAK,EAAa,gBAAgB,EAAwB,MAAM,yBAAyB,CAAC;AAgBjG;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;IAC9C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxD,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB;+EAC2E;IAC3E,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,IAAI,WAAW,CAEhD;AAgDD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,mHAAmH;IACnH,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B;;8BAE0B;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,WAAW,CAAC;IAChC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG;IACvE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CAChH,CAUA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAa3C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIrD;AAUD,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAorBvG"}

package/dist/dev-server.js

@@ -14,6 +14,7 @@ import { resolveRuntimeErrorPayload, renderDevErrorPage } from './ssr-error';
 import { renderDefaultNotFoundPage, renderDefaultErrorPage } from '@vesk/adapter/src/default-pages';
 import { buildTreeShakenRuntime, runtimeExportNames } from '@vesk/adapter/src/client-bundle';
 import { resolveWithin, installMdReadHook } from '@vesk/adapter/src/paths';
+import { makeWebRequest, bodyTooLarge } from '@vesk/adapter/src/web-request';
 import { getPluginRecords } from './plugins';
 // @vesk/agentic — optional AI plugin; gated by active state if installed
 import { createAgentRouter } from '@vesk/agentic/src/dev-api';
@@ -58,11 +59,6 @@ async function deliverResponse(res, response) {
     }
     res.end(await response.text());
 }
-export function bodyTooLarge(maxBytes) {
-    const err = new Error(`Request body exceeds limit (${maxBytes} bytes)`);
-    err.status = 413;
-    return err;
-}
 function errorStatus(e, fallback) {
     const s = e?.status ?? e?.statusCode;
     return typeof s === 'number' && s >= 400 && s < 600 ? s : fallback;
@@ -149,49 +145,6 @@ export function injectDevScripts(html) {
     const scripts = '\t<script type="module" src="/_vesk/hmr.js"></script>\n' + devBootstrapScript() + '\n';
     return html.replace('</body>', scripts + '</body>');
 }
-function makeWebRequest(nodeReq, url, maxBodyBytes = DEFAULT_MAX_BODY_BYTES) {
-    const parsedUrl = new URL(url, `http://${nodeReq.headers.host || 'localhost'}`);
-    const method = nodeReq.method || 'GET';
-    let _bodyBuffer = null;
-    async function getBody() {
-        if (_bodyBuffer)
-            return _bodyBuffer;
-        const chunks = [];
-        let total = 0;
-        for await (const chunk of nodeReq) {
-            total += chunk.byteLength;
-            if (total > maxBodyBytes)
-                throw bodyTooLarge(maxBodyBytes);
-            chunks.push(Buffer.from(chunk));
-        }
-        _bodyBuffer = Buffer.concat(chunks);
-        return _bodyBuffer;
-    }
-    const webRequest = new Request(parsedUrl, { method, headers: nodeReq.headers, body: null });
-    webRequest.json = async () => { try {
-        return JSON.parse((await getBody()).toString());
-    }
-    catch {
-        return null;
-    } };
-    webRequest.text = async () => (await getBody()).toString('utf-8');
-    webRequest.formData = async () => {
-        const body = await getBody();
-        const ct = String(nodeReq.headers['content-type'] || '');
-        if (ct.includes('multipart/form-data')) {
-            const temp = new Request('http://localhost', { method: 'POST', headers: nodeReq.headers, body: body });
-            return temp.formData();
-        }
-        const fd = new FormData();
-        if (ct.includes('x-www-form-urlencoded')) {
-            for (const [k, v] of new URLSearchParams(body.toString()).entries())
-                fd.append(k, v);
-        }
-        return fd;
-    };
-    webRequest.clone = () => webRequest;
-    return webRequest;
-}
 const MIME = {
     '.svg': 'image/svg+xml', '.css': 'text/css', '.js': 'application/javascript',
     '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',

package/dist/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAqE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAiCpK,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,EAAE,EACnB,SAAS,EAAE,SAAS,EAAE,EACtB,SAAS,EAAE,YAAY,EAAE,EACzB,YAAY,EAAE,cAAc,EAAE,EAC9B,iBAAiB,EAAE,OAAO,EAC1B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,CAAC,EAAE,MAAM,EAClB,aAAa,UAAQ,GACpB,QAAQ,CAuEV"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAqE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAiCpK,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,EAAE,EACnB,SAAS,EAAE,SAAS,EAAE,EACtB,SAAS,EAAE,YAAY,EAAE,EACzB,YAAY,EAAE,cAAc,EAAE,EAC9B,iBAAiB,EAAE,OAAO,EAC1B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,CAAC,EAAE,MAAM,EAClB,aAAa,UAAQ,GACpB,QAAQ,CA8EV"}

package/dist/manifest.js

@@ -44,6 +44,13 @@ export function generateManifest(routes, ssrRoutes, apiRoutes, staticRoutes, mid
             entry.tags = r._isrTags;
         routeEntries.push(entry);
     }
+    // Same precedence rule as the API entries below, and for the same reason:
+    // every consumer takes the FIRST exact-length match, so directory-scan order
+    // decides. `app/docs/[slug]/page.vsk` scanned before `app/docs/boom/page.vsk`
+    // left `/docs/boom` permanently served by the dynamic route — a static page
+    // that 404s or, worse, renders the wrong page's content. The API half of this
+    // fix landed earlier; SSR entries had the identical defect.
+    routeEntries.sort((a, b) => compareSpecificity(a.path, b.path));
     const apiEntries = [];
     for (const r of apiRoutes) {
         const urlParts = r.fullPath.split('/').filter(Boolean);

package/dist/prod-server.d.ts

@@ -1,8 +1,5 @@
 import { type Server } from 'node:http';
 import type { CompressionConfig, ProdServerOptions } from '@vesk/adapter/src/types';
-export declare function bodyTooLarge(maxBytes: number): Error & {
-    status: number;
-};
 export declare function startProdServer(outDir: string, options?: ProdServerOptions & {
     compression?: CompressionConfig | false;
     healthCheck?: boolean;

package/dist/prod-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAajG,OAAO,KAAK,EAAkB,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAuFpG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AA0FD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG;IAAE,WAAW,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAqlBvK"}
+{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAejG,OAAO,KAAK,EAAkB,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAyHpG,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG;IAAE,WAAW,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAwoBvK"}

package/dist/prod-server.js

@@ -12,6 +12,8 @@ import { resolveCssUrls, hasBuiltGlobalCss } from '@vesk/adapter/src/css';
 import { loadVeskConfig } from '@vesk/adapter/src/load-config';
 import { renderDefaultNotFoundPage, renderDefaultErrorPage } from '@vesk/adapter/src/default-pages';
 import { installResponsePipeline } from '@vesk/adapter/src/response-pipeline';
+import { resolveBoundaryFileForUrl } from '@vesk/adapter/src/ssr-function';
+import { makeWebRequest, bodyTooLarge } from '@vesk/adapter/src/web-request';
 import { mimeFor } from '@vesk/adapter/src/platform-output';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 async function readBody(req, maxBytes = DEFAULT_MAX_BODY_BYTES) {
@@ -101,69 +103,10 @@ function pumpRemaining(res, reader) {
         res.end();
     })();
 }
-export function bodyTooLarge(maxBytes) {
-    const err = new Error(`Request body exceeds limit (${maxBytes} bytes)`);
-    err.status = 413;
-    return err;
-}
 function errorStatus(e, fallback) {
     const s = e?.status ?? e?.statusCode;
     return typeof s === 'number' && s >= 400 && s < 600 ? s : fallback;
 }
-function makeWebRequest(nodeReq, url, maxBodyBytes = DEFAULT_MAX_BODY_BYTES) {
-    const parsedUrl = new URL(url, `http://${nodeReq.headers.host || 'localhost'}`);
-    const method = nodeReq.method || 'GET';
-    let _bodyBuffer = null;
-    async function getBody() {
-        if (_bodyBuffer)
-            return _bodyBuffer;
-        const chunks = [];
-        let total = 0;
-        for await (const chunk of nodeReq) {
-            total += chunk.byteLength;
-            if (total > maxBodyBytes)
-                throw bodyTooLarge(maxBodyBytes);
-            chunks.push(Buffer.from(chunk));
-        }
-        _bodyBuffer = Buffer.concat(chunks);
-        return _bodyBuffer;
-    }
-    const webRequest = new Request(parsedUrl, { method, headers: nodeReq.headers, body: null });
-    webRequest.json = async () => { try {
-        return JSON.parse((await getBody()).toString());
-    }
-    catch {
-        return null;
-    } };
-    webRequest.text = async () => (await getBody()).toString('utf-8');
-    webRequest.formData = async () => {
-        const body = await getBody();
-        const ct = String(nodeReq.headers['content-type'] || '');
-        if (ct.includes('multipart/form-data')) {
-            const temp = new Request('http://localhost', { method: 'POST', headers: nodeReq.headers, body: body });
-            return temp.formData();
-        }
-        const fd = new FormData();
-        if (ct.includes('x-www-form-urlencoded')) {
-            for (const [k, v] of new URLSearchParams(body.toString()).entries())
-                fd.append(k, v);
-        }
-        return fd;
-    };
-    webRequest.clone = () => webRequest;
-    const cookies = {};
-    for (const [k, v] of String(nodeReq.headers.cookie || '').split(';').map(s => s.trim()).filter(Boolean)) {
-        const eq = k.indexOf('=');
-        if (eq > -1)
-            cookies[k.slice(0, eq)] = decodeURIComponent(k.slice(eq + 1));
-    }
-    webRequest.cookies = cookies;
-    const query = {};
-    for (const [k, v] of parsedUrl.searchParams.entries())
-        query[k] = v;
-    webRequest.query = query;
-    return webRequest;
-}
 export async function startProdServer(outDir, options) {
     const port = options?.port || 3000;
     const host = options?.host || '127.0.0.1';
@@ -252,9 +195,26 @@ export async function startProdServer(outDir, options) {
         }
     }
     const functionCache = new Map();
+    /** Import failures, kept so the same broken module is not re-imported per request. */
+    const functionFailures = new Map();
+    /**
+     * Load a generated function module.
+     *
+     * Returns null both for "no such file" and for "the file exists but could not
+     * be imported", and the caller cannot tell them apart — which turned a route
+     * with a bad import into a **404 with no diagnostic anywhere**. A missing
+     * export or an unresolvable dependency is a build bug, and the only evidence
+     * was an empty 404. `functionFailure` records what happened so the request
+     * path can answer 500 and log it, which is what a broken route is.
+     */
+    function functionFailure(funcPath) {
+        return functionFailures.get(funcPath);
+    }
     async function loadFunction(funcPath) {
         if (functionCache.has(funcPath))
             return functionCache.get(funcPath);
+        if (functionFailures.has(funcPath))
+            return null;
         const fullPath = resolve(outDir, funcPath);
         if (!existsSync(fullPath))
             return null;
@@ -263,7 +223,9 @@ export async function startProdServer(outDir, options) {
             functionCache.set(funcPath, mod);
             return mod;
         }
-        catch {
+        catch (e) {
+            console.error(`vesk start: failed to load ${funcPath}:`, e instanceof Error ? e.message : e);
+            functionFailures.set(funcPath, e);
             return null;
         }
     }
@@ -578,19 +540,27 @@ export async function startProdServer(outDir, options) {
                     const params = matchPath(route.path, url.pathname);
                     if (params) {
                         const mod = await loadFunction(route.function);
-                        if (mod) {
-                            try {
-                                const webRequest = makeWebRequest(req, url.href, maxBodyBytes);
-                                const response = await withSecurityScope(() => mod.handle(webRequest));
-                                await deliverResponse(res, response);
-                                return;
-                            }
-                            catch (e) {
-                                const status = errorStatus(e, 500);
-                                res.writeHead(status, { 'Content-Type': 'application/json' });
-                                res.end(JSON.stringify({ error: status === 500 ? 'Internal Server Error' : e instanceof Error ? e.message : String(e) }));
+                        if (!mod) {
+                            // The route matched, so a 404 would be a lie: the handler is
+                            // there and could not be loaded.
+                            if (functionFailure(route.function)) {
+                                res.writeHead(500, { 'Content-Type': 'application/json' });
+                                res.end(JSON.stringify({ error: 'Internal Server Error' }));
                                 return;
                             }
+                            continue;
+                        }
+                        try {
+                            const webRequest = makeWebRequest(req, url.href, maxBodyBytes);
+                            const response = await withSecurityScope(() => mod.handle(webRequest));
+                            await deliverResponse(res, response);
+                            return;
+                        }
+                        catch (e) {
+                            const status = errorStatus(e, 500);
+                            res.writeHead(status, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: status === 500 ? 'Internal Server Error' : e instanceof Error ? e.message : String(e) }));
+                            return;
                         }
                     }
                 }
@@ -600,17 +570,42 @@ export async function startProdServer(outDir, options) {
         const pageCssUrls = resolveCssUrls({
             enabled: hasBuiltGlobalCss(outDir),
         });
-        const nfPath = resolve(appDir, 'not-found.vsk');
-        let notFoundHtml = null;
-        if (existsSync(nfPath)) {
-            try {
-                const runtimePath = resolve(outDir, 'server', 'runtime.js');
-                const { renderFullPage, storeDataScriptGlobal } = await import(runtimePath);
-                const src = readFileSync(nfPath, 'utf-8');
-                const compName = resolveComponentName(src) || 'NotFound';
-                notFoundHtml = await renderFullPage(src, compName, { params: {}, url: url.pathname }, new Map(), { hydrate: true, cssUrls: pageCssUrls, security: securityConfig?.security || {}, externalDataScript: storeDataScriptGlobal, sourcePath: nfPath, headExtra: bakedHeadExtra });
+        /**
+         * Render the boundary that owns `url.pathname`.
+         *
+         * Deepest-match over the URL's directories, not a hard read of the root
+         * file: `app/admin/not-found.vsk` is the boundary for `/admin/*`, and the
+         * root one is the fallback. The generated SSR function does the same walk at
+         * build time (`resolveNotFoundFile`) and renders the boundary itself inside
+         * the layout stack; this path is what remains for an unmatched URL, for a
+         * route with no layout (which streams, so its status is already committed),
+         * and for an error thrown outside a page's own try block.
+         */
+        const boundaryCache = new Map();
+        async function renderBoundaryFile(file, pathname, props) {
+            const boundaryPath = resolveBoundaryFileForUrl(pathname, appDir, file);
+            if (!boundaryPath)
+                return null;
+            const key = `${file}:${boundaryPath}`;
+            let html = boundaryCache.has(key) ? boundaryCache.get(key) : null;
+            if (html === null) {
+                try {
+                    const runtimePath = resolve(outDir, 'server', 'runtime.js');
+                    const { renderFullPage, storeDataScriptGlobal } = await import(runtimePath);
+                    const src = readFileSync(boundaryPath, 'utf-8');
+                    const compName = resolveComponentName(src) || (file === 'error.vsk' ? 'Error' : 'NotFound');
+                    html = await renderFullPage(src, compName, props, new Map(), { hydrate: true, cssUrls: pageCssUrls, clientScriptUrl: buildConfig?.assets?.client?.url || '/_vesk/static/client.js', clientScriptIntegrity: buildConfig?.assets?.client?.integrity, security: securityConfig?.security || {}, externalDataScript: storeDataScriptGlobal, sourcePath: boundaryPath, headExtra: bakedHeadExtra });
+                }
+                catch {
+                    return null;
+                }
             }
-            catch { }
+            return html;
+        }
+        let notFoundHtml = null;
+        {
+            const rendered = await renderBoundaryFile('not-found.vsk', url.pathname, { params: {}, url: url.pathname });
+            notFoundHtml = rendered;
         }
         for (const route of buildConfig.routes) {
             if (route.type === 'ssr') {
@@ -686,20 +681,17 @@ export async function startProdServer(outDir, options) {
                             if (eventsMod) {
                                 await executeError(err, { url: url.href, routePath: route.path, target: 'node', status: 500 }, eventsMod);
                             }
-                            const errPath = resolve(appDir, 'error.vsk');
-                            let errorHtml = null;
-                            if (existsSync(errPath)) {
-                                try {
-                                    const runtimePath = resolve(outDir, 'server', 'runtime.js');
-                                    const { renderFullPage, storeDataScriptGlobal } = await import(runtimePath);
-                                    const src = readFileSync(errPath, 'utf-8');
-                                    const compName = resolveComponentName(src) || 'Error';
-                                    // never leak stack traces / internal messages to prod error pages
-                                    const expose = process.env.NODE_ENV !== 'production';
-                                    errorHtml = await renderFullPage(src, compName, { error: expose ? err.message : 'Internal Server Error', stack: expose ? err.stack : '', statusCode: 500, url: url.pathname }, new Map(), { hydrate: true, cssUrls: pageCssUrls, clientScriptUrl: buildConfig?.assets?.client?.url || '/_vesk/static/client.js', clientScriptIntegrity: buildConfig?.assets?.client?.integrity, security: securityConfig?.security || {}, externalDataScript: storeDataScriptGlobal, sourcePath: errPath, headExtra: bakedHeadExtra });
-                                }
-                                catch { }
-                            }
+                            // Same nearest-boundary walk as not-found above. This is the last resort for a
+                            // throw the generated function could not absorb — a layout render
+                            // failure, or the error boundary itself failing — and it must pick
+                            // the boundary that owns the URL, not the root one.
+                            const expose = process.env.NODE_ENV !== 'production';
+                            const errorHtml = await renderBoundaryFile('error.vsk', url.pathname, {
+                                error: expose ? err.message : 'Internal Server Error',
+                                stack: expose ? err.stack : '',
+                                statusCode: 500,
+                                url: url.pathname,
+                            });
                             res.writeHead(500, { 'Content-Type': 'text/html' });
                             res.end(errorHtml || renderDefaultErrorPage({ message: process.env.NODE_ENV !== 'production' ? err.message : undefined, url: url.pathname, headExtra: bakedHeadExtra }));
                             return;

package/dist/ssr-function.d.ts

@@ -1,5 +1,25 @@
 import type { RouteNode, SsrFunctionOptions } from '@vesk/adapter/src/types';
+/**
+ * The nearest `<file>` walking up from a route's own directory to the app root.
+ *
+ * This is the server-side twin of the client router's `findErrorComponent` /
+ * `findNotFoundComponent`, which walk the matched chain deepest-first. Same rule,
+ * same reason: an `error.vsk` (or `not-found.vsk`) inside `app/admin/` is the
+ * boundary for `/admin/*` and nothing else — the root file is the fallback, not
+ * the implementation.
+ */
+export declare function resolveBoundaryFile(sourceDir: string, appDir: string, file: string): string | null;
 export declare function resolveErrorFile(sourceDir: string, appDir: string): string | null;
+export declare function resolveNotFoundFile(sourceDir: string, appDir: string): string | null;
+/**
+ * The nearest `<file>` for a REQUESTED URL, used by the server when no SSR
+ * function ran (an unmatched path) or when one gave up.
+ *
+ * The walk is over URL segments, so a dynamic segment cannot be mapped back to a
+ * directory — `/users/42/edit` stops at `/users`. Static paths, which is what a
+ * `not-found.vsk` is written for, resolve exactly.
+ */
+export declare function resolveBoundaryFileForUrl(pathname: string, appDir: string, file: string): string | null;
 /** Shared persisted-store SSR helper block emitted into every generated SSR
  *  function (prod via ssr-function.ts, dev via hmr.ts — keep the two callers
  *  in sync by calling this). Emit it AFTER the function declarations so the

package/dist/ssr-function.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-function.d.ts","sourceRoot":"","sources":["../src/ssr-function.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAkB,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAI7F,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQjF;AAgED;;;2EAG2E;AAC3E,wBAAgB,qBAAqB,IAAI,MAAM,CA4C9C;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,kBAAkB,GAC3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA4btD"}
+{"version":3,"file":"ssr-function.d.ts","sourceRoot":"","sources":["../src/ssr-function.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAkB,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7F;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQlG;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEjF;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEpF;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQvG;AAgED;;;2EAG2E;AAC3E,wBAAgB,qBAAqB,IAAI,MAAM,CA4C9C;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,kBAAkB,GAC3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA6etD"}

package/dist/ssr-function.js

@@ -3,13 +3,44 @@ import { resolve, relative, join } from 'node:path';
 import { resolveComponentName, precompileFile } from '@vesk/compiler/src/server-codegen';
 import { resolveCssUrls, hasBuiltGlobalCss } from '@vesk/adapter/src/css';
 import { renderDefaultErrorFragment } from '@vesk/adapter/src/default-pages';
-// Finds the nearest error.vsk walking up from the route's own directory to the
-// app root, mirroring the router's findErrorComponent chain semantics.
-export function resolveErrorFile(sourceDir, appDir) {
+/**
+ * The nearest `<file>` walking up from a route's own directory to the app root.
+ *
+ * This is the server-side twin of the client router's `findErrorComponent` /
+ * `findNotFoundComponent`, which walk the matched chain deepest-first. Same rule,
+ * same reason: an `error.vsk` (or `not-found.vsk`) inside `app/admin/` is the
+ * boundary for `/admin/*` and nothing else — the root file is the fallback, not
+ * the implementation.
+ */
+export function resolveBoundaryFile(sourceDir, appDir, file) {
     const rel = relative(appDir, sourceDir).split('/').filter(Boolean);
     for (let depth = rel.length; depth >= 0; depth--) {
         const dir = depth === 0 ? appDir : join(appDir, ...rel.slice(0, depth));
-        const p = join(dir, 'error.vsk');
+        const p = join(dir, file);
+        if (existsSync(p))
+            return p;
+    }
+    return null;
+}
+export function resolveErrorFile(sourceDir, appDir) {
+    return resolveBoundaryFile(sourceDir, appDir, 'error.vsk');
+}
+export function resolveNotFoundFile(sourceDir, appDir) {
+    return resolveBoundaryFile(sourceDir, appDir, 'not-found.vsk');
+}
+/**
+ * The nearest `<file>` for a REQUESTED URL, used by the server when no SSR
+ * function ran (an unmatched path) or when one gave up.
+ *
+ * The walk is over URL segments, so a dynamic segment cannot be mapped back to a
+ * directory — `/users/42/edit` stops at `/users`. Static paths, which is what a
+ * `not-found.vsk` is written for, resolve exactly.
+ */
+export function resolveBoundaryFileForUrl(pathname, appDir, file) {
+    const segments = pathname.split('/').filter(Boolean);
+    for (let depth = segments.length; depth >= 0; depth--) {
+        const dir = join(appDir, ...segments.slice(0, depth));
+        const p = join(dir, file);
         if (existsSync(p))
             return p;
     }
@@ -168,18 +199,30 @@ export function generateSsrFunction(routeNode, appDir, outDir, componentMap, opt
     const errorVars = errorPath
         ? `const _errorComp = ${JSON.stringify(errorComp)};\nconst _errorCompiled = ${hydrateInvoke(precompilePlan(errorPath))};\n`
         : 'const _errorComp = null;\nconst _errorCompiled = null;\n';
+    // Not-found used to have no server-side resolution at all: a NotFoundError was
+    // re-thrown out of the function and the prod server answered with the ROOT
+    // not-found.vsk. A nested `app/admin/not-found.vsk` therefore did nothing on a
+    // hard load, while the client router — which walks the matched chain
+    // deepest-first — honoured it on SPA navigation. Same URL, two different
+    // pages depending on how you arrived.
+    const notFoundPath = resolveNotFoundFile(routeNode.sourceDir, appDir);
+    const notFoundSrc = notFoundPath ? readFileSync(notFoundPath, 'utf-8') : null;
+    const notFoundComp = notFoundPath ? (extractCompName(notFoundSrc) || 'NotFound') : null;
+    const notFoundVars = notFoundPath
+        ? `const _notFoundComp = ${JSON.stringify(notFoundComp)};\nconst _notFoundCompiled = ${hydrateInvoke(precompilePlan(notFoundPath))};\n`
+        : 'const _notFoundComp = null;\nconst _notFoundCompiled = null;\n';
     let src = '';
     if (layoutDecls.length > 0) {
         src = `const _pageComp = ${JSON.stringify(pageComp)};\n`;
         src += `const _pageCompiled = (() => { try { return hydratePrecompile(${pagePlan}); } catch { return null; } })();\n`;
         src += `const _layoutCompList = [${layoutDecls.map((d) => d.comp).join(', ')}];\n`;
         src += `const _layoutCompiledList = [\n${layoutDecls.map((d) => '  ' + d.compiled + ',').join('\n')}\n];\n`;
-        src += errorVars;
+        src += errorVars + notFoundVars;
     }
     else {
         src = `const _comp = ${JSON.stringify(pageComp)};\n`;
         src += `const _compiled = (() => { try { return hydratePrecompile(${pagePlan}); } catch { return null; } })();\n`;
-        src += errorVars;
+        src += errorVars + notFoundVars;
     }
     const urlParts = routeNode.fullPath.split('/').filter(Boolean);
     const paramExprs = buildParamExtraction(routeNode, urlParts);
@@ -215,30 +258,66 @@ export function generateSsrFunction(routeNode, appDir, outDir, componentMap, opt
             '  }',
             '}',
             '',
+            // Returns null rather than throwing when there is no boundary, so the
+            // caller can re-throw the original NotFoundError and let the server answer
+            // — a page with no not-found.vsk anywhere must still get a 404.
+            'async function __renderNotFoundBody(props) {',
+            '  if (!_notFoundComp) return null;',
+            '  try {',
+            '    const result = await renderPage(\'\', _notFoundComp, props, __componentRegistry, { hydrate: true, cached: _notFoundCompiled });',
+            '    return result.body;',
+            '  } catch {',
+            '    return null;',
+            '  }',
+            '}',
+            '',
+            // The layout wrap, shared by the page / error / not-found paths. Extracted
+            // because three call sites that each re-implemented it is three chances to
+            // forget the head merge.
+            'async function __wrapLayouts(params, body, head) {',
+            '  let _b = body;',
+            '  let _h = head || "";',
+            '  for (let _i = _layoutCompList.length - 1; _i > 0; _i--) {',
+            "    const _inner = await renderPage('', _layoutCompList[_i], { params, children: _b }, __componentRegistry, { hydrate: true, cached: _layoutCompiledList[_i] });",
+            '    _b = _inner.body;',
+            '    if (_inner.head) _h = _inner.head + _h;',
+            '  }',
+            "  return renderFullPage('', _layoutCompList[0], { params, children: _b }, __componentRegistry, { hydrate: true, cached: _layoutCompiledList[0]" + bakedOptions + clientScriptOption + dataScriptOption + ", pageHead: _h });",
+            '}',
+            '',
             'async function __renderHtml(params, requestUrl) {',
             '  return withSsrStore(async () => {',
             '  resetPersistedStoreKeys();',
             '  let page;',
             '  let caughtError = null;',
+            '  let notFound = false;',
             "  const __expose = process.env.NODE_ENV !== 'production';",
             '  try {',
             '    page = await renderPage(\'\', _pageComp, { params }, __componentRegistry, { hydrate: true, cached: _pageCompiled });',
             '  } catch (err) {',
-            '    if (err && (err.name === \'NotFoundError\' || err.name === \'Redirect\')) throw err;',
-            '    caughtError = err;',
-            "    const message = err && typeof err === 'object' && 'message' in err ? String(err.message) : String(err);",
-            "    const stack = err && typeof err === 'object' && 'stack' in err ? String(err.stack) : '';",
-            "    page = { body: await __renderErrorBody({ params, statusCode: 500, error: __expose ? message : 'Internal Server Error', stack: __expose ? stack : '', url: requestUrl || '' }), head: '' };",
-            '  }',
-            '  let _body = (caughtError ? \'<!--vesk-ssr-error:\' + (caughtError && typeof caughtError === \'object\' && \'message\' in caughtError ? encodeURIComponent(__expose ? String(caughtError.message) : \'Internal Server Error\') : \'\') + \'-->\' : \'\') + page.body;',
-            '  let _head = page.head || \'\';',
-            '  for (let _i = _layoutCompList.length - 1; _i > 0; _i--) {',
-            "    const _inner = await renderPage('', _layoutCompList[_i], { params, children: _body }, __componentRegistry, { hydrate: true, cached: _layoutCompiledList[_i] });",
-            '    _body = _inner.body;',
-            '    if (_inner.head) _head = _inner.head + _head;',
+            "    if (err && err.name === 'Redirect') throw err;",
+            "    if (err && err.name === 'NotFoundError') {",
+            // The boundary is chosen per-route at build time (resolveNotFoundFile walks
+            // this route's own directory up to the app root), so a nested
+            // app/admin/not-found.vsk answers /admin/* and the root one answers the
+            // rest — matching the client router's deepest-first chain walk.
+            '      const nfBody = await __renderNotFoundBody({ params, url: requestUrl || \'\' });',
+            '      if (nfBody !== null) {',
+            '        notFound = true;',
+            '        page = { body: nfBody, head: \'\' };',
+            '      } else {',
+            '        throw err;',
+            '      }',
+            '    } else {',
+            '      caughtError = err;',
+            "      const message = err && typeof err === 'object' && 'message' in err ? String(err.message) : String(err);",
+            "      const stack = err && typeof err === 'object' && 'stack' in err ? String(err.stack) : '';",
+            "      page = { body: await __renderErrorBody({ params, statusCode: 500, error: __expose ? message : 'Internal Server Error', stack: __expose ? stack : '', url: requestUrl || '' }), head: '' };",
+            '    }',
             '  }',
-            "  const html = await renderFullPage('', _layoutCompList[0], { params, children: _body }, __componentRegistry, { hydrate: true, cached: _layoutCompiledList[0]" + bakedOptions + clientScriptOption + dataScriptOption + ", pageHead: _head });",
-            "  return new Response(__injectStoreInit(html), { headers: { 'Content-Type': 'text/html' }, status: caughtError ? 500 : 200 });",
+            "  let _body = (caughtError ? '<!--vesk-ssr-error:' + (caughtError && typeof caughtError === 'object' && 'message' in caughtError ? encodeURIComponent(__expose ? String(caughtError.message) : 'Internal Server Error') : '') + '-->' : '') + page.body;",
+            '  const html = await __wrapLayouts(params, _body, page.head || \'\');',
+            "  return new Response(__injectStoreInit(html), { headers: { 'Content-Type': 'text/html' }, status: notFound ? 404 : (caughtError ? 500 : 200) });",
             '  });',
             '}',
             '',

package/dist/web-request.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The `Request` handed to API routes and server actions.
+ *
+ * One implementation, used by both the dev and production servers. They each
+ * carried an identical copy until this existed, which is how the same defect sat
+ * in both: the shim built its `Request` with `body: null` and supplied only
+ * whole-body readers (`text()`, `json()`, `formData()`). Anything reading
+ * `request.body` — which is every streaming parser, including
+ * `@vesk/plugin-multipart` — saw no body at all and failed with `NO_BODY`.
+ * That is the difference between an upload handler that works and one that
+ * 400s on every request, so the body is now a real stream.
+ *
+ * The stream is created LAZILY, on first access to `request.body`. Attaching
+ * `data` listeners eagerly would start draining every GET body in the process,
+ * and a GET that never asked for its body would still be read.
+ *
+ * Reading is single-pass by definition, so both access patterns have to work on
+ * one socket: every byte that flows through the stream is cached, and
+ * `text()`/`json()`/`formData()` serve from that cache if the stream has already
+ * been taken. A handler that reads `request.body` and then calls
+ * `request.text()` gets the body once, not a hang.
+ */
+import type { IncomingMessage } from 'node:http';
+export interface ExtendedRequest extends Request {
+    json(): Promise<unknown>;
+    text(): Promise<string>;
+    formData(): Promise<FormData>;
+    clone(): ExtendedRequest;
+    cookies: Record<string, string>;
+    query: Record<string, string>;
+}
+export declare function bodyTooLarge(maxBytes: number): Error & {
+    status: number;
+};
+export declare function makeWebRequest(nodeReq: IncomingMessage, url: string, maxBodyBytes?: number): ExtendedRequest;
+//# sourceMappingURL=web-request.d.ts.map

package/dist/web-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-request.d.ts","sourceRoot":"","sources":["../src/web-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAIjD,MAAM,WAAW,eAAgB,SAAQ,OAAO;IAC9C,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,KAAK,IAAI,eAAe,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,MAAM,EACX,YAAY,GAAE,MAA+B,GAC5C,eAAe,CAwIjB"}

package/dist/web-request.js

@@ -0,0 +1,165 @@
+import { Buffer } from 'node:buffer';
+import { DEFAULT_MAX_BODY_BYTES } from '@vesk/compiler/src/server-codegen';
+export function bodyTooLarge(maxBytes) {
+    const err = new Error(`Request body exceeds limit (${maxBytes} bytes)`);
+    err.status = 413;
+    return err;
+}
+export function makeWebRequest(nodeReq, url, maxBodyBytes = DEFAULT_MAX_BODY_BYTES) {
+    const parsedUrl = new URL(url, `http://${nodeReq.headers.host || 'localhost'}`);
+    const method = nodeReq.method || 'GET';
+    let cachedBody = null;
+    let streamTaken = false;
+    let streamEnded = false;
+    const endWaiters = [];
+    const settleEnd = (body) => {
+        if (body !== null)
+            cachedBody = body;
+        streamEnded = true;
+        for (const resolve of endWaiters.splice(0))
+            resolve();
+    };
+    function createBodyStream() {
+        streamTaken = true;
+        const cache = [];
+        let total = 0;
+        return new ReadableStream({
+            start(controller) {
+                nodeReq.on('data', (chunk) => {
+                    total += chunk.length;
+                    if (total > maxBodyBytes) {
+                        // Same cap the buffered readers enforce, checked as the bytes arrive
+                        // so an oversized upload is refused mid-body rather than after the
+                        // last byte has been read and held in memory.
+                        settleEnd(Buffer.concat(cache));
+                        cache.length = 0;
+                        try {
+                            controller.error(bodyTooLarge(maxBodyBytes));
+                        }
+                        catch { /* already settled */ }
+                        nodeReq.destroy();
+                        return;
+                    }
+                    cache.push(chunk);
+                    try {
+                        controller.enqueue(new Uint8Array(chunk));
+                    }
+                    catch { /* consumer cancelled */ }
+                });
+                nodeReq.on('end', () => {
+                    settleEnd(Buffer.concat(cache));
+                    cache.length = 0;
+                    try {
+                        controller.close();
+                    }
+                    catch { /* errored */ }
+                });
+                nodeReq.on('error', (e) => {
+                    settleEnd(Buffer.concat(cache));
+                    cache.length = 0;
+                    try {
+                        controller.error(e);
+                    }
+                    catch { /* already settled */ }
+                });
+            },
+        });
+    }
+    async function getBody() {
+        if (cachedBody)
+            return cachedBody;
+        if (streamTaken) {
+            // The stream is the reader now. Everything it has seen is in the cache,
+            // and it settles on 'end' — so wait rather than racing an empty read.
+            while (!streamEnded)
+                await new Promise(r => endWaiters.push(r));
+            return cachedBody || Buffer.alloc(0);
+        }
+        const chunks = [];
+        let total = 0;
+        for await (const chunk of nodeReq) {
+            total += chunk.byteLength;
+            if (total > maxBodyBytes)
+                throw bodyTooLarge(maxBodyBytes);
+            chunks.push(Buffer.from(chunk));
+        }
+        cachedBody = Buffer.concat(chunks);
+        return cachedBody;
+    }
+    const webRequest = new Request(parsedUrl, {
+        method,
+        headers: nodeReq.headers,
+        body: null,
+    });
+    // Shadow the prototype's `body` getter with a lazily-created stream over the
+    // Node request. An own accessor on the instance wins over the prototype one,
+    // which is the only reason this works without a Node-specific Request class.
+    let bodyStream = null;
+    Object.defineProperty(webRequest, 'body', {
+        configurable: true,
+        enumerable: false,
+        get: () => {
+            if (bodyStream)
+                return bodyStream;
+            // `new Request(..., { body: null })` reports null for GET/HEAD, which is
+            // correct; only a request that can carry a body needs a stream.
+            if (method === 'GET' || method === 'HEAD')
+                return null;
+            bodyStream = createBodyStream();
+            return bodyStream;
+        },
+    });
+    webRequest.json = async () => { try {
+        return JSON.parse((await getBody()).toString());
+    }
+    catch {
+        return null;
+    } };
+    webRequest.text = async () => (await getBody()).toString('utf-8');
+    webRequest.formData = async () => {
+        const body = await getBody();
+        const ct = String(nodeReq.headers['content-type'] || '');
+        if (ct.includes('multipart/form-data')) {
+            const temp = new Request('http://localhost', { method: 'POST', headers: nodeReq.headers, body: body });
+            return temp.formData();
+        }
+        const fd = new FormData();
+        if (ct.includes('x-www-form-urlencoded')) {
+            for (const [k, v] of new URLSearchParams(body.toString()).entries())
+                fd.append(k, v);
+        }
+        return fd;
+    };
+    webRequest.clone = () => webRequest;
+    const cookies = {};
+    // Iterate the pieces, do NOT destructure them. `cookie.split(';')` yields an
+    // array of STRINGS, and a string is iterable, so `for (const [k, v] of …)`
+    // bound `k` to the first CHARACTER of the pair ('s' of "session=…"),
+    // `indexOf('=')` was always -1, and the loop never populated anything.
+    // `request.cookies` has therefore been `{}` in every production request that
+    // ever read it. The `[k, v]` form is right for `searchParams.entries()`,
+    // which really does yield pairs — which is why the bug survived next to
+    // working code.
+    for (const part of String(nodeReq.headers.cookie || '').split(';')) {
+        const eq = part.indexOf('=');
+        if (eq === -1)
+            continue;
+        const name = part.slice(0, eq).trim();
+        if (!name)
+            continue;
+        const raw = part.slice(eq + 1).trim();
+        try {
+            cookies[name] = decodeURIComponent(raw);
+        }
+        catch {
+            // A malformed percent-escape must not lose the whole cookie jar.
+            cookies[name] = raw;
+        }
+    }
+    webRequest.cookies = cookies;
+    const query = {};
+    for (const [k, v] of parsedUrl.searchParams.entries())
+        query[k] = v;
+    webRequest.query = query;
+    return webRequest;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vesk/adapter",
-  "version": "0.2.69",
+  "version": "0.2.71",
   "type": "module",
   "description": "Vesk adapter — builds deployable .vesk/ output for Deno and Node serverless",
   "main": "./dist/index.js",
@@ -23,9 +23,9 @@
     "sharp": "^0.35.3"
   },
   "dependencies": {
-    "@vesk/compiler": "^0.2.69",
-    "@vesk/runtime": "^0.2.69",
-    "@vesk/types": "^0.2.69"
+    "@vesk/compiler": "^0.2.71",
+    "@vesk/runtime": "^0.2.71",
+    "@vesk/types": "^0.2.71"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1",