@vesk/vesk-cli 0.2.38 → 0.2.39

package/dist/cli.js

@@ -379,6 +379,14 @@ var init_ir = __esm({
     ComponentIR = class {
       name;
       paramNames;
+      /**
+       * The declared first parameter when it is a plain identifier
+       * (`component Card(p)`), i.e. the whole props object bound to another name.
+       * `null` for a destructuring pattern (`component Card({ title })`) or when
+       * there is no parameter. `paramNames` alone cannot express this: `p` and
+       * `{ p }` both flatten to `['p']` but need opposite bindings.
+       */
+      propsAlias;
       propsType;
       isClient;
       isAsync;
@@ -391,6 +399,7 @@ var init_ir = __esm({
       constructor(name, paramNames, body, opts = {}) {
         this.name = name;
         this.paramNames = paramNames;
+        this.propsAlias = opts.propsAlias ?? null;
         this.body = body;
         this.isClient = opts.isClient ?? false;
         this.isAsync = opts.isAsync ?? false;
@@ -1540,6 +1549,26 @@ function setActiveComponent(value) {
 function createContext(value) {
   return new Context(value);
 }
+function createLocals() {
+  const store = {};
+  return {
+    set(key, value) {
+      store[key] = value;
+    },
+    get(key) {
+      return store[key];
+    },
+    has(key) {
+      return Object.prototype.hasOwnProperty.call(store, key);
+    },
+    delete(key) {
+      delete store[key];
+    },
+    all() {
+      return { ...store };
+    }
+  };
+}
 var ctx, Context;
 var init_context = __esm({
   "../runtime/src/context.ts"() {
@@ -1547,9 +1576,17 @@ var init_context = __esm({
     ctx = { current: null };
     Context = class {
       _v;
+      /** Identity of this context instance — a Map key in the provider chain. */
+      id;
       constructor(value) {
         this._v = value;
+        this.id = Symbol("vesk-context");
       }
+      /**
+       * Reads the nearest value set by an ancestor component, else the default.
+       * Typed as `T`, so a context created with a type carries that type all the
+       * way to every reader.
+       */
       get() {
         let current2 = getActiveComponent();
         while (current2) {
@@ -1558,6 +1595,7 @@ var init_context = __esm({
         }
         return this._v;
       }
+      /** Sets the value for this component and its descendants. Typed as `T`. */
       set(value) {
         const component = getActiveComponent();
         if (component === null) throw new Error("No active component found, cannot set context");
@@ -1999,6 +2037,32 @@ function revalidate(handle2) {
   handle2.controller?.abort();
   startRequest(handle2, true);
 }
+function mutate(key, data2) {
+  if (isServer()) return;
+  const registry = getRegistry().get(key);
+  const prev = getInflight().get(key);
+  if (data2 !== void 0) {
+    getClientCache().set(key, { data: data2, fetchedAt: Date.now() });
+    if (prev) {
+      getInflight().delete(key);
+      if (registry) registry.forEach((h) => h.controller?.abort());
+    }
+    if (registry) {
+      registry.forEach((h) => {
+        if (h.into) setInto(h.into, data2);
+        set(h.state, { loading: false, error: null, data: data2 });
+      });
+    }
+    return;
+  }
+  if (registry && registry.size > 0) {
+    if (prev) {
+      getInflight().delete(key);
+      registry.forEach((h) => h.controller?.abort());
+    }
+    registry.forEach((h) => startRequest(h, true));
+  }
+}
 function createResourceAccessor(handle2) {
   const state = handle2.state;
   const accessor = {};
@@ -5342,11 +5406,18 @@ function createRouter(routes, options = {}) {
           if (decision === false) return;
           if (typeof decision === "string" && decision !== url.pathname && (self._guardDepth ?? 0) < 5) {
             self._guardDepth = (self._guardDepth ?? 0) + 1;
-            try {
-              self.navigate(decision, { replace: true });
-            } finally {
-              self._guardDepth = 0;
+            const hop = self.navigate(decision, { replace: true });
+            if (hop && typeof hop.then === "function") {
+              return hop.then(
+                () => {
+                  self._guardDepth = 0;
+                },
+                () => {
+                  self._guardDepth = 0;
+                }
+              );
             }
+            self._guardDepth = 0;
             return;
           }
           proceedNav();
@@ -5767,11 +5838,18 @@ function createFileRouter(routeTree, options = {}) {
           if (decision === false) return;
           if (typeof decision === "string" && decision !== url.pathname && (router._guardDepth || 0) < 5) {
             router._guardDepth = (router._guardDepth || 0) + 1;
-            try {
-              router.navigate(decision, { replace: true });
-            } finally {
-              router._guardDepth = 0;
+            const hop = router.navigate(decision, { replace: true });
+            if (hop && typeof hop.then === "function") {
+              return hop.then(
+                () => {
+                  router._guardDepth = 0;
+                },
+                () => {
+                  router._guardDepth = 0;
+                }
+              );
             }
+            router._guardDepth = 0;
             return;
           }
           afterGuards();
@@ -17629,9 +17707,24 @@ function blankComments(text) {
       continue;
     }
     if (ch === "/" && text[i + 1] === "*") {
-      let j = i;
-      while (j < n && !(text[j] === "*" && text[j + 1] === "/")) j++;
-      const end = Math.min(j + 2, n);
+      if (!lineStart) {
+        i += 2;
+        continue;
+      }
+      let j = i + 2;
+      let end = -1;
+      while (j < n) {
+        if (text[j] === "*" && text[j + 1] === "/") {
+          end = j + 2;
+          break;
+        }
+        j++;
+      }
+      if (end === -1) {
+        lineStart = false;
+        i += 2;
+        continue;
+      }
       for (let k = i; k < end; k++) if (text[k] !== "\n") chars[k] = " ";
       lineStart = false;
       i = end;
@@ -20628,6 +20721,8 @@ function generateIR(ast, source, filename) {
     }
     const name = inner.id.name;
     const paramNames = getParamNames(inner.params, source);
+    const firstParam = inner.params?.[0];
+    const propsAlias = firstParam && firstParam.type === "Identifier" ? firstParam.name : null;
     const propsType = getPropsType(inner.params, source);
     const bodyStmts = inner.body.body;
     const isClientComp = !!inner.client;
@@ -20637,7 +20732,7 @@ function generateIR(ast, source, filename) {
       const raw2 = processStatementModeBody(source, bodyStmts, file);
       const { body, css } = extractStyle(raw2);
       validateBlocks(name, isClientComp, body, file, source);
-      const comp = new ComponentIR(name, paramNames, body, { mode: "statement", exported, defaultExport, isClient: inner.client, isAsync: inner.async, ssrAwait: componentUsesFetch(body), propsType });
+      const comp = new ComponentIR(name, paramNames, body, { mode: "statement", exported, defaultExport, isClient: inner.client, isAsync: inner.async, ssrAwait: componentUsesFetch(body), propsType, propsAlias });
       comp.style = css;
       components.push(comp);
       __slotProps = prevSlotProps;
@@ -21634,11 +21729,14 @@ function tryParseImport(code) {
     return null;
   }
 }
-function buildParamInit(paramNames) {
+function buildParamInit(paramNames, propsAlias = null) {
+  if (propsAlias) {
+    return propsAlias === "props" ? "" : `const ${propsAlias} = props;`;
+  }
+  if (paramNames.length === 0) return "";
   if (paramNames.length === 1 && paramNames[0] === "props") {
     return "";
   }
-  if (paramNames.length === 0) return "";
   return `const { ${paramNames.join(", ")} } = props;`;
 }
 function resolveComponentName(source) {
@@ -22056,6 +22154,12 @@ function webhook(options) {
     });
   }
   async function webhookHandler(request) {
+    if (request.method !== "POST") {
+      return new Response(JSON.stringify({ error: "Method not allowed" }), {
+        status: 405,
+        headers: { "Content-Type": "application/json", Allow: "POST" }
+      });
+    }
     const signature = request.headers.get(headerName);
     if (!signature) {
       return new Response(JSON.stringify({ error: "Missing signature header" }), {
@@ -22224,7 +22328,7 @@ async function readSignedCookie2(name, cookieString, host) {
   if (impl.readSignedCookie) return impl.readSignedCookie(name, cookieString, host);
   throw new Error("readSignedCookie: @vesk/compiler not available");
 }
-var ServerRequest, ServerResponse, VeskRequest, _VeskResponse, VeskResponse, _signImpl;
+var ServerRequest, ServerResponse, DEFAULT_MAX_BODY_BYTES2, PayloadTooLargeError, VeskRequest, _VeskResponse, VeskResponse, _signImpl;
 var init_request = __esm({
   "../runtime/src/request.ts"() {
     "use strict";
@@ -22292,6 +22396,14 @@ var init_request = __esm({
         });
       }
     };
+    DEFAULT_MAX_BODY_BYTES2 = 1024 * 1024;
+    PayloadTooLargeError = class extends Error {
+      status = 413;
+      constructor(message = `Request body exceeds limit (${DEFAULT_MAX_BODY_BYTES2} bytes)`) {
+        super(message);
+        this.name = "PayloadTooLargeError";
+      }
+    };
     VeskRequest = class _VeskRequest extends ServerRequest {
       _query;
       _ip;
@@ -22500,14 +22612,35 @@ var init_request = __esm({
         this._flushSecurityHeaders();
         return this;
       }
+      /**
+       * Rejects a body that declares itself over the cap before any bytes are
+       * read. The dev server additionally caps the Node stream itself; this is
+       * the portable guard for platform/serverless builds, so a route that does
+       * `await req.json()` on an oversized payload fails with 413 instead of an
+       * opaque 500.
+       */
+      _assertBodyWithinLimit() {
+        const limit = DEFAULT_MAX_BODY_BYTES2;
+        const declared = Number(this.headers?.get("content-length") || "0");
+        if (Number.isFinite(declared) && declared > limit) {
+          throw new PayloadTooLargeError(`Request body exceeds limit (${limit} bytes)`);
+        }
+      }
       async text() {
         this._flushSecurityHeaders();
+        this._assertBodyWithinLimit();
         return super.text();
       }
       async json() {
         this._flushSecurityHeaders();
+        this._assertBodyWithinLimit();
         return super.json();
       }
+      async formData() {
+        this._flushSecurityHeaders();
+        this._assertBodyWithinLimit();
+        return super.formData();
+      }
       setCookie(name, value, opts = {}) {
         const parts = [`${name}=${encodeURIComponent(value)}`];
         if (opts.httpOnly !== false) parts.push("HttpOnly");
@@ -25697,11 +25830,13 @@ __export(index_server_exports, {
   ArticleSchema: () => ArticleSchema,
   BreadcrumbListSchema: () => BreadcrumbListSchema,
   Context: () => Context,
+  DEFAULT_MAX_BODY_BYTES: () => DEFAULT_MAX_BODY_BYTES2,
   Experiment: () => Experiment,
   FAQPageSchema: () => FAQPageSchema,
   Field: () => Field,
   For: () => For,
   Form: () => Form,
+  HttpError: () => HttpError,
   Image: () => Image,
   JsonLd: () => JsonLd,
   Link: () => Link,
@@ -25713,6 +25848,7 @@ __export(index_server_exports, {
   NotFoundError: () => NotFoundError,
   OrganizationSchema: () => OrganizationSchema,
   Outlet: () => Outlet,
+  PayloadTooLargeError: () => PayloadTooLargeError,
   Portal: () => Portal,
   ProductSchema: () => ProductSchema,
   Redirect: () => Redirect,
@@ -25720,6 +25856,7 @@ __export(index_server_exports, {
   ServerResponse: () => ServerResponse,
   Show: () => Show,
   Switch: () => Switch,
+  TimeoutError: () => TimeoutError,
   VeskRequest: () => VeskRequest,
   VeskResponse: () => VeskResponse,
   VideoSchema: () => VideoSchema,
@@ -25740,6 +25877,7 @@ __export(index_server_exports, {
   cors: () => cors,
   createContext: () => createContext,
   createFileRouter: () => createFileRouter,
+  createLocals: () => createLocals,
   createResource: () => createResource,
   createRouter: () => createRouter,
   create_component_ctx: () => create_component_ctx,
@@ -25771,6 +25909,7 @@ __export(index_server_exports, {
   locals: () => locals,
   maxLength: () => maxLength,
   minLength: () => minLength,
+  mutate: () => mutate,
   notFound: () => notFound,
   on_destroy: () => on_destroy,
   pageIsr: () => pageIsr,
@@ -29896,7 +30035,7 @@ function generateComponent(comp, importedNames = /* @__PURE__ */ new Set(), hydr
     ctx2.push(indent2(`const $root = document.createDocumentFragment();`));
   }
   ctx2.push(indent2(`let __pendingChild = null;`));
-  const paramInit = buildParamInit2(comp.paramNames);
+  const paramInit = buildParamInit2(comp.paramNames, comp.propsAlias);
   if (paramInit) ctx2.push(indent2(paramInit));
   for (const node of comp.body) {
     if (node instanceof TrackDecl) {
@@ -29945,7 +30084,8 @@ function generateComponent(comp, importedNames = /* @__PURE__ */ new Set(), hydr
   ctx2.push(`}`);
   return ctx2.getCode();
 }
-function buildParamInit2(paramNames) {
+function buildParamInit2(paramNames, propsAlias = null) {
+  if (propsAlias) return propsAlias === "props" ? "" : `const ${propsAlias} = props;`;
   if (paramNames.length === 1 && paramNames[0] === "props") return "";
   if (paramNames.length === 0) return "";
   return `const { ${paramNames.join(", ")} } = props;`;
@@ -30830,7 +30970,7 @@ function buildComponentEntries(irRoot) {
   const entries = [];
   for (const comp of irRoot.components) {
     const bodyCode = generateFunctionBody(comp, importedNames);
-    const paramInit = buildParamInit(comp.paramNames);
+    const paramInit = buildParamInit(comp.paramNames, comp.propsAlias);
     const diag = process.env.VESK_SSR_LOG ? `console.error('[SSR-CALL]', ${JSON.stringify(comp.name)}, props ? JSON.stringify(props) : String(props));
 ` : "";
     const code = `${scopeDecl}${paramInit}${diag}
@@ -36894,6 +37034,54 @@ function isTrackDeclStatement(stmt) {
     (d) => d && d.id && d.id.type === "ArrayPattern" && d.id.lazy === true && d.init
   );
 }
+function stripCallTypeArgs(text) {
+  let i = 0;
+  while (i < text.length && /\s/.test(text[i])) i++;
+  const nameStart = i;
+  while (i < text.length && /[A-Za-z0-9_$]/.test(text[i])) i++;
+  if (i === nameStart) return text;
+  while (i < text.length && (text[i] === "." || text[i] === "?" || text[i] === "[")) {
+    const ch = text[i];
+    if (ch === "[") {
+      const close = text.indexOf("]", i);
+      if (close === -1) return text;
+      i = close + 1;
+    } else {
+      i++;
+      while (i < text.length && /[A-Za-z0-9_$]/.test(text[i])) i++;
+    }
+  }
+  if (text[i] !== "<") return text;
+  let depth = 0;
+  let quote = "";
+  for (let j = i; j < text.length; j++) {
+    const c = text[j];
+    if (quote) {
+      if (c === "\\") {
+        j++;
+        continue;
+      }
+      if (c === quote) quote = "";
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      quote = c;
+      continue;
+    }
+    if (c === "<") depth++;
+    else if (c === ">") {
+      depth--;
+      if (depth === 0) {
+        const after = text.slice(j + 1);
+        if (/^\s*\(/.test(after)) return text.slice(0, i) + after;
+        return text;
+      }
+    } else if (c === ";" || c === "\n") {
+      return text;
+    }
+  }
+  return text;
+}
 function emitTrackDeclStatement(g2, source, stmt, indent4, isLast, opts) {
   const fullText = stripTrailingSemicolons(source.slice(stmt.start, stmt.end).trimEnd());
   const text = fullText + (!fullText.endsWith("}") && !isLast ? ";" : "");
@@ -36931,8 +37119,15 @@ function emitTrackDeclStatement(g2, source, stmt, indent4, isLast, opts) {
     if (opts.typedCells) {
       const cellName = g2.cellCount === 0 ? "__cell" : `__cell${g2.cellCount}`;
       g2.cellCount++;
-      g2.add(`const ${cellName} = `);
-      g2.add(initText, decl.init.start, decl.init.end);
+      if (annotation) {
+        g2.add(`const ${cellName}: Tracked<`);
+        g2.add(annotation, annStart, annEnd);
+        g2.add("> = ");
+      } else {
+        g2.add(`const ${cellName} = `);
+      }
+      const cellInit = annotation ? stripCallTypeArgs(initText) : initText;
+      g2.add(cellInit, decl.init.start, decl.init.end);
       g2.add(";");
       g2.add(" let ");
       g2.add(first, firstRange[0], firstRange[1], REACTIVE_DATA);
@@ -36954,16 +37149,18 @@ function emitTrackDeclStatement(g2, source, stmt, indent4, isLast, opts) {
         g2.add(": ");
         g2.add(annotation, annStart, annEnd);
         g2.add(" = (");
-        g2.add(initText, decl.init.start, decl.init.end);
+        g2.add(stripCallTypeArgs(initText), decl.init.start, decl.init.end);
         g2.add(" as unknown as ");
         g2.add(annotation, annStart, annEnd);
         g2.add(");");
       } else {
-        g2.add("let ");
-        g2.add(first, firstRange[0], firstRange[1], REACTIVE_DATA);
-        g2.add(": any = ");
+        const cellName = g2.cellCount === 0 ? "__cell" : `__cell${g2.cellCount}`;
+        g2.cellCount++;
+        g2.add(`const ${cellName} = `);
         g2.add(initText, decl.init.start, decl.init.end);
-        g2.add(";");
+        g2.add("; let ");
+        g2.add(first, firstRange[0], firstRange[1], REACTIVE_DATA);
+        g2.add(` = ${cellName}.get();`);
       }
       for (let n = 1; n < names.length; n++) {
         g2.add(" let ");
@@ -37225,10 +37422,18 @@ function emitIf(g2, source, stmt, indent4, opts) {
     emitBlock(g2, source, stmt.alternate, indent4, opts);
   }
 }
+function emitLoopVariable(g2, source, left) {
+  if (left && left.type === "Identifier") {
+    g2.addRaw("const ");
+    g2.add(source.slice(left.start, left.end), left.start, left.end);
+    return;
+  }
+  g2.add(source.slice(left.start, left.end), left.start, left.end);
+}
 function emitForOf(g2, source, stmt, indent4, opts) {
   g2.add(indent4);
   g2.addRaw("for (");
-  g2.add(source.slice(stmt.left.start, stmt.left.end), stmt.left.start, stmt.left.end);
+  emitLoopVariable(g2, source, stmt.left);
   g2.addRaw(" of ");
   g2.add(source.slice(stmt.right.start, stmt.right.end), stmt.right.start, stmt.right.end);
   g2.addRaw(") ");
@@ -37237,7 +37442,7 @@ function emitForOf(g2, source, stmt, indent4, opts) {
 function emitForIn(g2, source, stmt, indent4, opts) {
   g2.add(indent4);
   g2.addRaw("for (");
-  g2.add(source.slice(stmt.left.start, stmt.left.end), stmt.left.start, stmt.left.end);
+  emitLoopVariable(g2, source, stmt.left);
   g2.addRaw(" in ");
   g2.add(source.slice(stmt.right.start, stmt.right.end), stmt.right.start, stmt.right.end);
   g2.addRaw(") ");
@@ -37705,6 +37910,9 @@ function compileVskCodegen(source, opts = {}) {
     g2.prepend("declare const Head: (props: { children?: Component }) => Component;\n");
     code = g2.code;
   }
+  if (!isModuleAst(ast)) {
+    code += "\nexport {};\n";
+  }
   return { code, mappings: g2.mappings, styleRegions: g2.styleRegions, errors: [] };
 }
 function vskToTsx(source) {
@@ -37972,7 +38180,8 @@ function createTypecheckHost(projectRoot, appDir, vskFiles) {
     resolveModuleNameLiterals(moduleLiterals, containingFile, redirectedReference, options) {
       return moduleLiterals.map(({ text }) => {
         if (text.endsWith(".vsk")) {
-          const abs = normalize(join25(dirname27(containingFile), text));
+          const aliased = text.startsWith(".") ? null : resolveAliasModule(text, dirname27(containingFile));
+          const abs = normalize(aliased ?? join25(dirname27(containingFile), text));
           return {
             resolvedModule: {
               resolvedFileName: abs + ".d.ts",
@@ -38055,6 +38264,8 @@ function typecheckProject(projectRoot, opts = {}) {
     esModuleInterop: true,
     allowSyntheticDefaultImports: true,
     allowImportingTsExtensions: true,
+    // Required so the virtual `.vsk` files are actually pulled into the
+    // program (without it tsc silently excludes them and reports nothing).
     allowNonTsExtensions: true,
     resolveJsonModule: true,
     lib: ["lib.es2022.d.ts", "lib.dom.d.ts", "lib.dom.iterable.d.ts"],
@@ -38102,6 +38313,7 @@ var init_typecheck = __esm({
     "use strict";
     init_parser();
     init_vsk_tsx();
+    init_module_imports();
     SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".vesk", ".git", "dist", "tarballs", ".next"]);
     SKIP_FILES = /* @__PURE__ */ new Set(["__vesk_ambient.d.ts", "__vesk_runtime_override.d.ts"]);
     AMBIENT = `
@@ -38476,6 +38688,16 @@ declare namespace JSX {
 }
 declare type Component = string | number | boolean | null | undefined | Component[];
 declare const Head: (props: { children?: Component }) => Component;
+// Server-side .vsk code reads process.env (NODE_ENV, feature flags, secrets).
+// @types/node is not installed for browser targets, so declare the slice the
+// framework documents rather than failing every project that branches on env.
+declare const process: {
+  env: Record<string, string | undefined>;
+  argv: string[];
+  platform: string;
+  cwd(): string;
+  exit(code?: number): never;
+};
 interface Tracked<T> {
   get(): T;
   set(value: T): void;
@@ -38493,7 +38715,26 @@ declare function peek<T>(fn: () => T): T;
 declare function tick(): Promise<void>;
 declare function flushSync(fn: () => void): void;
 declare function on_destroy(fn: () => void): void;
-declare function createContext<T>(defaultValue?: T): { id: symbol; defaultValue: T | undefined };
+/**
+ * A context created by createContext. The value type flows from the default
+ * (or an explicit type argument) through set() and every get().
+ */
+interface VeskContext<T> {
+  readonly id: symbol;
+  get(): T;
+  set(value: T): void;
+}
+declare function createContext<const T>(defaultValue: T): VeskContext<T>;
+// Typed request-scoped store (middleware locals, event payloads). Declare the
+// shape once and every set/get is checked against it.
+interface VeskLocals<T extends object> {
+  set<K extends keyof T>(key: K, value: T[K]): void;
+  get<K extends keyof T>(key: K): T[K];
+  has<K extends keyof T>(key: K): boolean;
+  delete<K extends keyof T>(key: K): void;
+  all(): T;
+}
+declare function createLocals<T extends object = Record<string, unknown>>(): VeskLocals<T>;
 // useFetch returns a THENABLE resource, not the data itself. In async
 // components you must \`await\` it before reading/iterating the payload;
 // passing \`into: <tracked cell>\` writes the payload into the cell and makes
@@ -38612,6 +38853,8 @@ declare module '@vesk/runtime' {
   export function track<T>(initialValue: T): Tracked<T>;
   export function track<T>(fn: () => T): Derived<T>;
   export function derived<T>(fn: () => T): Derived<T>;
+  export function createContext<const T>(defaultValue: T): VeskContext<T>;
+  export function createLocals<T extends object = Record<string, unknown>>(): VeskLocals<T>;
 }
 `;
   }
@@ -38672,10 +38915,14 @@ SECURITY_PRESETS["default"] = { ...SECURITY_PRESETS["strict"] };
 function preset(name, overrides = {}) {
   const presets = {
     production: { ...SECURITY_PRESETS["strict"] },
+    // `strict` is the real name of the production preset; both resolve to it.
+    strict: { ...SECURITY_PRESETS["strict"] },
     development: {
       ...SECURITY_PRESETS["strict"],
       contentSecurityPolicy: false
-    }
+    },
+    // autoEscape only, SAMEORIGIN framing, no CSRF/HSTS/CSP.
+    minimal: { ...SECURITY_PRESETS["minimal"] }
   };
   if (!presets[name]) {
     throw VeskError.configError(`Unknown security preset: "${name}".`, Object.keys(presets));
@@ -38693,8 +38940,13 @@ function definePlugin(plugin) {
 }
 function defineConfig(config) {
   if (config.security === false || config.security === "off") {
-    config.security = {};
-  } else if (typeof config.security === "string") {
+    config.security = { autoEscape: true };
+    if (config.routeDataCache === void 0) config.routeDataCache = 0;
+    const mdOff = normalizeMdConfig(config.md);
+    if (mdOff !== void 0) config.md = mdOff;
+    return config;
+  }
+  if (typeof config.security === "string") {
     const p = SECURITY_PRESETS[config.security];
     if (!p) throw VeskError.configError(`Unknown security preset string: "${config.security}".`, Object.keys(SECURITY_PRESETS));
     config.security = { ...p };
@@ -38813,7 +39065,7 @@ init_parser();
 init_ir_generator();
 init_scan();
 init_tokens();
-var DEFAULT_MAX_BODY_BYTES2 = 1024 * 1024;
+var DEFAULT_MAX_BODY_BYTES3 = 1024 * 1024;
 function isAlnum2(code) {
   return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122;
 }
@@ -39298,6 +39550,8 @@ async function bundleRuntime(appDir, outDir) {
     "",
     "// Re-export runtime classes used by API routes",
     "export const VeskRequest = __veskRuntime.VeskRequest;",
+    "export const PayloadTooLargeError = __veskRuntime.PayloadTooLargeError;",
+    "export const DEFAULT_MAX_BODY_BYTES = __veskRuntime.DEFAULT_MAX_BODY_BYTES;",
     "export const VeskResponse = __veskRuntime.VeskResponse;",
     "",
     "// Server actions",
@@ -39307,6 +39561,39 @@ async function bundleRuntime(appDir, outDir) {
     "export const validateActionInput = __veskRuntime.validateActionInput;",
     "export const issuesToFieldMap = __veskRuntime.issuesToFieldMap;",
     "",
+    "// API-route surface. `@vesk/runtime/server` imports in app/api/**/route.ts",
+    "// are rewritten to this bundle, so anything a route is documented to",
+    "// import must be re-exported here \u2014 otherwise it resolves in dev (which",
+    "// imports the real barrel) and fails only in a production build.",
+    "export const redirect = __veskRuntime.redirect;",
+    "export const permanentRedirect = __veskRuntime.permanentRedirect;",
+    "export const notFound = __veskRuntime.notFound;",
+    "export const NotFoundError = __veskRuntime.NotFoundError;",
+    "export const useParams = __veskRuntime.useParams;",
+    "export const useBody = __veskRuntime.useBody;",
+    "export const useRequest = __veskRuntime.useRequest;",
+    "export const withValidation = __veskRuntime.withValidation;",
+    "export const cors = __veskRuntime.cors;",
+    "export const webhook = __veskRuntime.webhook;",
+    "export const signCookie = __veskRuntime.signCookie;",
+    "export const unsignCookie = __veskRuntime.unsignCookie;",
+    "export const setSignedCookie = __veskRuntime.setSignedCookie;",
+    "export const readSignedCookie = __veskRuntime.readSignedCookie;",
+    "export const HttpError = __veskRuntime.HttpError;",
+    "export const TimeoutError = __veskRuntime.TimeoutError;",
+    "export const mutate = __veskRuntime.mutate;",
+    "export const runHooks = __veskRuntime.runHooks;",
+    "",
+    "// ISR (server-only; revalidate*/clear* are no-ops outside a request).",
+    "export const isr = __veskRuntime.isr;",
+    "export const pageIsr = __veskRuntime.pageIsr;",
+    "export const componentIsr = __veskRuntime.componentIsr;",
+    "export const revalidatePath = __veskRuntime.revalidatePath;",
+    "export const revalidateTag = __veskRuntime.revalidateTag;",
+    "export const revalidateComponent = __veskRuntime.revalidateComponent;",
+    "export const clearIsrCache = __veskRuntime.clearIsrCache;",
+    "export const isrConfigToRevalidate = __veskRuntime.isrConfigToRevalidate;",
+    "",
     "// Server-wide context store (server events)",
     "export const serverLocals = __veskRuntime.serverLocals;",
     "export const getServerContext = __veskRuntime.getServerContext;",
@@ -39976,19 +40263,122 @@ function generateApiFunction(apiNode, _apiDir, outDir, options) {
   }
   const paramsCode = extracts.length > 0 ? `  const params = { ${extracts.join(", ")} };
 ` : "  const params = {};\n";
-  const handlerMethods = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"].filter((m) => routeSrc.includes(`async function ${m}(`) || routeSrc.includes(`async function ${m} (`) || routeSrc.includes(`export async function ${m}`)).map((m) => `${m}`).join(", ");
+  const sharedBody = [
+    "  const url = new URL(request.url);",
+    "  const urlParts = url.pathname.replace(/^\\/api\\/?/, '/').split('/').filter(Boolean);",
+    "  const method = request.method || 'GET';",
+    `${paramsCode}`,
+    "  Object.defineProperty(request, 'query', {",
+    "    get: () => Object.fromEntries(url.searchParams.entries()),",
+    "    enumerable: true,",
+    "  });",
+    "  const __rootLocals = (globalThis.__vesk_request && globalThis.__vesk_request.locals) || {};"
+  ];
+  const dispatchBody = [
+    "  try {",
+    "    const __mod = {",
+    ...["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"].map(
+      (m) => `      ${m}: typeof ${m} === 'function' ? ${m} : undefined,`
+    ),
+    "    };",
+    "    const __allowed = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'].filter((m) => __mod[m]);",
+    "    const handler = __mod[method];",
+    "    if (!handler) {",
+    "      if (method === 'OPTIONS') {",
+    "        return new Response(null, { status: 204, headers: { Allow: __allowed.join(', ') } });",
+    "      }",
+    "      return new Response(JSON.stringify({ error: `Method ${method} not allowed` }), {",
+    "        status: 405,",
+    "        headers: { 'Content-Type': 'application/json', Allow: __allowed.join(', ') },",
+    "      });",
+    "    }",
+    "    const __routeConfig = (typeof config !== 'undefined' && config) || {};",
+    "    // Default CSRF defense for mutating API calls: same-origin check unless",
+    "    // the route opts out via `config.csrf = false`.",
+    "    if (__routeConfig.csrf !== false && method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS') {",
+    "      try {",
+    "        assertSameOrigin({",
+    "          method,",
+    "          headers: Object.fromEntries([...request.headers.entries()].map(([k, v]) => [k, Array.isArray(v) ? v.join(', ') : v])),",
+    "        });",
+    "      } catch {",
+    "        return new Response(JSON.stringify({ error: 'Cross-origin request blocked' }), {",
+    "          status: 403, headers: { 'Content-Type': 'application/json' },",
+    "        });",
+    "      }",
+    "    }",
+    "    // Body cap. The handler receives the raw platform Request, so a route that",
+    "    // calls `req.json()` directly would bypass a VeskRequest-level guard \u2014",
+    "    // enforce it here, before any handler runs, on every target (dev, node,",
+    "    // serverless, edge).",
+    "    const __declared = Number(request.headers.get('content-length') || '0');",
+    "    if (Number.isFinite(__declared) && __declared > DEFAULT_MAX_BODY_BYTES) {",
+    "      return new Response(JSON.stringify({ error: `Request body exceeds limit (${DEFAULT_MAX_BODY_BYTES} bytes)` }), {",
+    "        status: 413, headers: { 'Content-Type': 'application/json' },",
+    "      });",
+    "    }",
+    "    let __signal = request.signal;",
+    "    let __timeout;",
+    "    if (__routeConfig.maxDuration) {",
+    "      const __controller = new AbortController();",
+    "      __timeout = setTimeout(",
+    "        () => __controller.abort(new Error(`Request timed out after ${__routeConfig.maxDuration}s`)),",
+    "        Number(__routeConfig.maxDuration) * 1000",
+    "      );",
+    "      __signal = __controller.signal;",
+    "      Object.defineProperty(request, 'signal', { value: __signal, writable: false });",
+    "    }",
+    "    // Route hooks may be a single function or an array of them.",
+    "    const __before = typeof beforeRequest === 'undefined' ? [] : (Array.isArray(beforeRequest) ? beforeRequest : [beforeRequest]);",
+    "    for (const __hook of __before) {",
+    "      const __hookResult = await __hook(request, { params: Promise.resolve(params), locals: ctx.locals });",
+    "      if (__hookResult instanceof Response) return __hookResult;",
+    "    }",
+    "    let __global = await runHooks('beforeRequest', request, { params, locals: ctx.locals });",
+    "    if (__global instanceof Response) return __global;",
+    "    let __response;",
+    "    try {",
+    "      __response = await handler(request, { params: Promise.resolve(params) });",
+    "    } catch (__e) {",
+    "      const __handled = await runHooks('onError', __e, request);",
+    "      if (__handled instanceof Response) return __handled;",
+    "      throw __e;",
+    "    } finally {",
+    "      if (__timeout) clearTimeout(__timeout);",
+    "    }",
+    "    const __after = typeof afterRequest === 'undefined' ? [] : (Array.isArray(afterRequest) ? afterRequest : [afterRequest]);",
+    "    for (const __hook of __after) {",
+    "      const __hookResult = await __hook(request, __response);",
+    "      if (__hookResult instanceof Response) __response = __hookResult;",
+    "    }",
+    "    __global = await runHooks('afterRequest', request, __response);",
+    "    if (__global instanceof Response) __response = __global;",
+    "    if (__response && typeof __response.build === 'function') __response.build();",
+    "    if (__response instanceof Response) return __response;",
+    "    return new Response(JSON.stringify(__response), {",
+    "      status: 200,",
+    "      headers: { 'Content-Type': 'application/json' },",
+    "    });",
+    "  } catch (e) {",
+    "    const err = /** @type {Error & Record<string, unknown>} */(e);",
+    "    if (err.name === 'Redirect') {",
+    "      return new Response(null, { status: Number(err.status) || 302, headers: { Location: String(err.url || '/') } });",
+    "    }",
+    "    if (err.name === 'NotFoundError') {",
+    "      return new Response(JSON.stringify({ error: 'Not Found' }), { status: 404, headers: { 'Content-Type': 'application/json' } });",
+    "    }",
+    "    if (err.name === 'PayloadTooLargeError') {",
+    "      return new Response(JSON.stringify({ error: 'Request body too large' }), { status: 413, headers: { 'Content-Type': 'application/json' } });",
+    "    }",
+    "    return new Response(JSON.stringify({ error: process.env.NODE_ENV === 'production' ? 'Internal Server Error' : err.message }), { status: 500, headers: { 'Content-Type': 'application/json' } });",
+    "  } finally {",
+    "    globalThis.__vesk_request = prev;",
+    "  }"
+  ];
   let handleBody;
   if (middlewareCode) {
     handleBody = [
-      "  const url = new URL(request.url);",
-      "  const urlParts = url.pathname.replace(/^\\/api\\/?/, '/').split('/').filter(Boolean);",
-      "  const method = request.method || 'GET';",
-      `${paramsCode}`,
-      "  Object.defineProperty(request, 'query', {",
-      "    get: () => Object.fromEntries(url.searchParams.entries()),",
-      "    enumerable: true,",
-      "  });",
-      "  const __rootLocals = (globalThis.__vesk_request && globalThis.__vesk_request.locals) || {};",
+      ...sharedBody,
       "  // \u2500\u2500 Middleware context \u2500\u2500",
       "  const __ctx = {",
       "    request,",
@@ -40015,47 +40405,11 @@ function generateApiFunction(apiNode, _apiDir, outDir, options) {
       "  });",
       "  const prev = globalThis.__vesk_request;",
       "  globalThis.__vesk_request = ctx;",
-      "  try {",
-      `    const handler = { ${handlerMethods} }[method];`,
-      "    if (!handler) {",
-      "      return new Response(JSON.stringify({ error: 'Method not allowed' }), {",
-      "        status: 405,",
-      "        headers: { 'Content-Type': 'application/json' },",
-      "      });",
-      "    }",
-      "    const response = await handler(request, { params: Promise.resolve(params) });",
-      "    if (response instanceof Response) {",
-      "      if (typeof response.build === 'function') response.build();",
-      "      return response;",
-      "    }",
-      "    return new Response(JSON.stringify(response), {",
-      "      status: 200,",
-      "      headers: { 'Content-Type': 'application/json' },",
-      "    });",
-      "  } catch (e) {",
-      "    const err = /** @type {Error & Record<string, unknown>} */(e);",
-      "    if (err.name === 'Redirect') {",
-      '      return new Response(null, { status: Number(err.status) || 302, headers: { Location: String(err.url || "") } });',
-      "    }",
-      "    if (err.name === 'NotFoundError') {",
-      "      return new Response(JSON.stringify({ error: 'Not Found' }), { status: 404, headers: { 'Content-Type': 'application/json' } });",
-      "    }",
-      "    return new Response(JSON.stringify({ error: err.message }), { status: 500, headers: { 'Content-Type': 'application/json' } });",
-      "  } finally {",
-      "    globalThis.__vesk_request = prev;",
-      "  }"
+      ...dispatchBody
     ].join("\n");
   } else {
     handleBody = [
-      "  const url = new URL(request.url);",
-      "  const urlParts = url.pathname.replace(/^\\/api\\/?/, '/').split('/').filter(Boolean);",
-      "  const method = request.method || 'GET';",
-      `${paramsCode}`,
-      "  Object.defineProperty(request, 'query', {",
-      "    get: () => Object.fromEntries(url.searchParams.entries()),",
-      "    enumerable: true,",
-      "  });",
-      "  const __rootLocals = (globalThis.__vesk_request && globalThis.__vesk_request.locals) || {};",
+      ...sharedBody,
       "  const ctx = {",
       "    headers: Object.fromEntries(request.headers.entries()),",
       "    url: request.url,",
@@ -40069,35 +40423,7 @@ function generateApiFunction(apiNode, _apiDir, outDir, options) {
       "  });",
       "  const prev = globalThis.__vesk_request;",
       "  globalThis.__vesk_request = ctx;",
-      "  try {",
-      `    const handler = { ${handlerMethods} }[method];`,
-      "    if (!handler) {",
-      "      return new Response(JSON.stringify({ error: 'Method not allowed' }), {",
-      "        status: 405,",
-      "        headers: { 'Content-Type': 'application/json' },",
-      "      });",
-      "    }",
-      "    const response = await handler(request, { params: Promise.resolve(params) });",
-      "    if (response instanceof Response) {",
-      "      if (typeof response.build === 'function') response.build();",
-      "      return response;",
-      "    }",
-      "    return new Response(JSON.stringify(response), {",
-      "      status: 200,",
-      "      headers: { 'Content-Type': 'application/json' },",
-      "    });",
-      "  } catch (e) {",
-      "    const err = /** @type {Error & Record<string, unknown>} */(e);",
-      "    if (err.name === 'Redirect') {",
-      '      return new Response(null, { status: Number(err.status) || 302, headers: { Location: String(err.url || "") } });',
-      "    }",
-      "    if (err.name === 'NotFoundError') {",
-      "      return new Response(JSON.stringify({ error: 'Not Found' }), { status: 404, headers: { 'Content-Type': 'application/json' } });",
-      "    }",
-      "    return new Response(JSON.stringify({ error: err.message }), { status: 500, headers: { 'Content-Type': 'application/json' } });",
-      "  } finally {",
-      "    globalThis.__vesk_request = prev;",
-      "  }"
+      ...dispatchBody
     ].join("\n");
   }
   const funcCode = [
@@ -40106,7 +40432,7 @@ function generateApiFunction(apiNode, _apiDir, outDir, options) {
     routeSrc.trim(),
     "",
     "// \u2500\u2500 Request handler wrapper \u2500\u2500",
-    "import { parseCookies } from '../runtime.js';",
+    "import { parseCookies, assertSameOrigin, runHooks, DEFAULT_MAX_BODY_BYTES } from '../runtime.js';",
     middlewareCode ? "import { parseCookies as __parseCookies } from '../runtime.js';" : "",
     "",
     middlewareCode || "",
@@ -44296,7 +44622,7 @@ function generateComponent2(comp, importedNames = /* @__PURE__ */ new Set(), hyd
     ctx2.push(indent3(`const $root = document.createDocumentFragment();`));
   }
   ctx2.push(indent3(`let __pendingChild = null;`));
-  const paramInit = buildParamInit3(comp.paramNames);
+  const paramInit = buildParamInit3(comp.paramNames, comp.propsAlias);
   if (paramInit)
     ctx2.push(indent3(paramInit));
   for (const node of comp.body) {
@@ -44345,7 +44671,9 @@ function generateComponent2(comp, importedNames = /* @__PURE__ */ new Set(), hyd
   ctx2.push(`}`);
   return ctx2.getCode();
 }
-function buildParamInit3(paramNames) {
+function buildParamInit3(paramNames, propsAlias = null) {
+  if (propsAlias)
+    return propsAlias === "props" ? "" : `const ${propsAlias} = props;`;
   if (paramNames.length === 1 && paramNames[0] === "props")
     return "";
   if (paramNames.length === 0)
@@ -45434,8 +45762,12 @@ async function executeApiRoute(filePath, method, request, params = {}, locals2 =
       signal = controller.signal;
       Object.defineProperty(request, "signal", { value: signal, writable: false });
     }
-    const beforeHooks = mod.beforeRequest || [];
-    for (const hook of beforeHooks) {
+    const toHookList = (v) => {
+      if (v == null)
+        return [];
+      return Array.isArray(v) ? v : [v];
+    };
+    for (const hook of toHookList(mod.beforeRequest)) {
       const hookResult = await hook(request, { params, locals: locals2 });
       if (hookResult instanceof Response)
         return hookResult;
@@ -45453,8 +45785,7 @@ async function executeApiRoute(filePath, method, request, params = {}, locals2 =
         return errorResult;
       throw e;
     }
-    const afterHooks = mod.afterRequest || [];
-    for (const hook of afterHooks) {
+    for (const hook of toHookList(mod.afterRequest)) {
       const hookResult = await hook(request, response);
       if (hookResult instanceof Response)
         response = hookResult;
@@ -52850,7 +53181,7 @@ async function handleActionRequest(req, res, ctx2) {
   let tooLarge = false;
   for await (const chunk of req) {
     bodyTotal += chunk.byteLength;
-    if (bodyTotal > (ctx2.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES2)) {
+    if (bodyTotal > (ctx2.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES3)) {
       tooLarge = true;
       break;
     }
@@ -52858,7 +53189,7 @@ async function handleActionRequest(req, res, ctx2) {
   }
   if (tooLarge) {
     res.writeHead(413, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ ok: false, error: `Request body exceeds limit (${ctx2.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES2} bytes)` }));
+    res.end(JSON.stringify({ ok: false, error: `Request body exceeds limit (${ctx2.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES3} bytes)` }));
     return true;
   }
   const bodyBuffer = Buffer.concat(chunks);
@@ -53324,8 +53655,8 @@ async function startDevServer(port, projectDir, config, host) {
   if (!process.env.NODE_ENV) process.env.NODE_ENV = "development";
   const secCfg = config.security || {};
   const maxBodyBytes = (typeof secCfg.maxBodyBytes === "number" ? secCfg.maxBodyBytes : void 0) || DEFAULT_MAX_BODY_BYTES;
-  const appDirPath = join24(projectDir, "app");
-  const publicDir = join24(projectDir, "public");
+  const appDirPath = resolve38(projectDir, typeof config.appDir === "string" ? config.appDir : "./app");
+  const publicDir = resolve38(projectDir, typeof config.publicDir === "string" ? config.publicDir : "./public");
   installMdReadHook2([publicDir]);
   try {
     ensurePackagesBuilt();
@@ -54706,11 +55037,13 @@ __export(index_server_exports2, {
   ArticleSchema: () => ArticleSchema,
   BreadcrumbListSchema: () => BreadcrumbListSchema,
   Context: () => Context,
+  DEFAULT_MAX_BODY_BYTES: () => DEFAULT_MAX_BODY_BYTES2,
   Experiment: () => Experiment,
   FAQPageSchema: () => FAQPageSchema,
   Field: () => Field,
   For: () => For,
   Form: () => Form,
+  HttpError: () => HttpError,
   Image: () => Image,
   JsonLd: () => JsonLd,
   Link: () => Link,
@@ -54722,6 +55055,7 @@ __export(index_server_exports2, {
   NotFoundError: () => NotFoundError,
   OrganizationSchema: () => OrganizationSchema,
   Outlet: () => Outlet,
+  PayloadTooLargeError: () => PayloadTooLargeError,
   Portal: () => Portal,
   ProductSchema: () => ProductSchema,
   Redirect: () => Redirect,
@@ -54729,6 +55063,7 @@ __export(index_server_exports2, {
   ServerResponse: () => ServerResponse,
   Show: () => Show,
   Switch: () => Switch,
+  TimeoutError: () => TimeoutError,
   VeskRequest: () => VeskRequest,
   VeskResponse: () => VeskResponse,
   VideoSchema: () => VideoSchema,
@@ -54749,6 +55084,7 @@ __export(index_server_exports2, {
   cors: () => cors,
   createContext: () => createContext,
   createFileRouter: () => createFileRouter,
+  createLocals: () => createLocals,
   createResource: () => createResource,
   createRouter: () => createRouter,
   create_component_ctx: () => create_component_ctx,
@@ -54780,6 +55116,7 @@ __export(index_server_exports2, {
   locals: () => locals,
   maxLength: () => maxLength,
   minLength: () => minLength,
+  mutate: () => mutate,
   notFound: () => notFound,
   on_destroy: () => on_destroy,
   pageIsr: () => pageIsr,
@@ -54936,12 +55273,20 @@ async function loadConfig(projectDir) {
   }
   return config;
 }
+function resolveProjectDirs(projectDir, config) {
+  const cfg = config || {};
+  return {
+    appDir: resolve40(projectDir, typeof cfg.appDir === "string" ? cfg.appDir : "./app"),
+    publicDir: resolve40(projectDir, typeof cfg.publicDir === "string" ? cfg.publicDir : "./public"),
+    outDir: resolve40(projectDir, typeof cfg.outDir === "string" ? cfg.outDir : ".vesk")
+  };
+}
 if (cmd === "build") {
   const projectDir = process.cwd();
-  const appDirPath = join26(projectDir, "app");
-  const publicDir = join26(projectDir, "public");
+  const rawConfig = await loadConfig(projectDir) || {};
+  const { appDir: appDirPath, publicDir, outDir } = resolveProjectDirs(projectDir, rawConfig);
   if (!existsSync43(appDirPath)) {
-    console.error(`vesk build: no app/ directory found in ${projectDir}`);
+    console.error(`vesk build: no app directory found in ${projectDir} (config appDir: ${rawConfig.appDir ?? "./app"})`);
     process.exit(1);
   }
   const restArgs = process.argv.slice(3);
@@ -54951,13 +55296,14 @@ if (cmd === "build") {
   const platform = platformIdx !== -1 ? restArgs[platformIdx + 1] : void 0;
   const targetIdx = restArgs.indexOf("--target");
   const target = targetIdx !== -1 && restArgs[targetIdx + 1] === "edge" ? "edge" : "node";
-  const config = await loadConfig(projectDir);
-  const plugins = config?.plugins || [];
-  const mdCfg = config?.md;
-  const opts = { publicDir, plugins, seo, strictSeo: strict, codeSplit: !restArgs.includes("--skip-split"), target };
+  const config = rawConfig;
+  const plugins = config.plugins || [];
+  const mdCfg = config.md;
+  const opts = { outDir, publicDir, plugins, seo, strictSeo: strict, codeSplit: !restArgs.includes("--skip-split"), target };
   if (mdCfg) opts.md = mdCfg;
   if (config.routeDataCache !== void 0) opts.routeDataCache = config.routeDataCache;
   if (platform) opts.platform = platform;
+  if (config.ssg !== void 0 && config.ssg !== false) opts.ssg = true;
   try {
     await build2(appDirPath, opts);
     const { drainMdHtmlWarnings: drainMdHtmlWarnings3 } = await Promise.resolve().then(() => (init_md2(), md_exports2));
@@ -55010,9 +55356,9 @@ ${code}`;
 }
 if (cmd === "seo") {
   const projectDir = process.cwd();
-  const appDirPath = join26(projectDir, "app");
+  const { appDir: appDirPath } = resolveProjectDirs(projectDir, await loadConfig(projectDir) || {});
   if (!existsSync43(appDirPath)) {
-    console.error(`vesk seo: no app/ directory found in ${projectDir}`);
+    console.error(`vesk seo: no app directory found in ${projectDir}`);
     process.exit(1);
   }
   const strict = args.includes("--strict");
@@ -55025,9 +55371,9 @@ if (cmd === "seo") {
 }
 if (cmd === "typecheck") {
   const projectDir = process.cwd();
-  const appDirPath = join26(projectDir, "app");
+  const { appDir: appDirPath } = resolveProjectDirs(projectDir, await loadConfig(projectDir) || {});
   if (!existsSync43(appDirPath)) {
-    console.error(`vesk typecheck: no app/ directory found in ${projectDir}`);
+    console.error(`vesk typecheck: no app directory found in ${projectDir}`);
     process.exit(1);
   }
   const { typecheckProject: typecheckProject2, formatTypecheckErrors: formatTypecheckErrors2, formatTypecheckWarnings: formatTypecheckWarnings2 } = await Promise.resolve().then(() => (init_typecheck(), typecheck_exports));
@@ -55050,16 +55396,20 @@ if (cmd === "typecheck") {
 }
 if (cmd === "start") {
   const projectDir = process.cwd();
-  const outDir = join26(projectDir, ".vesk");
+  const { outDir } = resolveProjectDirs(projectDir, await loadConfig(projectDir) || {});
   const port = parsePortArg(args);
   const host = parseHostArg(args);
+  if (!existsSync43(outDir)) {
+    console.error(`vesk start: no build found at ${outDir} \u2014 run "vesk build" first.`);
+    process.exit(1);
+  }
   startProdServer(outDir, { port, host });
   await new Promise(() => {
   });
 }
 if (cmd === "init") {
   const projectDir = process.cwd();
-  const appDirPath = join26(projectDir, "app");
+  const { appDir: appDirPath } = resolveProjectDirs(projectDir, await loadConfig(projectDir) || {});
   const target = join26(appDirPath, "global.css");
   if (existsSync43(target)) {
     console.error(`vesk init: ${target} already exists \u2014 skipping`);
@@ -55079,7 +55429,7 @@ if (cmd === "init") {
 }
 if (cmd === "dev") {
   const projectDir = process.cwd();
-  const appDirPath = join26(projectDir, "app");
+  const { appDir: appDirPath, publicDir } = resolveProjectDirs(projectDir, await loadConfig(projectDir) || {});
   const port = parsePortArg(args);
   const host = parseHostArg(args);
   if (!existsSync43(appDirPath)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vesk/vesk-cli",
-  "version": "0.2.38",
+  "version": "0.2.39",
   "type": "module",
   "description": "Vesk — compiler-first framework for the post-VDOM web. vesk dev, vesk build.",
   "bin": {
@@ -8,10 +8,10 @@
   },
   "main": "./dist/cli.js",
   "dependencies": {
-    "@vesk/adapter": "^0.2.38",
-    "@vesk/compiler": "^0.2.38",
-    "@vesk/plugin-tailwind": "^0.2.38",
-    "@vesk/runtime": "^0.2.38",
+    "@vesk/adapter": "^0.2.39",
+    "@vesk/compiler": "^0.2.39",
+    "@vesk/plugin-tailwind": "^0.2.39",
+    "@vesk/runtime": "^0.2.39",
     "esrap": "^2.3.0",
     "typescript": "^5.8.0",
     "ws": "^8.18.0",