@voltro/cli 0.39.1 → 0.41.0

package/dist/{webDev-CTpSY-e_.js → webDev-Dk8lFUzf.js}

@@ -4,37 +4,37 @@ import { t as n } from "./bootRefusal-pgvDxlrU.js";
 import { r } from "./appPort-B_HpJ_ck.js";
 import { A as i, _ as a, g as o, h as s, m as c, o as l } from "./fileConventions-Cof68_BL.js";
 import { A as u, D as d, a as f, h as p, j as m, k as h } from "./inspect-B7U7Cl_Z.js";
-import { n as g } from "./agentsMd-7zI2h5l9.js";
+import { n as g } from "./agentsMd-D6yD7IQv.js";
 import { c as _, p as v, t as y } from "./renderModeScan-D7J1B7Kw.js";
 import { t as b } from "./pageConvention-cEiRxdab.js";
 import { i as x, n as S, r as C, t as w } from "./runtimeRegistry-DMeKfTHP.js";
 import { n as T } from "./logFileSink-B4uP8pvf.js";
 import { basename as E, dirname as D, join as O, relative as k, resolve as A } from "node:path";
-import { existsSync as j, promises as M, readFileSync as N, readdirSync as P, statSync as F, unwatchFile as I, watchFile as L } from "node:fs";
-import { fileURLToPath as R, pathToFileURL as z } from "node:url";
-import { addSink as B, createLogger as V, printReadyBlock as ee } from "@voltro/logger";
-import { createRequire as te } from "node:module";
-import { homedir as H } from "node:os";
-import { currentTraceContext as U, resolveSecret as W } from "@voltro/runtime";
-import { FRAMEWORK_ENV_CATALOG as ne, appEnvEntries as G, checkEnvNaming as re, formatEnvErrors as ie, installEnvSnapshot as K, isEnvContract as ae, pluginEnvEntries as oe, renderDotEnvExample as se, resolveEnv as ce } from "@voltro/env";
-import { __installPublicEnv as le } from "@voltro/env/public";
-import { mkdir as ue, writeFile as de } from "node:fs/promises";
-import { createHash as q } from "node:crypto";
-import { spawn as fe } from "node:child_process";
-import { createConnection as pe } from "node:net";
-import { PassThrough as me } from "node:stream";
+import { existsSync as j, promises as M, readFileSync as N, readdirSync as P, statSync as F, unwatchFile as ee, watchFile as I } from "node:fs";
+import { fileURLToPath as te, pathToFileURL as L } from "node:url";
+import { addSink as R, createLogger as z, printReadyBlock as ne } from "@voltro/logger";
+import { createRequire as B } from "node:module";
+import { homedir as V } from "node:os";
+import { currentTraceContext as re, resolveSecret as H } from "@voltro/runtime";
+import { FRAMEWORK_ENV_CATALOG as U, appEnvEntries as ie, checkEnvNaming as W, formatEnvErrors as ae, installEnvSnapshot as G, isEnvContract as oe, pluginEnvEntries as se, renderDotEnvExample as ce, resolveEnv as le } from "@voltro/env";
+import { __installPublicEnv as ue } from "@voltro/env/public";
+import { mkdir as de, writeFile as fe } from "node:fs/promises";
+import { createHash as pe } from "node:crypto";
+import { spawn as me } from "node:child_process";
+import { createConnection as K } from "node:net";
+import { PassThrough as he } from "node:stream";
 //#region src/buildToolImport.ts
-var J = (e) => {
+var ge = (e) => {
 	let t = e;
 	return t?.code === "ERR_MODULE_NOT_FOUND" || /Cannot find (package|module)/.test(String(t?.message ?? ""));
-}, he = async (e, t) => {
+}, _e = async (e, t) => {
 	try {
 		return await t();
 	} catch (t) {
-		throw J(t) ? Error(`voltro: the build tool '${e}' is not installed.\n\nIt's an OPTIONAL dependency of @voltro/cli — needed by 'voltro dev' and 'voltro build', but excluded from a serve-only production install (that's how prod images stay lean). If you are building, reinstall WITHOUT '--no-optional' (e.g. 'pnpm install'). A production SERVE container does not need '${e}' — it boots from the precompiled bundle.`) : t;
+		throw ge(t) ? Error(`voltro: the build tool '${e}' is not installed.\n\nIt's an OPTIONAL dependency of @voltro/cli — needed by 'voltro dev' and 'voltro build', but excluded from a serve-only production install (that's how prod images stay lean). If you are building, reinstall WITHOUT '--no-optional' (e.g. 'pnpm install'). A production SERVE container does not need '${e}' — it boots from the precompiled bundle.`) : t;
 	}
-}, ge = "// AUTO-GENERATED by Voltro — DO NOT EDIT.\n// Source: app.config.ts `env` (defineEnv). Regenerated on every `voltro dev` boot.\n", _e = (e, t) => t ? `${e} | undefined` : e, ve = (e, t) => Object.entries(e.vars).filter(([, e]) => t(e.access)).map(([e, t]) => `${t.description ? `    /** ${t.description} */\n` : ""}    readonly ${e}: ${_e(t.tsType, t.optional)}`).join("\n"), ye = async (e, t) => {
-	let n = ve(t, () => !0), r = `${ge}
+}, q = "// AUTO-GENERATED by Voltro — DO NOT EDIT.\n// Source: app.config.ts `env` (defineEnv). Regenerated on every `voltro dev` boot.\n", ve = (e, t) => t ? `${e} | undefined` : e, ye = (e, t) => Object.entries(e.vars).filter(([, e]) => t(e.access)).map(([e, t]) => `${t.description ? `    /** ${t.description} */\n` : ""}    readonly ${e}: ${ve(t.tsType, t.optional)}`).join("\n"), be = async (e, t) => {
+	let n = ye(t, () => !0), r = `${q}
 import '@voltro/env/server'
 
 declare module '@voltro/env/server' {
@@ -43,9 +43,9 @@ ${n.length > 0 ? n : "    // (no variables declared)"}
   }
 }
 `;
-	await de(O(e, "env.generated.d.ts"), r, "utf8");
-}, be = async (e, t) => {
-	let n = ve(t, (e) => e === "public"), r = `${ge}
+	await fe(O(e, "env.generated.d.ts"), r, "utf8");
+}, xe = async (e, t) => {
+	let n = ye(t, (e) => e === "public"), r = `${q}
 import '@voltro/env/public'
 
 declare module '@voltro/env/public' {
@@ -54,9 +54,9 @@ ${n.length > 0 ? n : "    // (no public variables declared)"}
   }
 }
 `, i = O(e, "src");
-	await ue(i, { recursive: !0 }), await de(O(i, "voltro-env.d.ts"), r, "utf8");
-}, xe = async (e, t) => {
-	let n = `${ge}
+	await de(i, { recursive: !0 }), await fe(O(i, "voltro-env.d.ts"), r, "utf8");
+}, Se = async (e, t) => {
+	let n = `${q}
 import { __installPublicEnv } from '@voltro/env/public'
 
 export const publicEnvValues = ${JSON.stringify(t, null, 2)} as const
@@ -64,14 +64,14 @@ export const publicEnvValues = ${JSON.stringify(t, null, 2)} as const
 // Set the browser/SSR-shared global the \`publicEnv\` accessor reads.
 __installPublicEnv(publicEnvValues)
 `;
-	await ue(e, { recursive: !0 }), await de(O(e, "env.public.ts"), n, "utf8");
-}, Se = async (e) => {
-	let t = ae(e.rawEnv) ? e.rawEnv : void 0, n = await ce({
+	await de(e, { recursive: !0 }), await fe(O(e, "env.public.ts"), n, "utf8");
+}, Ce = async (e) => {
+	let t = oe(e.rawEnv) ? e.rawEnv : void 0, n = await le({
 		contract: t,
-		resolveSecret: W
-	}), r = [...n.errors, ...re(t, e.appType)];
-	if (r.length > 0) throw Error(ie(r));
-	K(n.values), e.appType === "web" && le(n.publicValues);
+		resolveSecret: H
+	}), r = [...n.errors, ...W(t, e.appType)];
+	if (r.length > 0) throw Error(ae(r));
+	G(n.values), e.appType === "web" && ue(n.publicValues);
 	let i = t ? Object.keys(t.vars).length : 0;
 	if (i > 0) {
 		let r = Object.keys(n.publicValues).length;
@@ -83,20 +83,20 @@ __installPublicEnv(publicEnvValues)
 			n.length > 0 && e.log.warn(`env: ${n.length} secret var(s) declared on a web app — secrets are reachable only from server-side render code and are NEVER bundled. Prefer declaring secrets on the api.`, { keys: n });
 		}
 	}
-	return e.generateTypes && t && (e.appType === "api" ? await ye(e.root, t) : await be(e.root, t)), {
+	return e.generateTypes && t && (e.appType === "api" ? await be(e.root, t) : await xe(e.root, t)), {
 		resolved: n,
 		contract: t
 	};
-}, Ce = (e) => {
-	let t = G(e.contract), n = (e.plugins ?? []).flatMap((e) => oe(e.name, e.declaredEnv)), r = e.includeFramework === !1 ? [] : ne, i = /* @__PURE__ */ new Set(), a = [];
+}, we = (e) => {
+	let t = ie(e.contract), n = (e.plugins ?? []).flatMap((e) => se(e.name, e.declaredEnv)), r = e.includeFramework === !1 ? [] : U, i = /* @__PURE__ */ new Set(), a = [];
 	for (let e of [
 		...t,
 		...n,
 		...r
 	]) i.has(e.key) || (i.add(e.key), a.push(e));
 	return a;
-}, we = (e, t, n = (e) => process.env[e]) => {
-	let r = Ce(t).map((e) => {
+}, Te = (e, t, n = (e) => process.env[e]) => {
+	let r = we(t).map((e) => {
 		let t = n(e.key) !== void 0;
 		return {
 			...e,
@@ -113,16 +113,16 @@ __installPublicEnv(publicEnvValues)
 			missingRequired: r.filter((e) => e.required && !e.isSet && e.default === void 0).length
 		}
 	};
-}, Te = (e, t) => {
-	let n = Ce({
+}, Ee = (e, t) => {
+	let n = we({
 		...e,
 		includeFramework: !1
 	});
-	return se(n, {
+	return ce(n, {
 		includeFramework: e.includeFramework !== !1,
 		...t ? { header: t } : {}
 	});
-}, Ee = async (e, t) => {
+}, J = async (e, t) => {
 	let n = e;
 	for (;;) {
 		let e = O(n, "node_modules", t);
@@ -148,7 +148,7 @@ __installPublicEnv(publicEnvValues)
 		return [];
 	}
 	return (await Promise.all(t.map(async (t) => {
-		let n = await Ee(e, t);
+		let n = await J(e, t);
 		if (n === null) return null;
 		let r = O(n, "src");
 		try {
@@ -165,7 +165,7 @@ __installPublicEnv(publicEnvValues)
 	if (e.length === 0) return () => {};
 	let r = (e) => n.root ? k(n.root, e) : e, i = !1, a = (e) => {
 		i || (i = !0, t.warn(`.env changed (${r(e)}) — hard-restarting: process.env is read once at boot, a reload would keep stale values`, { file: r(e) }), Promise.resolve().then(() => n.onBeforeRestart?.()).catch((e) => t.warn(".env restart: onBeforeRestart failed (continuing)", {}, e)).finally(() => {
-			let e = fe(process.execPath, [...process.execArgv, ...process.argv.slice(1)], {
+			let e = me(process.execPath, [...process.execArgv, ...process.argv.slice(1)], {
 				stdio: "inherit",
 				env: process.env,
 				cwd: n.cwd ?? process.cwd()
@@ -179,14 +179,14 @@ __installPublicEnv(publicEnvValues)
 			});
 		}));
 	};
-	for (let t of e) L(t, { interval: Oe }, (e, n) => {
+	for (let t of e) I(t, { interval: Oe }, (e, n) => {
 		e.mtimeMs !== n.mtimeMs && a(t);
 	});
 	return t.info("watching .env files for changes", {
 		files: e.map(r),
 		intervalMs: Oe
 	}), () => {
-		for (let t of e) I(t);
+		for (let t of e) ee(t);
 	};
 }, Ae = [{
 	host: "127.0.0.1",
@@ -203,7 +203,7 @@ __installPublicEnv(publicEnvValues)
 			} catch {}
 			r(e);
 		}
-	}, o = pe({
+	}, o = K({
 		host: e,
 		port: t
 	});
@@ -229,7 +229,7 @@ __installPublicEnv(publicEnvValues)
 ].join("\n"), Pe = async (e, t) => {
 	let { families: r } = await Me(e);
 	if (r.length !== 0) throw n(Ne(e, t, r));
-}, Y = (e) => e === "effect" || e.startsWith("@effect/") || e.startsWith("@voltro/") || e === "react" || e === "react-dom", Fe = /(^|\/)(\.bin|\.cache|\.pnpm-store|dist|build)(\/|$)/, Ie = (e) => {
+}, Fe = (e) => e === "effect" || e.startsWith("@effect/") || e.startsWith("@voltro/") || e === "react" || e === "react-dom", Y = /(^|\/)(\.bin|\.cache|\.pnpm-store|dist|build)(\/|$)/, Ie = (e) => {
 	let t = [], n = e;
 	for (let e = 0; e < 12; e++) {
 		let e = O(n, "node_modules");
@@ -303,7 +303,7 @@ __installPublicEnv(publicEnvValues)
 	} catch {
 		return;
 	}
-}, Be = (e) => {
+}, X = (e) => {
 	let t = [], n;
 	try {
 		n = P(e);
@@ -311,7 +311,7 @@ __installPublicEnv(publicEnvValues)
 		return t;
 	}
 	for (let r of n) {
-		if (r.startsWith(".") || Fe.test(r)) continue;
+		if (r.startsWith(".") || Y.test(r)) continue;
 		let n = O(e, r);
 		if (r.startsWith("@")) {
 			let e;
@@ -337,13 +337,13 @@ __installPublicEnv(publicEnvValues)
 		});
 	}
 	return t;
-}, Ve = (e) => {
+}, Be = (e) => {
 	let t = /* @__PURE__ */ new Map(), n = (e, n, r) => {
-		if (!Y(e)) return;
+		if (!Fe(e)) return;
 		let i = t.get(e) ?? /* @__PURE__ */ new Map();
 		i.has(n) || i.set(n, r), t.set(e, i);
 	};
-	for (let t of Ie(e)) for (let { pkg: e, dir: r } of Be(t)) {
+	for (let t of Ie(e)) for (let { pkg: e, dir: r } of X(t)) {
 		let t = ze(r);
 		t !== void 0 && n(e, t, r);
 	}
@@ -355,7 +355,7 @@ __installPublicEnv(publicEnvValues)
 		paths: [...i.values()].map((t) => k(e, t)).sort()
 	});
 	return r.sort((e, t) => e.pkg.localeCompare(t.pkg));
-}, He = (e) => {
+}, Ve = (e) => {
 	if (e.length !== 0) return [
 		`•  ${e.length} package(s) resolved at more than one version:`,
 		...e.flatMap((e) => [`     ${e.pkg} — ${e.versions.join(", ")}`, ...e.paths.map((e) => `       ${e}`)]),
@@ -373,9 +373,9 @@ __installPublicEnv(publicEnvValues)
 		"   instrument), then reinstall. Do not silence the generated file — it is where",
 		"   a genuine mistake in your own descriptors surfaces."
 	].join("\n");
-}, Ue = (e) => {
+}, He = (e) => {
 	let t = /* @__PURE__ */ new Map();
-	for (let n of Ie(e)) for (let { pkg: e, dir: r } of Be(n)) {
+	for (let n of Ie(e)) for (let { pkg: e, dir: r } of X(n)) {
 		if (!e.startsWith("@voltro/")) continue;
 		let n = ze(r);
 		n !== void 0 && !t.has(e) && t.set(e, n);
@@ -392,7 +392,7 @@ __installPublicEnv(publicEnvValues)
 			version: t
 		})).sort((e, t) => e.pkg.localeCompare(t.pkg))
 	};
-}, We = (e) => {
+}, Ue = (e) => {
 	if (e !== void 0) return [
 		`•  ${e.behind.length} @voltro/* package(s) are not on ${e.majority}:`,
 		...e.behind.map((e) => `     ${e.pkg}  ${e.version}`),
@@ -410,59 +410,59 @@ __installPublicEnv(publicEnvValues)
 		"   its pattern: the one that produced this report was `@voltro/[a-z-]+`,",
 		"   which silently skips `@voltro/i18n` because the name contains digits."
 	].join("\n");
-}, Ge = (e, t) => {
-	let n = Ue(e);
+}, We = (e, t) => {
+	let n = He(e);
 	n !== void 0 && t.warn?.(`@voltro/* version skew: ${n.behind.length} package(s) are not on ${n.majority}`, {
 		majority: n.majority,
 		behind: n.behind.map((e) => `${e.pkg}@${e.version}`),
 		fix: "the framework ships in lockstep; bump the listed packages and reinstall"
 	});
-}, Ke = V({ scope: "vite" }), qe = /\x1b\[[0-9;]*m/g, Je = /^\s*\[?vite\]?\s*(\([a-z-]+\)\s*)?/, Ye = (e) => e.replace(qe, "").replace(Je, "").trim(), Xe = /proxy error/i, Ze = [
+}, Ge = z({ scope: "vite" }), Ke = /\x1b\[[0-9;]*m/g, qe = /^\s*\[?vite\]?\s*(\([a-z-]+\)\s*)?/, Je = (e) => e.replace(Ke, "").replace(qe, "").trim(), Ye = /proxy error/i, Xe = [
 	"ECONNREFUSED",
 	"ECONNRESET",
 	"ECONNABORTED",
 	"EPIPE",
 	"ETIMEDOUT"
-], Qe = (e, t = 0) => {
+], Ze = (e, t = 0) => {
 	if (e == null || t > 5) return !1;
 	let n = e;
-	return typeof n.code == "string" && Ze.includes(n.code) || typeof n.message == "string" && Ze.some((e) => n.message.includes(e)) || Array.isArray(n.errors) && n.errors.some((e) => Qe(e, t + 1)) ? !0 : Qe(n.cause, t + 1);
-}, $e = 4e3, et = () => {
+	return typeof n.code == "string" && Xe.includes(n.code) || typeof n.message == "string" && Xe.some((e) => n.message.includes(e)) || Array.isArray(n.errors) && n.errors.some((e) => Ze(e, t + 1)) ? !0 : Ze(n.cause, t + 1);
+}, Qe = 4e3, $e = () => {
 	let e = /* @__PURE__ */ new Set(), t = 0, n = {
 		hasWarned: !1,
 		info: (e) => {
-			let t = Ye(e);
-			t.length !== 0 && Ke.info(t);
+			let t = Je(e);
+			t.length !== 0 && Ge.info(t);
 		},
 		warn: (e) => {
 			n.hasWarned = !0;
-			let t = Ye(e);
-			t.length !== 0 && Ke.warn(t);
+			let t = Je(e);
+			t.length !== 0 && Ge.warn(t);
 		},
 		warnOnce: (t) => {
-			let r = Ye(t);
-			e.has(r) || (e.add(r), n.hasWarned = !0, r.length !== 0 && Ke.warn(r));
+			let r = Je(t);
+			e.has(r) || (e.add(r), n.hasWarned = !0, r.length !== 0 && Ge.warn(r));
 		},
 		error: (e, n) => {
-			let r = Ye(e), i = n?.error;
+			let r = Je(e), i = n?.error;
 			if (r.length !== 0) {
-				if (Xe.test(r) && Qe(i)) {
+				if (Ye.test(r) && Ze(i)) {
 					let e = Date.now();
-					e - t > $e && (t = e, Ke.info("waiting for api — proxy upstream not accepting connections yet (still starting?)"));
+					e - t > Qe && (t = e, Ge.info("waiting for api — proxy upstream not accepting connections yet (still starting?)"));
 					return;
 				}
-				Ke.error(r, {}, i);
+				Ge.error(r, {}, i);
 			}
 		},
 		clearScreen: () => {},
 		hasErrorLogged: (e) => !1
 	};
 	return n;
-}, tt = (e) => e.replace(/\\"|"(?:[^"\\]|\\.)*"|(\/\/[^\n]*|\/\*[\s\S]*?\*\/)/g, (e, t) => t ? "" : e), nt = (e) => {
+}, et = (e) => e.replace(/\\"|"(?:[^"\\]|\\.)*"|(\/\/[^\n]*|\/\*[\s\S]*?\*\/)/g, (e, t) => t ? "" : e), tt = (e) => {
 	try {
 		let t = O(e, "tsconfig.json");
 		if (!j(t)) return [];
-		let n = JSON.parse(tt(N(t, "utf8"))).compilerOptions ?? {}, r = n.paths ?? {}, i = n.baseUrl ?? ".", a = A(e, i), o = [];
+		let n = JSON.parse(et(N(t, "utf8"))).compilerOptions ?? {}, r = n.paths ?? {}, i = n.baseUrl ?? ".", a = A(e, i), o = [];
 		for (let [e, t] of Object.entries(r)) {
 			let n = t[0];
 			if (!n) continue;
@@ -484,12 +484,12 @@ __installPublicEnv(publicEnvValues)
 	} catch {
 		return [];
 	}
-}, rt = (e = process.env) => {
+}, nt = (e = process.env) => {
 	let t = e.VOLTRO_DEV_SSR_COMPILE_CONCURRENCY;
 	if (t === void 0 || t.trim() === "") return 4;
 	let n = Number(t);
 	return Number.isFinite(n) && n >= 1 ? Math.floor(n) : 4;
-}, it = (e) => {
+}, rt = (e) => {
 	let t = Math.max(1, Math.floor(e)), n = 0, r = [], i = () => n < t ? (n++, Promise.resolve()) : new Promise((e) => r.push(e)), a = () => {
 		let e = r.shift();
 		e ? e() : n--;
@@ -507,8 +507,8 @@ __installPublicEnv(publicEnvValues)
 			return n;
 		}
 	};
-}, at = (e) => {
-	let t = it(e.limit), n = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Set();
+}, it = (e) => {
+	let t = rt(e.limit), n = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Set();
 	return {
 		load: (i, a) => {
 			if (r.has(i)) return a();
@@ -538,7 +538,7 @@ __installPublicEnv(publicEnvValues)
 			return r.size;
 		}
 	};
-}, ot = (e) => {
+}, at = (e) => {
 	let t = [];
 	for (let n of e.split("/").filter(Boolean)) n.startsWith("[[...") && n.endsWith("]]") ? t.push({
 		name: n.slice(5, -2),
@@ -554,7 +554,7 @@ __installPublicEnv(publicEnvValues)
 		optional: !1
 	});
 	return t;
-}, st = (e) => e.replace(/-([a-z0-9])/g, (e, t) => t.toUpperCase()), ct = async (e) => {
+}, ot = (e) => e.replace(/-([a-z0-9])/g, (e, t) => t.toUpperCase()), st = async (e) => {
 	let t = A(e);
 	for (let e = 0; e < 4; e++) {
 		let e = O(t, "project.json");
@@ -572,8 +572,8 @@ __installPublicEnv(publicEnvValues)
 		t = n;
 	}
 	return null;
-}, lt = async (e) => {
-	let t = await ct(e);
+}, ct = async (e) => {
+	let t = await st(e);
 	if (!t) return [];
 	let { projectDir: n, manifest: r } = t, i = E(e), a = r.apps ?? {}, o = [];
 	for (let [e, t] of Object.entries(a)) {
@@ -582,23 +582,23 @@ __installPublicEnv(publicEnvValues)
 		if (!j(a)) continue;
 		let s;
 		try {
-			let { pages: e } = await $(a);
+			let { pages: e } = await Jr(a);
 			s = e.map((e) => ({
 				pattern: e.pattern,
-				params: ot(e.pattern)
+				params: at(e.pattern)
 			}));
 		} catch {
 			continue;
 		}
 		o.push({
-			key: st(e),
+			key: ot(e),
 			origin: `http://localhost:${t.port}`,
 			...typeof t.origin == "string" && t.origin.length > 0 ? { prodOrigin: t.origin } : {},
 			routes: s
 		});
 	}
 	return o;
-}, ut = (e) => {
+}, lt = (e) => {
 	if (e.params.length === 0) return `'${e.pattern}'`;
 	let t = e.pattern;
 	for (let n of e.params) {
@@ -606,21 +606,21 @@ __installPublicEnv(publicEnvValues)
 		t = t.replace(e, r);
 	}
 	return "`" + t + "`";
-}, dt = (e) => e.params.length === 0 ? "EmptyParams" : `{ ${e.params.map((e) => {
+}, ut = (e) => e.params.length === 0 ? "EmptyParams" : `{ ${e.params.map((e) => {
 	let t = "string";
 	return e.optional ? `readonly ${e.name}?: ${t}` : `readonly ${e.name}: ${t}`;
-}).join("; ")} }`, ft = (e, t, n) => {
-	let r = dt(e), i = ut(e), a = t ? "VoltroExternalUrl" : "VoltroRouteUrl", o = t && n ? `${n} + ` : "";
+}).join("; ")} }`, dt = (e, t, n) => {
+	let r = ut(e), i = lt(e), a = t ? "VoltroExternalUrl" : "VoltroRouteUrl", o = t && n ? `${n} + ` : "";
 	return e.params.length === 0 ? `() => (${o}${i}) as ${a}` : `({ ${e.params.map((e) => e.name).join(", ")} }: ${r}) => (${o}${i}) as ${a}`;
-}, pt = (e) => `{\n${[...e].sort((e, t) => e.pattern.localeCompare(t.pattern)).map((e) => `  ${JSON.stringify(e.pattern)}: ${ft(e, !1)},`).join("\n")}\n}`, mt = (e, t) => {
+}, ft = (e) => `{\n${[...e].sort((e, t) => e.pattern.localeCompare(t.pattern)).map((e) => `  ${JSON.stringify(e.pattern)}: ${dt(e, !1)},`).join("\n")}\n}`, pt = (e, t) => {
 	if (e.routes.length === 0) return `  ${e.key}: {} as Record<string, never>,`;
-	let n = [...e.routes].sort((e, t) => e.pattern.localeCompare(t.pattern)), r = t === "prod" && e.prodOrigin ? e.prodOrigin : e.origin, i = JSON.stringify(r), a = n.map((e) => `    ${JSON.stringify(e.pattern)}: ${ft(e, !0, i)},`);
+	let n = [...e.routes].sort((e, t) => e.pattern.localeCompare(t.pattern)), r = t === "prod" && e.prodOrigin ? e.prodOrigin : e.origin, i = JSON.stringify(r), a = n.map((e) => `    ${JSON.stringify(e.pattern)}: ${dt(e, !0, i)},`);
 	return `  ${e.key}: {\n${a.join("\n")}\n  },`;
-}, ht = async (e) => {
+}, mt = async (e) => {
 	let t = e.pages.map((e) => ({
 		pattern: e.pattern,
-		params: ot(e.pattern)
-	})), n = await lt(e.appRoot), r = [
+		params: at(e.pattern)
+	})), n = await ct(e.appRoot), r = [
 		"// THIS FILE IS GENERATED — DO NOT EDIT BY HAND.",
 		"// Re-emitted by `voltro dev` whenever `src/pages/**` changes.",
 		"// Type-safe route builders consumed by <Link to={...}>.",
@@ -629,7 +629,7 @@ __installPublicEnv(publicEnvValues)
 		"",
 		"type EmptyParams = Record<string, never>",
 		""
-	].join("\n"), i = e.mode ?? "dev", a = `${r}\n${`export const routes = ${pt(t)} as const\n`}\n${n.length === 0 ? "export const siblingApps = {} as Record<string, never>\n" : `export const siblingApps = {\n${n.map((e) => mt(e, i)).join("\n")}\n} as const\n`}`, o = O(e.appRoot, ".framework", "routes.generated.ts");
+	].join("\n"), i = e.mode ?? "dev", a = `${r}\n${`export const routes = ${ft(t)} as const\n`}\n${n.length === 0 ? "export const siblingApps = {} as Record<string, never>\n" : `export const siblingApps = {\n${n.map((e) => pt(e, i)).join("\n")}\n} as const\n`}`, o = O(e.appRoot, ".framework", "routes.generated.ts");
 	await M.mkdir(D(o), { recursive: !0 });
 	let s = null;
 	try {
@@ -642,37 +642,37 @@ __installPublicEnv(publicEnvValues)
 		path: o,
 		wrote: !0
 	});
-}, gt = (e) => {
+}, ht = (e) => {
 	if (e === "" || e === "/") return "/";
 	let t = e.startsWith("/") ? e : `/${e}`;
 	return t.endsWith("/") ? t.slice(0, -1) : t;
-}, _t = (e, t) => {
-	let n = e.endsWith("/") ? e.slice(0, -1) : e, r = gt(t);
+}, gt = (e, t) => {
+	let n = e.endsWith("/") ? e.slice(0, -1) : e, r = ht(t);
 	return r === "/" ? `${n}/` : `${n}${r}`;
-}, vt = (e, t, n) => {
-	let r = gt(e);
+}, _t = (e, t, n) => {
+	let r = ht(e);
 	return t === n ? r : r === "/" ? `/${t}` : `/${t}${r}`;
-}, yt = (e) => e.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;"), bt = (e) => {
+}, vt = (e) => e.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;"), yt = (e) => {
 	let { siteUrl: t, entries: n } = e, r = e.locales && e.locales.length > 1 ? e.locales : void 0, i = e.defaultLocale ?? r?.[0] ?? "en", a = r !== void 0, o = /* @__PURE__ */ new Map(), s = (e) => {
 		if (!r) return "";
-		let n = r.map((n) => `    <xhtml:link rel="alternate" hreflang="${yt(n)}" href="${yt(_t(t, vt(e, n, i)))}" />`);
-		return n.push(`    <xhtml:link rel="alternate" hreflang="x-default" href="${yt(_t(t, vt(e, i, i)))}" />`), `\n${n.join("\n")}`;
+		let n = r.map((n) => `    <xhtml:link rel="alternate" hreflang="${vt(n)}" href="${vt(gt(t, _t(e, n, i)))}" />`);
+		return n.push(`    <xhtml:link rel="alternate" hreflang="x-default" href="${vt(gt(t, _t(e, i, i)))}" />`), `\n${n.join("\n")}`;
 	};
 	for (let e of n) {
 		let n = r ?? [i];
 		for (let r of n) {
-			let n = _t(t, vt(e.path, r, i)), a = e.lastmod ? `\n    <lastmod>${yt(e.lastmod)}</lastmod>` : "";
-			o.set(n, `  <url>\n    <loc>${yt(n)}</loc>${a}${s(e.path)}\n  </url>`);
+			let n = gt(t, _t(e.path, r, i)), a = e.lastmod ? `\n    <lastmod>${vt(e.lastmod)}</lastmod>` : "";
+			o.set(n, `  <url>\n    <loc>${vt(n)}</loc>${a}${s(e.path)}\n  </url>`);
 		}
 	}
 	let c = [...o.keys()].sort().map((e) => o.get(e)).join("\n");
 	return `<?xml version="1.0" encoding="UTF-8"?>\n<urlset${a ? " xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\" xmlns:xhtml=\"http://www.w3.org/1999/xhtml\"" : " xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\""}>\n${c}\n</urlset>\n`;
-}, xt = (e) => {
+}, bt = (e) => {
 	if (!e.indexable) return "User-agent: *\nDisallow: /\n";
 	let t = ["User-agent: *", "Allow: /"];
-	for (let n of e.disallow ?? []) t.push(`Disallow: ${gt(n)}`);
+	for (let n of e.disallow ?? []) t.push(`Disallow: ${ht(n)}`);
 	return e.sitemapUrl && t.push("", `Sitemap: ${e.sitemapUrl}`), `${t.join("\n")}\n`;
-}, St = 256, Ct = (e = St) => {
+}, xt = 256, St = (e = xt) => {
 	let t = [], n = /* @__PURE__ */ new Set();
 	return {
 		emit(r, i) {
@@ -695,18 +695,18 @@ __installPublicEnv(publicEnvValues)
 			return t.slice();
 		}
 	};
-}, wt = (e) => `event: ${e.channel}\ndata: ${JSON.stringify(e)}\n\n`, Tt = () => `: keep-alive ${Date.now()}\n\n`, Et = 8e3, Dt = (e, t = Et) => {
-	let n = kt(e);
+}, Ct = (e) => `event: ${e.channel}\ndata: ${JSON.stringify(e)}\n\n`, wt = () => `: keep-alive ${Date.now()}\n\n`, Tt = 8e3, Et = (e, t = Tt) => {
+	let n = Ot(e);
 	return n.length <= t ? n : `${n.slice(0, t)}\n… [voltro] truncated at ${t} chars (${n.length} total)`;
-}, Ot = 4, kt = (e, t = 0, n = /* @__PURE__ */ new Set()) => {
+}, Dt = 4, Ot = (e, t = 0, n = /* @__PURE__ */ new Set()) => {
 	if (e instanceof Error) {
 		let r = e.stack ?? `${e.name}: ${e.message}`;
 		if (n.has(e)) return `${r}\n  [cycle]`;
 		n.add(e);
 		let i = [];
-		if (t < Ot) {
-			if (e instanceof AggregateError && Array.isArray(e.errors)) for (let [r, a] of e.errors.entries()) i.push(`\n  [aggregate ${r}] ${At(kt(a, t + 1, n))}`);
-			else e.cause !== void 0 && e.cause !== null && i.push(`\n  [cause] ${At(kt(e.cause, t + 1, n))}`);
+		if (t < Dt) {
+			if (e instanceof AggregateError && Array.isArray(e.errors)) for (let [r, a] of e.errors.entries()) i.push(`\n  [aggregate ${r}] ${kt(Ot(a, t + 1, n))}`);
+			else e.cause !== void 0 && e.cause !== null && i.push(`\n  [cause] ${kt(Ot(e.cause, t + 1, n))}`);
 		}
 		return r + i.join("");
 	}
@@ -715,30 +715,30 @@ __installPublicEnv(publicEnvValues)
 	} catch {
 		return "[unstringifiable thrown value]";
 	}
-}, At = (e) => {
+}, kt = (e) => {
 	let t = e.split("\n");
 	return t.length <= 3 ? e : `${t.slice(0, 3).join("\n")}\n  …`;
-}, jt = {
+}, At = {
 	trace: 0,
 	debug: 1,
 	info: 2,
 	warn: 3,
 	error: 4,
 	fatal: 5
-}, Mt = 2e3, Nt = 200, Pt = class {
+}, jt = 2e3, Mt = 200, Nt = class {
 	capacity;
 	buffer = [];
-	constructor(e = Mt) {
+	constructor(e = jt) {
 		this.capacity = e;
 	}
 	append(e) {
 		this.buffer.push(e), this.buffer.length > this.capacity && this.buffer.shift();
 	}
 	query(e = {}) {
-		let t = e.since ?? 0, n = e.until ?? Date.now(), r = Math.min(e.max ?? Nt, this.capacity), i = e.minLevel === void 0 ? jt.trace : jt[e.minLevel], a = e.scope?.toLowerCase(), o = e.source, s = e.filter?.toLowerCase(), c = e.traceId, l = [];
+		let t = e.since ?? 0, n = e.until ?? Date.now(), r = Math.min(e.max ?? Mt, this.capacity), i = e.minLevel === void 0 ? At.trace : At[e.minLevel], a = e.scope?.toLowerCase(), o = e.source, s = e.filter?.toLowerCase(), c = e.traceId, l = [];
 		for (let e = this.buffer.length - 1; e >= 0 && l.length < r; e--) {
 			let r = this.buffer[e];
-			r.ts < t || r.ts > n || jt[r.level] < i || (o === void 0 || r.source === o) && (a !== void 0 && (r.scope === void 0 || !r.scope.toLowerCase().includes(a)) || s !== void 0 && !r.message.toLowerCase().includes(s) || (c === void 0 || r.fields.traceId === c) && l.push(r));
+			r.ts < t || r.ts > n || At[r.level] < i || (o === void 0 || r.source === o) && (a !== void 0 && (r.scope === void 0 || !r.scope.toLowerCase().includes(a)) || s !== void 0 && !r.message.toLowerCase().includes(s) || (c === void 0 || r.fields.traceId === c) && l.push(r));
 		}
 		return l.reverse();
 	}
@@ -751,7 +751,7 @@ __installPublicEnv(publicEnvValues)
 	clear() {
 		this.buffer = [];
 	}
-}, Ft = null, It = () => (Ft === null && (Ft = new Pt()), Ft), Lt = (e) => {
+}, Pt = null, Ft = () => (Pt === null && (Pt = new Nt()), Pt), It = (e) => {
 	if (typeof e == "string") return e;
 	if (e instanceof Error) return e.message;
 	try {
@@ -759,28 +759,28 @@ __installPublicEnv(publicEnvValues)
 	} catch {
 		return String(e);
 	}
-}, Rt = 8e3, zt = (e) => typeof e == "string" ? e.length <= Rt ? e : `${e.slice(0, Rt)}… [voltro: truncated]` : typeof e != "object" || !e ? e : Dt(e, Rt), Bt = (e, t) => {
+}, Lt = 8e3, Rt = (e) => typeof e == "string" ? e.length <= Lt ? e : `${e.slice(0, Lt)}… [voltro: truncated]` : typeof e != "object" || !e ? e : Et(e, Lt), zt = (e, t) => {
 	try {
 		e(...t);
 	} catch (n) {
 		try {
-			e(...t.map(zt)), e(`  ↑ [voltro] an argument above was too large for console formatting (${n?.message ?? "inspect failed"}) — printed bounded to ${Rt} chars per argument.`);
+			e(...t.map(Rt)), e(`  ↑ [voltro] an argument above was too large for console formatting (${n?.message ?? "inspect failed"}) — printed bounded to ${Lt} chars per argument.`);
 		} catch {
 			e(`[voltro] a console.error argument could not be formatted at all (${t.length} arg(s)).`);
 		}
 	}
-}, Vt = (e) => {
+}, Bt = (e) => {
 	let t = {
 		log: console.log.bind(console),
 		info: console.info.bind(console),
 		warn: console.warn.bind(console),
 		error: console.error.bind(console),
 		debug: console.debug.bind(console)
-	}, n = It(), r = !1, i = (i) => (...a) => {
-		if (Bt(t[i], a), !r) {
+	}, n = Ft(), r = !1, i = (i) => (...a) => {
+		if (zt(t[i], a), !r) {
 			r = !0;
 			try {
-				let t = a.length > 0 ? Lt(a[0]) : "", r = t.length > 500 ? t.slice(0, 500) + "…" : t, o = U();
+				let t = a.length > 0 ? It(a[0]) : "", r = t.length > 500 ? t.slice(0, 500) + "…" : t, o = re();
 				e.emit("log", {
 					level: i,
 					message: r,
@@ -807,7 +807,7 @@ __installPublicEnv(publicEnvValues)
 		}
 	};
 	console.log = i("log"), console.info = i("info"), console.warn = i("warn"), console.error = i("error"), console.debug = i("debug");
-	let a = B((t) => {
+	let a = R((t) => {
 		if (!r) {
 			r = !0;
 			try {
@@ -818,7 +818,7 @@ __installPublicEnv(publicEnvValues)
 					argsCount: 1,
 					...t.scope === void 0 ? {} : { scope: t.scope }
 				});
-				let a = U(), o = a !== void 0 && t.fields.traceId === void 0 ? {
+				let a = re(), o = a !== void 0 && t.fields.traceId === void 0 ? {
 					...t.fields,
 					traceId: a.traceId
 				} : t.fields;
@@ -838,14 +838,14 @@ __installPublicEnv(publicEnvValues)
 	return () => {
 		console.log = t.log, console.info = t.info, console.warn = t.warn, console.error = t.error, console.debug = t.debug, a();
 	};
-}, Ht = 2e3, Ut = 8, Wt = 1e3, Gt = 200, X = (e, t) => e.length > t ? `${e.slice(0, t)}…` : e, Kt = (e) => {
+}, Vt = 2e3, Ht = 8, Ut = 1e3, Wt = 200, Gt = (e, t) => e.length > t ? `${e.slice(0, t)}…` : e, Kt = (e) => {
 	switch (e) {
 		case "error": return "error";
 		case "warn": return "warn";
 		case "debug": return "debug";
 		default: return "info";
 	}
-}, qt = V({ scope: "client" }), Jt = (e, t) => {
+}, qt = z({ scope: "client" }), Jt = (e, t) => {
 	let n;
 	try {
 		n = JSON.parse(e);
@@ -855,7 +855,7 @@ __installPublicEnv(publicEnvValues)
 	if (typeof n != "object" || !n) return Yt(400, { error: "body must be a JSON object" });
 	let r = n;
 	if (!Array.isArray(r.entries)) return Yt(400, { error: "entries must be an array" });
-	let i = typeof r.app == "string" ? X(r.app, 120) : void 0, a = typeof r.page == "string" ? X(r.page, 200) : void 0, o = typeof r.ua == "string" ? X(r.ua, 200) : void 0, s = r.entries.slice(0, Gt), c = 0;
+	let i = typeof r.app == "string" ? Gt(r.app, 120) : void 0, a = typeof r.page == "string" ? Gt(r.page, 200) : void 0, o = typeof r.ua == "string" ? Gt(r.ua, 200) : void 0, s = r.entries.slice(0, Wt), c = 0;
 	for (let e of s) {
 		if (typeof e != "object" || !e) continue;
 		let n = e;
@@ -866,7 +866,7 @@ __installPublicEnv(publicEnvValues)
 			"warn",
 			"error",
 			"debug"
-		].includes(n.level) ? n.level : "log", s = typeof n.ts == "number" && Number.isFinite(n.ts) ? n.ts : Date.now(), l = X(n.message, Ht), u = Array.isArray(n.args) ? n.args.slice(0, Ut).filter((e) => typeof e == "string").map((e) => X(e, Wt)) : void 0, d = typeof n.stack == "string" ? X(n.stack, Ht) : void 0;
+		].includes(n.level) ? n.level : "log", s = typeof n.ts == "number" && Number.isFinite(n.ts) ? n.ts : Date.now(), l = Gt(n.message, Vt), u = Array.isArray(n.args) ? n.args.slice(0, Ht).filter((e) => typeof e == "string").map((e) => Gt(e, Ut)) : void 0, d = typeof n.stack == "string" ? Gt(n.stack, Vt) : void 0;
 		t.emit("clientLog", {
 			ts: s,
 			level: r,
@@ -1016,7 +1016,7 @@ __installPublicEnv(publicEnvValues)
 	let e = {
 		warn: console.warn.bind(console),
 		error: console.error.bind(console)
-	}, t = V({ scope: "babel" }), n = !1, r = (r) => (...i) => {
+	}, t = z({ scope: "babel" }), n = !1, r = (r) => (...i) => {
 		if (!n) {
 			for (let e of cn) if (e.match(i[0])) {
 				n = !0;
@@ -1166,7 +1166,7 @@ import {
 			map: null
 		};
 	}
-}), xn = V({ scope: "voltro:dashboard" }), Sn = te(import.meta.url), Cn = 5179, wn = (e) => {
+}), xn = z({ scope: "voltro:dashboard" }), Sn = B(import.meta.url), Cn = 5179, wn = (e) => {
 	let t = process.env.VOLTRO_DASHBOARD_PATH;
 	if (t && j(O(A(t), "app.config.ts"))) return A(t);
 	try {
@@ -1183,14 +1183,14 @@ import {
 	}
 	return null;
 }, Tn = "VOLTRO_IS_DASHBOARD", En = (e, t = "127.0.0.1", n = 250) => new Promise((r) => {
-	let i = pe({
+	let i = K({
 		port: e,
 		host: t
 	}), a = !1, o = (e) => {
 		a || (a = !0, i.destroy(), r(e));
 	};
 	i.once("connect", () => o(!0)), i.once("error", () => o(!1)), setTimeout(() => o(!1), n);
-}), Dn = () => !!(process.env.VOLTRO_DASHBOARD === "off" || process.argv.includes("--disable-dashboard")), On = () => process.env[Tn] === "1", kn = () => process.stdout.isTTY === !0, An = O(H(), ".voltro", "dashboard-launch.lock"), jn = 1e4, Mn = async () => {
+}), Dn = () => !!(process.env.VOLTRO_DASHBOARD === "off" || process.argv.includes("--disable-dashboard")), On = () => process.env[Tn] === "1", kn = () => process.stdout.isTTY === !0, An = O(V(), ".voltro", "dashboard-launch.lock"), jn = 1e4, Mn = async () => {
 	try {
 		await M.mkdir(D(An), { recursive: !0 });
 		let e = await M.open(An, "wx");
@@ -1237,7 +1237,7 @@ import {
 		let e = process.argv[1];
 		n = e && e.endsWith("/src/bin.ts") ? O(D(e), "..", "bin", "voltro.mjs") : e ?? "voltro";
 	}
-	let r = O(e.dashboardAppPath, ".framework", "dist", "index.html"), i = j(r), a = i ? "start" : "dev", o = fe(process.execPath, [
+	let r = O(e.dashboardAppPath, ".framework", "dist", "index.html"), i = j(r), a = i ? "start" : "dev", o = me(process.execPath, [
 		n,
 		a,
 		e.dashboardAppPath
@@ -1452,7 +1452,7 @@ import {
 			headInjection: i(a.meta),
 			htmlLang: r
 		}));
-		let c = new me();
+		let c = new he();
 		c.pipe(t, { end: !1 }), c.on("end", () => {
 			t.end(n.tail);
 		}), a.stream.pipe(c);
@@ -1518,7 +1518,7 @@ import {
 	};
 	return await n(e), t.sort();
 }, fr = async (e) => {
-	let t = q("sha1");
+	let t = pe("sha1");
 	for (let n of await dr(e)) {
 		t.update(n.slice(e.length)), t.update("\0");
 		try {
@@ -1534,24 +1534,146 @@ import {
 	if (e.length === 0) return;
 	let t = [];
 	for (let n of [...e].sort()) t.push(await fr(n));
-	return q("sha1").update(t.join("\0")).digest("hex");
-}, Z = V({ scope: "voltro:dev:web" }), mr = V({ scope: "vite" }), hr = await (async () => {
+	return pe("sha1").update(t.join("\0")).digest("hex");
+}, mr = (e) => typeof e == "object" && !!e && e._tag === "VoltroMiddleware" && typeof e.run == "function", hr = ["middleware.ts", "middleware.tsx"], gr = (e) => {
+	let t = e.replace(/\/+$/, "");
+	return t === "" ? "/" : t;
+}, Z = (e, t) => {
+	let n = gr(e);
+	if (n === "/") return !0;
+	let r = gr(t);
+	return r === n || r.startsWith(`${n}/`);
+}, _r = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, vr = (e, t) => {
+	if (e === void 0) return !0;
+	let n = _r(e.under), r = e.routes ?? [];
+	return n.length === 0 && r.length === 0 || r.includes(t) || n.some((e) => Z(e, t)) ? !(e.except ?? []).some((e) => e === t || Z(e, t)) : !1;
+}, yr = (e) => {
+	if (e?.assets !== !0) return [];
+	let t = _r(e.under);
+	return t.length > 0 ? t : (e.routes ?? []).length > 0 ? [] : ["/"];
+}, br = (e, t) => yr(e).some((e) => Z(e, t)) ? !(e?.except ?? []).some((e) => Z(e, t)) : !1, xr = (e, t) => e.find(({ middleware: e }) => t.route === void 0 ? br(e.match, t.pathname) : vr(e.match, t.route))?.middleware, Sr = (e, t) => {
+	let n = [];
+	for (let { exportName: r, middleware: i } of e) {
+		let e = i.match;
+		for (let i of e?.routes ?? []) t.includes(i) || n.push({
+			kind: "dead-matcher",
+			message: `\`${r}\` matches routes: ['${i}'], which is not a route in this app. Route patterns are spelled as the router spells them, e.g. \`/notes/[id]\`.`
+		});
+		if (e?.assets !== !0) for (let [i, a] of [["under", _r(e?.under)], ["except", e?.except ?? []]]) for (let e of a) t.some((t) => Z(e, t)) || n.push({
+			kind: "dead-matcher",
+			message: `\`${r}\` matches ${i}: ['${e}'], which covers no route in this app. ` + (i === "except" ? "An `except` that excludes nothing is a rule that reads as active and is not." : "Add `assets: true` if you meant a path the router does not serve.")
+		});
+	}
+	for (let r = 0; r < e.length; r += 1) for (let i = r + 1; i < e.length; i += 1) {
+		let a = e[r], o = e[i], s = t.find((e) => vr(a.middleware.match, e) && vr(o.middleware.match, e));
+		if (s !== void 0) {
+			n.push({
+				kind: "overlap",
+				message: `\`${a.exportName}\` and \`${o.exportName}\` both match ${s}. A route may have at most one middleware — two hooks writing one \`authorization\` header have no defined winner. Narrow one with \`except\`, or fold them into one middleware that branches on \`req.route\`.`
+			});
+			continue;
+		}
+		{
+			let e = yr(a.middleware.match), t = yr(o.middleware.match), r = e.some((e) => t.some((t) => Z(e, t) || Z(t, e))), i = (a.middleware.match?.except ?? []).some((e) => t.length > 0 && t.every((t) => Z(e, t))) || (o.middleware.match?.except ?? []).some((t) => e.length > 0 && e.every((e) => Z(t, e)));
+			r && !i && n.push({
+				kind: "overlap",
+				message: `\`${a.exportName}\` and \`${o.exportName}\` both declare \`assets: true\` over overlapping paths. A non-page request would match both, and there is no route to tell them apart.`
+			});
+		}
+	}
+	return n;
+}, Cr = (e, t) => {
+	let r = Sr(e, t);
+	if (r.length !== 0) throw n(`middleware.ts: ${r.length} problem(s)\n\n` + r.map((e) => `  • ${e.message}`).join("\n\n"));
+}, wr = (e) => {
+	let t = {};
+	if (!e) return t;
+	for (let n of e.split(";")) {
+		let e = n.indexOf("=");
+		if (e <= 0) continue;
+		let r = n.slice(0, e).trim();
+		if (r !== "") try {
+			t[r] = decodeURIComponent(n.slice(e + 1).trim());
+		} catch {
+			t[r] = n.slice(e + 1).trim();
+		}
+	}
+	return t;
+}, Tr = (e) => Object.entries(e).map(([e, t]) => `${e}=${encodeURIComponent(t)}`).join("; "), Er = /(^|[-_.])(auth[-_.]?token|session|access[-_.]?token)([-_.]|$)|^sb-.*-auth-token$/i, Dr = (e) => e.httpOnly === void 0 && Er.test(e.name), Or = (e) => {
+	let t = [`${e.name}=${encodeURIComponent(e.value)}`];
+	return t.push(`Path=${e.path ?? "/"}`), e.maxAge !== void 0 && t.push(`Max-Age=${Math.trunc(e.maxAge)}`), e.httpOnly !== !1 && t.push("HttpOnly"), e.secure === !0 && t.push("Secure"), t.push(`SameSite=${e.sameSite ?? "lax"}`), t.join("; ");
+}, kr = (e) => e.length === 0 ? {} : { "set-cookie": e.map(Or) }, Ar = async (e, t = (e) => import(L(e).href)) => {
+	for (let r of hr) {
+		let i;
+		try {
+			i = await t(O(e, r));
+		} catch (e) {
+			let t = e?.code;
+			if (t === "ERR_MODULE_NOT_FOUND" || t === "MODULE_NOT_FOUND") continue;
+			throw e;
+		}
+		let a = Object.entries(i ?? {}), o = a.filter((e) => mr(e[1])).map(([e, t]) => ({
+			exportName: e,
+			middleware: t
+		}));
+		if (o.length > 0) return o;
+		let s = a.find(([, e]) => typeof e == "function");
+		if (s !== void 0) {
+			let [e] = s;
+			throw n(`${r} exports \`${e}\` as a bare function, which is not a middleware. Wrap it:\n\n    import { defineMiddleware } from '@voltro/web/middleware'
+
+    export const ${e === "default" ? "session" : e} = defineMiddleware({\n      match: { under: '/app' },   // omit to run on every route
+      run: async (req) => { /* … */ },\n    })
+
+The wrapper is what carries \`match\`, and what lets \`voltro doctor\` report where a middleware runs without executing it.`);
+		}
+		return o;
+	}
+	return [];
+}, jr = async (e, t, n) => {
+	let r = {
+		headers: t.headers,
+		cookies: t.cookies,
+		setCookies: []
+	};
+	if (e === void 0) return r;
+	let i = await e.run(t);
+	if (!i) return r;
+	let a = i.setCookies ?? [];
+	if (n !== void 0) for (let e of a) Dr(e) && n(e);
+	let o = i.headers ? {
+		...t.headers,
+		...i.headers
+	} : { ...t.headers };
+	if (a.length === 0) return {
+		headers: o,
+		cookies: t.cookies,
+		setCookies: a
+	};
+	let s = { ...t.cookies };
+	for (let e of a) e.maxAge !== void 0 && e.maxAge <= 0 ? delete s[e.name] : s[e.name] = e.value;
+	return i.headers?.cookie === void 0 && (o.cookie = Tr(s)), {
+		headers: o,
+		cookies: s,
+		setCookies: a
+	};
+}, Q = z({ scope: "voltro:dev:web" }), Mr = z({ scope: "vite" }), Nr = await (async () => {
 	try {
-		let e = O(D(R(import.meta.url)), "..", "package.json"), t = await M.readFile(e, "utf8");
+		let e = O(D(te(import.meta.url)), "..", "package.json"), t = await M.readFile(e, "utf8");
 		return JSON.parse(t).version ?? "0.0.0";
 	} catch {
 		return "0.0.0";
 	}
-})(), gr = async () => {
+})(), Pr = async () => {
 	try {
-		let e = D(R(import.meta.url)), t = A(e, "..", "..", "devtools");
+		let e = D(te(import.meta.url)), t = A(e, "..", "..", "devtools");
 		if (j(O(t, "package.json"))) return t;
 		let n = A(e, "..", "..", "..", "devtools");
 		return j(O(n, "package.json")) ? n : null;
 	} catch {
 		return null;
 	}
-}, _r = (e, t) => e.disableDevtools || !t ? [] : [
+}, Fr = (e, t) => e.disableDevtools || !t ? [] : [
 	"",
 	"// Dev-only in-page devtools overlay. The `import.meta.env.DEV` guard is a",
 	"// compile-time constant, so prod builds strip this whole `if` block — the",
@@ -1561,12 +1683,12 @@ import {
 	"  await import('@voltro/devtools/styles.css')",
 	"  Devtools = (await import('@voltro/devtools')).VoltroDevtools",
 	"}"
-], vr = (e, t) => e.disableDevtools || !t ? [] : ["  ...(Devtools ? { Devtools } : {}),"], yr = (e) => e.sentry ? ["import { initSentryBrowser } from '@voltro/plugin-sentry/web'"] : [], br = (e) => e.sentry ? [
+], Ir = (e, t) => e.disableDevtools || !t ? [] : ["  ...(Devtools ? { Devtools } : {}),"], Lr = (e) => e.sentry ? ["import { initSentryBrowser } from '@voltro/plugin-sentry/web'"] : [], Rr = (e) => e.sentry ? [
 	"",
 	"// Browser-side Sentry (frontend half of the deep integration). Errors +",
 	"// browser rpc spans flow to Sentry, sharing the server transactions' trace.",
 	`await initSentryBrowser(${JSON.stringify(e.sentry)})`
-] : [], xr = (e) => e.env ? ["import './env.public'"] : [], Sr = (e) => {
+] : [], zr = (e) => e.env ? ["import './env.public'"] : [], Br = (e) => {
 	let t = [], n = A(e);
 	for (;;) {
 		j(O(n, "pnpm-workspace.yaml")) && t.push(n);
@@ -1575,14 +1697,14 @@ import {
 		n = e;
 	}
 	return t;
-}, Cr = b, wr = (e) => {
+}, Vr = b, Hr = (e) => {
 	if (/\/node_modules\/(?:\.pnpm\/[^/]+\/node_modules\/)?(?:react|react-dom|scheduler)\//.test(e)) return "react";
 	let t = /\/([^/]+)\.island\.tsx?$/.exec(e);
 	if (t) return `island-${t[1]}`;
-}, Tr = /export\s+(?:async\s+)?(?:const|function|let|var)\s+loader\b/, Er = (e) => e.startsWith("(") && e.endsWith(")"), Dr = (e) => e.filter((e) => !Er(e)), Or = (e) => {
-	let t = e.replace(c, "").split("/").filter(Boolean).filter((e) => !Er(e));
+}, Ur = /export\s+(?:async\s+)?(?:const|function|let|var)\s+loader\b/, Wr = (e) => e.startsWith("(") && e.endsWith(")"), Gr = (e) => e.filter((e) => !Wr(e)), Kr = (e) => {
+	let t = e.replace(c, "").split("/").filter(Boolean).filter((e) => !Wr(e));
 	return t.length === 0 ? "/" : "/" + t.join("/");
-}, kr = (e) => `${e.replace(c, "").split("/").filter(Boolean).map((e) => e.replace(/[()]/g, "").replace(/\[\.\.\./g, "_rest_").replace(/[[\]]/g, "_")).map((e) => e.charAt(0).toUpperCase() + e.slice(1)).join("").replace(/[^A-Za-z0-9_]/g, "_") || "Index"}Page`, Q = (e, t) => e === "" ? `Root${t}` : `${e.split("/").filter(Boolean).map((e) => e.replace(/[()]/g, "").replace(/\[\.\.\./g, "_rest_").replace(/[[\]]/g, "_")).map((e) => e.charAt(0).toUpperCase() + e.slice(1)).join("").replace(/[^A-Za-z0-9_]/g, "_") || "Root"}${t}`, $ = async (e) => {
+}, qr = (e) => `${e.replace(c, "").split("/").filter(Boolean).map((e) => e.replace(/[()]/g, "").replace(/\[\.\.\./g, "_rest_").replace(/[[\]]/g, "_")).map((e) => e.charAt(0).toUpperCase() + e.slice(1)).join("").replace(/[^A-Za-z0-9_]/g, "_") || "Index"}Page`, $ = (e, t) => e === "" ? `Root${t}` : `${e.split("/").filter(Boolean).map((e) => e.replace(/[()]/g, "").replace(/\[\.\.\./g, "_rest_").replace(/[[\]]/g, "_")).map((e) => e.charAt(0).toUpperCase() + e.slice(1)).join("").replace(/[^A-Za-z0-9_]/g, "_") || "Root"}${t}`, Jr = async (e) => {
 	let t = [], n = [], r = async (e, i) => {
 		let a = [];
 		try {
@@ -1590,17 +1712,17 @@ import {
 		} catch {
 			return;
 		}
-		let o = a.filter((e) => e.isDirectory()).map((e) => e.name).sort(), l = a.filter((e) => e.isFile() && e.name.endsWith(".tsx") && !Cr(e.name)).map((e) => e.name).sort(), u = new Set(l), d = i.join("/");
+		let o = a.filter((e) => e.isDirectory()).map((e) => e.name).sort(), l = a.filter((e) => e.isFile() && e.name.endsWith(".tsx") && !Vr(e.name)).map((e) => e.name).sort(), u = new Set(l), d = i.join("/");
 		if (l.some((e) => s.has(e))) {
 			let t = u.has("layout.tsx"), r = !1;
 			if (t) try {
 				let t = await M.readFile(O(e, "layout.tsx"), "utf8");
-				r = Tr.test(t);
+				r = Ur.test(t);
 			} catch {}
 			n.push({
 				dir: d,
 				chain: i,
-				contributesToUrl: i.length === 0 || !Er(i[i.length - 1]),
+				contributesToUrl: i.length === 0 || !Wr(i[i.length - 1]),
 				hasLayout: t,
 				hasLayoutLoader: r,
 				hasError: u.has("error.tsx"),
@@ -1614,8 +1736,8 @@ import {
 			let n = d ? `${d}/${e}` : e;
 			t.push({
 				file: n,
-				pattern: Or(n),
-				ident: kr(n),
+				pattern: Kr(n),
+				ident: qr(n),
 				dirChain: i
 			});
 		}
@@ -1634,14 +1756,14 @@ import {
 		dirs: a,
 		orphanedSpecials: o
 	};
-}, Ar = (e, t) => {
+}, Yr = (e, t) => {
 	let n = [];
 	for (let r = 0; r <= t.length; r++) {
 		let i = t.slice(0, r).join("/"), a = e.find((e) => e.dir === i);
 		a && n.push(a);
 	}
 	return n;
-}, jr = async (e) => {
+}, Xr = async (e) => {
 	let { entries: t, loadLayout: n, loadError: r, loadPending: i, ctx: a } = e, o = {};
 	return {
 		chain: await Promise.all(t.map(async (e, t) => {
@@ -1665,10 +1787,10 @@ import {
 		})),
 		segmentLoaderData: o
 	};
-}, Mr = (e) => {
-	let t = Dr(e);
+}, Zr = (e) => {
+	let t = Gr(e);
 	return t.length === 0 ? "" : "/" + t.join("/");
-}, Nr = [
+}, Qr = [
 	"// Hot-reload bridge: keep SSR-injected <link rel=\"stylesheet\"> tags",
 	"// in sync with Vite's CSS HMR. Without this, edits to .css files",
 	"// only update the JS-injected <style> overlay; the underlying <link>",
@@ -1761,7 +1883,7 @@ import {
 	"    _vdtErrorStart('Build error')",
 	"  })",
 	"}"
-].join("\n"), Pr = (e) => {
+].join("\n"), $r = (e) => {
 	let t = [], n = 0, r = e.split("/").filter(Boolean), i = [];
 	for (let e of r) e.startsWith("[[...") && e.endsWith("]]") ? (i.push("(.*)"), t.push(e.slice(5, -2)), n += 2) : e.startsWith("[...") && e.endsWith("]") ? (i.push("(.+)"), t.push(e.slice(4, -1)), n += 3) : e.startsWith("[") && e.endsWith("]") ? (i.push("([^/]+)"), t.push(e.slice(1, -1)), n += 1) : i.push(e.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
 	let a = i.join("/");
@@ -1770,8 +1892,8 @@ import {
 		paramNames: t,
 		priority: n
 	};
-}, Fr = (e) => e.map((e) => {
-	let { regex: t, paramNames: n, priority: r } = Pr(e.pattern);
+}, ei = (e) => e.map((e) => {
+	let { regex: t, paramNames: n, priority: r } = $r(e.pattern);
 	return {
 		pattern: e.pattern,
 		file: e.file,
@@ -1780,7 +1902,7 @@ import {
 		paramNames: n,
 		priority: r
 	};
-}).slice().sort((e, t) => e.priority - t.priority), Ir = (e, t) => {
+}).slice().sort((e, t) => e.priority - t.priority), ti = (e, t) => {
 	for (let n of t) {
 		let t = n.regex.exec(e);
 		if (!t) continue;
@@ -1792,9 +1914,9 @@ import {
 		};
 	}
 	return null;
-}, Lr = Ee, Rr = async (e) => {
+}, ni = J, ri = async (e) => {
 	try {
-		let t = await import(z(O(e, "app.config.ts")).href), n = t.default?.port, i = r({
+		let t = await import(L(O(e, "app.config.ts")).href), n = t.default?.port, i = r({
 			kind: "api",
 			configPort: typeof n == "number" ? n : void 0,
 			env: {}
@@ -1808,7 +1930,7 @@ import {
 		kind: "api",
 		env: {}
 	}).port };
-}, zr = (e, t) => ({
+}, ii = (e, t) => ({
 	name: e,
 	pkg: t.package,
 	browserWsUrl: t.url,
@@ -1816,7 +1938,7 @@ import {
 	...t.serverUrl ? { serverOrigin: t.serverUrl } : {},
 	...t.headers ? { headers: t.headers } : {},
 	...t.authHeaders ? { hasAuthHeaders: !0 } : {}
-}), Br = (e, t, n) => {
+}), ai = (e, t, n) => {
 	let r = t.transport?.wsPath ?? n.wsPath;
 	return {
 		name: e,
@@ -1828,7 +1950,7 @@ import {
 		...t.headers ? { headers: t.headers } : {},
 		...t.authHeaders ? { hasAuthHeaders: !0 } : {}
 	};
-}, Vr = (e) => {
+}, oi = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e) {
 		if (n.proxyTarget === void 0) continue;
@@ -1836,43 +1958,43 @@ import {
 		if (e) throw Error(`[voltro] api ${JSON.stringify(n.name)} and ${JSON.stringify(e)} both resolve the same-origin WS path ${JSON.stringify(n.browserWsUrl)}. A custom transport.wsPath must be unique per origin (one api per origin may use a fixed path). Give each a distinct wsPath, or drop the override to use the default /ws/<name>.`);
 		t.set(n.browserWsUrl, n.name);
 	}
-}, Hr = async (e, t) => {
+}, si = async (e, t) => {
 	let n = Object.entries(t.apis ?? {}), r = [];
 	for (let [t, i] of n) {
 		if (i.url) {
-			r.push(zr(t, i));
+			r.push(ii(t, i));
 			continue;
 		}
-		let n = await Lr(e, i.package);
+		let n = await ni(e, i.package);
 		if (!n) throw Error(`[voltro dev] api ${JSON.stringify(t)} (package ${JSON.stringify(i.package)}) is not a workspace dep and has no \`url\` set in app.config.ts. External apis need an explicit \`url\` because the framework can't discover their dev port.`);
-		r.push(Br(t, i, await Rr(n)));
+		r.push(ai(t, i, await ri(n)));
 	}
-	return Vr(r), r;
-}, Ur = (e) => {
+	return oi(r), r;
+}, ci = (e) => {
 	if (!(!/^wss?:\/\//.test(e) && !/^https?:\/\//.test(e))) try {
 		let t = new URL(e);
 		return t.protocol = t.protocol === "wss:" || t.protocol === "https:" ? "https:" : "http:", `${t.protocol}//${t.host}`;
 	} catch {
 		return;
 	}
-}, Wr = (e) => `VOLTRO_API_ORIGIN_${e.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, Gr = (e) => process.env[Wr(e)] ?? process.env.VOLTRO_API_ORIGIN, Kr = (e, t) => {
+}, li = (e) => `VOLTRO_API_ORIGIN_${e.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, ui = (e) => process.env[li(e)] ?? process.env.VOLTRO_API_ORIGIN, di = (e, t) => {
 	if (!e) return;
-	let n = Gr(e.name) ?? e.serverOrigin;
+	let n = ui(e.name) ?? e.serverOrigin;
 	if (n) {
-		let e = Ur(n);
+		let e = ci(n);
 		if (e) return e;
 	}
 	if (t?.allowDevProxy && e.proxyTarget) {
-		let t = Ur(e.proxyTarget);
+		let t = ci(e.proxyTarget);
 		if (t) return t;
 	}
-	if (!e.proxyTarget && /^wss?:\/\//.test(e.browserWsUrl)) return Ur(e.browserWsUrl);
-}, qr = (e, t, n) => {
+	if (!e.proxyTarget && /^wss?:\/\//.test(e.browserWsUrl)) return ci(e.browserWsUrl);
+}, fi = (e, t, n) => {
 	if (!e) {
 		if (n?.apiName === void 0) return;
 		let e = n.apiName;
 		return async () => {
-			throw Error(`[loader.query] api '${e}' has no server-side origin for SSR. In a split web/api deployment the web pod reaches the api by internal DNS, not the browser's relative wsPath — set ${Wr(e)} (or VOLTRO_API_ORIGIN, or apis.${e}.serverUrl in app.config.ts) to the api's internal origin, e.g. http://api.<namespace>.svc.cluster.local. The browser transport is unaffected.`);
+			throw Error(`[loader.query] api '${e}' has no server-side origin for SSR. In a split web/api deployment the web pod reaches the api by internal DNS, not the browser's relative wsPath — set ${li(e)} (or VOLTRO_API_ORIGIN, or apis.${e}.serverUrl in app.config.ts) to the api's internal origin, e.g. http://api.<namespace>.svc.cluster.local. The browser transport is unaffected.`);
 		};
 	}
 	return async (r, i) => {
@@ -1888,13 +2010,14 @@ import {
 				method: "POST",
 				headers: {
 					"content-type": "application/json",
-					...t ? { cookie: t } : {}
+					...t ? { cookie: t } : {},
+					...Object.fromEntries(Object.entries(n?.headers ?? {}).filter(([e]) => e === "authorization" || e.startsWith("x-voltro-") || e === "x-tenant"))
 				},
 				body: JSON.stringify(a)
 			});
 		} catch (t) {
 			let i = t?.cause?.code ?? String(t?.message ?? t);
-			throw Error(`[loader.query] ${r}: could not reach the api at ${e}/rpc (${i}). ${n?.apiName ? `Set ${Wr(n.apiName)} / VOLTRO_API_ORIGIN` : "Set the api server origin"} to the api's SSR-reachable origin (internal cluster DNS in a split deployment).`, { cause: t });
+			throw Error(`[loader.query] ${r}: could not reach the api at ${e}/rpc (${i}). ${n?.apiName ? `Set ${li(n.apiName)} / VOLTRO_API_ORIGIN` : "Set the api server origin"} to the api's SSR-reachable origin (internal cluster DNS in a split deployment).`, { cause: t });
 		}
 		if (!o.ok) throw Error(`[loader.query] ${r}: HTTP ${o.status} ${await o.text()}`);
 		let s = await o.json();
@@ -1924,8 +2047,8 @@ import {
 		}
 		if (u) return l;
 	};
-}, Jr = async (e, t, n, r = {}) => {
-	let i = t.title ?? t.name ?? "app", a = t.theme === "dark" ? " class=\"dark\"" : t.theme === "light" ? " class=\"light\"" : "", o = j(O(e, "node_modules", "@voltro", "devtools", "package.json")) || await gr() !== null, s = t.theme === "system" ? [
+}, pi = async (e, t, n, r = {}) => {
+	let i = t.title ?? t.name ?? "app", a = t.theme === "dark" ? " class=\"dark\"" : t.theme === "light" ? " class=\"light\"" : "", o = j(O(e, "node_modules", "@voltro", "devtools", "package.json")) || await Pr() !== null, s = t.theme === "system" ? [
 		"    <script>",
 		"      (function () {",
 		"        var root = document.documentElement",
@@ -1963,9 +2086,9 @@ import {
 		"  </body>",
 		"</html>",
 		""
-	].join("\n"), l = O(e, "src", "pages"), { pages: u, dirs: d, orphanedSpecials: f } = await $(l);
+	].join("\n"), l = O(e, "src", "pages"), { pages: u, dirs: d, orphanedSpecials: f } = await Jr(l);
 	await y(l, u);
-	for (let e of f) Z.warn(`src/pages/${e.dir || "."}/ contains ${e.files.join(", ")} but no page.tsx at or below it — ${e.files.length > 1 ? "those files are" : "that file is"} inert. A layout/error/loading/not-found file only applies to routes in its own directory tree; if this is an ordinary component, rename it so it does not read as a route boundary.`);
+	for (let e of f) Q.warn(`src/pages/${e.dir || "."}/ contains ${e.files.join(", ")} but no page.tsx at or below it — ${e.files.length > 1 ? "those files are" : "that file is"} inert. A layout/error/loading/not-found file only applies to routes in its own directory tree; if this is an ordinary component, rename it so it does not read as a route boundary.`);
 	let p = (e) => `${e.replace(/[^a-zA-Z0-9]/g, "_")}AppGroup`, m = (e) => `${e.replace(/[^a-zA-Z0-9]/g, "_")}AppDescriptors`, h = n.map((e) => `import { appGroup as ${p(e.name)}, appDescriptors as ${m(e.name)} } from '${e.pkg}/rpcGroup'`);
 	n.some((e) => e.hasAuthHeaders) && (h.push("import __voltroAppConfig from '../app.config'"), h.push("const __voltroAuthHeaders = (__voltroAppConfig as { readonly apis?: Record<string, { readonly authHeaders?: () => Record<string, string> | Promise<Record<string, string>> }> }).apis"));
 	let g = n.map((e) => {
@@ -1976,16 +2099,16 @@ import {
 		let n = u.map((e) => `  ${JSON.stringify(e.pattern)}: () => import('../src/pages/${e.file}'),`), r = [];
 		for (let e of d) {
 			let t = e.dir === "" ? "../src/pages" : `../src/pages/${e.dir}`;
-			e.hasLayout && e.hasLayoutLoader ? r.push(`import * as ${Q(e.dir, "Layout")}Mod from '${t}/layout.tsx'`) : e.hasLayout && r.push(`import ${Q(e.dir, "Layout")}   from '${t}/layout.tsx'`), e.hasError && r.push(`import ${Q(e.dir, "Error")}    from '${t}/error.tsx'`), e.hasPending && r.push(`import ${Q(e.dir, "Pending")}  from '${t}/loading.tsx'`), e.hasNotFound && r.push(`import ${Q(e.dir, "NotFound")} from '${t}/not-found.tsx'`);
+			e.hasLayout && e.hasLayoutLoader ? r.push(`import * as ${$(e.dir, "Layout")}Mod from '${t}/layout.tsx'`) : e.hasLayout && r.push(`import ${$(e.dir, "Layout")}   from '${t}/layout.tsx'`), e.hasError && r.push(`import ${$(e.dir, "Error")}    from '${t}/error.tsx'`), e.hasPending && r.push(`import ${$(e.dir, "Pending")}  from '${t}/loading.tsx'`), e.hasNotFound && r.push(`import ${$(e.dir, "NotFound")} from '${t}/not-found.tsx'`);
 		}
 		let i = u.map((e) => {
-			let t = Ar(d, e.dirChain).map((e) => {
+			let t = Yr(d, e.dirChain).map((e) => {
 				let t = [`id: ${JSON.stringify(e.dir || "/")}`], n = JSON.stringify(e.dir);
 				return e.hasLayout && t.push(`Layout:  refs.layouts[${n}]`), e.hasLayoutLoader && t.push(`loader:  refs.layoutLoaders[${n}]`), e.hasError && t.push(`Error:   refs.errors[${n}]`), e.hasPending && t.push(`Pending: refs.pendings[${n}]`), `      { ${t.join(", ")} }`;
 			}).join(",\n");
 			return `    makePageRoute(${JSON.stringify(e.pattern)}, ${t.length > 0 ? `[\n${t},\n    ]` : "undefined"}),`;
 		}), a = d.filter((e) => e.hasNotFound).map((e) => {
-			let t = Mr(e.chain), n = Ar(d, e.chain).map((e) => {
+			let t = Zr(e.chain), n = Yr(d, e.chain).map((e) => {
 				let t = [`id: ${JSON.stringify(e.dir || "/")}`], n = JSON.stringify(e.dir);
 				return e.hasLayout && t.push(`Layout: refs.layouts[${n}]`), e.hasError && t.push(`Error:  refs.errors[${n}]`), `        { ${t.join(", ")} }`;
 			}).join(",\n"), r = n.length > 0 ? `\n      chain: [\n${n},\n      ],` : "";
@@ -1993,23 +2116,23 @@ import {
 		}), s = [], c = [], l = [], f = [], p = [], m = [];
 		for (let e of d) {
 			let t = e.dir === "" ? "../src/pages/layout.tsx" : `../src/pages/${e.dir}/layout.tsx`, n = e.dir === "" ? "../src/pages/error.tsx" : `../src/pages/${e.dir}/error.tsx`, r = e.dir === "" ? "../src/pages/loading.tsx" : `../src/pages/${e.dir}/loading.tsx`, i = e.dir === "" ? "../src/pages/not-found.tsx" : `../src/pages/${e.dir}/not-found.tsx`, a = JSON.stringify(e.dir);
-			e.hasLayout && e.hasLayoutLoader ? (c.push(`  ${a}: ${Q(e.dir, "Layout")}Mod.default,`), l.push(`  ${a}: ${Q(e.dir, "Layout")}Mod.loader,`), s.push({
+			e.hasLayout && e.hasLayoutLoader ? (c.push(`  ${a}: ${$(e.dir, "Layout")}Mod.default,`), l.push(`  ${a}: ${$(e.dir, "Layout")}Mod.loader,`), s.push({
 				relPath: t,
 				kind: "layout",
 				slotKey: e.dir
-			})) : e.hasLayout && (c.push(`  ${a}: ${Q(e.dir, "Layout")},`), s.push({
+			})) : e.hasLayout && (c.push(`  ${a}: ${$(e.dir, "Layout")},`), s.push({
 				relPath: t,
 				kind: "layout",
 				slotKey: e.dir
-			})), e.hasError && (f.push(`  ${a}: ${Q(e.dir, "Error")},`), s.push({
+			})), e.hasError && (f.push(`  ${a}: ${$(e.dir, "Error")},`), s.push({
 				relPath: n,
 				kind: "error",
 				slotKey: e.dir
-			})), e.hasPending && (p.push(`  ${a}: ${Q(e.dir, "Pending")},`), s.push({
+			})), e.hasPending && (p.push(`  ${a}: ${$(e.dir, "Pending")},`), s.push({
 				relPath: r,
 				kind: "pending",
 				slotKey: e.dir
-			})), e.hasNotFound && (m.push(`  ${a}: ${Q(e.dir, "NotFound")},`), s.push({
+			})), e.hasNotFound && (m.push(`  ${a}: ${$(e.dir, "NotFound")},`), s.push({
 				relPath: i,
 				kind: "notFound",
 				slotKey: e.dir
@@ -2024,7 +2147,7 @@ import {
 			let n = JSON.stringify(e.slotKey);
 			return e.kind === "page" ? `      if (newMods[${t}] && refs.pages[${n}] !== undefined) { refs.pages[${n}] = newMods[${t}]; changed = true }` : `      if (newMods[${t}]?.default) { refs.${e.kind === "layout" ? "layouts" : e.kind === "error" ? "errors" : e.kind === "pending" ? "pendings" : "notFounds"}[${n}] = newMods[${t}].default;${e.kind === "layout" ? ` refs.layoutLoaders[${n}] = newMods[${t}].loader;` : ""} changed = true }`;
 		}), S = t.locales ?? [], C = S.length > 0 && S.every((t) => j(O(e, "src", "locales", `${t}.ts`)) || j(O(e, "src", "locales", `${t}.tsx`))), w = C, T = t.defaultLocale ?? S[0] ?? "en";
-		if (S.length > 0 && !C && Z.info(`i18n: locales [${S.join(", ")}] declared with no src/locales/<code>.ts — using them for <html lang> and the resolved locale only. Add the catalogs to get <I18nProvider> wired, or keep your own i18n stack.`), S.length > 0 && !S.includes(T)) throw Error(`[voltro dev] app.config.ts: defaultLocale '${T}' must be one of locales [${S.join(", ")}]`);
+		if (S.length > 0 && !C && Q.info(`i18n: locales [${S.join(", ")}] declared with no src/locales/<code>.ts — using them for <html lang> and the resolved locale only. Add the catalogs to get <I18nProvider> wired, or keep your own i18n stack.`), S.length > 0 && !S.includes(T)) throw Error(`[voltro dev] app.config.ts: defaultLocale '${T}' must be one of locales [${S.join(", ")}]`);
 		let E = w ? [
 			"import { I18nProvider } from '@voltro/i18n'",
 			"import { resolveLocale } from '@voltro/i18n/server'",
@@ -2241,14 +2364,14 @@ import {
 			"// resolved apis map. Side-effect only — no local component definitions —",
 			"// so downstream invalidations (user page edits) terminate at app.tsx.",
 			"",
-			...xr(t),
+			...zr(t),
 			"import { mount } from '@voltro/web'",
 			...h,
 			"import { App } from './app'",
 			"import { preloadCurrentRoute } from './routeTable'",
-			...yr(t),
-			..._r(t, o),
-			...br(t),
+			...Lr(t),
+			...Fr(t, o),
+			...Rr(t),
 			"",
 			"// Preload the current route's page chunk BEFORE hydration so the first",
 			"// client render matches the SSG/SSR-prerendered HTML. Without it, a lazy",
@@ -2265,10 +2388,10 @@ import {
 			"  apis: {",
 			...g,
 			"  },",
-			...vr(t, o),
+			...Ir(t, o),
 			"})",
 			"",
-			Nr
+			Qr
 		].join("\n");
 	} else _ = "", v = "", b = [
 		"// GENERATED BY `voltro dev` — do not edit; will be overwritten on next boot.",
@@ -2276,25 +2399,25 @@ import {
 		"// and calls mount(). Side-effect only, no component definitions, so the",
 		"// user's component file remains the Fast Refresh boundary.",
 		"",
-		...xr(t),
+		...zr(t),
 		"import { mount } from '@voltro/web'",
 		...h,
 		"import App from '../src/App'",
-		...yr(t),
-		..._r(t, o),
-		...br(t),
+		...Lr(t),
+		...Fr(t, o),
+		...Rr(t),
 		"",
 		"mount(App, {",
 		"  apis: {",
 		...g,
 		"  },",
-		...vr(t, o),
+		...Ir(t, o),
 		"})",
 		"",
-		Nr
+		Qr
 	].join("\n");
 	let x = O(e, ".framework");
-	await M.mkdir(x, { recursive: !0 }), t.env ? await xe(x, r) : await M.rm(O(x, "env.public.ts"), { force: !0 }), await M.writeFile(O(x, "index.html"), c, "utf8"), await M.writeFile(O(x, "main.tsx"), b, "utf8"), _ ? (await M.writeFile(O(x, "app.tsx"), _, "utf8"), await M.writeFile(O(x, "routeTable.ts"), v, "utf8")) : (await M.rm(O(x, "app.tsx"), { force: !0 }), await M.rm(O(x, "routeTable.ts"), { force: !0 }));
+	await M.mkdir(x, { recursive: !0 }), t.env ? await Se(x, r) : await M.rm(O(x, "env.public.ts"), { force: !0 }), await M.writeFile(O(x, "index.html"), c, "utf8"), await M.writeFile(O(x, "main.tsx"), b, "utf8"), _ ? (await M.writeFile(O(x, "app.tsx"), _, "utf8"), await M.writeFile(O(x, "routeTable.ts"), v, "utf8")) : (await M.rm(O(x, "app.tsx"), { force: !0 }), await M.rm(O(x, "routeTable.ts"), { force: !0 }));
 	let S = O(e, ".gitignore"), C = "";
 	try {
 		C = await M.readFile(S, "utf8");
@@ -2305,41 +2428,41 @@ import {
 		try {
 			await M.appendFile(S, `${e}${E.join("\n")}\n`, "utf8");
 		} catch (e) {
-			Z.warn(`could not add ${E.join(", ")} to ${S} — add it by hand so the generated directory stays out of git. The build is unaffected.`, { reason: e?.message ?? String(e) });
+			Q.warn(`could not add ${E.join(", ")} to ${S} — add it by hand so the generated directory stays out of git. The build is unaffected.`, { reason: e?.message ?? String(e) });
 		}
 	}
-}, Yr = async (e, t) => {
+}, mi = async (e, t) => {
 	try {
 		let n = D(e), r = O(n, "project.json");
 		if (!j(r)) return;
 		let i = await M.readFile(r, "utf8"), a = JSON.parse(i).apps ?? {}, o = e.split("/").filter(Boolean).pop() ?? "", s = [];
 		for (let [e, n] of Object.entries(a)) e !== o && n.port === t && s.push(e);
 		if (s.length === 0) return;
-		Z.warn("sibling app(s) claim the same port — only one boots", {
+		Q.warn("sibling app(s) claim the same port — only one boots", {
 			port: t,
 			conflicts: s,
 			projectJson: r
 		});
 	} catch {}
-}, Xr = (e) => O(e, ".framework", "dist", "server", "appConfig.js"), Zr = async (e, t = {}) => {
-	let n = Xr(e), r = t.preferSource !== !0 && j(n) ? n : O(e, "app.config.ts");
+}, hi = (e) => O(e, ".framework", "dist", "server", "appConfig.js"), gi = async (e, t = {}) => {
+	let n = hi(e), r = t.preferSource !== !0 && j(n) ? n : O(e, "app.config.ts");
 	try {
-		let e = (await import(z(r).href)).default;
+		let e = (await import(L(r).href)).default;
 		return typeof e == "object" && e && "type" in e && e.type === "web" ? e : null;
 	} catch {
 		return null;
 	}
-}, Qr = async (e) => {
-	let n = await Zr(e, { preferSource: !0 });
+}, _i = async (e) => {
+	let n = await gi(e, { preferSource: !0 });
 	if (!n) return {
 		ran: !1,
 		exitCode: 0
 	};
 	ln();
-	let i = Ct();
-	Vt(i), Z.info("booting voltro dev (web)", { app: n.name ?? "(unnamed)" }), Ge(e, Z);
-	let a = await Hr(e, n);
-	for (let e of a) Z.info("api wired", {
+	let i = St();
+	Bt(i), Q.info("booting voltro dev (web)", { app: n.name ?? "(unnamed)" }), We(e, Q);
+	let a = await si(e, n);
+	for (let e of a) Q.info("api wired", {
 		name: e.name,
 		pkg: e.pkg,
 		...e.proxyTarget ? { proxyTo: e.proxyTarget } : { directWs: e.browserWsUrl }
@@ -2347,17 +2470,17 @@ import {
 	g(e).then((e) => {
 		for (let t of e.files) if (t.action === "created") {
 			let e = t.path.split("/").pop() ?? t.path;
-			Z.info(`${e} seeded`, { path: t.path });
+			Q.info(`${e} seeded`, { path: t.path });
 		}
 	}).catch(() => {});
-	let { resolved: o } = await Se({
+	let { resolved: o } = await Ce({
 		rawEnv: n.env,
 		appType: "web",
 		root: e,
-		log: Z,
+		log: Q,
 		generateTypes: !0
 	}), s = o.publicValues;
-	await Jr(e, n, a, s), Z.debug("generated framework entry files", { files: [
+	await pi(e, n, a, s), Q.debug("generated framework entry files", { files: [
 		"index.html",
 		".framework/main.tsx",
 		...n.env ? [".framework/env.public.ts"] : []
@@ -2368,7 +2491,7 @@ import {
 		env: process.env,
 		dashboardPin: process.env[Tn] === "1"
 	});
-	for (let e of c.warnings) Z.warn(e);
+	for (let e of c.warnings) Q.warn(e);
 	let l = c.port, y = n.name ?? "unnamed", b = w("web", y, l), D = T(y);
 	await x({
 		id: b,
@@ -2378,22 +2501,22 @@ import {
 		pid: process.pid,
 		status: "booting",
 		logFile: D.path
-	}).catch(() => {}), await Yr(e, l);
-	let { pages: N, dirs: P } = await $(O(e, "src", "pages")), F = {
+	}).catch(() => {}), await mi(e, l);
+	let { pages: N, dirs: P } = await Jr(O(e, "src", "pages")), F = {
 		dirs: P,
-		ssrRoutes: Fr(N)
-	}, I = P.map((e) => ({
+		ssrRoutes: ei(N)
+	}, ee = P.map((e) => ({
 		dir: e.dir,
 		hasLayout: e.hasLayout,
 		hasError: e.hasError,
 		hasPending: e.hasPending,
 		hasNotFound: e.hasNotFound
-	})), L = await ht({
+	})), I = await mt({
 		appRoot: e,
 		pages: N
 	});
-	L.wrote && Z.debug("routes codegen wrote", { path: k(e, L.path) });
-	let R = await he("vite", () => import("vite")), z = (await import("@vitejs/plugin-react")).default, B = (await import("@tailwindcss/vite")).default, V = O(e, ".framework"), te = O(e, "src"), H = /* @__PURE__ */ new Set([
+	I.wrote && Q.debug("routes codegen wrote", { path: k(e, I.path) });
+	let te = await _e("vite", () => import("vite")), L = (await import("@vitejs/plugin-react")).default, R = (await import("@tailwindcss/vite")).default, z = O(e, ".framework"), B = O(e, "src"), V = /* @__PURE__ */ new Set([
 		".framework",
 		"node_modules",
 		"dist",
@@ -2401,156 +2524,166 @@ import {
 		".vite",
 		".turbo",
 		".cache"
-	]), U = {
+	]), re = {
 		name: "framework:watch-app-sources",
 		async configureServer(t) {
 			try {
-				let n = (await M.readdir(e, { withFileTypes: !0 })).filter((e) => e.isDirectory() && !H.has(e.name));
+				let n = (await M.readdir(e, { withFileTypes: !0 })).filter((e) => e.isDirectory() && !V.has(e.name));
 				for (let r of n) t.watcher.add(O(e, r.name));
-				n.length === 0 && t.watcher.add(te);
+				n.length === 0 && t.watcher.add(B);
 			} catch {
-				t.watcher.add(te);
+				t.watcher.add(B);
 			}
 			for (let n of await De(e)) t.watcher.add(n.dir);
 		}
-	}, W = O(e, "src", "pages"), ne = (e) => e.endsWith(".tsx") && (e === W || e.startsWith(W + "/")), G = (e) => e === W || e.startsWith(W + "/"), re = async (t) => {
+	}, H = O(e, "src", "pages"), U = (e) => e.endsWith(".tsx") && (e === H || e.startsWith(H + "/")), ie = (e) => e === H || e.startsWith(H + "/"), W = async (t) => {
 		try {
 			let r = Date.now();
-			await Jr(e, n, a, s);
-			let { pages: i, dirs: o } = await $(W);
-			await ht({
+			await pi(e, n, a, s);
+			let { pages: i, dirs: o } = await Jr(H);
+			await mt({
 				appRoot: e,
 				pages: i
-			}), F.dirs = o, F.ssrRoutes = Fr(i), Z.info("page tree regenerated", {
+			}), F.dirs = o, F.ssrRoutes = ei(i), Q.info("page tree regenerated", {
 				reason: t,
 				ms: Date.now() - r,
 				routes: F.ssrRoutes.length
 			});
+			for (let e of Sr(X, F.ssrRoutes.map((e) => e.pattern))) Q.error(`middleware.ts: ${e.message}`);
 		} catch (e) {
-			Z.error("page tree regen failed", { reason: t }, e);
+			Q.error("page tree regen failed", { reason: t }, e);
 		}
-	}, ie = {
+	}, ae = {
 		name: "framework:regenerate-on-page-tree-change",
 		configureServer(t) {
 			let n = null, r = [], i = (e) => {
 				r.push(e), n && clearTimeout(n), n = setTimeout(() => {
 					n = null;
 					let e = r.length === 1 ? r[0] : `${r.length} events (${r[0]}, …)`;
-					r.length = 0, re(e);
+					r.length = 0, W(e);
 				}, 50);
 			};
 			t.watcher.on("add", (t) => {
-				ne(t) && i(`add ${k(e, t)}`);
+				U(t) && i(`add ${k(e, t)}`);
 			}), t.watcher.on("unlink", (t) => {
-				ne(t) && i(`unlink ${k(e, t)}`);
+				U(t) && i(`unlink ${k(e, t)}`);
 			}), t.watcher.on("addDir", (t) => {
-				G(t) && i(`addDir ${k(e, t)}`);
+				ie(t) && i(`addDir ${k(e, t)}`);
 			}), t.watcher.on("unlinkDir", (t) => {
-				G(t) && i(`unlinkDir ${k(e, t)}`);
+				ie(t) && i(`unlinkDir ${k(e, t)}`);
 			});
 		}
-	}, K = O(e, "app.config.ts"), oe = (e) => {
-		if (!ae(e.env)) return "";
+	}, G = O(e, "app.config.ts"), se = (e) => {
+		if (!oe(e.env)) return "";
 		let t = Object.entries(e.env.vars).map(([e, t]) => `${e}:${t.access}`).sort();
 		return `${String(e.env.publicPrefix)}|${t.join(",")}`;
-	}, se = (e, t) => {
+	}, ce = (e, t) => {
 		let n = [];
-		return e.port !== t.port && n.push(`port ${e.port ?? "(default)"} → ${t.port ?? "(default)"}`), JSON.stringify(e.proxies) !== JSON.stringify(t.proxies) && n.push("proxies"), JSON.stringify(e.allowedHosts) !== JSON.stringify(t.allowedHosts) && n.push("allowedHosts"), JSON.stringify(e.apis) !== JSON.stringify(t.apis) && n.push("apis"), oe(e) !== oe(t) && n.push("env"), n;
-	}, ce = n, le = A(K), ue = {
+		return e.port !== t.port && n.push(`port ${e.port ?? "(default)"} → ${t.port ?? "(default)"}`), JSON.stringify(e.proxies) !== JSON.stringify(t.proxies) && n.push("proxies"), JSON.stringify(e.allowedHosts) !== JSON.stringify(t.allowedHosts) && n.push("allowedHosts"), JSON.stringify(e.apis) !== JSON.stringify(t.apis) && n.push("apis"), se(e) !== se(t) && n.push("env"), n;
+	}, le = n, ue = A(G), de = () => {
+		let e = me(process.execPath, [...process.execArgv, ...process.argv.slice(1)], {
+			stdio: "inherit",
+			env: process.env,
+			cwd: process.cwd()
+		}), t = (t) => {
+			e.kill(t);
+		}, n = () => t("SIGINT"), r = () => t("SIGTERM");
+		process.on("SIGINT", n), process.on("SIGTERM", r), e.on("exit", (e, t) => {
+			process.off("SIGINT", n), process.off("SIGTERM", r), t ? process.kill(process.pid, t) : process.exit(e ?? 0);
+		}), e.on("error", (e) => {
+			Q.error("restart spawn failed", {}, e), process.exit(1);
+		});
+	}, fe = {
 		name: "framework:watch-app-config",
 		async configureServer(n) {
-			n.watcher.add(K), Z.info("watching app.config.ts for changes", { path: k(e, K) });
-			let r = async () => {
+			n.watcher.add(G), Q.info("watching app.config.ts for changes", { path: k(e, G) });
+			let r = hr.map((t) => O(e, t)), i = new Set(r.map((e) => A(e)));
+			for (let e of r) n.watcher.add(e);
+			n.watcher.on("all", (t, r) => {
+				i.has(A(r)) && (Q.warn("middleware.ts changed — restarting (it is loaded once per boot)", { path: k(e, r) }), n.close().catch(() => void 0).then(() => {
+					de();
+				}));
+			});
+			let a = async () => {
 				try {
 					try {
-						let e = n.moduleGraph.getModuleById(K);
+						let e = n.moduleGraph.getModuleById(G);
 						e && n.moduleGraph.invalidateModule(e);
 					} catch {}
-					let e = (await n.ssrLoadModule(K, { fixStacktrace: !0 })).default;
-					return typeof e == "object" && e && "type" in e && e.type === "web" ? e : (Z.warn("app.config.ts re-load returned wrong shape", { hasDefault: e !== void 0 }), null);
+					let e = (await n.ssrLoadModule(G, { fixStacktrace: !0 })).default;
+					return typeof e == "object" && e && "type" in e && e.type === "web" ? e : (Q.warn("app.config.ts re-load returned wrong shape", { hasDefault: e !== void 0 }), null);
 				} catch (e) {
-					return Z.warn("app.config.ts re-load failed — ignoring this change", {}, e), null;
+					return Q.warn("app.config.ts re-load failed — ignoring this change", {}, e), null;
 				}
-			}, i = null, a = () => {
-				i && clearTimeout(i), i = setTimeout(() => {
-					i = null, o();
+			}, o = null, s = () => {
+				o && clearTimeout(o), o = setTimeout(() => {
+					o = null, c();
 				}, 100);
-			}, o = async () => {
-				let t = await r();
+			}, c = async () => {
+				let t = await a();
 				if (!t) {
-					Z.info("app.config.ts onConfigChange: load returned null — skipping");
+					Q.info("app.config.ts onConfigChange: load returned null — skipping");
 					return;
 				}
-				if (Z.info("app.config.ts onConfigChange: loaded", {
+				if (Q.info("app.config.ts onConfigChange: loaded", {
 					theme: t.theme,
 					port: t.port,
 					name: t.name
-				}), JSON.stringify(t) === JSON.stringify(ce)) {
-					Z.info("app.config.ts onConfigChange: parsed config unchanged — skipping (no-op edit?)");
+				}), JSON.stringify(t) === JSON.stringify(le)) {
+					Q.info("app.config.ts onConfigChange: parsed config unchanged — skipping (no-op edit?)");
 					return;
 				}
-				let i = se(ce, t);
-				if (i.length > 0) {
-					Z.warn("app.config.ts changed — hard restart required", { fields: i });
+				let r = ce(le, t);
+				if (r.length > 0) {
+					Q.warn("app.config.ts changed — hard restart required", { fields: r });
 					try {
 						await n.close();
 					} catch {}
-					let e = fe(process.execPath, [...process.execArgv, ...process.argv.slice(1)], {
-						stdio: "inherit",
-						env: process.env,
-						cwd: process.cwd()
-					}), t = (t) => {
-						e.kill(t);
-					}, r = () => t("SIGINT"), a = () => t("SIGTERM");
-					process.on("SIGINT", r), process.on("SIGTERM", a), e.on("exit", (e, t) => {
-						process.off("SIGINT", r), process.off("SIGTERM", a), t ? process.kill(process.pid, t) : process.exit(e ?? 0);
-					}), e.on("error", (e) => {
-						Z.error("restart spawn failed", {}, e), process.exit(1);
-					});
+					de();
 					return;
 				}
 				try {
 					let r = Date.now();
-					await Jr(e, t, await Hr(e, t)), ce = t, n.ws && n.ws.send({
+					await pi(e, t, await si(e, t)), le = t, n.ws && n.ws.send({
 						type: "full-reload",
 						path: "*"
-					}), Z.info("app.config.ts soft-regen", {
+					}), Q.info("app.config.ts soft-regen", {
 						ms: Date.now() - r,
 						reload: "full"
 					});
 				} catch (e) {
-					Z.error("app.config.ts soft-regen failed", {}, e);
+					Q.error("app.config.ts soft-regen failed", {}, e);
 				}
-			}, s = (e) => E(e) === "app.config.ts" ? e === K || A(e) === le : !1;
+			}, l = (e) => E(e) === "app.config.ts" ? e === G || A(e) === ue : !1;
 			n.watcher.on("change", (e) => {
-				s(e) && (Z.info("app.config.ts change event (chokidar)", { file: e }), a());
+				l(e) && (Q.info("app.config.ts change event (chokidar)", { file: e }), s());
 			}), n.watcher.on("add", (e) => {
-				s(e) && (Z.info("app.config.ts add event (chokidar)", { file: e }), a());
+				l(e) && (Q.info("app.config.ts add event (chokidar)", { file: e }), s());
 			});
 			try {
 				let { watchFile: e } = await import("node:fs");
-				e(K, { interval: 500 }, (e, t) => {
-					e.mtimeMs !== t.mtimeMs && (Z.info("app.config.ts change event (poll)", { mtime: e.mtimeMs }), a());
-				}), Z.info("app.config.ts polling watcher attached", { intervalMs: 500 });
+				e(G, { interval: 500 }, (e, t) => {
+					e.mtimeMs !== t.mtimeMs && (Q.info("app.config.ts change event (poll)", { mtime: e.mtimeMs }), s());
+				}), Q.info("app.config.ts polling watcher attached", { intervalMs: 500 });
 			} catch (e) {
-				Z.warn("app.config.ts polling watcher could not attach", {}, e);
+				Q.warn("app.config.ts polling watcher could not attach", {}, e);
 			}
-			ke(t, Z, {
+			ke(t, Q, {
 				root: e,
 				onBeforeRestart: () => n.close()
 			});
 		}
-	}, de = /\/apps\/[^/]+\/.*\.(route|mutation|workflow|schema)\.tsx?$/, q = 0, pe = {
+	}, pe = /\/apps\/[^/]+\/.*\.(route|mutation|workflow|schema)\.tsx?$/, K = 0, he = {
 		name: "framework:suppress-api-hmr",
 		handleHotUpdate(e) {
-			if (q += 1, de.test(e.file)) return [];
+			if (K += 1, pe.test(e.file)) return [];
 		}
-	}, me = {
+	}, ge = {
 		name: "framework:reoptimize-on-rpcgroup-change",
 		async configureServer(t) {
 			let n = [];
 			for (let r of a) {
-				let i = await Lr(e, r.pkg);
+				let i = await ni(e, r.pkg);
 				if (i) {
 					n.push(i);
 					try {
@@ -2566,14 +2699,14 @@ import {
 				if (o) return;
 				let e = await pr(n);
 				if (e !== void 0 && e !== r) {
-					r = e, o = !0, Z.info("the api surface changed — re-bundling the api client + reloading (descriptor edits propagate automatically; no manual restart needed)");
+					r = e, o = !0, Q.info("the api surface changed — re-bundling the api client + reloading (descriptor edits propagate automatically; no manual restart needed)");
 					try {
-						await M.rm(O(V, ".vite", "deps"), {
+						await M.rm(O(z, ".vite", "deps"), {
 							recursive: !0,
 							force: !0
 						}), await t.restart(!0);
 					} catch (e) {
-						o = !1, Z.error("rpcGroup re-optimize failed", {}, e);
+						o = !1, Q.error("rpcGroup re-optimize failed", {}, e);
 					}
 				}
 			}, c = (e) => {
@@ -2584,7 +2717,7 @@ import {
 			};
 			t.watcher.on("change", c), t.watcher.on("add", c);
 		}
-	}, J = {}, ge = (e) => (t) => {
+	}, q = {}, ve = (e) => (t) => {
 		t.on("proxyReq", (t, n) => {
 			sn(t, n, {
 				target: e,
@@ -2596,36 +2729,36 @@ import {
 	};
 	for (let e of a) {
 		if (!e.proxyTarget) continue;
-		J[e.browserWsUrl] = {
+		q[e.browserWsUrl] = {
 			target: e.proxyTarget,
 			ws: !0,
 			changeOrigin: !0,
 			...e.wsPath ? {} : { rewrite: () => "/ws" }
 		};
 		let t = e.proxyTarget.replace(/^ws/, "http");
-		J[`/_voltro/api/${e.name}`] = {
+		q[`/_voltro/api/${e.name}`] = {
 			target: t,
 			changeOrigin: !0,
 			rewrite: (t) => t.replace(RegExp(`^/_voltro/api/${e.name}`), ""),
-			configure: ge(t)
+			configure: ve(t)
 		};
 	}
 	for (let [e, t] of Object.entries(n.proxies ?? {})) {
-		if (J[e]) {
-			Z.warn("user proxy ignored — prefix already claimed by an api ws proxy", { prefix: e });
+		if (q[e]) {
+			Q.warn("user proxy ignored — prefix already claimed by an api ws proxy", { prefix: e });
 			continue;
 		}
-		J[e] = {
+		q[e] = {
 			target: t.target,
 			changeOrigin: t.changeOrigin ?? !0,
 			...t.rewrite === void 0 ? {} : { rewrite: (n) => n.replace(RegExp(`^${e}`), t.rewrite) }
-		}, Z.info(`proxy ${e} → ${t.target}`, {
+		}, Q.info(`proxy ${e} → ${t.target}`, {
 			prefix: e,
 			target: t.target,
 			...t.rewrite === void 0 ? {} : { rewrite: t.rewrite }
 		});
 	}
-	let _e = {
+	let ye = {
 		name: "framework:inspect",
 		configureServer(t) {
 			let r = null, a = async () => {
@@ -2648,7 +2781,7 @@ import {
 						hasGetStaticPaths: typeof i.getStaticPaths == "function"
 					});
 				} catch (e) {
-					Z.warn("inspect: failed to load page metadata", { pattern: r.pattern }, e);
+					Q.warn("inspect: failed to load page metadata", { pattern: r.pattern }, e);
 				}
 				return r = n, n;
 			};
@@ -2670,7 +2803,7 @@ import {
 				if (t.method !== "GET" && t.method !== "HEAD") return r();
 				let { pathname: i } = Hn(t.url ?? "/");
 				if (i !== "/robots.txt" || j(O(e, "public", "robots.txt"))) return r();
-				n.statusCode = 200, n.setHeader("Content-Type", "text/plain; charset=utf-8"), n.end(xt({ indexable: !1 }));
+				n.statusCode = 200, n.setHeader("Content-Type", "text/plain; charset=utf-8"), n.end(bt({ indexable: !1 }));
 			}), n.name === "voltroDashboard" && t.middlewares.use(async (e, t, n) => {
 				let r = e.url ?? "", i = r.split("?")[0];
 				if (i === "/api/dashboard/proxy") {
@@ -2761,7 +2894,7 @@ import {
 				for (let [t, n] of Object.entries(e.headers ?? {})) n !== void 0 && (s[String(t).toLowerCase()] = Array.isArray(n) ? n.join(", ") : String(n));
 				let c = o.split("?")[0];
 				if (e.method === "GET" && (c === "/_voltro/inspect/logs" || o.startsWith("/_voltro/inspect/logs?"))) {
-					let e = d(s.origin), n = en(o, It(), s);
+					let e = d(s.origin), n = en(o, Ft(), s);
 					t.statusCode = n.status, t.setHeader("content-type", n.contentType);
 					for (let [n, r] of Object.entries(e)) t.setHeader(n, r);
 					t.end(n.body);
@@ -2810,14 +2943,14 @@ import {
 					for (let [e, r] of Object.entries(n)) t.setHeader(e, r);
 					t.flushHeaders?.(), t.write("retry: 5000\n\n");
 					let a = o.indexOf("?");
-					if (a === -1 || new URLSearchParams(o.slice(a + 1)).get("live") !== "1") for (let e of i.buffered()) t.write(wt(e));
+					if (a === -1 || new URLSearchParams(o.slice(a + 1)).get("live") !== "1") for (let e of i.buffered()) t.write(Ct(e));
 					let c = i.subscribe((e) => {
 						try {
-							t.write(wt(e));
+							t.write(Ct(e));
 						} catch {}
 					}), l = setInterval(() => {
 						try {
-							t.write(Tt());
+							t.write(wt());
 						} catch {}
 					}, 15e3), p = () => {
 						clearInterval(l), c();
@@ -2830,7 +2963,7 @@ import {
 						kind: "web",
 						meta: {
 							name: n.name ?? "(unnamed)",
-							voltroVersion: hr,
+							voltroVersion: Nr,
 							port: l,
 							mode: "dev",
 							apis: Object.entries(n.apis ?? {}).map(([e, t]) => {
@@ -2842,13 +2975,13 @@ import {
 							})
 						},
 						routes: await a(),
-						dirs: I,
+						dirs: ee,
 						cache: () => ({
 							backend: "memory",
 							size: 0,
 							entries: []
 						}),
-						env: () => we(n.name ?? "app", { contract: ae(n.env) ? n.env : void 0 })
+						env: () => Te(n.name ?? "app", { contract: oe(n.env) ? n.env : void 0 })
 					}, c = p(o, i, s, { method: e.method ?? "GET" });
 					if (c === null) return r();
 					t.statusCode = c.status, t.setHeader("content-type", c.contentType);
@@ -2859,7 +2992,7 @@ import {
 				}
 			});
 		}
-	}, ve = n.name === "voltroDashboard" ? {
+	}, be = n.name === "voltroDashboard" ? {
 		name: "framework:dashboard-registry",
 		configureServer(e) {
 			e.middlewares.use(async (e, t, n) => {
@@ -2872,12 +3005,12 @@ import {
 				}
 			});
 		}
-	} : null, ye = /* @__PURE__ */ new Set(), be = (e, t, n, r, i, a = !1) => {
+	} : null, xe = /* @__PURE__ */ new Set(), Se = (e, t, n, r, i, a = !1) => {
 		let o = Yn(i, a, t) ?? "";
-		if (Z.error(`${t} render failed`, {
+		if (Q.error(`${t} render failed`, {
 			pathname: n,
 			pattern: r,
-			cause: Dt(i) + o
+			cause: Et(i) + o
 		}), e.headersSent) {
 			e.end();
 			return;
@@ -2885,24 +3018,24 @@ import {
 		e.writeHead(500, {
 			"content-type": "text/plain; charset=utf-8",
 			"x-voltro-rendered-by": `${t}-failed`,
-			"x-voltro-ssr-generation": String(q)
+			"x-voltro-ssr-generation": String(K)
 		});
-		let s = q === 0 ? "" : `\n[voltro] this process has absorbed ${q} hot update(s) since boot, so its SSR\nmodule graph may not match the files on disk. Before reporting this — to us or to\nyourself — restart \`voltro dev\` and measure once from a fresh boot.\n`;
-		e.end(`${t} render failed for ${n}\n\n${Dt(i)}\n${o}\n${s}`);
-	}, xe = rt(), Ce = at({
-		limit: xe,
-		onColdStart: (e) => Z.debug("ssr cold-compile start", { id: e }),
-		onColdEnd: (e, { durationMs: t, failed: n }) => Z.debug(`ssr cold-compile ${n ? "FAILED" : "end"} ${t}ms`, {
+		let s = K === 0 ? "" : `\n[voltro] this process has absorbed ${K} hot update(s) since boot, so its SSR\nmodule graph may not match the files on disk. Before reporting this — to us or to\nyourself — restart \`voltro dev\` and measure once from a fresh boot.\n`;
+		e.end(`${t} render failed for ${n}\n\n${Et(i)}\n${o}\n${s}`);
+	}, we = nt(), Ee = it({
+		limit: we,
+		onColdStart: (e) => Q.debug("ssr cold-compile start", { id: e }),
+		onColdEnd: (e, { durationMs: t, failed: n }) => Q.debug(`ssr cold-compile ${n ? "FAILED" : "end"} ${t}ms`, {
 			id: e,
 			ms: t,
 			...n ? { failed: !0 } : {}
 		})
 	});
-	Z.debug(`ssr cold-compile concurrency ${xe}`, { concurrency: xe });
-	let Te = null, Ee = async () => (Te === null && (Te = await M.readFile(O(e, ".framework", "index.html"), "utf8")), Te), Oe = {
+	Q.debug(`ssr cold-compile concurrency ${we}`, { concurrency: we });
+	let J = null, Oe = async () => (J === null && (J = await M.readFile(O(e, ".framework", "index.html"), "utf8")), J), Ae = {
 		name: "framework:ssr",
 		configureServer(t) {
-			let r = (e) => Ce.load(e, async () => await t.ssrLoadModule(e)), i, o = !1, s = () => {
+			let r = (e) => Ee.load(e, async () => await t.ssrLoadModule(e)), i, o = !1, s = () => {
 				if (i !== void 0) return i;
 				let t = n.locales ?? [], a = n.defaultLocale ?? t[0] ?? "en";
 				return t.length === 0 ? (i = Promise.resolve(() => void 0), i) : (i = (async () => {
@@ -2911,7 +3044,7 @@ import {
 						let t = (await r(O(e, "src", "locales", `${i}.ts`))).default;
 						t !== void 0 && (s[i] = n(i, t, a));
 					} catch (e) {
-						Z.warn("locale catalog failed to load for SSR", { locale: i }, e);
+						Q.warn("locale catalog failed to load for SSR", { locale: i }, e);
 					}
 					if (o = Object.keys(s).length > 0, Object.keys(s).length === 0) {
 						let { resolveLocale: e } = await r("@voltro/i18n/server");
@@ -2937,18 +3070,37 @@ import {
 				let u = i.url ?? "/";
 				u.indexOf("?");
 				let { pathname: d, search: f } = Hn(u);
-				if (d.startsWith("/@") || d.startsWith("/node_modules/") || d.startsWith("/.framework/") || d.startsWith("/_voltro/") || d === "/main.tsx" || d === "/index.html" || d === "/sw.js" || d === "/favicon.ico" || d === "/robots.txt" || /\.[a-z0-9]+$/i.test(d)) return l();
-				let p = Ir(d, F.ssrRoutes);
-				if (!p) return l();
-				let m = !ye.has(p.route.pattern), h = Date.now();
-				m && Z.info(`ssr compiling ${p.route.pattern}`, {
-					pattern: p.route.pattern,
+				if (d.startsWith("/@") || d.startsWith("/node_modules/") || d.startsWith("/.framework/") || d.startsWith("/_voltro/") || d === "/main.tsx" || d === "/index.html" || d === "/sw.js" || d === "/favicon.ico" || d === "/robots.txt") return l();
+				let p = async () => {
+					if (X.length === 0) return;
+					let e = xr(X, {
+						route: void 0,
+						pathname: d
+					});
+					if (e === void 0) return;
+					let t = {};
+					for (let [e, n] of Object.entries(i.headers ?? {})) typeof n == "string" ? t[e] = n : Array.isArray(n) && (t[e] = n.join(", "));
+					let n = await jr(e, {
+						pathname: d,
+						search: f,
+						headers: t,
+						cookies: wr(t.cookie),
+						route: void 0
+					});
+					for (let e of n.setCookies) c.appendHeader("set-cookie", Or(e));
+				};
+				if (/\.[a-z0-9]+$/i.test(d)) return await p(), l();
+				let m = ti(d, F.ssrRoutes);
+				if (!m) return await p(), l();
+				let h = !xe.has(m.route.pattern), g = Date.now();
+				h && Q.info(`ssr compiling ${m.route.pattern}`, {
+					pattern: m.route.pattern,
 					pathname: d
 				});
-				let g = {}, v = async (e, t) => {
+				let v = {}, y = async (e, t) => {
 					let n = Date.now(), r = await t();
-					return g[e] = (g[e] ?? 0) + (Date.now() - n), r;
-				}, y = async (e, n, r) => {
+					return v[e] = (v[e] ?? 0) + (Date.now() - n), r;
+				}, b = async (e, n, r) => {
 					let i = await t.moduleGraph.getModuleById(e);
 					if (!(!i || n.has(e))) {
 						if (n.add(e), i.id && /\.(css|sass|scss|less|stylus|pcss|postcss)(\?|$)/.test(i.id)) {
@@ -2956,127 +3108,141 @@ import {
 							r.includes(e) || r.push(e);
 							return;
 						}
-						for (let e of i.importedModules ?? []) e.id && await y(e.id, n, r);
+						for (let e of i.importedModules ?? []) e.id && await b(e.id, n, r);
 					}
-				}, b = !1;
+				}, x = !1;
 				try {
-					let x = await v("loadPage", async () => await r(O(e, "src", "pages", p.route.file))), S = _(x, O("src", "pages", p.route.file)), C = Ar(F.dirs, p.route.dirChain), w = S === "spa" && C.some((e) => e.hasLayout);
-					if (S !== "ssr" && S !== "isr" && !w) return l();
-					let T = {};
-					for (let [e, t] of Object.entries(i.headers ?? {})) typeof t == "string" ? T[e] = t : Array.isArray(t) && (T[e] = t.join(", "));
-					let E = qr(Kr(a[0], { allowDevProxy: !0 }), T.cookie, { apiName: a[0]?.name }), D = new AbortController(), k = () => D.abort();
-					c.once("close", k);
-					let A = null, j = [], M = {};
+					let S = await y("loadPage", async () => await r(O(e, "src", "pages", m.route.file))), C = _(S, O("src", "pages", m.route.file)), w = Yr(F.dirs, m.route.dirChain), T = C === "spa" && w.some((e) => e.hasLayout);
+					if (C !== "ssr" && C !== "isr" && !T) return await p(), l();
+					let E = {};
+					for (let [e, t] of Object.entries(i.headers ?? {})) typeof t == "string" ? E[e] = t : Array.isArray(t) && (E[e] = t.join(", "));
+					let D = await jr(xr(X, {
+						route: m.route.pattern,
+						pathname: d
+					}), {
+						pathname: d,
+						search: f,
+						headers: E,
+						cookies: wr(E.cookie),
+						route: m.route.pattern
+					}, ze);
+					for (let e of D.setCookies) c.appendHeader("set-cookie", Or(e));
+					let k = D.headers, A = fi(di(a[0], { allowDevProxy: !0 }), D.headers.cookie, {
+						apiName: a[0]?.name,
+						headers: D.headers
+					}), j = new AbortController(), M = () => j.abort();
+					c.once("close", M);
+					let N = null, P = [], ee = {};
 					try {
-						(await r("@voltro/web/ssr")).beginStoreSeeds(), {chain: j, segmentLoaderData: M} = await v("loadChain", () => jr({
-							entries: C,
+						(await r("@voltro/web/ssr")).beginStoreSeeds(), {chain: P, segmentLoaderData: ee} = await y("loadChain", () => Xr({
+							entries: w,
 							loadLayout: (t) => r(O(e, "src", "pages", t.dir, "layout.tsx")),
 							loadError: (t) => r(O(e, "src", "pages", t.dir, "error.tsx")),
 							loadPending: (t) => r(O(e, "src", "pages", t.dir, "loading.tsx")),
 							ctx: {
-								params: p.params,
+								params: m.params,
 								pathname: d,
 								search: f,
-								signal: D.signal,
-								headers: T,
-								query: E,
+								signal: j.signal,
+								headers: k,
+								query: A,
 								isServer: !0
 							}
 						}));
-						let t = x.loader;
-						typeof t == "function" && !w && (A = await v("loader", () => t({
-							params: p.params,
+						let t = S.loader;
+						typeof t == "function" && !T && (N = await y("loader", () => t({
+							params: m.params,
 							pathname: d,
 							search: f,
-							signal: D.signal,
-							headers: T,
-							query: E,
+							signal: j.signal,
+							headers: k,
+							query: A,
 							isServer: !0
 						})));
 					} finally {
-						c.off("close", k);
+						c.off("close", M);
 					}
-					let N = await v("loadSsrHelpers", async () => await r("@voltro/web/ssr"));
-					w || await cr({
-						pageMod: x,
-						params: p.params,
-						query: E,
+					let I = await y("loadSsrHelpers", async () => await r("@voltro/web/ssr"));
+					T || await cr({
+						pageMod: S,
+						params: m.params,
+						query: A,
 						apiName: a[0]?.name,
-						seed: N.seedPreloadedSubscription,
-						seedFailure: N.seedPreloadedSubscriptionFailure,
-						onError: ({ tag: e, apiName: t }, n) => Z.warn("preload seed failed", {
+						seed: I.seedPreloadedSubscription,
+						seedFailure: I.seedPreloadedSubscriptionFailure,
+						onError: ({ tag: e, apiName: t }, n) => Q.warn("preload seed failed", {
 							tag: e,
 							apiName: t,
 							pathname: d
 						}, n)
 					});
-					let P = {
-						pattern: p.route.pattern,
-						Component: x.default,
-						meta: x.meta,
-						loader: x.loader,
-						ErrorBoundary: x.ErrorBoundary,
-						Pending: x.Pending,
-						renderMode: S,
-						chain: j
-					}, I = {
-						cookies: N.parseCookieHeader(T.cookie),
-						headers: T,
+					let te = {
+						pattern: m.route.pattern,
+						Component: S.default,
+						meta: S.meta,
+						loader: S.loader,
+						ErrorBoundary: S.ErrorBoundary,
+						Pending: S.Pending,
+						renderMode: C,
+						chain: P
+					}, L = {
+						cookies: D.cookies,
+						headers: k,
 						url: u
-					}, L = x.interactive ?? "full", R = (await s())(T.cookie, T["accept-language"]);
-					b = R !== void 0 && o;
-					let z = R ? {
-						outerWrap: R.outerWrap,
-						locale: R.locale
-					} : {}, B = w ? zn({
-						helpers: N,
-						page: `src/pages/${p.route.file}`,
-						interactive: L,
+					}, R = S.interactive ?? "full", z = (await s())(k.cookie, k["accept-language"]);
+					x = z !== void 0 && o;
+					let ne = z ? {
+						outerWrap: z.outerWrap,
+						locale: z.locale
+					} : {}, B = T ? zn({
+						helpers: I,
+						page: `src/pages/${m.route.file}`,
+						interactive: R,
 						delivery: "stream",
 						renderInput: {
-							descriptor: P,
-							params: p.params,
+							descriptor: te,
+							params: m.params,
 							pathname: d,
 							search: f,
-							segmentLoaderData: M,
-							requestContext: I,
-							...z
+							segmentLoaderData: ee,
+							requestContext: L,
+							...ne
 						}
-					}) : null, V = w ? null : Rn({
-						helpers: N,
-						page: `src/pages/${p.route.file}`,
+					}) : null, V = T ? null : Rn({
+						helpers: I,
+						page: `src/pages/${m.route.file}`,
 						pathname: d,
-						renderMode: S,
-						interactive: L,
-						loaderData: A,
-						segmentLoaderData: M,
-						pageLoaderRan: typeof x.loader == "function"
-					}), ee = [];
-					await v("collectCss", async () => {
+						renderMode: C,
+						interactive: R,
+						loaderData: N,
+						segmentLoaderData: ee,
+						pageLoaderRan: typeof S.loader == "function"
+					}), re = [];
+					await y("collectCss", async () => {
 						let t = /* @__PURE__ */ new Set(), n = [
-							O(e, "src", "pages", p.route.file),
-							...C.flatMap((t) => [
+							O(e, "src", "pages", m.route.file),
+							...w.flatMap((t) => [
 								...t.hasLayout ? [O(e, "src", "pages", t.dir, "layout.tsx")] : [],
 								...t.hasError ? [O(e, "src", "pages", t.dir, "error.tsx")] : [],
 								...t.hasPending ? [O(e, "src", "pages", t.dir, "loading.tsx")] : []
 							]),
 							O(e, ".framework", "main.tsx")
 						];
-						for (let e of n) await y(e, t, ee);
+						for (let e of n) await b(e, t, re);
 					});
-					let te = await v("readShell", Ee), H = await v("transformShell", () => t.transformIndexHtml(u, te)), U = ee.map((e) => `<link rel="stylesheet" href="${e}?direct" />`).join("\n    "), W = R?.locale ?? I.cookies["voltro:locale"] ?? n.defaultLocale ?? (n.locales ?? [])[0] ?? "en", ne = Date.now();
+					let H = await y("readShell", Oe), U = await y("transformShell", () => t.transformIndexHtml(u, H)), ie = re.map((e) => `<link rel="stylesheet" href="${e}?direct" />`).join("\n    "), W = z?.locale ?? L.cookies["voltro:locale"] ?? n.defaultLocale ?? (n.locales ?? [])[0] ?? "en", ae = Date.now();
 					if (B) {
 						let e = (e) => Vn({
-							helpers: N,
+							helpers: I,
 							prepared: B,
 							meta: e,
-							interactive: L,
-							extra: [U]
+							interactive: R,
+							extra: [ie]
 						});
 						if (B.hasDeferred) ar({
 							res: c,
 							shell: nr({
-								shell: H,
+								shell: U,
 								inlineModuleScriptsAsync: !0
 							}),
 							htmlLang: W,
@@ -3085,42 +3251,42 @@ import {
 								"x-voltro-rendered-by": "spa-shell-dev"
 							},
 							headInjection: e,
-							render: (e) => N.renderPageToStream({
+							render: (e) => I.renderPageToStream({
 								...B.renderInput,
 								...e
 							}),
 							onShellError: (e) => {
-								be(c, "spa-shell-dev", d, p.route.pattern, e, b);
+								Se(c, "spa-shell-dev", d, m.route.pattern, e, x);
 							}
 						});
 						else {
 							let t = Bn({
-								helpers: N,
+								helpers: I,
 								prepared: B
-							}), n = H.replace("<div id=\"root\"></div>", `<div id="root">${t.body}</div>`).replace("</head>", `    ${e(t.meta)}\n  </head>`).replace(/<html(\s+lang="[^"]*")?/i, `<html lang="${W}"`);
+							}), n = U.replace("<div id=\"root\"></div>", `<div id="root">${t.body}</div>`).replace("</head>", `    ${e(t.meta)}\n  </head>`).replace(/<html(\s+lang="[^"]*")?/i, `<html lang="${W}"`);
 							c.statusCode = 200, c.setHeader("content-type", "text/html; charset=utf-8"), c.setHeader("x-voltro-rendered-by", "spa-shell-dev"), c.end(n);
 						}
 					} else if (V) {
 						let e = (e) => [
-							U,
-							N.renderMetaToHtml(e),
-							`<meta name="voltro-interactive" content="${L}" />`,
-							...V.hasDeferred ? [N.renderDeferredRegistryScript()] : [],
-							N.renderRouterStateScript(V.stateInput)
+							ie,
+							I.renderMetaToHtml(e),
+							`<meta name="voltro-interactive" content="${R}" />`,
+							...V.hasDeferred ? [I.renderDeferredRegistryScript()] : [],
+							I.renderRouterStateScript(V.stateInput)
 						].filter((e) => e.length > 0).join("\n    "), t = {
-							descriptor: P,
-							params: p.params,
+							descriptor: te,
+							params: m.params,
 							pathname: d,
 							search: f,
 							loaderData: V.loaderData,
 							segmentLoaderData: V.segmentLoaderData,
-							requestContext: I,
-							...z
+							requestContext: L,
+							...ne
 						};
-						if (S === "ssr" && L === "full") ar({
+						if (C === "ssr" && R === "full") ar({
 							res: c,
 							shell: nr({
-								shell: H,
+								shell: U,
 								inlineModuleScriptsAsync: !0
 							}),
 							htmlLang: W,
@@ -3129,39 +3295,39 @@ import {
 								"x-voltro-rendered-by": "ssr-dev"
 							},
 							headInjection: e,
-							render: (e) => N.renderPageToStream({
+							render: (e) => I.renderPageToStream({
 								...t,
 								...e
 							}),
 							onShellError: (e) => {
-								be(c, "ssr-dev", d, p.route.pattern, e, b);
+								Se(c, "ssr-dev", d, m.route.pattern, e, x);
 							}
 						});
 						else {
-							let { html: n, meta: r } = N.renderPageToHtml(t), i = H.replace("<div id=\"root\"></div>", `<div id="root">${n}</div>`).replace("</head>", `    ${e(r)}\n  </head>`).replace(/<html(\s+lang="[^"]*")?/i, `<html lang="${W}"`);
+							let { html: n, meta: r } = I.renderPageToHtml(t), i = U.replace("<div id=\"root\"></div>", `<div id="root">${n}</div>`).replace("</head>", `    ${e(r)}\n  </head>`).replace(/<html(\s+lang="[^"]*")?/i, `<html lang="${W}"`);
 							c.statusCode = 200, c.setHeader("content-type", "text/html; charset=utf-8"), c.setHeader("x-voltro-rendered-by", "ssr-dev"), c.end(i);
 						}
 					}
-					g.render = Date.now() - ne;
-					let G = Date.now() - h;
-					m ? (ye.add(p.route.pattern), Z.info(`ssr compiled ${p.route.pattern} in ${G}ms`, {
-						pattern: p.route.pattern,
+					v.render = Date.now() - ae;
+					let G = Date.now() - g;
+					h ? (xe.add(m.route.pattern), Q.info(`ssr compiled ${m.route.pattern} in ${G}ms`, {
+						pattern: m.route.pattern,
 						pathname: d,
 						elapsedMs: G,
 						cold: !0,
-						phases: g
-					})) : G > 200 && Z.info(`ssr rendered ${d} in ${G}ms`, {
-						pattern: p.route.pattern,
+						phases: v
+					})) : G > 200 && Q.info(`ssr rendered ${d} in ${G}ms`, {
+						pattern: m.route.pattern,
 						pathname: d,
 						elapsedMs: G,
 						cold: !1,
-						phases: g
+						phases: v
 					});
 				} catch (e) {
 					if (In(e)) {
-						Z.error("ssr-dev render refused", {
+						Q.error("ssr-dev render refused", {
 							pathname: d,
-							pattern: p.route.pattern
+							pattern: m.route.pattern
 						}, e), c.statusCode = 500, c.setHeader("content-type", "text/plain; charset=utf-8"), c.end(e.message);
 						return;
 					}
@@ -3172,19 +3338,19 @@ import {
 						c.end(t.body);
 						return;
 					}
-					be(c, "ssr-dev", d, p.route.pattern, e, b);
+					Se(c, "ssr-dev", d, m.route.pattern, e, x);
 				}
 			});
 		}
-	}, Ae = Date.now(), je = R.version ?? "?", Me = await gr(), Ne = O(e, "node_modules", "@voltro", "ui-shadcn"), Y = j(O(Ne, "package.json")) ? Ne : null, Fe = [], Ie = await (async () => {
+	}, je = Date.now(), Me = te.version ?? "?", Ne = await Pr(), Fe = O(e, "node_modules", "@voltro", "ui-shadcn"), Y = j(O(Fe, "package.json")) ? Fe : null, Ie = [], Le = await (async () => {
 		let t = [];
 		for (let n of a) {
-			let r = await Lr(e, n.pkg);
+			let r = await ni(e, n.pkg);
 			r && t.push(r);
 		}
 		let n = await pr(t);
 		if (n === void 0) return !1;
-		let r = O(V, ".voltro-rpcgroup-optimize"), i = "";
+		let r = O(z, ".voltro-rpcgroup-optimize"), i = "";
 		try {
 			i = (await M.readFile(r, "utf8")).trim();
 		} catch {}
@@ -3193,15 +3359,20 @@ import {
 			await M.writeFile(r, n);
 		} catch {}
 		return !0;
-	})();
-	Ie && Z.info("rpcGroup changed since last boot — forcing a dep re-optimize so the browser loads the current api client");
+	})(), Re = /* @__PURE__ */ new Set(), ze = (e) => {
+		Re.has(e.name) || (Re.add(e.name), Q.warn(`middleware.ts wrote the cookie "${e.name}" with the HttpOnly default — a browser SDK cannot read it`, {
+			cookie: e.name,
+			hint: "If your IdP client reads this from `document.cookie` (Supabase's `createBrowserClient` does), pass `httpOnly: false`. Otherwise the SSR render succeeds and the user is signed out at the first client-side call. Set `httpOnly: true` explicitly to silence this."
+		}));
+	}, X = await Ar(e);
+	X.length > 0 && Q.info(`middleware.ts loaded — ${X.length} middleware(s): ` + X.map((e) => e.exportName).join(", ")), Cr(X, F.ssrRoutes.map((e) => e.pattern)), Le && Q.info("rpcGroup changed since last boot — forcing a dep re-optimize so the browser loads the current api client");
 	try {
 		await Pe(l, "voltro dev (web)");
 	} catch (e) {
-		Z.error(String(e.message ?? e)), process.exit(1);
+		Q.error(String(e.message ?? e)), process.exit(1);
 	}
-	await (await R.createServer({
-		root: V,
+	await (await te.createServer({
+		root: z,
 		envPrefix: "__VOLTRO_VITE_ENV_DISABLED__",
 		ssr: { noExternal: ["react-intl", "@voltro/i18n"] },
 		resolve: {
@@ -3212,12 +3383,12 @@ import {
 				"@voltro/i18n"
 			],
 			alias: [
-				...Me ? [{
+				...Ne ? [{
 					find: "@voltro/devtools/styles.css",
-					replacement: O(Me, "src/styles.css")
+					replacement: O(Ne, "src/styles.css")
 				}, {
 					find: "@voltro/devtools",
-					replacement: O(Me, "src/index.ts")
+					replacement: O(Ne, "src/index.ts")
 				}] : [],
 				...Y ? [
 					{
@@ -3237,49 +3408,49 @@ import {
 						replacement: O(Y, "src/index.ts")
 					}
 				] : [],
-				...nt(e)
+				...tt(e)
 			]
 		},
 		optimizeDeps: {
-			include: [...a.map((e) => `${e.pkg}/rpcGroup`), ...Fe],
-			force: Ie
+			include: [...a.map((e) => `${e.pkg}/rpcGroup`), ...Ie],
+			force: Le
 		},
-		customLogger: et(),
+		customLogger: $e(),
 		plugins: [
 			bn(O(e, "src", "pages")),
-			z(),
-			B(),
-			U,
-			ie,
-			ue,
-			pe,
-			me,
-			_e,
-			Oe,
-			...ve ? [ve] : []
+			L(),
+			R(),
+			re,
+			ae,
+			fe,
+			he,
+			ge,
+			ye,
+			Ae,
+			...be ? [be] : []
 		],
 		server: {
 			port: l,
 			strictPort: !0,
 			host: !0,
 			allowedHosts: n.allowedHosts === !0 || [...n.allowedHosts ?? []],
-			proxy: J,
-			fs: { allow: [e, ...Sr(e)] }
+			proxy: q,
+			fs: { allow: [e, ...Br(e)] }
 		},
 		appType: "spa",
-		cacheDir: O(V, ".vite"),
+		cacheDir: O(z, ".vite"),
 		publicDir: O(e, "public")
-	})).listen(), mr.info(`v${je} ready in ${Date.now() - Ae}ms`, {
-		version: je,
-		bootMs: Date.now() - Ae
-	}), Z.info(`listening on http://localhost:${l}`, {
+	})).listen(), Mr.info(`v${Me} ready in ${Date.now() - je}ms`, {
+		version: Me,
+		bootMs: Date.now() - je
+	}), Q.info(`listening on http://localhost:${l}`, {
 		port: l,
 		app: n.name ?? "(unnamed)"
 	});
-	for (let e of a) e.proxyTarget && (Z.info(`proxy /ws/${e.name} → ${e.proxyTarget}`, {
+	for (let e of a) e.proxyTarget && (Q.info(`proxy /ws/${e.name} → ${e.proxyTarget}`, {
 		api: e.name,
 		target: e.proxyTarget
-	}), Z.info(`proxy /_voltro/api/${e.name} → ${e.proxyTarget.replace(/^ws/, "http")}/_voltro/inspect`, { api: e.name }));
+	}), Q.info(`proxy /_voltro/api/${e.name} → ${e.proxyTarget.replace(/^ws/, "http")}/_voltro/inspect`, { api: e.name }));
 	try {
 		await x({
 			id: b,
@@ -3293,7 +3464,7 @@ import {
 		let t = wn(e);
 		if (t) {
 			let e = await Pn({ dashboardAppPath: t });
-			e.status === "launched" ? Z.info(`dashboard launched at http://localhost:${e.port}`, { port: e.port }) : e.status === "already-running" && Z.debug(`dashboard already running on :${e.port}`, { port: e.port });
+			e.status === "launched" ? Q.info(`dashboard launched at http://localhost:${e.port}`, { port: e.port }) : e.status === "already-running" && Q.debug(`dashboard already running on :${e.port}`, { port: e.port });
 		}
 		setInterval(() => {
 			x({
@@ -3311,32 +3482,32 @@ import {
 		};
 		process.on("SIGINT", n), process.on("SIGTERM", n);
 	} catch (e) {
-		Z.warn("runtime-registry write failed", {}, e);
+		Q.warn("runtime-registry write failed", {}, e);
 	}
-	return ee({
+	return ne({
 		app: n.name ?? "unnamed",
 		kind: "web",
 		url: `http://localhost:${l}`,
-		bootMs: Date.now() - Ae
+		bootMs: Date.now() - je
 	}), new Promise(() => {});
-}, $r = async (t) => {
+}, vi = async (t) => {
 	e("serve");
-	let n = await Zr(t);
+	let n = await gi(t);
 	if (!n) return {
 		ran: !1,
 		exitCode: 0
 	};
-	let i = Date.now(), a = Z.child("serve");
+	let i = Date.now(), a = Q.child("serve");
 	a.info("booting voltro serve (preview)", { app: n.name ?? "(unnamed)" });
-	let o = await Hr(t, n);
+	let o = await si(t, n);
 	for (let e of o) a.info("api wired", {
 		name: e.name,
 		pkg: e.pkg
 	});
-	await Jr(t, n, o);
+	await pi(t, n, o);
 	{
-		let { pages: e } = await $(O(t, "src", "pages"));
-		await ht({
+		let { pages: e } = await Jr(O(t, "src", "pages"));
+		await mt({
 			appRoot: t,
 			pages: e
 		});
@@ -3345,12 +3516,12 @@ import {
 		kind: "web",
 		configPort: n.port,
 		env: process.env
-	}).port, c = await he("vite", () => import("vite")), l = (await import("@vitejs/plugin-react")).default, u = O(t, ".framework");
-	Z.info("running production build"), await c.build({
+	}).port, c = await _e("vite", () => import("vite")), l = (await import("@vitejs/plugin-react")).default, u = O(t, ".framework");
+	Q.info("running production build"), await c.build({
 		root: u,
 		envPrefix: "__VOLTRO_VITE_ENV_DISABLED__",
 		plugins: [l()],
-		customLogger: et(),
+		customLogger: $e(),
 		resolve: { dedupe: [
 			"react",
 			"react-dom",
@@ -3359,7 +3530,7 @@ import {
 		] },
 		build: {
 			outDir: "dist",
-			rollupOptions: { output: { manualChunks: wr } }
+			rollupOptions: { output: { manualChunks: Hr } }
 		},
 		publicDir: O(t, "public")
 	});
@@ -3372,7 +3543,7 @@ import {
 		label: "Local",
 		url: e
 	})) ?? [];
-	return ee({
+	return ne({
 		app: n.name ?? "unnamed",
 		kind: "preview",
 		url: f,
@@ -3381,4 +3552,4 @@ import {
 	}), new Promise(() => {});
 };
 //#endregion
-export { We as $, Hn as A, It as B, nr as C, zn as D, Rn as E, on as F, bt as G, Ct as H, en as I, rt as J, ht as K, Xt as L, Cn as M, Pn as N, Bn as O, wn as P, He as Q, Jt as R, rr as S, In as T, Tt as U, wt as V, xt as W, Ve as X, nt as Y, Ue as Z, $r as _, jr as a, we as at, Jr as b, Or as c, be as ct, Zr as d, Ge as et, Hr as f, Qr as g, Wr as h, qr as i, De as it, Tn as j, Vn as k, Q as l, ye as lt, Br as m, Kr as n, ke as nt, Xr as o, Te as ot, zr as p, at as q, Vr as r, Ee as rt, Ar as s, Se as st, Tr as t, Pe as tt, kr as u, he as ut, wr as v, ar as w, cr as x, $ as y, Vt as z };
+export { yt as $, rr as A, Cn as B, Ar as C, xr as D, jr as E, zn as F, Xt as G, wn as H, Bn as I, Ft as J, Jt as K, Vn as L, ar as M, In as N, Or as O, Rn as P, bt as Q, Hn as R, kr as S, wr as T, on as U, Pn as V, en as W, St as X, Ct as Y, wt as Z, vi as _, be as _t, Xr as a, He as at, pi as b, Kr as c, We as ct, gi as d, J as dt, mt as et, si as f, De as ft, _i as g, xe as gt, li as h, Ce as ht, fi as i, Be as it, nr as j, cr as k, $ as l, Pe as lt, ai as m, Ee as mt, di as n, nt, hi as o, Ve as ot, ii as p, Te as pt, Bt as q, oi as r, tt as rt, Yr as s, Ue as st, Ur as t, it as tt, qr as u, ke as ut, Hr as v, _e as vt, Sr as w, Cr as x, Jr as y, Tn as z };