@webjsdev/server 0.8.48 → 0.8.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/server",
-  "version": "0.8.48",
+  "version": "0.8.50",
   "type": "module",
   "description": "webjs dev/prod server: SSR, router, API, server actions, live reload",
   "main": "index.js",

package/src/check.js

@@ -7,7 +7,7 @@ import {
   matchClosingBrace,
   parsePropEntries,
 } from './js-scan.js';
-import { buildModuleGraph, transitiveDeps } from './module-graph.js';
+import { buildModuleGraph, transitiveDeps, resolveImport } from './module-graph.js';
 import { scanComponents } from './component-scanner.js';
 import { buildRouteTable } from './router.js';
 import { analyzeElision } from './component-elision.js';
@@ -144,6 +144,11 @@ export const RULES = [
     description:
       'Flags a template interpolation (`${...}`) placed as a child of a `<style>` or `<script>` element inside a COMPONENT `html` template. Raw-text elements are an SSR/client asymmetry trap: the server renderer emits the interpolated content, but the client renderer drops it (a raw-text hole is a `noop`, since the compile cache is keyed on the static strings), so the element renders correctly on the server and then wipes to empty on hydration. Scoped to components (files with a `WebComponent` class), which hydrate; pages and layouts render server-only and never hydrate, so a page interpolating a `css` result into a `<style>` is a legitimate pattern and is not flagged. In a component, author scoped CSS with `static styles` (shadow DOM) or a `css` template. Found dogfooding a tic-tac-toe app (#845): a `<style>${STYLE}</style>` painted at SSR then vanished on hydrate.',
   },
+  {
+    name: 'no-missing-local-import',
+    description:
+      'Flags a NAMED value import of a symbol that a resolvable app-internal module does not export (`import { todos } from \'#db/schema.server.ts\'` when the schema no longer exports `todos`). The binding is `undefined` at runtime and crashes on first use, yet the rest of `webjs check` (elision-based, it does not compile types) misses it, so a schema swap that orphans a gallery module can pass `check` while `typecheck` is red. This is the runtime-crash class `check` exists to catch, filling that gap so an agent running only `check` cannot ship a broken import. Deliberately conservative to never false-positive on a valid app: it only inspects app-internal specifiers (a relative `./` path or a `#` alias) that resolve to a file in the app, only NAMED value imports (a `type` import, a default import, a namespace import, and any bare / `node:` / npm-package specifier are skipped), and it treats a module as UNKNOWABLE (never flags imports from it) when its exports are not fully enumerable: a `export * from ...` star re-export, a destructuring `export const { a } = ...`, or a multi-declarator `export const a = .., b = ..`. It reads names from `export function/class/const/let/var/type/interface/enum` and from `export { a, b as c }` / `export { x } from ...` clauses (the alias after `as` is the exported name). A re-export barrel therefore resolves correctly, and a `\'use server\'` action file exports its function names normally. Found dogfooding a tic-tac-toe app: dropping the example `todos` table left a gallery module importing it, green under `check` but red under `typecheck`.',
+  },
 ];
 
 /** Set of all known rule names for fast lookup. */
@@ -379,6 +384,112 @@ function findBrowserMemberUses(code) {
   return out;
 }
 
+/**
+ * True if any `export const/let/var` declares more than one binding
+ * (`export const a = 1, b = 2`), which the single-name collector would
+ * under-count. Depth-aware: a comma inside an initializer (`f(a, b)`, `[a, b]`,
+ * `{ a, b }`) does not count, only a top-level comma before the statement end.
+ * Bailing the whole module on this errs toward a false negative (safe), never a
+ * false positive. Runs on the string/comment-redacted `scan`.
+ * @param {string} scan
+ * @returns {boolean}
+ */
+function hasMultiDeclaratorExport(scan) {
+  const re = /\bexport\s+(?:const|let|var)\b/g;
+  let m;
+  while ((m = re.exec(scan))) {
+    let depth = 0;      // () [] {} nesting
+    let angle = 0;      // <> generics, tracked ONLY inside a type annotation
+    let seenEq = false; // passed this declarator's `=` (now in the initializer)
+    let inType = false; // inside a `: Type` annotation (before the `=`)
+    for (let i = m.index + m[0].length; i < scan.length; i++) {
+      const ch = scan[i];
+      if (ch === '(' || ch === '[' || ch === '{') { depth++; continue; }
+      if (ch === ')' || ch === ']' || ch === '}') { if (depth === 0) break; depth--; continue; }
+      if (depth !== 0) continue;
+      if (ch === ';') break;
+      // A plain `=` ends the type annotation and enters the initializer. `<=`,
+      // `>=`, `=>`, `==` are harmless here (seenEq only latches true).
+      if (ch === '=') { seenEq = true; inType = false; angle = 0; continue; }
+      // A `:` BEFORE the `=` opens the type annotation. A `:` after `=` (a
+      // ternary in the initializer) is NOT a type and must not suppress a real
+      // declarator comma.
+      if (ch === ':' && !seenEq) { inType = true; continue; }
+      // Inside a type annotation `<` / `>` are generic delimiters (a comparison
+      // only appears in the initializer, after `=`). Track their depth so a
+      // generic's comma (`Map<string, number>`) is skipped while a real
+      // declarator comma (`a: number, b: number`) still counts. A `>` that is
+      // part of a `=>` function-type arrow is not a generic close.
+      if (inType && ch === '<') { angle++; continue; }
+      if (inType && ch === '>' && scan[i - 1] !== '=') { if (angle > 0) angle--; continue; }
+      // A top-level comma starts a second declarator UNLESS it is a generic's
+      // comma inside a type annotation.
+      if (ch === ',' && !(inType && angle > 0)) return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Enumerate a module's provable named exports from its redacted `scan`, for the
+ * `no-missing-local-import` rule. Returns `null` when the export list is NOT
+ * fully enumerable (a `export *` star re-export, a destructuring export, or a
+ * multi-declarator `export const a = .., b = ..`), which tells the rule to treat
+ * the module as unknowable and flag nothing from it. Otherwise returns the set
+ * of exported names (the alias after `as` for a clause, and type/interface/enum
+ * names too, so a value import of a type is not falsely flagged; tsc owns that).
+ * @param {string} scan  string/template/comment-redacted source
+ * @returns {Set<string>|null}
+ */
+function enumerableExports(scan) {
+  // Unknowable export shapes: bail so the rule never false-positives.
+  if (/\bexport\s*\*/.test(scan)) return null;                       // export * from
+  if (/\bexport\s+(?:const|let|var)\s*[{[]/.test(scan)) return null; // destructuring export
+  if (hasMultiDeclaratorExport(scan)) return null;                   // export const a=1, b=2
+  const names = new Set();
+  let m;
+  const collect = (re) => { while ((m = re.exec(scan))) names.add(m[1]); };
+  collect(/\bexport\s+(?:async\s+)?function\b\s*\*?\s*([A-Za-z_$][\w$]*)/g);
+  collect(/\bexport\s+(?:abstract\s+)?class\s+([A-Za-z_$][\w$]*)/g);
+  collect(/\bexport\s+(?:const|let|var)\s+([A-Za-z_$][\w$]*)/g);
+  collect(/\bexport\s+(?:type|interface|enum|namespace)\s+([A-Za-z_$][\w$]*)/g);
+  // A named-default import (`import { default as Foo }`) is legal against an
+  // `export default` module, so record the `default` name when present.
+  if (/\bexport\s+default\b/.test(scan)) names.add('default');
+  // `export { a, b as c }` / `export type { ... }` / `export { x } from '...'`:
+  // the EXPORTED name is the alias after `as`, else the bare name.
+  const reClause = /\bexport\s+(?:type\s+)?\{([^}]*)\}/g;
+  while ((m = reClause.exec(scan))) {
+    for (let part of m[1].split(',')) {
+      part = part.trim().replace(/^type\s+/, '');
+      if (!part) continue;
+      const name = part.split(/\s+as\s+/).pop().trim();
+      if (/^[A-Za-z_$][\w$]*$/.test(name)) names.add(name);
+    }
+  }
+  return names;
+}
+
+/**
+ * The NAMED VALUE names a single `import { ... } from` clause pulls in, for the
+ * `no-missing-local-import` rule. Returns `null` for an `import type { ... }`
+ * (all type, skip), and `[]` for a default / namespace / side-effect import
+ * (nothing named to verify). A per-specifier inline `type` marker is dropped,
+ * and for `a as b` the IMPORTED name is `a` (what the target must export).
+ * @param {string} clause  the text between `import` and `from`
+ * @returns {string[]|null}
+ */
+function importedValueNames(clause) {
+  if (/^\s*type\b/.test(clause)) return null; // import type { ... }
+  const brace = clause.match(/\{([^}]*)\}/);
+  if (!brace) return []; // default / namespace only
+  return brace[1].split(',')
+    .map((s) => s.trim())
+    .filter((s) => s && !/^type\s/.test(s))
+    .map((s) => s.split(/\s+as\s+/)[0].trim())
+    .filter((n) => /^[A-Za-z_$][\w$]*$/.test(n));
+}
+
 /**
  * Scan a WebJs app directory and report convention violations.
  *
@@ -1125,6 +1236,59 @@ export async function checkConventions(appDir) {
   // directly, so it is not elided and ships the server import.
   await checkServerImportInBrowserModule(appDir, violations);
 
+  // --- Rule: no-missing-local-import ---
+  // A named value import of a symbol an app-internal module does not export is a
+  // runtime crash (the binding is undefined) that the elision-based checks miss,
+  // so `check` can stay green while `typecheck` is red (a dropped schema table
+  // orphaning a gallery module is the motivating dogfood case). Conservative by
+  // construction: only app-internal specifiers resolving to a known app file,
+  // only named value imports, and only when the target's exports are fully
+  // enumerable (see enumerableExports / importedValueNames).
+  {
+    // Fully-blanked view (blankStrings=true): string AND template AND comment
+    // bodies blank to spaces, position-preserving. The default `scan` keeps
+    // plain-string bodies VERBATIM (so callers can read `register('tag')`),
+    // which would let an `import`/`export` inside a string be matched, so use
+    // the fully-blanked view for both the export map and the import scan. The
+    // real specifier is read back from `content` at the same (length-preserved)
+    // offset.
+    const maskedByAbs = new Map();
+    for (const f of files) maskedByAbs.set(f.abs, redactStringsAndTemplates(f.content, true));
+    const exportsByAbs = new Map();
+    for (const f of files) exportsByAbs.set(f.abs, enumerableExports(maskedByAbs.get(f.abs)));
+    // `import\s+` excludes `import.meta` and a dynamic `import(`. The clause is
+    // `[^'";]*?` so it cannot swallow a side-effect `import '...'` (its quote) or
+    // bridge across a `;` into the next statement's `from`.
+    const reImport = /\bimport\s+([^'";]*?)\bfrom\s*(['"])/g;
+    for (const { abs, rel, content } of files) {
+      const masked = maskedByAbs.get(abs);
+      reImport.lastIndex = 0;
+      let m;
+      while ((m = reImport.exec(masked))) {
+        const quote = m[2];
+        const specStart = reImport.lastIndex;           // just past the opening quote
+        const specEnd = content.indexOf(quote, specStart);
+        if (specEnd < 0) continue;
+        const spec = content.slice(specStart, specEnd);
+        if (!/^(?:\.|#)/.test(spec)) continue; // app-internal only (relative or #alias)
+        const names = importedValueNames(m[1]);
+        if (!names || names.length === 0) continue;
+        const target = resolveImport(spec, abs, appDir);
+        const exp = exportsByAbs.get(target);
+        if (exp == null) continue; // not an app file, or exports not enumerable
+        for (const name of names) {
+          if (exp.has(name)) continue;
+          violations.push({
+            rule: 'no-missing-local-import',
+            file: rel,
+            message: `Imports \`${name}\` from \`${spec}\`, but that module does not export \`${name}\`. The binding is undefined at runtime and crashes on first use (often a renamed or removed export, e.g. a dropped schema table).`,
+            fix: `Add \`${name}\` to \`${spec}\`, correct the imported name, or remove the import.`,
+          });
+        }
+      }
+    }
+  }
+
   return violations;
 }
 

package/src/js-scan.js

@@ -432,7 +432,13 @@ export function maskComments(src) {
  */
 export function extractWebComponentClassBodies(content) {
   const bodies = [];
-  const re = /class\s+\w+\s+extends\s+WebComponent/g;
+  // The optional `(?:\s*<[^{}();]*?>)?` skips a TypeScript generic parameter
+  // list on the class name (`class Grid<T> extends WebComponent`), so a generic
+  // component is not missed (which would let elision wrongly strip an
+  // interactive component, the unsafe direction). The exclusion class keeps the
+  // generic from swallowing the class body / a call, and stops it staying
+  // within the type-parameter list (#753, found differentially).
+  const re = /class\s+\w+(?:\s*<[^{}();]*?>)?\s+extends\s+WebComponent/g;
   let m;
   while ((m = re.exec(content)) !== null) {
     let i = m.index + m[0].length;

package/src/listener-bun.js

@@ -238,6 +238,16 @@ async function bunUpgrade(req, srv, ctx) {
 
   const wrapper = new BunWsAdapter();
   const handlerReq = upgradeRequest(req, url);
+  // Stamp the framework-trusted socket IP on the handler request so a `WS`
+  // handler's `clientIp(req)` returns the real peer, not a spoofed inbound
+  // `x-webjs-remote-ip` (#778). `srv.requestIP` must be queried with Bun's
+  // ORIGINAL `req` (the rebuilt `handlerReq` is unknown to it); the WeakMap
+  // stamp then makes `handlerReq` authoritative. Mirrors `stampRemoteIp` on the
+  // fetch path (which strips + stamps `req` directly). `upgradeRequest` already
+  // dropped any inbound copy of the header.
+  let ip;
+  try { ip = srv.requestIP(req)?.address; } catch {}
+  setTrustedRemoteIp(handlerReq, ip || '');
   const ok = srv.upgrade(req, {
     data: { wrapper, mod, req: handlerReq, params: match.params, pathname: url.pathname },
   });
@@ -254,7 +264,14 @@ async function bunUpgrade(req, srv, ctx) {
  */
 function upgradeRequest(req, url) {
   const headers = new Headers();
-  req.headers.forEach((v, k) => { if (!k.startsWith(':')) headers.set(k, v); });
+  // Skip a client-supplied `x-webjs-remote-ip`: it is a framework-internal trust
+  // header the caller re-stamps via the authoritative WeakMap (#778). Copying it
+  // would let a client spoof `clientIp` inside the WS handler on the fallback
+  // header read.
+  req.headers.forEach((v, k) => {
+    if (k.startsWith(':') || k === 'x-webjs-remote-ip') return;
+    headers.set(k, v);
+  });
   return new Request(url, { method: 'GET', headers });
 }
 

package/src/module-graph.js

@@ -14,7 +14,7 @@
 import { readFile, readdir, stat } from 'node:fs/promises';
 import { existsSync, readFileSync } from 'node:fs';
 import { join, resolve, dirname, extname, sep } from 'node:path';
-import { redactStringsAndTemplates } from './js-scan.js';
+import { redactStringsAndTemplates, redactToPlaceholders } from './js-scan.js';
 
 /**
  * Per-appDir cache of the parsed `package.json "imports"` subpath-alias map
@@ -78,7 +78,7 @@ export function expandImportAlias(spec, appDir) {
 }
 
 /** @type {RegExp} match static `import … from '…'` and `import '…'` */
-const IMPORT_RE = /\bimport\s+(?:(?:[\w*{}\s,]+)\s+from\s+)?['"]([^'"]+)['"]/g;
+const IMPORT_RE = /\bimport\s+(?:(?:[\w*{}\s,]+)\s+from\s+)?['"]([^'"]+)['"]/gd;
 
 /**
  * @type {RegExp} match `export … from '…'` re-exports.
@@ -94,12 +94,16 @@ const IMPORT_RE = /\bimport\s+(?:(?:[\w*{}\s,]+)\s+from\s+)?['"]([^'"]+)['"]/g;
  *
  * Barrel files are common (`lib/index.ts` re-exports its siblings),
  * and the graph must follow these edges or downstream consumers of
- * the barrel see authorisation 404s on the underlying files. The
- * gap class excludes quotes and `;` (so the lazy match cannot cross
- * a statement boundary) but DOES allow newlines, so multi-line
- * brace lists are caught.
+ * the barrel see authorisation 404s on the underlying files. The gap
+ * class excludes quotes, `;`, AND the backtick but DOES allow newlines,
+ * so multi-line brace lists are caught. The primary defence against a
+ * stray `export` word inside a literal swallowing a real later edge is
+ * that `parseFile` scans over the FULLY-BLANKED mask (every comment /
+ * string / template / regex body blanked), so no keyword can anchor
+ * inside a literal at all (#753); the exclusions here are belt-and-
+ * suspenders on top of that.
  */
-const EXPORT_FROM_RE = /\bexport\b[^'";]+?\sfrom\s+['"]([^'"]+)['"]/g;
+const EXPORT_FROM_RE = /\bexport\b[^'";`]+?\sfrom\s+['"]([^'"]+)['"]/gd;
 
 /**
  * @type {RegExp} match a dynamic `import('…')` with a STRING-LITERAL specifier
@@ -118,7 +122,7 @@ const EXPORT_FROM_RE = /\bexport\b[^'";]+?\sfrom\s+['"]([^'"]+)['"]/g;
  * `import('./pages/' + name)` the char after the closing quote is `+`, neither
  * `,` nor `)`, so it does not match.
  */
-const DYNAMIC_IMPORT_RE = /\bimport\s*\(\s*['"]([^'"]+)['"]\s*[,)]/g;
+const DYNAMIC_IMPORT_RE = /\bimport\s*\(\s*['"]([^'"]+)['"]\s*[,)]/gd;
 
 /**
  * @typedef {Map<string, Set<string>>} ModuleGraph
@@ -459,16 +463,26 @@ async function parseFile(file, appDir, graph, seen, dynamic, bare) {
   // graph edge to whatever path that string names. Since this caller only
   // checks keyword-in-code-position, blank every literal body so a
   // code-example `import` string never becomes an edge.
+  // Scan for edges over the FULLY-BLANKED mask: every comment / string /
+  // template / regex body is blanked to spaces (delimiters kept), `${...}`
+  // holes stay as code. Reason (#753, found differentially): a stray `import` /
+  // `export` word inside a comment, template, OR regex literal must not anchor a
+  // lazy regex match (e.g. `EXPORT_FROM_RE`'s `[^'";`]+?`) that spans across the
+  // literal's closing delimiter and consumes the next real `from '<spec>'`,
+  // whose keyword then sits in the blanked literal and is dropped, silently
+  // losing the real edge (the gate then 404s a legitimately imported module).
+  // Scanning over the blanked mask means NO keyword can anchor inside any
+  // literal or comment at all, so the whole class of delimiter blind spots
+  // (comment, string, template, regex) is closed at once, and there is nothing
+  // left for a per-match position guard to reject. The specifier itself is a
+  // string (blanked here), so it is read back from raw `src` via the match's
+  // group indices (the `d` flag).
   const masked = redactStringsAndTemplates(src, true);
   const deps = new Set();
   /** @type {Set<string>} bare npm vendor specifiers imported by this file (#754) */
   const bareDeps = new Set();
   for (const re of [IMPORT_RE, EXPORT_FROM_RE]) {
-    for (const m of src.matchAll(re)) {
-      // m.index is the keyword start (`\bimport` / `\bexport`). If that
-      // position is blanked in the mask, the match lives inside a literal
-      // and is not a real import edge.
-      if (masked[m.index] === ' ') continue;
+    for (const m of masked.matchAll(re)) {
       // A statement-leading `import type { X }` / `import type * as X` /
       // `import type Foo` (default type import) / `export type { X }` /
       // `export type *` is fully erased by the TS stripper, so it never becomes
@@ -481,22 +495,17 @@ async function parseFile(file, appDir, graph, seen, dynamic, bare) {
       //     followed by `from` is NOT type-only.
       //   - a MIXED `import { type A, b }` does NOT lead with `type`, so it is
       //     kept (its `b` binding is a real runtime edge).
+      // (m[0] here is over the mask, which keeps the binding syntax verbatim.)
       // #805
       const lead = m[0];
       const typeOnly =
         /^(?:import|export)\s+type\s*[{*]/.test(lead) ||
         (/^import\s+type\s+[A-Za-z_$]/.test(lead) && !/^import\s+type\s+from\b/.test(lead));
       if (typeOnly) continue;
-      const spec = m[1];
-      // Guard a match whose `from '<spec>'` tail reaches INTO a blanked literal:
-      // EXPORT_FROM_RE's lazy `[^'";]+?` can span a template body to a `from`
-      // written inside example code (`export const t = html\`...import x from
-      // 'left-pad'\``), so the KEYWORD is real but the SPECIFIER is not. A real
-      // string keeps its delimiters in the mask (only the body blanks), while a
-      // template body blanks whole, so a blanked opening quote means the
-      // specifier is inside a literal and the match is spurious.
-      const quoteAt = m.index + m[0].length - spec.length - 2;
-      if (masked[quoteAt] === ' ') continue;
+      // The specifier is read from RAW src at the match's captured-group indices
+      // (the group is the blanked string body in the mask; its position is the
+      // real specifier in src).
+      const spec = src.slice(m.indices[1][0], m.indices[1][1]);
       // Only resolve relative imports + `#`-style subpath aliases (#555)
       // within the project. A bare npm specifier (dayjs) has no alias match
       // and is skipped FROM THE GRAPH, but recorded as a vendor edge so SSR
@@ -513,12 +522,30 @@ async function parseFile(file, appDir, graph, seen, dynamic, bare) {
   }
   // Dynamic `import('…')` with a string-literal specifier (#751): a separate
   // edge class so the gate admits the lazily-loaded module (no 404) without
-  // preloading it. Same redaction-mask + alias rules as the static scan. A
-  // target already statically imported is not duplicated as a dynamic edge.
+  // preloading it. A target already statically imported is not duplicated as a
+  // dynamic edge.
+  //
+  // The static scan above runs over the FULLY-BLANKED mask, which also blanks
+  // the code inside `${...}` template holes. That drops a dynamic import written
+  // directly inside a hole (`html\`${import('./x.ts')}\``), which the AST counts
+  // as an edge but the mask scan did not, so the gate 404s a legitimately-loaded
+  // module (#918, the admit-fewer direction of the #753 family). So the dynamic
+  // scan instead runs over the PLACEHOLDER redaction (#634), which keeps `${...}`
+  // hole code readable (so a hole-position `import(...)` IS seen) while still
+  // tokenizing string / template-TEXT bodies to `__STR_<idx>__` and blanking
+  // comment / regex bodies (so a dynamic import written as literal TEXT is NOT
+  // an edge). The #753 swallow class stays closed because `DYNAMIC_IMPORT_RE` is
+  // tightly anchored on `import(`, never a lazy cross-delimiter span. The
+  // specifier surfaces as a `__STR_<idx>__` token, recovered from `literals`; a
+  // computed `import(expr)` still falls out (its char after the quote is not
+  // `,`/`)`), preserving the documented limitation.
+  const { redacted: holeAware, literals } = redactToPlaceholders(src);
   const dynDeps = new Set();
-  for (const m of src.matchAll(DYNAMIC_IMPORT_RE)) {
-    if (masked[m.index] === ' ') continue;
-    const spec = m[1];
+  for (const m of holeAware.matchAll(DYNAMIC_IMPORT_RE)) {
+    const token = m[1];
+    const pm = /^__STR_(\d+)__$/.exec(token);
+    const spec = pm ? literals[Number(pm[1])] : token;
+    if (spec == null) continue;
     if (!spec.startsWith('.') && !spec.startsWith('/') && !expandImportAlias(spec, appDir)) continue;
     const resolved = resolveImport(spec, file, appDir);
     if (resolved && !deps.has(resolved)) dynDeps.add(resolved);

package/src/ssr.js

@@ -194,25 +194,30 @@ export async function ssrPage(route, params, url, opts) {
     // enter the viewport.
     const { eager: eagerComponents, lazy: lazyComponents } =
       componentPreloads(suspenseCtx.usedComponents, opts.appDir, opts.elidableComponents);
+    // The walk roots for BOTH preload passes are the BOOT's actually-shipped
+    // module set (`moduleUrls`, which already drops inert page/layout modules and
+    // substitutes an import-only page with its components), NOT the raw route
+    // entries `[route.file, ...route.layouts]`. Rooting at the raw entries would
+    // walk a dropped page's SSR-only subtree (a direct import OR a relative
+    // helper) and hint a `modulepreload` for a module nothing that ships imports,
+    // an over-fetch (#780, the app-module analog of the #754 vendor over-fetch).
+    const shippedRoots = moduleUrls.map((u) =>
+      resolve(opts.appDir, u.startsWith('/') ? u.slice(1) : u));
     const preloads = deduplicatedPreloads(
       eagerComponents,
       moduleUrls,
       opts.moduleGraph,
-      [route.file, ...route.layouts],
+      shippedRoots,
       opts.appDir,
       opts.serverFiles,
       opts.elidableComponents,
     );
     // Vendor modulepreload (#754): flatten the npm CDN waterfall by hinting the
     // vendor URLs the page's SHIPPED modules actually import, fetched in parallel
-    // instead of discovered level by level. The walk roots are the BOOT's shipped
-    // module set (`moduleUrls`, which already drops inert page/layout modules and
-    // substitutes an import-only page with its components) plus the rendered
-    // components, so a vendor reached ONLY through a dropped module (a page's
-    // SSR-only direct import OR its SSR-only relative helper) is never preloaded
-    // (no over-fetch).
-    const shippedRoots = moduleUrls.map((u) =>
-      resolve(opts.appDir, u.startsWith('/') ? u.slice(1) : u));
+    // instead of discovered level by level. Same shipped-module roots as the
+    // app-module walk above, so a vendor reached ONLY through a dropped module
+    // (a page's SSR-only direct import OR its SSR-only relative helper) is never
+    // preloaded (no over-fetch).
     const vendorPreloads = vendorPreloadTargets(
       reachedVendorSpecifiers(
         opts.moduleGraph,
@@ -1523,6 +1528,7 @@ function wrapHead(opts) {
 <html lang="en">
 <head>
 <meta charset="utf-8">
+<style${n}>@layer webjs-host{:where([data-wj-host]){display:block}:where([data-wj-host][hidden]:not([hidden='until-found'])){display:none}}</style>
 ${opts.nonce ? `<meta name="csp-nonce" content="${escapeAttr(opts.nonce)}">` : ''}
 ${metaTags.join('\n')}
 <title>${escapeHtml(title)}</title>
@@ -1581,10 +1587,24 @@ function componentPreloads(usedTags, appDir, elidable) {
  * Merge component preloads with transitive dependencies from the module
  * graph, then deduplicate against the already-imported module URLs.
  *
+ * The walk ROOTS (`entryFiles`) are the boot's actually-SHIPPED page/layout
+ * module set (the caller passes the absolute paths of `moduleUrls`, which
+ * already drops an inert page/layout and substitutes an import-only page with
+ * its components), NOT the raw `[route.file, ...route.layouts]` route entries.
+ * This matches `reachedVendorSpecifiers`' roots so the two walks stay
+ * consistent. Rooting at the shipped set means a module reached ONLY through a
+ * dropped page/layout (its SSR-only direct app import OR its SSR-only relative
+ * helper) is never a walk root's dep, so it gets no `modulepreload` hint (no
+ * over-fetch, #780). A module that also ships some other way (a component shared
+ * with a live route, or reached via an import-only page's substituted
+ * components) is still reached through a real shipped root, so its hint stays
+ * (no under-fetch). `seen = new Set(moduleUrls)` already excludes the shipped
+ * modules' own URLs; the shipped-roots change closes the TRANSITIVE gap.
+ *
  * @param {string[]} componentUrls  direct component module URLs
  * @param {string[]} moduleUrls     boot script imports (page + layouts)
  * @param {import('./module-graph.js').ModuleGraph | undefined} graph
- * @param {string[]} entryFiles     absolute paths of page + layout files
+ * @param {string[]} entryFiles     absolute paths of the SHIPPED page/layout modules (from `moduleUrls`)
  * @param {string} appDir
  * @param {Set<string>} [elidableComponents]  absolute paths to skip in the walk
  * @returns {string[]}

package/src/vendor.js

@@ -1176,9 +1176,16 @@ async function pruneOrphans(appDir, expected) {
  * instead. When the app has zero bare-specifier imports at all
  * (scanned source produced nothing), returns
  * `{ pins: [], pruned: [], downloaded: 0, noBareImports: true }`
- * WITHOUT writing the pin file. Callers that need to surface a
- * non-zero exit code key off `failed` or `noBareImports`; both
- * are absent on the success path.
+ * WITHOUT writing the pin file. When the scan DID find specifiers but
+ * every one was dropped because no local version resolved (the package
+ * is not installed under `node_modules`), returns
+ * `{ pins: [], pruned: [], downloaded: 0, droppedUnresolvable: [...] }`
+ * (also WITHOUT a pin file), so the caller can name the found-but-
+ * uninstalled specifiers instead of claiming there were none. A
+ * partial pin (some resolved, some dropped) still writes the file and
+ * carries `droppedUnresolvable` alongside `pins`. Callers that need to
+ * surface a non-zero exit code key off `failed`, `noBareImports`, or an
+ * all-dropped `droppedUnresolvable`; all are absent on a clean success.
  *
  * The `from` option mirrors importmap-rails's `bin/importmap pin foo
  * --from jsdelivr`. Default `jspm` resolves to jspm.io; other values
@@ -1196,6 +1203,7 @@ async function pruneOrphans(appDir, expected) {
  *   provider?: string,
  *   failed?: boolean,
  *   noBareImports?: boolean,
+ *   droppedUnresolvable?: string[],
  *   attemptedInstalls?: string[],
  * }>}
  */
@@ -1224,12 +1232,23 @@ export async function pinAll(appDir, opts = {}) {
    * @type {Map<string, { pkg: string, version: string, subpath: string }>}
    */
   const partsByInstall = new Map();
+  /**
+   * Bare specifiers the scan FOUND but that were dropped because no local
+   * version could be resolved (the package is not installed under the app's
+   * `node_modules`). Kept distinct from "scan found nothing" so the CLI can
+   * name them and point at the remedy instead of claiming there were none.
+   * @type {string[]}
+   */
+  const droppedUnresolvable = [];
   for (const spec of bare) {
     if (BUILTIN.has(spec)) continue;
     const pkg = extractPackageName(spec);
     if (!pkg || BUILTIN.has(pkg) || FRAMEWORK_SERVER_ONLY.has(pkg)) continue;
     const version = getPackageVersion(pkg, appDir);
-    if (!version) continue;
+    if (!version) {
+      droppedUnresolvable.push(spec);
+      continue;
+    }
     const subpath = spec.slice(pkg.length);
     const install = `${pkg}@${version}${subpath}`;
     installs.push(install);
@@ -1350,12 +1369,22 @@ export async function pinAll(appDir, opts = {}) {
   // -imports filter, so the file exists but does nothing. The CLI
   // surfaces this as a clearer "no bare imports found" message.
   if (installs.length === 0) {
+    // Distinguish the two empty-set causes the CLI must report differently:
+    // the scan genuinely found nothing (noBareImports) vs it found specifiers
+    // that were all dropped for a missing local version (droppedUnresolvable).
+    if (droppedUnresolvable.length > 0) {
+      return { pins, pruned: [], downloaded, droppedUnresolvable, provider: from };
+    }
     return { pins, pruned: [], downloaded, noBareImports: true, provider: from };
   }
 
   await writePinFile(appDir, importmap, integrity, from);
   const pruned = await pruneOrphans(appDir, expected);
-  return { pins, pruned, downloaded, provider: from };
+  // Some specifiers may have pinned while others were dropped for a missing
+  // version; surface the dropped ones so a partial pin is not silent.
+  return droppedUnresolvable.length > 0
+    ? { pins, pruned, downloaded, provider: from, droppedUnresolvable }
+    : { pins, pruned, downloaded, provider: from };
 }
 
 /**

package/src/websocket.js

@@ -4,6 +4,7 @@ import { urlFromRequest } from './forwarded.js';
 import { registerClient } from './broadcast.js';
 import { loadWsModule } from './listener-core.js';
 import { makeThenable } from './thenable-params.js';
+import { setTrustedRemoteIp } from './rate-limit.js';
 
 /**
  * WebSocket support.
@@ -106,7 +107,17 @@ function buildRequestFromUpgrade(req, url) {
   const headers = {};
   for (const [k, v] of Object.entries(req.headers)) {
     if (k.startsWith(':')) continue;
+    // Never copy an inbound `x-webjs-remote-ip`: it is a framework-internal
+    // trust header a client could spoof on the upgrade. The real socket IP is
+    // stamped below via the authoritative WeakMap (#778, the WS-seam analog of
+    // the #773 fetch-path IP-trust fix).
+    if (k === 'x-webjs-remote-ip') continue;
     headers[k] = Array.isArray(v) ? v.join(',') : String(v ?? '');
   }
-  return new Request(url, { method: 'GET', headers });
+  const webReq = new Request(url, { method: 'GET', headers });
+  // Stamp the framework-trusted socket IP so `clientIp(req)` inside the `WS`
+  // handler returns the real peer address (the WeakMap is authoritative and
+  // ignores the inbound header), matching the fetch path's `toWebRequest`.
+  setTrustedRemoteIp(webReq, req.socket?.remoteAddress || '');
+  return webReq;
 }