akanjs 2.4.1 → 2.4.2-rc.0

package/client/csrTypes.ts

@@ -50,6 +50,13 @@ export interface PageConfig {
   rscPatchHeadSafe?: boolean;
   topSafeAreaColor?: string;
   bottomSafeAreaColor?: string;
+  /**
+   * Keeps the route out of `akan build`. The route still serves under `akan start`, but nothing about it
+   * reaches production: no bundle, no manifest entry, no URL. On a `_layout`, every route under that
+   * directory is excluded with it. Must be written as a literal `true`/`false` — the build reads it from
+   * the source without evaluating the module.
+   */
+  devOnly?: boolean;
 }
 
 export interface CsrState {

package/client/frameConfig.ts

@@ -24,6 +24,8 @@ const pageConfigKeys = new Set<keyof PageConfig>([
   "topSafeAreaColor",
   "bottomSafeAreaColor",
 ]);
+
+const buildPageConfigKeys = new Set<keyof PageConfig>(["devOnly"]);
 const transitionTypes = new Set<TransitionType>(["none", "fade", "bottomUp", "stack", "scaleOut"]);
 const ssrRenderModes = new Set<SsrRenderMode>(["stream", "block"]);
 const DEFAULT_BOOLEAN_INSET = 48;
@@ -38,10 +40,13 @@ export function validatePageConfig(routeKey: string, config?: PageConfig) {
   if (!isRecord(config)) throw new Error(`[route-convention] pageConfig in ${routeKey} must be an object.`);
   const pageConfig = config as PageConfig;
   for (const key of Object.keys(pageConfig)) {
-    if (!pageConfigKeys.has(key as keyof PageConfig)) {
+    if (!pageConfigKeys.has(key as keyof PageConfig) && !buildPageConfigKeys.has(key as keyof PageConfig)) {
       throw new Error(`[route-convention] unsupported pageConfig option "${key}" in ${routeKey}`);
     }
   }
+  if (pageConfig.devOnly !== undefined && typeof pageConfig.devOnly !== "boolean") {
+    throw new Error(`[route-convention] pageConfig.devOnly in ${routeKey} must be a boolean.`);
+  }
   if (pageConfig.transition !== undefined && !transitionTypes.has(pageConfig.transition)) {
     throw new Error(`[route-convention] unsupported pageConfig.transition "${pageConfig.transition}" in ${routeKey}`);
   }

package/client/rscNavigation.ts

@@ -1,5 +1,6 @@
 declare global {
   var __AKAN_RSC_CLEAR_CACHE__: (() => void) | undefined;
+  var __AKAN_RSC_IS_FROM_CACHE__: (() => boolean) | undefined;
   var __AKAN_RSC_NAVIGATE__:
     | ((href: string, options?: { replace?: boolean; scrollToTop?: boolean }) => Promise<void>)
     | undefined;
@@ -9,11 +10,19 @@ export const clearRscNavigationCache = () => {
   globalThis.__AKAN_RSC_CLEAR_CACHE__?.();
 };
 
+/**
+ * True when the page tree currently on screen was replayed from the RSC navigation cache instead of
+ * fetched from the server. Data hydrated out of such a payload can be arbitrarily old, so anything
+ * that must show current values should refetch.
+ */
+export const isRscNavigationFromCache = () => globalThis.__AKAN_RSC_IS_FROM_CACHE__?.() ?? false;
+
 export const navigateRsc = (href: string, options?: { replace?: boolean; scrollToTop?: boolean }) => {
   return globalThis.__AKAN_RSC_NAVIGATE__?.(href, options);
 };
 
 export const useRscNavigation = () => ({
   clearCache: clearRscNavigationCache,
+  isFromCache: isRscNavigationFromCache,
   navigate: navigateRsc,
 });

package/common/index.ts

@@ -54,3 +54,8 @@ export { sleep } from "./sleep";
 export { splitVersion } from "./splitVersion";
 export { getBasePathFromPathname, parseBasePaths } from "./subRoute";
 export type * from "./types";
+export {
+  type WebsocketAuthAckData,
+  type WebsocketAuthRequest,
+  websocketAuthContract,
+} from "./websocketAuth";

package/common/websocketAuth.ts

@@ -0,0 +1,24 @@
+export interface WebsocketAuthRequest {
+  key: string;
+  data: [string | null];
+}
+
+export interface WebsocketAuthAckData {
+  type: "auth";
+  revokedRooms: string[];
+}
+
+/**
+ * Framework-owned websocket auth contract shared by the client and the server dispatcher.
+ * The credential frame carries the raw bearer token; verifying it stays in userland middleware,
+ * so the server only swaps the credential snapshot held on the socket.
+ */
+export const websocketAuthContract = {
+  key: "__auth",
+  makeRequest: (jwt: string | null): WebsocketAuthRequest => ({ key: "__auth", data: [jwt] }),
+  makeAck: (revokedRooms: string[]): WebsocketAuthAckData => ({ type: "auth", revokedRooms }),
+  readJwt: (data: unknown): string | null => {
+    const jwt = Array.isArray(data) ? data[0] : null;
+    return typeof jwt === "string" && jwt.length > 0 ? jwt : null;
+  },
+} as const;

package/fetch/client/fetchClient.ts

@@ -197,6 +197,7 @@ export class FetchClient {
   }
   setJwt(jwt: string | null) {
     this.jwt = jwt;
+    this.ws.setJwt(jwt);
   }
   #makeAuthHeaders(option?: FetchPolicy): Record<string, string> {
     if (option?.token) return { Authorization: `Bearer ${option.token}` };

package/fetch/client/wsClient.ts

@@ -1,5 +1,6 @@
-import { Logger } from "akanjs/common";
+import { Logger, websocketAuthContract } from "akanjs/common";
 import type {
+  WebsocketAuthAck,
   WebsocketMessageData,
   WebsocketPublishData,
   WebsocketReqData,
@@ -39,6 +40,7 @@ export class WsClient {
   #roomSubscribeMap = new Map<string, SubscribeOption>();
   #listenerMap = new Map<string, Set<Listener>>();
   #destroyed = false;
+  #jwt: string | null = null;
   connected = false;
 
   constructor(
@@ -52,6 +54,21 @@ export class WsClient {
     this.ErrorCls = ErrorCls;
   }
 
+  /**
+   * The handshake only carries a same-origin cookie, so clients that hold the token in memory
+   * (native, cross-origin) authenticate with this frame instead. Signing out sends `null`, which
+   * drops the handshake cookie server-side and revokes the rooms it had authorized.
+   */
+  setJwt(jwt: string | null) {
+    if (this.#jwt === jwt) return;
+    this.#jwt = jwt;
+    if (this.#ws?.readyState === WebSocket.OPEN) this.#sendAuth();
+  }
+
+  #sendAuth() {
+    this.#ws?.send(JSON.stringify(websocketAuthContract.makeRequest(this.#jwt)));
+  }
+
   connect() {
     if (this.#ws && this.#ws.readyState !== WebSocket.CLOSED) return;
     this.logger.debug(`Connecting to ${this.url}`);
@@ -68,6 +85,8 @@ export class WsClient {
       this.#reconnectAttempts = 0;
       this.connected = true;
       this.logger.debug(`WebSocket connected`);
+
+      if (this.#jwt) this.#sendAuth();
       this.#roomSubscribeMap.forEach((option) => {
         const data: WebsocketReqData = { key: option.key, data: option.data, subscribe: true };
         this.#ws?.send(JSON.stringify(data));
@@ -97,6 +116,14 @@ export class WsClient {
             this.#handlePubsub(publishData.roomId, publishData.data);
             break;
           }
+          case "auth": {
+            const ack = parsed as WebsocketAuthAck;
+            for (const roomId of ack.revokedRooms) {
+              this.#roomSubscribeMap.delete(roomId);
+              this.logger.warn(`Websocket room ${roomId} is no longer authorized`);
+            }
+            break;
+          }
           default:
             this.logger.warn(`Unknown WebSocket message type: ${type} ${JSON.stringify(parsed)}`);
             break;

package/index.ts

@@ -163,6 +163,12 @@ export interface AppConfigResult {
   docker: DockerConfig;
   defaultDatabaseMode: DatabaseMode;
   routes?: AkanRouteConfig[];
+  /**
+   * Mounts `libs/<lib>/page` into this app under `page/(libs)/(<lib>)` on sync. `true` takes every lib
+   * dependency that ships a `page` folder, an array takes exactly the libs listed, `false` (the default)
+   * syncs nothing and removes what a previous sync created.
+   */
+  syncPageLibs?: string[] | boolean;
   externalLibs: string[];
   barrelImports: string[];
   optimizeImports: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akanjs",
-  "version": "2.4.1",
+  "version": "2.4.2-rc.0",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {

package/server/akanServer.ts

@@ -23,6 +23,7 @@ import { ProcessMetricsCollector } from "./processMetricsCollector";
 import { WebProxyRunner } from "./proxy";
 import { SignalResolver } from "./resolver";
 import { ApiRouter } from "./routing/apiRouter";
+import type { AppWsData } from "./routing/appWsData";
 import type { HttpRoutes, SignalRoutes, WebsocketRoutes } from "./types";
 import type { WebRouter } from "./webRouter";
 
@@ -65,8 +66,8 @@ export interface AkanServerConsoleInfo {
 export class AkanServer {
   status: "stopped" | "initializing" | "initialized" | "starting" | "running" | "stopping" = "stopped";
 
-  #server: Bun.Server<{ createdAt: number } | HmrWsData> | null = null;
-  #wsServer: Bun.Server<{ createdAt: number } | HmrWsData> | null = null;
+  #server: Bun.Server<AppWsData | HmrWsData> | null = null;
+  #wsServer: Bun.Server<AppWsData | HmrWsData> | null = null;
   #prepared: AkanAppPrepared | null = null;
   readonly logger: Logger;
   readonly name: string;
@@ -241,7 +242,7 @@ export class AkanServer {
       }),
       
       data: {},
-    } as Bun.WebSocketHandler<{ createdAt: number } | HmrWsData>;
+    } as Bun.WebSocketHandler<AppWsData | HmrWsData>;
     
     this.#server = Bun.serve({
       idleTimeout: 0,
@@ -270,7 +271,7 @@ export class AkanServer {
           builtinRoutes,
           routeOptions,
           renderEnvRoutes,
-          upgradeAppWs: (req: Request, data: { createdAt: number }) => this.#wsServer?.upgrade(req, { data }) ?? false,
+          upgradeAppWs: (req: Request, data: AppWsData) => this.#wsServer?.upgrade(req, { data }) ?? false,
           webProxyRunner,
         }),
         websocket: websocketHandlers,

package/server/resolver/signal.resolver.ts

@@ -452,6 +452,29 @@ export class SignalResolver {
     return Boolean(req.headers.get("authorization") || req.headers.get("cookie")?.includes("jwt="));
   }
 
+  /**
+   * Re-checks the guards of every room this socket is subscribed to and drops the ones that no
+   * longer pass. Called when the socket's credential changes: a pubsub room is authorized once at
+   * subscribe time, so without this a signed-out socket would keep receiving its old rooms.
+   */
+  static async revalidateWsRooms(ws: Bun.ServerWebSocket<any>, registry: InjectRegistry): Promise<string[]> {
+    const roomCtxMap = SignalResolver.#liveWsPubsubRoomCtx.get(ws);
+    if (!roomCtxMap?.size) return [];
+    const websocket = SignalResolver.#getWebsocket(registry);
+    const revokedRooms: string[] = [];
+    for (const [roomId, roomCtx] of [...roomCtxMap]) {
+      if (await roomCtx.authorize()) continue;
+      ws.unsubscribe(roomId);
+      await Promise.all([...roomCtx.getWebSocketContext().onUnsubscribe.values()].map((handler) => handler()));
+      roomCtxMap.delete(roomId);
+      websocket.leaveRoom(ws, roomId);
+      revokedRooms.push(roomId);
+      SignalResolver.logger.verbose(`WebSocket lost access to room ${roomId}; unsubscribed`);
+    }
+    if (roomCtxMap.size === 0) SignalResolver.#liveWsPubsubRoomCtx.delete(ws);
+    return revokedRooms;
+  }
+
   static async handleWsOpen(ws: Bun.ServerWebSocket<any>, registry: InjectRegistry) {
     await SignalResolver.#getWebsocket(registry).registerSocket(ws);
   }

package/server/routing/apiRouter.ts

@@ -1,11 +1,12 @@
 import { dayjs } from "akanjs/base";
-import type { Logger } from "akanjs/common";
+import { type Logger, websocketAuthContract } from "akanjs/common";
 import type { InjectRegistry } from "akanjs/service";
 import { Exception, type WebsocketReqData } from "akanjs/signal";
 import type { HmrWsData, HmrWsHub } from "../hmr/wsHub";
 import { copyBunRequestFields, type WebProxyRunner } from "../proxy";
 import { SignalResolver } from "../resolver";
 import type { HttpRoutes, SignalRouteOptions, WebsocketRoutes } from "../types";
+import { AppWsData } from "./appWsData";
 
 /**
  * Minimal render-state view the HMR WS hello message needs.
@@ -30,7 +31,7 @@ export interface ApiRouteInputs {
   routeOptions?: Record<string, SignalRouteOptions>;
   renderEnvRoutes: HttpRoutes;
   /** Upgrades the incoming request into an app-signal WebSocket. */
-  upgradeAppWs: (req: Request, data: { createdAt: number }) => boolean;
+  upgradeAppWs: (req: Request, data: AppWsData) => boolean;
   webProxyRunner?: WebProxyRunner | null;
 }
 
@@ -85,7 +86,7 @@ export class ApiRouter {
     const endpointPaths = new Set([...endpointEntries.map(([path]) => path), ...builtinEntries.map(([path]) => path)]);
     const routeTable = {
       [`${prefix}${websocketPrefix}` as "/api/ws"]: (req) => {
-        const upgraded = upgradeAppWs(req, { createdAt: Date.now() });
+        const upgraded = upgradeAppWs(req, AppWsData.fromRequest(req));
         if (upgraded) return;
         return new Response("Failed to upgrade to WebSocket", { status: 500 });
       },
@@ -138,6 +139,13 @@ export class ApiRouter {
           if (typeof message === "string") {
             const msg = JSON.parse(message) as WebsocketReqData;
             if (!msg.key) throw new Error("Message key is required");
+            if (msg.key === websocketAuthContract.key) {
+
+              AppWsData.applyCredential(AppWsData.of(ws), websocketAuthContract.readJwt(msg.data));
+              const revokedRooms = await SignalResolver.revalidateWsRooms(ws, registry);
+              ws.send(JSON.stringify(websocketAuthContract.makeAck(revokedRooms)));
+              return;
+            }
             const wsRoute = wsRoutes[msg.key];
             if (!wsRoute) throw new Error(`WebSocket route "${msg.key}" is not registered`);
             const eventType =

package/server/routing/appWsData.ts

@@ -0,0 +1,50 @@
+const CREDENTIAL_HEADERS = ["authorization", "cookie", "user-agent"] as const;
+
+/**
+ * Credential snapshot taken at the websocket handshake and carried on `ws.data` for the life of the
+ * socket, so auth middleware and guards can read the caller the same way they read an HTTP request.
+ * Only the credential headers are copied — retaining the whole `Request` would pin it for as long
+ * as the socket stays open.
+ */
+export class AppWsData {
+  static fromRequest(req: Request): AppWsData {
+    const headers = new Headers();
+    for (const key of CREDENTIAL_HEADERS) {
+      const value = req.headers.get(key);
+      if (value) headers.set(key, value);
+    }
+    return new AppWsData(headers);
+  }
+  static of(ws: Bun.ServerWebSocket<unknown>): AppWsData {
+    return ws.data as AppWsData;
+  }
+  /**
+   * Swaps the credential the socket authenticates with. Callers must run this synchronously on the
+   * auth frame: frames arrive in order, so a subscribe sent right after the credential must not be
+   * able to observe the previous one.
+   */
+  static applyCredential(data: AppWsData, jwt: string | null) {
+    if (jwt) data.headers.set("authorization", `Bearer ${jwt}`);
+    else {
+      data.headers.delete("authorization");
+      data.cookies.delete("jwt");
+      const cookie = [...data.cookies].map(([name, value]) => `${name}=${value}`).join("; ");
+      if (cookie) data.headers.set("cookie", cookie);
+      else data.headers.delete("cookie");
+    }
+    data.account = undefined;
+    data.resolvedAuthorization = undefined;
+  }
+  createdAt: number;
+  headers: Headers;
+  cookies: Bun.CookieMap;
+  account?: unknown;
+  /** The `authorization` value `account` was resolved from, so each frame need not re-verify it. */
+  resolvedAuthorization?: string;
+  socketId?: string;
+  constructor(headers: Headers) {
+    this.createdAt = Date.now();
+    this.headers = headers;
+    this.cookies = new Bun.CookieMap(headers.get("cookie") ?? "");
+  }
+}

package/server/rscClient.tsx

@@ -47,6 +47,7 @@ declare global {
     | undefined;
   var __AKAN_RSC_REFRESH__: ((options?: { buildId?: number }) => Promise<void>) | undefined;
   var __AKAN_RSC_CLEAR_CACHE__: (() => void) | undefined;
+  var __AKAN_RSC_IS_FROM_CACHE__: (() => boolean) | undefined;
   var __AKAN_DEV_SYNC_NAVIGATION__: ((href: string, kind: "push" | "replace" | "back" | "pop") => void) | undefined;
   var __AKAN_DEV_SYNC_NAVIGATION_APPLYING__: boolean | undefined;
   var __AKAN_GET_SYNC_ROUTE_HREF__: ((href: string) => string) | undefined;
@@ -299,8 +300,11 @@ let currentRouterState: AkanRouterStateV1 | null = initialRouterState;
 let currentSegmentTree: RscSegmentCacheNode | null = createAkanSegmentCacheTree(initialNode);
 let currentFullNode: RscCacheNode = initialNode;
 let currentCommitKind: "full" | "patch" = "full";
+let currentCommitFromCache = false;
 let navigationSeq = 0;
 
+globalThis.__AKAN_RSC_IS_FROM_CACHE__ = () => currentCommitFromCache;
+
 function rememberCommittedRouteState(node: RscCacheNode): void {
   rscPatchCache.clear();
   if (!node.routerState) return;
@@ -378,6 +382,7 @@ function Root(): ReactNode {
         maxEntries: MAX_RSC_CACHE_ENTRIES,
         startTransition,
         commitThenable: (node) => {
+          currentCommitFromCache = false;
           resetAkanSegmentOutletPatches();
           setThenable(node.thenable);
         },
@@ -397,6 +402,7 @@ function Root(): ReactNode {
     const scrollToTop = options.scrollToTop ?? true;
     try {
       let nextNode = rscCache.get(target);
+      const servedFromCache = !!nextNode;
       if (!nextNode) {
         const cachedPatch = rscPatchCache.get(target);
         if (cachedPatch) {
@@ -425,6 +431,7 @@ function Root(): ReactNode {
                 bumpScrollToTop: () => setScrollToTopTick((tick) => tick + 1),
               })
             ) {
+              currentCommitFromCache = true;
               rememberPatchedRouteState(patchResult.tree, patchResult.patchedNode);
               rememberRscPatchCacheNode(rscPatchCache, cachedPatch, MAX_RSC_CACHE_ENTRIES);
               return;
@@ -449,6 +456,7 @@ function Root(): ReactNode {
               bumpScrollToTop: () => setScrollToTopTick((tick) => tick + 1),
             })
           ) {
+            currentCommitFromCache = false;
             rememberPatchedRouteState(fetched.tree, fetched.patchedNode);
             const patchCacheNode = createRscPatchNavigationCacheNode({
               href: target,
@@ -493,6 +501,7 @@ function Root(): ReactNode {
         maxEntries: MAX_RSC_CACHE_ENTRIES,
         startTransition,
         commitThenable: (node) => {
+          currentCommitFromCache = servedFromCache;
           resetAkanSegmentOutletPatches();
           setThenable(node.thenable);
         },

package/signal/signalContext.ts

@@ -125,6 +125,38 @@ export class SignalContext<
       }),
     );
   }
+  /**
+   * Re-checks this context's guards outside of a request, for a websocket room that is already
+   * subscribed. Only global middlewares run: they carry the account resolution this depends on,
+   * while endpoint middlewares (cache/timeout/retry) would observe a call that never executes.
+   */
+  async authorize(): Promise<boolean> {
+    try {
+      await this.#withMiddleware(async () => await this.#checkGuards(), { endpointMiddlewares: false })();
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  #withMiddleware(
+    coreExec: () => Promise<unknown>,
+    { endpointMiddlewares = true }: { endpointMiddlewares?: boolean } = {},
+  ): () => Promise<unknown> {
+    const middlewares = [
+      ...this.#middleware.values(),
+      ...(endpointMiddlewares ? (this.endpointInfo.signalOption.middlewares ?? []) : []),
+    ];
+    if (middlewares.length === 0) return coreExec;
+    let next = coreExec;
+    for (let i = middlewares.length - 1; i >= 0; i--) {
+      const MiddlewareCls = middlewares[i];
+      if (!MiddlewareCls) continue;
+      const middleware = new MiddlewareCls();
+      const currentNext = next;
+      next = async () => await (await middleware.use(this.getEnv()))(this, currentNext);
+    }
+    return next;
+  }
   async exec() {
     if (!this.trace) return await this.#exec();
     return await runWithTrace(this.trace, async () => {
@@ -137,7 +169,6 @@ export class SignalContext<
   }
   async #exec() {
     if (!this.endpointInfo.execFn) throw new Exception.Error("Exec function is not set");
-    const endpointMiddlewares = this.endpointInfo.signalOption.middlewares ?? [];
     const coreExec = async () => {
       if (!this.endpointInfo.execFn) throw new Exception.Error("Exec function is not set");
       if (this.trace) await traceSpan("guards", () => this.#checkGuards());
@@ -158,17 +189,7 @@ export class SignalContext<
         async () => await this.endpointInfo.execFn?.call(this.adaptor, ...this.args, ...this.internalArgs),
       );
     };
-    let next = coreExec;
-    if (this.#middleware.size > 0 || endpointMiddlewares.length > 0) {
-      const middlewares = [...this.#middleware.values(), ...endpointMiddlewares];
-      for (let i = middlewares.length - 1; i >= 0; i--) {
-        const MiddlewareCls = middlewares[i];
-        if (!MiddlewareCls) continue;
-        const middleware = new MiddlewareCls();
-        const currentNext = next;
-        next = async () => await (await middleware.use(this.getEnv()))(this, currentNext);
-      }
-    }
+    const next = this.#withMiddleware(coreExec);
     const result = this.trace ? await traceSpan("execChain", () => next()) : await next();
     if (this.endpointInfo.type === "pubsub") return;
     if (result instanceof Response) return result;
@@ -340,6 +361,10 @@ export class SignalContext<
     if (this.transport !== "websocket") throw new Error("Transport is not websocket");
     return this.ctx as WebSocketExecutionContext<Appended>;
   }
+  get<T = unknown>(key: string): T | null {
+    if (this.transport === "http") return this.getHttpContext<{ [key: string]: T }>().req[key] ?? null;
+    return this.getWebSocketContext<{ [key: string]: T }>().ws.data[key] ?? null;
+  }
   getRoomId(key: string) {
     if (this.transport !== "websocket") throw new Error("Transport is not websocket");
     else if (this.endpointInfo.type !== "pubsub") throw new Error("Endpoint is not pubsub");

package/signal/types.ts

@@ -140,4 +140,5 @@ export type WebsocketReqData = { key: string; data: unknown[]; subscribe?: boole
 export type WebsocketMessageData = { type: "msg"; key: string; data: object | object[] };
 export type WebsocketSubscribeAck = { type: "sub"; roomId: string; subscribe: boolean };
 export type WebsocketPublishData = { type: "pub"; roomId: string; data: object | object[] };
-export type WebsocketResData = WebsocketMessageData | WebsocketSubscribeAck | WebsocketPublishData;
+export type WebsocketAuthAck = { type: "auth"; revokedRooms: string[] };
+export type WebsocketResData = WebsocketMessageData | WebsocketSubscribeAck | WebsocketPublishData | WebsocketAuthAck;

package/types/client/csrTypes.d.ts

@@ -43,6 +43,13 @@ export interface PageConfig {
     rscPatchHeadSafe?: boolean;
     topSafeAreaColor?: string;
     bottomSafeAreaColor?: string;
+    /**
+     * Keeps the route out of `akan build`. The route still serves under `akan start`, but nothing about it
+     * reaches production: no bundle, no manifest entry, no URL. On a `_layout`, every route under that
+     * directory is excluded with it. Must be written as a literal `true`/`false` — the build reads it from
+     * the source without evaluating the module.
+     */
+    devOnly?: boolean;
 }
 export interface CsrState {
     transition: TransitionType;

package/types/client/rscNavigation.d.ts

@@ -1,17 +1,25 @@
 declare global {
     var __AKAN_RSC_CLEAR_CACHE__: (() => void) | undefined;
+    var __AKAN_RSC_IS_FROM_CACHE__: (() => boolean) | undefined;
     var __AKAN_RSC_NAVIGATE__: ((href: string, options?: {
         replace?: boolean;
         scrollToTop?: boolean;
     }) => Promise<void>) | undefined;
 }
 export declare const clearRscNavigationCache: () => void;
+/**
+ * True when the page tree currently on screen was replayed from the RSC navigation cache instead of
+ * fetched from the server. Data hydrated out of such a payload can be arbitrarily old, so anything
+ * that must show current values should refetch.
+ */
+export declare const isRscNavigationFromCache: () => boolean;
 export declare const navigateRsc: (href: string, options?: {
     replace?: boolean;
     scrollToTop?: boolean;
 }) => Promise<void> | undefined;
 export declare const useRscNavigation: () => {
     clearCache: () => void;
+    isFromCache: () => boolean;
     navigate: (href: string, options?: {
         replace?: boolean;
         scrollToTop?: boolean;

package/types/common/index.d.ts

@@ -27,3 +27,4 @@ export { sleep } from "./sleep.d.ts";
 export { splitVersion } from "./splitVersion.d.ts";
 export { getBasePathFromPathname, parseBasePaths } from "./subRoute.d.ts";
 export type * from "./types.d.ts";
+export { type WebsocketAuthAckData, type WebsocketAuthRequest, websocketAuthContract, } from "./websocketAuth.d.ts";

package/types/common/websocketAuth.d.ts

@@ -0,0 +1,19 @@
+export interface WebsocketAuthRequest {
+    key: string;
+    data: [string | null];
+}
+export interface WebsocketAuthAckData {
+    type: "auth";
+    revokedRooms: string[];
+}
+/**
+ * Framework-owned websocket auth contract shared by the client and the server dispatcher.
+ * The credential frame carries the raw bearer token; verifying it stays in userland middleware,
+ * so the server only swaps the credential snapshot held on the socket.
+ */
+export declare const websocketAuthContract: {
+    readonly key: "__auth";
+    readonly makeRequest: (jwt: string | null) => WebsocketAuthRequest;
+    readonly makeAck: (revokedRooms: string[]) => WebsocketAuthAckData;
+    readonly readJwt: (data: unknown) => string | null;
+};

package/types/fetch/client/wsClient.d.ts

@@ -15,6 +15,12 @@ export declare class WsClient {
     connected: boolean;
     constructor(url: string, ErrorCls?: ErrorConstructor | undefined);
     setErrorConstructor(ErrorCls?: ErrorConstructor): void;
+    /**
+     * The handshake only carries a same-origin cookie, so clients that hold the token in memory
+     * (native, cross-origin) authenticate with this frame instead. Signing out sends `null`, which
+     * drops the handshake cookie server-side and revokes the rooms it had authorized.
+     */
+    setJwt(jwt: string | null): void;
     connect(): void;
     destroy(): void;
     on<Data = unknown>(key: string, callback: (data: Data) => void): this;

package/types/index.d.ts

@@ -161,6 +161,12 @@ export interface AppConfigResult {
     docker: DockerConfig;
     defaultDatabaseMode: DatabaseMode;
     routes?: AkanRouteConfig[];
+    /**
+     * Mounts `libs/<lib>/page` into this app under `page/(libs)/(<lib>)` on sync. `true` takes every lib
+     * dependency that ships a `page` folder, an array takes exactly the libs listed, `false` (the default)
+     * syncs nothing and removes what a previous sync created.
+     */
+    syncPageLibs?: string[] | boolean;
     externalLibs: string[];
     barrelImports: string[];
     optimizeImports: string[];

package/types/server/resolver/signal.resolver.d.ts

@@ -30,6 +30,12 @@ export declare class SignalResolver {
         live: LiveRegistry;
         middleware: Map<string, MiddlewareCls>;
     }): SignalRoutes;
+    /**
+     * Re-checks the guards of every room this socket is subscribed to and drops the ones that no
+     * longer pass. Called when the socket's credential changes: a pubsub room is authorized once at
+     * subscribe time, so without this a signed-out socket would keep receiving its old rooms.
+     */
+    static revalidateWsRooms(ws: Bun.ServerWebSocket<any>, registry: InjectRegistry): Promise<string[]>;
     static handleWsOpen(ws: Bun.ServerWebSocket<any>, registry: InjectRegistry): Promise<void>;
     static handleWsClose(ws: Bun.ServerWebSocket<any>, registry: InjectRegistry): Promise<void>;
 }

package/types/server/routing/apiRouter.d.ts

@@ -1,8 +1,9 @@
-import type { Logger } from "akanjs/common";
+import { type Logger } from "akanjs/common";
 import type { InjectRegistry } from "akanjs/service";
 import type { HmrWsHub } from "../hmr/wsHub.d.ts";
 import { type WebProxyRunner } from "../proxy.d.ts";
 import type { HttpRoutes, SignalRouteOptions, WebsocketRoutes } from "../types.d.ts";
+import { AppWsData } from "./appWsData.d.ts";
 /**
  * Minimal render-state view the HMR WS hello message needs.
  * `LazyHmrController` exposes this shape via `state.buildId` / `state.cssAssets`,
@@ -27,9 +28,7 @@ export interface ApiRouteInputs {
     routeOptions?: Record<string, SignalRouteOptions>;
     renderEnvRoutes: HttpRoutes;
     /** Upgrades the incoming request into an app-signal WebSocket. */
-    upgradeAppWs: (req: Request, data: {
-        createdAt: number;
-    }) => boolean;
+    upgradeAppWs: (req: Request, data: AppWsData) => boolean;
     webProxyRunner?: WebProxyRunner | null;
 }
 export interface WebsocketHandlersInputs {

package/types/server/routing/appWsData.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Credential snapshot taken at the websocket handshake and carried on `ws.data` for the life of the
+ * socket, so auth middleware and guards can read the caller the same way they read an HTTP request.
+ * Only the credential headers are copied — retaining the whole `Request` would pin it for as long
+ * as the socket stays open.
+ */
+export declare class AppWsData {
+    static fromRequest(req: Request): AppWsData;
+    static of(ws: Bun.ServerWebSocket<unknown>): AppWsData;
+    /**
+     * Swaps the credential the socket authenticates with. Callers must run this synchronously on the
+     * auth frame: frames arrive in order, so a subscribe sent right after the credential must not be
+     * able to observe the previous one.
+     */
+    static applyCredential(data: AppWsData, jwt: string | null): void;
+    createdAt: number;
+    headers: Headers;
+    cookies: Bun.CookieMap;
+    account?: unknown;
+    /** The `authorization` value `account` was resolved from, so each frame need not re-verify it. */
+    resolvedAuthorization?: string;
+    socketId?: string;
+    constructor(headers: Headers);
+}

package/types/server/rscClient.d.ts

@@ -13,6 +13,7 @@ declare global {
         buildId?: number;
     }) => Promise<void>) | undefined;
     var __AKAN_RSC_CLEAR_CACHE__: (() => void) | undefined;
+    var __AKAN_RSC_IS_FROM_CACHE__: (() => boolean) | undefined;
     var __AKAN_DEV_SYNC_NAVIGATION__: ((href: string, kind: "push" | "replace" | "back" | "pop") => void) | undefined;
     var __AKAN_DEV_SYNC_NAVIGATION_APPLYING__: boolean | undefined;
     var __AKAN_GET_SYNC_ROUTE_HREF__: ((href: string) => string) | undefined;

package/types/signal/signalContext.d.ts

@@ -32,6 +32,12 @@ export declare class SignalContext<Ctx extends HttpExecutionContext | WebSocketE
     getAdaptor<T extends Adaptor>(adaptorCls: AdaptorCls<T>): T;
     getService<T>(refName: string): T;
     init(): Promise<this>;
+    /**
+     * Re-checks this context's guards outside of a request, for a websocket room that is already
+     * subscribed. Only global middlewares run: they carry the account resolution this depends on,
+     * while endpoint middlewares (cache/timeout/retry) would observe a call that never executes.
+     */
+    authorize(): Promise<boolean>;
     exec(): Promise<Response | undefined>;
     static try(endpoint: Adaptor, endpointInfo: EndpointInfo, key: string, fn: () => Promise<Response | undefined>): Promise<Response | undefined>;
     static resolveReturn(value: unknown, { signalContext, returnRef, arrDepth, registry, live, }: {
@@ -47,6 +53,7 @@ export declare class SignalContext<Ctx extends HttpExecutionContext | WebSocketE
     }): Promise<unknown>;
     getHttpContext<Appended = unknown>(): HttpExecutionContext<Appended>;
     getWebSocketContext<Appended = unknown>(): WebSocketExecutionContext<Appended>;
+    get<T = unknown>(key: string): T | null;
     getRoomId(key: string): string;
     getEnv(): Env;
     getArg<T = unknown>(argName: string): T | undefined;

package/types/signal/types.d.ts

@@ -147,5 +147,9 @@ export type WebsocketPublishData = {
     roomId: string;
     data: object | object[];
 };
-export type WebsocketResData = WebsocketMessageData | WebsocketSubscribeAck | WebsocketPublishData;
+export type WebsocketAuthAck = {
+    type: "auth";
+    revokedRooms: string[];
+};
+export type WebsocketResData = WebsocketMessageData | WebsocketSubscribeAck | WebsocketPublishData | WebsocketAuthAck;
 export {};

package/ui/Model/EditModal.tsx

@@ -1,5 +1,5 @@
 "use client";
-import { clsx, router, usePage } from "akanjs/client";
+import { clsx, isRscNavigationFromCache, router, usePage } from "akanjs/client";
 import { capitalize, deepObjectify, lowerlize } from "akanjs/common";
 import { ConstantRegistry, immerify } from "akanjs/constant";
 import type { ClientEdit, ServerEdit, SliceMeta } from "akanjs/fetch";
@@ -11,6 +11,8 @@ import { AiOutlinePlus, AiOutlineSave } from "react-icons/ai";
 import { Button } from "../Button";
 import { Modal } from "../Modal";
 
+const EDIT_PAYLOAD_MAX_AGE_MS = 60_000;
+
 interface EditModelProps<Full> {
   /** Rendering mode for the edit shell. */
   type?: "modal" | "form" | "empty";
@@ -148,6 +150,7 @@ export default function EditModal<Full extends { id: string }>({
       setModelModal: `set${ModelName}Modal`,
       modelLoading: `${modelName}Loading`,
       modelViewAt: `${modelName}ViewAt`,
+      editModel: `edit${ModelName}`,
       newModel: `new${ModelName}`,
       crystalizeModel: `crystalize${ModelName}`,
       modelObj: `${modelName}Obj`,
@@ -159,10 +162,19 @@ export default function EditModal<Full extends { id: string }>({
     (state: unknown) => (state as { [key: string]: { id: string | null } })[names.modelForm].id,
   );
   const modelFormLoading = storeUse[names.modelFormLoading]() as string | boolean;
+  const modalId = id ?? ((modelEdit as any)?.[names.modelObj] as Full | undefined)?.id ?? undefined;
   const isModalOpen =
     modelModal === (modal ?? "edit") &&
-    (modelFormLoading === false || modelFormLoading === id) &&
-    ((!modelFormId && !id) || id === modelFormId);
+    (modelFormLoading === false || modelFormLoading === modalId) &&
+    ((!modelFormId && !modalId) || modalId === modelFormId);
+  const isEditPayloadStale = useCallback((viewAt?: Date | null) => {
+    if (isRscNavigationFromCache()) return true;
+    return (
+      viewAt instanceof Date &&
+      !Number.isNaN(viewAt.getTime()) &&
+      Date.now() - viewAt.getTime() > EDIT_PAYLOAD_MAX_AGE_MS
+    );
+  }, []);
   useEffect(() => {
     if (!modelEdit) return;
     const refName = (modelEdit as ServerEdit<string, Full>).refName;
@@ -170,15 +182,21 @@ export default function EditModal<Full extends { id: string }>({
     const cnst = ConstantRegistry.getDatabase(modelName);
     const modelRef = cnst.full;
     if (editType === "edit") {
-      const crystal = new modelRef().set((modelEdit as any)[names.modelObj] as Full) as unknown as Full;
+      const modelObj = (modelEdit as any)[names.modelObj] as Full;
+      const viewAt = (modelEdit as any)[names.modelViewAt] as Date;
+      const crystal = new modelRef().set(modelObj) as unknown as Full;
       st.set({
         [names.model]: crystal,
         [names.modelLoading]: false,
         [names.modelForm]: immerify(modelRef, crystal),
         [names.modelFormLoading]: false,
         [names.modelModal]: modal ?? "edit",
-        [names.modelViewAt]: (modelEdit as any)[names.modelViewAt] as Date,
+        [names.modelViewAt]: viewAt,
       });
+      if (isEditPayloadStale(viewAt))
+        void storeDo[names.editModel](modelObj.id, { modal }).catch(() => {
+          st.set({ [names.modelFormLoading]: false });
+        });
     } else {
       
       const crystal = new modelRef().set(modelEdit as Full) as unknown as Full;
@@ -186,7 +204,7 @@ export default function EditModal<Full extends { id: string }>({
     }
     return () => {
     };
-  }, [modelEdit]);
+  }, [modelEdit, isEditPayloadStale]);
 
   const handleCancel = useCallback(() => {
     const modelForm = (st.get() as any)[names.modelForm] as Full;