alabjs 0.2.6 → 0.3.0-alpha.1

package/dist/server/cache.js

@@ -19,7 +19,18 @@
  */
 /** Sentinel value returned when a cache key has no valid entry. */
 const CACHE_MISS = Symbol("alab:cache_miss");
-/** Global in-process LRU-style cache. Shared across all server function calls. */
+/**
+ * Global in-process LRU cache. Shared across all server function calls.
+ *
+ * Max size is capped to prevent unbounded memory growth in long-running servers.
+ * When the cap is reached, the oldest entry (by insertion order) is evicted.
+ *
+ * ⚠️  Multi-tenant note: this cache is process-wide and shared across all
+ * requests. In multi-tenant deployments, cache keys MUST include a tenant
+ * identifier (e.g. `tenant:${tenantId}:posts`) to prevent data leakage
+ * between tenants.
+ */
+const _STORE_MAX = 2048;
 const _store = new Map();
 export { CACHE_MISS };
 /** Retrieve a cached value. Returns `CACHE_MISS` if absent or expired. */
@@ -31,10 +42,17 @@ export function getCached(key) {
         _store.delete(key);
         return CACHE_MISS;
     }
+    // Move to end (LRU: mark as recently used)
+    _store.delete(key);
+    _store.set(key, entry);
     return entry.data;
 }
 /** Store a value in the cache with a TTL (seconds) and optional tags. */
 export function setCache(key, data, opts) {
+    // Evict oldest entry when at capacity
+    if (_store.size >= _STORE_MAX && !_store.has(key)) {
+        _store.delete(_store.keys().next().value);
+    }
     _store.set(key, {
         data,
         expires: Date.now() + opts.ttl * 1_000,
@@ -64,6 +82,7 @@ export function invalidateCache(opts) {
 export function invalidateCacheKey(key) {
     _store.delete(key);
 }
+const _PAGE_STORE_MAX = 1024;
 const _pageStore = new Map();
 /**
  * Retrieve a cached HTML page. Returns `null` if absent or fully expired
@@ -87,6 +106,9 @@ export function getCachedPage(pathname) {
 }
 /** Store a rendered HTML page with a TTL (seconds). */
 export function setCachedPage(pathname, html, ttl, tags = []) {
+    if (_pageStore.size >= _PAGE_STORE_MAX && !_pageStore.has(pathname)) {
+        _pageStore.delete(_pageStore.keys().next().value);
+    }
     _pageStore.set(pathname, { html, expires: Date.now() + ttl * 1_000, ttl, revalidating: false, tags });
 }
 /** Mark a page as currently being revalidated to prevent concurrent regen. */

package/dist/server/cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/server/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AASH,mEAAmE;AACnE,MAAM,UAAU,GAAkB,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAE5D,kFAAkF;AAClF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;AAE7C,OAAO,EAAE,UAAU,EAAE,CAAC;AAEtB,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,CAAC;IAC9B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,QAAQ,CACtB,GAAW,EACX,IAAa,EACb,IAAsC;IAEtC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;QACd,IAAI;QACJ,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,KAAK;QACtC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,IAAwB;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAeD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;AAErD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,cAAc;IACd,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpE,iFAAiF;IACjF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,GAAG,SAAS,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,IAAY,EAAE,GAAW,EAAE,OAAiB,EAAE;IAC5F,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACxG,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,KAAK;QAAE,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;AACvC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,YAAY,IAAI,KAAK,CAAC;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAAwB;IACpD,6BAA6B;IAC7B,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,wBAAwB;IACxB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY;IAK1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAA8D,EAAE,CAAC;IAC7E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC;QACtC,IAAI,SAAS,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;;YAC7F,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/server/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AASH,mEAAmE;AACnE,MAAM,UAAU,GAAkB,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;AAE7C,OAAO,EAAE,UAAU,EAAE,CAAC;AAEtB,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,CAAC;IAC9B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,2CAA2C;IAC3C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,QAAQ,CACtB,GAAW,EACX,IAAa,EACb,IAAsC;IAEtC,sCAAsC;IACtC,IAAI,MAAM,CAAC,IAAI,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;QACd,IAAI;QACJ,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,KAAK;QACtC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,IAAwB;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAeD,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;AAErD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,cAAc;IACd,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpE,iFAAiF;IACjF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,GAAG,SAAS,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,IAAY,EAAE,GAAW,EAAE,OAAiB,EAAE;IAC5F,IAAI,UAAU,CAAC,IAAI,IAAI,eAAe,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpE,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;IACrD,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACxG,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,KAAK;QAAE,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;AACvC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,YAAY,IAAI,KAAK,CAAC;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAAwB;IACpD,6BAA6B;IAC7B,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,wBAAwB;IACxB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY;IAK1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAA8D,EAAE,CAAC;IAC7E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC;QACtC,IAAI,SAAS,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;;YAC7F,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/csrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/server/csrf.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAEZ,eAAO,MAAM,WAAW,cAAc,CAAC;AACvC,eAAO,MAAM,WAAW,iBAAiB,CAAC;AAI1C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,sEAwB7B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAapD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD"}
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/server/csrf.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAEZ,eAAO,MAAM,WAAW,cAAc,CAAC;AACvC,eAAO,MAAM,WAAW,iBAAiB,CAAC;AAI1C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,sEA6B7B;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAapD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD"}

package/dist/server/csrf.js

@@ -21,6 +21,11 @@ export function csrfMiddleware() {
         const method = event.method.toUpperCase();
         if (SAFE_METHODS.has(method))
             return;
+        // Internal endpoints that use their own auth (Bearer token, no cookie session)
+        // don't need CSRF protection.
+        const path = (event.node.req.url ?? "").split("?")[0] ?? "";
+        if (path === "/_alabjs/revalidate" || path === "/_alabjs/vitals")
+            return;
         const cookieToken = getCookie(event, CSRF_COOKIE);
         const headerToken = getHeader(event, CSRF_HEADER);
         const tokensMatch = !!cookieToken &&

package/dist/server/csrf.js.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/server/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,GAEZ,MAAM,IAAI,CAAC;AAEZ,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC;AAE1C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAClC,+DAA+D;QAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;YAAE,OAAO;QAErD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QAErC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAElD,MAAM,WAAW,GACf,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,WAAW;YACb,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;YACzC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAEtE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,WAAW,CAAC;gBAChB,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,uDAAuD;aACjE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC/C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAClC,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE;QACnC,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;QAChD,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW;KAClC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,oCAAoC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC;AACjF,CAAC"}
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/server/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,GAEZ,MAAM,IAAI,CAAC;AAEZ,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC;AAE1C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAClC,+DAA+D;QAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;YAAE,OAAO;QAErD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QAErC,+EAA+E;QAC/E,8BAA8B;QAC9B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5D,IAAI,IAAI,KAAK,qBAAqB,IAAI,IAAI,KAAK,iBAAiB;YAAE,OAAO;QAEzE,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAElD,MAAM,WAAW,GACf,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,WAAW;YACb,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;YACzC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAEtE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,WAAW,CAAC;gBAChB,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,uDAAuD;aACjE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC/C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAClC,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE;QACnC,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;QAChD,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW;KAClC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,oCAAoC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC;AACjF,CAAC"}

package/dist/ssr/html.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../src/ssr/html.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,YAAY,CAAC;IACvB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,gBAAgB,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,GAAG,EAAE,OAAO,CAAC;IACb,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAgE9D;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,MAAM,CAM3E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,WAAW,CAAC,GAAG,MAAM,CAchG;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,WAAW,CAAC,GACrD,MAAM,CA0BR"}
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../src/ssr/html.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,YAAY,CAAC;IACvB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,gBAAgB,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,GAAG,EAAE,OAAO,CAAC;IACb,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAgE9D;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,MAAM,CAqB3E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,WAAW,CAAC,GAAG,MAAM,CAchG;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,WAAW,CAAC,GACrD,MAAM,CA0BR"}

package/dist/ssr/html.js

@@ -49,7 +49,22 @@ export function htmlShellBefore(opts) {
 /** Build the closing HTML fragment — everything after the SSR content. */
 export function htmlShellAfter(opts) {
     const nonceAttr = opts.nonce ? ` nonce="${escAttr(opts.nonce)}"` : "";
+    // The Rust compiler (oxc_transformer::enable_all) always emits $RefreshReg$ /
+    // $RefreshSig$ calls into TSX files, even in production builds. These are
+    // React Fast Refresh globals that only exist when the dev preamble is injected.
+    // In production there is no preamble, so the calls throw ReferenceError which
+    // silently aborts module loading and prevents React from mounting.
+    //
+    // A classic (non-module) <script> executes synchronously during HTML parsing,
+    // before any <script type="module"> is evaluated (modules are always deferred).
+    // Defining no-op shims here guarantees they exist before any page chunk runs.
+    const refreshShim = `<script${nonceAttr}>` +
+        `if(typeof $RefreshReg$==="undefined"){` +
+        `window.$RefreshReg$=function(){};` +
+        `window.$RefreshSig$=function(){return function(x){return x};}` +
+        `}</script>`;
     return `</div>
+    ${refreshShim}
     <script type="module" src="/@alabjs/client"${nonceAttr}></script>
   </body>
 </html>`;

package/dist/ssr/html.js.map

@@ -1 +1 @@
-{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/ssr/html.ts"],"names":[],"mappings":"AAoCA,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,IAAsB;IACpD,MAAM,EACJ,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,SAAS,EACT,GAAG,EACH,WAAW,EACX,WAAW,EACX,SAAS,GAAG,EAAE,EACd,OAAO,EACP,aAAa,GACd,GAAG,IAAI,CAAC;IAET,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK;QAC7B,CAAC,CAAC,UAAU,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU;QAC7C,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW;QAClC,CAAC,CAAC,qCAAqC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM;QAC1E,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,YAAY,GAAG,QAAQ,CAAC,SAAS;QACrC,CAAC,CAAC,+BAA+B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM;QAClE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM;QAC/B,CAAC,CAAC,gCAAgC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM;QAChE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,aAAa,GAAG,QAAQ,CAAC,UAAU;QACvC,CAAC,CAAC,qCAAqC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM;QACzE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvE,OAAO;;;;;MAKH,QAAQ;MACR,OAAO;MACP,YAAY;MACZ,SAAS;MACT,aAAa;MACb,MAAM;MACN,WAAW;MACX,SAAS;yCAC0B,OAAO,CAAC,SAAS,CAAC;uCACpB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;0CACnB,OAAO,CAAC,UAAU,CAAC;iDACZ,OAAO,CAAC,gBAAgB,CAAC;MACpE,WAAW,CAAC,CAAC,CAAC,wCAAwC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;MACrF,WAAW,CAAC,CAAC,CAAC,wCAAwC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;MACrF,OAAO,CAAC,CAAC,CAAC,yCAAyC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;MAC9E,aAAa,CAAC,CAAC,CAAC,4BAA4B,aAAa,WAAW,CAAC,CAAC,CAAC,EAAE;;MAEzE,SAAS;;;2BAGY,CAAC;AAC5B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAAC,IAAoC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO;iDACwC,SAAS;;QAElD,CAAC;AACT,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAsD;IACtF,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjG,OAAO;QACL,sCAAsC,OAAO,CAAC,SAAS,CAAC,MAAM;QAC9D,oCAAoC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM;QAChE,uCAAuC,OAAO,CAAC,UAAU,CAAC,MAAM;QAChE,8CAA8C,OAAO,CAAC,gBAAgB,CAAC,MAAM;QAC7E,WAAW,CAAC,CAAC,CAAC,wCAAwC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACrF,WAAW,CAAC,CAAC,CAAC,wCAAwC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACrF,OAAO,CAAC,CAAC,CAAC,yCAAyC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QAC9E,2EAA2E;QAC3E,mDAAmD;QACnD,qDAAqD;KACtD,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,IAAsD;IAEtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,YAAY,GAAG,8CAA8C,SAAS,YAAY,CAAC;IACzF,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa;QACrC,CAAC,CAAC,4BAA4B,IAAI,CAAC,aAAa,eAAe;QAC/D,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,MAAM,GAAG,OAAO,CAAC;IAErB,mEAAmE;IACnE,+DAA+D;IAC/D,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,YAAY,GAAG,QAAQ,aAAa,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,YAAY,GAAG,QAAQ,IAAI,GAAG,MAAM,CAAC;IACnD,CAAC;IAED,iDAAiD;IACjD,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,YAAY,aAAa,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,YAAY,CAAC;IACxC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iFAAiF;AAEjF,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAAC,EAAmC;IACtD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,EAAE,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,sCAAsC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,EAAE,CAAC,WAAW;QAAE,IAAI,CAAC,IAAI,CAAC,4CAA4C,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACzG,IAAI,EAAE,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,sCAAsC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,EAAE,CAAC,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,oCAAoC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjF,IAAI,EAAE,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,qCAAqC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpF,IAAI,EAAE,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,0CAA0C,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjG,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAwC;IAChE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,EAAE,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,sCAAsC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrF,IAAI,EAAE,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,uCAAuC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxF,IAAI,EAAE,CAAC,WAAW;QAAE,IAAI,CAAC,IAAI,CAAC,6CAA6C,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1G,IAAI,EAAE,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,uCAAuC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxF,IAAI,EAAE,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,yCAAyC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9F,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CAAC,KAAyC;IAC/D,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAClC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;aACvC,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,SAAS,OAAO,KAAK,CAAC;IAC/B,CAAC,CAAC;SACD,IAAI,CAAC,QAAQ,CAAC,CAAC;AACpB,CAAC"}
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/ssr/html.ts"],"names":[],"mappings":"AAoCA,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,IAAsB;IACpD,MAAM,EACJ,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,SAAS,EACT,GAAG,EACH,WAAW,EACX,WAAW,EACX,SAAS,GAAG,EAAE,EACd,OAAO,EACP,aAAa,GACd,GAAG,IAAI,CAAC;IAET,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK;QAC7B,CAAC,CAAC,UAAU,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU;QAC7C,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW;QAClC,CAAC,CAAC,qCAAqC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM;QAC1E,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,YAAY,GAAG,QAAQ,CAAC,SAAS;QACrC,CAAC,CAAC,+BAA+B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM;QAClE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM;QAC/B,CAAC,CAAC,gCAAgC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM;QAChE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,aAAa,GAAG,QAAQ,CAAC,UAAU;QACvC,CAAC,CAAC,qCAAqC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM;QACzE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvE,OAAO;;;;;MAKH,QAAQ;MACR,OAAO;MACP,YAAY;MACZ,SAAS;MACT,aAAa;MACb,MAAM;MACN,WAAW;MACX,SAAS;yCAC0B,OAAO,CAAC,SAAS,CAAC;uCACpB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;0CACnB,OAAO,CAAC,UAAU,CAAC;iDACZ,OAAO,CAAC,gBAAgB,CAAC;MACpE,WAAW,CAAC,CAAC,CAAC,wCAAwC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;MACrF,WAAW,CAAC,CAAC,CAAC,wCAAwC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;MACrF,OAAO,CAAC,CAAC,CAAC,yCAAyC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;MAC9E,aAAa,CAAC,CAAC,CAAC,4BAA4B,aAAa,WAAW,CAAC,CAAC,CAAC,EAAE;;MAEzE,SAAS;;;2BAGY,CAAC;AAC5B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAAC,IAAoC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,8EAA8E;IAC9E,0EAA0E;IAC1E,gFAAgF;IAChF,8EAA8E;IAC9E,mEAAmE;IACnE,EAAE;IACF,8EAA8E;IAC9E,gFAAgF;IAChF,8EAA8E;IAC9E,MAAM,WAAW,GAAG,UAAU,SAAS,GAAG;QACxC,wCAAwC;QACxC,mCAAmC;QACnC,+DAA+D;QAC/D,YAAY,CAAC;IACf,OAAO;MACH,WAAW;iDACgC,SAAS;;QAElD,CAAC;AACT,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAsD;IACtF,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjG,OAAO;QACL,sCAAsC,OAAO,CAAC,SAAS,CAAC,MAAM;QAC9D,oCAAoC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM;QAChE,uCAAuC,OAAO,CAAC,UAAU,CAAC,MAAM;QAChE,8CAA8C,OAAO,CAAC,gBAAgB,CAAC,MAAM;QAC7E,WAAW,CAAC,CAAC,CAAC,wCAAwC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACrF,WAAW,CAAC,CAAC,CAAC,wCAAwC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACrF,OAAO,CAAC,CAAC,CAAC,yCAAyC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QAC9E,2EAA2E;QAC3E,mDAAmD;QACnD,qDAAqD;KACtD,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,IAAsD;IAEtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,YAAY,GAAG,8CAA8C,SAAS,YAAY,CAAC;IACzF,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa;QACrC,CAAC,CAAC,4BAA4B,IAAI,CAAC,aAAa,eAAe;QAC/D,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,MAAM,GAAG,OAAO,CAAC;IAErB,mEAAmE;IACnE,+DAA+D;IAC/D,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,YAAY,GAAG,QAAQ,aAAa,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,YAAY,GAAG,QAAQ,IAAI,GAAG,MAAM,CAAC;IACnD,CAAC;IAED,iDAAiD;IACjD,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,YAAY,aAAa,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,YAAY,CAAC;IACxC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iFAAiF;AAEjF,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAAC,EAAmC;IACtD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,EAAE,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,sCAAsC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,EAAE,CAAC,WAAW;QAAE,IAAI,CAAC,IAAI,CAAC,4CAA4C,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACzG,IAAI,EAAE,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,sCAAsC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,EAAE,CAAC,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,oCAAoC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjF,IAAI,EAAE,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,qCAAqC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpF,IAAI,EAAE,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,0CAA0C,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjG,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAwC;IAChE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,EAAE,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,sCAAsC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrF,IAAI,EAAE,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,uCAAuC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxF,IAAI,EAAE,CAAC,WAAW;QAAE,IAAI,CAAC,IAAI,CAAC,6CAA6C,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1G,IAAI,EAAE,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,uCAAuC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxF,IAAI,EAAE,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,yCAAyC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9F,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CAAC,KAAyC;IAC/D,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAClC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;aACvC,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,SAAS,OAAO,KAAK,CAAC;IAC/B,CAAC,CAAC;SACD,IAAI,CAAC,QAAQ,CAAC,CAAC;AACpB,CAAC"}

package/dist/ssr/ppr.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ppr.d.ts","sourceRoot":"","sources":["../../src/ssr/ppr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAA2B,KAAK,aAAa,EAAE,MAAM,OAAO,CAAC;AAOpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAIlD,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,sBAAsB,CAAC;AAIpD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAMzD;AAID,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IAEzD,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;IACzB,gDAAgD;IAEhD,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9B,kEAAkE;IAClE,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAC/C,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,IAAI,EACJ,OAAO,EACP,SAAS,EACT,WAAW,EACX,SAAS,GACV,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkCrC;AAID;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOjF;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAQ/E;AAID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAYjF"}
+{"version":3,"file":"ppr.d.ts","sourceRoot":"","sources":["../../src/ssr/ppr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAA2B,KAAK,aAAa,EAAE,MAAM,OAAO,CAAC;AAOpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAIlD,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,sBAAsB,CAAC;AAIpD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAMzD;AAID,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IAEzD,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;IACzB,gDAAgD;IAEhD,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9B,kEAAkE;IAClE,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAC/C,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,IAAI,EACJ,OAAO,EACP,SAAS,EACT,WAAW,EACX,SAAS,GACV,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkCrC;AAID;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOjF;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAQ/E;AAID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAajF"}

package/dist/ssr/ppr.js

@@ -122,7 +122,8 @@ export function findBuildLayoutFiles(routeFile, distDir) {
     const layouts = [];
     for (let i = 1; i <= parts.length; i++) {
         const dir = parts.slice(0, i).join("/");
-        const candidate = `${dir}/layout.tsx`;
+        // esbuild compiles layout.tsx → layout.js in the dist/server tree.
+        const candidate = `${dir}/layout.js`;
         if (existsSync(join(distDir, "server", candidate))) {
             layouts.push(candidate);
         }

package/dist/ssr/ppr.js.map

@@ -1 +1 @@
-{"version":3,"file":"ppr.js","sourceRoot":"","sources":["../../src/ssr/ppr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAsB,MAAM,OAAO,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAG5D,iFAAiF;AAEjF,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEpD,iFAAiF;AAEjF;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,IAAI,GAAG,SAAS;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAmB,kBAAkB;SACvD,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,CAAI,qBAAqB;SAC1D,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAgB,SAAS;IACjD,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,OAAO,CAAC;AACrC,CAAC;AAmBD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,IAAI,EACJ,OAAO,EACP,SAAS,EACT,WAAW,EACX,SAAS,GACW;IACpB,8EAA8E;IAC9E,8DAA8D;IAC9D,IAAI,MAAM,GAAQ,aAAa,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IACxE,uEAAuE;IACvE,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7D,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM;YAAE,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IACD,2DAA2D;IAC3D,8DAA8D;IAC9D,MAAM,IAAI,GAAG,aAAa,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAEnE,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9D,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC;YACxB,KAAK,CAAC,KAAa,EAAE,IAAI,EAAE,EAAE,IAAI,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACpE,KAAK,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE;YAC5C,UAAU,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,IAAK,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/E,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,KAAK,GAAI,cAAc,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,EAAE,CAAC;IAEjD,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AACjF,CAAC;AAED,iFAAiF;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,WAAmB;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,OAAe;IACrE,MAAM,GAAG,GAAG,yCAAyC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC;IAC3F,+DAA+D;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,OAAe;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,GAAG,GAAG,aAAa,CAAC;QACtC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"ppr.js","sourceRoot":"","sources":["../../src/ssr/ppr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAsB,MAAM,OAAO,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAG5D,iFAAiF;AAEjF,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEpD,iFAAiF;AAEjF;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,IAAI,GAAG,SAAS;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAmB,kBAAkB;SACvD,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,CAAI,qBAAqB;SAC1D,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAgB,SAAS;IACjD,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,OAAO,CAAC;AACrC,CAAC;AAmBD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,IAAI,EACJ,OAAO,EACP,SAAS,EACT,WAAW,EACX,SAAS,GACW;IACpB,8EAA8E;IAC9E,8DAA8D;IAC9D,IAAI,MAAM,GAAQ,aAAa,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IACxE,uEAAuE;IACvE,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7D,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM;YAAE,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IACD,2DAA2D;IAC3D,8DAA8D;IAC9D,MAAM,IAAI,GAAG,aAAa,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAEnE,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9D,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC;YACxB,KAAK,CAAC,KAAa,EAAE,IAAI,EAAE,EAAE,IAAI,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACpE,KAAK,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE;YAC5C,UAAU,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,IAAK,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/E,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,KAAK,GAAI,cAAc,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,EAAE,CAAC;IAEjD,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AACjF,CAAC;AAED,iFAAiF;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,WAAmB;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,OAAe;IACrE,MAAM,GAAG,GAAG,yCAAyC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC;IAC3F,+DAA+D;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,OAAe;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,mEAAmE;QACnE,MAAM,SAAS,GAAG,GAAG,GAAG,YAAY,CAAC;QACrC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alabjs",
-  "version": "0.2.6",
+  "version": "0.3.0-alpha.1",
   "description": "AlabJS — full-stack React framework powered by a Rust compiler",
   "keywords": [
     "react",
@@ -53,6 +53,10 @@
       "import": "./dist/components/index.js",
       "types": "./dist/components/index.d.ts"
     },
+    "./components/server": {
+      "import": "./dist/components/ImageServer.js",
+      "types": "./dist/components/ImageServer.d.ts"
+    },
     "./middleware": {
       "import": "./dist/server/middleware.js",
       "types": "./dist/server/middleware.d.ts"
@@ -82,14 +86,15 @@
     "alab": "./dist/cli.js"
   },
   "optionalDependencies": {
-    "@alabjs/compiler": "0.2.6"
+    "@alabjs/compiler": "0.3.0-alpha.1"
   },
   "dependencies": {
     "h3": "^1.15.0",
     "vite": "^8.0.0",
+    "esbuild": "^0.25.0",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
-    "alabjs-vite-plugin": "0.2.6"
+    "alabjs-vite-plugin": "0.3.0-alpha.1"
   },
   "devDependencies": {
     "@types/react": "^19.1.0",

package/src/analytics/handler.ts

@@ -81,8 +81,12 @@ export async function handleVitalsBeacon(
  * GET /_alabjs/analytics
  *
  * Returns a JSON snapshot of all collected metrics.
- * Protected by Authorization: Bearer <ALAB_ANALYTICS_SECRET>.
+ * Always requires Authorization: Bearer <ALAB_ANALYTICS_SECRET>.
  * Falls back to ALAB_REVALIDATE_SECRET if ALAB_ANALYTICS_SECRET is unset.
+ *
+ * If neither env var is set the endpoint returns 401 — the endpoint is
+ * intentionally closed by default to prevent information leaks in production
+ * deployments that forget to set an analytics secret.
  */
 export function handleAnalyticsDashboard(
   req: IncomingMessage,
@@ -92,15 +96,16 @@ export function handleAnalyticsDashboard(
     process.env["ALAB_ANALYTICS_SECRET"] ??
     process.env["ALAB_REVALIDATE_SECRET"];
 
-  if (secret) {
-    const auth = req.headers["authorization"] ?? "";
-    const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
-    if (token !== secret) {
-      res.statusCode = 401;
-      res.setHeader("content-type", "application/json");
-      res.end(JSON.stringify({ error: "Unauthorized. Set Authorization: Bearer <ALAB_ANALYTICS_SECRET>." }));
-      return;
-    }
+  const auth = req.headers["authorization"] ?? "";
+  const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
+
+  if (!secret || token !== secret) {
+    res.statusCode = 401;
+    res.setHeader("content-type", "application/json");
+    res.end(JSON.stringify({
+      error: "Unauthorized. Set ALAB_ANALYTICS_SECRET and pass Authorization: Bearer <secret>.",
+    }));
+    return;
   }
 
   res.statusCode = 200;

package/src/cli.ts

@@ -48,7 +48,9 @@ switch (command) {
     break;
   }
   case "start":
-    await import("./commands/start.js").then((m) => m.start({ cwd }));
+    await import("./commands/start.js").then((m) =>
+      m.start({ cwd, port: Number(values["port"]) }),
+    );
     break;
   case "info":
     await import("./commands/info.js").then((m) => m.info({ cwd }));

package/src/client/hooks.ts

@@ -19,7 +19,15 @@ function _cacheSet(key: string, value: Promise<unknown>): void {
   _promiseCache.set(key, value);
 }
 
-/** Clear the server-side promise cache between SSR renders. Called by alab's dev server. */
+/**
+ * Clear the server-side promise cache between SSR renders.
+ *
+ * @internal — Called by Alab's dev and production SSR entry points before each
+ * `renderToPipeableStream` call. If you build a custom SSR integration, you
+ * MUST call this before rendering each page; failing to do so causes stale
+ * promises from a previous request to be returned by `useServerData`, resulting
+ * in wrong data being served to subsequent visitors.
+ */
 export function _clearALabSSRCache(): void {
   _promiseCache.clear();
 }
@@ -48,6 +56,17 @@ export function useServerData<T extends ServerFn<any, any, any>>(
   fnName: string,
   params?: RouteParams<InferServerPath<T>>,
 ): InferServerOutput<T> {
+  // During PPR build-time pre-rendering there is no server running, so we
+  // must not make network calls.  Return an empty array so the component can
+  // render its static shell; data-dependent children should be inside
+  // <Dynamic> which renders a placeholder hole in PPR mode anyway.
+  if (
+    typeof process !== "undefined" &&
+    process.env["ALAB_PPR_PRERENDER"] === "1"
+  ) {
+    return [] as unknown as InferServerOutput<T>;
+  }
+
   const searchParams = params
     ? new URLSearchParams(params as Record<string, string>).toString()
     : "";
@@ -175,9 +194,18 @@ export function useMutation<T extends ServerFn<any, any, any>>(
     startTransition(() => {
       void (async () => {
         try {
+          // Read the CSRF token from the cookie (set by the server on any SSR
+          // page response) and echo it as x-csrf-token for double-submit protection.
+          const csrfToken =
+            typeof document !== "undefined"
+              ? document.cookie.match(/alab-csrf=([^;]+)/)?.[1] ?? ""
+              : "";
           const r = await fetch(`/_alabjs/fn/${fnName}`, {
             method: "POST",
-            headers: { "content-type": "application/json" },
+            headers: {
+              "content-type": "application/json",
+              ...(csrfToken ? { "x-csrf-token": csrfToken } : {}),
+            },
             body: JSON.stringify(input),
           });
 

package/src/commands/build.ts

@@ -1,5 +1,6 @@
 import { build as viteBuild, type PluginOption } from "vite";
-import { resolve } from "node:path";
+import { resolve, relative, isAbsolute } from "node:path";
+import { pathToFileURL } from "node:url";
 import { spawn, execSync } from "node:child_process";
 import { existsSync, writeFileSync, readFileSync, mkdirSync } from "node:fs";
 import { loadUserConfig } from "../config.js";
@@ -151,7 +152,10 @@ export async function build({ cwd, skipTypecheck = false, mode = "ssr", analyze
         ...(visualizerPlugin ? [visualizerPlugin] : []),
       ],
       build: {
-        outDir: resolve(cwd, ".alabjs/dist"),
+        // Output client assets to .alabjs/dist/client/ so the production server's
+        // static handler (which serves from distDir/client/) can find them.
+        outDir: resolve(cwd, ".alabjs/dist/client"),
+        manifest: true,
         ssrManifest: true,
         rolldownOptions: {
           // In SSR mode, we don't use an index.html as the entry point.
@@ -169,9 +173,19 @@ export async function build({ cwd, skipTypecheck = false, mode = "ssr", analyze
 
   await Promise.all(tasks);
 
-  // Write a stable build ID for skew protection (must run after Vite so the
-  // route-manifest.json is in place for the content-hash fallback path).
   const distDir = resolve(cwd, ".alabjs/dist");
+
+  // Scan the app/ directory with the Rust router, normalize paths, and write
+  // route-manifest.json. Must run before writeBuildId (hash) and buildPPRShells.
+  const manifest = await buildRouteManifest(cwd, distDir);
+
+  // Compile all app pages, layouts, and server functions to .alabjs/dist/server/.
+  // Must run after buildRouteManifest so we have the entry list, and before
+  // buildPPRShells which imports the compiled modules.
+  await buildSsrBundle(cwd, distDir, manifest);
+
+  // Write a stable build ID for skew protection (must run after the route
+  // manifest is in place for the content-hash fallback path).
   await writeBuildId(distDir, cwd);
   await buildPPRShells(distDir, cwd);
 
@@ -242,52 +256,64 @@ async function buildPPRShells(distDir: string, cwd: string): Promise<void> {
   const pprCacheDir = resolve(cwd, PPR_CACHE_SUBDIR);
   let count = 0;
 
-  for (const route of pageRoutes) {
-    const modulePath = resolve(distDir, "server", route.file);
-    if (!existsSync(modulePath)) continue;
+  // Signal to useServerData that it must not make network calls — return
+  // empty placeholders instead so components can render their static shell.
+  process.env["ALAB_PPR_PRERENDER"] = "1";
 
-    // Dynamic import — module is compiled ESM, importable by Node directly.
-    const mod = await import(modulePath) as {
-      default?: unknown;
-      ppr?: unknown;
-      metadata?: Record<string, unknown>;
-    };
-
-    if (mod.ppr !== true) continue;
-    if (typeof mod.default !== "function") {
-      console.warn(`  alab  ppr: ${route.file} has no default export — skipping.`);
-      continue;
-    }
+  try {
+    for (const route of pageRoutes) {
+      // esbuild compiles .tsx/.ts → .js; use the compiled path.
+      const modulePath = resolve(distDir, "server", route.file.replace(/\.(tsx?)$/, ".js"));
+      if (!existsSync(modulePath)) continue;
+
+      // Dynamic import — on Windows absolute paths need a file:// URL.
+      const mod = await import(pathToFileURL(modulePath).href) as {
+        default?: unknown;
+        ppr?: unknown;
+        metadata?: Record<string, unknown>;
+      };
+
+      if (mod.ppr !== true) continue;
+      if (typeof mod.default !== "function") {
+        console.warn(`  alab  ppr: ${route.file} has no default export — skipping.`);
+        continue;
+      }
 
-    // Load layout modules (outermost → innermost).
-    const layoutPaths = findBuildLayoutFiles(route.file, distDir);
-    const layoutMods = await Promise.all(
-      layoutPaths.map((p) => import(resolve(distDir, "server", p))),
-    );
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const layouts = layoutMods.map((m: any) => m.default).filter((c: unknown) => typeof c === "function");
+      // Load layout modules (outermost → innermost).
+      const layoutPaths = findBuildLayoutFiles(route.file, distDir);
+      const layoutMods = await Promise.all(
+        layoutPaths.map((p) => import(pathToFileURL(resolve(distDir, "server", p)).href)),
+      );
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const layouts = layoutMods.map((m: any) => m.default).filter((c: unknown) => typeof c === "function");
 
-    try {
-      await preRenderPPRShell({
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        Page: mod.default as any,
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        layouts: layouts as any[],
-        shellOpts: {
-          metadata: (mod.metadata as never) ?? {},
-          paramsJson: "{}",
-          searchParamsJson: "{}",
-          routeFile: route.file,
-          ssr: true,
-        },
-        pprCacheDir,
-        routePath: route.path,
-      });
-      count++;
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.warn(`  alab  ppr: failed to pre-render ${route.path}: ${msg}`);
+      try {
+        await preRenderPPRShell({
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          Page: mod.default as any,
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          layouts: layouts as any[],
+          shellOpts: {
+            metadata: (mod.metadata as never) ?? {},
+            paramsJson: "{}",
+            searchParamsJson: "{}",
+            routeFile: route.file,
+            // PPR shells are static snapshots — client mounts via CSR (createRoot)
+            // rather than hydration to avoid mismatches with the pre-rendered HTML.
+            ssr: false,
+            layoutsJson: JSON.stringify(layoutPaths.map(p => p.replace(/\.js$/, ".tsx"))),
+          },
+          pprCacheDir,
+          routePath: route.path,
+        });
+        count++;
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.warn(`  alab  ppr: failed to pre-render ${route.path}: ${msg}`);
+      }
     }
+  } finally {
+    delete process.env["ALAB_PPR_PRERENDER"];
   }
 
   if (count > 0) {
@@ -443,6 +469,112 @@ async function buildFederationExposes(
   );
 }
 
+/**
+ * Scan `app/` with the Rust router napi, normalize absolute file paths to
+ * cwd-relative, and write `route-manifest.json` to `distDir`.
+ *
+ * Returns the in-memory manifest so callers can use it immediately without
+ * reading the file back from disk.
+ */
+async function buildRouteManifest(cwd: string, distDir: string): Promise<RouteManifest> {
+  const appDir = resolve(cwd, "app");
+  let manifest: RouteManifest = { routes: [] };
+
+  try {
+    type NapiRoutes = { buildRoutes(appDir: string): string };
+    const mod = await import("@alabjs/compiler") as unknown as { default?: NapiRoutes } & NapiRoutes;
+    const napi = (mod.default ?? mod) as NapiRoutes;
+    const json = napi.buildRoutes(appDir);
+    manifest = JSON.parse(json) as RouteManifest;
+
+    // The Rust scanner stores absolute paths; normalize to cwd-relative so the
+    // production server can construct `distDir/server/<file>` paths correctly.
+    for (const route of manifest.routes) {
+      if (isAbsolute(route.file)) {
+        route.file = relative(cwd, route.file);
+      }
+    }
+  } catch {
+    console.warn(
+      "  alab  warning: Rust compiler unavailable — route manifest will be empty.\n" +
+      "         Run `cargo build --release -p alab-napi && bash scripts/copy-napi-binary.sh`.",
+    );
+  }
+
+  mkdirSync(distDir, { recursive: true });
+  writeFileSync(resolve(distDir, "route-manifest.json"), JSON.stringify(manifest, null, 2), "utf8");
+
+  const pages = manifest.routes.filter((r) => r.kind === "page").length;
+  const apis  = manifest.routes.filter((r) => r.kind === "api").length;
+  console.log(`  alab  routes → ${pages} page(s), ${apis} api route(s)`);
+
+  return manifest;
+}
+
+/**
+ * Compile all SSR route files to `distDir/server/` using esbuild's per-file
+ * transpilation mode.
+ *
+ * We use esbuild directly (bundled with Vite) rather than a second viteBuild
+ * call because:
+ *  1. Preserves directory structure via `outbase` without needing
+ *     `preserveModules` (which hangs with some Rolldown versions).
+ *  2. `packages: "external"` externalizes all npm specifiers while inlining
+ *     local relative imports — avoids Node ESM extensionless-import failures.
+ *  3. Much faster: no second Vite startup overhead.
+ */
+async function buildSsrBundle(cwd: string, distDir: string, manifest: RouteManifest): Promise<void> {
+  const entryFiles = manifest.routes.map((r) => resolve(cwd, r.file));
+
+  // Include top-level middleware.ts if present.
+  const middlewarePath = resolve(cwd, "middleware.ts");
+  if (existsSync(middlewarePath)) entryFiles.push(middlewarePath);
+
+  if (entryFiles.length === 0) return;
+
+  // Build the import.meta.env replacement object for esbuild.
+  // Node.js never defines import.meta.env (it's a Vite-only concept), so if
+  // we leave it undefined the compiled server modules throw at runtime on any
+  // reference to import.meta.env.*. We mirror exactly what Vite inlines for
+  // the client build: standard constants + ALAB_PUBLIC_* / VITE_* vars.
+  const publicEnv: Record<string, string> = {};
+  for (const [key, val] of Object.entries(process.env)) {
+    if (key.startsWith("ALAB_PUBLIC_") || key.startsWith("VITE_")) {
+      publicEnv[key] = val ?? "";
+    }
+  }
+  const metaEnv = {
+    PROD: true,
+    DEV: false,
+    SSR: true,
+    MODE: "production",
+    BASE_URL: "/",
+    ...publicEnv,
+  };
+
+  const { build: esbuild } = await import("esbuild");
+  await esbuild({
+    entryPoints: entryFiles,
+    outbase: cwd,      // preserve directory structure: app/page.tsx → server/app/page.js
+    outdir: resolve(distDir, "server"),
+    format: "esm",
+    platform: "node",
+    target: "node22",
+    bundle: true,      // bundle local imports (resolves extensionless paths)
+    packages: "external", // keep all npm specifiers (react, alabjs/*…) as-is
+    jsx: "automatic",
+    jsxImportSource: "react",
+    logLevel: "warning",
+    define: {
+      // Replace the entire import.meta.env expression so property accesses,
+      // destructuring, and optional-chaining all resolve correctly at runtime.
+      "import.meta.env": JSON.stringify(metaEnv),
+    },
+  });
+
+  console.log("  alab  SSR bundle → .alabjs/dist/server");
+}
+
 /** Compile the offline service worker to a standalone iife bundle. */
 async function buildOfflineSw(cwd: string): Promise<void> {
   const swEntry = new URL("../client/offline-sw.js", import.meta.url).pathname;
@@ -461,7 +593,10 @@ async function buildOfflineSw(cwd: string): Promise<void> {
           fileName: () => "offline-sw.js",
         },
         minify: true,
-        rolldownOptions: { output: { inlineDynamicImports: true } },
+        // Note: do NOT set rolldownOptions.output.inlineDynamicImports here.
+        // iife format sets codeSplitting:false which already implies
+        // inlineDynamicImports:true in Rolldown. Setting it explicitly
+        // produces a warning that can cause the build to stall in Rolldown/Vite 8+.
       },
     });
   } catch (err) {

package/src/commands/start.ts

@@ -8,7 +8,7 @@ interface StartOptions {
 }
 
 export async function start({ cwd, port = 3000 }: StartOptions) {
-  const manifestPath = resolve(cwd, ".alabjs/route-manifest.json");
+  const manifestPath = resolve(cwd, ".alabjs/dist/route-manifest.json");
 
   let manifest: RouteManifest;
   try {