eclipsa 0.1.4 → 0.1.6

package/{types-BCEY9lGp.d.mts → types-Cu9gFlEY.d.mts}

@@ -246,6 +246,10 @@ type NamespacedIntrinsicElementProps = {
   [name: string]: AttributeValue | undefined;
 };
 declare namespace JSX {
+  interface SSRRaw {
+    __e_ssr_raw: true;
+    value: string;
+  }
   interface SSRTemplate {
     __e_ssr_template: true;
     strings: readonly string[];
@@ -259,7 +263,7 @@ declare namespace JSX {
     key?: string | number | symbol | null;
     isStatic: boolean;
     metadata?: Metadata;
-  } | SSRTemplate | string | number | undefined | null | boolean | ((() => Element) & {
+  } | SSRRaw | SSRTemplate | string | number | undefined | null | boolean | ((() => Element) & {
     key?: string | number | symbol;
   });
   interface Metadata {
@@ -279,4 +283,4 @@ declare namespace JSX {
 }
 //#endregion
 export { JSX as i, DelegatedEvent as n, EventHandler as r, BindTarget as t };
-//# sourceMappingURL=types-BCEY9lGp.d.mts.map
+//# sourceMappingURL=types-Cu9gFlEY.d.mts.map

package/{types-DKpefD_u.d.mts → types-DDeNM8UH.d.mts}

@@ -8,4 +8,4 @@ type Insertable = string | number | boolean | undefined | null | Node | Insertab
 type ClientElementLike = Insertable | Insertable[];
 //#endregion
 export { Insertable as n, ClientElementLike as t };
-//# sourceMappingURL=types-DKpefD_u.d.mts.map
+//# sourceMappingURL=types-DDeNM8UH.d.mts.map

package/vite/build/runtime.d.mts

@@ -0,0 +1,4 @@
+import { $t as APP_HOOKS_ELEMENT_ID, An as resolveReroute, At as primeActionState, Cn as createRequestFetch, Dn as markPublicError, Dt as getActionFormSubmissionId, Fn as withServerRequestContext, Gn as escapeInlineScriptText, Kn as escapeJSONScriptText, Mn as serializePublicValue, Nn as toPublicError, On as registerClientHooks, Ot as getNormalizedActionInput, Pt as primeLocationState, Q as hasLoader, Sn as attachRequestFetch, Tt as executeAction, Vt as RESUME_FINAL_STATE_ELEMENT_ID, Wn as deserializeValue, Xt as composeRouteMetadata, Z as executeLoader, Zt as renderRouteMetadataHead, _n as ServerHooksModule, an as BaseAppVariables, at as ACTION_CONTENT_TYPE, en as AppContext, fn as PublicError, gn as ResolvedHooks, hn as Reroute, it as resolvePendingLoaders, jn as runHandleError, kt as hasAction, ln as HandleFetch, mn as RequestFetch, nn as AppHooksManifest, nt as primeLoaderState, on as Handle, rn as AppHooksModule, sn as HandleError, wn as deserializePublicValue, xn as WithAppEnv, yn as Transport } from "../../internal-CHYAJznU.mjs";
+import { Fragment, jsxDEV } from "../../jsx/jsx-dev-runtime.mjs";
+import { a as renderSSR, c as serializeResumePayload, i as getStreamingResumeBootstrapScriptContent, o as renderSSRAsync, s as renderSSRStream } from "../../ssr-D8F-DtCv.mjs";
+export { ACTION_CONTENT_TYPE, APP_HOOKS_ELEMENT_ID, type AppContext, type AppHooksManifest, type AppHooksModule, type BaseAppVariables, Fragment, type Handle, type HandleError, type HandleFetch, type PublicError, RESUME_FINAL_STATE_ELEMENT_ID, type RequestFetch, type Reroute, type ResolvedHooks, type ServerHooksModule, type Transport, type WithAppEnv, attachRequestFetch, composeRouteMetadata, createRequestFetch, deserializePublicValue, deserializeValue, escapeInlineScriptText, escapeJSONScriptText, executeAction, executeLoader, getActionFormSubmissionId, getNormalizedActionInput, getStreamingResumeBootstrapScriptContent, hasAction, hasLoader, jsxDEV, markPublicError, primeActionState, primeLoaderState, primeLocationState, registerClientHooks, renderRouteMetadataHead, renderSSR, renderSSRAsync, renderSSRStream, resolvePendingLoaders, resolveReroute, runHandleError, serializePublicValue, serializeResumePayload, toPublicError, withServerRequestContext };

package/vite/build/runtime.mjs

@@ -0,0 +1,4 @@
+import { Fn as deserializePublicValue, Hn as runHandleError, Jn as escapeInlineScriptText, Kn as withServerRequestContext, L as primeLocationState, Mn as APP_HOOKS_ELEMENT_ID, Nn as attachRequestFetch, Pn as createRequestFetch, Rn as markPublicError, St as RESUME_FINAL_STATE_ELEMENT_ID, Un as serializePublicValue, Vn as resolveReroute, Wn as toPublicError, Yn as escapeJSONScriptText, bn as renderRouteMetadataHead, c as getActionFormSubmissionId, cn as resolvePendingLoaders, d as primeActionState, en as executeLoader, l as getNormalizedActionInput, o as executeAction, on as primeLoaderState, qn as deserializeValue, t as ACTION_CONTENT_TYPE, tn as hasLoader, u as hasAction, yn as composeRouteMetadata, zn as registerClientHooks } from "../../action-DqgkV3zb.mjs";
+import { a as jsxDEV, t as Fragment } from "../../jsx-dev-runtime-DpbWQ4Q0.mjs";
+import { a as serializeResumePayload, i as renderSSRStream, n as renderSSR, r as renderSSRAsync, t as getStreamingResumeBootstrapScriptContent } from "../../ssr-CRg57Wn2.mjs";
+export { ACTION_CONTENT_TYPE, APP_HOOKS_ELEMENT_ID, Fragment, RESUME_FINAL_STATE_ELEMENT_ID, attachRequestFetch, composeRouteMetadata, createRequestFetch, deserializePublicValue, deserializeValue, escapeInlineScriptText, escapeJSONScriptText, executeAction, executeLoader, getActionFormSubmissionId, getNormalizedActionInput, getStreamingResumeBootstrapScriptContent, hasAction, hasLoader, jsxDEV, markPublicError, primeActionState, primeLoaderState, primeLocationState, registerClientHooks, renderRouteMetadataHead, renderSSR, renderSSRAsync, renderSSRStream, resolvePendingLoaders, resolveReroute, runHandleError, serializePublicValue, serializeResumePayload, toPublicError, withServerRequestContext };

package/vite/mod.mjs

@@ -1,5 +1,5 @@
-import { Nn as withServerRequestContext, On as resolveReroute, Tn as markPublicError, _t as ROUTE_MANIFEST_ELEMENT_ID, bn as attachRequestFetch, bt as ROUTE_PREFLIGHT_REQUEST_HEADER, ht as ROUTE_DATA_REQUEST_HEADER, kn as runHandleError, mt as ROUTE_DATA_ENDPOINT, on as composeRouteMetadata, sn as renderRouteMetadataHead, xn as createRequestFetch, yn as APP_HOOKS_ELEMENT_ID, yt as ROUTE_PREFLIGHT_ENDPOINT, z as primeLocationState } from "../action-CgM3EJUS.mjs";
-import { i as jsxDEV, t as Fragment } from "../jsx-dev-runtime-CY60yQJY.mjs";
+import { Hn as runHandleError, Kn as withServerRequestContext, L as primeLocationState, Mn as APP_HOOKS_ELEMENT_ID, Nn as attachRequestFetch, Pn as createRequestFetch, Rn as markPublicError, Vn as resolveReroute, _n as ROUTE_RPC_URL_HEADER, bn as renderRouteMetadataHead, fn as ROUTE_MANIFEST_ELEMENT_ID, hn as ROUTE_PREFLIGHT_REQUEST_HEADER, ln as ROUTE_DATA_ENDPOINT, mn as ROUTE_PREFLIGHT_ENDPOINT, un as ROUTE_DATA_REQUEST_HEADER, yn as composeRouteMetadata } from "../action-DqgkV3zb.mjs";
+import { a as jsxDEV, t as Fragment } from "../jsx-dev-runtime-DpbWQ4Q0.mjs";
 import { t as RESUME_HMR_EVENT } from "../resume-hmr-qTpLc5o-.mjs";
 import { createServerModuleRunner, transformWithOxc } from "vite";
 import { Hono } from "hono";
@@ -10,8 +10,8 @@ import path from "node:path";
 import ts from "typescript";
 import { runRustAnalyzeCompiler, runRustCompiler } from "@eclipsa/optimizer";
 import { cwd } from "node:process";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { toSSG } from "hono/ssg";
-import { pathToFileURL } from "node:url";
 //#region vite/utils/routing.ts
 const normalizeRoutePath = (pathname) => {
 	const normalizedPath = pathname.trim() || "/";
@@ -386,15 +386,19 @@ const annotateOptimizedRootComponents = (source, id) => {
 	const insertions = [];
 	const visit = (node) => {
 		if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === "__eclipsaComponent") {
+			if (node.arguments.length >= 5) return;
 			const lastArgument = node.arguments.at(-1);
-			insertions.push(lastArgument ? lastArgument.end : node.expression.end + 1);
+			insertions.push({
+				code: node.arguments.length >= 4 ? ", { optimizedRoot: true }" : ", undefined, { optimizedRoot: true }",
+				index: lastArgument ? lastArgument.end : node.expression.end + 1
+			});
 		}
 		ts.forEachChild(node, visit);
 	};
 	visit(sourceFile);
 	if (insertions.length === 0) return source;
 	let nextSource = source;
-	for (const index of [...insertions].sort((left, right) => right - left)) nextSource = nextSource.slice(0, index) + ", { optimizedRoot: true }" + nextSource.slice(index);
+	for (const insertion of [...insertions].sort((left, right) => right.index - left.index)) nextSource = nextSource.slice(0, insertion.index) + insertion.code + nextSource.slice(insertion.index);
 	return nextSource;
 };
 const analyzeModule = async (source, id = "analyze-input.tsx") => {
@@ -776,13 +780,51 @@ const collectAppSymbols = async (root) => {
 	}
 	return [...symbols.values()];
 };
+const collectReachableAnalyzableFiles = async (entryFiles) => {
+	const pending = [...entryFiles];
+	const visited = /* @__PURE__ */ new Set();
+	const reachable = /* @__PURE__ */ new Set();
+	const entryFileSet = new Set(entryFiles.map((filePath) => stripQuery(filePath)));
+	while (pending.length > 0) {
+		const next = pending.pop();
+		if (!next) continue;
+		const filePath = stripQuery(next);
+		if (visited.has(filePath) || !isAnalyzableSourceFile(filePath)) continue;
+		visited.add(filePath);
+		let source;
+		try {
+			source = await fs.readFile(filePath, "utf8");
+		} catch (error) {
+			const code = error?.code;
+			if (entryFileSet.has(filePath) && code !== "ENOENT" && code !== "ENOTDIR") throw error;
+			continue;
+		}
+		try {
+			await loadAnalyzedModule(filePath, source);
+		} catch (error) {
+			if (entryFileSet.has(filePath)) throw error;
+			continue;
+		}
+		reachable.add(filePath);
+		const imports = ts.preProcessFile(source, true, true).importedFiles;
+		for (const imported of imports) {
+			const resolvedFilePath = resolveImportedModule(imported.fileName, filePath);
+			if (!resolvedFilePath || !isAnalyzableSourceFile(resolvedFilePath)) continue;
+			pending.push(resolvedFilePath);
+		}
+	}
+	return [...reachable];
+};
 const collectAppActions = async (root) => {
 	const appDir = path$1.join(root, "app");
 	const files = await fg(path$1.join(appDir, "**/*.{ts,tsx}").replaceAll("\\", "/"));
 	const result = [];
 	for (const filePath of files) {
 		const analyzed = await loadAnalyzedModule(filePath);
-		result.push(...analyzed.actions.values());
+		result.push(...[...analyzed.actions.values()].map((action) => ({
+			filePath,
+			id: action.id
+		})));
 	}
 	return result;
 };
@@ -792,7 +834,10 @@ const collectAppLoaders = async (root) => {
 	const result = [];
 	for (const filePath of files) {
 		const analyzed = await loadAnalyzedModule(filePath);
-		result.push(...analyzed.loaders.values());
+		result.push(...[...analyzed.loaders.values()].map((loader) => ({
+			filePath,
+			id: loader.id
+		})));
 	}
 	return result;
 };
@@ -831,7 +876,7 @@ const shouldInvalidateDevApp = (root, filePath, event) => {
 const RESUME_PAYLOAD_PLACEHOLDER = "__ECLIPSA_RESUME_PAYLOAD__";
 const ROUTE_MANIFEST_PLACEHOLDER = "__ECLIPSA_ROUTE_MANIFEST__";
 const APP_HOOKS_PLACEHOLDER = "__ECLIPSA_APP_HOOKS__";
-const replaceHeadPlaceholder = (html, placeholder, value) => html.replace(placeholder, value);
+const replaceHeadPlaceholder = (html, placeholder, value) => html.replaceAll(placeholder, value);
 const splitHtmlForStreaming = (html) => {
 	const bodyCloseIndex = html.lastIndexOf("</body>");
 	if (bodyCloseIndex >= 0) return {
@@ -848,6 +893,37 @@ const splitHtmlForStreaming = (html) => {
 		suffix: ""
 	};
 };
+const toIdsByFilePath$1 = (entries) => {
+	const idsByFilePath = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const existing = idsByFilePath.get(entry.filePath);
+		if (existing) {
+			existing.push(entry.id);
+			continue;
+		}
+		idsByFilePath.set(entry.filePath, [entry.id]);
+	}
+	return idsByFilePath;
+};
+const getRouteReachableEntryFiles$1 = (route) => [
+	route.error?.filePath,
+	...route.layouts.map((layout) => layout.filePath),
+	route.loading?.filePath,
+	route.notFound?.filePath,
+	route.page?.filePath
+].filter((filePath) => typeof filePath === "string");
+const createRouteServerAccessEntries$1 = async (routes, actions, loaders) => {
+	const actionIdsByFilePath = toIdsByFilePath$1(actions);
+	const loaderIdsByFilePath = toIdsByFilePath$1(loaders);
+	return await Promise.all(routes.map(async (route) => {
+		const reachableFiles = await collectReachableAnalyzableFiles(getRouteReachableEntryFiles$1(route));
+		return {
+			actionIds: new Set(reachableFiles.flatMap((filePath) => actionIdsByFilePath.get(filePath) ?? [])),
+			loaderIds: new Set(reachableFiles.flatMap((filePath) => loaderIdsByFilePath.get(filePath) ?? [])),
+			route
+		};
+	}));
+};
 const ROUTE_SLOT_ROUTE_KEY = Symbol.for("eclipsa.route-slot-route");
 const createRouteSlot = (route, startLayoutIndex) => {
 	const slot = {
@@ -983,6 +1059,8 @@ const createDevApp = async (init) => {
 	const allSymbols = await deps.collectAppSymbols(init.resolvedConfig.root);
 	const actionModules = new Map(actions.map((action) => [action.id, action.filePath]));
 	const loaderModules = new Map(loaders.map((loader) => [loader.id, loader.filePath]));
+	const routeServerAccessEntries = await createRouteServerAccessEntries$1(routes, actions, loaders);
+	const routeServerAccessByRoute = new Map(routeServerAccessEntries.map((entry) => [entry.route, entry]));
 	const symbolUrls = Object.fromEntries(allSymbols.map((symbol) => [symbol.id, deps.createDevSymbolUrl(init.resolvedConfig.root, symbol.filePath, symbol.id)]));
 	const routeManifest = createRouteManifest(routes, (entry) => deps.createDevModuleUrl(init.resolvedConfig.root, entry));
 	const appHooksPath = path$1.join(init.resolvedConfig.root, "app/+hooks.ts");
@@ -996,6 +1074,32 @@ const createDevApp = async (init) => {
 		return c;
 	};
 	const reroutePathname = (request, pathname, baseUrl) => normalizeRoutePath(resolveReroute(appHooks.reroute, request, pathname, baseUrl));
+	const getRouteServerAccess = (route) => routeServerAccessByRoute.get(route) ?? {
+		actionIds: /* @__PURE__ */ new Set(),
+		loaderIds: /* @__PURE__ */ new Set(),
+		route
+	};
+	const resolveRouteForCurrentUrl = (request, currentUrl) => {
+		const resolvedPathname = reroutePathname(request, normalizeRoutePath(currentUrl.pathname), currentUrl.href);
+		const match = matchRoute(routes, resolvedPathname);
+		if (match?.route.page) return match;
+		const fallback = findSpecialRoute(routes, resolvedPathname, "notFound");
+		if (fallback?.route.notFound) return fallback;
+		return null;
+	};
+	const getRpcCurrentRoute = (requestContext) => {
+		const requestUrl = getRequestUrl(requestContext.req.raw);
+		const routeUrlHeader = requestContext.req.header(ROUTE_RPC_URL_HEADER);
+		if (!routeUrlHeader) return null;
+		let currentUrl;
+		try {
+			currentUrl = new URL(routeUrlHeader, requestUrl);
+		} catch {
+			return null;
+		}
+		if (currentUrl.origin !== requestUrl.origin) return null;
+		return resolveRouteForCurrentUrl(requestContext.req.raw, currentUrl);
+	};
 	const resolveRequest = async (c, handler) => {
 		const requestContext = prepareRequestContext(c);
 		const execute = (nextContext = requestContext) => withServerRequestContext(nextContext, {
@@ -1063,7 +1167,7 @@ const createDevApp = async (init) => {
 			params,
 			url: getRequestUrl(c.req.raw)
 		});
-		const document = SSRRoot({
+		const document = jsxDEV(SSRRoot, {
 			children: createRouteElement(pathname, params, Page, Layouts, options?.routeError),
 			head: {
 				type: Fragment,
@@ -1116,7 +1220,7 @@ const createDevApp = async (init) => {
 					}
 				] }
 			}
-		});
+		}, null, false, {});
 		applyRequestParams(c, params);
 		const { html, payload, chunks } = await renderSSRStream(() => document, {
 			prepare(container) {
@@ -1286,19 +1390,25 @@ const createDevApp = async (init) => {
 		const { executeAction, hasAction } = await init.runner.import("eclipsa");
 		const id = requestContext.req.param("id");
 		if (!id) return requestContext.text("Not Found", 404);
+		const routeMatch = getRpcCurrentRoute(requestContext);
+		if (!routeMatch) return requestContext.text("Bad Request", 400);
+		if (!getRouteServerAccess(routeMatch.route).actionIds.has(id)) return requestContext.text("Not Found", 404);
 		const modulePath = actionModules.get(id);
 		if (!modulePath) return requestContext.text("Not Found", 404);
 		if (!hasAction(id)) await init.runner.import(modulePath);
-		return executeAction(id, requestContext);
+		return composeRouteMiddlewares(routeMatch.route, requestContext, routeMatch.params, async () => executeAction(id, requestContext));
 	}));
 	app.get("/__eclipsa/loader/:id", async (c) => resolveRequest(c, async (requestContext) => {
 		const { executeLoader, hasLoader } = await init.runner.import("eclipsa");
 		const id = requestContext.req.param("id");
 		if (!id) return requestContext.text("Not Found", 404);
+		const routeMatch = getRpcCurrentRoute(requestContext);
+		if (!routeMatch) return requestContext.text("Bad Request", 400);
+		if (!getRouteServerAccess(routeMatch.route).loaderIds.has(id)) return requestContext.text("Not Found", 404);
 		const modulePath = loaderModules.get(id);
 		if (!modulePath) return requestContext.text("Not Found", 404);
 		if (!hasLoader(id)) await init.runner.import(modulePath);
-		return executeLoader(id, requestContext);
+		return composeRouteMiddlewares(routeMatch.route, requestContext, routeMatch.params, async () => executeLoader(id, requestContext));
 	}));
 	app.get(ROUTE_PREFLIGHT_ENDPOINT, async (c) => resolveRequest(c, async (requestContext) => {
 		const href = requestContext.req.query("href");
@@ -1331,6 +1441,7 @@ const createDevApp = async (init) => {
 			const { ACTION_CONTENT_TYPE, deserializePublicValue, executeAction, getNormalizedActionInput, getActionFormSubmissionId, hasAction, primeActionState } = await init.runner.import("eclipsa");
 			const actionId = await getActionFormSubmissionId(requestContext);
 			if (!actionId) return match.route.server ? invokeRouteServer(match.route.server.filePath, requestContext, match.params) : renderMatchedPage(match, requestContext);
+			if (!getRouteServerAccess(match.route).actionIds.has(actionId)) return requestContext.text("Not Found", 404);
 			const modulePath = actionModules.get(actionId);
 			if (!modulePath) return requestContext.text("Not Found", 404);
 			if (!hasAction(actionId)) await init.runner.import(modulePath);
@@ -1765,18 +1876,49 @@ const createSerializedRoutes = (routes) => JSON.stringify(routes.map((route) =>
 	segments: route.segments,
 	server: route.server ? createBuildServerModuleUrl(route.server) : null
 })));
+const toIdsByFilePath = (entries) => {
+	const idsByFilePath = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const existing = idsByFilePath.get(entry.filePath);
+		if (existing) {
+			existing.push(entry.id);
+			continue;
+		}
+		idsByFilePath.set(entry.filePath, [entry.id]);
+	}
+	return idsByFilePath;
+};
+const getRouteReachableEntryFiles = (route) => [
+	route.error?.filePath,
+	...route.layouts.map((layout) => layout.filePath),
+	route.loading?.filePath,
+	route.notFound?.filePath,
+	route.page?.filePath
+].filter((filePath) => typeof filePath === "string");
+const createRouteServerAccessEntries = async (routes, actions, loaders) => {
+	const actionIdsByFilePath = toIdsByFilePath(actions);
+	const loaderIdsByFilePath = toIdsByFilePath(loaders);
+	return await Promise.all(routes.map(async (route) => {
+		const reachableFiles = await collectReachableAnalyzableFiles(getRouteReachableEntryFiles(route));
+		return {
+			actionIds: reachableFiles.flatMap((filePath) => actionIdsByFilePath.get(filePath) ?? []),
+			loaderIds: reachableFiles.flatMap((filePath) => loaderIdsByFilePath.get(filePath) ?? [])
+		};
+	}));
+};
 const createActionTable = (actions) => actions.map((action) => `  ${JSON.stringify(action.id)}: ${JSON.stringify(createBuildServerActionUrl(action.id))},`).join("\n");
 const createLoaderTable = (loaders) => loaders.map((loader) => `  ${JSON.stringify(loader.id)}: ${JSON.stringify(createBuildServerLoaderUrl(loader.id))},`).join("\n");
 const createPageRouteEntries = (routes) => routes.flatMap((route, routeIndex) => route.page ? toHonoRoutePaths(route.segments).map((honoPath) => ({
 	path: honoPath,
 	routeIndex
 })) : []);
-const renderAppModule = (actions, appHooksClientUrl, appHooksServerUrl, loaders, routes, routeManifest, serverHooksUrl, symbolUrls, stylesheetUrls, chunkCacheUrls) => {
+const renderAppModule = (actions, appHooksClientUrl, appHooksServerUrl, loaders, routes, routeServerAccessEntries, routeManifest, serverHooksUrl, symbolUrls, stylesheetUrls, chunkCacheUrls) => {
 	const serializedRoutes = createSerializedRoutes(routes);
 	const serializedPageRouteEntries = JSON.stringify(createPageRouteEntries(routes));
 	const actionTable = createActionTable(actions);
 	const loaderTable = createLoaderTable(loaders);
 	const serializedAppHooksManifest = JSON.stringify({ client: appHooksClientUrl });
+	const serializedRouteServerAccessEntries = JSON.stringify(routeServerAccessEntries);
 	const serializedAppHooksServerUrl = JSON.stringify(appHooksServerUrl);
 	const serializedSymbolUrls = JSON.stringify(symbolUrls);
 	return `import userApp from "./entries/server_entry.mjs";
@@ -1791,6 +1933,7 @@ const loaders = {
 ${loaderTable}
 };
 const routes = ${serializedRoutes};
+const routeServerAccessEntries = ${serializedRouteServerAccessEntries};
 const pageRouteEntries = ${serializedPageRouteEntries};
 const appHooksManifest = ${serializedAppHooksManifest};
 const appHooksServerUrl = ${serializedAppHooksServerUrl};
@@ -2045,6 +2188,40 @@ const prepareRequestContext = (c, hooks) => {
 const reroutePathname = (hooks, request, pathname, baseUrl) =>
   normalizeRoutePath(resolveReroute(hooks.reroute, request, pathname, baseUrl));
 
+const getRouteServerAccess = (route) => {
+  const routeIndex = routes.indexOf(route);
+  const entry = routeIndex >= 0 ? routeServerAccessEntries[routeIndex] : null;
+  return entry ?? { actionIds: [], loaderIds: [] };
+};
+
+const resolveRouteForCurrentUrl = (hooks, request, currentUrl) => {
+  const resolvedPathname = reroutePathname(hooks, request, normalizeRoutePath(currentUrl.pathname), currentUrl.href);
+  const match = matchRoute(resolvedPathname);
+  if (match?.route?.page) {
+    return match;
+  }
+  const fallback = findSpecialRoute(resolvedPathname, "notFound");
+  return fallback?.route?.notFound ? fallback : null;
+};
+
+const getRpcCurrentRoute = (hooks, c) => {
+  const requestUrl = getRequestUrl(c.req.raw);
+  const routeUrlHeader = c.req.header(${JSON.stringify(ROUTE_RPC_URL_HEADER)});
+  if (!routeUrlHeader) {
+    return null;
+  }
+  let currentUrl;
+  try {
+    currentUrl = new URL(routeUrlHeader, requestUrl);
+  } catch {
+    return null;
+  }
+  if (currentUrl.origin !== requestUrl.origin) {
+    return null;
+  }
+  return resolveRouteForCurrentUrl(hooks, c.req.raw, currentUrl);
+};
+
 const resolveRequest = async (c, handler) => {
   const { appHooks, serverHooks } = await hooksPromise;
   const requestContext = prepareRequestContext(c, serverHooks);
@@ -2545,29 +2722,65 @@ for (const pageRouteEntry of pageRouteEntries) {
   });
 }
 
-app.post("/__eclipsa/action/:id", async (c) => {
-  const id = c.req.param("id");
-  const moduleUrl = actions[id];
-  if (!moduleUrl) {
-    return c.text("Not Found", 404);
-  }
-  if (!hasAction(id)) {
-    await import(moduleUrl);
-  }
-  return executeAction(id, c);
-});
-
-app.get("/__eclipsa/loader/:id", async (c) => {
-  const id = c.req.param("id");
-  const moduleUrl = loaders[id];
-  if (!moduleUrl) {
-    return c.text("Not Found", 404);
-  }
-  if (!hasLoader(id)) {
-    await import(moduleUrl);
-  }
-  return executeLoader(id, c);
-});
+app.post("/__eclipsa/action/:id", async (c) =>
+  resolveRequest(c, async (requestContext, appHooks) => {
+    const id = requestContext.req.param("id");
+    if (!id) {
+      return requestContext.text("Not Found", 404);
+    }
+    const routeMatch = getRpcCurrentRoute(appHooks, requestContext);
+    if (!routeMatch) {
+      return requestContext.text("Bad Request", 400);
+    }
+    const routeAccess = getRouteServerAccess(routeMatch.route);
+    if (!routeAccess.actionIds.includes(id)) {
+      return requestContext.text("Not Found", 404);
+    }
+    const moduleUrl = actions[id];
+    if (!moduleUrl) {
+      return requestContext.text("Not Found", 404);
+    }
+    if (!hasAction(id)) {
+      await import(moduleUrl);
+    }
+    return composeRouteMiddlewares(
+      routeMatch.route,
+      requestContext,
+      routeMatch.params,
+      async () => executeAction(id, requestContext),
+    );
+  }),
+);
+
+app.get("/__eclipsa/loader/:id", async (c) =>
+  resolveRequest(c, async (requestContext, appHooks) => {
+    const id = requestContext.req.param("id");
+    if (!id) {
+      return requestContext.text("Not Found", 404);
+    }
+    const routeMatch = getRpcCurrentRoute(appHooks, requestContext);
+    if (!routeMatch) {
+      return requestContext.text("Bad Request", 400);
+    }
+    const routeAccess = getRouteServerAccess(routeMatch.route);
+    if (!routeAccess.loaderIds.includes(id)) {
+      return requestContext.text("Not Found", 404);
+    }
+    const moduleUrl = loaders[id];
+    if (!moduleUrl) {
+      return requestContext.text("Not Found", 404);
+    }
+    if (!hasLoader(id)) {
+      await import(moduleUrl);
+    }
+    return composeRouteMiddlewares(
+      routeMatch.route,
+      requestContext,
+      routeMatch.params,
+      async () => executeLoader(id, requestContext),
+    );
+  }),
+);
 
 app.get(${JSON.stringify(ROUTE_PREFLIGHT_ENDPOINT)}, async (c) => {
   const href = c.req.query("href");
@@ -2632,6 +2845,10 @@ app.all("*", async (c) => {
             ? invokeRouteServer(match.route.server, c, match.params)
             : renderMatchedPage(match, c);
         }
+        const routeAccess = getRouteServerAccess(match.route);
+        if (!routeAccess.actionIds.includes(actionId)) {
+          return c.text("Not Found", 404);
+        }
         const moduleUrl = actions[actionId];
         if (!moduleUrl) {
           return c.text("Not Found", 404);
@@ -2782,6 +2999,7 @@ const build = async (builder, userConfig, options) => {
 	const actions = await collectAppActions(root);
 	const loaders = await collectAppLoaders(root);
 	const routes = await createRoutes(root);
+	const routeServerAccessEntries = await createRouteServerAccessEntries(routes, actions, loaders);
 	const staticPageRoutes = routes.filter((route) => route.page && resolveRouteRenderMode(route, options.output) === "static");
 	const dynamicPageRoutes = routes.filter((route) => route.page && resolveRouteRenderMode(route, options.output) === "dynamic");
 	if (options.output === "ssg") {
@@ -2814,7 +3032,7 @@ const build = async (builder, userConfig, options) => {
 	const serverDir = path$1.join(root, "dist/server");
 	const appModulePath = path$1.join(root, "dist/ssr/eclipsa_app.mjs");
 	await fs.mkdir(path$1.dirname(appModulePath), { recursive: true });
-	await fs.writeFile(appModulePath, renderAppModule(actions, appHooksClientUrl, appHooksServerUrl, loaders, routes, routeManifest, serverHooksUrl, symbolUrls, stylesheetUrls, chunkCacheAssets.map((asset) => asset.url)));
+	await fs.writeFile(appModulePath, renderAppModule(actions, appHooksClientUrl, appHooksServerUrl, loaders, routes, routeServerAccessEntries, routeManifest, serverHooksUrl, symbolUrls, stylesheetUrls, chunkCacheAssets.map((asset) => asset.url)));
 	const staticPrerenderTargets = await resolveStaticPrerenderTargets(root, staticPageRoutes);
 	const prerenderStaticRoutes = async () => {
 		if (staticPrerenderTargets.concretePaths.size === 0 && staticPrerenderTargets.dynamicParamsByPattern.size === 0) return;
@@ -2890,6 +3108,7 @@ const createEclipsaNitroConfig = (root, nitroConfig) => {
 };
 //#endregion
 //#region vite/config.ts
+const ECLIPSA_RUNTIME_ENTRY_PATH = fileURLToPath(import.meta.resolve("eclipsa/vite/build/runtime"));
 const fileExists = async (filePath) => {
 	try {
 		await fs.access(filePath);
@@ -2920,7 +3139,7 @@ const createConfig = (options) => async (userConfig) => {
 	const ssrInput = Object.fromEntries([
 		["server_entry", path.join(root, "app/+server-entry.ts")],
 		["ssr_root", path.join(root, "app/+ssr-root.tsx")],
-		["eclipsa_runtime", path.join(root, "../packages/eclipsa/vite/build/runtime.ts")],
+		["eclipsa_runtime", ECLIPSA_RUNTIME_ENTRY_PATH],
 		...hasAppHooks ? [["app_hooks", appHooksPath]] : [],
 		...hasServerHooks ? [["server_hooks", serverHooksPath]] : [],
 		...actions.map((action) => [`action__${action.id}`, action.filePath]),
@@ -2950,19 +3169,22 @@ const createConfig = (options) => async (userConfig) => {
 					preserveEntrySignatures: "allow-extension"
 				}
 			} },
-			ssr: { build: {
-				emptyOutDir: true,
-				outDir: path.join(root, "dist/ssr"),
-				rollupOptions: {
-					input: ssrInput,
-					output: {
-						assetFileNames: "assets/[name]-[hash][extname]",
-						chunkFileNames: "chunks/[name]-[hash].mjs",
-						entryFileNames: "entries/[name].mjs"
-					},
-					preserveEntrySignatures: "allow-extension"
+			ssr: {
+				resolve: { noExternal: [/^eclipsa(?:\/|$)/] },
+				build: {
+					emptyOutDir: true,
+					outDir: path.join(root, "dist/ssr"),
+					rollupOptions: {
+						input: ssrInput,
+						output: {
+							assetFileNames: "assets/[name]-[hash][extname]",
+							chunkFileNames: "chunks/[name]-[hash].mjs",
+							entryFileNames: "entries/[name].mjs"
+						},
+						preserveEntrySignatures: "allow-extension"
+					}
 				}
-			} }
+			}
 		},
 		builder: { async buildApp(builder) {
 			await build(builder, userConfig, options);