gorsee 0.2.5 → 0.2.7

package/README.md

@@ -30,12 +30,16 @@ Read the strategic docs:
 - [Reactive Debugging](./docs/REACTIVE_DEBUGGING.md)
 - [Reactive Measurement Gaps](./docs/REACTIVE_MEASUREMENT_GAPS.md)
 - [Benchmark Policy](./docs/BENCHMARK_POLICY.md)
+- [Benchmark Contract](./docs/BENCHMARK_CONTRACT.json)
 - [Benchmark Methodology](./docs/BENCHMARK_METHODOLOGY.md)
 - [SSR Benchmark Proof](./docs/SSR_BENCHMARK_PROOF.md)
 - [DOM Benchmark Proof](./docs/DOM_BENCHMARK_PROOF.md)
 - [Benchmark Artifacts](./docs/BENCHMARK_ARTIFACTS.md)
 - [Benchmark Release Discipline](./docs/BENCHMARK_RELEASE_DISCIPLINE.md)
 - [Build Diagnostics](./docs/BUILD_DIAGNOSTICS.md)
+- [Deploy Contract](./docs/DEPLOY_CONTRACT.json)
+- [Diagnostics Contract](./docs/DIAGNOSTICS_CONTRACT.json)
+- [Runtime Security Contract](./docs/RUNTIME_SECURITY_CONTRACT.json)
 - [Runtime Failures](./docs/RUNTIME_FAILURES.md)
 - [Cache Invalidation](./docs/CACHE_INVALIDATION.md)
 - [Streaming and Hydration Failures](./docs/STREAMING_HYDRATION_FAILURES.md)
@@ -51,6 +55,8 @@ Read the strategic docs:
 - [AI Debugging Workflows](./docs/AI_DEBUGGING_WORKFLOWS.md)
 - [Starter Onboarding](./docs/STARTER_ONBOARDING.md)
 - [Market-Ready Proof](./docs/MARKET_READY_PROOF.md)
+- [Adoption Proof Manifest](./docs/ADOPTION_PROOF_MANIFEST.json)
+- [Release Contract](./docs/RELEASE_CONTRACT.json)
 - [Migration Guide](./docs/MIGRATION_GUIDE.md)
 - [Upgrade Playbook](./docs/UPGRADE_PLAYBOOK.md)
 - [Deploy Target Guide](./docs/DEPLOY_TARGET_GUIDE.md)
@@ -59,9 +65,12 @@ Read the strategic docs:
 - [Recipe Boundaries](./docs/RECIPE_BOUNDARIES.md)
 - [Workspace Adoption](./docs/WORKSPACE_ADOPTION.md)
 - [Downstream Testing](./docs/DOWNSTREAM_TESTING.md)
+- [Test Coverage Audit](./docs/TEST_COVERAGE_AUDIT.md)
 - [Team Failures](./docs/TEAM_FAILURES.md)
 - [Maturity Policy](./docs/MATURITY_POLICY.md)
+- [Top-Tier Exit Gate](./docs/TOP_TIER_EXIT_GATE.md)
 - [Dependency Policy](./docs/DEPENDENCY_POLICY.md)
+- [Dependency Contract](./docs/DEPENDENCY_CONTRACT.json)
 - [Compatibility Guardrails](./docs/COMPATIBILITY_GUARDRAILS.md)
 - [Ambiguity Policy](./docs/AMBIGUITY_POLICY.md)
 - [DX Feedback Loop](./docs/DX_FEEDBACK_LOOP.md)
@@ -107,6 +116,20 @@ What that means in practice:
 - deterministic plugin platform with capabilities, dependency ordering, config validation, and conformance testing
 - AI diagnostics, saved reactive-trace ingestion, context bundles, IDE projections, and MCP integration built into the framework lifecycle
 - CLI enforcement through `gorsee check`, release gates, deploy contracts, and policy docs
+- machine-readable public API stability enforcement through `bun run api:policy`
+- machine-readable adoption and market-ready proof enforcement through `bun run adoption:policy`
+- machine-readable dependency/runtime support enforcement through `bun run dependency:policy`
+- machine-readable deploy/runtime profile enforcement through `bun run deploy:policy`
+- machine-readable benchmark evidence enforcement through `bun run benchmarks:policy`
+- machine-readable runtime/security contract enforcement through `bun run runtime:security:policy`
+- machine-readable diagnostics and triage contract enforcement through `bun run runtime:policy`
+- critical runtime/release regression enforcement through `bun run critical:surface` and `bun run test:critical-surface`
+- repository-level coverage enforcement through `bun run coverage:audit`
+
+Critical Surface Suite:
+
+- `bun run critical:surface` keeps the documented regression gate aligned across package scripts, CI, support claims, and coverage docs.
+- `bun run test:critical-surface` runs the highest-risk runtime/security/reactive/AI/publish regressions that must fail closed before release.
 
 ## Core Ideas
 

package/dist-pkg/ai/mcp.d.ts

@@ -3,7 +3,7 @@ interface JSONRPCRequest {
     jsonrpc: "2.0";
     id?: string | number | null;
     method: string;
-    params?: any;
+    params?: unknown;
 }
 interface JSONRPCResponse {
     jsonrpc: "2.0";

package/dist-pkg/ai/mcp.js

@@ -1,5 +1,5 @@
 import { buildAIHealthReport, readAIDiagnosticsSnapshot, readAIEvents } from "./store.js";
-import { MAX_AI_JSON_BYTES, safeJSONParse } from "./json.js";
+import { isRecord, MAX_AI_JSON_BYTES, safeJSONParse } from "./json.js";
 export function createAIMCPServer(options) {
   async function handleRequest(request) {
     switch (request.method) {
@@ -44,7 +44,12 @@ export function createAIMCPServer(options) {
           ]
         });
       case "tools/call":
-        return ok(request.id, await callTool(request.params));
+        try {
+          return ok(request.id, await callTool(request.params));
+        } catch (error) {
+          const message = error instanceof Error ? error.message : "Tool invocation failed";
+          return err(request.id, -32602, message);
+        }
       default:
         return err(request.id, -32601, `Method not found: ${request.method}`);
     }
@@ -72,7 +77,7 @@ export function createAIMCPServer(options) {
     serve
   };
   async function callTool(params) {
-    const name = params?.name, args = params?.arguments, limit = Math.max(1, Math.min(args?.limit ?? options.limit ?? 50, 500));
+    const { name, limit } = parseToolCall(params, options.limit);
     if (name === "gorsee_ai_recent_events") {
       const events = await readAIEvents(options.paths.eventsPath, { limit });
       return text(JSON.stringify(events, null, 2));
@@ -88,6 +93,22 @@ export function createAIMCPServer(options) {
     throw Error(`Unknown tool: ${name}`);
   }
 }
+function parseToolCall(params, defaultLimit) {
+  if (!isRecord(params))
+    throw Error("Invalid params: expected tool call object");
+  const { name, arguments: args } = params;
+  if (typeof name !== "string" || name.length === 0)
+    throw Error("Invalid params: tool name is required");
+  if (args !== void 0 && !isRecord(args))
+    throw Error("Invalid params: arguments must be an object");
+  const rawLimit = args?.limit;
+  if (rawLimit !== void 0 && typeof rawLimit !== "number")
+    throw Error("Invalid params: limit must be a number");
+  return {
+    name,
+    limit: Math.max(1, Math.min(rawLimit ?? defaultLimit ?? 50, 500))
+  };
+}
 export function createLineReader(input) {
   const decoder = new TextDecoder;
   return {

package/dist-pkg/cli/cmd-create.js

@@ -191,7 +191,7 @@ dist/
 *.sqlite
 *.db
 .DS_Store
-`, PACKAGE_MANAGER = "bun@1.3.9", CREATE_TEMPLATES = ["basic", "secure-saas", "content-site", "agent-aware-ops", "workspace-monorepo"], REPO_ROOT = fileURLToPath(new URL("../../", import.meta.url)), TEMPLATE_DEFINITIONS = {
+`, PACKAGE_MANAGER = "bun@1.3.9", REPO_ROOT = fileURLToPath(new URL("../../", import.meta.url)), FRAMEWORK_VERSION = JSON.parse(await readFile(join(REPO_ROOT, "package.json"), "utf-8")), FRAMEWORK_PACKAGE_VERSION = FRAMEWORK_VERSION.version, CREATE_TEMPLATES = ["basic", "secure-saas", "content-site", "agent-aware-ops", "workspace-monorepo"], TEMPLATE_DEFINITIONS = {
   "secure-saas": {
     sourceDir: join(REPO_ROOT, "examples/secure-saas"),
     readmeDescription: "Authenticated SaaS starter with protected route groups, explicit auth middleware, and private cache semantics.",
@@ -244,7 +244,7 @@ dist/
       webPackageJson.packageManager = PACKAGE_MANAGER;
       webPackageJson.scripts = createPackageScripts();
       webPackageJson.dependencies = {
-        gorsee: "latest",
+        gorsee: FRAMEWORK_PACKAGE_VERSION,
         "@workspace/shared": "workspace:*"
       };
       await writeFile(webPackagePath, JSON.stringify(webPackageJson, null, 2) + `
@@ -263,10 +263,10 @@ dist/
 };
 function createPackageScripts() {
   return {
-    dev: "gorsee dev",
-    build: "gorsee build",
-    start: "gorsee start",
-    check: "gorsee check"
+    dev: "bun run ./node_modules/gorsee/dist-pkg/bin/gorsee.js dev",
+    build: "bun run ./node_modules/gorsee/dist-pkg/bin/gorsee.js build",
+    start: "bun run ./node_modules/gorsee/dist-pkg/bin/gorsee.js start",
+    check: "bun run ./node_modules/gorsee/dist-pkg/bin/gorsee.js check"
   };
 }
 function normalizePackageName(name) {
@@ -337,7 +337,7 @@ async function normalizeSinglePackageManifest(packageJsonPath, packageName) {
   packageJson.scripts = createPackageScripts();
   packageJson.dependencies = {
     ...packageJson.dependencies ?? {},
-    gorsee: "latest"
+    gorsee: FRAMEWORK_PACKAGE_VERSION
   };
   await writeFile(packageJsonPath, JSON.stringify(packageJson, null, 2) + `
 `);
@@ -408,7 +408,7 @@ async function createBasicProject(dir, name) {
     packageManager: PACKAGE_MANAGER,
     scripts: createPackageScripts(),
     dependencies: {
-      gorsee: "latest"
+      gorsee: FRAMEWORK_PACKAGE_VERSION
     },
     devDependencies: {
       "@types/bun": "1.3.10"

package/dist-pkg/deploy/cloudflare.js

@@ -1,3 +1,9 @@
+function getStaticContent(env) {
+  const value = env.__STATIC_CONTENT;
+  if (typeof value !== "object" || value === null || !("get" in value) || typeof value.get !== "function")
+    return;
+  return value;
+}
 export function generateWranglerConfig(name) {
   const today = new Date().toISOString().split("T")[0];
   return `# Gorsee.js \u2014 Cloudflare Workers configuration
@@ -34,6 +40,18 @@ export function generateCloudflareEntry() {
   return `// Gorsee.js \u2014 Cloudflare Worker entry
 // Auto-generated by \`gorsee deploy cloudflare\`
 
+interface CloudflareStaticContent {
+  get(path: string): Promise<BodyInit | null | undefined>
+}
+
+function getStaticContent(env: Record<string, unknown>): CloudflareStaticContent | undefined {
+  const value = env.__STATIC_CONTENT
+  if (typeof value !== "object" || value === null || !("get" in value) || typeof value.get !== "function") {
+    return undefined
+  }
+  return value as CloudflareStaticContent
+}
+
 export default {
   async fetch(
     request: Request,
@@ -42,12 +60,13 @@ export default {
   ): Promise<Response> {
     const url = new URL(request.url)
     const appOrigin = (env.APP_ORIGIN as string | undefined) ?? url.origin
+    // __STATIC_CONTENT is injected by Cloudflare for static asset access.
+    const staticContent = getStaticContent(env)
 
     // Serve static client assets from KV/site
     if (url.pathname.startsWith("/_gorsee/")) {
       const assetPath = url.pathname.slice("/_gorsee/".length)
-      // @ts-expect-error \u2014 __STATIC_CONTENT is injected by Cloudflare
-      const asset = await (env.__STATIC_CONTENT as any)?.get(assetPath)
+      const asset = await staticContent?.get(assetPath)
       if (asset) {
         return new Response(asset, {
           headers: {
@@ -61,8 +80,7 @@ export default {
     // Serve public static files
     const staticExts = [".css", ".ico", ".svg", ".png", ".jpg", ".woff2", ".txt"]
     if (staticExts.some((ext) => url.pathname.endsWith(ext))) {
-      // @ts-expect-error \u2014 __STATIC_CONTENT is injected by Cloudflare
-      const asset = await (env.__STATIC_CONTENT as any)?.get(url.pathname.slice(1))
+      const asset = await staticContent?.get(url.pathname.slice(1))
       if (asset) {
         return new Response(asset, {
           headers: { "Cache-Control": "public, max-age=3600" },

package/dist-pkg/i18n/index.js

@@ -95,7 +95,7 @@ export function stripLocalePrefix(pathname, supportedLocales = Object.keys(dicti
   return pathname.replace(new RegExp(`^/${locale}(?=/|$)`), "") || "/";
 }
 export function withLocalePath(pathname, locale, options = {}) {
-  const resolvedDefault = options.defaultLocale ?? defaultLocale, strategy = options.strategy ?? routeStrategy, normalized = pathname.startsWith("/") ? pathname : `/${pathname}`;
+  const resolvedDefault = options.defaultLocale ?? defaultLocale, strategy = options.strategy ?? routeStrategy, supportedLocales = Object.keys(dictionaries), normalized = stripLocalePrefix(pathname.startsWith("/") ? pathname : `/${pathname}`, supportedLocales);
   if (strategy === "none")
     return normalized;
   if (strategy === "prefix-except-default" && locale === resolvedDefault)

package/dist-pkg/plugins/drizzle.js

@@ -23,6 +23,9 @@ export default defineConfig({
 })
 `;
 }
+function isDrizzleClosable(value) {
+  return typeof value === "object" && value !== null && "close" in value && typeof value.close === "function";
+}
 export function drizzlePlugin(config) {
   return definePlugin({
     name: "gorsee-drizzle",
@@ -42,7 +45,7 @@ export function drizzlePlugin(config) {
       app.addMiddleware(drizzleMiddleware(drizzleInstance));
     },
     async teardown() {
-      if (drizzleInstance && typeof drizzleInstance.close === "function")
+      if (isDrizzleClosable(drizzleInstance))
         drizzleInstance.close();
       drizzleInstance = null;
     }

package/dist-pkg/plugins/index.js

@@ -124,9 +124,19 @@ export function createPluginRunner(config = {}) {
         await runPluginPhase(plugin, phase);
     },
     async teardownAll() {
-      for (const plugin of [...getOrderedPlugins()].reverse())
-        if (plugin.teardown)
+      const failures = [];
+      for (const plugin of [...getOrderedPlugins()].reverse()) {
+        if (!plugin.teardown)
+          continue;
+        try {
           await plugin.teardown();
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          failures.push(`${plugin.name}: ${message}`);
+        }
+      }
+      if (failures.length > 0)
+        throw Error(`Plugin teardown failed: ${failures.join("; ")}`);
     },
     getMiddlewares: () => [...middlewares],
     getBuildPlugins(_target) {
@@ -134,7 +144,9 @@ export function createPluginRunner(config = {}) {
       for (const plugin of getOrderedPlugins())
         if (plugin.buildPlugins)
           result.push(...plugin.buildPlugins());
-      return result;
+      if (!_target)
+        return result;
+      return result.filter((plugin) => _target === "bun" ? Boolean(plugin.bun) : Boolean(plugin.rolldown));
     },
     getRoutes: () => new Map(routes),
     getPluginDescriptors() {

package/dist-pkg/plugins/prisma.js

@@ -30,6 +30,9 @@ datasource db {
 // }
 `;
 }
+function isPrismaDisconnectable(value) {
+  return typeof value === "object" && value !== null && "$disconnect" in value && typeof value.$disconnect === "function";
+}
 export function prismaPlugin(config = {}) {
   return definePlugin({
     name: "gorsee-prisma",
@@ -49,7 +52,7 @@ export function prismaPlugin(config = {}) {
       app.addMiddleware(prismaMiddleware(prismaClient));
     },
     async teardown() {
-      if (prismaClient && typeof prismaClient.$disconnect === "function")
+      if (isPrismaDisconnectable(prismaClient))
         await prismaClient.$disconnect();
       prismaClient = null;
     }

package/dist-pkg/reactive/live.js

@@ -7,7 +7,7 @@ export function createLive(options) {
     reconnect = !0,
     reconnectDelay = 1000
   } = options, [value, setValue] = createSignal(initialValue), [connected, setConnected] = createSignal(!1);
-  let ws = null, closed = !1, retryCount = 0;
+  let ws = null, closed = !1, retryCount = 0, reconnectScheduled = !1, reconnectToken = 0;
   function handleMessage(event) {
     try {
       const parsed = JSON.parse(String(event.data)), result = transform ? transform(parsed) : parsed;
@@ -16,6 +16,8 @@ export function createLive(options) {
   }
   function handleOpen() {
     retryCount = 0;
+    reconnectScheduled = !1;
+    reconnectToken++;
     setConnected(!0);
   }
   function handleClose() {
@@ -25,9 +27,17 @@ export function createLive(options) {
       scheduleReconnect();
   }
   function scheduleReconnect() {
-    const delay = Math.min(reconnectDelay * 2 ** retryCount, 30000);
+    if (reconnectScheduled || closed)
+      return;
+    reconnectScheduled = !0;
+    const token = ++reconnectToken, delay = Math.min(reconnectDelay * 2 ** retryCount, 30000);
     retryCount++;
-    setTimeout(connect, delay);
+    setTimeout(() => {
+      if (closed || !reconnectScheduled || token !== reconnectToken)
+        return;
+      reconnectScheduled = !1;
+      connect();
+    }, delay);
   }
   function connect() {
     if (closed)
@@ -46,6 +56,8 @@ export function createLive(options) {
   }
   function close() {
     closed = !0;
+    reconnectScheduled = !1;
+    reconnectToken++;
     if (ws) {
       ws.close();
       ws = null;

package/dist-pkg/reactive/optimistic.js

@@ -10,12 +10,17 @@ import {
 } from "./diagnostics.js";
 export function createMutation(options) {
   const mutationNodeId = trackMutationCreated(options.label), [data, setData] = createSignal(void 0), [error, setError] = createSignal(void 0), [isPending, setIsPending] = createSignal(!1);
+  let pendingCount = 0, mutationEpoch = 0;
   async function mutate(variables) {
+    const epoch = mutationEpoch;
     trackMutationStart(mutationNodeId, options.label);
+    pendingCount++;
     setIsPending(!0);
     setError(void 0);
     try {
       const result = await options.mutationFn(variables);
+      if (epoch !== mutationEpoch)
+        return result;
       setData(result);
       trackMutationSuccess(mutationNodeId, options.label);
       options.onSuccess?.(result, variables);
@@ -23,6 +28,8 @@ export function createMutation(options) {
       return result;
     } catch (err) {
       const e = err instanceof Error ? err : Error(String(err));
+      if (epoch !== mutationEpoch)
+        throw e;
       setError(e);
       trackMutationError(mutationNodeId, options.label, e.message);
       options.onError?.(e, variables);
@@ -30,22 +37,28 @@ export function createMutation(options) {
       throw e;
     } finally {
       trackMutationSettled(mutationNodeId, options.label);
-      setIsPending(!1);
+      if (epoch === mutationEpoch) {
+        pendingCount = Math.max(0, pendingCount - 1);
+        setIsPending(pendingCount > 0);
+      }
     }
   }
   async function optimistic(signal, setter, update, variables) {
-    const previous = signal();
-    setter(update(previous, variables));
+    const previous = signal(), optimisticValue = update(previous, variables);
+    setter(optimisticValue);
     try {
       return await mutate(variables);
     } catch (err) {
-      setter(previous);
+      if (Object.is(signal(), optimisticValue))
+        setter(previous);
       trackMutationRollback(mutationNodeId, options.label);
       throw err;
     }
   }
   function reset() {
     trackMutationReset(mutationNodeId, options.label);
+    mutationEpoch++;
+    pendingCount = 0;
     setData(void 0);
     setError(void 0);
     setIsPending(!1);

package/dist-pkg/reactive/resource.js

@@ -8,18 +8,38 @@ import {
   trackResourceMutate,
   trackResourceRefetch
 } from "./diagnostics.js";
-const resourceCache = new Map;
+const resourceCache = new Map, resourceCacheEpochs = new Map;
+function getCacheEpoch(key) {
+  return resourceCacheEpochs.get(key) ?? 0;
+}
+function bumpCacheEpoch(key) {
+  const nextEpoch = getCacheEpoch(key) + 1;
+  resourceCacheEpochs.set(key, nextEpoch);
+  return nextEpoch;
+}
 export function invalidateResource(key) {
+  bumpCacheEpoch(key);
   resourceCache.delete(key);
   trackResourceInvalidation(key, "resource.invalidate");
 }
 export function invalidateAll() {
-  for (const key of resourceCache.keys())
+  for (const key of resourceCache.keys()) {
+    bumpCacheEpoch(key);
     trackResourceInvalidation(key, "resource.invalidateAll");
+  }
   resourceCache.clear();
 }
 export function createResource(fetcher, options) {
   const retryCount = options?.retry ?? 0, retryDelay = options?.retryDelay ?? 1000, cacheKey = options?.key, staleTime = options?.staleTime, diagnosticsLabel = options?.label ?? cacheKey, resourceNodeId = trackResourceCreated(diagnosticsLabel, cacheKey), cached = cacheKey ? resourceCache.get(cacheKey) : void 0, hasValidCache = cached && staleTime && Date.now() - cached.fetchedAt < staleTime, initialValue = hasValidCache ? cached.data : options?.initialData, [data, setData] = createSignal(initialValue), [loading, setLoading] = createSignal(!hasValidCache), [error, setError] = createSignal(void 0);
+  let currentLoadId = 0;
+  function writeCachedValue(value) {
+    if (!cacheKey)
+      return;
+    resourceCache.set(cacheKey, {
+      data: value,
+      fetchedAt: Date.now()
+    });
+  }
   async function fetchWithRetry(attempt) {
     try {
       return await fetcher();
@@ -31,16 +51,30 @@ export function createResource(fetcher, options) {
       throw err;
     }
   }
-  const load = () => {
-    if (cacheKey) {
+  const load = (forceFresh = !1) => {
+    const loadId = ++currentLoadId;
+    if (cacheKey && !forceFresh) {
       const entry = resourceCache.get(cacheKey);
       if (entry?.promise) {
+        const cacheEpoch = getCacheEpoch(cacheKey);
         trackResourceLoadStart(resourceNodeId, diagnosticsLabel, cacheKey, "deduped");
         entry.promise.then((result) => {
+          if (loadId !== currentLoadId)
+            return;
+          if (getCacheEpoch(cacheKey) !== cacheEpoch) {
+            setLoading(!1);
+            return;
+          }
           setData(() => result);
           setLoading(!1);
           trackResourceLoadSuccess(resourceNodeId, diagnosticsLabel, cacheKey);
         }).catch((err) => {
+          if (loadId !== currentLoadId)
+            return;
+          if (getCacheEpoch(cacheKey) !== cacheEpoch) {
+            setLoading(!1);
+            return;
+          }
           setError(err instanceof Error ? err : Error(String(err)));
           setLoading(!1);
           trackResourceLoadError(resourceNodeId, diagnosticsLabel, cacheKey, err instanceof Error ? err.message : String(err));
@@ -48,6 +82,7 @@ export function createResource(fetcher, options) {
         return;
       }
     }
+    const cacheEpoch = cacheKey ? bumpCacheEpoch(cacheKey) : 0;
     setLoading(!0);
     setError(void 0);
     trackResourceLoadStart(resourceNodeId, diagnosticsLabel, cacheKey);
@@ -58,12 +93,24 @@ export function createResource(fetcher, options) {
       resourceCache.set(cacheKey, entry);
     }
     promise.then((result) => {
+      if (loadId !== currentLoadId)
+        return;
+      if (cacheKey && getCacheEpoch(cacheKey) !== cacheEpoch) {
+        setLoading(!1);
+        return;
+      }
       setData(() => result);
       setLoading(!1);
       trackResourceLoadSuccess(resourceNodeId, diagnosticsLabel, cacheKey);
       if (cacheKey)
         resourceCache.set(cacheKey, { data: result, fetchedAt: Date.now() });
     }).catch((err) => {
+      if (loadId !== currentLoadId)
+        return;
+      if (cacheKey && getCacheEpoch(cacheKey) !== cacheEpoch) {
+        setLoading(!1);
+        return;
+      }
       setError(err instanceof Error ? err : Error(String(err)));
       setLoading(!1);
       trackResourceLoadError(resourceNodeId, diagnosticsLabel, cacheKey, err instanceof Error ? err.message : String(err));
@@ -83,14 +130,23 @@ export function createResource(fetcher, options) {
       error,
       refetch: () => {
         trackResourceRefetch(resourceNodeId, diagnosticsLabel, cacheKey);
-        load();
+        load(!0);
       },
       mutate: (value) => {
         trackResourceMutate(resourceNodeId, diagnosticsLabel, cacheKey);
-        if (typeof value === "function")
-          setData(value);
-        else
+        currentLoadId++;
+        if (cacheKey)
+          bumpCacheEpoch(cacheKey);
+        setLoading(!1);
+        setError(void 0);
+        if (typeof value === "function") {
+          const nextValue = value(data());
+          setData(() => nextValue);
+          writeCachedValue(nextValue);
+        } else {
           setData(() => value);
+          writeCachedValue(value);
+        }
       }
     }
   ];

package/dist-pkg/runtime/client.js

@@ -1,15 +1,18 @@
 import { jsx } from "./jsx-runtime.js";
-import { enterHydration, exitHydration } from "./hydration.js";
+import { enterHydration, exitHydration, isHydrating } from "./hydration.js";
 import { replayEvents } from "./event-replay.js";
 import { isRenderableThunk } from "./html-escape.js";
 function isVNodeLike(value) {
   return typeof value === "object" && value !== null && "type" in value && "props" in value;
 }
+function renderVNodeLike(vnode) {
+  return jsx(vnode.type, vnode.props);
+}
 function insertResult(container, result) {
   if (result instanceof Node)
     container.appendChild(result);
   else if (typeof result === "object" && result !== null && isVNodeLike(result))
-    container.appendChild(jsx(result.type, result.props));
+    container.appendChild(renderVNodeLike(result));
   else if (Array.isArray(result))
     for (const child of result)
       insertResult(container, child);
@@ -24,8 +27,16 @@ export function render(component, container) {
 }
 export function hydrate(component, container) {
   enterHydration(container);
-  component();
-  if (exitHydration().recoverableMismatch)
+  let diagnostics;
+  try {
+    component();
+    diagnostics = exitHydration();
+  } catch (error) {
+    if (isHydrating())
+      exitHydration();
+    throw error;
+  }
+  if (diagnostics.recoverableMismatch)
     render(component, container);
   replayEvents(container);
 }

package/dist-pkg/runtime/event-replay.js

@@ -25,11 +25,24 @@ export const EVENT_REPLAY_SCRIPT = `<script data-g-event-replay>
 })();
 </script>`;
 function getEventReplay() {
-  return globalThis.__gorsee_events;
+  const value = globalThis.__gorsee_events;
+  if (!value || typeof value !== "object")
+    return;
+  return value;
 }
 export function replayEvents(root) {
-  getEventReplay()?.replay(root);
+  const replay = getEventReplay()?.replay;
+  if (typeof replay !== "function")
+    return;
+  try {
+    replay(root);
+  } catch {}
 }
 export function stopEventCapture() {
-  getEventReplay()?.stop();
+  const stop = getEventReplay()?.stop;
+  if (typeof stop !== "function")
+    return;
+  try {
+    stop();
+  } catch {}
 }

package/dist-pkg/runtime/form.js

@@ -1,4 +1,7 @@
 import { createSignal } from "../reactive/signal.js";
+function isPlainFormActionResult(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function normalizeFormInput(input) {
   return input instanceof FormData ? input : new URLSearchParams(input);
 }
@@ -27,7 +30,10 @@ export function useFormAction(actionUrl) {
         headers: {
           Accept: "application/json"
         }
-      }), rawResult = await res.json(), result = {
+      }), decoded = await res.json();
+      if (!isPlainFormActionResult(decoded))
+        throw Error("Malformed form action response");
+      const rawResult = decoded, result = {
         ok: rawResult.ok ?? res.ok,
         status: rawResult.status ?? res.status,
         data: rawResult.data,

package/dist-pkg/runtime/island-hydrator.js

@@ -1,12 +1,16 @@
 import { enterHydration, exitHydration } from "./hydration.js";
 import { replayEvents } from "./event-replay.js";
-const islandRegistry = new Map;
+const islandRegistry = new Map, hydrationStarted = new WeakSet;
 export function registerIsland(name, loader) {
   islandRegistry.set(name, loader);
 }
 function parseIslandProps(raw) {
   try {
-    return JSON.parse(raw);
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+      return parsed;
+    console.warn(`[gorsee] Island props payload must decode to an object: ${raw}`);
+    return {};
   } catch {
     console.warn(`[gorsee] Failed to parse island props: ${raw}`);
     return {};
@@ -21,11 +25,30 @@ async function hydrateOne(el) {
     console.warn(`[gorsee] Island "${name}" not found in registry`);
     return;
   }
-  const component = (await loader()).default, rawProps = el.getAttribute("data-props") ?? "{}", props = parseIslandProps(rawProps);
-  enterHydration(el);
-  component(props);
-  exitHydration();
-  replayEvents(el);
+  if (hydrationStarted.has(el))
+    return;
+  hydrationStarted.add(el);
+  let enteredHydration = !1;
+  try {
+    const component = (await loader()).default;
+    if (typeof component !== "function") {
+      hydrationStarted.delete(el);
+      console.warn(`[gorsee] Island "${name}" loader did not return a default component`);
+      return;
+    }
+    const rawProps = el.getAttribute("data-props") ?? "{}", props = parseIslandProps(rawProps);
+    enterHydration(el);
+    enteredHydration = !0;
+    component(props);
+    exitHydration();
+    enteredHydration = !1;
+    replayEvents(el);
+  } catch {
+    if (enteredHydration)
+      exitHydration();
+    hydrationStarted.delete(el);
+    console.warn(`[gorsee] Island "${name}" hydration failed`);
+  }
 }
 export function hydrateIslands() {
   const islands = document.querySelectorAll("[data-island]");
@@ -38,9 +61,11 @@ export function hydrateIslands() {
   }
 }
 function observeLazy(el) {
+  let hydrated = !1;
   const observer = new IntersectionObserver((entries) => {
     for (const entry of entries)
-      if (entry.isIntersecting) {
+      if (!hydrated && entry.isIntersecting) {
+        hydrated = !0;
         observer.unobserve(el);
         hydrateOne(el);
       }

package/dist-pkg/runtime/jsx-runtime.d.ts

@@ -3,10 +3,10 @@ export type GorseeNode = Node | string | number | boolean | null | undefined | G
 export type Component = (props: Record<string, unknown>) => GorseeRenderable;
 export declare const Fragment: unique symbol;
 export interface JSXElement {
-    type: string | Component | typeof Fragment;
+    type: string | Component | symbol;
     props: Record<string, unknown>;
     children: unknown[];
 }
-export declare function jsx(type: string | Component | typeof Fragment, props: Record<string, unknown> | null): Node | DocumentFragment;
+export declare function jsx(type: string | Component | symbol, props: Record<string, unknown> | null): Node | DocumentFragment;
 export declare const jsxs: typeof jsx;
 export declare const jsxDEV: typeof jsx;

package/dist-pkg/runtime/jsx-runtime.js

@@ -5,6 +5,9 @@ export const Fragment = Symbol("Fragment");
 function isVNodeLike(value) {
   return typeof value === "object" && value !== null && "type" in value && "props" in value;
 }
+function renderVNodeLike(vnode) {
+  return jsx(vnode.type, vnode.props);
+}
 function createTextNode(value) {
   return document.createTextNode(String(value ?? ""));
 }
@@ -59,7 +62,7 @@ function hydrateChild(parent, child) {
     return;
   }
   if (isVNodeLike(child)) {
-    jsx(child.type, child.props);
+    renderVNodeLike(child);
     return;
   }
   if (typeof child === "function" && isSignal(child)) {
@@ -90,7 +93,7 @@ function insertChild(parent, child) {
     return;
   }
   if (isVNodeLike(child)) {
-    parent.appendChild(jsx(child.type, child.props));
+    parent.appendChild(renderVNodeLike(child));
     return;
   }
   if (child instanceof Node) {
@@ -113,7 +116,7 @@ function insertChild(parent, child) {
 }
 export function jsx(type, props) {
   const allProps = props ?? {}, children = allProps.children, hydrating = isHydrating();
-  if (type === Fragment) {
+  if (typeof type === "symbol") {
     if (hydrating) {
       if (children != null)
         hydrateChild(document.createDocumentFragment(), children);
@@ -129,7 +132,7 @@ export function jsx(type, props) {
     if (result instanceof Node)
       return result;
     if (isVNodeLike(result))
-      return jsx(result.type, result.props);
+      return renderVNodeLike(result);
     if (isRenderableThunk(result)) {
       const resolved = result();
       if (hydrating) {

package/dist-pkg/runtime/router.js

@@ -1,7 +1,7 @@
 import { hydrate } from "./client.js";
 let currentPath = "";
 const subscribers = [], beforeNavigateHooks = [];
-let navigating = !1, loadingElement = null, activeNavigationController = null, latestNavigationToken = 0, pendingPopScrollY = null, activeNavigationUrl = null, activeNavigationPushState = !0, lastFocusedPreserveKey = null, currentRouteScript = null;
+let navigating = !1, loadingElement = null, activeNavigationController = null, latestNavigationToken = 0, pendingPopScrollY = null, activeNavigationUrl = null, activeNavigationPushState = !0, lastFocusedPreserveKey = null, currentRouteScript = null, initializedDocument = null, initializedWindow = null;
 export function createHTMLFragment(html) {
   const template = document.createElement("template");
   template.innerHTML = html;
@@ -373,13 +373,18 @@ export async function applyHMRUpdate(update) {
 }
 const prefetchCache = new Set, observedViewportPrefetchAnchors = new WeakSet;
 let viewportPrefetchObserver = null;
+function normalizePrefetchURL(url) {
+  const [withoutHash] = url.split("#", 1);
+  return withoutHash || url;
+}
 export function prefetch(url) {
-  if (prefetchCache.has(url))
+  const normalizedURL = normalizePrefetchURL(url);
+  if (prefetchCache.has(normalizedURL))
     return;
-  prefetchCache.add(url);
+  prefetchCache.add(normalizedURL);
   const link = document.createElement("link");
   link.rel = "prefetch";
-  link.href = url;
+  link.href = normalizedURL;
   link.setAttribute("as", "fetch");
   link.setAttribute("crossorigin", "");
   document.head.appendChild(link);
@@ -425,7 +430,7 @@ function shouldHandleClick(e, anchor) {
     return !1;
   if (anchor.hasAttribute("download"))
     return !1;
-  if (anchor.pathname === location.pathname && anchor.hash)
+  if (anchor.pathname === location.pathname && anchor.search === location.search && anchor.hash)
     return !1;
   return !0;
 }
@@ -446,31 +451,37 @@ export function initRouter() {
       gorseeScrollY: readCurrentScrollY()
     }, "", readLocationPath());
   }
-  document.addEventListener("click", (e) => {
-    const anchor = e.target.closest?.("a[href]");
-    if (!anchor)
-      return;
-    if (anchor.dataset.gNoRouter !== void 0)
-      return;
-    if (shouldHandleClick(e, anchor)) {
-      e.preventDefault();
-      navigate(anchor.pathname + anchor.search);
-    }
-  });
-  document.addEventListener("focusin", (e) => {
-    const target = e.target, container = document.getElementById("app");
-    if (!target || !container || !container.contains(target))
-      return;
-    const key = getFocusablePreserveKey(target);
-    if (key)
-      lastFocusedPreserveKey = key;
-  });
-  window.addEventListener("popstate", (e) => {
-    const nextPath = readLocationPath();
-    if (e.state?.gorsee || currentPath !== nextPath) {
-      pendingPopScrollY = typeof e.state?.gorseeScrollY === "number" ? e.state.gorseeScrollY : 0;
-      navigate(nextPath, !1);
-    }
-  });
+  if (initializedDocument !== document) {
+    initializedDocument = document;
+    document.addEventListener("click", (e) => {
+      const anchor = e.target.closest?.("a[href]");
+      if (!anchor)
+        return;
+      if (anchor.dataset.gNoRouter !== void 0)
+        return;
+      if (shouldHandleClick(e, anchor)) {
+        e.preventDefault();
+        navigate(anchor.pathname + anchor.search);
+      }
+    });
+    document.addEventListener("focusin", (e) => {
+      const target = e.target, container = document.getElementById("app");
+      if (!target || !container || !container.contains(target))
+        return;
+      const key = getFocusablePreserveKey(target);
+      if (key)
+        lastFocusedPreserveKey = key;
+    });
+  }
+  if (initializedWindow !== window) {
+    initializedWindow = window;
+    window.addEventListener("popstate", (e) => {
+      const nextPath = readLocationPath();
+      if (e.state?.gorsee || currentPath !== nextPath) {
+        pendingPopScrollY = typeof e.state?.gorseeScrollY === "number" ? e.state.gorseeScrollY : 0;
+        navigate(nextPath, !1);
+      }
+    });
+  }
   observeViewportPrefetchAnchors(document);
 }

package/dist-pkg/server/compress.js

@@ -14,6 +14,34 @@ function isCompressible(contentType) {
   const type = contentType.split(";")[0].trim();
   return COMPRESSIBLE_TYPES.has(type);
 }
+function parseAcceptedEncodings(header) {
+  const accepted = new Map;
+  for (const rawEntry of header.split(",")) {
+    const entry = rawEntry.trim();
+    if (!entry)
+      continue;
+    const [rawName, ...params] = entry.split(";").map((part) => part.trim()), name = rawName?.toLowerCase();
+    if (!name)
+      continue;
+    const qParam = params.find((part) => part.startsWith("q=")), qValue = qParam ? Number(qParam.slice(2)) : 1;
+    if (!Number.isFinite(qValue))
+      continue;
+    accepted.set(name, Math.max(0, Math.min(qValue, 1)));
+  }
+  return accepted;
+}
+function resolveEncoding(header) {
+  const acceptedEncodings = parseAcceptedEncodings(header), wildcardWeight = acceptedEncodings.get("*"), candidates = ["gzip", "deflate"];
+  let best = null;
+  for (const encoding of candidates) {
+    const weight = acceptedEncodings.get(encoding) ?? wildcardWeight ?? 0;
+    if (weight <= 0)
+      continue;
+    if (!best || weight > best.weight)
+      best = { encoding, weight };
+  }
+  return best?.encoding ?? null;
+}
 export function compress() {
   return async (_ctx, next) => {
     const response = await next(), contentType = response.headers.get("content-type");
@@ -23,8 +51,8 @@ export function compress() {
       return response;
     if (!response.body)
       return response;
-    const acceptEncoding = _ctx.request.headers.get("accept-encoding") ?? "";
-    if (acceptEncoding.includes("gzip")) {
+    const selectedEncoding = resolveEncoding(_ctx.request.headers.get("accept-encoding") ?? "");
+    if (selectedEncoding === "gzip") {
       const compressed = response.body.pipeThrough(new CompressionStream("gzip")), headers = new Headers(response.headers);
       headers.set("Content-Encoding", "gzip");
       headers.delete("Content-Length");
@@ -34,7 +62,7 @@ export function compress() {
         headers
       });
     }
-    if (acceptEncoding.includes("deflate")) {
+    if (selectedEncoding === "deflate") {
       const compressed = response.body.pipeThrough(new CompressionStream("deflate")), headers = new Headers(response.headers);
       headers.set("Content-Encoding", "deflate");
       headers.delete("Content-Length");

package/dist-pkg/server/jobs.js

@@ -3,8 +3,9 @@ export function defineJob(name, handler) {
 }
 export function createMemoryJobQueue() {
   const jobs = [];
+  let sequence = 0;
   function sortJobs() {
-    jobs.sort((a, b) => a.runAt - b.runAt);
+    jobs.sort((a, b) => a.runAt - b.runAt || a.sequence - b.sequence);
   }
   return {
     async enqueue(job, payload, options = {}) {
@@ -16,7 +17,8 @@ export function createMemoryJobQueue() {
         attempts: 0,
         maxAttempts: options.maxAttempts ?? 3,
         backoffMs: options.backoffMs ?? 1000,
-        job
+        job,
+        sequence: sequence++
       };
       jobs.push(enqueued);
       sortJobs();

package/dist-pkg/server/middleware.js

@@ -115,8 +115,13 @@ export async function runMiddlewareChain(middlewares, ctx, handler) {
   }, response = await next();
   for (const [key, value] of ctx.responseHeaders.entries())
     if (key.toLowerCase() === "set-cookie")
-      response.headers.append(key, value);
+      appendUniqueSetCookie(response.headers, value);
     else
       response.headers.set(key, value);
   return response;
 }
+function appendUniqueSetCookie(headers, value) {
+  if ((typeof headers.getSetCookie === "function" ? headers.getSetCookie() : []).includes(value))
+    return;
+  headers.append("Set-Cookie", value);
+}

package/dist-pkg/server/not-found.js

@@ -1,6 +1,9 @@
 import { join } from "node:path";
 import { stat } from "node:fs/promises";
 import { wrapHTML } from "./html-shell.js";
+function toRuntimeComponent(component) {
+  return component;
+}
 export async function renderNotFoundPage(routesDir, nonce, options = {}) {
   const { title = "404 - Not Found", bodyPrefix, bodySuffix, headElements } = options;
   try {
@@ -10,7 +13,7 @@ export async function renderNotFoundPage(routesDir, nonce, options = {}) {
         continue;
       const mod = await import(notFoundPath);
       if (typeof mod.default === "function") {
-        const { ssrJsx, renderToString } = await import("../runtime/server.js"), vnode = ssrJsx(mod.default, {}), body = renderToString(vnode);
+        const { ssrJsx, renderToString } = await import("../runtime/server.js"), vnode = ssrJsx(toRuntimeComponent(mod.default), {}), body = renderToString(vnode);
         return wrapHTML(body, nonce, { title, bodyPrefix, bodySuffix, headElements });
       }
     }

package/dist-pkg/server/page-render.js

@@ -1,5 +1,8 @@
 import { resetServerHead, getServerHead } from "../runtime/head.js";
 import { renderToString, ssrJsx } from "../runtime/server.js";
+function toRuntimeComponent(component) {
+  return component;
+}
 function resolvePageDataHook(mod) {
   if (typeof mod.load === "function")
     return mod.load;
@@ -8,7 +11,7 @@ function resolvePageDataHook(mod) {
   return;
 }
 export async function resolvePageRoute(mod, match, ctx) {
-  const component = mod.default;
+  const component = typeof mod.default === "function" ? mod.default : void 0;
   if (typeof component !== "function")
     return null;
   const layoutImportPromises = (match.route.layoutPaths ?? []).map((layoutPath) => import(layoutPath)), pageLoaderPromise = resolvePageDataHook(mod)?.(ctx), [layoutMods, loaderData] = await Promise.all([
@@ -21,9 +24,9 @@ export async function resolvePageRoute(mod, match, ctx) {
     cssFiles.push(...mod.css);
   let pageComponent = component;
   for (let i = layoutMods.length - 1;i >= 0; i--) {
-    const Layout = layoutMods[i].default;
-    if (typeof Layout === "function") {
-      const inner = pageComponent, layoutData = layoutLoaderResults[i];
+    const layoutDefault = layoutMods[i]?.default;
+    if (typeof layoutDefault === "function") {
+      const Layout = layoutDefault, inner = pageComponent, layoutData = layoutLoaderResults[i];
       pageComponent = (props) => Layout({ ...props, data: layoutData, children: () => inner(props) });
     }
   }
@@ -40,7 +43,7 @@ export function createClientScriptPath(entryFile) {
 }
 export function renderPageDocument(pageComponent, ctx, params, loaderData) {
   resetServerHead();
-  const vnode = ssrJsx(pageComponent, { params, ctx, data: loaderData }), html = renderToString(vnode), headElements = getServerHead();
+  const pageProps = { params, ctx, data: loaderData }, vnode = ssrJsx(toRuntimeComponent(pageComponent), pageProps), html = renderToString(vnode), headElements = getServerHead();
   return {
     html,
     headElements,

package/dist-pkg/server/request-policy.js

@@ -2,7 +2,7 @@ import { isAllowedRequestOrigin } from "./middleware.js";
 import { isPartialNavigationRequest } from "./partial-navigation.js";
 import { RPC_ACCEPTED_CONTENT_TYPES } from "./rpc.js";
 export function resolveRequestMetadata(request, options) {
-  const url = new URL(request.url), endpointContract = resolveRequestExecutionPolicy(options.kind), urlProtocol = url.protocol.replace(/:$/, ""), trustedForwardedHops = options.trustForwardedHeaders === !0 ? Math.max(1, options.trustedForwardedHops ?? 1) : 0, forwarded = parseForwardedHeader(request.headers.get("forwarded"), trustedForwardedHops), forwardedHost = normalizeForwardedHost(getTrustedForwardedValue(request.headers.get("x-forwarded-host"), trustedForwardedHops) ?? forwarded.host) ?? forwarded.host ?? void 0, forwardedProto = normalizeForwardedProto(getTrustedForwardedValue(request.headers.get("x-forwarded-proto"), trustedForwardedHops) ?? forwarded.proto) ?? forwarded.proto ?? void 0, forwardedFor = normalizeForwardedFor(getTrustedForwardedValue(request.headers.get("x-forwarded-for"), trustedForwardedHops) ?? forwarded.for) ?? forwarded.for ?? void 0, proxyTrusted = options.trustForwardedHeaders === !0, effectiveHost = proxyTrusted ? forwardedHost ?? (request.headers.get("host") ?? url.host) : request.headers.get("host") ?? url.host, effectiveProto = proxyTrusted ? forwardedProto ?? urlProtocol : urlProtocol;
+  const url = new URL(request.url), endpointContract = resolveRequestExecutionPolicy(options.kind), urlProtocol = url.protocol.replace(/:$/, ""), trustedForwardedHops = options.trustForwardedHeaders === !0 ? Math.max(1, options.trustedForwardedHops ?? 1) : 0, forwarded = parseForwardedHeader(request.headers.get("forwarded"), trustedForwardedHops), trustedForwardedHost = normalizeForwardedHost(getTrustedForwardedValue(request.headers.get("x-forwarded-host"), trustedForwardedHops)), trustedForwardedProto = normalizeForwardedProto(getTrustedForwardedValue(request.headers.get("x-forwarded-proto"), trustedForwardedHops)), trustedForwardedFor = normalizeForwardedFor(getTrustedForwardedValue(request.headers.get("x-forwarded-for"), trustedForwardedHops)), forwardedHost = forwarded.host ?? trustedForwardedHost ?? void 0, forwardedProto = forwarded.proto ?? trustedForwardedProto ?? void 0, forwardedFor = forwarded.for ?? trustedForwardedFor ?? void 0, proxyTrusted = options.trustForwardedHeaders === !0, effectiveHost = proxyTrusted ? forwardedHost ?? (request.headers.get("host") ?? url.host) : request.headers.get("host") ?? url.host, effectiveProto = proxyTrusted ? forwardedProto ?? urlProtocol : urlProtocol;
   return {
     request,
     url,

package/dist-pkg/server/request-preflight.js

@@ -7,10 +7,11 @@ export async function createRateLimitResponse(rateLimiter, key) {
   const result = await rateLimiter.check(key);
   if (result.allowed)
     return null;
+  const retryAfterSeconds = Math.max(0, Math.ceil((result.resetAt - Date.now()) / 1000));
   return new Response("Too Many Requests", {
     status: 429,
     headers: {
-      "Retry-After": String(Math.ceil((result.resetAt - Date.now()) / 1000))
+      "Retry-After": String(retryAfterSeconds)
     }
   });
 }

package/dist-pkg/server/request-security-policy.js

@@ -12,7 +12,7 @@ export function createRequestSecurityPolicy(options = {}) {
     trustForwardedHeaders: options.trustForwardedHeaders === !0,
     trustedForwardedHops: options.trustForwardedHeaders === !0 ? Math.max(1, options.trustedForwardedHops ?? 1) : 0,
     trustedHosts: [...trustedHosts],
-    enforceTrustedHosts: options.enforceTrustedHosts ?? explicitTrustedHosts.length > 0
+    enforceTrustedHosts: options.enforceTrustedHosts ?? (explicitTrustedHosts.length > 0 || options.trustForwardedHeaders === !0 && trustedHosts.size > 0)
   };
 }
 export function validateRequestSecurityPolicy(metadata, executionPolicy, securityPolicy) {

package/dist-pkg/server/route-response.js

@@ -6,6 +6,9 @@ import {
   renderPageDocument
 } from "./page-render.js";
 import { partialNavigationHeaders } from "./partial-navigation.js";
+function toRuntimeComponent(component) {
+  return component;
+}
 export async function renderRoutePageResponse(options) {
   const { match, ctx, resolved, clientScript, nonce, secHeaders = {}, wrapHTML } = options, { pageComponent, loaderData, cssFiles, renderMode } = resolved, pageProps = { params: match.params, ctx, data: loaderData }, htmlOptions = {
     clientScript,
@@ -17,7 +20,7 @@ export async function renderRoutePageResponse(options) {
     if (!wrapHTML)
       throw Error("wrapHTML is required for streaming page responses");
     resetServerHead();
-    const vnode = streamJsx(pageComponent, pageProps), stream = renderToStream(vnode, {
+    const vnode = streamJsx(toRuntimeComponent(pageComponent), pageProps), stream = renderToStream(vnode, {
       shell: (body) => wrapHTML(body, nonce, {
         ...htmlOptions,
         headElements: getServerHead()
@@ -47,10 +50,10 @@ export function renderRoutePartialResponse(options) {
   });
 }
 export async function renderRouteErrorBoundaryResponse(errorPath, error, options) {
-  const { match, nonce, secHeaders = {}, wrapHTML } = options, ErrorComponent = (await import(errorPath)).default;
+  const { match, nonce, secHeaders = {}, wrapHTML } = options, errorMod = await import(errorPath), ErrorComponent = typeof errorMod.default === "function" ? errorMod.default : void 0;
   if (typeof ErrorComponent !== "function")
     throw error;
-  const vnode = ssrJsx(ErrorComponent, { error, params: match.params }), body = renderToString(vnode), html = wrapHTML(body, nonce, { title: "Error" });
+  const vnode = ssrJsx(toRuntimeComponent(ErrorComponent), { error, params: match.params }), body = renderToString(vnode), html = wrapHTML(body, nonce, { title: "Error" });
   return new Response(html, {
     status: 500,
     headers: { "Content-Type": "text/html", ...secHeaders }

package/dist-pkg/server/static-file.js

@@ -25,10 +25,10 @@ export async function serveStaticFile(rootDir, relativePath, options = {}) {
       headers["Cache-Control"] = cacheControl;
     if (etag) {
       const tag = await fileETag(filePath);
-      if (tag && request && isNotModified(request, tag))
-        return new Response(null, { status: 304, headers: extraHeaders });
       if (tag)
         headers.ETag = tag;
+      if (tag && request && isNotModified(request, tag))
+        return new Response(null, { status: 304, headers });
     }
     return new Response(fileBuffer, { headers });
   } catch {

package/dist-pkg/testing/index.js

@@ -10,6 +10,9 @@ import { createContext, runMiddlewareChain } from "../server/middleware.js";
 import { createPluginRunner } from "../plugins/index.js";
 import { renderToString, ssrJsx } from "../runtime/server.js";
 import { navigate } from "../runtime/router.js";
+function toRuntimeComponent(component) {
+  return component;
+}
 export function createTestRequest(path, options = {}) {
   const { method = "GET", headers = {}, body } = options, url = `http://localhost${path}`, init = { method, headers };
   if (body)
@@ -28,7 +31,7 @@ export async function runTestMiddleware(middleware, ctx, handler) {
   return runMiddlewareChain([middleware], ctx, handler ?? (async () => new Response("OK")));
 }
 export function renderComponent(component, props = {}) {
-  const vnode = ssrJsx(component, props);
+  const vnode = ssrJsx(toRuntimeComponent(component), props);
   return renderToString(vnode);
 }
 export async function testLoader(loader, path, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gorsee",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "AI-first reactive full-stack TypeScript framework for deterministic human and agent collaboration",
   "type": "module",
   "packageManager": "bun@1.3.9",
@@ -64,15 +64,21 @@
   ],
   "scripts": {
     "test": "bun test",
+    "test:critical-surface": "bun test tests/server/compress.test.ts tests/server/request-security-policy.test.ts tests/server/request-preflight.test.ts tests/server/route-request-security.test.ts tests/reactive/race-contracts.test.ts tests/runtime/client-runtime-negative.test.ts tests/runtime/client-hydration-recovery.test.ts tests/runtime/router-navigation.test.ts tests/ai/mcp.test.ts tests/cli/install-matrix.test.ts tests/cli/release-surface.test.ts",
     "test:security": "bun test tests/security tests/server/request-policy.test.ts tests/server/request-security-policy.test.ts tests/server/request-preflight.test.ts tests/server/route-request-security.test.ts tests/server/runtime-dispatch.test.ts tests/dev/hmr-security.test.ts tests/integration/dev-prod-parity.test.ts tests/integration/production-runtime.test.ts",
     "test:confidence": "bun test tests/build/entrypoints-boundary.test.ts tests/integration/dev-prod-auth-cache-parity.test.ts tests/integration/dev-prod-cache-rpc-parity.test.ts tests/integration/production-large-app-runtime.test.ts tests/integration/canonical-recipes-runtime.test.ts",
     "test:provider-smoke": "bun test tests/deploy/provider-smoke.test.ts",
     "test:browser-smoke": "node scripts/browser-smoke.mjs",
     "product:policy": "node scripts/product-policy-check.mjs",
+    "dependency:policy": "node scripts/dependency-contract-check.mjs",
+    "deploy:policy": "node scripts/deploy-contract-check.mjs",
+    "api:policy": "node scripts/api-stability-check.mjs",
+    "adoption:policy": "node scripts/adoption-proof-check.mjs",
     "ai:policy": "node scripts/ai-policy-check.mjs",
     "dx:policy": "node scripts/dx-policy-check.mjs",
     "maturity:policy": "node scripts/maturity-policy-check.mjs",
     "runtime:policy": "node scripts/runtime-diagnostics-policy-check.mjs",
+    "runtime:security:policy": "node scripts/runtime-security-contract-check.mjs",
     "compiler:audit": "node scripts/compiler-platform-audit.mjs",
     "compiler:parity": "node scripts/compiler-backend-parity.mjs",
     "compiler:canary": "node scripts/compiler-backend-parity.mjs && bun test tests/cli/programmatic-runtime.test.ts tests/compiler/init.test.ts",
@@ -93,9 +99,12 @@
     "benchmarks:realworld:check": "node scripts/realworld-benchmark-check.mjs",
     "examples:policy": "node scripts/examples-policy-check.mjs",
     "proof:policy": "node scripts/proof-surface-check.mjs",
+    "critical:surface": "node scripts/critical-surface-check.mjs",
+    "top-tier:exit": "node scripts/top-tier-exit-check.mjs",
+    "coverage:audit": "node scripts/coverage-audit-check.mjs",
     "repo:policy": "node scripts/repo-policy-check.mjs",
     "ci:policy": "node scripts/ci-policy-check.mjs",
-    "verify:security": "bun run check && bun run product:policy && bun run ai:policy && bun run dx:policy && bun run maturity:policy && bun run runtime:policy && bun run benchmarks:policy && bun run benchmarks:realworld:check && bun run examples:policy && bun run proof:policy && bun run repo:policy && bun run ci:policy && bun run compiler:promotion:check && bun run build:promotion:check && bun run backend:switch:evidence:check && bun run backend:default-switch:review:check && bun run backend:candidate:rollout:check && bun run compiler:default:rehearsal:check && bun run build:default:rehearsal:check && bun run test:security && bun run test:confidence",
+    "verify:security": "bun run check && bun run product:policy && bun run dependency:policy && bun run deploy:policy && bun run api:policy && bun run adoption:policy && bun run ai:policy && bun run dx:policy && bun run maturity:policy && bun run top-tier:exit && bun run runtime:policy && bun run runtime:security:policy && bun run benchmarks:policy && bun run benchmarks:realworld:check && bun run examples:policy && bun run proof:policy && bun run critical:surface && bun run coverage:audit && bun run repo:policy && bun run ci:policy && bun run compiler:promotion:check && bun run build:promotion:check && bun run backend:switch:evidence:check && bun run backend:default-switch:review:check && bun run backend:candidate:rollout:check && bun run compiler:default:rehearsal:check && bun run build:default:rehearsal:check && bun run test:security && bun run test:critical-surface && bun run test:confidence",
     "check": "tsc --noEmit",
     "install:matrix": "node scripts/install-matrix-check.mjs",
     "dev": "bun run src/dev.ts",