hadars 0.1.32 → 0.1.34

package/dist/cli.js

@@ -387,17 +387,23 @@ var VOID_ELEMENTS = /* @__PURE__ */ new Set([
   "track",
   "wbr"
 ]);
+var HTML_ESC = { "&": "&amp;", "<": "&lt;", ">": "&gt;", "'": "&#x27;" };
 function escapeHtml(str) {
-  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/'/g, "&#x27;");
+  return str.replace(/[&<>']/g, (c) => HTML_ESC[c]);
 }
+var ATTR_ESC = { "&": "&amp;", '"': "&quot;", "<": "&lt;", ">": "&gt;" };
 function escapeAttr(str) {
-  return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  return str.replace(/[&"<>]/g, (c) => ATTR_ESC[c]);
 }
 function styleObjectToString(style) {
-  return Object.entries(style).map(([key, value]) => {
+  let result = "";
+  for (const key in style) {
+    if (result)
+      result += ";";
     const cssKey = key.replace(/[A-Z]/g, (m) => "-" + m.toLowerCase());
-    return `${cssKey}:${value}`;
-  }).join(";");
+    result += cssKey + ":" + style[key];
+  }
+  return result;
 }
 var SVG_ATTR_MAP = {
   // Presentation / geometry
@@ -532,7 +538,8 @@ var SVG_ATTR_MAP = {
 };
 function renderAttributes(props, isSvg) {
   let attrs = "";
-  for (const [key, value] of Object.entries(props)) {
+  for (const key in props) {
+    const value = props[key];
     if (key === "children" || key === "key" || key === "ref" || key === "dangerouslySetInnerHTML" || key === "suppressHydrationWarning" || key === "suppressContentEditableWarning")
       continue;
     if (key.startsWith("on") && key.length > 2 && key[2] === key[2].toUpperCase())
@@ -996,6 +1003,45 @@ async function renderToString(element, options) {
   }
 }
 
+// src/utils/segmentCache.ts
+function getStore() {
+  const g = globalThis;
+  if (!g.__hadarsSegmentStore) {
+    g.__hadarsSegmentStore = /* @__PURE__ */ new Map();
+  }
+  return g.__hadarsSegmentStore;
+}
+function setSegment(key, html, ttl) {
+  getStore().set(key, {
+    html,
+    expiresAt: ttl != null ? Date.now() + ttl : null
+  });
+}
+function processSegmentCache(html) {
+  let prev;
+  do {
+    prev = html;
+    html = html.replace(
+      /<hadars-c([^>]*)>([\s\S]*?)<\/hadars-c>/g,
+      (match, attrs, content) => {
+        const cacheM = /data-cache="([^"]+)"/.exec(attrs);
+        const keyM = /data-key="([^"]+)"/.exec(attrs);
+        const ttlM = /data-ttl="(\d+)"/.exec(attrs);
+        if (!cacheM || !keyM)
+          return match;
+        if (cacheM[1] === "miss") {
+          setSegment(keyM[1], content, ttlM ? Number(ttlM[1]) : void 0);
+          return content;
+        }
+        if (cacheM[1] === "hit")
+          return content;
+        return match;
+      }
+    );
+  } while (html !== prev);
+  return html;
+}
+
 // src/utils/response.tsx
 var ESC = { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" };
 var escAttr = (s2) => s2.replace(/[&<>"]/g, (c) => ESC[c] ?? c);
@@ -1053,11 +1099,12 @@ var getReactResponse = async (req, opts) => {
   };
   const unsuspend = { cache: /* @__PURE__ */ new Map() };
   globalThis.__hadarsUnsuspend = unsuspend;
+  let bodyHtml;
   try {
-    let html = await renderToString(createElement(App, props));
+    bodyHtml = await renderToString(createElement(App, props));
     if (getAfterRenderProps) {
-      props = await getAfterRenderProps(props, html);
-      await renderToString(
+      props = await getAfterRenderProps(props, bodyHtml);
+      bodyHtml = await renderToString(
         createElement(App, { ...props, location: req.location, context })
       );
     }
@@ -1075,12 +1122,9 @@ var getReactResponse = async (req, opts) => {
     location: req.location,
     ...Object.keys(serverData).length > 0 ? { __serverData: serverData } : {}
   };
-  const appProps = { ...props, location: req.location, context };
   return {
-    App,
-    appProps,
+    bodyHtml: processSegmentCache(bodyHtml),
     clientProps,
-    unsuspend,
     status: context.head.status,
     headHtml: getHeadHtml(context.head)
   };
@@ -1137,7 +1181,8 @@ var getConfigBase = (mode, isServerBuild = false) => {
             // Transforms loadModule('./path') based on build target.
             // Runs before swc-loader (loaders execute right-to-left).
             {
-              loader: loaderPath
+              loader: loaderPath,
+              options: { server: isServerBuild }
             },
             {
               loader: "builtin:swc-loader",
@@ -1168,7 +1213,8 @@ var getConfigBase = (mode, isServerBuild = false) => {
           exclude: [loaderPath],
           use: [
             {
-              loader: loaderPath
+              loader: loaderPath,
+              options: { server: isServerBuild }
             },
             {
               loader: "builtin:swc-loader",
@@ -1631,47 +1677,6 @@ import { existsSync as existsSync2 } from "node:fs";
 import os from "node:os";
 import { spawn } from "node:child_process";
 import cluster from "node:cluster";
-
-// src/utils/segmentCache.ts
-function getStore() {
-  const g = globalThis;
-  if (!g.__hadarsSegmentStore) {
-    g.__hadarsSegmentStore = /* @__PURE__ */ new Map();
-  }
-  return g.__hadarsSegmentStore;
-}
-function setSegment(key, html, ttl) {
-  getStore().set(key, {
-    html,
-    expiresAt: ttl != null ? Date.now() + ttl : null
-  });
-}
-function processSegmentCache(html) {
-  let prev;
-  do {
-    prev = html;
-    html = html.replace(
-      /<hadars-c([^>]*)>([\s\S]*?)<\/hadars-c>/g,
-      (match, attrs, content) => {
-        const cacheM = /data-cache="([^"]+)"/.exec(attrs);
-        const keyM = /data-key="([^"]+)"/.exec(attrs);
-        const ttlM = /data-ttl="(\d+)"/.exec(attrs);
-        if (!cacheM || !keyM)
-          return match;
-        if (cacheM[1] === "miss") {
-          setSegment(keyM[1], content, ttlM ? Number(ttlM[1]) : void 0);
-          return content;
-        }
-        if (cacheM[1] === "hit")
-          return content;
-        return match;
-      }
-    );
-  } while (html !== prev);
-  return html;
-}
-
-// src/build.ts
 var encoder = new TextEncoder();
 async function processHtmlTemplate(templatePath) {
   const html = await fs.readFile(templatePath, "utf-8");
@@ -1816,19 +1821,11 @@ var RenderWorkerPool = class {
     await Promise.all(this.workers.map((w) => w.terminate()));
   }
 };
-async function buildSsrResponse(App, appProps, clientProps, headHtml, status, getPrecontentHtml, unsuspendForRender) {
+async function buildSsrResponse(bodyHtml, clientProps, headHtml, status, getPrecontentHtml) {
   const responseStream = new ReadableStream({
     async start(controller) {
       const [precontentHtml, postContent] = await getPrecontentHtml(headHtml);
       controller.enqueue(encoder.encode(precontentHtml));
-      let bodyHtml;
-      try {
-        globalThis.__hadarsUnsuspend = unsuspendForRender;
-        bodyHtml = await renderToString(createElement(App, appProps));
-      } finally {
-        globalThis.__hadarsUnsuspend = null;
-      }
-      bodyHtml = processSegmentCache(bodyHtml);
       const scriptContent = JSON.stringify({ hadars: { props: clientProps } }).replace(/</g, "\\u003c");
       controller.enqueue(encoder.encode(
         `<div id="app">${bodyHtml}</div><script id="hadars" type="application/json">${scriptContent}</script>` + postContent
@@ -2202,7 +2199,7 @@ var dev = async (options) => {
         getAfterRenderProps,
         getFinalProps
       } = await import(importPath);
-      const { App, appProps, clientProps, unsuspend, status, headHtml } = await getReactResponse(request, {
+      const { bodyHtml, clientProps, status, headHtml } = await getReactResponse(request, {
         document: {
           body: Component,
           lang: "en",
@@ -2211,7 +2208,7 @@ var dev = async (options) => {
           getFinalProps
         }
       });
-      return buildSsrResponse(App, appProps, clientProps, headHtml, status, getPrecontentHtml, unsuspend);
+      return buildSsrResponse(bodyHtml, clientProps, headHtml, status, getPrecontentHtml);
     } catch (err) {
       console.error("[hadars] SSR render error:", err);
       const msg = (err?.stack ?? err?.message ?? String(err)).replace(/</g, "&lt;");
@@ -2356,7 +2353,7 @@ var run = async (options) => {
           status: wStatus
         });
       }
-      const { App, appProps, clientProps, unsuspend, status, headHtml } = await getReactResponse(request, {
+      const { bodyHtml, clientProps, status, headHtml } = await getReactResponse(request, {
         document: {
           body: Component,
           lang: "en",
@@ -2365,7 +2362,7 @@ var run = async (options) => {
           getFinalProps
         }
       });
-      return buildSsrResponse(App, appProps, clientProps, headHtml, status, getPrecontentHtml, unsuspend);
+      return buildSsrResponse(bodyHtml, clientProps, headHtml, status, getPrecontentHtml);
     } catch (err) {
       console.error("[hadars] SSR render error:", err);
       return new Response("Internal Server Error", { status: 500 });

package/dist/loader.cjs

@@ -22,7 +22,8 @@ __export(loader_exports, {
 });
 module.exports = __toCommonJS(loader_exports);
 function loader(source) {
-  const isServer = this.target === "node" || this.target === "async-node";
+  const opts = this.getOptions?.() ?? {};
+  const isServer = typeof opts.server === "boolean" ? opts.server : this.target === "node" || this.target === "async-node";
   const resourcePath = this.resourcePath ?? this.resource ?? "(unknown)";
   let swc;
   try {
@@ -51,7 +52,22 @@ function swcTransform(swc, source, isServer, resourcePath) {
     if (node.type !== "CallExpression")
       return;
     const callee = node.callee;
-    if (!callee || callee.type !== "Identifier" || callee.value !== "loadModule")
+    if (!callee || callee.type !== "Identifier")
+      return;
+    const name = callee.value;
+    if (!isServer && name === "useServerData") {
+      const args2 = node.arguments;
+      if (!args2 || args2.length < 2)
+        return;
+      const fnArg = args2[1].expression ?? args2[1];
+      replacements.push({
+        start: fnArg.span.start - fileOffset,
+        end: fnArg.span.end - fileOffset,
+        replacement: "()=>undefined"
+      });
+      return;
+    }
+    if (name !== "loadModule")
       return;
     const args = node.arguments;
     if (!args || args.length === 0)
@@ -136,11 +152,87 @@ function countLeadingNonCodeBytes(source) {
 }
 const LOAD_MODULE_RE = /\bloadModule\s*(?:<(?:[^<>]|<[^<>]*>)*>\s*)?\(\s*(['"`])((?:\\.|(?!\1)[^\\])*)\1\s*\)/gs;
 const DYNAMIC_LOAD_MODULE_RE = /\bloadModule\s*(?:<(?:[^<>]|<[^<>]*>)*>\s*)?\(/g;
+function scanExpressionEnd(source, pos) {
+  let depth = 0;
+  let i = pos;
+  while (i < source.length) {
+    const ch = source[i];
+    if (ch === "(" || ch === "[" || ch === "{") {
+      depth++;
+      i++;
+      continue;
+    }
+    if (ch === ")" || ch === "]" || ch === "}") {
+      if (depth === 0)
+        break;
+      depth--;
+      i++;
+      continue;
+    }
+    if (ch === "," && depth === 0)
+      break;
+    if (ch === '"' || ch === "'" || ch === "`") {
+      const q = ch;
+      i++;
+      while (i < source.length && source[i] !== q) {
+        if (source[i] === "\\")
+          i++;
+        i++;
+      }
+      i++;
+      continue;
+    }
+    if (ch === "/" && source[i + 1] === "/") {
+      while (i < source.length && source[i] !== "\n")
+        i++;
+      continue;
+    }
+    if (ch === "/" && source[i + 1] === "*") {
+      i += 2;
+      while (i + 1 < source.length && !(source[i] === "*" && source[i + 1] === "/"))
+        i++;
+      i += 2;
+      continue;
+    }
+    i++;
+  }
+  return i;
+}
+function stripUseServerDataFns(source) {
+  const CALL_RE = /\buseServerData\s*(?:<(?:[^<>]|<[^<>]*>)*>\s*)?\(/g;
+  let result = "";
+  let lastIndex = 0;
+  let match;
+  CALL_RE.lastIndex = 0;
+  while ((match = CALL_RE.exec(source)) !== null) {
+    const callStart = match.index;
+    let i = match.index + match[0].length;
+    while (i < source.length && /\s/.test(source[i]))
+      i++;
+    i = scanExpressionEnd(source, i);
+    if (i >= source.length || source[i] !== ",")
+      continue;
+    i++;
+    while (i < source.length && /\s/.test(source[i]))
+      i++;
+    const fnStart = i;
+    const fnEnd = scanExpressionEnd(source, i);
+    if (fnEnd <= fnStart)
+      continue;
+    result += source.slice(lastIndex, fnStart) + "()=>undefined";
+    lastIndex = fnEnd;
+    CALL_RE.lastIndex = fnEnd;
+  }
+  return lastIndex === 0 ? source : result + source.slice(lastIndex);
+}
 function regexTransform(source, isServer, resourcePath) {
-  const transformed = source.replace(
+  let transformed = source.replace(
     LOAD_MODULE_RE,
     (_match, quote, modulePath) => isServer ? `Promise.resolve(require(${quote}${modulePath}${quote}))` : `import(${quote}${modulePath}${quote})`
   );
+  if (!isServer) {
+    transformed = stripUseServerDataFns(transformed);
+  }
   let match;
   DYNAMIC_LOAD_MODULE_RE.lastIndex = 0;
   while ((match = DYNAMIC_LOAD_MODULE_RE.exec(transformed)) !== null) {

package/dist/slim-react/index.cjs

@@ -370,17 +370,23 @@ var VOID_ELEMENTS = /* @__PURE__ */ new Set([
   "track",
   "wbr"
 ]);
+var HTML_ESC = { "&": "&amp;", "<": "&lt;", ">": "&gt;", "'": "&#x27;" };
 function escapeHtml(str) {
-  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/'/g, "&#x27;");
+  return str.replace(/[&<>']/g, (c) => HTML_ESC[c]);
 }
+var ATTR_ESC = { "&": "&amp;", '"': "&quot;", "<": "&lt;", ">": "&gt;" };
 function escapeAttr(str) {
-  return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  return str.replace(/[&"<>]/g, (c) => ATTR_ESC[c]);
 }
 function styleObjectToString(style) {
-  return Object.entries(style).map(([key, value]) => {
+  let result = "";
+  for (const key in style) {
+    if (result)
+      result += ";";
     const cssKey = key.replace(/[A-Z]/g, (m) => "-" + m.toLowerCase());
-    return `${cssKey}:${value}`;
-  }).join(";");
+    result += cssKey + ":" + style[key];
+  }
+  return result;
 }
 var SVG_ATTR_MAP = {
   // Presentation / geometry
@@ -515,7 +521,8 @@ var SVG_ATTR_MAP = {
 };
 function renderAttributes(props, isSvg) {
   let attrs = "";
-  for (const [key, value] of Object.entries(props)) {
+  for (const key in props) {
+    const value = props[key];
     if (key === "children" || key === "key" || key === "ref" || key === "dangerouslySetInnerHTML" || key === "suppressHydrationWarning" || key === "suppressContentEditableWarning")
       continue;
     if (key.startsWith("on") && key.length > 2 && key[2] === key[2].toUpperCase())

package/dist/slim-react/index.js

@@ -269,17 +269,23 @@ var VOID_ELEMENTS = /* @__PURE__ */ new Set([
   "track",
   "wbr"
 ]);
+var HTML_ESC = { "&": "&amp;", "<": "&lt;", ">": "&gt;", "'": "&#x27;" };
 function escapeHtml(str) {
-  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/'/g, "&#x27;");
+  return str.replace(/[&<>']/g, (c) => HTML_ESC[c]);
 }
+var ATTR_ESC = { "&": "&amp;", '"': "&quot;", "<": "&lt;", ">": "&gt;" };
 function escapeAttr(str) {
-  return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  return str.replace(/[&"<>]/g, (c) => ATTR_ESC[c]);
 }
 function styleObjectToString(style) {
-  return Object.entries(style).map(([key, value]) => {
+  let result = "";
+  for (const key in style) {
+    if (result)
+      result += ";";
     const cssKey = key.replace(/[A-Z]/g, (m) => "-" + m.toLowerCase());
-    return `${cssKey}:${value}`;
-  }).join(";");
+    result += cssKey + ":" + style[key];
+  }
+  return result;
 }
 var SVG_ATTR_MAP = {
   // Presentation / geometry
@@ -414,7 +420,8 @@ var SVG_ATTR_MAP = {
 };
 function renderAttributes(props, isSvg) {
   let attrs = "";
-  for (const [key, value] of Object.entries(props)) {
+  for (const key in props) {
+    const value = props[key];
     if (key === "children" || key === "key" || key === "ref" || key === "dangerouslySetInnerHTML" || key === "suppressHydrationWarning" || key === "suppressContentEditableWarning")
       continue;
     if (key.startsWith("on") && key.length > 2 && key[2] === key[2].toUpperCase())

package/dist/ssr-render-worker.js

@@ -294,17 +294,23 @@ var VOID_ELEMENTS = /* @__PURE__ */ new Set([
   "track",
   "wbr"
 ]);
+var HTML_ESC = { "&": "&amp;", "<": "&lt;", ">": "&gt;", "'": "&#x27;" };
 function escapeHtml(str) {
-  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/'/g, "&#x27;");
+  return str.replace(/[&<>']/g, (c) => HTML_ESC[c]);
 }
+var ATTR_ESC = { "&": "&amp;", '"': "&quot;", "<": "&lt;", ">": "&gt;" };
 function escapeAttr(str) {
-  return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  return str.replace(/[&"<>]/g, (c) => ATTR_ESC[c]);
 }
 function styleObjectToString(style) {
-  return Object.entries(style).map(([key, value]) => {
+  let result = "";
+  for (const key in style) {
+    if (result)
+      result += ";";
     const cssKey = key.replace(/[A-Z]/g, (m) => "-" + m.toLowerCase());
-    return `${cssKey}:${value}`;
-  }).join(";");
+    result += cssKey + ":" + style[key];
+  }
+  return result;
 }
 var SVG_ATTR_MAP = {
   // Presentation / geometry
@@ -439,7 +445,8 @@ var SVG_ATTR_MAP = {
 };
 function renderAttributes(props, isSvg) {
   let attrs = "";
-  for (const [key, value] of Object.entries(props)) {
+  for (const key in props) {
+    const value = props[key];
     if (key === "children" || key === "key" || key === "ref" || key === "dangerouslySetInnerHTML" || key === "suppressHydrationWarning" || key === "suppressContentEditableWarning")
       continue;
     if (key.startsWith("on") && key.length > 2 && key[2] === key[2].toUpperCase())
@@ -973,16 +980,18 @@ async function runFullLifecycle(serialReq) {
   };
   const unsuspend = { cache: /* @__PURE__ */ new Map() };
   globalThis.__hadarsUnsuspend = unsuspend;
+  let prelimHtml;
   try {
-    let html = await renderToString(createElement(Component, props));
+    prelimHtml = await renderToString(createElement(Component, props));
     if (getAfterRenderProps) {
-      props = await getAfterRenderProps(props, html);
+      props = await getAfterRenderProps(props, prelimHtml);
       await renderToString(
         createElement(Component, { ...props, location: serialReq.location, context })
       );
     }
-  } finally {
+  } catch (e) {
     globalThis.__hadarsUnsuspend = null;
+    throw e;
   }
   const { context: _ctx, ...restProps } = getFinalProps ? await getFinalProps(props) : props;
   const serverData = {};
@@ -996,7 +1005,16 @@ async function runFullLifecycle(serialReq) {
     ...Object.keys(serverData).length > 0 ? { __serverData: serverData } : {}
   };
   const finalAppProps = { ...props, location: serialReq.location, context };
-  return { finalAppProps, clientProps, unsuspend, headHtml: buildHeadHtml(context.head), status: context.head.status ?? 200 };
+  let appHtml;
+  try {
+    appHtml = await renderToString(createElement(Component, finalAppProps));
+  } finally {
+    globalThis.__hadarsUnsuspend = null;
+  }
+  appHtml = processSegmentCache(appHtml);
+  const scriptContent = JSON.stringify({ hadars: { props: clientProps } }).replace(/</g, "\\u003c");
+  const html = `<div id="app">${appHtml}</div><script id="hadars" type="application/json">${scriptContent}</script>`;
+  return { html, headHtml: buildHeadHtml(context.head), status: context.head.status ?? 200 };
 }
 parentPort.on("message", async (msg) => {
   const { id, type, request } = msg;
@@ -1004,18 +1022,7 @@ parentPort.on("message", async (msg) => {
     await init();
     if (type !== "renderFull")
       return;
-    const { finalAppProps, clientProps, unsuspend, headHtml, status } = await runFullLifecycle(request);
-    const Component = _ssrMod.default;
-    globalThis.__hadarsUnsuspend = unsuspend;
-    let appHtml;
-    try {
-      appHtml = await renderToString(createElement(Component, finalAppProps));
-    } finally {
-      globalThis.__hadarsUnsuspend = null;
-    }
-    appHtml = processSegmentCache(appHtml);
-    const scriptContent = JSON.stringify({ hadars: { props: clientProps } }).replace(/</g, "\\u003c");
-    const html = `<div id="app">${appHtml}</div><script id="hadars" type="application/json">${scriptContent}</script>`;
+    const { html, headHtml, status } = await runFullLifecycle(request);
     parentPort.postMessage({ id, html, headHtml, status });
   } catch (err) {
     parentPort.postMessage({ id, error: err?.message ?? String(err) });

package/dist/ssr-watch.js

@@ -52,7 +52,8 @@ var getConfigBase = (mode, isServerBuild = false) => {
             // Transforms loadModule('./path') based on build target.
             // Runs before swc-loader (loaders execute right-to-left).
             {
-              loader: loaderPath
+              loader: loaderPath,
+              options: { server: isServerBuild }
             },
             {
               loader: "builtin:swc-loader",
@@ -83,7 +84,8 @@ var getConfigBase = (mode, isServerBuild = false) => {
           exclude: [loaderPath],
           use: [
             {
-              loader: loaderPath
+              loader: loaderPath,
+              options: { server: isServerBuild }
             },
             {
               loader: "builtin:swc-loader",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hadars",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "description": "Minimal SSR framework for React — rspack, HMR, TypeScript, Bun/Node/Deno",
   "module": "./dist/index.js",
   "type": "module",

package/src/build.ts

@@ -16,7 +16,6 @@ import os from 'node:os';
 import { spawn } from 'node:child_process';
 import cluster from 'node:cluster';
 import type { HadarsEntryModule, HadarsOptions, HadarsProps } from "./types/hadars";
-import { processSegmentCache } from "./utils/segmentCache";
 const encoder = new TextEncoder();
 
 /**
@@ -73,7 +72,7 @@ async function processHtmlTemplate(templatePath: string): Promise<string> {
 const HEAD_MARKER = '<meta name="HADARS_HEAD">';
 const BODY_MARKER = '<meta name="HADARS_BODY">';
 
-import { renderToString as slimRenderToString, createElement } from './slim-react/index';
+
 
 // Round-robin thread pool for SSR rendering — used on Bun/Deno where
 // node:cluster is not available but node:worker_threads is.
@@ -194,29 +193,19 @@ class RenderWorkerPool {
 }
 
 async function buildSsrResponse(
-    App: any,
-    appProps: Record<string, unknown>,
+    bodyHtml: string,
     clientProps: Record<string, unknown>,
     headHtml: string,
     status: number,
     getPrecontentHtml: (headHtml: string) => Promise<[string, string]>,
-    unsuspendForRender: any,
 ): Promise<Response> {
     const responseStream = new ReadableStream({
         async start(controller) {
             const [precontentHtml, postContent] = await getPrecontentHtml(headHtml);
             // Flush the shell (precontentHtml) immediately so the browser can
-            // start loading CSS/fonts before renderToString blocks the thread.
+            // start loading CSS/fonts before the body is assembled.
             controller.enqueue(encoder.encode(precontentHtml));
 
-            let bodyHtml: string;
-            try {
-                (globalThis as any).__hadarsUnsuspend = unsuspendForRender;
-                bodyHtml = await slimRenderToString(createElement(App, appProps));
-            } finally {
-                (globalThis as any).__hadarsUnsuspend = null;
-            }
-            bodyHtml = processSegmentCache(bodyHtml);
             const scriptContent = JSON.stringify({ hadars: { props: clientProps } }).replace(/</g, '\\u003c');
             controller.enqueue(encoder.encode(
                 `<div id="app">${bodyHtml}</div><script id="hadars" type="application/json">${scriptContent}</script>` + postContent
@@ -690,7 +679,7 @@ export const dev = async (options: HadarsRuntimeOptions) => {
                 getFinalProps,
             } = (await import(importPath)) as HadarsEntryModule<any>;
 
-            const { App, appProps, clientProps, unsuspend, status, headHtml } = await getReactResponse(request, {
+            const { bodyHtml, clientProps, status, headHtml } = await getReactResponse(request, {
                 document: {
                     body: Component as React.FC<HadarsProps<object>>,
                     lang: 'en',
@@ -700,7 +689,7 @@ export const dev = async (options: HadarsRuntimeOptions) => {
                 },
             });
 
-            return buildSsrResponse(App, appProps, clientProps, headHtml, status, getPrecontentHtml, unsuspend);
+            return buildSsrResponse(bodyHtml, clientProps, headHtml, status, getPrecontentHtml);
         } catch (err: any) {
             console.error('[hadars] SSR render error:', err);
             const msg = (err?.stack ?? err?.message ?? String(err)).replace(/</g, '&lt;');
@@ -880,7 +869,7 @@ export const run = async (options: HadarsRuntimeOptions) => {
                 });
             }
 
-            const { App, appProps, clientProps, unsuspend, status, headHtml } = await getReactResponse(request, {
+            const { bodyHtml, clientProps, status, headHtml } = await getReactResponse(request, {
                 document: {
                     body: Component as React.FC<HadarsProps<object>>,
                     lang: 'en',
@@ -890,7 +879,7 @@ export const run = async (options: HadarsRuntimeOptions) => {
                 },
             });
 
-            return buildSsrResponse(App, appProps, clientProps, headHtml, status, getPrecontentHtml, unsuspend);
+            return buildSsrResponse(bodyHtml, clientProps, headHtml, status, getPrecontentHtml);
         } catch (err: any) {
             console.error('[hadars] SSR render error:', err);
             return new Response('Internal Server Error', { status: 500 });

package/src/slim-react/render.ts

@@ -61,30 +61,25 @@ const VOID_ELEMENTS = new Set([
   "wbr",
 ]);
 
+const HTML_ESC: Record<string, string> = { '&': '&amp;', '<': '&lt;', '>': '&gt;', "'": '&#x27;' };
 function escapeHtml(str: string): string {
-  return str
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/'/g, "&#x27;");
+  return str.replace(/[&<>']/g, c => HTML_ESC[c]!);
 }
 
+const ATTR_ESC: Record<string, string> = { '&': '&amp;', '"': '&quot;', '<': '&lt;', '>': '&gt;' };
 function escapeAttr(str: string): string {
-  return str
-    .replace(/&/g, "&amp;")
-    .replace(/"/g, "&quot;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;");
+  return str.replace(/[&"<>]/g, c => ATTR_ESC[c]!);
 }
 
 function styleObjectToString(style: Record<string, any>): string {
-  return Object.entries(style)
-    .map(([key, value]) => {
-      // camelCase → kebab-case
-      const cssKey = key.replace(/[A-Z]/g, (m) => "-" + m.toLowerCase());
-      return `${cssKey}:${value}`;
-    })
-    .join(";");
+  let result = '';
+  for (const key in style) {
+    if (result) result += ';';
+    // camelCase → kebab-case
+    const cssKey = key.replace(/[A-Z]/g, (m) => "-" + m.toLowerCase());
+    result += cssKey + ':' + style[key];
+  }
+  return result;
 }
 
 // ---------------------------------------------------------------------------
@@ -247,7 +242,8 @@ const SVG_ELEMENTS = new Set([
 
 function renderAttributes(props: Record<string, any>, isSvg: boolean): string {
   let attrs = "";
-  for (const [key, value] of Object.entries(props)) {
+  for (const key in props) {
+    const value = props[key];
     // Skip internal / non-attribute props
     if (
       key === "children" ||

package/src/ssr-render-worker.ts

@@ -102,17 +102,19 @@ async function runFullLifecycle(serialReq: SerializableRequest) {
     const unsuspend = { cache: new Map<string, any>() };
     (globalThis as any).__hadarsUnsuspend = unsuspend;
 
+    let prelimHtml: string;
     try {
-        let html = await renderToString(createElement(Component, props));
+        prelimHtml = await renderToString(createElement(Component, props));
 
         if (getAfterRenderProps) {
-            props = await getAfterRenderProps(props, html);
+            props = await getAfterRenderProps(props, prelimHtml);
             await renderToString(
                 createElement(Component, { ...props, location: serialReq.location, context }),
             );
         }
-    } finally {
+    } catch (e) {
         (globalThis as any).__hadarsUnsuspend = null;
+        throw e;
     }
 
     const { context: _ctx, ...restProps } = getFinalProps ? await getFinalProps(props) : props;
@@ -129,7 +131,21 @@ async function runFullLifecycle(serialReq: SerializableRequest) {
     };
 
     const finalAppProps = { ...props, location: serialReq.location, context };
-    return { finalAppProps, clientProps, unsuspend, headHtml: buildHeadHtml(context.head), status: context.head.status ?? 200 };
+
+    // Final render — __hadarsUnsuspend is still set; cache is fully populated so
+    // useServerData calls return cached values without any async work.
+    let appHtml: string;
+    try {
+        appHtml = await renderToString(createElement(Component, finalAppProps));
+    } finally {
+        (globalThis as any).__hadarsUnsuspend = null;
+    }
+    appHtml = processSegmentCache(appHtml);
+
+    const scriptContent = JSON.stringify({ hadars: { props: clientProps } }).replace(/</g, '\\u003c');
+    const html = `<div id="app">${appHtml}</div><script id="hadars" type="application/json">${scriptContent}</script>`;
+
+    return { html, headHtml: buildHeadHtml(context.head), status: context.head.status ?? 200 };
 }
 
 // ── Message handler ────────────────────────────────────────────────────────
@@ -140,27 +156,7 @@ parentPort!.on('message', async (msg: any) => {
         await init();
         if (type !== 'renderFull') return;
 
-        const { finalAppProps, clientProps, unsuspend, headHtml, status } =
-            await runFullLifecycle(request as SerializableRequest);
-
-        const Component = _ssrMod.default;
-
-        // Render the Component as the direct root — matching hydrateRoot(div#app, <Component>)
-        // on the client.  Wrapping in Fragment(div#app(...), script) would add an extra
-        // pushTreeContext(2,0) from the Fragment's child array, shifting all tree-position
-        // useId values by 2 bits and causing a hydration mismatch.
-        (globalThis as any).__hadarsUnsuspend = unsuspend;
-        let appHtml: string;
-        try {
-            appHtml = await renderToString(createElement(Component, finalAppProps));
-        } finally {
-            (globalThis as any).__hadarsUnsuspend = null;
-        }
-        appHtml = processSegmentCache(appHtml);
-
-        const scriptContent = JSON.stringify({ hadars: { props: clientProps } }).replace(/</g, '\\u003c');
-        const html = `<div id="app">${appHtml}</div><script id="hadars" type="application/json">${scriptContent}</script>`;
-
+        const { html, headHtml, status } = await runFullLifecycle(request as SerializableRequest);
         parentPort!.postMessage({ id, html, headHtml, status });
 
     } catch (err: any) {

package/src/utils/loader.ts

@@ -1,34 +1,49 @@
 /**
- * Rspack/webpack loader that transforms `loadModule('path')` calls based on
- * the compilation target:
+ * Rspack/webpack loader that applies two source-level transforms based on the
+ * compilation target (web vs node):
  *
+ * ── loadModule('path') ────────────────────────────────────────────────────────
  *  - web  (browser): replaced with `import('./path')` — rspack treats this as
  *    a true dynamic import and splits the module into a separate chunk.
- *
  *  - node (SSR):     replaced with `Promise.resolve(require('./path'))` —
- *    rspack bundles the module statically so it is always available
- *    synchronously on the server, wrapped in Promise.resolve to keep the
- *    API shape identical to the client side.
+ *    bundled statically, wrapped in Promise.resolve to keep the API shape.
+ *
+ * ── useServerData(key, fn) ───────────────────────────────────────────────────
+ *  - web  (browser): the second argument `fn` is replaced with `()=>undefined`.
+ *    `fn` is a server-only callback that may reference internal endpoints,
+ *    credentials, or other sensitive information. It is never called in the
+ *    browser (the hook returns the SSR-cached value immediately), but without
+ *    this transform it would still be compiled into the client bundle — exposing
+ *    those details to anyone who inspects the JS. Stripping it at bundle time
+ *    prevents the leak entirely.
+ *  - node (SSR): kept as-is — the real fn is needed to fetch data.
  *
  * Transformation strategy:
  *   Primary  — SWC AST parsing via @swc/core. Handles any valid TS/JS syntax
  *              including arbitrarily-nested generics, comments, and string
- *              literals that contain the text "loadModule".
- *   Fallback — Regex transform used when @swc/core is unavailable.
+ *              literals that contain the function names.
+ *   Fallback — Scanner-based transform used when @swc/core is unavailable.
  *
- * Example usage:
+ * Example:
  *
- *   import { loadModule } from 'hadars';
+ *   // Source (shared component):
+ *   const user = useServerData('user', () => db.getUser(req.userId));
  *
- *   // Code-split React component (wrap with React.lazy + Suspense):
- *   const MyComp = React.lazy(() => loadModule('./MyComp'));
+ *   // Client bundle after transform:
+ *   const user = useServerData('user', ()=>undefined);
  *
- *   // Dynamic module load:
- *   const { default: fn } = await loadModule('./heavyUtil');
+ *   // Server bundle (unchanged):
+ *   const user = useServerData('user', () => db.getUser(req.userId));
  */
 
 export default function loader(this: any, source: string): string {
-    const isServer = this.target === 'node' || this.target === 'async-node';
+    // Prefer the explicit `server` option injected by rspack.ts over the legacy
+    // `this.target` heuristic (which is unreliable when `target` is not set in
+    // the rspack config — rspack then reports 'web' for every build).
+    const opts = this.getOptions?.() ?? {};
+    const isServer: boolean = (typeof opts.server === 'boolean')
+        ? opts.server
+        : (this.target === 'node' || this.target === 'async-node');
     const resourcePath: string = this.resourcePath ?? this.resource ?? '(unknown)';
 
     let swc: any;
@@ -80,7 +95,26 @@ function swcTransform(this: any, swc: any, source: string, isServer: boolean, re
         if (node.type !== 'CallExpression') return;
 
         const callee = node.callee;
-        if (!callee || callee.type !== 'Identifier' || callee.value !== 'loadModule') return;
+        if (!callee || callee.type !== 'Identifier') return;
+
+        const name: string = callee.value;
+
+        // ── useServerData(key, fn) — strip fn on client builds ────────────────
+        if (!isServer && name === 'useServerData') {
+            const args: any[] = node.arguments;
+            if (!args || args.length < 2) return;
+            const fnArg = args[1].expression ?? args[1];
+            // Normalise to 0-based local byte offsets and replace with stub.
+            replacements.push({
+                start: fnArg.span.start - fileOffset,
+                end: fnArg.span.end - fileOffset,
+                replacement: '()=>undefined',
+            });
+            return;
+        }
+
+        // ── loadModule(path) ─────────────────────────────────────────────────
+        if (name !== 'loadModule') return;
 
         const args: any[] = node.arguments;
         if (!args || args.length === 0) return;
@@ -199,13 +233,99 @@ const LOAD_MODULE_RE =
 // (i.e. a dynamic / non-literal path argument).
 const DYNAMIC_LOAD_MODULE_RE = /\bloadModule\s*(?:<(?:[^<>]|<[^<>]*>)*>\s*)?\(/g;
 
+/**
+ * Scan forward from `pos` in `source`, skipping over a balanced JS expression
+ * (handles nested parens/brackets/braces and string literals).
+ * Returns the index of the first character AFTER the expression
+ * (i.e. the position of the trailing `,` or `)` at depth 0).
+ */
+function scanExpressionEnd(source: string, pos: number): number {
+    let depth = 0;
+    let i = pos;
+    while (i < source.length) {
+        const ch = source[i]!;
+        if (ch === '(' || ch === '[' || ch === '{') { depth++; i++; continue; }
+        if (ch === ')' || ch === ']' || ch === '}') {
+            if (depth === 0) break; // end of expression — closing delimiter of outer call
+            depth--; i++; continue;
+        }
+        if (ch === ',' && depth === 0) break; // end of expression — next argument
+        // String / template literals
+        if (ch === '"' || ch === "'" || ch === '`') {
+            const q = ch; i++;
+            while (i < source.length && source[i] !== q) {
+                if (source[i] === '\\') i++; // escape sequence
+                i++;
+            }
+            i++; // closing quote
+            continue;
+        }
+        // Line comment
+        if (ch === '/' && source[i + 1] === '/') {
+            while (i < source.length && source[i] !== '\n') i++;
+            continue;
+        }
+        // Block comment
+        if (ch === '/' && source[i + 1] === '*') {
+            i += 2;
+            while (i + 1 < source.length && !(source[i] === '*' && source[i + 1] === '/')) i++;
+            i += 2;
+            continue;
+        }
+        i++;
+    }
+    return i;
+}
+
+/**
+ * Strip the `fn` argument from `useServerData(key, fn)` calls in client builds.
+ * Uses a character-level scanner to handle arbitrary fn expressions (arrow
+ * functions with nested calls, async functions, object literals, etc.).
+ */
+function stripUseServerDataFns(source: string): string {
+    // Match `useServerData` + optional generic + opening paren
+    const CALL_RE = /\buseServerData\s*(?:<(?:[^<>]|<[^<>]*>)*>\s*)?\(/g;
+    let result = '';
+    let lastIndex = 0;
+    let match: RegExpExecArray | null;
+    CALL_RE.lastIndex = 0;
+    while ((match = CALL_RE.exec(source)) !== null) {
+        const callStart = match.index;
+        let i = match.index + match[0].length;
+        // Skip whitespace before first arg
+        while (i < source.length && /\s/.test(source[i]!)) i++;
+        // Skip first argument (key: string or array)
+        i = scanExpressionEnd(source, i);
+        // Expect comma separator
+        if (i >= source.length || source[i] !== ',') continue;
+        i++; // skip comma
+        // Skip whitespace before fn
+        while (i < source.length && /\s/.test(source[i]!)) i++;
+        const fnStart = i;
+        // Scan to end of fn argument
+        const fnEnd = scanExpressionEnd(source, i);
+        if (fnEnd <= fnStart) continue;
+        // Emit everything up to fn, then the stub, skip the original fn
+        result += source.slice(lastIndex, fnStart) + '()=>undefined';
+        lastIndex = fnEnd;
+        // Advance regex past this call to avoid re-matching
+        CALL_RE.lastIndex = fnEnd;
+    }
+    return lastIndex === 0 ? source : result + source.slice(lastIndex);
+}
+
 function regexTransform(this: any, source: string, isServer: boolean, resourcePath: string): string {
-    const transformed = source.replace(LOAD_MODULE_RE, (_match, quote, modulePath) =>
+    let transformed = source.replace(LOAD_MODULE_RE, (_match, quote, modulePath) =>
         isServer
             ? `Promise.resolve(require(${quote}${modulePath}${quote}))`
             : `import(${quote}${modulePath}${quote})`
     );
 
+    // Strip server-only fn arguments from useServerData on client builds.
+    if (!isServer) {
+        transformed = stripUseServerDataFns(transformed);
+    }
+
     // Warn for any remaining dynamic calls
     let match: RegExpExecArray | null;
     DYNAMIC_LOAD_MODULE_RE.lastIndex = 0;

package/src/utils/response.tsx

@@ -1,6 +1,7 @@
 import type React from "react";
 import type { AppHead, HadarsRequest, HadarsEntryBase, HadarsEntryModule, HadarsProps, AppContext } from "../types/hadars";
 import { renderToString, createElement } from '../slim-react/index';
+import { processSegmentCache } from './segmentCache';
 
 interface ReactResponseOptions {
     document: {
@@ -55,10 +56,8 @@ export const getReactResponse = async (
     req: HadarsRequest,
     opts: ReactResponseOptions,
 ): Promise<{
-    App: React.FC<any>,
-    appProps: Record<string, unknown>,
+    bodyHtml: string,
     clientProps: Record<string, unknown>,
-    unsuspend: { cache: Map<string, any> },
     status: number,
     headHtml: string,
 }> => {
@@ -78,11 +77,12 @@ export const getReactResponse = async (
     // Create per-request cache for useServerData, active for all renders.
     const unsuspend = { cache: new Map<string, any>() };
     (globalThis as any).__hadarsUnsuspend = unsuspend;
+    let bodyHtml: string;
     try {
-        let html = await renderToString(createElement(App as any, props as any));
+        bodyHtml = await renderToString(createElement(App as any, props as any));
         if (getAfterRenderProps) {
-            props = await getAfterRenderProps(props, html);
-            await renderToString(
+            props = await getAfterRenderProps(props, bodyHtml);
+            bodyHtml = await renderToString(
                 createElement(App as any, { ...props, location: req.location, context } as any),
             );
         }
@@ -103,13 +103,9 @@ export const getReactResponse = async (
         ...(Object.keys(serverData).length > 0 ? { __serverData: serverData } : {}),
     };
 
-    const appProps = { ...props, location: req.location, context } as unknown as Record<string, unknown>;
-
     return {
-        App: App as React.FC<any>,
-        appProps,
+        bodyHtml: processSegmentCache(bodyHtml),
         clientProps: clientProps as Record<string, unknown>,
-        unsuspend,
         status: context.head.status,
         headHtml: getHeadHtml(context.head),
     };

package/src/utils/rspack.ts

@@ -59,6 +59,7 @@ const getConfigBase = (mode: "development" | "production", isServerBuild = false
                         // Runs before swc-loader (loaders execute right-to-left).
                         {
                             loader: loaderPath,
+                            options: { server: isServerBuild },
                         },
                         {
                             loader: 'builtin:swc-loader',
@@ -90,6 +91,7 @@ const getConfigBase = (mode: "development" | "production", isServerBuild = false
                     use: [
                         {
                             loader: loaderPath,
+                            options: { server: isServerBuild },
                         },
                         {
                             loader: 'builtin:swc-loader',