jskelet 0.5.5 → 0.6.1

package/docs/en/11-migration.md

@@ -8,6 +8,29 @@ modeled on the subset of Next that people actually use — concepts like the
 will feel familiar. The *reasons* behind the differences are in
 [02-architecture.md](./02-architecture.md).
 
+## `jskelet migrate` (codemod)
+
+Run the codemod against an App Router tree. Babel (`@babel/parser`,
+`@babel/types`) ships with JSkelet — no extra install.
+
+```bash
+npx jskelet migrate scan ../my-next-app
+npx jskelet migrate apply ../my-next-app --out . --write
+npx jskelet migrate config ../my-next-app --write
+```
+
+| Command | What it does |
+| --- | --- |
+| `migrate` / `migrate scan` | Inventory pages, layouts, `"use client"` modules, blockers (nested layouts, Server Actions, Suspense). |
+| `migrate apply` | **Automatic convert:** `page.*` → feature controller + `.jsk`; presentational components → `views/components/*.js`; clients → island `mount()` stubs. Default is dry-run; pass `--write`. Never overwrites (conflicts get a `.migrate` suffix). |
+| `migrate config` | Draft `jskelet.config.mjs` from `next.config` (`headers` / `redirects` / `rewrites`, `images.widths`, `NEXT_PUBLIC_*` → `clientEnv`). |
+
+Flags: `--out <dir>`, `--only pages,components,islands`, `--json`, `--strict` (exit 1 on partial/skipped).
+
+**Converted automatically:** `className`, `{{ }}` / `{{{ }}}`, `{#if}` / `{#each}`, `next/image` → `<Image />`, `next/link` → `<Link />`, `dangerouslySetInnerHTML`, `revalidate`, simple controller prelude (`await` data + `notFound()`).
+
+**Not converted (reported):** React hooks, Server Actions, nested layout flattening, Streaming/Suspense, client-side routing. Confidence per file is `ok` / `partial` / `skipped`.
+
 ## Equivalence table
 
 ### Configuration
@@ -31,8 +54,8 @@ will feel familiar. The *reasons* behind the differences are in
 | `app/page.js` (file-based routing) | `app.get(...)` inside `routes/*.mjs` | The order is written explicitly ([03](./03-routing.md)) |
 | `app/[slug]/page.js` | `app.get("/:slug", route(...))` | Express pattern syntax |
 | `params`, `searchParams` | `ctx.params`, `ctx.query` | The controller's single argument |
-| `layout.js` | `views/layout.ejs` + `hooks.layoutContext()` | A single layout; no nested layouts |
-| Server component (RSC) | Controller + EJS template + `views/components/**` | A function returns an HTML string |
+| `layout.js` | `views/layout.jsk` + `hooks.layoutContext()` | A single layout; no nested layouts |
+| Server component (RSC) | Controller + `.jsk` template + `views/components/**` | A function returns an HTML string |
 | Client component (`"use client"`) | Island (`data-island` + `mount`) | The whole page is not hydrated ([05](./05-islands.md)) |
 | `notFound()` | `notFound()` | Same name, same control flow |
 | `redirect()` | `redirect()` (307) | For permanent, `permanentRedirect()` (308) |
@@ -88,8 +111,11 @@ Account for these from the start in your migration plan:
 
 - **React itself.** Components turn into functions that return HTML strings. No
   JSX, no hooks, no virtual DOM.
-- **TypeScript.** The project is plain JS + JSDoc. With `checkJs: true` in
-  `jsconfig.json` you get type checking from the editor.
+- **TypeScript.** Framework source is plain JS + JSDoc and publishes `.d.ts` for
+  consumers. Client entries and islands may be `.ts` / `.mts` (esbuild strips
+  types; the manifest key stays `*.js`). Server routes, hooks and
+  `jskelet.config.mjs` remain Node ESM JavaScript — use `checkJs: true` in
+  `jsconfig.json` for editor checking there.
 - **Nested layouts.** There is a single layout; you share common sections with
   EJS `include` or component functions.
 - **Streaming / Suspense / partial prerendering.** The response is produced as a
@@ -172,12 +198,12 @@ export default function register(app, { route, notFound }) {
 }
 ```
 
-```ejs
-<%# views/pages/article.ejs %>
+```jsk
+{# views/pages/article.jsk #}
 <article class="wrapper">
-  <h1 class="text-3xl font-bold"><%= article.title %></h1>
-  <%- image({ src: article.cover, alt: article.title, priority: true, width: 1200, height: 630 }) %>
-  <div><%- article.body %></div>
+  <h1 class="text-3xl font-bold">{{ article.title }}</h1>
+  <Image :src="article.cover" :alt="article.title" priority :width="1200" :height="630" />
+  <div>{{{ article.body }}}</div>
 </article>
 ```
 
@@ -190,7 +216,8 @@ single upstream request is made ([06-caching.md](./06-caching.md)).
 ### 1. Set up the skeleton (half a day)
 
 Run `npx jskelet init` in a new directory and watch `jskelet dev` come up. Leave
-the existing Next project as it is; let the migration run in parallel.
+the existing Next project as it is; let the migration run in parallel. Optionally
+run `jskelet migrate scan <next-root>` first to list pages and blockers.
 
 Carry over the `paths` aliases from your `jsconfig.json` — prefixes like `@/`
 work the same way both on the server and in the bundle
@@ -198,6 +225,8 @@ work the same way both on the server and in the bundle
 
 ### 2. Translate `next.config.mjs` (1-2 hours)
 
+`jskelet migrate config <next-root> --write` drafts most of this. Then review:
+
 The `headers()`, `redirects()` and `rewrites()` sections are copied almost
 verbatim. Check the pattern syntax: JSkelet supports the `:slug`, `:path*`,
 `/a-:b` and `/:path*.svg` forms; more complex `path-to-regexp` expressions are
@@ -218,9 +247,9 @@ they are copied as-is. Make two changes:
 
 ### 4. Set up the layout (half a day)
 
-Translate `app/layout.jsx` into `views/layout.ejs`. Copying the framework's
-default layout (`node_modules/jskelet/src/templates/layout.ejs`) and editing it
-is the fastest path.
+Translate `app/layout.jsx` into `views/layout.jsk` (or let `migrate apply` draft
+it). Copying the framework's default layout (`jskelet/layout` → `.jsk`) and
+editing it is the fastest path.
 
 If you fetch data inside `layout.jsx` (navigation, site settings), move it into
 `hooks.layoutContext()`: it runs in parallel with the body render, and every
@@ -231,6 +260,10 @@ into `hooks.metadata()`.
 
 ### 5. Translate the components (the longest step)
 
+`jskelet migrate apply --only components --write` converts presentational
+components that are props + JSX with no hooks. Everything else you finish by
+hand:
+
 Every React component turns into a function:
 
 ```jsx
@@ -264,8 +297,9 @@ Keep components small and pure; leave data fetching in the controller.
 
 ### 6. Migrate the pages (hours per page)
 
-Every `page.jsx` splits into a controller plus an EJS template. File them with
-the order in mind:
+`jskelet migrate apply --only pages --write` splits each `page.*` into a
+feature controller plus a `.jsk` template. Review `partial` / `skipped` rows,
+then finish the TODO markers. File them with the order in mind:
 
 ```
 routes/
@@ -342,7 +376,8 @@ especially for verifying that the redirect rules are correct.
 ## Common mistakes during migration
 
 - **Forgetting `esc()`.** Writing `${value}` out of JSX habit means XSS. In
-  templates, mind the distinction between `<%= %>` (escaped) and `<%- %>` (raw).
+  `.jsk` templates use `{{ }}` (escaped) vs `{{{ }}}` (raw); in components call
+  `esc()` yourself.
 - **Opening a new directory without adding `@source`.** The classes are silently
   dropped.
 - **Putting the catch-all route in the wrong order.** `/:slug` always goes last.

package/docs/en/12-dashboards-and-sessions.md

@@ -145,7 +145,9 @@ export default {
     sharedCookieRoots: [".investvio.com", ".localhost"],
   },
   auth: {
-    crossSubdomainHandoff: true, // POST /_jskelet/auth/handoff
+    crossSubdomainHandoff: {
+      allowedCookieNames: ["sid"], // required allowlist
+    },
   },
 };
 ```
@@ -210,17 +212,20 @@ a **read-back** runs; if the browser rejected the Domain, `handoff: true`.
 
 With `auth.crossSubdomainHandoff` on:
 
-1. `POST /_jskelet/auth/handoff` `{ name, value, next }` → `{ url }` (with `?handoff=`)
+1. `POST /_jskelet/auth/handoff` `{ name, value, next }` → `{ url }` (with
+   `?handoff=`). Mint is mounted **after** the CSRF middleware; `name` must be
+   in `allowedCookieNames` and an RFC 6265 token.
 2. On the target host a GET middleware redeems the one-time ticket, sets the
    cookie (shared Domain first, else host-only), and 303-redirects without
    `handoff`
 
 `next` must be under the same `sharedCookieRoots`. Tickets live ~60s in process
-memory. Do not put a JWT in the URL.
+memory, with pending-ticket and per-IP mint limits. Do not put a JWT in the URL.
 
 The `window.name` bridge is the cookie-less fallback:
 `handoffViaWindowName` on the source page, `consumeWindowNameHandoff` on the
-target.
+target. Prefer the server handoff when possible — `window.name` remains readable
+across origins in the same tab.
 
 ## CSRF
 

package/docs/en/README.md

@@ -2,10 +2,12 @@
 
 JSkelet is a framework that "feels frameworkless", built for SEO- and
 speed-focused sites: it produces complete HTML on the server with Express 5 +
-EJS, adds interactivity with vanilla JS islands, compiles CSS into a single
-stylesheet with Tailwind v4, and instead of ISR uses an HTML TTL cache that
-lives in process memory with stale-while-revalidate. No React, no TypeScript;
-plain JavaScript and JSDoc.
+build-time `.jsk` (EJS is an optional legacy peer), adds interactivity with
+vanilla JS islands, compiles CSS into a single stylesheet with Tailwind v4, and
+instead of ISR uses an HTML TTL cache that lives in process memory with
+stale-while-revalidate. No React; the framework source is plain JavaScript with
+JSDoc. Apps may write client islands and entries in TypeScript, and the
+published package ships declaration files.
 
 This directory is the full reference for the framework. To read it in order,
 start from the beginning; if you are looking for a specific topic, go straight
@@ -22,7 +24,7 @@ change one, change the other.
 | [01-getting-started.md](./01-getting-started.md) | Installation, `jskelet init`, first route, first island, directory structure, CLI commands |
 | [02-architecture.md](./02-architecture.md) | Architectural decisions and their rationale: the island model, complete server HTML, cache strategy, middleware order |
 | [03-routing.md](./03-routing.md) | The route module contract, load order, the controller contract, `ctx`, `notFound`/`redirect`, config redirects/rewrites |
-| [04-rendering.md](./04-rendering.md) | EJS layout, pages, automatic component registration, `html`/`tags` helpers, metadata → `<head>`, hooks |
+| [04-rendering.md](./04-rendering.md) | `.jsk` layout/pages, automatic component registration, `html`/`tags`, metadata → `<head>`, hooks; EJS legacy |
 | [05-islands.md](./05-islands.md) | The `data-island` contract, hydration strategies, `client/entries/*`, `createStore`, DOM helpers, `startSafeImages` |
 | [06-caching.md](./06-caching.md) | `withHtmlCache`, `revalidate`, stale-while-revalidate, the cache key, `X-JSkelet-Cache`, in-request cache, degraded render, prewarm |
 | [07-configuration.md](./07-configuration.md) | Full `jskelet.config.mjs` reference, the `source` pattern syntax, environment variable table |
@@ -48,7 +50,7 @@ change one, change the other.
 
 ## Runnable examples
 
-All four are in working order; most of the examples in the docs were taken from
+All three are in working order; most of the examples in the docs were taken from
 them.
 
 **`examples/minimal/`** — two routes, one component, one island, minimal config.
@@ -70,34 +72,7 @@ npm --prefix examples/blog install
 npm --prefix examples/blog run dev
 ```
 
-**`examples/marketing/`** — the framework's own marketing site: hero, comparison
-table, live latency measurement, FAQ, docs index, release notes and a download
-page. The byte counts on the page are read in `lib/payload.js` from the site's
-**own** build output, and the release info in `lib/release.js` from the
-installed package's `package.json`; the latency numbers are measured in the
-browser by the `latency` island. With a long TTL (one hour) and a prewarm that
-warms every page, it shows the profile in which the cache works most
-efficiently.
-
-It also serves **these documents**: `/docs/<chapter>` reads the markdown files
-in `node_modules/jskelet/docs/` and renders them with a sidebar, an "on this
-page" list and sequential navigation. The renderer is a small module in
-`lib/markdown.js` — no dependency — and the source of truth stays the package,
-so the site never drifts from the installed version.
-
-The site is also **bilingual**: English by default at the root, Turkish under
-`/tr`, with the same route names in both languages. There is no i18n in the
-framework; language resolution lives in `lib/i18n.js` as the application's own
-contract and is wired to a dictionary via `hooks.layoutContext`. This is the
-place to look if you want to see how to build a multilingual site with this
-surface.
-
-```bash
-npm --prefix examples/marketing install
-npm --prefix examples/marketing run dev
-```
-
-**`examples/dashboard/`** — the opposite axis from the other three: per-visitor
+**`examples/dashboard/`** — the opposite axis from the other two: per-visitor
 pages. Sign-in with a signed cookie session, a `private: true` protected panel,
 a paginated table fragment, a CSRF-protected mutation form and an island that
 returns a cleanup function. It also has a public landing page, so a cached
@@ -108,5 +83,5 @@ npm --prefix examples/dashboard install
 npm --prefix examples/dashboard run dev
 ```
 
-In all four examples, `node smoke.mjs` verifies that the endpoints respond as
+In all three examples, `node smoke.mjs` verifies that the endpoints respond as
 expected while the server is up.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "jskelet",
-  "version": "0.5.5",
-  "description": "A framework that feels like no framework: Express 5 + build-time .jsk (or EJS) SSR, vanilla JS islands, Tailwind v4 and an in-process HTML TTL cache.",
+  "version": "0.6.1",
+  "description": "A framework that feels like no framework: Express 5 + build-time .jsk SSR (optional EJS peer), vanilla JS islands, Tailwind v4 and an in-process HTML TTL cache.",
   "type": "module",
   "license": "MIT",
   "author": "Ayberk Enis",
@@ -17,7 +17,7 @@
     "ssr",
     "islands",
     "express",
-    "ejs",
+    "jsk",
     "esbuild",
     "tailwind",
     "seo",
@@ -28,19 +28,42 @@
   },
   "main": "./src/index.js",
   "exports": {
-    ".": "./src/index.js",
-    "./server": "./src/index.js",
-    "./client": "./src/client/index.js",
-    "./html": "./src/views/helpers/html.js",
-    "./tags": "./src/views/helpers/tags.js",
-    "./cookies": "./src/http/cookies-entry.js",
-    "./log": "./src/log.mjs",
+    ".": {
+      "types": "./types/index.d.ts",
+      "default": "./src/index.js"
+    },
+    "./server": {
+      "types": "./types/index.d.ts",
+      "default": "./src/index.js"
+    },
+    "./client": {
+      "types": "./types/client/index.d.ts",
+      "default": "./src/client/index.js"
+    },
+    "./html": {
+      "types": "./types/views/helpers/html.d.ts",
+      "default": "./src/views/helpers/html.js"
+    },
+    "./tags": {
+      "types": "./types/views/helpers/tags.d.ts",
+      "default": "./src/views/helpers/tags.js"
+    },
+    "./cookies": {
+      "types": "./types/http/cookies-entry.d.ts",
+      "default": "./src/http/cookies-entry.js"
+    },
+    "./log": {
+      "types": "./types/log.d.mts",
+      "default": "./src/log.mjs"
+    },
     "./register": "./src/runtime/register.mjs",
-    "./layout": "./src/templates/layout.ejs"
+    "./layout": "./src/templates/layout.jsk",
+    "./layout/ejs": "./src/templates/layout.ejs"
   },
   "files": [
     "bin",
     "src",
+    "types",
     "docs",
     "README.md",
     "AGENTS.md",
@@ -53,12 +76,16 @@
   "scripts": {
     "lint": "eslint",
     "test": "node --test \"test/**/*.test.mjs\"",
+    "types": "tsc -p tsconfig.types.json",
+    "prepublishOnly": "npm run types",
+    "test:framework-layout": "node scripts/compile-framework-layout.mjs --check",
     "example:minimal": "npm --prefix examples/minimal run dev",
     "example:blog": "npm --prefix examples/blog run dev",
     "example:dashboard": "npm --prefix examples/dashboard run dev"
   },
   "dependencies": {
-    "ejs": "^6.0.1",
+    "@babel/parser": "^8.0.6",
+    "@babel/types": "^8.0.6",
     "esbuild": "^0.28.2",
     "express": "^5.2.1",
     "tailwind-merge": "^3.5.0"
@@ -66,6 +93,7 @@
   "peerDependencies": {
     "@phosphor-icons/core": "^2.1.1",
     "@tailwindcss/postcss": "^4.3.3",
+    "ejs": "^6.0.1",
     "ioredis": "^5.4.0 || ^6.0.0",
     "lightningcss": "^1.32.0",
     "postcss": "^8.5.26",
@@ -79,6 +107,9 @@
     "@tailwindcss/postcss": {
       "optional": true
     },
+    "ejs": {
+      "optional": true
+    },
     "ioredis": {
       "optional": true
     },
@@ -97,7 +128,11 @@
   },
   "devDependencies": {
     "@eslint/js": "^9",
+    "@types/express": "^5.0.6",
+    "@types/node": "^26.6.1",
+    "ejs": "^6.0.1",
     "eslint": "^9",
-    "globals": "^16"
+    "globals": "^16",
+    "typescript": "^7.0.2"
   }
 }

package/src/build/tasks/client.mjs

@@ -1,9 +1,11 @@
 /**
  * Island bundle'ı: esbuild, ESM, code splitting.
  *
- * `client/entries/*.js` içindeki her dosya bir entry'dir. `main.js` her sayfada
- * yüklenen ortak island bootstrap'ıdır; ek entry'ler yalnızca onları isteyen
- * sayfalarda (`controller` → `entries: ["chart.js"]`) yüklenir.
+ * `client/entries/*.{js,ts,mts}` içindeki her dosya bir entry'dir. `main.js`
+ * (veya `main.ts`) her sayfada yüklenen ortak island bootstrap'ıdır; ek
+ * entry'ler yalnızca onları isteyen sayfalarda
+ * (`controller` → `entries: ["chart.js"]`) yüklenir. Manifest anahtarı her
+ * zaman `*.js` kalır.
  *
  * Hedef tarayıcılar `package.json` → `browserslist` yerine burada sabit: ESM +
  * dinamik import + `IntersectionObserver` island modelinin zaten alt sınırı,
@@ -16,11 +18,17 @@ import * as esbuild from "esbuild";
 import { paths, patchManifest, pruneAssets } from "../paths.mjs";
 import * as log from "../../log.mjs";
 
+/** Client entry ve `@/` alias için kabul edilen kaynak uzantıları. `.tsx` yok. */
+const CLIENT_SOURCE_EXTS = [".js", ".ts", ".mts"];
+
 /**
  * `@/` alias'ını proje köküne çözer — Node tarafındaki `alias-hooks.mjs` ile
  * aynı davranış, böylece `lib/` altındaki modüller hem sunucuda hem
  * tarayıcıda aynı import stilini kullanabilir.
  *
+ * Not: sunucu runtime `.ts` çözmez; paylaşılan `@/lib` dosyaları `.js`
+ * kalmalıdır. `.ts` yalnızca esbuild client hattında anlamlıdır.
+ *
  * @param {string} root
  * @returns {esbuild.Plugin}
  */
@@ -35,6 +43,23 @@ function aliasPlugin(root) {
   };
 }
 
+/**
+ * Secret benzeri isimler public bundle'a gömülmemeli. `PUBLIC` / `PUBLISHABLE`
+ * içerenler (örn. Stripe publishable key) muaf; diğer `SECRET`, `PASSWORD`,
+ * `TOKEN`, `API_KEY`, `PRIVATE` vb. reddedilir.
+ */
+const SECRETISH_CLIENT_ENV =
+  /(?:^|_)(SECRET|PASSWORD|PASSWD|TOKEN|PRIVATE|CREDENTIAL|API[_-]?KEY)(?:_|$)|(?:^|_)(SECRET|PASSWORD|TOKEN|PRIVATE|KEY)$/i;
+
+/**
+ * @param {string} key
+ * @returns {boolean}
+ */
+export function isSecretLikeClientEnvKey(key) {
+  if (/PUBLIC|PUBLISHABLE/i.test(key)) return false;
+  return SECRETISH_CLIENT_ENV.test(key);
+}
+
 /**
  * Tarayıcıda `process` yoktur; sunucuyla paylaşılan modüller yine de
  * `process.env` okur. `clientEnv` ile bildirilen anahtarlar build zamanında
@@ -48,6 +73,14 @@ function aliasPlugin(root) {
  * @returns {Record<string, string>}
  */
 function publicEnv(keys) {
+  const secretish = keys.filter((key) => isSecretLikeClientEnvKey(key));
+  if (secretish.length) {
+    throw new Error(
+      `[build] clientEnv must not include secret-like keys: ${secretish.join(", ")}. ` +
+        "Only values safe to publish in the browser bundle belong here.",
+    );
+  }
+
   /** @type {Record<string, string>} */
   const env = { NODE_ENV: process.env.NODE_ENV ?? "production" };
   for (const key of keys) {
@@ -61,13 +94,16 @@ function publicEnv(keys) {
  * @param {string} base
  * @returns {string}
  */
-function resolveWithExtension(base) {
+export function resolveWithExtension(base) {
   const candidates = [
     base,
     `${base}.js`,
     `${base}.mjs`,
+    `${base}.ts`,
+    `${base}.mts`,
     `${base}.json`,
     path.join(base, "index.js"),
+    path.join(base, "index.ts"),
   ];
   for (const candidate of candidates) {
     if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) return candidate;
@@ -75,6 +111,53 @@ function resolveWithExtension(base) {
   return base;
 }
 
+/**
+ * Entry dosya adını manifest anahtarına çevirir (`main.ts` → `main.js`).
+ * Layout / `entries: ["chart.js"]` sözleşmesi hash'siz `.js` anahtarları bekler.
+ *
+ * @param {string} entryPath
+ * @returns {string}
+ */
+export function entryManifestName(entryPath) {
+  const base = path.basename(entryPath);
+  const ext = path.extname(base);
+  const stem = CLIENT_SOURCE_EXTS.includes(ext)
+    ? base.slice(0, -ext.length)
+    : path.basename(base, ".js");
+  return `${stem}.js`;
+}
+
+/**
+ * `client/entries/` altındaki kaynakları listeler. Aynı stem için birden fazla
+ * uzantı (`main.js` + `main.ts`) sessiz tercih yerine hata verir.
+ *
+ * @param {string} entryDir
+ * @returns {string[]}
+ */
+export function listClientEntries(entryDir) {
+  /** @type {Map<string, string>} */
+  const byStem = new Map();
+
+  for (const file of fs.readdirSync(entryDir)) {
+    const ext = path.extname(file);
+    if (!CLIENT_SOURCE_EXTS.includes(ext)) continue;
+
+    const stem = file.slice(0, -ext.length);
+    const previous = byStem.get(stem);
+    if (previous) {
+      throw new Error(
+        `[build] conflicting client entries for "${stem}": ${previous} and ${file}. ` +
+          "Keep a single extension per entry name.",
+      );
+    }
+    byStem.set(stem, file);
+  }
+
+  return [...byStem.values()]
+    .sort()
+    .map((file) => path.join(entryDir, file));
+}
+
 /**
  * @param {import('../../config/index.js').ResolvedConfig} config
  * @param {{ watch?: boolean }} [options]
@@ -89,10 +172,7 @@ export async function buildClient(config, { watch = false } = {}) {
     return {};
   }
 
-  const entryPoints = fs
-    .readdirSync(entryDir)
-    .filter((file) => file.endsWith(".js"))
-    .map((file) => path.join(entryDir, file));
+  const entryPoints = listClientEntries(entryDir);
 
   if (!entryPoints.length) {
     log.detail("no entries, skipped");
@@ -117,7 +197,8 @@ export async function buildClient(config, { watch = false } = {}) {
     format: "esm",
     target: ["chrome111", "edge111", "firefox111", "safari16.4"],
     minify: true,
-    sourcemap: true,
+    // Prod'da map dosyaları `public/assets` altında herkese açık kalırdı.
+    sourcemap: process.env.NODE_ENV === "development",
     metafile: true,
     entryNames: "[name].[hash]",
     chunkNames: "chunks/[name].[hash]",
@@ -256,7 +337,7 @@ function toManifest(metafile, config, entryRoot) {
   for (const [outputPath, output] of Object.entries(metafile.outputs)) {
     if (!output.entryPoint?.startsWith(entryRoot)) continue;
 
-    const name = `${path.basename(output.entryPoint, ".js")}.js`;
+    const name = entryManifestName(output.entryPoint);
     const absolute = path.resolve(config.root, outputPath);
     manifest[name] = `/${path
       .relative(config.dirs.public, absolute)

package/src/build/tasks/icons.mjs

@@ -24,12 +24,15 @@ import { createRequire } from "node:module";
 import { pruneAssets, writeAsset } from "../paths.mjs";
 import * as log from "../../log.mjs";
 
-const SCAN_EXTENSIONS = new Set([".ejs", ".jsk", ".js", ".mjs"]);
+const SCAN_EXTENSIONS = new Set([".ejs", ".jsk", ".js", ".mjs", ".ts", ".mts"]);
 
 /** `icon({ … })` çağrısının tamamı; `name:` ifadesi ayrıca çözümlenir. */
 const ICON_CALL = /icon\(\s*\{([^}]*)\}/g;
 const ICON_NAME_EXPR = /name:\s*([^,}]+)/;
 const ICON_WEIGHT = /weight:\s*["']([^"']+)["']/;
+/** `.jsk` / JSX tarzı `<Icon name="Moon" />` ve isteğe bağlı `weight="bold"`. */
+const ICON_TAG =
+  /<Icon\b[^>]*\bname=["']([A-Z][A-Za-z0-9]*)["'][^>]*(?:\bweight=["']([a-z]+)["'])?/gi;
 /** `data-icon="flag:fill"` ve JS nesnesindeki `"data-icon": "flag:fill"`. */
 const ICON_ATTR = /data-icon"?\s*[:=]\s*["']([a-z0-9-]+)(?::([a-z]+))?["']/g;
 
@@ -191,6 +194,13 @@ function scanUsedIcons(scanDirs) {
         for (const name of names) used.add(`${toKebab(name)}:${weight}`);
       }
 
+      for (const match of source.matchAll(ICON_TAG)) {
+        const weight = match[2] ?? "regular";
+        used.add(
+          `${toKebab(match[1])}:${WEIGHTS.has(weight) ? weight : "regular"}`,
+        );
+      }
+
       for (const match of source.matchAll(ICON_NAME_PROP)) {
         indirectNames.add(toKebab(match[1]));
       }

package/src/client/index.js

@@ -1,12 +1,12 @@
 /**
  * JSkelet island runtime'ının tarayıcı tarafı API'si.
  *
- * `client/entries/main.js` içinde:
+ * `client/entries/main.js` (veya `main.ts`) içinde:
  *
  *   import { registerAll, start } from "jskelet/client";
  *
  *   registerAll({
- *     counter: () => import("../islands/counter.js"),
+ *     counter: () => import("../islands/counter.ts"),
  *   });
  *
  *   start();

package/src/compile/codegen.js

@@ -21,6 +21,7 @@ export function codegen(ast, options) {
   return {
     code: ctx.finish(),
     includes: [...ctx.includes],
+    includeEntries: ctx.includeEntries,
     components: [...ctx.components],
   };
 }
@@ -58,6 +59,8 @@ class CodegenContext {
     this.knownComponents = options.knownComponents ?? null;
     /** @type {Set<string>} */
     this.includes = new Set();
+    /** @type {{ id: string, index: number }[]} */
+    this.includeEntries = [];
     /** @type {Set<string>} */
     this.components = new Set();
     /** @type {string[]} */
@@ -249,6 +252,7 @@ class CodegenContext {
   emitInclude(node) {
     const id = normalizeIncludeId(node.path);
     this.includes.add(id);
+    this.includeEntries.push({ id, index: node.index });
     const alias = includeAlias(id);
     this.append(`(${alias}(data, helpers) ?? "")`);
   }