swift-rust 1.5.0 → 1.8.0

package/bin/build.mjs

@@ -500,23 +500,29 @@ function simpleHash(s) {
   return (h >>> 0).toString(36);
 }
 async function localizeIslands(html) {
-  const re = /\/_swift-rust\/island\.js\?p=([^"]+)/g;
-  const found = new Set();
-  let m;
-  while ((m = re.exec(html)) !== null) found.add(m[1]);
-  if (found.size === 0) return html;
   let out = html;
-  for (const enc of found) {
-    let staticUrl = islandWritten.get(enc);
-    if (!staticUrl) {
-      const { status, body } = await fetchRoute(`/_swift-rust/island.js?p=${enc}`);
-      if (status !== 200) continue;
-      const rel = `_swift-rust/island/${simpleHash(enc)}.js`;
-      writeRawFile(STATIC_DIR, rel, body);
-      staticUrl = `/${rel}`;
-      islandWritten.set(enc, staticUrl);
+  // Page-level islands (/_swift-rust/island.js) and component-level islands
+  // (/_swift-rust/island-comp.js) both reference a dev-only bundle keyed by an
+  // encoded source path. For the static export we fetch each bundle once, write
+  // it as a real file, and rewrite the script src to point at it.
+  for (const endpoint of ["island.js", "island-comp.js"]) {
+    const re = new RegExp(`/_swift-rust/${endpoint.replace(".", "\\.")}\\?p=([^"]+)`, "g");
+    const found = new Set();
+    let m;
+    while ((m = re.exec(out)) !== null) found.add(m[1]);
+    for (const enc of found) {
+      const key = `${endpoint}:${enc}`;
+      let staticUrl = islandWritten.get(key);
+      if (!staticUrl) {
+        const { status, body } = await fetchRoute(`/_swift-rust/${endpoint}?p=${enc}`);
+        if (status !== 200) continue;
+        const rel = `_swift-rust/island/${simpleHash(key)}.js`;
+        writeRawFile(STATIC_DIR, rel, body);
+        staticUrl = `/${rel}`;
+        islandWritten.set(key, staticUrl);
+      }
+      out = out.split(`/_swift-rust/${endpoint}?p=${enc}`).join(staticUrl);
     }
-    out = out.split(`/_swift-rust/island.js?p=${enc}`).join(staticUrl);
   }
   return out;
 }

package/bin/dev-server.mjs

@@ -364,6 +364,192 @@ const externalizeDepsPlugin = {
   },
 };
 
+// ── Component-level "use client" islands ───────────────────────────────────
+// A `use client` *component* imported into a server-rendered page can't just be
+// SSR'd to static HTML — its useState/effects/handlers would never run. So when
+// the SSR bundle pulls in a client component, we wrap it: on the server it still
+// renders to HTML (good for SEO + no flash), but inside a marker element that
+// carries the component's source path, export name, and serialized props. A tiny
+// client runtime then hydrates each marker from a per-component browser bundle.
+//
+// Limitations (documented): props must be JSON-serializable; `children` and
+// function props don't cross the boundary, so islands should be self-contained
+// leaves (they manage their own children). Nested client components imported by
+// a client component are bundled into that island, not re-wrapped.
+
+const ISLAND_EXTS = [".tsx", ".ts", ".jsx", ".js", ".mjs"];
+
+// Resolve a relative / absolute / "@/"-aliased specifier to a real file path.
+function resolveIslandSpecifier(spec, importer) {
+  let base;
+  if (spec.startsWith("@/")) base = resolve(cwd, "src", spec.slice(2));
+  else if (spec.startsWith("/")) base = spec;
+  else if (spec.startsWith(".")) base = resolve(dirname(importer || cwd), spec);
+  else return null;
+  const candidates = [base, ...ISLAND_EXTS.map((e) => base + e), ...ISLAND_EXTS.map((e) => join(base, "index" + e))];
+  for (const c of candidates) {
+    try { if (statSync(c).isFile()) return c; } catch {}
+  }
+  return null;
+}
+
+// Extract export names from a module's source so we can re-export wrapped
+// versions. We only wrap Capitalized exports (React component convention) + the
+// default export; lowercase exports pass through untouched.
+function detectIslandExports(src) {
+  const named = new Set();
+  let hasDefault = false;
+  // strip block/line comments cheaply to avoid false matches
+  const code = src.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/[^\n]*/g, "$1");
+  if (/\bexport\s+default\b/.test(code)) hasDefault = true;
+  for (const m of code.matchAll(/\bexport\s+(?:async\s+)?(?:function|class|const|let|var)\s+([A-Za-z_$][\w$]*)/g)) {
+    named.add(m[1]);
+  }
+  for (const m of code.matchAll(/\bexport\s*\{([^}]*)\}/g)) {
+    for (const part of m[1].split(",")) {
+      const name = part.trim().split(/\s+as\s+/).pop()?.trim();
+      if (name && name !== "default") named.add(name);
+    }
+  }
+  return { hasDefault, named: [...named] };
+}
+
+// Temp sibling files holding verbatim copies of client components, so the
+// wrapper can import the *real* module under a distinct on-disk path (Bun
+// dedupes modules by resolved path, so a query-string alias would collapse the
+// real module into the wrapper). Cleaned up after each SSR build.
+const islandRawTemps = [];
+
+// Build the source of an island wrapper module for a given client component file.
+function islandWrapperSource(abs) {
+  const src = readFileSync(abs, "utf8");
+  const { hasDefault, named } = detectIslandExports(src);
+  // Write the real component to a unique sibling so imports resolve identically.
+  const rawName = `.__sr_raw_${process.pid}_${Math.random().toString(36).slice(2)}__${basename(abs)}`;
+  const rawPath = join(dirname(abs), rawName);
+  writeFileSync(rawPath, src);
+  islandRawTemps.push(rawPath);
+  const rawSpec = JSON.stringify("./" + rawName);
+  let out = `import { createElement as __h } from "react";
+import * as __real from ${rawSpec};
+const __src = ${JSON.stringify(abs)};
+function __ser(props){
+  var out = {};
+  for (var k in props){
+    if (k === "children") continue;
+    var v = props[k]; var t = typeof v;
+    if (v === null || t === "string" || t === "number" || t === "boolean" || (t === "object" && typeof v.$$typeof === "undefined")){
+      try { JSON.stringify(v); out[k] = v; } catch (e) {}
+    }
+  }
+  return JSON.stringify(out).replace(/</g, "\\\\u003c");
+}
+function __wrap(Comp, name){
+  if (typeof Comp !== "function") return Comp;
+  function SrIsland(props){
+    return __h("div", {
+      "data-sr-island": "",
+      "data-sr-island-src": __src,
+      "data-sr-island-export": name,
+      "data-sr-island-props": __ser(props),
+      style: { display: "contents" },
+    }, __h(Comp, props));
+  }
+  SrIsland.displayName = "Island(" + name + ")";
+  return SrIsland;
+}
+`;
+  if (hasDefault) out += `export default __wrap(__real.default, "default");\n`;
+  for (const n of named) {
+    if (/^[A-Z]/.test(n)) out += `export const ${n} = __wrap(__real[${JSON.stringify(n)}], ${JSON.stringify(n)});\n`;
+    else out += `export const ${n} = __real[${JSON.stringify(n)}];\n`;
+  }
+  return out;
+}
+
+// Bun plugin: wrap client components imported by *server* modules as islands.
+const clientIslandPlugin = {
+  name: "sr-client-islands",
+  setup(build) {
+    build.onResolve({ filter: /.*/ }, (args) => {
+      const p = args.path;
+      if (!(p.startsWith(".") || p.startsWith("/") || p.startsWith("@/"))) return undefined;
+      // Never wrap our own temp raw copies, and don't wrap when the importer is
+      // itself a client module — nested client components belong to that
+      // island's bundle, not a new boundary.
+      if (/\.__sr_raw_/.test(p)) return undefined;
+      if (args.importer && hasUseDirective(args.importer, "client")) return undefined;
+      const abs = resolveIslandSpecifier(p, args.importer);
+      if (!abs || !hasUseDirective(abs, "client")) return undefined;
+      return { path: abs, namespace: "sr-island" };
+    });
+    build.onLoad({ filter: /.*/, namespace: "sr-island" }, (args) => ({
+      contents: islandWrapperSource(args.path),
+      loader: "js",
+      resolveDir: dirname(args.path),
+    }));
+  },
+};
+
+// Cache for per-component browser island bundles (src -> { gen, code }).
+// Each bundle is self-mounting: it imports the client component, finds every
+// marker on the page for this source, and hydrates it. React is bundled in, so a
+// single <script type="module"> per source needs no import map or shared runtime.
+const componentIslandCache = new Map();
+async function buildComponentIslandBundle(srcFile) {
+  if (typeof Bun === "undefined" || typeof Bun.build !== "function") {
+    throw new Error("client islands require the Bun runtime");
+  }
+  const cached = componentIslandCache.get(srcFile);
+  if (cached && cached.gen === buildGeneration) return cached.code;
+
+  const entryPath = join(dirname(srcFile), `.__sr_cisland_${process.pid}_${Date.now()}.js`);
+  const entry = `import { hydrateRoot, createRoot } from "react-dom/client";
+import { createElement } from "react";
+import * as __mod from ${JSON.stringify(srcFile)};
+var __src = ${JSON.stringify(srcFile)};
+var nodes = document.querySelectorAll('[data-sr-island]');
+for (var i = 0; i < nodes.length; i++) {
+  var el = nodes[i];
+  if (el.getAttribute("data-sr-island-src") !== __src || el.__srHydrated) continue;
+  el.__srHydrated = true;
+  var name = el.getAttribute("data-sr-island-export") || "default";
+  var Comp = __mod[name] || __mod.default;
+  if (typeof Comp !== "function") { console.warn("[swift-rust] island export missing:", name, __src); continue; }
+  var props = {};
+  try { props = JSON.parse(el.getAttribute("data-sr-island-props") || "{}"); } catch (e) {}
+  var element = createElement(Comp, props);
+  try { hydrateRoot(el, element); }
+  catch (err) { el.innerHTML = ""; createRoot(el).render(element); }
+}
+`;
+  writeFileSync(entryPath, entry);
+  try {
+    const result = await Bun.build({
+      entrypoints: [entryPath],
+      target: "browser",
+      minify: true,
+      define: { "process.env.NODE_ENV": '"production"' },
+    });
+    if (!result.success) throw new Error(result.logs.map((l) => l.message).join("\n"));
+    const code = await result.outputs[0].text();
+    componentIslandCache.set(srcFile, { gen: buildGeneration, code });
+    return code;
+  } finally {
+    try { unlinkSync(entryPath); } catch {}
+  }
+}
+
+// Collect unique client-island source files referenced in rendered HTML.
+function collectIslandSources(html) {
+  const srcs = new Set();
+  if (!html) return srcs;
+  for (const m of html.matchAll(/data-sr-island-src="([^"]+)"/g)) {
+    srcs.add(m[1].replace(/&amp;/g, "&").replace(/&quot;/g, '"'));
+  }
+  return srcs;
+}
+
 const ssrBundleCache = new Map(); // file -> { gen, mod }
 
 async function loadModuleFresh(filePath) {
@@ -373,11 +559,18 @@ async function loadModuleFresh(filePath) {
   const cached = ssrBundleCache.get(filePath);
   if (cached && cached.gen === buildGeneration) return cached.mod;
 
-  const result = await Bun.build({
-    entrypoints: [filePath],
-    target: "bun",
-    plugins: [externalizeDepsPlugin],
-  });
+  islandRawTemps.length = 0;
+  let result;
+  try {
+    result = await Bun.build({
+      entrypoints: [filePath],
+      target: "bun",
+      plugins: [clientIslandPlugin, externalizeDepsPlugin],
+    });
+  } finally {
+    for (const t of islandRawTemps) { try { unlinkSync(t); } catch {} }
+    islandRawTemps.length = 0;
+  }
   if (!result.success) {
     throw new Error(result.logs.map((l) => l.message).join("\n"));
   }
@@ -771,6 +964,80 @@ export function isClientPage(file) {
   return false;
 }
 
+// True when a file's leading directive prologue contains `'use server'`.
+// (Component-level "use server" is NOT supported — swift-rust does classic SSR +
+// client islands, not React Server Components / Flight. The only legitimate home
+// for 'use server' is a route action.ts file, which is loaded by the router, not
+// imported into a page's render tree.)
+function hasServerDirective(file) {
+  try {
+    for (const raw of readFileSync(file, "utf8").split("\n")) {
+      const t = raw.trim();
+      if (!t || t.startsWith("//") || t.startsWith("/*") || t.startsWith("*")) continue;
+      if (/^["']use server["'];?$/.test(t)) return true;
+      if (/^["']use [a-z]+["'];?$/.test(t)) continue;
+      return false;
+    }
+  } catch {}
+  return false;
+}
+
+// Walk a page's transitive *relative* import graph looking for a module that
+// declares `'use server'`. Returns the offending file (or null). We only follow
+// ./ and ../ specifiers — that's where a developer's own components live, and it
+// keeps the scan cheap and free of node_modules false positives.
+const RELATIVE_EXTS = [".tsx", ".ts", ".jsx", ".js", ".mjs"];
+function findServerComponentInClientGraph(entryFile, seen = new Set()) {
+  const resolved = resolve(entryFile);
+  if (seen.has(resolved)) return null;
+  seen.add(resolved);
+  let src;
+  try {
+    src = readFileSync(resolved, "utf8");
+  } catch {
+    return null;
+  }
+  // The entry (the page) is allowed to be 'use client'; we only flag *imports*.
+  for (const m of src.matchAll(/\b(?:import|export)\b[^'"]*['"](\.[^'"]+)['"]/g)) {
+    const spec = m[1];
+    const base = resolve(dirname(resolved), spec);
+    let target = null;
+    const candidates = [base, ...RELATIVE_EXTS.map((e) => base + e), ...RELATIVE_EXTS.map((e) => join(base, "index" + e))];
+    for (const c of candidates) {
+      try {
+        if (statSync(c).isFile()) { target = c; break; }
+      } catch {}
+    }
+    if (!target) continue;
+    if (hasServerDirective(target)) return target;
+    const nested = findServerComponentInClientGraph(target, seen);
+    if (nested) return nested;
+  }
+  return null;
+}
+
+// Throw a clear, actionable error when a 'use client' page pulls a component
+// that declares 'use server'. Replaces the old silent no-op (the component used
+// to be imported but its directive ignored, so nothing ran and nothing warned).
+export function assertNoServerComponentInClientPage(pageFile) {
+  if (!isClientPage(pageFile)) return;
+  const offender = findServerComponentInClientGraph(pageFile);
+  if (offender) {
+    const rel = (f) => relative(cwd, f);
+    throw new Error(
+      `Unsupported: '${rel(offender)}' declares 'use server' but is imported into the ` +
+      `'use client' page '${rel(pageFile)}'.\n\n` +
+      `swift-rust uses classic SSR + client islands, not React Server Components, so a ` +
+      `'use server' component inside a client tree cannot run on the server — React forbids ` +
+      `importing a Server Component into a Client Component.\n\n` +
+      `Fix one of these:\n` +
+      `  • Remove the 'use server' directive — the component will render normally inside the client page.\n` +
+      `  • Move server-only work into a route loader (loader.ts) or action (action.ts) and pass the data down as props.\n` +
+      `  • Keep the page server-rendered (drop 'use client' on the page) and mark only the interactive leaf with 'use client'.`,
+    );
+  }
+}
+
 const VALID_RUNTIMES = new Set(["bun", "edge", "node", "worker"]);
 
 // Detect a `'use bun' | 'use edge' | 'use node'` directive among a file's
@@ -809,6 +1076,7 @@ async function buildIslandBundle(pageFile) {
   if (typeof Bun === "undefined" || typeof Bun.build !== "function") {
     throw new Error("client islands require the Bun runtime");
   }
+  assertNoServerComponentInClientPage(pageFile);
   const cached = islandBundleCache.get(pageFile);
   if (cached && cached.gen === buildGeneration) return cached.code;
 
@@ -1036,9 +1304,39 @@ async function readMergedConfig(chain, route) {
   // A route is "dynamic" (emitted as a request-time function) when it explicitly
   // opts into a runtime via a directive, config.ts/edge/worker, or config.dynamic.
   config.dynamic = Boolean(directive) || explicitRuntime || config.dynamic === true;
+
+  // `use static` (page directive) or config.static: a hard guarantee that the
+  // route is purely static — no request-time/dynamic behavior. We fail loudly on
+  // any conflict so the guarantee can't silently rot, then force the route static
+  // and tag it for aggressive caching. (The actual prerender happens in build;
+  // here we enforce + emit the cache contract.)
+  const wantsStatic =
+    (route?.file && hasUseDirective(route.file, "static")) ||
+    collectRouteFiles(chain, "config").some(({ file }) => hasUseDirective(file, "static")) ||
+    config.static === true;
+  if (wantsStatic) {
+    const reasons = [];
+    if (directive) reasons.push(`a 'use ${directive}' runtime directive (declares a request-time runtime)`);
+    else if (explicitRuntime) reasons.push("a runtime set by config.ts / edge.ts / worker.ts");
+    if (config.dynamic === true && !directive && !explicitRuntime) reasons.push("config.dynamic = true");
+    if (collectRouteFiles(chain, "action").length) reasons.push("an action.ts (mutations are dynamic)");
+    if (reasons.length) {
+      const rel = route?.file ? relative(cwd, route.file) : "(route)";
+      throw new Error(
+        `Route '${rel}' is marked 'use static' but is dynamic: it has ${reasons.join(", ")}.\n\n` +
+          `A 'use static' route is prerendered and CDN-cached, so it can't use request-time features. Fix one:\n` +
+          `  • Remove 'use static' if the route really needs to be dynamic.\n` +
+          `  • Drop the runtime directive / dynamic config / action.ts so the route can be fully static.\n` +
+          `  • For periodic refresh, keep 'use static' and add a revalidate.ts (ISR), which stays static + cached.`,
+      );
+    }
+    config.dynamic = false;
+    config.static = true;
+  }
   config.headers = {
     "x-swift-rust-runtime": runtime,
     ...(config.dynamic ? { "x-swift-rust-dynamic": "1" } : {}),
+    ...(config.static ? { "x-swift-rust-render": "static" } : {}),
     ...config.headers,
   };
   return config;
@@ -1416,6 +1714,11 @@ async function renderRoute(urlPath, req) {
     });
 
     const clientPage = isClientPage(route.file);
+    if (clientPage) {
+      // Loud failure (was a silent no-op): a 'use server' component imported into
+      // a 'use client' page can't run on the server in this SSR+islands model.
+      assertNoServerComponentInClientPage(route.file);
+    }
     let tree = React.createElement(Page, { params: paramsProxy });
     if (clientPage) {
       // Wrap in a hydration root so the client bundle can mount into it.
@@ -2156,6 +2459,26 @@ async function handleFetch(req) {
     return new Response("// island not found", { status: 404, headers: { "Content-Type": "application/javascript" } });
   }
 
+  // Per-component client-island bundle (self-mounting; hydrates its markers).
+  if (pathname === "/_swift-rust/island-comp.js") {
+    const p = url.searchParams.get("p");
+    if (p && existsSync(p)) {
+      try {
+        const code = await buildComponentIslandBundle(p);
+        return new Response(code, {
+          headers: { "Content-Type": "application/javascript; charset=utf-8", "Cache-Control": "no-cache" },
+        });
+      } catch (e) {
+        logError(e, `component island bundle failed for ${p}`);
+        return new Response(`/* island build error: ${String(e?.message || e).replace(/\*\//g, "* /")} */`, {
+          status: 500,
+          headers: { "Content-Type": "application/javascript; charset=utf-8" },
+        });
+      }
+    }
+    return new Response("// island not found", { status: 404, headers: { "Content-Type": "application/javascript" } });
+  }
+
   if (pathname.startsWith("/_swift-rust/")) {
     return new Response("Not found", { status: 404 });
   }
@@ -2364,6 +2687,12 @@ async function handleFetch(req) {
     const src = `/_swift-rust/island.js?p=${encodeURIComponent(renderResult.pageFile)}`;
     doc = doc.replace("</body>", `<script type="module" src="${src}"></script>\n</body>`);
   }
+  // Component-level "use client" islands: one self-mounting module per unique
+  // source referenced by a marker in the rendered HTML.
+  for (const islandSrc of collectIslandSources(doc)) {
+    const s = `/_swift-rust/island-comp.js?p=${encodeURIComponent(islandSrc)}`;
+    doc = doc.replace("</body>", `<script type="module" src="${s}"></script>\n</body>`);
+  }
   // pending.tsx → hidden overlay the client navigator reveals while a
   // navigation is in flight (see runtime/navigator.js).
   const pendingOverlay = await renderPendingOverlay(renderResult.segments);
@@ -2380,12 +2709,28 @@ async function handleFetch(req) {
     const json = JSON.stringify(transitionCfg).replace(/</g, "\\u003c");
     doc = doc.replace("</body>", `<script>window.__SR_TRANSITION__=${json}</script>\n</body>`);
   }
+  // `use static` guarantee: a static route must not perform request-time work.
+  // Setting cookies during render is the one dynamic signal we can catch at
+  // runtime — fail loudly rather than silently shipping a wrong cache header.
+  if (renderResult.config?.static && (renderResult.setCookies || []).length) {
+    const e = new Error(
+      "A 'use static' route set a cookie during render, which is a dynamic action. " +
+        "Remove 'use static' or stop setting cookies on this route.",
+    );
+    logError(e, "use static violation");
+    return new Response(errorOverlayHTML(e.message, e.stack || ""), {
+      status: 500,
+      headers: { "Content-Type": "text/html; charset=utf-8" },
+    });
+  }
   const headers = new Headers({ "Content-Type": "text/html; charset=utf-8" });
   for (const c of renderResult.setCookies || []) headers.append("Set-Cookie", c);
   // config.ts headers
   for (const [k, v] of Object.entries(renderResult.config?.headers || {})) headers.set(k, String(v));
-  // revalidate.ts → Cache-Control + cache tags
-  const cc = cacheControlFromPlan(renderResult.revalidatePlan);
+  // revalidate.ts → Cache-Control + cache tags. A 'use static' route with no
+  // explicit revalidate plan gets a long-lived, revalidatable CDN cache.
+  let cc = cacheControlFromPlan(renderResult.revalidatePlan);
+  if (!cc && renderResult.config?.static) cc = "public, max-age=0, s-maxage=31536000, stale-while-revalidate";
   if (cc) headers.set("Cache-Control", cc);
   const tags = renderResult.revalidatePlan?.tags || renderResult.revalidatePlan?.invalidate;
   if (Array.isArray(tags) && tags.length) headers.set("x-vercel-cache-tags", tags.join(","));

package/bin/runtime/hmr-client.js

@@ -45,9 +45,17 @@
     }, 1800);
   }
 
-  es.addEventListener("change", function (e) {
+  // The server sends *unnamed* SSE messages whose payload is an envelope:
+  //   data: {"event":"change","data":{"type":"reload",...}}
+  // An unnamed SSE message fires the browser's default "message" event — NOT a
+  // named "change" event. Listening only on addEventListener("change") meant the
+  // handler never fired, so the browser never reloaded and you had to refresh by
+  // hand. We listen on "message" (and "change", for forward-compat) and unwrap
+  // the envelope, tolerating both the enveloped and flat payload shapes.
+  function handlePayload(raw) {
     try {
-      var data = JSON.parse(e.data);
+      var msg = JSON.parse(raw);
+      var data = msg && msg.event && msg.data ? msg.data : msg;
       if (data.type === "reload") {
         showToast("↻ Reloading…");
         setTimeout(function () { location.reload(); }, 100);
@@ -64,7 +72,9 @@
     } catch (err) {
       console.error("[swift-rust] bad HMR payload", err);
     }
-  });
+  }
+  es.addEventListener("message", function (e) { handlePayload(e.data); });
+  es.addEventListener("change", function (e) { handlePayload(e.data); });
 
   es.addEventListener("open", function () {
     if (window.__sr_setStatus) window.__sr_setStatus(true);

package/bin/swift-rust.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { existsSync, realpathSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join, resolve } from "node:path";
 import { spawn } from "node:child_process";
@@ -55,6 +55,81 @@ if (cmd === "build") {
   process.exit(code);
 }
 
+if (cmd === "upgrade" || cmd === "update") {
+  const projectDir = process.cwd();
+  const args = process.argv.slice(3);
+
+  if (args.includes("--help") || args.includes("-h")) {
+    process.stdout.write(
+      `swift-rust upgrade — update swift-rust to the latest release.\n\n` +
+        `Usage:\n` +
+        `  swift-rust upgrade            update to the latest stable\n` +
+        `  swift-rust upgrade <tag>      update to a dist-tag (e.g. canary) or version (e.g. 1.6.0)\n` +
+        `  swift-rust upgrade --tag <t>  same, explicit flag\n\n` +
+        `Detects your package manager from the lockfile (bun/pnpm/npm/yarn).\n` +
+        `The @swift-rust/* packages (font, image, pdf, video, env) update transitively.\n`,
+    );
+    process.exit(0);
+  }
+
+  // Resolve the target tag/version: a bare arg, or --tag <t>, else "latest".
+  let target = "latest";
+  const tagIdx = args.indexOf("--tag");
+  if (tagIdx !== -1 && args[tagIdx + 1]) target = args[tagIdx + 1];
+  else {
+    const bare = args.find((a) => !a.startsWith("-"));
+    if (bare) target = bare;
+  }
+
+  // Detect the package manager from the lockfile in the project.
+  const pm =
+    existsSync(join(projectDir, "bun.lock")) || existsSync(join(projectDir, "bun.lockb"))
+      ? "bun"
+      : existsSync(join(projectDir, "pnpm-lock.yaml"))
+        ? "pnpm"
+        : existsSync(join(projectDir, "yarn.lock"))
+          ? "yarn"
+          : existsSync(join(projectDir, "package-lock.json"))
+            ? "npm"
+            : "bun";
+
+  const readInstalledVersion = () => {
+    try {
+      const pkgPath = join(projectDir, "node_modules", "swift-rust", "package.json");
+      if (existsSync(pkgPath)) {
+        return JSON.parse(readFileSync(pkgPath, "utf8")).version;
+      }
+    } catch {}
+    return null;
+  };
+
+  if (!existsSync(join(projectDir, "package.json"))) {
+    process.stderr.write("swift-rust upgrade: no package.json here — run this inside your project.\n");
+    process.exit(1);
+  }
+
+  const before = readInstalledVersion();
+  const spec = `swift-rust@${target}`;
+  const addArgs = pm === "npm" ? ["install", spec] : ["add", spec];
+  process.stdout.write(`↻ Upgrading ${spec} with ${pm}${before ? ` (current: ${before})` : ""}…\n`);
+
+  const child = spawn(pm, addArgs, { stdio: "inherit", cwd: projectDir, env: process.env });
+  const code = await new Promise((r) => {
+    child.on("exit", (c) => r(c ?? 1));
+    child.on("error", (e) => {
+      process.stderr.write(`swift-rust upgrade: failed to run ${pm} (${e.message}).\n`);
+      r(1);
+    });
+  });
+  if (code === 0) {
+    const after = readInstalledVersion();
+    if (after && before && after !== before) process.stdout.write(`✓ swift-rust ${before} → ${after}\n`);
+    else if (after) process.stdout.write(`✓ swift-rust on ${after}\n`);
+    else process.stdout.write(`✓ done — restart your dev server to pick up the new runtime.\n`);
+  }
+  process.exit(code);
+}
+
 function getBinaryName() {
   if (process.platform === "win32") return "swift-rust.exe";
   return "swift-rust";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "swift-rust",
-  "version": "1.5.0",
+  "version": "1.8.0",
   "description": "The full-stack React framework powered with Rust + Bun. TSX-first, Rust rendering, 10x faster than Next.js, single binary deploy.",
   "license": "MIT",
   "homepage": "https://swift-rust.dev",