tw-framework 1.0.6 → 1.0.7

package/dist/tw.mjs

@@ -3,7 +3,9 @@ globalThis.__TW_BUNDLE_DIR = new URL(".", import.meta.url).pathname;
 import { createRequire } from "node:module";
 const require = createRequire(import.meta.url);
 var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
   get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
 }) : x)(function(x) {
@@ -17,6 +19,15 @@ var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // ../../packages/shared/tw/hashing/md5.ts
 function bytesToWords(bytes) {
@@ -2555,6 +2566,97 @@ var init_config = __esm({
   }
 });
 
+// ../../packages/shared/tw/source-mask.ts
+function blank(s) {
+  return s.replace(/[^\n]/g, " ");
+}
+function maskSourceStringsAndComments(src) {
+  let out = "";
+  let i = 0;
+  const n = src.length;
+  while (i < n) {
+    const ch = src[i];
+    const next = src[i + 1];
+    if (ch === "/" && next === "/") {
+      let j = i;
+      while (j < n && src[j] !== "\n") j++;
+      out += blank(src.slice(i, j));
+      i = j;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      let j = i + 2;
+      while (j < n && !(src[j] === "*" && src[j + 1] === "/")) j++;
+      j = Math.min(j + 2, n);
+      out += blank(src.slice(i, j));
+      i = j;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      let j = i + 1;
+      while (j < n) {
+        const c = src[j];
+        if (c === "\\") {
+          j += 2;
+          continue;
+        }
+        if (c === ch) {
+          j++;
+          break;
+        }
+        j++;
+      }
+      out += blank(src.slice(i, j));
+      i = j;
+      continue;
+    }
+    out += ch;
+    i++;
+  }
+  return out;
+}
+function stripCommentsStringAware(src) {
+  let out = "";
+  let i = 0;
+  const n = src.length;
+  while (i < n) {
+    const c = src[i];
+    if (c === '"' || c === "'") {
+      const q = c;
+      out += c;
+      i++;
+      while (i < n && src[i] !== q) {
+        if (src[i] === "\\") {
+          out += src[i++];
+          if (i < n) out += src[i++];
+          continue;
+        }
+        out += src[i++];
+      }
+      out += src[i] ?? "";
+      i++;
+      continue;
+    }
+    if (c === "/" && src[i + 1] === "/") {
+      while (i < n && src[i] !== "\n") i++;
+      continue;
+    }
+    if (c === "/" && src[i + 1] === "*") {
+      const end = src.indexOf("*/", i + 2);
+      i = end === -1 ? n : end + 2;
+      out += " ";
+      continue;
+    }
+    out += c;
+    i++;
+  }
+  return out;
+}
+var init_source_mask = __esm({
+  "../../packages/shared/tw/source-mask.ts"() {
+  }
+});
+
 // ../../packages/shared/tw/cache.ts
 function parseCacheBody(body) {
   const meta = {};
@@ -2577,9 +2679,12 @@ function parseCacheBody(body) {
   return meta;
 }
 function extractCacheDirective(source) {
-  const m = /page\s*\{[^}]*?\bcache\s*\{([^}]*)\}/.exec(source);
+  const masked = maskSourceStringsAndComments(source);
+  const m = /page\s*\{[^}]*?\bcache\s*\{([^}]*)\}/.exec(masked);
   if (!m) return null;
-  return parseCacheBody(m[1]);
+  const bodyStart = m.index + m[0].length - m[1].length - 1;
+  const bodyEnd = bodyStart + m[1].length;
+  return parseCacheBody(source.slice(bodyStart, bodyEnd));
 }
 function cacheMetaIsUsable(meta) {
   if (!meta) return false;
@@ -2711,6 +2816,7 @@ function parseCacheProfilesSource(src) {
 var BUILTIN_CACHE_PROFILES;
 var init_cache = __esm({
   "../../packages/shared/tw/cache.ts"() {
+    init_source_mask();
     BUILTIN_CACHE_PROFILES = {
       seconds: { stale: 1, revalidate: 1, expire: 2 },
       minutes: { stale: 60, revalidate: 300, expire: 3600 },
@@ -6653,6 +6759,7 @@ __export(tw_exports, {
   maskPhone: () => maskPhone,
   maskSSN: () => maskSSN,
   maskSensitiveData: () => maskSensitiveData,
+  maskSourceStringsAndComments: () => maskSourceStringsAndComments,
   md5: () => md5,
   md5Async: () => md52,
   mergeConfig: () => mergeConfig,
@@ -6992,6 +7099,7 @@ __export(tw_exports, {
   shortHash: () => shortHash,
   signData: () => signData,
   statSync: () => statSync,
+  stripCommentsStringAware: () => stripCommentsStringAware,
   supportsColor: () => supportsColor,
   supportsFileSystem: () => supportsFileSystem,
   supportsWebSocket: () => supportsWebSocket,
@@ -7072,6 +7180,7 @@ var init_tw = __esm({
     init_utils();
     init_config();
     init_cache();
+    init_source_mask();
     init_constants();
     init_crypto();
     init_env();
@@ -9518,6 +9627,9 @@ function readEscape(source, start) {
   if (LINE_TERMINATORS.has(ch)) {
     return { value: "", end: start + 2 };
   }
+  if (ch === "{" || ch === "}") {
+    return { value: "\\" + ch, end: start + 2 };
+  }
   return { value: ch, end: start + 2 };
 }
 function validateString(str) {
@@ -12848,6 +12960,7 @@ function parsePageDirective(cursor, token) {
   if (valToken && (valToken.type === "STRING" || valToken.type === "NUMBER")) {
     cursor.advance();
     value = valToken.value;
+    if (valToken.type === "STRING") value = String(value).replace(/\\([{}"])/g, "$1");
     if (valToken.type === "NUMBER") value = parseFloat(valToken.value);
   } else if (cursor.match("EQUALS") || cursor.match("COLON")) {
     cursor.skipWhitespace();
@@ -12855,6 +12968,7 @@ function parsePageDirective(cursor, token) {
     if (vToken) {
       cursor.advance();
       value = vToken.value;
+      if (vToken.type === "STRING") value = String(value).replace(/\\([{}"])/g, "$1");
       if (vToken.type === "NUMBER") value = parseFloat(vToken.value);
       if (vToken.type === "BOOLEAN") value = vToken.value === "true";
     }
@@ -12878,7 +12992,7 @@ function parsePageDirective(cursor, token) {
     const nextToken = cursor.peek();
     if (nextToken && (nextToken.type === "STRING" || nextToken.type === "NUMBER" || nextToken.type === "IDENT" || nextToken.type === "KEYWORD")) {
       cursor.advance();
-      options[optName] = nextToken.value;
+      options[optName] = nextToken.type === "STRING" ? String(nextToken.value).replace(/\\([{}"])/g, "$1") : nextToken.value;
     } else if (cursor.match("EQUALS")) {
       cursor.skipWhitespace();
       const optVal = cursor.consumeValue();
@@ -13260,6 +13374,7 @@ function consumeStateValue(cursor) {
   if (!t2) return "";
   if (t2.type === "STRING" || t2.type === "NUMBER" || t2.type === "IDENT" || t2.type === "KEYWORD") {
     cursor.advance();
+    if (t2.type === "STRING") return String(t2.value).replace(/\\([{}"])/g, "$1");
     return t2.value;
   }
   if (t2.type === "LBRACKET" || t2.type === "LBRACE" || t2.type === "LBRACK") {
@@ -13272,7 +13387,7 @@ function consumeStateValue(cursor) {
       else if (tk.type === "RBRACKET" || tk.type === "RBRACE" || tk.type === "RBRACK") depth--;
       const after = cursor.peek(1);
       if (tk.type === "STRING") {
-        parts.push(`"${tk.value}"`);
+        parts.push(`"${String(tk.value).replace(/\\([{}"])/g, "$1")}"`);
       } else if (tk.type === "IDENT" && after && after.type === "COLON" && depth > 0) {
         parts.push(`"${tk.value}"`);
       } else {
@@ -21274,6 +21389,15 @@ function splitArgs2(str) {
 function findMatchingBrace3(str, start) {
   let depth = 1;
   for (let i = start + 1; i < str.length; i++) {
+    if (str[i] === '"' || str[i] === "'") {
+      const q = str[i];
+      i++;
+      while (i < str.length && str[i] !== q) {
+        if (str[i] === "\\") i++;
+        i++;
+      }
+      continue;
+    }
     if (str[i] === "{") depth++;
     else if (str[i] === "}") {
       depth--;
@@ -22826,7 +22950,7 @@ var init_types4 = __esm({
 var TW_VERSION, TW_GENERATOR_META;
 var init_version = __esm({
   "../../packages/compiler/tw/codegen/version.ts"() {
-    TW_VERSION = "1.0.6";
+    TW_VERSION = "1.0.7";
     TW_GENERATOR_META = `<meta name="generator" content="TW Framework ${TW_VERSION}">`;
   }
 });
@@ -23386,6 +23510,14 @@ function interpolate(template, vars) {
   let i = 0;
   while (i < template.length) {
     const ch = template[i];
+    if (ch === "\\") {
+      const nxt = template[i + 1];
+      if (nxt === "{" || nxt === "}") {
+        result += nxt;
+        i += 2;
+        continue;
+      }
+    }
     if (ch === "{" && template[i + 1] !== "{") {
       let depth = 1;
       let j = i + 1;
@@ -23874,7 +24006,8 @@ function validatePlainCss(src, filePath) {
 function compileDecl(decl) {
   const trimmed = decl.trim();
   if (!trimmed) return "";
-  if (trimmed.includes(":")) return trimmed.replace(/\s*:\s*/, ": ");
+  const cssForm = /^([-\w]+)\s*:\s*/.exec(trimmed);
+  if (cssForm) return trimmed.replace(/^([-\w]+)\s*:\s*/, "$1: ");
   const spaceIdx = trimmed.search(/[\s]/);
   if (spaceIdx === -1) {
     return TSS_SHORTHANDS2[trimmed] ?? trimmed;
@@ -23888,9 +24021,72 @@ function combineSelector(parent, child) {
   if (child.includes("&")) return child.replace(/&/g, parent);
   return `${parent} ${child}`;
 }
+function stripTssComments(src) {
+  let out = "";
+  let i = 0;
+  const n = src.length;
+  while (i < n) {
+    const c = src[i];
+    if (c === '"' || c === "'") {
+      const q = c;
+      out += c;
+      i++;
+      while (i < n && src[i] !== q) {
+        if (src[i] === "\\") {
+          out += src[i++];
+          if (i < n) out += src[i++];
+          continue;
+        }
+        out += src[i++];
+      }
+      out += src[i] ?? "";
+      i++;
+      continue;
+    }
+    if (c === "u" && /^url\s*\(/i.test(src.slice(i, i + 6))) {
+      let depth = 0;
+      let j = i;
+      for (; j < n; j++) {
+        if (src[j] === "(") depth++;
+        else if (src[j] === ")") {
+          depth--;
+          if (depth === 0) {
+            j++;
+            break;
+          }
+        }
+      }
+      out += src.slice(i, j);
+      i = j;
+      continue;
+    }
+    if (c === "/" && src[i + 1] === "/") {
+      while (i < n && src[i] !== "\n") i++;
+      continue;
+    }
+    if (c === "/" && src[i + 1] === "*") {
+      const end = src.indexOf("*/", i + 2);
+      i = end === -1 ? n : end + 2;
+      out += " ";
+      continue;
+    }
+    out += c;
+    i++;
+  }
+  return out;
+}
 function compileTSS(source) {
+  const __twOut = __twCompileTSSInner(source);
+  const leftover = __twOut.match(/\$[A-Za-z_][\w-]*/g);
+  if (leftover && !/\$\{/.test(__twOut)) {
+    const seen = Array.from(new Set(leftover));
+    console.warn("[tss] unsubstituted $var(s) in output: " + seen.join(", ") + " -- define them as state vars or fix the spelling");
+  }
+  return __twOut;
+}
+function __twCompileTSSInner(source) {
   if (!source || !source.trim()) return "";
-  let src = source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/.*$/gm, "");
+  let src = stripTssComments(source);
   const vars = {};
   src = src.replace(/\$([A-Za-z_][\w-]*)\s*:\s*([^;{}\n]+);?/g, (_m, name, val) => {
     vars[name] = String(val).trim();
@@ -24100,6 +24296,11 @@ function stripComments(src) {
       out += c;
       i++;
       while (i < n && src[i] !== q) {
+        if (src[i] === "\\") {
+          out += src[i++];
+          if (i < n) out += src[i++];
+          continue;
+        }
         out += src[i++];
       }
       out += src[i] ?? "";
@@ -24418,9 +24619,19 @@ function emit(items, parent, env, mixins, out) {
   out.push(...childCss);
 }
 function compileSCSS(source) {
+  const cleaned0 = stripComments(source);
+  const UNSUPPORTED = /@(import|mixin|include|extend|use|forward|function|each|if)\b/g;
+  const m = cleaned0.match(UNSUPPORTED);
+  if (m) {
+    const seen = Array.from(new Set(m.map((x) => x.trim())));
+    console.warn("[scss] unsupported at-rule(s) ignored: " + seen.join(", ") + " -- TW's SCSS subset supports nesting, $vars and & references only");
+  }
   const items = parseItems(stripComments(source));
   const out = [];
   emit(items, "", [/* @__PURE__ */ new Map()], /* @__PURE__ */ new Map(), out);
+  if (out.length === 0 && cleaned0.replace(/[\s;]/g, "").length > 0) {
+    console.warn("[scss] compileSCSS produced no output for a non-empty source -- check for unsupported syntax (TW uses `color: #fff` declarations, not `color #fff`)");
+  }
   return out.join("\n");
 }
 var init_scss = __esm({
@@ -24460,7 +24671,8 @@ function addScope(css, scopeId) {
   return css.replace(/([.#]?[\w-]+)\s*\{/g, `$1[data-tw-scope="${scopeId}"] {`);
 }
 function interpolate2(expr, vars) {
-  return expr.replace(/\{([^}]+)\}/g, (_, name) => {
+  const masked = expr.replace(/\\\{/g, "
O").replace(/\\\}/g, "
C");
+  const out = masked.replace(/\{([^}]+)\}/g, (_, name) => {
     const key = name.trim();
     if (/^[a-zA-Z_$][\w$]*$/.test(key)) {
       return vars[key] ?? "";
@@ -24468,6 +24680,7 @@ function interpolate2(expr, vars) {
     const val = evaluate(key, vars);
     return val === null ? "" : val;
   });
+  return out.replace(/\u0001O/g, "{").replace(/\u0001C/g, "}");
 }
 function isTruthy2(val) {
   return isTruthy(val);
@@ -24869,6 +25082,8 @@ function renderAttrs(el, ctx) {
     } else if (typeof attr.value === "string" && !attr.name.startsWith("data-tw-event") && /\{[^}]+\}/.test(attr.value) && Object.keys(ctx.stateVars).length > 0) {
       const val = interpolate2(attr.value, ctx.stateVars);
       parts.push(`${attr.name}="${escapeAttr2(sanitizeUrlAttr(attr.name, val))}"`);
+    } else if (typeof attr.value === "string" && /\\[{}]/.test(attr.value)) {
+      parts.push(`${attr.name}="${escapeAttr2(sanitizeUrlAttr(attr.name, String(attr.value).replace(/\\([{}])/g, "$1")))}"`);
     } else {
       parts.push(`${attr.name}="${escapeAttr2(sanitizeUrlAttr(attr.name, attr.value))}"`);
     }
@@ -24975,6 +25190,9 @@ function generateText(text, ctx) {
     }
     return escapeHTML(interpolate2(text.value, ctx.stateVars));
   }
+  if (text.value && /\\[{}]/.test(text.value)) {
+    return escapeHTML(text.value.replace(/\\([{}])/g, "$1"));
+  }
   return escapeHTML(text.value);
 }
 function registerComponentTemplate(name, program) {
@@ -26458,7 +26676,7 @@ function emitElement(gen, el, ctx) {
     attrStr = el.attrs.map((a) => {
       if (a.value === true) return a.name;
       const val = a.isInterpolated ? interpolate3(a.value, ctx.stateVars) : a.value;
-      return `${a.name}="${escapeAttr3(val)}"`;
+      return `${a.name}="${escapeAttr3(sanitizeUrlAttr2(a.name, val))}"`;
     }).join(" ");
   }
   if (el.styles && el.styles.length > 0) {
@@ -26574,14 +26792,25 @@ function getDirectiveValue2(program, key) {
 function escapeHTML2(str) {
   return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;");
 }
+function sanitizeUrlAttr2(name, value) {
+  const URL_ATTRS = /* @__PURE__ */ new Set(["href", "src", "action", "formaction", "xlink:href", "poster", "background"]);
+  if (!URL_ATTRS.has(name.toLowerCase())) return value;
+  const trimmed = String(value).trim().toLowerCase().replace(/[\s\0]/g, "");
+  if (trimmed.startsWith("javascript:") || trimmed.startsWith("data:text/html") || trimmed.startsWith("vbscript:")) {
+    return "#";
+  }
+  return value;
+}
 function escapeAttr3(str) {
   return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;");
 }
 function interpolate3(expr, vars) {
-  return expr.replace(/\{([^}]+)\}/g, (_, name) => {
+  const masked = expr.replace(/\\\{/g, "
O").replace(/\\\}/g, "
C");
+  const out = masked.replace(/\{([^}]+)\}/g, (_, name) => {
     const key = name.trim();
     return vars[key] ?? "";
   });
+  return out.replace(/\u0001O/g, "{").replace(/\u0001C/g, "}");
 }
 function isTruthy3(val) {
   if (!val) return false;
@@ -26785,6 +27014,15 @@ var init_streaming = __esm({
 });
 
 // ../../packages/compiler/tw/codegen/vdom-gen.ts
+function sanitizeUrlAttr3(name, value) {
+  const URL_ATTRS = /* @__PURE__ */ new Set(["href", "src", "action", "formaction", "xlink:href", "poster", "background"]);
+  if (!URL_ATTRS.has(name.toLowerCase())) return value;
+  const trimmed = String(value).trim().toLowerCase().replace(/[\s\0]/g, "");
+  if (trimmed.startsWith("javascript:") || trimmed.startsWith("data:text/html") || trimmed.startsWith("vbscript:")) {
+    return "#";
+  }
+  return value;
+}
 function generateVDOMCode(program, ctx) {
   const builder2 = new VDOMCodeBuilder(ctx);
   return builder2.generateModule(program);
@@ -26798,10 +27036,12 @@ function generateNodeVDOM(node, ctx) {
   return builder2.generateFromAST(node);
 }
 function interpolate4(expr, vars) {
-  return expr.replace(/\{([^}]+)\}/g, (_, name) => {
+  const masked = expr.replace(/\\\{/g, "
O").replace(/\\\}/g, "
C");
+  const out = masked.replace(/\{([^}]+)\}/g, (_, name) => {
     const key = name.trim();
     return vars[key] ?? "";
   });
+  return out.replace(/\u0001O/g, "{").replace(/\u0001C/g, "}");
 }
 function isTruthy4(val) {
   if (!val) return false;
@@ -26935,7 +27175,7 @@ var init_vdom_gen = __esm({
               const expr = this.interpolateToExpr(attr.value);
               attrs.push(`${JSON.stringify(attr.name)}: ${expr}`);
             } else {
-              attrs.push(`${JSON.stringify(attr.name)}: ${JSON.stringify(attr.value)}`);
+              attrs.push(`${JSON.stringify(attr.name)}: ${JSON.stringify(sanitizeUrlAttr3(attr.name, attr.value))}`);
             }
           }
         }
@@ -28952,7 +29192,7 @@ function generateVDOM(program, ctx) {
       return {
         t: el.tag,
         a: el.attrs.reduce((acc, a) => {
-          acc[a.name] = a.value;
+          acc[a.name] = sanitizeUrlAttr4(a.name, String(a.value));
           return acc;
         }, {}),
         c: el.children.map(toVNode)
@@ -28990,16 +29230,27 @@ function processDirectives(program, ctx) {
   }
 }
 function interpolate5(expr, vars) {
-  return expr.replace(/\{([^}]+)\}/g, (_, name) => {
+  const masked = expr.replace(/\\\{/g, "
O").replace(/\\\}/g, "
C");
+  const out = masked.replace(/\{([^}]+)\}/g, (_, name) => {
     const key = name.trim();
     return vars[key] ?? "";
   });
+  return out.replace(/\u0001O/g, "{").replace(/\u0001C/g, "}");
 }
 function isTruthy5(val) {
   if (!val) return false;
   const lower = val.toLowerCase().trim();
   return lower !== "false" && lower !== "0" && lower !== "" && lower !== "null" && lower !== "undefined";
 }
+function sanitizeUrlAttr4(name, value) {
+  const URL_ATTRS = /* @__PURE__ */ new Set(["href", "src", "action", "formaction", "xlink:href", "poster", "background"]);
+  if (!URL_ATTRS.has(name.toLowerCase())) return value;
+  const trimmed = String(value).trim().toLowerCase().replace(/[\s\0]/g, "");
+  if (trimmed.startsWith("javascript:") || trimmed.startsWith("data:text/html") || trimmed.startsWith("vbscript:")) {
+    return "#";
+  }
+  return value;
+}
 function generate(program, stateVars) {
   const startTime = performance.now();
   const ctx = createContext("ssr");
@@ -33080,7 +33331,12 @@ async function renderIslandContent(component, props, ctx) {
   return { html: result.html, css: result.css, js: result.js };
 }
 function countServerComponents(source) {
-  const matches = source.match(/@render\s+mode:\s*['"]server['"]/g);
+  let cleaned = source;
+  try {
+    cleaned = stripCommentsStringAware(source);
+  } catch {
+  }
+  const matches = cleaned.match(/@render\s+mode:\s*['"]server['"]/g);
   return matches ? matches.length : 0;
 }
 function determineHydrationStrategy(component, position) {
@@ -33118,6 +33374,7 @@ function parseClientDirective(source) {
 var componentRegistry2;
 var init_server_components = __esm({
   "../../packages/compiler/tw/server-components.ts"() {
+    init_tw();
     init_tw4();
     componentRegistry2 = /* @__PURE__ */ new Map();
   }
@@ -40041,385 +40298,6 @@ var init_tw4 = __esm({
   }
 });
 
-// ../../packages/shared/tw/node-import.ts
-var node_import_exports = {};
-__export(node_import_exports, {
-  twImportTs: () => twImportTs
-});
-import { join as join10 } from "node:path";
-import { tmpdir } from "node:os";
-import { pathToFileURL as pathToFileURL2 } from "node:url";
-async function twImportTs(tsPath) {
-  if (!globalThis.__TW_NODE) {
-    return import(tsPath);
-  }
-  const esbuildMain = globalThis.__TW_ESBUILD_MODULE;
-  const esbuild = await (esbuildMain ? import(esbuildMain) : import("esbuild"));
-  const safe = tsPath.replace(/[^a-zA-Z0-9]/g, "_").slice(-120);
-  const cachePath = join10(tmpdir(), "tw-" + safe + ".mjs");
-  await esbuild.build({
-    entryPoints: [tsPath],
-    bundle: true,
-    format: "esm",
-    platform: "node",
-    target: "node18",
-    outfile: cachePath,
-    logLevel: "silent"
-  });
-  return import(pathToFileURL2(cachePath).href);
-}
-var init_node_import = __esm({
-  "../../packages/shared/tw/node-import.ts"() {
-  }
-});
-
-// tw/commands/client-bundle.ts
-var client_bundle_exports = {};
-__export(client_bundle_exports, {
-  BUILTIN_CLIENT_OK_SPECIFIERS: () => BUILTIN_CLIENT_OK_SPECIFIERS,
-  RUNTIME_CLIENT_OK_SPECIFIERS: () => RUNTIME_CLIENT_OK_SPECIFIERS,
-  buildClientChunk: () => buildClientChunk,
-  buildPageScope: () => buildPageScope,
-  collectClientImportsFromSource: () => collectClientImportsFromSource,
-  findServerOnlyViolations: () => findServerOnlyViolations,
-  importNames: () => importNames,
-  isClientImportSpecifier: () => isClientImportSpecifier
-});
-import { join as join11, resolve as resolve3 } from "node:path";
-import { existsSync as existsSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, unlinkSync as unlinkSync2 } from "node:fs";
-import { spawnSync as spawnSync2 } from "node:child_process";
-function isClientImportSpecifier(spec) {
-  if (spec.startsWith("@./") || spec.startsWith("./") || spec.startsWith("../")) return false;
-  if (/\.(tw|tss|twm|ts|js)$/.test(spec)) return false;
-  if (spec.startsWith("@tw/")) {
-    return RUNTIME_CLIENT_OK_SPECIFIERS.includes(spec);
-  }
-  return true;
-}
-function collectClientImportsFromSource(src) {
-  const lines = [];
-  let m;
-  IMPORT_RE.lastIndex = 0;
-  while (m = IMPORT_RE.exec(src)) {
-    if (isClientImportSpecifier(m[2])) lines.push(m[0].trim().replace(/;$/, ""));
-  }
-  return lines;
-}
-function importNames(line) {
-  const clause = line.match(/^import\s+([\s\S]+?)\s+from/);
-  if (!clause) return [];
-  const c = clause[1].trim();
-  const names = [];
-  if (c.startsWith("*")) {
-    const as = c.split(/\s+as\s+/);
-    if (as[1]) names.push(as[1].trim());
-  } else if (c.startsWith("{")) {
-    const braces = c.match(/\{([\s\S]*)\}/);
-    if (braces) {
-      for (const part of braces[1].split(",")) {
-        const p = part.trim();
-        if (!p) continue;
-        const seg = p.split(/\s+as\s+/);
-        names.push(seg[seg.length - 1].trim());
-      }
-    }
-  } else {
-    const def = c.match(/^[A-Za-z_$][\w$]*/);
-    if (def) names.push(def[0]);
-  }
-  return names;
-}
-function findEsbuildBin(rootDir) {
-  const candidates = [
-    join11(rootDir, "node_modules", ".bin", "esbuild"),
-    resolve3(rootDir, "..", "node_modules", ".bin", "esbuild"),
-    // CLI repo layout (dev / source runs)
-    resolve3(new URL(".", import.meta.url).pathname, "..", "..", "..", "..", "node_modules", ".bin", "esbuild")
-  ];
-  for (const c of candidates) {
-    try {
-      if (existsSync7(c)) return c;
-    } catch {
-    }
-  }
-  const bd = globalThis.__TW_BUNDLE_DIR;
-  if (bd) {
-    const b = resolve3(bd, "..", "..", "..", "node_modules", ".bin", "esbuild");
-    try {
-      if (existsSync7(b)) return b;
-    } catch {
-    }
-  }
-  return "esbuild";
-}
-function findServerOnlyViolations(src) {
-  const out = [];
-  let m;
-  IMPORT_RE.lastIndex = 0;
-  while (m = IMPORT_RE.exec(src)) {
-    const spec = m[2];
-    if (spec === "lib" || spec.startsWith("lib/")) {
-      out.push(spec);
-      continue;
-    }
-    if (isClientImportSpecifier(spec)) continue;
-    if (spec.startsWith("@tw/")) {
-      if (BUILTIN_CLIENT_OK_SPECIFIERS.includes(spec)) continue;
-      if (RUNTIME_CLIENT_OK_SPECIFIERS.includes(spec)) continue;
-      out.push(spec);
-      continue;
-    }
-    if (spec.startsWith("@./") || spec.startsWith("./") || spec.startsWith("../")) {
-      if (/\.(tw|tss)$/.test(spec)) continue;
-      out.push(spec);
-      continue;
-    }
-    if (spec.startsWith("lib/")) out.push(spec);
-  }
-  return out;
-}
-function contentHash2(s) {
-  let h = 5381;
-  for (let i = 0; i < s.length; i++) h = (h * 33 ^ s.charCodeAt(i)) >>> 0;
-  return h.toString(36);
-}
-function vendoredRuntimeClient() {
-  const fromSrc = new URL("../../dist/tw-runtime-client.mjs", import.meta.url).pathname;
-  if (existsSync7(fromSrc)) return fromSrc;
-  const fromBundle = new URL("./tw-runtime-client.mjs", import.meta.url).pathname;
-  if (existsSync7(fromBundle)) return fromBundle;
-  return null;
-}
-function rewriteRuntimeSpecifier(importLine) {
-  const vendored = vendoredRuntimeClient();
-  if (!vendored) return importLine;
-  const m = importLine.match(/from\s+["'](@tw\/runtime)["']/);
-  if (!m) return importLine;
-  return importLine.replace(m[0], `from ${JSON.stringify(vendored)}`);
-}
-function buildClientChunk(rootDir, importLine, minify) {
-  if (!importLine) return "";
-  const cached = chunkCache.get(importLine);
-  if (cached && existsSync7(join11(rootDir, ".tw", cached))) return cached;
-  const jsDir = join11(rootDir, ".tw", "js");
-  mkdirSync4(jsDir, { recursive: true });
-  const names = importNames(importLine);
-  const entryLine = rewriteRuntimeSpecifier(importLine);
-  const entry = [
-    entryLine + ";",
-    "globalThis.__twClient = globalThis.__twClient || {};",
-    ...names.map((n) => "globalThis.__twClient." + n + " = " + n + ";")
-  ].join("\n");
-  const stamp = contentHash2(importLine);
-  const entryPath = join11(rootDir, ".tw", ".chunk-entry-" + stamp + ".js");
-  const tmpOut = join11(rootDir, ".tw", ".chunk-tmp-" + stamp + ".js");
-  writeFileSync4(entryPath, entry);
-  const bin = findEsbuildBin(rootDir);
-  const args = [entryPath, "--bundle", "--format=iife", "--target=es2019", "--outfile=" + tmpOut];
-  if (minify) args.push("--minify");
-  const r = spawnSync2(bin, args, { cwd: rootDir });
-  try {
-    unlinkSync2(entryPath);
-  } catch {
-  }
-  if (r.status !== 0) {
-    const errText = (r.stderr && r.stderr.toString ? r.stderr.toString() : "") || String(r.error || "unknown");
-    console.error("  [tw] client chunk failed (" + importLine + "): " + errText.split("\n")[0]);
-    try {
-      unlinkSync2(tmpOut);
-    } catch {
-    }
-    return "";
-  }
-  const code = readFileSync6(tmpOut, "utf-8");
-  const url = "js/c-" + contentHash2(code) + ".js";
-  writeFileSync4(join11(rootDir, ".tw", url), code);
-  try {
-    unlinkSync2(tmpOut);
-  } catch {
-  }
-  chunkCache.set(importLine, url);
-  return url;
-}
-function buildPageScope(rootDir, ownImportLines) {
-  if (!ownImportLines || ownImportLines.length === 0) return "";
-  const names = ownImportLines.flatMap((l) => importNames(l));
-  if (names.length === 0) return "";
-  mkdirSync4(join11(rootDir, ".tw", "js"), { recursive: true });
-  const body = names.map((n) => "p." + n + " = g.__twClient." + n + ";").join("\n");
-  const code = "(function(g){g.__twClient=g.__twClient||{};var p={};\n" + body + "\ng.__twClient.$page=p;})(globalThis);\n";
-  const url = "js/p-" + contentHash2(names.slice().sort().join("|")) + ".js";
-  writeFileSync4(join11(rootDir, ".tw", url), code);
-  return url;
-}
-var IMPORT_RE, BUILTIN_CLIENT_OK_SPECIFIERS, RUNTIME_CLIENT_OK_SPECIFIERS, chunkCache;
-var init_client_bundle = __esm({
-  "tw/commands/client-bundle.ts"() {
-    IMPORT_RE = /^[ \t]*import\s+([^\n]+?)\s+from\s+["'']([^"'']+)["''][; \t]*$/gm;
-    BUILTIN_CLIENT_OK_SPECIFIERS = ["@tw/optImage", "@tw/RouterLink"];
-    RUNTIME_CLIENT_OK_SPECIFIERS = ["@tw/runtime"];
-    chunkCache = /* @__PURE__ */ new Map();
-  }
-});
-
-// ../../packages/server/tw/routing/revalidate.ts
-function setActivePipeline(p) {
-  activePipeline = p;
-}
-function getActivePipeline() {
-  return activePipeline;
-}
-function revalidatePath(pathname, opts) {
-  return activePipeline ? activePipeline.revalidatePath(pathname, opts) : 0;
-}
-function registerTwmTagInvalidator(fn) {
-  twmTagInvalidator = fn;
-}
-function revalidateTag(tag) {
-  let dropped = 0;
-  if (activePipeline) dropped += activePipeline.revalidateTag(tag);
-  if (twmTagInvalidator) dropped += twmTagInvalidator(tag);
-  return dropped;
-}
-var activePipeline, twmTagInvalidator;
-var init_revalidate = __esm({
-  "../../packages/server/tw/routing/revalidate.ts"() {
-    activePipeline = null;
-    twmTagInvalidator = null;
-  }
-});
-
-// ../../packages/server/tw/routing/signal-stream.ts
-function getSignalHub() {
-  if (!hub) hub = new SignalHub();
-  return hub;
-}
-function setSignal(name, value, opts) {
-  let session = opts?.session;
-  if (!session && opts?.request) {
-    try {
-      const cookies = opts.request.cookies;
-      if (cookies && typeof cookies.get === "function") {
-        session = cookies.get("tw_session") ?? void 0;
-      } else {
-        const header = opts.request.headers?.get?.("cookie") ?? "";
-        const m = /(?:^|;\s*)tw_session=([^;]+)/.exec(header);
-        if (m) session = decodeURIComponent(m[1].trim().replace(/^"|"$/g, ""));
-      }
-    } catch {
-    }
-  }
-  return getSignalHub().setSignal(name, value, session ? { session } : void 0);
-}
-var BATCH_MS, HISTORY_LIMIT, SignalHub, hub;
-var init_signal_stream = __esm({
-  "../../packages/server/tw/routing/signal-stream.ts"() {
-    BATCH_MS = 100;
-    HISTORY_LIMIT = 1e3;
-    SignalHub = class {
-      clients = /* @__PURE__ */ new Map();
-      nextClientId = 1;
-      seq = 0;
-      values = /* @__PURE__ */ new Map();
-      kinds = /* @__PURE__ */ new Map();
-      history = [];
-      pending = /* @__PURE__ */ new Map();
-      pendingSession;
-      timer = null;
-      /**
-       * Server-side mutation (route handlers): queue an update, batch-flush.
-       * With `session` (derived from the request's tw_session cookie) private
-       * signals are delivered only to clients authenticated as that session.
-       */
-      setSignal(name, value, opts) {
-        const kind = this.kinds.get(name) ?? "public";
-        this.values.set(name, value);
-        this.kinds.set(name, kind);
-        this.pending.set(name, value);
-        if (opts?.session) this.pendingSession = opts.session;
-        if (this.timer == null) {
-          this.timer = setTimeout(() => this.flush(), BATCH_MS);
-        }
-        return { queued: true, kind };
-      }
-      /** Latest known values (also used for fresh snapshots). */
-      snapshot() {
-        return { seq: this.seq, snapshot: Object.fromEntries(this.values) };
-      }
-      register(declared, session) {
-        const id = this.nextClientId++;
-        for (const [name, kind] of declared) {
-          if (!this.kinds.has(name)) this.kinds.set(name, kind);
-        }
-        const client = {
-          id,
-          declared,
-          session,
-          send: () => {
-          },
-          close: () => this.clients.delete(id)
-        };
-        this.clients.set(id, client);
-        return client;
-      }
-      /** Build the replay/snapshot preamble for a connecting client. */
-      connectPayloads(since, declared, session) {
-        const out = [];
-        const hasCoverage = since <= this.seq && this.history.length > 0 && since >= this.history[0].seq - 1;
-        if (hasCoverage) {
-          for (const entry of this.history) {
-            if (entry.seq > since && this.sessionMatches(session, entry) && this.deliversTo(declared, entry.names)) {
-              out.push(entry.payload);
-            }
-          }
-        } else if (this.values.size > 0) {
-          const snap = {};
-          for (const [name, value] of this.values) {
-            if (this.sessionMatches(session, { names: [name], session: this.valueSessions.get(name) }) && this.deliversTo(declared, [name])) snap[name] = value;
-          }
-          if (Object.keys(snap).length > 0) {
-            out.push(this.frame({ v: 1, seq: this.seq, snapshot: snap }));
-          }
-        }
-        return out;
-      }
-      /** latest-known session per signal (for snapshot filtering) */
-      valueSessions = /* @__PURE__ */ new Map();
-      sessionMatches(clientSession, entry) {
-        if (!entry.session) return true;
-        return entry.session === clientSession;
-      }
-      deliversTo(declared, names) {
-        return names.some((n) => {
-          const kind = this.kinds.get(n) ?? "public";
-          return kind === "public" || declared.has(n);
-        });
-      }
-      flush() {
-        this.timer = null;
-        if (this.pending.size === 0) return;
-        const updates = [...this.pending.entries()];
-        const session = this.pendingSession;
-        this.pending.clear();
-        this.pendingSession = void 0;
-        this.seq++;
-        const names = updates.map(([n]) => n);
-        for (const [n] of updates) this.valueSessions.set(n, session);
-        const payload = this.frame({ v: 1, seq: this.seq, updates });
-        this.history.push({ seq: this.seq, payload, names, session });
-        if (this.history.length > HISTORY_LIMIT) this.history.shift();
-        for (const client of this.clients.values()) {
-          if (this.sessionMatches(client.session, { names, session }) && this.deliversTo(client.declared, names)) client.send(payload);
-        }
-      }
-      frame(obj) {
-        return JSON.stringify(obj).replace(/</g, "\\u003c");
-      }
-    };
-    hub = null;
-  }
-});
-
 // ../../packages/server/tw/routing/twm-rules.ts
 var twm_rules_exports = {};
 __export(twm_rules_exports, {
@@ -40538,16 +40416,30 @@ function verifyJwt_hs256(token, secret) {
   return true;
 }
 function matchPath(pattern, pathname) {
-  if (pattern === "/**" || pattern === "/*") return true;
-  if (pattern.endsWith("/**")) {
-    const prefix = pattern.slice(0, -3);
-    return pathname === prefix || pathname.startsWith(prefix + "/");
+  const norm = (p) => {
+    let x = p;
+    try {
+      x = decodeURIComponent(x);
+    } catch {
+    }
+    if (x.length > 1 && x.endsWith("/")) x = x.slice(0, -1);
+    return x;
+  };
+  const pat = norm(pattern);
+  const path = norm(pathname);
+  if (pat === "/**") return true;
+  if (pat === "/*") return path === "" || path === "/";
+  if (pat.endsWith("/**")) {
+    const prefix = pat.slice(0, -3);
+    return path === prefix || path.startsWith(prefix + "/");
   }
-  if (pattern.endsWith("/*")) {
-    const prefix = pattern.slice(0, -2);
-    return pathname === prefix || pathname.startsWith(prefix + "/");
+  if (pat.endsWith("/*")) {
+    const prefix = pat.slice(0, -2);
+    if (!path.startsWith(prefix + "/")) return path === prefix;
+    const rest = path.slice(prefix.length + 1);
+    return !rest.includes("/");
   }
-  return pathname === pattern;
+  return path === pat;
 }
 function ruleBlocked(rule, request, pathname) {
   const headers = request.headers;
@@ -40870,6 +40762,385 @@ var init_twm_rules = __esm({
   }
 });
 
+// ../../packages/shared/tw/node-import.ts
+var node_import_exports = {};
+__export(node_import_exports, {
+  twImportTs: () => twImportTs
+});
+import { join as join10 } from "node:path";
+import { tmpdir } from "node:os";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
+async function twImportTs(tsPath) {
+  if (!globalThis.__TW_NODE) {
+    return import(tsPath);
+  }
+  const esbuildMain = globalThis.__TW_ESBUILD_MODULE;
+  const esbuild = await (esbuildMain ? import(esbuildMain) : import("esbuild"));
+  const safe = tsPath.replace(/[^a-zA-Z0-9]/g, "_").slice(-120);
+  const cachePath = join10(tmpdir(), "tw-" + safe + ".mjs");
+  await esbuild.build({
+    entryPoints: [tsPath],
+    bundle: true,
+    format: "esm",
+    platform: "node",
+    target: "node18",
+    outfile: cachePath,
+    logLevel: "silent"
+  });
+  return import(pathToFileURL2(cachePath).href);
+}
+var init_node_import = __esm({
+  "../../packages/shared/tw/node-import.ts"() {
+  }
+});
+
+// tw/commands/client-bundle.ts
+var client_bundle_exports = {};
+__export(client_bundle_exports, {
+  BUILTIN_CLIENT_OK_SPECIFIERS: () => BUILTIN_CLIENT_OK_SPECIFIERS,
+  RUNTIME_CLIENT_OK_SPECIFIERS: () => RUNTIME_CLIENT_OK_SPECIFIERS,
+  buildClientChunk: () => buildClientChunk,
+  buildPageScope: () => buildPageScope,
+  collectClientImportsFromSource: () => collectClientImportsFromSource,
+  findServerOnlyViolations: () => findServerOnlyViolations,
+  importNames: () => importNames,
+  isClientImportSpecifier: () => isClientImportSpecifier
+});
+import { join as join11, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, unlinkSync as unlinkSync2 } from "node:fs";
+import { spawnSync as spawnSync2 } from "node:child_process";
+function isClientImportSpecifier(spec) {
+  if (spec.startsWith("@./") || spec.startsWith("./") || spec.startsWith("../")) return false;
+  if (/\.(tw|tss|twm|ts|js)$/.test(spec)) return false;
+  if (spec.startsWith("@tw/")) {
+    return RUNTIME_CLIENT_OK_SPECIFIERS.includes(spec);
+  }
+  return true;
+}
+function collectClientImportsFromSource(src) {
+  const lines = [];
+  let m;
+  IMPORT_RE.lastIndex = 0;
+  while (m = IMPORT_RE.exec(src)) {
+    if (isClientImportSpecifier(m[2])) lines.push(m[0].trim().replace(/;$/, ""));
+  }
+  return lines;
+}
+function importNames(line) {
+  const clause = line.match(/^import\s+([\s\S]+?)\s+from/);
+  if (!clause) return [];
+  const c = clause[1].trim();
+  const names = [];
+  if (c.startsWith("*")) {
+    const as = c.split(/\s+as\s+/);
+    if (as[1]) names.push(as[1].trim());
+  } else if (c.startsWith("{")) {
+    const braces = c.match(/\{([\s\S]*)\}/);
+    if (braces) {
+      for (const part of braces[1].split(",")) {
+        const p = part.trim();
+        if (!p) continue;
+        const seg = p.split(/\s+as\s+/);
+        names.push(seg[seg.length - 1].trim());
+      }
+    }
+  } else {
+    const def = c.match(/^[A-Za-z_$][\w$]*/);
+    if (def) names.push(def[0]);
+  }
+  return names;
+}
+function findEsbuildBin(rootDir) {
+  const candidates = [
+    join11(rootDir, "node_modules", ".bin", "esbuild"),
+    resolve3(rootDir, "..", "node_modules", ".bin", "esbuild"),
+    // CLI repo layout (dev / source runs)
+    resolve3(new URL(".", import.meta.url).pathname, "..", "..", "..", "..", "node_modules", ".bin", "esbuild")
+  ];
+  for (const c of candidates) {
+    try {
+      if (existsSync7(c)) return c;
+    } catch {
+    }
+  }
+  const bd = globalThis.__TW_BUNDLE_DIR;
+  if (bd) {
+    const b = resolve3(bd, "..", "..", "..", "node_modules", ".bin", "esbuild");
+    try {
+      if (existsSync7(b)) return b;
+    } catch {
+    }
+  }
+  return "esbuild";
+}
+function findServerOnlyViolations(src) {
+  const out = [];
+  let m;
+  IMPORT_RE.lastIndex = 0;
+  while (m = IMPORT_RE.exec(src)) {
+    const spec = m[2];
+    if (spec === "lib" || spec.startsWith("lib/")) {
+      out.push(spec);
+      continue;
+    }
+    if (isClientImportSpecifier(spec)) continue;
+    if (spec.startsWith("@tw/")) {
+      if (BUILTIN_CLIENT_OK_SPECIFIERS.includes(spec)) continue;
+      if (RUNTIME_CLIENT_OK_SPECIFIERS.includes(spec)) continue;
+      out.push(spec);
+      continue;
+    }
+    if (spec.startsWith("@./") || spec.startsWith("./") || spec.startsWith("../")) {
+      if (/\.(tw|tss)$/.test(spec)) continue;
+      out.push(spec);
+      continue;
+    }
+    if (spec.startsWith("lib/")) out.push(spec);
+  }
+  return out;
+}
+function contentHash2(s) {
+  let h = 5381;
+  for (let i = 0; i < s.length; i++) h = (h * 33 ^ s.charCodeAt(i)) >>> 0;
+  return h.toString(36);
+}
+function vendoredRuntimeClient() {
+  const fromSrc = new URL("../../dist/tw-runtime-client.mjs", import.meta.url).pathname;
+  if (existsSync7(fromSrc)) return fromSrc;
+  const fromBundle = new URL("./tw-runtime-client.mjs", import.meta.url).pathname;
+  if (existsSync7(fromBundle)) return fromBundle;
+  return null;
+}
+function rewriteRuntimeSpecifier(importLine) {
+  const vendored = vendoredRuntimeClient();
+  if (!vendored) return importLine;
+  const m = importLine.match(/from\s+["'](@tw\/runtime)["']/);
+  if (!m) return importLine;
+  return importLine.replace(m[0], `from ${JSON.stringify(vendored)}`);
+}
+function buildClientChunk(rootDir, importLine, minify) {
+  if (!importLine) return "";
+  const cached = chunkCache.get(importLine);
+  if (cached && existsSync7(join11(rootDir, ".tw", cached))) return cached;
+  const jsDir = join11(rootDir, ".tw", "js");
+  mkdirSync4(jsDir, { recursive: true });
+  const names = importNames(importLine);
+  const entryLine = rewriteRuntimeSpecifier(importLine);
+  const entry = [
+    entryLine + ";",
+    "globalThis.__twClient = globalThis.__twClient || {};",
+    ...names.map((n) => "globalThis.__twClient." + n + " = " + n + ";")
+  ].join("\n");
+  const stamp = contentHash2(importLine);
+  const entryPath = join11(rootDir, ".tw", ".chunk-entry-" + stamp + ".js");
+  const tmpOut = join11(rootDir, ".tw", ".chunk-tmp-" + stamp + ".js");
+  writeFileSync4(entryPath, entry);
+  const bin = findEsbuildBin(rootDir);
+  const args = [entryPath, "--bundle", "--format=iife", "--target=es2019", "--outfile=" + tmpOut];
+  if (minify) args.push("--minify");
+  const r = spawnSync2(bin, args, { cwd: rootDir });
+  try {
+    unlinkSync2(entryPath);
+  } catch {
+  }
+  if (r.status !== 0) {
+    const errText = (r.stderr && r.stderr.toString ? r.stderr.toString() : "") || String(r.error || "unknown");
+    console.error("  [tw] client chunk failed (" + importLine + "): " + errText.split("\n")[0]);
+    try {
+      unlinkSync2(tmpOut);
+    } catch {
+    }
+    return "";
+  }
+  const code = readFileSync6(tmpOut, "utf-8");
+  const url = "js/c-" + contentHash2(code) + ".js";
+  writeFileSync4(join11(rootDir, ".tw", url), code);
+  try {
+    unlinkSync2(tmpOut);
+  } catch {
+  }
+  chunkCache.set(importLine, url);
+  return url;
+}
+function buildPageScope(rootDir, ownImportLines) {
+  if (!ownImportLines || ownImportLines.length === 0) return "";
+  const names = ownImportLines.flatMap((l) => importNames(l));
+  if (names.length === 0) return "";
+  mkdirSync4(join11(rootDir, ".tw", "js"), { recursive: true });
+  const body = names.map((n) => "p." + n + " = g.__twClient." + n + ";").join("\n");
+  const code = "(function(g){g.__twClient=g.__twClient||{};var p={};\n" + body + "\ng.__twClient.$page=p;})(globalThis);\n";
+  const url = "js/p-" + contentHash2(names.slice().sort().join("|")) + ".js";
+  writeFileSync4(join11(rootDir, ".tw", url), code);
+  return url;
+}
+var IMPORT_RE, BUILTIN_CLIENT_OK_SPECIFIERS, RUNTIME_CLIENT_OK_SPECIFIERS, chunkCache;
+var init_client_bundle = __esm({
+  "tw/commands/client-bundle.ts"() {
+    IMPORT_RE = /^[ \t]*import\s+([^\n]+?)\s+from\s+["'']([^"'']+)["''][; \t]*$/gm;
+    BUILTIN_CLIENT_OK_SPECIFIERS = ["@tw/optImage", "@tw/RouterLink"];
+    RUNTIME_CLIENT_OK_SPECIFIERS = ["@tw/runtime"];
+    chunkCache = /* @__PURE__ */ new Map();
+  }
+});
+
+// ../../packages/server/tw/routing/revalidate.ts
+function setActivePipeline(p) {
+  activePipeline = p;
+}
+function getActivePipeline() {
+  return activePipeline;
+}
+function revalidatePath(pathname, opts) {
+  return activePipeline ? activePipeline.revalidatePath(pathname, opts) : 0;
+}
+function registerTwmTagInvalidator(fn) {
+  twmTagInvalidator = fn;
+}
+function revalidateTag(tag) {
+  let dropped = 0;
+  if (activePipeline) dropped += activePipeline.revalidateTag(tag);
+  if (twmTagInvalidator) dropped += twmTagInvalidator(tag);
+  return dropped;
+}
+var activePipeline, twmTagInvalidator;
+var init_revalidate = __esm({
+  "../../packages/server/tw/routing/revalidate.ts"() {
+    activePipeline = null;
+    twmTagInvalidator = null;
+  }
+});
+
+// ../../packages/server/tw/routing/signal-stream.ts
+function getSignalHub() {
+  if (!hub) hub = new SignalHub();
+  return hub;
+}
+function setSignal(name, value, opts) {
+  let session = opts?.session;
+  if (!session && opts?.request) {
+    try {
+      const cookies = opts.request.cookies;
+      if (cookies && typeof cookies.get === "function") {
+        session = cookies.get("tw_session") ?? void 0;
+      } else {
+        const header = opts.request.headers?.get?.("cookie") ?? "";
+        const m = /(?:^|;\s*)tw_session=([^;]+)/.exec(header);
+        if (m) session = decodeURIComponent(m[1].trim().replace(/^"|"$/g, ""));
+      }
+    } catch {
+    }
+  }
+  return getSignalHub().setSignal(name, value, session ? { session } : void 0);
+}
+var BATCH_MS, HISTORY_LIMIT, SignalHub, hub;
+var init_signal_stream = __esm({
+  "../../packages/server/tw/routing/signal-stream.ts"() {
+    BATCH_MS = 100;
+    HISTORY_LIMIT = 1e3;
+    SignalHub = class {
+      clients = /* @__PURE__ */ new Map();
+      nextClientId = 1;
+      seq = 0;
+      values = /* @__PURE__ */ new Map();
+      kinds = /* @__PURE__ */ new Map();
+      history = [];
+      pending = /* @__PURE__ */ new Map();
+      pendingSession;
+      timer = null;
+      /**
+       * Server-side mutation (route handlers): queue an update, batch-flush.
+       * With `session` (derived from the request's tw_session cookie) private
+       * signals are delivered only to clients authenticated as that session.
+       */
+      setSignal(name, value, opts) {
+        const kind = this.kinds.get(name) ?? "public";
+        this.values.set(name, value);
+        this.kinds.set(name, kind);
+        this.pending.set(name, value);
+        if (opts?.session) this.pendingSession = opts.session;
+        if (this.timer == null) {
+          this.timer = setTimeout(() => this.flush(), BATCH_MS);
+        }
+        return { queued: true, kind };
+      }
+      /** Latest known values (also used for fresh snapshots). */
+      snapshot() {
+        return { seq: this.seq, snapshot: Object.fromEntries(this.values) };
+      }
+      register(declared, session) {
+        const id = this.nextClientId++;
+        for (const [name, kind] of declared) {
+          if (!this.kinds.has(name)) this.kinds.set(name, kind);
+        }
+        const client = {
+          id,
+          declared,
+          session,
+          send: () => {
+          },
+          close: () => this.clients.delete(id)
+        };
+        this.clients.set(id, client);
+        return client;
+      }
+      /** Build the replay/snapshot preamble for a connecting client. */
+      connectPayloads(since, declared, session) {
+        const out = [];
+        const hasCoverage = since <= this.seq && this.history.length > 0 && since >= this.history[0].seq - 1;
+        if (hasCoverage) {
+          for (const entry of this.history) {
+            if (entry.seq > since && this.sessionMatches(session, entry) && this.deliversTo(declared, entry.names)) {
+              out.push(entry.payload);
+            }
+          }
+        } else if (this.values.size > 0) {
+          const snap = {};
+          for (const [name, value] of this.values) {
+            if (this.sessionMatches(session, { names: [name], session: this.valueSessions.get(name) }) && this.deliversTo(declared, [name])) snap[name] = value;
+          }
+          if (Object.keys(snap).length > 0) {
+            out.push(this.frame({ v: 1, seq: this.seq, snapshot: snap }));
+          }
+        }
+        return out;
+      }
+      /** latest-known session per signal (for snapshot filtering) */
+      valueSessions = /* @__PURE__ */ new Map();
+      sessionMatches(clientSession, entry) {
+        if (!entry.session) return true;
+        return entry.session === clientSession;
+      }
+      deliversTo(declared, names) {
+        return names.some((n) => {
+          const kind = this.kinds.get(n) ?? "public";
+          return kind === "public" || declared.has(n);
+        });
+      }
+      flush() {
+        this.timer = null;
+        if (this.pending.size === 0) return;
+        const updates = [...this.pending.entries()];
+        const session = this.pendingSession;
+        this.pending.clear();
+        this.pendingSession = void 0;
+        this.seq++;
+        const names = updates.map(([n]) => n);
+        for (const [n] of updates) this.valueSessions.set(n, session);
+        const payload = this.frame({ v: 1, seq: this.seq, updates });
+        this.history.push({ seq: this.seq, payload, names, session });
+        if (this.history.length > HISTORY_LIMIT) this.history.shift();
+        for (const client of this.clients.values()) {
+          if (this.sessionMatches(client.session, { names, session }) && this.deliversTo(client.declared, names)) client.send(payload);
+        }
+      }
+      frame(obj) {
+        return JSON.stringify(obj).replace(/</g, "\\u003c");
+      }
+    };
+    hub = null;
+  }
+});
+
 // ../../packages/server/tw/websocket-manager.ts
 var DEFAULT_MAX_ROOMS, DEFAULT_MAX_ROOM_SIZE, WebSocketManager;
 var init_websocket_manager = __esm({
@@ -41096,7 +41367,8 @@ function extractRenderMode(page) {
   try {
     const fs = __require("node:fs");
     const source = fs.readFileSync(page.absolutePath, "utf-8");
-    const m = source.match(/render\s+(static|ssr|island|edge)/);
+    const { maskSourceStringsAndComments: maskSourceStringsAndComments2 } = (init_tw(), __toCommonJS(tw_exports));
+    const m = maskSourceStringsAndComments2(source).match(/render\s+(static|ssr|island|edge)/);
     if (m) {
       return m[1];
     }
@@ -41744,7 +42016,7 @@ var init_render_pipeline = __esm({
             for (const headMatch of bodyHTML.matchAll(/<head[^>]*>([\s\S]*?)<\/head>/gi)) {
               const headInner = headMatch[1];
               const tMatch = headInner.match(/<title>([^<]*)<\/title>/i);
-              if (tMatch) layoutTitle = tMatch[1].trim();
+              if (tMatch) layoutTitle = tMatch[1].trim().replace(/&quot;/g, '"').replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
               const kids = headInner.replace(/<title>[^<]*<\/title>/gi, "").replace(/<meta[^>]+charset[^>]*>/gi, "").replace(/<meta[^>]+viewport[^>]*>/gi, "").trim();
               if (kids) liftedParts.push(kids);
             }
@@ -41784,7 +42056,7 @@ ${bodyHTML}`;
             for (const hp of headCandidates) {
               const headCompiled = this.compileFile({ absolutePath: hp, type: "head" });
               const m = headCompiled.html.match(/<body>([\s\S]*)<\/body>/);
-              if (m && m[1].trim()) headExtra += m[1].trim() + "\n";
+              if (m && m[1].trim()) headExtra += m[1].trim().replace(/\\([{}])/g, "$1") + "\n";
             }
             if (liftedHead) headExtra += liftedHead + "\n";
           } catch {
@@ -41982,8 +42254,13 @@ ${bodyHTML}`;
       extractTitle(file) {
         try {
           const source = readFileSync7(file.absolutePath, "utf-8");
-          const m = source.match(/page\s*\{[^}]*title\s+"([^"]+)"/);
-          return m ? m[1] : null;
+          const masked = maskSourceStringsAndComments(source);
+          const m = masked.match(/page\s*\{[^}]*title\s+"/);
+          if (!m || m.index === void 0) return null;
+          const start = m.index + m[0].length;
+          const end = source.indexOf('"', start);
+          if (end === -1 || end === start) return null;
+          return source.slice(start, end).replace(/\\([{}"])/g, "$1");
         } catch {
           return null;
         }
@@ -41997,7 +42274,9 @@ ${bodyHTML}`;
       extractRenderMode(file) {
         try {
           const src = readFileSync7(file.absolutePath, "utf8");
-          const m = /render\s+(static|ssr|island|edge|csr|stream|ppr)\b/.exec(src);
+          const m = /render\s+(static|ssr|island|edge|csr|stream|ppr)\b/.exec(
+            maskSourceStringsAndComments(src)
+          );
           return m ? m[1] : "static";
         } catch {
           return "static";
@@ -42045,7 +42324,7 @@ ${bodyHTML}`;
       extractRevalidate(file) {
         try {
           const source = readFileSync7(file.absolutePath, "utf-8");
-          const m = source.match(/page\s*\{[^}]*revalidate\s+(\d+)/);
+          const m = maskSourceStringsAndComments(source).match(/page\s*\{[^}]*revalidate\s+(\d+)/);
           if (m) {
             const n = Number(m[1]);
             return Number.isFinite(n) && n > 0 ? n : null;
@@ -42091,14 +42370,32 @@ ${bodyHTML}`;
       buildMetaTags(file) {
         try {
           const source = readFileSync7(file.absolutePath, "utf-8");
-          const fm = source.match(/page\s*\{([^}]*)\}/);
-          if (!fm) return "";
-          const body = fm[1];
+          const masked = maskSourceStringsAndComments(source);
+          const fm = masked.match(/page\s*\{/);
+          if (!fm || fm.index === void 0) return "";
+          const bodyStart = fm.index + fm[0].length;
+          const bodyEnd = masked.indexOf("}", bodyStart);
+          if (bodyEnd === -1) return "";
+          const body = source.slice(bodyStart, bodyEnd);
           const AMP = String.fromCharCode(38);
           const esc = (v) => v.split(AMP).join(AMP + "amp;").split(String.fromCharCode(34)).join(AMP + "quot;").split("<").join(AMP + "lt;");
           const pick = (key) => {
-            const m = body.match(new RegExp(key + '\\s+"([^"]*)"'));
-            return m ? m[1] : null;
+            const i = body.indexOf(key + ' "');
+            if (i === -1) return null;
+            const rest = body.slice(i + key.length + 2);
+            let end = -1;
+            for (let j = 0; j < rest.length; j++) {
+              if (rest[j] === "\\") {
+                j++;
+                continue;
+              }
+              if (rest[j] === '"') {
+                end = j;
+                break;
+              }
+            }
+            if (end === -1) return null;
+            return rest.slice(0, end).replace(/\\([{}"])/g, "$1");
           };
           let tags = "";
           const description = pick("description");
@@ -53507,6 +53804,13 @@ function generateSecurityHeaders(options = {}) {
   const headers = {};
   if (opts.csp) {
     headers["Content-Security-Policy"] = buildCSPHeader(opts.csp);
+    try {
+      const scriptSrc = Array.isArray(opts.csp["script-src"]) ? opts.csp["script-src"].join(" ") : String(opts.csp["script-src"] ?? "");
+      if (scriptSrc && !scriptSrc.includes("'unsafe-eval'") && !scriptSrc.includes("'strict-dynamic'")) {
+        console.warn("[tw] security: configured CSP has no 'unsafe-eval' in script-src -- the island hydration runtime needs it (add script-src: ['self', ''unsafe-eval''] or migrate handlers).");
+      }
+    } catch {
+    }
   }
   if (opts.hsts) {
     const hstsOpts = typeof opts.hsts === "object" ? opts.hsts : { maxAge: 31536e3, includeSubDomains: true };
@@ -54931,7 +55235,11 @@ async function executeRouteHandler(filePath, method, request, rootDir) {
     }
   } else if (typeof request?.json === "function") {
     try {
-      parsedBody = await request.json();
+      const rawBody2 = await request.text();
+      if (rawBody2.length > MAX_BODY_BYTES) {
+        return { status: 413, json: { ok: false, error: "Payload too large" } };
+      }
+      parsedBody = rawBody2 ? JSON.parse(rawBody2) : {};
     } catch {
       parsedBody = {};
     }
@@ -55211,7 +55519,9 @@ function findCompilerPath2() {
   return resolve6(process.cwd(), "packages/compiler/tw/index.ts");
 }
 function extractRenderMode2(src) {
-  const m = /render\s+(static|ssr|island|edge|csr|stream|ppr|signalStream)\b/.exec(src);
+  const m = /render\s+(static|ssr|island|edge|csr|stream|ppr|signalStream)\b/.exec(
+    maskSourceStringsAndComments(src)
+  );
   return m ? m[1] : "static";
 }
 function csrifyHtml(html) {
@@ -55325,18 +55635,32 @@ function scanComponents2(rootDir) {
   for (const d of privDirs) registerComponentsFrom2(d);
 }
 function buildMetaTagsFromSource(source) {
-  const fm = source.match(/page\s*\{([^}]*)\}/);
-  if (!fm) return "";
-  const body = fm[1];
+  const masked = maskSourceStringsAndComments(source);
+  const fm = masked.match(/page\s*\{/);
+  if (!fm || fm.index === void 0) return "";
+  const bodyStart = fm.index + fm[0].length;
+  const bodyEnd = masked.indexOf("}", bodyStart);
+  if (bodyEnd === -1) return "";
+  const body = source.slice(bodyStart, bodyEnd);
   const AMP = String.fromCharCode(38);
   const esc = (v) => v.split(AMP).join(AMP + "amp;").split(String.fromCharCode(34)).join(AMP + "quot;").split("<").join(AMP + "lt;");
   const pick = (key) => {
     const i = body.indexOf(key + ' "');
     if (i === -1) return null;
     const rest = body.slice(i + key.length + 2);
-    const end = rest.indexOf('"');
+    let end = -1;
+    for (let j = 0; j < rest.length; j++) {
+      if (rest[j] === "\\") {
+        j++;
+        continue;
+      }
+      if (rest[j] === '"') {
+        end = j;
+        break;
+      }
+    }
     if (end === -1) return null;
-    return rest.slice(0, end);
+    return rest.slice(0, end).replace(/\\([{}"])/g, "$1");
   };
   let tags = "";
   const description = pick("description");
@@ -55466,7 +55790,7 @@ async function buildCommand() {
           errorCount++;
         }
       }
-      const revM = resolved ? null : /page\s*\{[^}]*revalidate\s+(\d+)/.exec(pageSrc);
+      const revM = resolved ? null : /page\s*\{[^}]*revalidate\s+(\d+)/.exec(maskSourceStringsAndComments(pageSrc));
       if (resolved || revM) {
         for (const ps of paramSets) {
           const rp = routePath.split("/").map((seg) => {
@@ -55550,7 +55874,10 @@ async function buildCommand() {
             const headResult = _compileSync(headSource, { filePath: headSrc });
             const headBody = headResult.html.match(/<body>([\s\S]*)<\/body>/);
             if (headBody && headBody[1].trim()) {
-              html = html.replace("</head>", "  " + headBody[1].trim() + "\n</head>");
+              html = html.replace(
+                "</head>",
+                "  " + headBody[1].trim().replace(/\\([{}])/g, "$1") + "\n</head>"
+              );
             }
           } catch (e) {
             console.log("  Warning: head.tw failed: " + e.message);
@@ -55761,6 +56088,7 @@ async function buildCommand() {
   }
   console.log("\n  \x1B[32mBuild complete!\x1B[0m");
   console.log("  Pages: " + pageCount + " compiled");
+  if (pageCount === 0) console.warn("  [!] No static pages were compiled -- every page is SSR/API. Static hosts (Vercel/Cloudflare Pages output) will serve an empty site. Use `render static` or check your render modes.");
   console.log("  APIs:  " + apiCount + " routes");
   if (isrRoutes.size > 0) {
     const manifest = {};
@@ -57709,9 +58037,11 @@ var init_provider2 = __esm({
       getExpressionCompletions(doc) {
         const items = [];
         const definedVars = /* @__PURE__ */ new Set();
-        const scriptMatch = doc.content.match(/<script[^>]*>([\s\S]*?)<\/script>/i);
+        const scriptMatches = [...doc.content.matchAll(/<script[^>]*>([\s\S]*?)<\/script>/gi)];
+        const scriptMatch = scriptMatches.length ? [scriptMatches.map((m) => m[1]).join("\n")] : null;
+        const scriptContent = scriptMatch ? scriptMatch[0] : "";
         if (scriptMatch) {
-          const sc = scriptMatch[1];
+          const sc = scriptContent;
           const varRegex = /(?:const|let|var)\s+(\w+)/g;
           let m;
           while ((m = varRegex.exec(sc)) !== null) {
@@ -58286,8 +58616,10 @@ var init_symbols = __esm({
         const doc = this.docManager.getDocument(uri);
         if (!doc) return [];
         const symbols = [];
-        const scriptMatch = doc.content.match(/<script[^>]*>([\s\S]*?)<\/script>/i);
-        if (scriptMatch) symbols.push(...this.parseScriptSymbols(scriptMatch[1], this.findScriptStart(doc)));
+        const scriptMatches = [...doc.content.matchAll(/<script[^>]*>([\s\S]*?)<\/script>/gi)];
+        const scriptMatch = scriptMatches.length ? [scriptMatches.map((m) => m[1]).join("\n")] : null;
+        const scriptContent = scriptMatch ? scriptMatch[0] : "";
+        if (scriptMatch) symbols.push(...this.parseScriptSymbols(scriptContent, this.findScriptStart(doc)));
         symbols.push(...this.parseTemplateSymbols(doc));
         return symbols;
       }
@@ -58600,6 +58932,11 @@ var init_provider14 = __esm({
 });
 
 // ../../packages/lsp/tw/code-lens/provider.ts
+function stripLineComments(src) {
+  return src.split("\n").map(function(l) {
+    return l.replace(/(^|\s)\/\/.*$/, "");
+  }).join("\n");
+}
 var CodeLensProvider;
 var init_provider15 = __esm({
   "../../packages/lsp/tw/code-lens/provider.ts"() {
@@ -58632,7 +58969,7 @@ var init_provider15 = __esm({
         const esc = symbol.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
         const regex = new RegExp(`\\b${esc}\\b`, "g");
         for (const d of this.docManager.getAllDocuments()) {
-          const m = d.content.match(regex);
+          const m = stripLineComments(d.content).match(regex);
           if (m) count += m.length - 1;
         }
         return Math.max(0, count);
@@ -58642,7 +58979,7 @@ var init_provider15 = __esm({
         const esc = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
         const regex = new RegExp(`<${esc}\\b`, "g");
         for (const d of this.docManager.getAllDocuments()) {
-          const m = d.content.match(regex);
+          const m = stripLineComments(d.content).match(regex);
           if (m) count += m.length;
         }
         return count;
@@ -60983,38 +61320,15 @@ function destroySession(req) {
   const match = cookie.match(new RegExp(`${SESSION_COOKIE}=([^;]+)`));
   if (match) sessions.delete(match[1]);
 }
-function loadMiddleware(rootDir) {
-  const mwPath = join19(rootDir, "middleware.twm");
-  if (!existsSync15(mwPath)) return [];
-  const source = readFileSync11(mwPath, "utf-8");
-  const rules = [];
-  const ruleRegex = /rule\s+"([^"]+)"\s*{([^}]+)}/g;
-  let match;
-  while ((match = ruleRegex.exec(source)) !== null) {
-    const name = match[1];
-    const body = match[2];
-    const pathMatch = body.match(/match\s+"([^"]+)"/);
-    const authMatch = body.match(/auth\s+(true|false)/);
-    const redirectMatch = body.match(/redirect\s+"([^"]+)"/);
-    if (pathMatch) {
-      rules.push({
-        name,
-        match: pathMatch[1],
-        auth: authMatch ? authMatch[1] === "true" : false,
-        redirect: redirectMatch ? redirectMatch[1] : "/login"
-      });
-    }
-  }
-  return rules;
-}
-function matchGlob(path, pattern) {
-  if (pattern === "/**") return true;
-  if (pattern === path) return true;
-  if (pattern.endsWith("/**")) {
-    const prefix = pattern.slice(0, -3);
-    return path === prefix || path.startsWith(prefix + "/");
+async function loadMiddlewareRules(mwPath) {
+  try {
+    const source = readFileSync11(mwPath, "utf-8");
+    const { parseRules: parseRules2 } = await Promise.resolve().then(() => (init_twm_rules(), twm_rules_exports));
+    return parseRules2(source);
+  } catch (e) {
+    console.log("    Middleware error: " + e.message);
+    return [];
   }
-  return false;
 }
 function get404() {
   return `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>404 - Page Not Found</title><style>${DEFAULT_CSS}</style></head><body><div class="wrapper"><section class="hero"><div class="container"><h1>404</h1><p>Page not found</p><a class="btn" href="/">Go Home</a></div></section></div></body></html>`;
@@ -61093,7 +61407,8 @@ async function devCommand() {
     if (existsSync15(stylePath)) parts.push(readFileSync11(stylePath, "utf-8"));
     if (parts.length) css = parts.join("\n");
   }
-  const middlewareRules = loadMiddleware(rootDir);
+  const mwPath = join19(rootDir, "middleware.twm");
+  const middlewareRules = existsSync15(mwPath) ? await loadMiddlewareRules(mwPath) : [];
   scanComponents(rootDir);
   const compDir = join19(rootDir, "components");
   if (existsSync15(compDir)) {
@@ -61168,13 +61483,13 @@ async function devCommand() {
   }
   async function runUserMiddleware(req) {
     try {
-      const mwPath = join19(rootDir, "middleware.twm");
-      if (!existsSync15(mwPath)) return null;
+      const mwPath2 = join19(rootDir, "middleware.twm");
+      if (!existsSync15(mwPath2)) return null;
       const { executeMiddleware: executeMiddleware2, loadTWMModule: loadTWMModule2, shouldMatchMiddleware: shouldMatchMiddleware2 } = await Promise.resolve().then(() => (init_twm_loader(), twm_loader_exports));
-      const mod = await loadTWMModule2(mwPath, rootDir);
+      const mod = await loadTWMModule2(mwPath2, rootDir);
       const mwPathname = new URL(req.url).pathname;
       if (!mod.config?.matcher || shouldMatchMiddleware2(mod.config.matcher, mwPathname)) {
-        const mwResult = await executeMiddleware2(mwPath, req, rootDir);
+        const mwResult = await executeMiddleware2(mwPath2, req, rootDir);
         if (mwResult instanceof Response) return mwResult;
         if (mwResult && typeof mwResult === "object" && mwResult.headers && !mwResult.status && !mwResult.json) {
           return mwResult.headers;
@@ -61230,16 +61545,15 @@ async function devCommand() {
     rescanComponentsIfNeeded(rootDir);
     console.log("  [" + time + "] " + req.method + " " + path);
     const session = getSession(req);
-    for (const rule of middlewareRules) {
-      if (rule.auth && matchGlob(path, rule.match)) {
-        if (!session || !session.userId) {
-          console.log("    -> 302 Redirect to " + rule.redirect + " (auth required)");
-          return new Response(null, {
-            status: 302,
-            headers: { Location: rule.redirect }
-          });
-        }
+    try {
+      const { evaluateRules: evaluateRules2 } = await Promise.resolve().then(() => (init_twm_rules(), twm_rules_exports));
+      const mwRes = evaluateRules2(middlewareRules, req);
+      if (mwRes) {
+        console.log("    -> middleware response " + mwRes.status + " for " + path);
+        return mwRes;
       }
+    } catch (e) {
+      console.log("    Middleware error: " + e.message);
     }
     if (path === "/__tw_runtime.js") {
       const _fu = import.meta.url.replace("file://", "");
@@ -61449,13 +61763,20 @@ async function devCommand() {
         if (/<\/body>/.test(html)) {
           html = html.replace("</body>", devClientTag + '  <script src="/__tw_runtime.js"></script>\n</body>');
         }
+        const devGlobalHead = join19(homeDir, "head.tw");
+        const devHeadSources = [];
+        if (existsSync15(devGlobalHead)) devHeadSources.push(devGlobalHead);
         const headTw = join19(dirname5(resolved.file), "head.tw");
-        if (existsSync15(headTw)) {
+        if (headTw !== devGlobalHead && existsSync15(headTw)) devHeadSources.push(headTw);
+        for (const devHeadTw of devHeadSources) {
           try {
-            const headRes = compileSync3(readFileSync11(headTw, "utf-8"), { filePath: headTw });
+            const headRes = compileSync3(readFileSync11(devHeadTw, "utf-8"), { filePath: devHeadTw });
             const headBody = headRes.html.match(/<body>([\s\S]*)<\/body>/);
             if (headBody && headBody[1].trim()) {
-              html = html.replace("</head>", "  " + headBody[1].trim() + "\n</head>");
+              html = html.replace(
+                "</head>",
+                "  " + headBody[1].trim().replace(/\\([{}])/g, "$1") + "\n</head>"
+              );
             }
           } catch (e) {
             console.log("    Warning: head.tw failed: " + e.message);
@@ -61987,6 +62308,7 @@ async function testCommand() {
 }
 
 // tw/commands/check.ts
+init_tw();
 import { join as join28 } from "node:path";
 import { existsSync as existsSync23, readFileSync as readFileSync15, readdirSync as readdirSync10, statSync as statSync10 } from "node:fs";
 async function checkCommand() {
@@ -62044,23 +62366,24 @@ async function checkCommand() {
     for (const filePath of twFiles) {
       const relativePath = filePath.replace(rootDir + "/", "");
       const source = readFileSync15(filePath, "utf-8");
-      const openBraces = (source.match(/\{/g) || []).length;
-      const closeBraces = (source.match(/\}/g) || []).length;
+      const maskedSource = maskSourceStringsAndComments(source);
+      const openBraces = (maskedSource.match(/\{/g) || []).length;
+      const closeBraces = (maskedSource.match(/\}/g) || []).length;
       if (openBraces !== closeBraces) {
         totalErrors++;
-        console.debug(`  X ${relativePath}: unbalanced braces (${openBraces} open, ${closeBraces} close)`);
+        console.log(`  X ${relativePath}: unbalanced braces (${openBraces} open, ${closeBraces} close)`);
       } else {
-        console.debug(`  OK ${relativePath} -- syntax OK`);
+        console.log(`  OK ${relativePath} -- syntax OK`);
       }
     }
   }
-  console.debug(`
+  console.log(`
   Summary: ${totalErrors} errors, ${totalWarnings} warnings, ${totalInfo} info`);
   if (totalErrors > 0) {
-    console.debug("  Status: FAILED\n");
+    console.log("  Status: FAILED\n");
     process.exit(1);
   } else {
-    console.debug("  Status: PASSED\n");
+    console.log("  Status: PASSED\n");
   }
 }
 function collectFiles2(dir, ext, results) {
@@ -62077,11 +62400,12 @@ function collectFiles2(dir, ext, results) {
 }
 
 // tw/commands/plugin.ts
+init_tw();
 import { join as join29 } from "node:path";
 import { existsSync as existsSync24, readFileSync as readFileSync16, writeFileSync as writeFileSync9, mkdirSync as mkdirSync9, readdirSync as readdirSync11 } from "node:fs";
 function readConfigPlugins(cfgPath) {
   if (!existsSync24(cfgPath)) return [];
-  const src = readFileSync16(cfgPath, "utf-8");
+  const src = stripCommentsStringAware(readFileSync16(cfgPath, "utf-8"));
   const m = /plugins\s*:\s*\[([^\]]*)\]/s.exec(src);
   if (!m) return [];
   const out = [];
@@ -62100,7 +62424,7 @@ function addConfigPlugin(cfgPath, name) {
 `);
     return true;
   }
-  const src = readFileSync16(cfgPath, "utf-8");
+  const src = stripCommentsStringAware(readFileSync16(cfgPath, "utf-8"));
   if (new RegExp(`["'\`]${name}["'\`]`).test(src)) return false;
   const m = /plugins\s*:\s*\[([^\]]*)\]/s.exec(src);
   if (m) {
@@ -62117,7 +62441,7 @@ function addConfigPlugin(cfgPath, name) {
 }
 function removeConfigPlugin(cfgPath, name) {
   if (!existsSync24(cfgPath)) return false;
-  const src = readFileSync16(cfgPath, "utf-8");
+  const src = stripCommentsStringAware(readFileSync16(cfgPath, "utf-8"));
   const m = /plugins\s*:\s*\[([^\]]*)\]/s.exec(src);
   if (!m) return false;
   const kept = m[1].split(",").map((e) => e.trim()).filter((e) => e && e !== `"${name}"` && e !== `'${name}'` && e !== "`" + name + "`");