tw-framework 1.0.6 → 1.0.8

package/dist/tw.mjs

@@ -3,7 +3,9 @@ globalThis.__TW_BUNDLE_DIR = new URL(".", import.meta.url).pathname;
 import { createRequire } from "node:module";
 const require = createRequire(import.meta.url);
 var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
   get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
 }) : x)(function(x) {
@@ -17,6 +19,15 @@ var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // ../../packages/shared/tw/hashing/md5.ts
 function bytesToWords(bytes) {
@@ -2555,6 +2566,97 @@ var init_config = __esm({
   }
 });
 
+// ../../packages/shared/tw/source-mask.ts
+function blank(s) {
+  return s.replace(/[^\n]/g, " ");
+}
+function maskSourceStringsAndComments(src) {
+  let out = "";
+  let i = 0;
+  const n = src.length;
+  while (i < n) {
+    const ch = src[i];
+    const next = src[i + 1];
+    if (ch === "/" && next === "/") {
+      let j = i;
+      while (j < n && src[j] !== "\n") j++;
+      out += blank(src.slice(i, j));
+      i = j;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      let j = i + 2;
+      while (j < n && !(src[j] === "*" && src[j + 1] === "/")) j++;
+      j = Math.min(j + 2, n);
+      out += blank(src.slice(i, j));
+      i = j;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      let j = i + 1;
+      while (j < n) {
+        const c = src[j];
+        if (c === "\\") {
+          j += 2;
+          continue;
+        }
+        if (c === ch) {
+          j++;
+          break;
+        }
+        j++;
+      }
+      out += blank(src.slice(i, j));
+      i = j;
+      continue;
+    }
+    out += ch;
+    i++;
+  }
+  return out;
+}
+function stripCommentsStringAware(src) {
+  let out = "";
+  let i = 0;
+  const n = src.length;
+  while (i < n) {
+    const c = src[i];
+    if (c === '"' || c === "'") {
+      const q = c;
+      out += c;
+      i++;
+      while (i < n && src[i] !== q) {
+        if (src[i] === "\\") {
+          out += src[i++];
+          if (i < n) out += src[i++];
+          continue;
+        }
+        out += src[i++];
+      }
+      out += src[i] ?? "";
+      i++;
+      continue;
+    }
+    if (c === "/" && src[i + 1] === "/") {
+      while (i < n && src[i] !== "\n") i++;
+      continue;
+    }
+    if (c === "/" && src[i + 1] === "*") {
+      const end = src.indexOf("*/", i + 2);
+      i = end === -1 ? n : end + 2;
+      out += " ";
+      continue;
+    }
+    out += c;
+    i++;
+  }
+  return out;
+}
+var init_source_mask = __esm({
+  "../../packages/shared/tw/source-mask.ts"() {
+  }
+});
+
 // ../../packages/shared/tw/cache.ts
 function parseCacheBody(body) {
   const meta = {};
@@ -2577,9 +2679,12 @@ function parseCacheBody(body) {
   return meta;
 }
 function extractCacheDirective(source) {
-  const m = /page\s*\{[^}]*?\bcache\s*\{([^}]*)\}/.exec(source);
+  const masked = maskSourceStringsAndComments(source);
+  const m = /page\s*\{[^}]*?\bcache\s*\{([^}]*)\}/.exec(masked);
   if (!m) return null;
-  return parseCacheBody(m[1]);
+  const bodyStart = m.index + m[0].length - m[1].length - 1;
+  const bodyEnd = bodyStart + m[1].length;
+  return parseCacheBody(source.slice(bodyStart, bodyEnd));
 }
 function cacheMetaIsUsable(meta) {
   if (!meta) return false;
@@ -2711,6 +2816,7 @@ function parseCacheProfilesSource(src) {
 var BUILTIN_CACHE_PROFILES;
 var init_cache = __esm({
   "../../packages/shared/tw/cache.ts"() {
+    init_source_mask();
     BUILTIN_CACHE_PROFILES = {
       seconds: { stale: 1, revalidate: 1, expire: 2 },
       minutes: { stale: 60, revalidate: 300, expire: 3600 },
@@ -6653,6 +6759,7 @@ __export(tw_exports, {
   maskPhone: () => maskPhone,
   maskSSN: () => maskSSN,
   maskSensitiveData: () => maskSensitiveData,
+  maskSourceStringsAndComments: () => maskSourceStringsAndComments,
   md5: () => md5,
   md5Async: () => md52,
   mergeConfig: () => mergeConfig,
@@ -6992,6 +7099,7 @@ __export(tw_exports, {
   shortHash: () => shortHash,
   signData: () => signData,
   statSync: () => statSync,
+  stripCommentsStringAware: () => stripCommentsStringAware,
   supportsColor: () => supportsColor,
   supportsFileSystem: () => supportsFileSystem,
   supportsWebSocket: () => supportsWebSocket,
@@ -7072,6 +7180,7 @@ var init_tw = __esm({
     init_utils();
     init_config();
     init_cache();
+    init_source_mask();
     init_constants();
     init_crypto();
     init_env();
@@ -9518,6 +9627,9 @@ function readEscape(source, start) {
   if (LINE_TERMINATORS.has(ch)) {
     return { value: "", end: start + 2 };
   }
+  if (ch === "{" || ch === "}") {
+    return { value: "\\" + ch, end: start + 2 };
+  }
   return { value: ch, end: start + 2 };
 }
 function validateString(str) {
@@ -12848,6 +12960,7 @@ function parsePageDirective(cursor, token) {
   if (valToken && (valToken.type === "STRING" || valToken.type === "NUMBER")) {
     cursor.advance();
     value = valToken.value;
+    if (valToken.type === "STRING") value = String(value).replace(/\\([{}"])/g, "$1");
     if (valToken.type === "NUMBER") value = parseFloat(valToken.value);
   } else if (cursor.match("EQUALS") || cursor.match("COLON")) {
     cursor.skipWhitespace();
@@ -12855,6 +12968,7 @@ function parsePageDirective(cursor, token) {
     if (vToken) {
       cursor.advance();
       value = vToken.value;
+      if (vToken.type === "STRING") value = String(value).replace(/\\([{}"])/g, "$1");
       if (vToken.type === "NUMBER") value = parseFloat(vToken.value);
       if (vToken.type === "BOOLEAN") value = vToken.value === "true";
     }
@@ -12878,7 +12992,7 @@ function parsePageDirective(cursor, token) {
     const nextToken = cursor.peek();
     if (nextToken && (nextToken.type === "STRING" || nextToken.type === "NUMBER" || nextToken.type === "IDENT" || nextToken.type === "KEYWORD")) {
       cursor.advance();
-      options[optName] = nextToken.value;
+      options[optName] = nextToken.type === "STRING" ? String(nextToken.value).replace(/\\([{}"])/g, "$1") : nextToken.value;
     } else if (cursor.match("EQUALS")) {
       cursor.skipWhitespace();
       const optVal = cursor.consumeValue();
@@ -13258,8 +13372,16 @@ function consumeSignalDeclaration(cursor) {
 function consumeStateValue(cursor) {
   const t2 = cursor.peek();
   if (!t2) return "";
+  if (t2.value === "-" || t2.value === "+") {
+    const after = cursor.peek(1);
+    if (after && (after.type === "NUMBER" || after.type === "IDENT" || after.type === "KEYWORD")) {
+      cursor.advance();
+      return (t2.value === "-" ? "-" : "") + String(after.value);
+    }
+  }
   if (t2.type === "STRING" || t2.type === "NUMBER" || t2.type === "IDENT" || t2.type === "KEYWORD") {
     cursor.advance();
+    if (t2.type === "STRING") return String(t2.value).replace(/\\([{}"])/g, "$1");
     return t2.value;
   }
   if (t2.type === "LBRACKET" || t2.type === "LBRACE" || t2.type === "LBRACK") {
@@ -13272,7 +13394,7 @@ function consumeStateValue(cursor) {
       else if (tk.type === "RBRACKET" || tk.type === "RBRACE" || tk.type === "RBRACK") depth--;
       const after = cursor.peek(1);
       if (tk.type === "STRING") {
-        parts.push(`"${tk.value}"`);
+        parts.push(`"${String(tk.value).replace(/\\([{}"])/g, "$1")}"`);
       } else if (tk.type === "IDENT" && after && after.type === "COLON" && depth > 0) {
         parts.push(`"${tk.value}"`);
       } else {
@@ -14274,6 +14396,20 @@ function parseTWSelector(cursor, errors, state, parseBody) {
         }
         cursor.consumeIf("RBRACE");
       } else {
+        for (; ; ) {
+          const t2 = cursor.peek();
+          if (!t2 || t2.type === "RBRACE" || t2.type === "EOF") break;
+          if ((t2.type === "IDENT" || t2.type === "KEYWORD") && ATTR_PAIR_NAMES.has(t2.value)) {
+            const after = cursor.peek(1);
+            if (after && (after.type === "STRING" || after.type === "NUMBER")) {
+              cursor.advance();
+              cursor.advance();
+              el.attrs.push(createAttribute(t2.value, after.value, t2.pos.line, t2.pos.col));
+              continue;
+            }
+          }
+          break;
+        }
         el.children = parseBody(["RBRACE"]);
         cursor.consumeIf("RBRACE");
       }
@@ -14892,10 +15028,13 @@ function parseWhileStatement(cursor, errors, parseBody) {
   const whileToken = cursor.advance();
   if (!whileToken) return null;
   cursor.skipWhitespace();
-  const condToken = cursor.peek();
   let condition = "";
-  if (condToken) {
-    condition = condToken.value;
+  while (!cursor.done) {
+    cursor.skipWhitespace();
+    const t2 = cursor.peek();
+    if (!t2 || t2.type === "EOF") break;
+    if (t2.type === "LBRACE" || t2.value === "{") break;
+    condition += (condition ? " " : "") + t2.value;
     cursor.advance();
   }
   const body = parseBlockBody2(cursor, parseBody);
@@ -15016,13 +15155,133 @@ function parseBlockBody2(cursor, parseBody) {
   }
   return parseBody(["KEYWORD", "RBRACE"]);
 }
-var CLASS_BOUNDARY_BOOLEAN_ATTRS;
+var ATTR_PAIR_NAMES, CLASS_BOUNDARY_BOOLEAN_ATTRS;
 var init_statements = __esm({
   "../../packages/compiler/tw/parser/statements/index.ts"() {
     init_nodes();
     init_recovery();
     init_directives();
     init_tw();
+    ATTR_PAIR_NAMES = /* @__PURE__ */ new Set([
+      "href",
+      "src",
+      "type",
+      "id",
+      "name",
+      "value",
+      "placeholder",
+      "action",
+      "method",
+      "title",
+      "alt",
+      "rel",
+      "target",
+      "lang",
+      "charset",
+      "content",
+      "width",
+      "height",
+      "loading",
+      "for",
+      "role",
+      "min",
+      "max",
+      "step",
+      "pattern",
+      "accept",
+      "list",
+      "download",
+      "tabindex",
+      "cols",
+      "rows",
+      "wrap",
+      "datetime",
+      "method",
+      "action",
+      "placeholder",
+      "disabled",
+      "required",
+      "readonly",
+      "checked",
+      "selected",
+      "target",
+      "rel",
+      "download",
+      "autocomplete",
+      "autofocus",
+      "min",
+      "max",
+      "step",
+      "pattern",
+      "multiple",
+      "size",
+      "cols",
+      "rows",
+      "wrap",
+      "for",
+      "hidden",
+      "width",
+      "height",
+      "loading",
+      "loop",
+      "muted",
+      "controls",
+      "poster",
+      "preload",
+      "contenteditable",
+      "draggable",
+      "spellcheck",
+      "translate",
+      "accesskey",
+      "tabindex",
+      "role",
+      "slot",
+      "is",
+      "part",
+      "enterkeyhint",
+      "inert",
+      "inputmode",
+      "sandbox",
+      "allow",
+      "allowfullscreen",
+      "referrerpolicy",
+      "fetchpriority",
+      "blocking",
+      "property",
+      "itemprop",
+      "itemtype",
+      "itemid",
+      "itemref",
+      "itemscope",
+      "charset",
+      "http-equiv",
+      "data",
+      "nonce",
+      "crossorigin",
+      "integrity",
+      "async",
+      "defer",
+      "srcset",
+      "sizes",
+      "media",
+      "ping",
+      "coords",
+      "shape",
+      "usemap",
+      "ismap",
+      "kind",
+      "srclang",
+      "default",
+      "autoplay",
+      "playsinline",
+      "enctype",
+      "novalidate",
+      "formaction",
+      "formmethod",
+      "formtarget",
+      "formenctype",
+      "formnovalidate"
+    ]);
     CLASS_BOUNDARY_BOOLEAN_ATTRS = /* @__PURE__ */ new Set([
       "disabled",
       "required",
@@ -21274,6 +21533,15 @@ function splitArgs2(str) {
 function findMatchingBrace3(str, start) {
   let depth = 1;
   for (let i = start + 1; i < str.length; i++) {
+    if (str[i] === '"' || str[i] === "'") {
+      const q = str[i];
+      i++;
+      while (i < str.length && str[i] !== q) {
+        if (str[i] === "\\") i++;
+        i++;
+      }
+      continue;
+    }
     if (str[i] === "{") depth++;
     else if (str[i] === "}") {
       depth--;
@@ -22826,7 +23094,7 @@ var init_types4 = __esm({
 var TW_VERSION, TW_GENERATOR_META;
 var init_version = __esm({
   "../../packages/compiler/tw/codegen/version.ts"() {
-    TW_VERSION = "1.0.6";
+    TW_VERSION = "1.0.8";
     TW_GENERATOR_META = `<meta name="generator" content="TW Framework ${TW_VERSION}">`;
   }
 });
@@ -23213,6 +23481,16 @@ function collectBuiltinImports(program) {
   for (const dir of program.directives ?? []) {
     if (dir.type !== "ImportDirective") continue;
     const imp = dir;
+    if (imp.source === "tw" || imp.source === "@tw/server") {
+      for (const item of imp.items ?? []) {
+        const name = item.split(" as ").pop().trim();
+        const spec = TW_NAMED_BUILTINS[name];
+        if (spec) out.set(name, spec);
+      }
+      if (imp.defaultImport && TW_NAMED_BUILTINS[imp.defaultImport]) {
+        out.set(imp.defaultImport, TW_NAMED_BUILTINS[imp.defaultImport]);
+      }
+    }
     if (!BUILTIN_COMPONENT_SPECIFIERS.includes(imp.source)) continue;
     if (imp.defaultImport) out.set(imp.defaultImport, imp.source);
     for (const item of imp.items ?? []) {
@@ -23282,7 +23560,7 @@ function normalizePrefetchProp(props) {
   return p;
 }
 function generateRouterLinkTag(props, textContent) {
-  const href = (props.href ?? "").trim();
+  const href = (props.href ?? props.to ?? "").trim();
   if (!href) return `<!-- @tw/RouterLink: missing href -->`;
   const opts = {
     href,
@@ -23309,13 +23587,18 @@ function generateBuiltinTag(specifier, props, textContent) {
   if (specifier === "@tw/RouterLink") return generateRouterLinkTag(props, textContent);
   return null;
 }
-var BUILTIN_COMPONENT_SPECIFIERS, imageConfig;
+var BUILTIN_COMPONENT_SPECIFIERS, imageConfig, TW_NAMED_BUILTINS;
 var init_builtin_components = __esm({
   "../../packages/compiler/tw/codegen/builtin-components.ts"() {
     init_tw2();
     init_tw3();
     BUILTIN_COMPONENT_SPECIFIERS = ["@tw/optImage", "@tw/RouterLink"];
     imageConfig = DEFAULT_IMAGE_CONFIG;
+    TW_NAMED_BUILTINS = {
+      RouterLink: "@tw/RouterLink",
+      optImage: "@tw/optImage",
+      Image: "@tw/optImage"
+    };
   }
 });
 
@@ -23386,6 +23669,14 @@ function interpolate(template, vars) {
   let i = 0;
   while (i < template.length) {
     const ch = template[i];
+    if (ch === "\\") {
+      const nxt = template[i + 1];
+      if (nxt === "{" || nxt === "}") {
+        result += nxt;
+        i += 2;
+        continue;
+      }
+    }
     if (ch === "{" && template[i + 1] !== "{") {
       let depth = 1;
       let j = i + 1;
@@ -23874,7 +24165,8 @@ function validatePlainCss(src, filePath) {
 function compileDecl(decl) {
   const trimmed = decl.trim();
   if (!trimmed) return "";
-  if (trimmed.includes(":")) return trimmed.replace(/\s*:\s*/, ": ");
+  const cssForm = /^([-\w]+)\s*:\s*/.exec(trimmed);
+  if (cssForm) return trimmed.replace(/^([-\w]+)\s*:\s*/, "$1: ");
   const spaceIdx = trimmed.search(/[\s]/);
   if (spaceIdx === -1) {
     return TSS_SHORTHANDS2[trimmed] ?? trimmed;
@@ -23888,9 +24180,124 @@ function combineSelector(parent, child) {
   if (child.includes("&")) return child.replace(/&/g, parent);
   return `${parent} ${child}`;
 }
+function stripTssComments(src) {
+  let out = "";
+  let i = 0;
+  const n = src.length;
+  while (i < n) {
+    const c = src[i];
+    if (c === '"' || c === "'") {
+      const q = c;
+      out += c;
+      i++;
+      while (i < n && src[i] !== q) {
+        if (src[i] === "\\") {
+          out += src[i++];
+          if (i < n) out += src[i++];
+          continue;
+        }
+        out += src[i++];
+      }
+      out += src[i] ?? "";
+      i++;
+      continue;
+    }
+    if (c === "u" && /^url\s*\(/i.test(src.slice(i, i + 6))) {
+      let depth = 0;
+      let j = i;
+      for (; j < n; j++) {
+        if (src[j] === "(") depth++;
+        else if (src[j] === ")") {
+          depth--;
+          if (depth === 0) {
+            j++;
+            break;
+          }
+        }
+      }
+      out += src.slice(i, j);
+      i = j;
+      continue;
+    }
+    if (c === "/" && src[i + 1] === "/") {
+      while (i < n && src[i] !== "\n") i++;
+      continue;
+    }
+    if (c === "/" && src[i + 1] === "*") {
+      const end = src.indexOf("*/", i + 2);
+      i = end === -1 ? n : end + 2;
+      out += " ";
+      continue;
+    }
+    out += c;
+    i++;
+  }
+  return out;
+}
 function compileTSS(source) {
+  {
+    let depth = 0;
+    let line = 1;
+    let inString = null;
+    let inComment = false;
+    let inUrl = false;
+    for (let i = 0; i < source.length; i++) {
+      const ch = source[i];
+      const prev = i > 0 ? source[i - 1] : "";
+      if (ch === "\n") {
+        line++;
+        inComment = false;
+        continue;
+      }
+      if (inComment) continue;
+      if (inString) {
+        if (ch === inString && prev !== "\\") inString = null;
+        continue;
+      }
+      if (inUrl) {
+        if (ch === ")") inUrl = false;
+        continue;
+      }
+      if (ch === "/" && source[i + 1] === "/" && source.slice(Math.max(0, i - 3), i).includes(":")) {
+        inUrl = true;
+        continue;
+      }
+      if (ch === "u" && source.slice(i, i + 4) === "url(") {
+        inUrl = true;
+        i += 3;
+        continue;
+      }
+      if (ch === "/" && source[i + 1] === "/") {
+        inComment = true;
+        continue;
+      }
+      if (ch === '"' || ch === "'") {
+        inString = ch;
+        continue;
+      }
+      if (ch === "{") depth++;
+      else if (ch === "}") {
+        depth--;
+        if (depth < 0) {
+          throw new Error("TW303: unbalanced '}' in stylesheet (line " + line + ")\n  " + (source.split("\n")[line - 1] ?? "").trim().slice(0, 80));
+        }
+      }
+    }
+    if (depth !== 0) {
+      throw new Error("TW303: " + depth + " unclosed '{' in stylesheet -- a rule block is never closed\n  last line: " + (source.split("\n").pop() ?? "").trim().slice(0, 80));
+    }
+  }
+  const __twOut = __twCompileTSSInner(source);
+  const leftover = __twOut.match(/\$[A-Za-z_][\w-]*/g);
+  if (leftover && !/\$\{/.test(__twOut)) {
+    const seen = Array.from(new Set(leftover));
+    console.warn("[tss] unsubstituted $var(s) in output: " + seen.join(", ") + " -- define them as state vars or fix the spelling");
+  }
+  return __twOut;
+}
+function __twCompileTSSInner(source) {
   if (!source || !source.trim()) return "";
-  let src = source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/.*$/gm, "");
+  let src = stripTssComments(source);
   const vars = {};
   src = src.replace(/\$([A-Za-z_][\w-]*)\s*:\s*([^;{}\n]+);?/g, (_m, name, val) => {
     vars[name] = String(val).trim();
@@ -24100,6 +24507,11 @@ function stripComments(src) {
       out += c;
       i++;
       while (i < n && src[i] !== q) {
+        if (src[i] === "\\") {
+          out += src[i++];
+          if (i < n) out += src[i++];
+          continue;
+        }
         out += src[i++];
       }
       out += src[i] ?? "";
@@ -24418,9 +24830,19 @@ function emit(items, parent, env, mixins, out) {
   out.push(...childCss);
 }
 function compileSCSS(source) {
+  const cleaned0 = stripComments(source);
+  const UNSUPPORTED = /@(import|extend|use|forward|function|each|if|else|for|while)\b/g;
+  const m = cleaned0.match(UNSUPPORTED);
+  if (m) {
+    const seen = Array.from(new Set(m.map((x) => x.trim())));
+    console.warn("[scss] unsupported at-rule(s) ignored: " + seen.join(", ") + " -- TW's SCSS subset supports nesting, $vars, & references and @mixin/@include");
+  }
   const items = parseItems(stripComments(source));
   const out = [];
   emit(items, "", [/* @__PURE__ */ new Map()], /* @__PURE__ */ new Map(), out);
+  if (out.length === 0 && cleaned0.replace(/[\s;]/g, "").length > 0) {
+    console.warn("[scss] compileSCSS produced no output for a non-empty source -- check for unsupported syntax (TW uses `color: #fff` declarations, not `color #fff`)");
+  }
   return out.join("\n");
 }
 var init_scss = __esm({
@@ -24460,7 +24882,8 @@ function addScope(css, scopeId) {
   return css.replace(/([.#]?[\w-]+)\s*\{/g, `$1[data-tw-scope="${scopeId}"] {`);
 }
 function interpolate2(expr, vars) {
-  return expr.replace(/\{([^}]+)\}/g, (_, name) => {
+  const masked = expr.replace(/\\\{/g, "
O").replace(/\\\}/g, "
C");
+  const out = masked.replace(/\{([^}]+)\}/g, (_, name) => {
     const key = name.trim();
     if (/^[a-zA-Z_$][\w$]*$/.test(key)) {
       return vars[key] ?? "";
@@ -24468,6 +24891,7 @@ function interpolate2(expr, vars) {
     const val = evaluate(key, vars);
     return val === null ? "" : val;
   });
+  return out.replace(/\u0001O/g, "{").replace(/\u0001C/g, "}");
 }
 function isTruthy2(val) {
   return isTruthy(val);
@@ -24553,13 +24977,13 @@ function collectTssImports(programs, ctx) {
               else ctx.inlineStyles.push(css);
             }
           } catch (e) {
-            if (e && typeof e.message === "string" && /^TW30[12]/.test(e.message)) throw e;
+            if (e && typeof e.message === "string" && /^TW30[123]/.test(e.message)) throw e;
           }
         }
       }
     }
   } catch (e) {
-    if (e && typeof e.message === "string" && /^TW30[12]/.test(e.message)) throw e;
+    if (e && typeof e.message === "string" && /^TW30[123]/.test(e.message)) throw e;
   }
 }
 function resolveTssPath(fromDir, rel) {
@@ -24779,6 +25203,10 @@ function generateSuspense(el, ctx) {
 function generateElement(el, ctx) {
   const tag = el.tag;
   const voidTag = VOID_TAGS5.has(tag.toLowerCase());
+  if (tag.length > 0 && tag[0] === tag[0].toUpperCase() && !["Link", "Suspense"].includes(tag) && !componentRegistry.has(tag) && !resolveBuiltin(tag, activeBuiltinImports)) {
+    console.warn("[tw] unknown component <" + tag + "> (" + el.line + ":" + el.col + ") -- no import resolves it; nothing was rendered");
+    return "<!-- TW: unknown component '" + tag + "' -- check the import -->";
+  }
   {
     const builtinSpec = resolveBuiltin(tag, activeBuiltinImports);
     if (builtinSpec) {
@@ -24869,6 +25297,8 @@ function renderAttrs(el, ctx) {
     } else if (typeof attr.value === "string" && !attr.name.startsWith("data-tw-event") && /\{[^}]+\}/.test(attr.value) && Object.keys(ctx.stateVars).length > 0) {
       const val = interpolate2(attr.value, ctx.stateVars);
       parts.push(`${attr.name}="${escapeAttr2(sanitizeUrlAttr(attr.name, val))}"`);
+    } else if (typeof attr.value === "string" && /\\[{}]/.test(attr.value)) {
+      parts.push(`${attr.name}="${escapeAttr2(sanitizeUrlAttr(attr.name, String(attr.value).replace(/\\([{}])/g, "$1")))}"`);
     } else {
       parts.push(`${attr.name}="${escapeAttr2(sanitizeUrlAttr(attr.name, attr.value))}"`);
     }
@@ -24975,6 +25405,9 @@ function generateText(text, ctx) {
     }
     return escapeHTML(interpolate2(text.value, ctx.stateVars));
   }
+  if (text.value && /\\[{}]/.test(text.value)) {
+    return escapeHTML(text.value.replace(/\\([{}])/g, "$1"));
+  }
   return escapeHTML(text.value);
 }
 function registerComponentTemplate(name, program) {
@@ -25033,7 +25466,13 @@ function generateComponent(comp, ctx) {
     ctx.slotContent = savedSlot;
     ctx.inHead = compSavedInHead;
   } else {
-    childrenHTML = comp.children.map((c) => generateNode(c, ctx)).join("");
+    const known = ["Link", "Suspense"];
+    if (!known.includes(compName)) {
+      console.warn("[tw] unknown component <" + compName + "> (" + comp.line + ":" + comp.col + ") -- unresolvable import; nothing was rendered");
+      childrenHTML = "<!-- TW: unknown component '" + compName + "' -- check the import -->";
+    } else {
+      childrenHTML = comp.children.map((c) => generateNode(c, ctx)).join("");
+    }
   }
   ctx.stateVars = savedStateVars;
   ctx.componentStack.pop();
@@ -26458,7 +26897,7 @@ function emitElement(gen, el, ctx) {
     attrStr = el.attrs.map((a) => {
       if (a.value === true) return a.name;
       const val = a.isInterpolated ? interpolate3(a.value, ctx.stateVars) : a.value;
-      return `${a.name}="${escapeAttr3(val)}"`;
+      return `${a.name}="${escapeAttr3(sanitizeUrlAttr2(a.name, val))}"`;
     }).join(" ");
   }
   if (el.styles && el.styles.length > 0) {
@@ -26574,14 +27013,25 @@ function getDirectiveValue2(program, key) {
 function escapeHTML2(str) {
   return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;");
 }
+function sanitizeUrlAttr2(name, value) {
+  const URL_ATTRS = /* @__PURE__ */ new Set(["href", "src", "action", "formaction", "xlink:href", "poster", "background"]);
+  if (!URL_ATTRS.has(name.toLowerCase())) return value;
+  const trimmed = String(value).trim().toLowerCase().replace(/[\s\0]/g, "");
+  if (trimmed.startsWith("javascript:") || trimmed.startsWith("data:text/html") || trimmed.startsWith("vbscript:")) {
+    return "#";
+  }
+  return value;
+}
 function escapeAttr3(str) {
   return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;");
 }
 function interpolate3(expr, vars) {
-  return expr.replace(/\{([^}]+)\}/g, (_, name) => {
+  const masked = expr.replace(/\\\{/g, "
O").replace(/\\\}/g, "
C");
+  const out = masked.replace(/\{([^}]+)\}/g, (_, name) => {
     const key = name.trim();
     return vars[key] ?? "";
   });
+  return out.replace(/\u0001O/g, "{").replace(/\u0001C/g, "}");
 }
 function isTruthy3(val) {
   if (!val) return false;
@@ -26785,6 +27235,15 @@ var init_streaming = __esm({
 });
 
 // ../../packages/compiler/tw/codegen/vdom-gen.ts
+function sanitizeUrlAttr3(name, value) {
+  const URL_ATTRS = /* @__PURE__ */ new Set(["href", "src", "action", "formaction", "xlink:href", "poster", "background"]);
+  if (!URL_ATTRS.has(name.toLowerCase())) return value;
+  const trimmed = String(value).trim().toLowerCase().replace(/[\s\0]/g, "");
+  if (trimmed.startsWith("javascript:") || trimmed.startsWith("data:text/html") || trimmed.startsWith("vbscript:")) {
+    return "#";
+  }
+  return value;
+}
 function generateVDOMCode(program, ctx) {
   const builder2 = new VDOMCodeBuilder(ctx);
   return builder2.generateModule(program);
@@ -26798,10 +27257,12 @@ function generateNodeVDOM(node, ctx) {
   return builder2.generateFromAST(node);
 }
 function interpolate4(expr, vars) {
-  return expr.replace(/\{([^}]+)\}/g, (_, name) => {
+  const masked = expr.replace(/\\\{/g, "
O").replace(/\\\}/g, "
C");
+  const out = masked.replace(/\{([^}]+)\}/g, (_, name) => {
     const key = name.trim();
     return vars[key] ?? "";
   });
+  return out.replace(/\u0001O/g, "{").replace(/\u0001C/g, "}");
 }
 function isTruthy4(val) {
   if (!val) return false;
@@ -26935,7 +27396,7 @@ var init_vdom_gen = __esm({
               const expr = this.interpolateToExpr(attr.value);
               attrs.push(`${JSON.stringify(attr.name)}: ${expr}`);
             } else {
-              attrs.push(`${JSON.stringify(attr.name)}: ${JSON.stringify(attr.value)}`);
+              attrs.push(`${JSON.stringify(attr.name)}: ${JSON.stringify(sanitizeUrlAttr3(attr.name, attr.value))}`);
             }
           }
         }
@@ -28806,13 +29267,27 @@ ${indentation})` : type;
 });
 
 // ../../packages/compiler/tw/codegen/vdom.ts
+function stateLiteralForRender(raw) {
+  const evalNum = (v) => typeof v === "number" || typeof v === "boolean" ? String(v) : null;
+  try {
+    const n = evalNum(JSON.parse(raw));
+    if (n !== null) return n;
+  } catch {
+  }
+  try {
+    const n = evalNum(new Function("return (" + raw + ")")());
+    if (n !== null) return n;
+  } catch {
+  }
+  return raw;
+}
 function generateWithLayout(layoutProgram, pageProgram, stateVars) {
   const ctx = createContext("ssr");
   if (stateVars) ctx.stateVars = { ...stateVars };
   for (const dir of pageProgram.directives || []) {
     if (dir.type === "StateDirective") {
       for (const decl of dir.declarations || []) {
-        ctx.stateVars[decl.name] = decl.value;
+        ctx.stateVars[decl.name] = stateLiteralForRender(decl.value);
       }
     }
   }
@@ -28844,7 +29319,7 @@ function generateWithLayoutChain(layoutPrograms, pageProgram, stateVars) {
     for (const dir of pageProgram.directives || []) {
       if (dir.type === "StateDirective") {
         for (const decl of dir.declarations || []) {
-          ctx2.stateVars[decl.name] = decl.value;
+          ctx2.stateVars[decl.name] = stateLiteralForRender(decl.value);
         }
       }
     }
@@ -28952,7 +29427,7 @@ function generateVDOM(program, ctx) {
       return {
         t: el.tag,
         a: el.attrs.reduce((acc, a) => {
-          acc[a.name] = a.value;
+          acc[a.name] = sanitizeUrlAttr4(a.name, String(a.value));
           return acc;
         }, {}),
         c: el.children.map(toVNode)
@@ -28990,16 +29465,27 @@ function processDirectives(program, ctx) {
   }
 }
 function interpolate5(expr, vars) {
-  return expr.replace(/\{([^}]+)\}/g, (_, name) => {
+  const masked = expr.replace(/\\\{/g, "
O").replace(/\\\}/g, "
C");
+  const out = masked.replace(/\{([^}]+)\}/g, (_, name) => {
     const key = name.trim();
     return vars[key] ?? "";
   });
+  return out.replace(/\u0001O/g, "{").replace(/\u0001C/g, "}");
 }
 function isTruthy5(val) {
   if (!val) return false;
   const lower = val.toLowerCase().trim();
   return lower !== "false" && lower !== "0" && lower !== "" && lower !== "null" && lower !== "undefined";
 }
+function sanitizeUrlAttr4(name, value) {
+  const URL_ATTRS = /* @__PURE__ */ new Set(["href", "src", "action", "formaction", "xlink:href", "poster", "background"]);
+  if (!URL_ATTRS.has(name.toLowerCase())) return value;
+  const trimmed = String(value).trim().toLowerCase().replace(/[\s\0]/g, "");
+  if (trimmed.startsWith("javascript:") || trimmed.startsWith("data:text/html") || trimmed.startsWith("vbscript:")) {
+    return "#";
+  }
+  return value;
+}
 function generate(program, stateVars) {
   const startTime = performance.now();
   const ctx = createContext("ssr");
@@ -29024,7 +29510,9 @@ function generate(program, stateVars) {
           ctx.hasInteractivity = true;
           continue;
         }
-        ctx.stateVars[decl.name] = decl.value;
+        if (!(decl.name in ctx.stateVars)) {
+          ctx.stateVars[decl.name] = stateLiteralForRender(decl.value);
+        }
         let v = decl.value;
         try {
           v = JSON.parse(decl.value);
@@ -29357,7 +29845,11 @@ var init_codes = __esm({
       TW090: { message: "cache { } requires a revalidate window or a life profile", severity: "error", category: "syntax" },
       TW091: { message: "fn cached handler is impure (request.cookies/headers/body or setSignal)", severity: "error", category: "semantic" },
       TW092: { message: "Unknown cache profile", severity: "error", category: "semantic" },
-      TW093: { message: "Non-deterministic call in a cached handler (value freezes into the cache entry)", severity: "warning", category: "best-practice" }
+      TW093: { message: "Non-deterministic call in a cached handler (value freezes into the cache entry)", severity: "warning", category: "best-practice" },
+      TW094: { message: "Invalid state literal -- array/object elements must be comma-separated (and objects need colons)", severity: "error", category: "syntax" },
+      TW095: { message: "Invalid for-loop iterable -- use {varName} or a valid comma-separated literal", severity: "error", category: "syntax" },
+      TW096: { message: "Unknown state variable in interpolation (renders empty)", severity: "warning", category: "semantic" },
+      TW097: { message: "while with a comparison renders its body ONCE at build time (state cannot mutate during SSR) -- use for loops for repetition", severity: "warning", category: "semantic" }
     };
   }
 });
@@ -29678,6 +30170,124 @@ function checkUnusedDeclarations(program, filePath, diags) {
     }
   }
 }
+function literalIsBroken(value) {
+  const v = value.trim();
+  if (!v.startsWith("[") && !v.startsWith("{")) return false;
+  try {
+    new Function("return (" + v + ")");
+    return false;
+  } catch {
+    return true;
+  }
+}
+function checkStateLiterals(program, filePath, diags) {
+  for (const decl of collectStateDecls(program)) {
+    if (decl.signalKind === "derived") continue;
+    if (literalIsBroken(String(decl.value))) {
+      diags.push(createDiagnostic(
+        "TW094",
+        decl.line,
+        decl.col,
+        filePath,
+        `${decl.name} = ${decl.value}`,
+        [
+          `Comma-separate array elements: ${decl.name} = ["a", "b", "c"]`,
+          `Objects need colons: ${decl.name} = { key: "value" }`
+        ]
+      ));
+    }
+  }
+}
+function checkLoopIterables(program, filePath, diags) {
+  forEachNode(program, (node) => {
+    if (!node || node.type !== "For") return;
+    const iterable = String(node.iterable ?? "").trim();
+    if (!iterable) {
+      diags.push(createDiagnostic(
+        "TW095",
+        node.line,
+        node.col,
+        filePath,
+        "for-loop has no iterable",
+        [`Use: for item in {list} { ... }`]
+      ));
+      return;
+    }
+    if (/^\{[A-Za-z_][\w.]*\}$/.test(iterable)) return;
+    if (/^[A-Za-z_][\w.]*$/.test(iterable)) return;
+    if (literalIsBroken(iterable)) {
+      diags.push(createDiagnostic(
+        "TW095",
+        node.line,
+        node.col,
+        filePath,
+        "for x in " + iterable,
+        [
+          `Wrap a state variable in braces: for item in {items}`,
+          `Literals need commas: for item in {["a", "b", "c"]}`
+        ]
+      ));
+    }
+  });
+}
+function checkUnknownStateVars(program, filePath, diags) {
+  const known = /* @__PURE__ */ new Set();
+  for (const decl of collectStateDecls(program)) known.add(decl.name);
+  forEachNode(program, (node) => {
+    if (node && node.type === "For" && node.varName) known.add(node.varName);
+    if (node && node.type === "For" && node.indexName) known.add(node.indexName);
+  });
+  const BUILTINS2 = /* @__PURE__ */ new Set([
+    "params",
+    "props",
+    "Math",
+    "Date",
+    "JSON",
+    "String",
+    "Number",
+    "Boolean",
+    "Array",
+    "Object",
+    "window",
+    "true",
+    "false",
+    "null",
+    "undefined"
+  ]);
+  forEachNode(program, (node) => {
+    if (!isText(node)) return;
+    const text = String(node.value ?? "");
+    if (!text.includes("{")) return;
+    for (const m of text.matchAll(/\{\s*([A-Za-z_][\w]*)\s*\}/g)) {
+      const name = m[1];
+      if (known.has(name) || BUILTINS2.has(name)) continue;
+      diags.push(createDiagnostic(
+        "TW096",
+        node.line,
+        node.col,
+        filePath,
+        `{${name}}`,
+        [`Declare it in the state block, or check the spelling`]
+      ));
+    }
+  });
+}
+function checkWhileComparisons(program, filePath, diags) {
+  forEachNode(program, (node) => {
+    if (!node || node.type !== "While") return;
+    const cond = String(node.condition ?? "");
+    if (/[<>=!]/.test(cond)) {
+      diags.push(createDiagnostic(
+        "TW097",
+        node.line,
+        node.col,
+        filePath,
+        "while " + cond,
+        ["Use `for item in {list}` for repetition", "while is for boolean flags (state { loading = true })"]
+      ));
+    }
+  });
+}
 var HTML_ELEMENTS2, HTML_ATTRIBUTES2, GLOBAL_ATTRIBUTES2, CSS_PROPERTIES2, CSS_ALIASES2, EVENT_TYPES2, ARIA_ROLES2, ARIA_ATTRIBUTES2;
 var init_rules = __esm({
   "../../packages/compiler/tw/diagnostics/rules.ts"() {
@@ -30568,6 +31178,10 @@ function diagnose(program, filePath) {
   checkSemanticErrors(program, filePath, diagnostics);
   checkDirectives(program, filePath, diagnostics);
   checkUnusedDeclarations(program, filePath, diagnostics);
+  checkStateLiterals(program, filePath, diagnostics);
+  checkLoopIterables(program, filePath, diagnostics);
+  checkUnknownStateVars(program, filePath, diagnostics);
+  checkWhileComparisons(program, filePath, diagnostics);
   return diagnostics;
 }
 var RuleEngine;
@@ -33080,7 +33694,12 @@ async function renderIslandContent(component, props, ctx) {
   return { html: result.html, css: result.css, js: result.js };
 }
 function countServerComponents(source) {
-  const matches = source.match(/@render\s+mode:\s*['"]server['"]/g);
+  let cleaned = source;
+  try {
+    cleaned = stripCommentsStringAware(source);
+  } catch {
+  }
+  const matches = cleaned.match(/@render\s+mode:\s*['"]server['"]/g);
   return matches ? matches.length : 0;
 }
 function determineHydrationStrategy(component, position) {
@@ -33118,6 +33737,7 @@ function parseClientDirective(source) {
 var componentRegistry2;
 var init_server_components = __esm({
   "../../packages/compiler/tw/server-components.ts"() {
+    init_tw();
     init_tw4();
     componentRegistry2 = /* @__PURE__ */ new Map();
   }
@@ -40041,385 +40661,6 @@ var init_tw4 = __esm({
   }
 });
 
-// ../../packages/shared/tw/node-import.ts
-var node_import_exports = {};
-__export(node_import_exports, {
-  twImportTs: () => twImportTs
-});
-import { join as join10 } from "node:path";
-import { tmpdir } from "node:os";
-import { pathToFileURL as pathToFileURL2 } from "node:url";
-async function twImportTs(tsPath) {
-  if (!globalThis.__TW_NODE) {
-    return import(tsPath);
-  }
-  const esbuildMain = globalThis.__TW_ESBUILD_MODULE;
-  const esbuild = await (esbuildMain ? import(esbuildMain) : import("esbuild"));
-  const safe = tsPath.replace(/[^a-zA-Z0-9]/g, "_").slice(-120);
-  const cachePath = join10(tmpdir(), "tw-" + safe + ".mjs");
-  await esbuild.build({
-    entryPoints: [tsPath],
-    bundle: true,
-    format: "esm",
-    platform: "node",
-    target: "node18",
-    outfile: cachePath,
-    logLevel: "silent"
-  });
-  return import(pathToFileURL2(cachePath).href);
-}
-var init_node_import = __esm({
-  "../../packages/shared/tw/node-import.ts"() {
-  }
-});
-
-// tw/commands/client-bundle.ts
-var client_bundle_exports = {};
-__export(client_bundle_exports, {
-  BUILTIN_CLIENT_OK_SPECIFIERS: () => BUILTIN_CLIENT_OK_SPECIFIERS,
-  RUNTIME_CLIENT_OK_SPECIFIERS: () => RUNTIME_CLIENT_OK_SPECIFIERS,
-  buildClientChunk: () => buildClientChunk,
-  buildPageScope: () => buildPageScope,
-  collectClientImportsFromSource: () => collectClientImportsFromSource,
-  findServerOnlyViolations: () => findServerOnlyViolations,
-  importNames: () => importNames,
-  isClientImportSpecifier: () => isClientImportSpecifier
-});
-import { join as join11, resolve as resolve3 } from "node:path";
-import { existsSync as existsSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, unlinkSync as unlinkSync2 } from "node:fs";
-import { spawnSync as spawnSync2 } from "node:child_process";
-function isClientImportSpecifier(spec) {
-  if (spec.startsWith("@./") || spec.startsWith("./") || spec.startsWith("../")) return false;
-  if (/\.(tw|tss|twm|ts|js)$/.test(spec)) return false;
-  if (spec.startsWith("@tw/")) {
-    return RUNTIME_CLIENT_OK_SPECIFIERS.includes(spec);
-  }
-  return true;
-}
-function collectClientImportsFromSource(src) {
-  const lines = [];
-  let m;
-  IMPORT_RE.lastIndex = 0;
-  while (m = IMPORT_RE.exec(src)) {
-    if (isClientImportSpecifier(m[2])) lines.push(m[0].trim().replace(/;$/, ""));
-  }
-  return lines;
-}
-function importNames(line) {
-  const clause = line.match(/^import\s+([\s\S]+?)\s+from/);
-  if (!clause) return [];
-  const c = clause[1].trim();
-  const names = [];
-  if (c.startsWith("*")) {
-    const as = c.split(/\s+as\s+/);
-    if (as[1]) names.push(as[1].trim());
-  } else if (c.startsWith("{")) {
-    const braces = c.match(/\{([\s\S]*)\}/);
-    if (braces) {
-      for (const part of braces[1].split(",")) {
-        const p = part.trim();
-        if (!p) continue;
-        const seg = p.split(/\s+as\s+/);
-        names.push(seg[seg.length - 1].trim());
-      }
-    }
-  } else {
-    const def = c.match(/^[A-Za-z_$][\w$]*/);
-    if (def) names.push(def[0]);
-  }
-  return names;
-}
-function findEsbuildBin(rootDir) {
-  const candidates = [
-    join11(rootDir, "node_modules", ".bin", "esbuild"),
-    resolve3(rootDir, "..", "node_modules", ".bin", "esbuild"),
-    // CLI repo layout (dev / source runs)
-    resolve3(new URL(".", import.meta.url).pathname, "..", "..", "..", "..", "node_modules", ".bin", "esbuild")
-  ];
-  for (const c of candidates) {
-    try {
-      if (existsSync7(c)) return c;
-    } catch {
-    }
-  }
-  const bd = globalThis.__TW_BUNDLE_DIR;
-  if (bd) {
-    const b = resolve3(bd, "..", "..", "..", "node_modules", ".bin", "esbuild");
-    try {
-      if (existsSync7(b)) return b;
-    } catch {
-    }
-  }
-  return "esbuild";
-}
-function findServerOnlyViolations(src) {
-  const out = [];
-  let m;
-  IMPORT_RE.lastIndex = 0;
-  while (m = IMPORT_RE.exec(src)) {
-    const spec = m[2];
-    if (spec === "lib" || spec.startsWith("lib/")) {
-      out.push(spec);
-      continue;
-    }
-    if (isClientImportSpecifier(spec)) continue;
-    if (spec.startsWith("@tw/")) {
-      if (BUILTIN_CLIENT_OK_SPECIFIERS.includes(spec)) continue;
-      if (RUNTIME_CLIENT_OK_SPECIFIERS.includes(spec)) continue;
-      out.push(spec);
-      continue;
-    }
-    if (spec.startsWith("@./") || spec.startsWith("./") || spec.startsWith("../")) {
-      if (/\.(tw|tss)$/.test(spec)) continue;
-      out.push(spec);
-      continue;
-    }
-    if (spec.startsWith("lib/")) out.push(spec);
-  }
-  return out;
-}
-function contentHash2(s) {
-  let h = 5381;
-  for (let i = 0; i < s.length; i++) h = (h * 33 ^ s.charCodeAt(i)) >>> 0;
-  return h.toString(36);
-}
-function vendoredRuntimeClient() {
-  const fromSrc = new URL("../../dist/tw-runtime-client.mjs", import.meta.url).pathname;
-  if (existsSync7(fromSrc)) return fromSrc;
-  const fromBundle = new URL("./tw-runtime-client.mjs", import.meta.url).pathname;
-  if (existsSync7(fromBundle)) return fromBundle;
-  return null;
-}
-function rewriteRuntimeSpecifier(importLine) {
-  const vendored = vendoredRuntimeClient();
-  if (!vendored) return importLine;
-  const m = importLine.match(/from\s+["'](@tw\/runtime)["']/);
-  if (!m) return importLine;
-  return importLine.replace(m[0], `from ${JSON.stringify(vendored)}`);
-}
-function buildClientChunk(rootDir, importLine, minify) {
-  if (!importLine) return "";
-  const cached = chunkCache.get(importLine);
-  if (cached && existsSync7(join11(rootDir, ".tw", cached))) return cached;
-  const jsDir = join11(rootDir, ".tw", "js");
-  mkdirSync4(jsDir, { recursive: true });
-  const names = importNames(importLine);
-  const entryLine = rewriteRuntimeSpecifier(importLine);
-  const entry = [
-    entryLine + ";",
-    "globalThis.__twClient = globalThis.__twClient || {};",
-    ...names.map((n) => "globalThis.__twClient." + n + " = " + n + ";")
-  ].join("\n");
-  const stamp = contentHash2(importLine);
-  const entryPath = join11(rootDir, ".tw", ".chunk-entry-" + stamp + ".js");
-  const tmpOut = join11(rootDir, ".tw", ".chunk-tmp-" + stamp + ".js");
-  writeFileSync4(entryPath, entry);
-  const bin = findEsbuildBin(rootDir);
-  const args = [entryPath, "--bundle", "--format=iife", "--target=es2019", "--outfile=" + tmpOut];
-  if (minify) args.push("--minify");
-  const r = spawnSync2(bin, args, { cwd: rootDir });
-  try {
-    unlinkSync2(entryPath);
-  } catch {
-  }
-  if (r.status !== 0) {
-    const errText = (r.stderr && r.stderr.toString ? r.stderr.toString() : "") || String(r.error || "unknown");
-    console.error("  [tw] client chunk failed (" + importLine + "): " + errText.split("\n")[0]);
-    try {
-      unlinkSync2(tmpOut);
-    } catch {
-    }
-    return "";
-  }
-  const code = readFileSync6(tmpOut, "utf-8");
-  const url = "js/c-" + contentHash2(code) + ".js";
-  writeFileSync4(join11(rootDir, ".tw", url), code);
-  try {
-    unlinkSync2(tmpOut);
-  } catch {
-  }
-  chunkCache.set(importLine, url);
-  return url;
-}
-function buildPageScope(rootDir, ownImportLines) {
-  if (!ownImportLines || ownImportLines.length === 0) return "";
-  const names = ownImportLines.flatMap((l) => importNames(l));
-  if (names.length === 0) return "";
-  mkdirSync4(join11(rootDir, ".tw", "js"), { recursive: true });
-  const body = names.map((n) => "p." + n + " = g.__twClient." + n + ";").join("\n");
-  const code = "(function(g){g.__twClient=g.__twClient||{};var p={};\n" + body + "\ng.__twClient.$page=p;})(globalThis);\n";
-  const url = "js/p-" + contentHash2(names.slice().sort().join("|")) + ".js";
-  writeFileSync4(join11(rootDir, ".tw", url), code);
-  return url;
-}
-var IMPORT_RE, BUILTIN_CLIENT_OK_SPECIFIERS, RUNTIME_CLIENT_OK_SPECIFIERS, chunkCache;
-var init_client_bundle = __esm({
-  "tw/commands/client-bundle.ts"() {
-    IMPORT_RE = /^[ \t]*import\s+([^\n]+?)\s+from\s+["'']([^"'']+)["''][; \t]*$/gm;
-    BUILTIN_CLIENT_OK_SPECIFIERS = ["@tw/optImage", "@tw/RouterLink"];
-    RUNTIME_CLIENT_OK_SPECIFIERS = ["@tw/runtime"];
-    chunkCache = /* @__PURE__ */ new Map();
-  }
-});
-
-// ../../packages/server/tw/routing/revalidate.ts
-function setActivePipeline(p) {
-  activePipeline = p;
-}
-function getActivePipeline() {
-  return activePipeline;
-}
-function revalidatePath(pathname, opts) {
-  return activePipeline ? activePipeline.revalidatePath(pathname, opts) : 0;
-}
-function registerTwmTagInvalidator(fn) {
-  twmTagInvalidator = fn;
-}
-function revalidateTag(tag) {
-  let dropped = 0;
-  if (activePipeline) dropped += activePipeline.revalidateTag(tag);
-  if (twmTagInvalidator) dropped += twmTagInvalidator(tag);
-  return dropped;
-}
-var activePipeline, twmTagInvalidator;
-var init_revalidate = __esm({
-  "../../packages/server/tw/routing/revalidate.ts"() {
-    activePipeline = null;
-    twmTagInvalidator = null;
-  }
-});
-
-// ../../packages/server/tw/routing/signal-stream.ts
-function getSignalHub() {
-  if (!hub) hub = new SignalHub();
-  return hub;
-}
-function setSignal(name, value, opts) {
-  let session = opts?.session;
-  if (!session && opts?.request) {
-    try {
-      const cookies = opts.request.cookies;
-      if (cookies && typeof cookies.get === "function") {
-        session = cookies.get("tw_session") ?? void 0;
-      } else {
-        const header = opts.request.headers?.get?.("cookie") ?? "";
-        const m = /(?:^|;\s*)tw_session=([^;]+)/.exec(header);
-        if (m) session = decodeURIComponent(m[1].trim().replace(/^"|"$/g, ""));
-      }
-    } catch {
-    }
-  }
-  return getSignalHub().setSignal(name, value, session ? { session } : void 0);
-}
-var BATCH_MS, HISTORY_LIMIT, SignalHub, hub;
-var init_signal_stream = __esm({
-  "../../packages/server/tw/routing/signal-stream.ts"() {
-    BATCH_MS = 100;
-    HISTORY_LIMIT = 1e3;
-    SignalHub = class {
-      clients = /* @__PURE__ */ new Map();
-      nextClientId = 1;
-      seq = 0;
-      values = /* @__PURE__ */ new Map();
-      kinds = /* @__PURE__ */ new Map();
-      history = [];
-      pending = /* @__PURE__ */ new Map();
-      pendingSession;
-      timer = null;
-      /**
-       * Server-side mutation (route handlers): queue an update, batch-flush.
-       * With `session` (derived from the request's tw_session cookie) private
-       * signals are delivered only to clients authenticated as that session.
-       */
-      setSignal(name, value, opts) {
-        const kind = this.kinds.get(name) ?? "public";
-        this.values.set(name, value);
-        this.kinds.set(name, kind);
-        this.pending.set(name, value);
-        if (opts?.session) this.pendingSession = opts.session;
-        if (this.timer == null) {
-          this.timer = setTimeout(() => this.flush(), BATCH_MS);
-        }
-        return { queued: true, kind };
-      }
-      /** Latest known values (also used for fresh snapshots). */
-      snapshot() {
-        return { seq: this.seq, snapshot: Object.fromEntries(this.values) };
-      }
-      register(declared, session) {
-        const id = this.nextClientId++;
-        for (const [name, kind] of declared) {
-          if (!this.kinds.has(name)) this.kinds.set(name, kind);
-        }
-        const client = {
-          id,
-          declared,
-          session,
-          send: () => {
-          },
-          close: () => this.clients.delete(id)
-        };
-        this.clients.set(id, client);
-        return client;
-      }
-      /** Build the replay/snapshot preamble for a connecting client. */
-      connectPayloads(since, declared, session) {
-        const out = [];
-        const hasCoverage = since <= this.seq && this.history.length > 0 && since >= this.history[0].seq - 1;
-        if (hasCoverage) {
-          for (const entry of this.history) {
-            if (entry.seq > since && this.sessionMatches(session, entry) && this.deliversTo(declared, entry.names)) {
-              out.push(entry.payload);
-            }
-          }
-        } else if (this.values.size > 0) {
-          const snap = {};
-          for (const [name, value] of this.values) {
-            if (this.sessionMatches(session, { names: [name], session: this.valueSessions.get(name) }) && this.deliversTo(declared, [name])) snap[name] = value;
-          }
-          if (Object.keys(snap).length > 0) {
-            out.push(this.frame({ v: 1, seq: this.seq, snapshot: snap }));
-          }
-        }
-        return out;
-      }
-      /** latest-known session per signal (for snapshot filtering) */
-      valueSessions = /* @__PURE__ */ new Map();
-      sessionMatches(clientSession, entry) {
-        if (!entry.session) return true;
-        return entry.session === clientSession;
-      }
-      deliversTo(declared, names) {
-        return names.some((n) => {
-          const kind = this.kinds.get(n) ?? "public";
-          return kind === "public" || declared.has(n);
-        });
-      }
-      flush() {
-        this.timer = null;
-        if (this.pending.size === 0) return;
-        const updates = [...this.pending.entries()];
-        const session = this.pendingSession;
-        this.pending.clear();
-        this.pendingSession = void 0;
-        this.seq++;
-        const names = updates.map(([n]) => n);
-        for (const [n] of updates) this.valueSessions.set(n, session);
-        const payload = this.frame({ v: 1, seq: this.seq, updates });
-        this.history.push({ seq: this.seq, payload, names, session });
-        if (this.history.length > HISTORY_LIMIT) this.history.shift();
-        for (const client of this.clients.values()) {
-          if (this.sessionMatches(client.session, { names, session }) && this.deliversTo(client.declared, names)) client.send(payload);
-        }
-      }
-      frame(obj) {
-        return JSON.stringify(obj).replace(/</g, "\\u003c");
-      }
-    };
-    hub = null;
-  }
-});
-
 // ../../packages/server/tw/routing/twm-rules.ts
 var twm_rules_exports = {};
 __export(twm_rules_exports, {
@@ -40538,19 +40779,35 @@ function verifyJwt_hs256(token, secret) {
   return true;
 }
 function matchPath(pattern, pathname) {
-  if (pattern === "/**" || pattern === "/*") return true;
-  if (pattern.endsWith("/**")) {
-    const prefix = pattern.slice(0, -3);
-    return pathname === prefix || pathname.startsWith(prefix + "/");
+  const norm = (p) => {
+    let x = p;
+    try {
+      x = decodeURIComponent(x);
+    } catch {
+    }
+    if (x.length > 1 && x.endsWith("/")) x = x.slice(0, -1);
+    return x;
+  };
+  const pat = norm(pattern);
+  const path = norm(pathname);
+  if (pat === "/**") return true;
+  if (pat === "/*") return path === "" || path === "/";
+  if (pat.endsWith("/**")) {
+    const prefix = pat.slice(0, -3);
+    return path === prefix || path.startsWith(prefix + "/");
   }
-  if (pattern.endsWith("/*")) {
-    const prefix = pattern.slice(0, -2);
-    return pathname === prefix || pathname.startsWith(prefix + "/");
+  if (pat.endsWith("/*")) {
+    const prefix = pat.slice(0, -2);
+    if (!path.startsWith(prefix + "/")) return path === prefix;
+    const rest = path.slice(prefix.length + 1);
+    return !rest.includes("/");
   }
-  return pathname === pattern;
+  return path === pat;
 }
 function ruleBlocked(rule, request, pathname) {
   const headers = request.headers;
+  const hasCondition = rule.userAgent || rule.path || rule.auth || rule.rateLimit || rule.origin || rule.methods && rule.methods.length > 0;
+  if (!hasCondition) return true;
   if (rule.userAgent) {
     const ua = (headers.get("user-agent") ?? "").toLowerCase();
     if (!ua) {
@@ -40870,6 +41127,631 @@ var init_twm_rules = __esm({
   }
 });
 
+// ../../packages/shared/tw/node-import.ts
+var node_import_exports = {};
+__export(node_import_exports, {
+  twImportTs: () => twImportTs
+});
+import { join as join10 } from "node:path";
+import { tmpdir } from "node:os";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
+async function twImportTs(tsPath) {
+  if (!globalThis.__TW_NODE) {
+    return import(tsPath);
+  }
+  const esbuildMain = globalThis.__TW_ESBUILD_MODULE;
+  const esbuild = await (esbuildMain ? import(esbuildMain) : import("esbuild"));
+  const safe = tsPath.replace(/[^a-zA-Z0-9]/g, "_").slice(-120);
+  const cachePath = join10(tmpdir(), "tw-" + safe + ".mjs");
+  await esbuild.build({
+    entryPoints: [tsPath],
+    bundle: true,
+    format: "esm",
+    platform: "node",
+    target: "node18",
+    outfile: cachePath,
+    logLevel: "silent"
+  });
+  return import(pathToFileURL2(cachePath).href);
+}
+var init_node_import = __esm({
+  "../../packages/shared/tw/node-import.ts"() {
+  }
+});
+
+// tw/commands/client-bundle.ts
+var client_bundle_exports = {};
+__export(client_bundle_exports, {
+  BUILTIN_CLIENT_OK_SPECIFIERS: () => BUILTIN_CLIENT_OK_SPECIFIERS,
+  RUNTIME_CLIENT_OK_SPECIFIERS: () => RUNTIME_CLIENT_OK_SPECIFIERS,
+  buildClientChunk: () => buildClientChunk,
+  buildPageScope: () => buildPageScope,
+  collectClientImportsFromSource: () => collectClientImportsFromSource,
+  findServerOnlyViolations: () => findServerOnlyViolations,
+  importNames: () => importNames,
+  isClientImportSpecifier: () => isClientImportSpecifier
+});
+import { join as join11, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, unlinkSync as unlinkSync2 } from "node:fs";
+import { spawnSync as spawnSync2 } from "node:child_process";
+function isClientImportSpecifier(spec) {
+  if (spec.startsWith("@./") || spec.startsWith("./") || spec.startsWith("../")) return false;
+  if (/\.(tw|tss|twm|ts|js)$/.test(spec)) return false;
+  if (spec.startsWith("@tw/")) {
+    return RUNTIME_CLIENT_OK_SPECIFIERS.includes(spec);
+  }
+  return true;
+}
+function collectClientImportsFromSource(src) {
+  const lines = [];
+  let m;
+  IMPORT_RE.lastIndex = 0;
+  while (m = IMPORT_RE.exec(src)) {
+    if (isClientImportSpecifier(m[2])) lines.push(m[0].trim().replace(/;$/, ""));
+  }
+  return lines;
+}
+function importNames(line) {
+  const clause = line.match(/^import\s+([\s\S]+?)\s+from/);
+  if (!clause) return [];
+  const c = clause[1].trim();
+  const names = [];
+  if (c.startsWith("*")) {
+    const as = c.split(/\s+as\s+/);
+    if (as[1]) names.push(as[1].trim());
+  } else if (c.startsWith("{")) {
+    const braces = c.match(/\{([\s\S]*)\}/);
+    if (braces) {
+      for (const part of braces[1].split(",")) {
+        const p = part.trim();
+        if (!p) continue;
+        const seg = p.split(/\s+as\s+/);
+        names.push(seg[seg.length - 1].trim());
+      }
+    }
+  } else {
+    const def = c.match(/^[A-Za-z_$][\w$]*/);
+    if (def) names.push(def[0]);
+  }
+  return names;
+}
+function findEsbuildBin(rootDir) {
+  const candidates = [
+    join11(rootDir, "node_modules", ".bin", "esbuild"),
+    resolve3(rootDir, "..", "node_modules", ".bin", "esbuild"),
+    // CLI repo layout (dev / source runs)
+    resolve3(new URL(".", import.meta.url).pathname, "..", "..", "..", "..", "node_modules", ".bin", "esbuild")
+  ];
+  for (const c of candidates) {
+    try {
+      if (existsSync7(c)) return c;
+    } catch {
+    }
+  }
+  const bd = globalThis.__TW_BUNDLE_DIR;
+  if (bd) {
+    const b = resolve3(bd, "..", "..", "..", "node_modules", ".bin", "esbuild");
+    try {
+      if (existsSync7(b)) return b;
+    } catch {
+    }
+  }
+  return "esbuild";
+}
+function findServerOnlyViolations(src) {
+  const out = [];
+  let m;
+  IMPORT_RE.lastIndex = 0;
+  while (m = IMPORT_RE.exec(src)) {
+    const spec = m[2];
+    if (spec === "lib" || spec.startsWith("lib/")) {
+      out.push(spec);
+      continue;
+    }
+    if (isClientImportSpecifier(spec)) continue;
+    if (spec.startsWith("@tw/")) {
+      if (BUILTIN_CLIENT_OK_SPECIFIERS.includes(spec)) continue;
+      if (RUNTIME_CLIENT_OK_SPECIFIERS.includes(spec)) continue;
+      out.push(spec);
+      continue;
+    }
+    if (spec.startsWith("@./") || spec.startsWith("./") || spec.startsWith("../")) {
+      if (/\.(tw|tss)$/.test(spec)) continue;
+      out.push(spec);
+      continue;
+    }
+    if (spec.startsWith("lib/")) out.push(spec);
+  }
+  return out;
+}
+function contentHash2(s) {
+  let h = 5381;
+  for (let i = 0; i < s.length; i++) h = (h * 33 ^ s.charCodeAt(i)) >>> 0;
+  return h.toString(36);
+}
+function vendoredRuntimeClient() {
+  const fromSrc = new URL("../../dist/tw-runtime-client.mjs", import.meta.url).pathname;
+  if (existsSync7(fromSrc)) return fromSrc;
+  const fromBundle = new URL("./tw-runtime-client.mjs", import.meta.url).pathname;
+  if (existsSync7(fromBundle)) return fromBundle;
+  return null;
+}
+function rewriteRuntimeSpecifier(importLine) {
+  const vendored = vendoredRuntimeClient();
+  if (!vendored) return importLine;
+  const m = importLine.match(/from\s+["'](@tw\/runtime)["']/);
+  if (!m) return importLine;
+  return importLine.replace(m[0], `from ${JSON.stringify(vendored)}`);
+}
+function buildClientChunk(rootDir, importLine, minify) {
+  if (!importLine) return "";
+  const cached = chunkCache.get(importLine);
+  if (cached && existsSync7(join11(rootDir, ".tw", cached))) return cached;
+  const jsDir = join11(rootDir, ".tw", "js");
+  mkdirSync4(jsDir, { recursive: true });
+  const names = importNames(importLine);
+  const entryLine = rewriteRuntimeSpecifier(importLine);
+  const entry = [
+    entryLine + ";",
+    "globalThis.__twClient = globalThis.__twClient || {};",
+    ...names.map((n) => "globalThis.__twClient." + n + " = " + n + ";")
+  ].join("\n");
+  const stamp = contentHash2(importLine);
+  const entryPath = join11(rootDir, ".tw", ".chunk-entry-" + stamp + ".js");
+  const tmpOut = join11(rootDir, ".tw", ".chunk-tmp-" + stamp + ".js");
+  writeFileSync4(entryPath, entry);
+  const bin = findEsbuildBin(rootDir);
+  const args = [entryPath, "--bundle", "--format=iife", "--target=es2019", "--outfile=" + tmpOut];
+  if (minify) args.push("--minify");
+  const r = spawnSync2(bin, args, { cwd: rootDir });
+  try {
+    unlinkSync2(entryPath);
+  } catch {
+  }
+  if (r.status !== 0) {
+    const errText = (r.stderr && r.stderr.toString ? r.stderr.toString() : "") || String(r.error || "unknown");
+    console.error("  [tw] client chunk failed (" + importLine + "): " + errText.split("\n")[0]);
+    try {
+      unlinkSync2(tmpOut);
+    } catch {
+    }
+    return "";
+  }
+  const code = readFileSync6(tmpOut, "utf-8");
+  const url = "js/c-" + contentHash2(code) + ".js";
+  writeFileSync4(join11(rootDir, ".tw", url), code);
+  try {
+    unlinkSync2(tmpOut);
+  } catch {
+  }
+  chunkCache.set(importLine, url);
+  return url;
+}
+function buildPageScope(rootDir, ownImportLines) {
+  if (!ownImportLines || ownImportLines.length === 0) return "";
+  const names = ownImportLines.flatMap((l) => importNames(l));
+  if (names.length === 0) return "";
+  mkdirSync4(join11(rootDir, ".tw", "js"), { recursive: true });
+  const body = names.map((n) => "p." + n + " = g.__twClient." + n + ";").join("\n");
+  const code = "(function(g){g.__twClient=g.__twClient||{};var p={};\n" + body + "\ng.__twClient.$page=p;})(globalThis);\n";
+  const url = "js/p-" + contentHash2(names.slice().sort().join("|")) + ".js";
+  writeFileSync4(join11(rootDir, ".tw", url), code);
+  return url;
+}
+var IMPORT_RE, BUILTIN_CLIENT_OK_SPECIFIERS, RUNTIME_CLIENT_OK_SPECIFIERS, chunkCache;
+var init_client_bundle = __esm({
+  "tw/commands/client-bundle.ts"() {
+    IMPORT_RE = /^[ \t]*import\s+([^\n]+?)\s+from\s+["'']([^"'']+)["''][; \t]*$/gm;
+    BUILTIN_CLIENT_OK_SPECIFIERS = ["@tw/optImage", "@tw/RouterLink"];
+    RUNTIME_CLIENT_OK_SPECIFIERS = ["@tw/runtime"];
+    chunkCache = /* @__PURE__ */ new Map();
+  }
+});
+
+// ../../packages/server/tw/routing/revalidate.ts
+function setActivePipeline(p) {
+  activePipeline = p;
+}
+function getActivePipeline() {
+  return activePipeline;
+}
+function revalidatePath(pathname, opts) {
+  return activePipeline ? activePipeline.revalidatePath(pathname, opts) : 0;
+}
+function registerTwmTagInvalidator(fn) {
+  twmTagInvalidator = fn;
+}
+function revalidateTag(tag) {
+  let dropped = 0;
+  if (activePipeline) dropped += activePipeline.revalidateTag(tag);
+  if (twmTagInvalidator) dropped += twmTagInvalidator(tag);
+  return dropped;
+}
+var activePipeline, twmTagInvalidator;
+var init_revalidate = __esm({
+  "../../packages/server/tw/routing/revalidate.ts"() {
+    activePipeline = null;
+    twmTagInvalidator = null;
+  }
+});
+
+// ../../packages/server/tw/routing/signal-stream.ts
+var signal_stream_exports = {};
+__export(signal_stream_exports, {
+  SignalHub: () => SignalHub,
+  createSignalStream: () => createSignalStream,
+  getSignalHub: () => getSignalHub,
+  setSignal: () => setSignal,
+  sseFrameWithId: () => sseFrameWithId,
+  writeSignalFromClient: () => writeSignalFromClient
+});
+function getSignalHub() {
+  if (!hub) hub = new SignalHub();
+  return hub;
+}
+function setSignal(name, value, opts) {
+  let session = opts?.session;
+  if (!session && opts?.request) {
+    try {
+      const cookies = opts.request.cookies;
+      if (cookies && typeof cookies.get === "function") {
+        session = cookies.get("tw_session") ?? void 0;
+      } else {
+        const header = opts.request.headers?.get?.("cookie") ?? "";
+        const m = /(?:^|;\s*)tw_session=([^;]+)/.exec(header);
+        if (m) session = decodeURIComponent(m[1].trim().replace(/^"|"$/g, ""));
+      }
+    } catch {
+    }
+  }
+  return getSignalHub().setSignal(name, value, session ? { session } : void 0);
+}
+function sseFrameWithId(payload) {
+  try {
+    const seq = JSON.parse(payload).seq;
+    if (typeof seq === "number") return "id: " + seq + "\ndata: " + payload + "\n\n";
+  } catch {
+  }
+  return "data: " + payload + "\n\n";
+}
+function createSignalStream(request, url, opts) {
+  const hub2 = getSignalHub();
+  if (opts && !hub2.__cfg) {
+    hub2.__cfg = true;
+    try {
+      hub2.configure({ maxClients: opts.maxClients, maxHistory: opts.maxHistory });
+    } catch {
+    }
+  }
+  if (url.searchParams.get("stats")) {
+    return new Response(JSON.stringify(hub2.getStats(), null, 2), {
+      status: 200,
+      headers: { "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store" }
+    });
+  }
+  if (!hub2.canAcceptClient()) {
+    return new Response("Too many signal-stream connections", {
+      status: 503,
+      headers: { "Content-Type": "text/plain", "Retry-After": "5" }
+    });
+  }
+  const names = (url.searchParams.get("s") ?? "").split(",").map((x) => x.trim()).filter(Boolean);
+  let since = Number(url.searchParams.get("since") ?? "0") || 0;
+  if (!since) {
+    const lei = Number(request.headers.get("last-event-id") ?? "0") || 0;
+    if (lei) since = lei;
+  }
+  const declared = /* @__PURE__ */ new Map();
+  for (const n of names) declared.set(n, "public");
+  let session;
+  try {
+    const header = request.headers.get("cookie") ?? "";
+    const m = /(?:^|;\s*)tw_session=([^;]+)/.exec(header);
+    if (m) session = decodeURIComponent(m[1].trim().replace(/^"|"$/g, ""));
+  } catch {
+  }
+  const enc = new TextEncoder();
+  const sse = (payload) => enc.encode(sseFrameWithId(payload));
+  let registered = null;
+  let keepAlive = null;
+  const stream = new ReadableStream({
+    start(controller) {
+      const client = hub2.register(declared, session);
+      registered = client;
+      const cleanup = () => {
+        if (keepAlive) clearInterval(keepAlive);
+        hub2.unregister(client.id);
+        try {
+          controller.close();
+        } catch {
+        }
+      };
+      client.send = (payload) => {
+        try {
+          controller.enqueue(sse(payload));
+        } catch {
+          cleanup();
+        }
+      };
+      client.close = cleanup;
+      for (const payload of hub2.connectPayloads(since, declared, session)) {
+        try {
+          controller.enqueue(sse(payload));
+        } catch {
+          break;
+        }
+      }
+      keepAlive = setInterval(() => {
+        try {
+          controller.enqueue(enc.encode(": keep-alive\n\n"));
+        } catch {
+          cleanup();
+        }
+      }, 25e3);
+    },
+    // v2: when the browser drops the connection (tab close, network
+    // loss) cancel fires -- remove THIS hub entry immediately instead
+    // of waiting for the next failed send.
+    cancel() {
+      if (keepAlive) clearInterval(keepAlive);
+      try {
+        registered?.close?.();
+      } catch {
+      }
+    }
+  });
+  return new Response(stream, {
+    status: 200,
+    headers: {
+      "Content-Type": "text/event-stream; charset=utf-8",
+      "Cache-Control": "no-store",
+      "X-Accel-Buffering": "no",
+      Connection: "keep-alive"
+    }
+  });
+}
+async function writeSignalFromClient(request, opts) {
+  if (!opts?.clientWrites) {
+    return new Response(JSON.stringify({ error: "client signal writes are disabled" }), {
+      status: 403,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  let body = null;
+  try {
+    body = await request.json();
+  } catch {
+  }
+  const name = body?.name;
+  if (typeof name !== "string" || !("value" in (body ?? {}))) {
+    return new Response(JSON.stringify({ error: "body must be { name, value }" }), {
+      status: 400,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  const hub2 = getSignalHub();
+  const kind = (hub2.getStats().signals ?? {})[name];
+  if (kind && kind !== "public") {
+    return new Response(JSON.stringify({ error: "only public signals are client-writable" }), {
+      status: 403,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  const res = hub2.setSignal(name, body.value);
+  if (!res.queued) {
+    return new Response(JSON.stringify({ error: res.error ?? "rejected" }), {
+      status: 400,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  return new Response(JSON.stringify({ ok: true, kind: res.kind }), {
+    status: 202,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+var BATCH_MS, HISTORY_LIMIT, MAX_CLIENTS, MAX_VALUE_BYTES, MAX_NAME_LEN, NAME_RE, SignalHub, hub;
+var init_signal_stream = __esm({
+  "../../packages/server/tw/routing/signal-stream.ts"() {
+    BATCH_MS = 100;
+    HISTORY_LIMIT = 1e3;
+    MAX_CLIENTS = 500;
+    MAX_VALUE_BYTES = 64 * 1024;
+    MAX_NAME_LEN = 64;
+    NAME_RE = /^[A-Za-z0-9_$.-]{1,64}$/;
+    SignalHub = class {
+      clients = /* @__PURE__ */ new Map();
+      nextClientId = 1;
+      seq = 0;
+      values = /* @__PURE__ */ new Map();
+      kinds = /* @__PURE__ */ new Map();
+      history = [];
+      pending = /* @__PURE__ */ new Map();
+      pendingSession;
+      timer = null;
+      // v2 stats + caps
+      maxClients = MAX_CLIENTS;
+      createdAt = Date.now();
+      totalUpdates = 0;
+      batchesFlushed = 0;
+      rejectedCount = 0;
+      /** v2: configure caps (from tw.config.ts signalStream options). */
+      configure(opts) {
+        if (opts?.maxClients && opts.maxClients > 0) this.maxClients = opts.maxClients;
+        if (opts?.maxHistory && opts.maxHistory > 0) this.historyLimit = opts.maxHistory;
+      }
+      historyLimit = HISTORY_LIMIT;
+      /** v2: observability for /_tw/stream?stats=1 and window.__tw stats. */
+      getStats() {
+        const signals = {};
+        for (const [n, k] of this.kinds) signals[n] = k;
+        return {
+          clients: this.clients.size,
+          clientCap: this.maxClients,
+          seq: this.seq,
+          signals,
+          valueCount: this.values.size,
+          history: this.history.length,
+          historyCap: this.historyLimit,
+          pending: this.pending.size,
+          totalUpdates: this.totalUpdates,
+          batchesFlushed: this.batchesFlushed,
+          rejected: this.rejectedCount,
+          uptimeMs: Date.now() - this.createdAt
+        };
+      }
+      /** v2: graceful shutdown -- close every connected stream now. */
+      closeAll() {
+        for (const c of [...this.clients.values()]) {
+          try {
+            c.close();
+          } catch {
+          }
+        }
+        this.clients.clear();
+        if (this.timer != null) {
+          clearTimeout(this.timer);
+          this.timer = null;
+        }
+        this.pending.clear();
+      }
+      /** v2: connection cap check BEFORE registering a stream client. */
+      canAcceptClient() {
+        return this.clients.size < this.maxClients;
+      }
+      /** v2: validate a setSignal name/value without throwing. */
+      validateSignal(name, value) {
+        if (typeof name !== "string" || name.length === 0 || name.length > MAX_NAME_LEN) {
+          return "signal name must be 1-" + MAX_NAME_LEN + " chars";
+        }
+        if (!NAME_RE.test(name)) return "signal name has invalid characters";
+        if (value === void 0) return "signal value is undefined";
+        try {
+          const size = typeof value === "string" ? value.length : JSON.stringify(value)?.length ?? 0;
+          if (size > MAX_VALUE_BYTES) return "signal value exceeds " + MAX_VALUE_BYTES + " bytes";
+        } catch {
+          return "signal value is not serializable";
+        }
+        return null;
+      }
+      /**
+       * Server-side mutation (route handlers): queue an update, batch-flush.
+       * With `session` (derived from the request's tw_session cookie) private
+       * signals are delivered only to clients authenticated as that session.
+       */
+      setSignal(name, value, opts) {
+        const invalid = this.validateSignal(name, value);
+        if (invalid) {
+          this.rejectedCount++;
+          return { queued: false, kind: this.kinds.get(name), error: invalid };
+        }
+        const kind = this.kinds.get(name) ?? "public";
+        this.values.set(name, value);
+        this.kinds.set(name, kind);
+        this.pending.set(name, value);
+        if (opts?.session) this.pendingSession = opts.session;
+        if (this.timer == null) {
+          this.timer = setTimeout(() => this.flush(), BATCH_MS);
+        }
+        return { queued: true, kind };
+      }
+      /** Latest known values (also used for fresh snapshots). */
+      snapshot() {
+        return { seq: this.seq, snapshot: Object.fromEntries(this.values) };
+      }
+      register(declared, session) {
+        const id = this.nextClientId++;
+        for (const [name, kind] of declared) {
+          if (!this.kinds.has(name)) this.kinds.set(name, kind);
+        }
+        const client = {
+          id,
+          declared,
+          session,
+          send: () => {
+          },
+          close: () => this.clients.delete(id)
+        };
+        this.clients.set(id, client);
+        return client;
+      }
+      /** v2: remove a stream client (its connection died / was cancelled).
+       *  The old handler overwrote client.close() with a closure that only
+       *  closed the controller -- the Map entry leaked forever, so every
+       *  disconnected browser still occupied a slot (and got flushed frames).
+       */
+      unregister(id) {
+        this.clients.delete(id);
+      }
+      /** Build the replay/snapshot preamble for a connecting client. */
+      connectPayloads(since, declared, session) {
+        const out = [];
+        if (since <= 0 && this.values.size > 0) {
+          const snap = {};
+          for (const [name, value] of this.values) {
+            if (this.sessionMatches(session, { names: [name], session: this.valueSessions.get(name) }) && this.deliversTo(declared, [name])) snap[name] = value;
+          }
+          if (Object.keys(snap).length > 0) {
+            out.push(this.frame({ v: 1, seq: this.seq, snapshot: snap }));
+          }
+          return out;
+        }
+        const hasCoverage = since <= this.seq && this.history.length > 0 && since >= this.history[0].seq - 1;
+        if (hasCoverage) {
+          for (const entry of this.history) {
+            if (entry.seq > since && this.sessionMatches(session, entry) && this.deliversTo(declared, entry.names)) {
+              out.push(entry.payload);
+            }
+          }
+        } else if (this.values.size > 0) {
+          const snap = {};
+          for (const [name, value] of this.values) {
+            if (this.sessionMatches(session, { names: [name], session: this.valueSessions.get(name) }) && this.deliversTo(declared, [name])) snap[name] = value;
+          }
+          if (Object.keys(snap).length > 0) {
+            out.push(this.frame({ v: 1, seq: this.seq, snapshot: snap }));
+          }
+        }
+        return out;
+      }
+      /** latest-known session per signal (for snapshot filtering) */
+      valueSessions = /* @__PURE__ */ new Map();
+      sessionMatches(clientSession, entry) {
+        if (!entry.session) return true;
+        return entry.session === clientSession;
+      }
+      deliversTo(declared, names) {
+        return names.some((n) => {
+          const kind = this.kinds.get(n) ?? "public";
+          return kind === "public" || declared.has(n);
+        });
+      }
+      flush() {
+        this.timer = null;
+        if (this.pending.size === 0) return;
+        const updates = [...this.pending.entries()];
+        const session = this.pendingSession;
+        this.pending.clear();
+        this.pendingSession = void 0;
+        this.seq++;
+        const names = updates.map(([n]) => n);
+        for (const [n] of updates) this.valueSessions.set(n, session);
+        const payload = this.frame({ v: 1, seq: this.seq, updates });
+        this.history.push({ seq: this.seq, payload, names, session });
+        this.totalUpdates += updates.length;
+        this.batchesFlushed++;
+        if (this.history.length > this.historyLimit) this.history.shift();
+        for (const client of this.clients.values()) {
+          if (this.sessionMatches(client.session, { names, session }) && this.deliversTo(client.declared, names)) client.send(payload);
+        }
+      }
+      frame(obj) {
+        return JSON.stringify(obj).replace(/</g, "\\u003c");
+      }
+    };
+    hub = null;
+  }
+});
+
 // ../../packages/server/tw/websocket-manager.ts
 var DEFAULT_MAX_ROOMS, DEFAULT_MAX_ROOM_SIZE, WebSocketManager;
 var init_websocket_manager = __esm({
@@ -41096,7 +41978,8 @@ function extractRenderMode(page) {
   try {
     const fs = __require("node:fs");
     const source = fs.readFileSync(page.absolutePath, "utf-8");
-    const m = source.match(/render\s+(static|ssr|island|edge)/);
+    const { maskSourceStringsAndComments: maskSourceStringsAndComments2 } = (init_tw(), __toCommonJS(tw_exports));
+    const m = maskSourceStringsAndComments2(source).match(/render\s+(static|ssr|island|edge)/);
     if (m) {
       return m[1];
     }
@@ -41543,6 +42426,7 @@ var init_render_pipeline = __esm({
     init_twm_loader();
     init_scanner();
     init_layout_chain();
+    init_signal_stream();
     init_helpers();
     init_tw6();
     init_twm_loader();
@@ -41696,6 +42580,17 @@ var init_render_pipeline = __esm({
         try {
           const pageState = { ...stateVars ?? {}, ...match.params ?? {}, params: match.params ?? {} };
           const requestVarKeys = new Set(Object.keys({ ...stateVars ?? {}, ...match.params ?? {} }));
+          try {
+            const hub2 = getSignalHub();
+            const snap = hub2.snapshot();
+            if (snap && snap.snapshot && typeof snap.snapshot === "object") {
+              for (const [k, v] of Object.entries(snap.snapshot)) {
+                pageState[k] = v;
+                requestVarKeys.add(k);
+              }
+            }
+          } catch {
+          }
           const pageCompiled = this.compileFile(ctx.page, pageState);
           {
             const seed = pageCompiled.stateSeed;
@@ -41741,24 +42636,30 @@ var init_render_pipeline = __esm({
           let layoutTitle;
           const liftedParts = [];
           {
-            for (const headMatch of bodyHTML.matchAll(/<head[^>]*>([\s\S]*?)<\/head>/gi)) {
+            const collectedTitles = [];
+            for (const headMatch of bodyHTML.matchAll(/<head(?:\s[^>]*)?>([\s\S]*?)<\/head\s*>/gi)) {
               const headInner = headMatch[1];
               const tMatch = headInner.match(/<title>([^<]*)<\/title>/i);
-              if (tMatch) layoutTitle = tMatch[1].trim();
-              const kids = headInner.replace(/<title>[^<]*<\/title>/gi, "").replace(/<meta[^>]+charset[^>]*>/gi, "").replace(/<meta[^>]+viewport[^>]*>/gi, "").trim();
+              if (tMatch) collectedTitles.push(tMatch[1].trim().replace(/&(amp|lt|gt|quot);/g, (m, k) => k === "amp" ? String.fromCharCode(38) : k === "lt" ? String.fromCharCode(60) : k === "gt" ? String.fromCharCode(62) : String.fromCharCode(34)));
+              else collectedTitles.push("");
+              const kids = headInner.replace(/<title>[^<]*<\/title>/gi, "").replace(/<meta[^>]+charset[^>]*>/gi, "").replace(/<meta[^>]+viewport[^>]*>/gi, "").replace(/<meta[^>]+generator[^>]*>/gi, "").trim();
               if (kids) liftedParts.push(kids);
             }
-            bodyHTML = bodyHTML.replace(/<head[^>]*>[\s\S]*?<\/head>/gi, "");
+            bodyHTML = bodyHTML.replace(/<head(?:\s[^>]*)?>[\s\S]*?<\/head\s*>/gi, "");
+            const templateTitle = collectedTitles.find((t2) => t2.includes("__TW_PAGETITLE__"));
+            layoutTitle = templateTitle ?? collectedTitles.filter(Boolean).pop();
             bodyHTML = bodyHTML.replace(/<\/?(?:html|body)[^>]*>/gi, "");
             bodyHTML = bodyHTML.replace(/<!DOCTYPE[^>]*>/gi, "");
           }
           const liftedHead = liftedParts.join("\n");
-          if (ctx.error) {
+          const liveRenderMode = this.extractRenderMode(ctx.page);
+          if (ctx.error && (liveRenderMode === "ssr" || liveRenderMode === "stream")) {
             const errorCompiled = this.compileFile(ctx.error);
             allCSS = errorCompiled.css + "\n" + allCSS;
             bodyHTML = `<div data-error-boundary>${bodyHTML}</div>`;
           }
-          if (ctx.loading) {
+          const needsSkeleton = bodyHTML.includes("data-tw-suspense") || bodyHTML.includes("data-tw-ppr");
+          if (ctx.loading && needsSkeleton) {
             const loadingCompiled = this.compileFile(ctx.loading);
             allCSS = loadingCompiled.css + "\n" + allCSS;
             let lh = String(loadingCompiled.html || "");
@@ -41770,7 +42671,7 @@ ${bodyHTML}`;
           const pageTitle = this.extractTitle(ctx.page) || "TW Page";
           let title = pageTitle;
           if (layoutTitle !== void 0) {
-            title = layoutTitle.replace(/\{\s*page\.title\s*\}/g, pageTitle);
+            title = layoutTitle.replace(/__TW_PAGETITLE__/g, pageTitle).replace(/\{\s*page\.title\s*\}/g, pageTitle);
             if (!title.trim()) title = pageTitle;
           }
           const metaTags = this.buildMetaTags(ctx.page);
@@ -41784,13 +42685,15 @@ ${bodyHTML}`;
             for (const hp of headCandidates) {
               const headCompiled = this.compileFile({ absolutePath: hp, type: "head" });
               const m = headCompiled.html.match(/<body>([\s\S]*)<\/body>/);
-              if (m && m[1].trim()) headExtra += m[1].trim() + "\n";
+              if (m && m[1].trim()) headExtra += m[1].trim().replace(/\\([{}])/g, "$1") + "\n";
             }
             if (liftedHead) headExtra += liftedHead + "\n";
           } catch {
           }
           let fullHTML = this.assembleHTML(bodyHTML, allCSS, allJS, title, metaTags + headExtra);
-          if (!/__tw_runtime\.js/.test(fullHTML)) {
+          const pageRenderMode = this.extractRenderMode(ctx.page);
+          const needsClientRuntime = /data-tw-event|data-tw-i|__TW_SIGNALS__|data-tw-suspense|data-tw-ppr/.test(fullHTML) || pageRenderMode === "csr" || pageRenderMode === "stream" || pageRenderMode === "ppr" || pageRenderMode === "signalStream";
+          if (needsClientRuntime && !/__tw_runtime\.js/.test(fullHTML)) {
             let stateSeed = "{}";
             try {
               stateSeed = JSON.stringify(pageState ?? {});
@@ -41909,7 +42812,8 @@ ${bodyHTML}`;
           throw new Error(`Route file not found: ${file.absolutePath}`);
         }
         const source = readFileSync7(file.absolutePath, "utf-8");
-        const result = compileSync(source, {
+        const srcWithSentinel = source.replace(/\{\s*page\.title\s*\}/g, "__TW_PAGETITLE__");
+        const result = compileSync(srcWithSentinel, {
           filePath: file.absolutePath,
           optimize: true,
           diagnostics: false,
@@ -41982,8 +42886,14 @@ ${bodyHTML}`;
       extractTitle(file) {
         try {
           const source = readFileSync7(file.absolutePath, "utf-8");
-          const m = source.match(/page\s*\{[^}]*title\s+"([^"]+)"/);
-          return m ? m[1] : null;
+          const masked = maskSourceStringsAndComments(source);
+          const m = masked.match(/page\s*\{[^}]*title\s/);
+          if (!m || m.index === void 0) return null;
+          const start = m.index + m[0].length;
+          if (source[start] !== '"') return null;
+          const end = source.indexOf('"', start + 1);
+          if (end === -1 || end === start + 1) return null;
+          return source.slice(start + 1, end).replace(/\\([{}"])/g, "$1");
         } catch {
           return null;
         }
@@ -41997,7 +42907,9 @@ ${bodyHTML}`;
       extractRenderMode(file) {
         try {
           const src = readFileSync7(file.absolutePath, "utf8");
-          const m = /render\s+(static|ssr|island|edge|csr|stream|ppr)\b/.exec(src);
+          const m = /render\s+(static|ssr|island|edge|csr|stream|ppr)\b/.exec(
+            maskSourceStringsAndComments(src)
+          );
           return m ? m[1] : "static";
         } catch {
           return "static";
@@ -42030,7 +42942,8 @@ ${bodyHTML}`;
        *     render-cache never reads `stale`.
        */
       stampCacheHeaders(headers, entry, now, verdict) {
-        const out = { ...headers ?? {}, "x-tw-cache": verdict };
+        const out = { ...headers ?? {} };
+        if (process.env.TW_DEBUG_CACHE || process.env.NODE_ENV === "test") out["x-tw-cache"] = verdict;
         const c = entry?.cache;
         if (c) {
           const ageSec = entry?.createdAt ? Math.max(0, Math.floor((now - entry.createdAt) / 1e3)) : 0;
@@ -42045,7 +42958,7 @@ ${bodyHTML}`;
       extractRevalidate(file) {
         try {
           const source = readFileSync7(file.absolutePath, "utf-8");
-          const m = source.match(/page\s*\{[^}]*revalidate\s+(\d+)/);
+          const m = maskSourceStringsAndComments(source).match(/page\s*\{[^}]*revalidate\s+(\d+)/);
           if (m) {
             const n = Number(m[1]);
             return Number.isFinite(n) && n > 0 ? n : null;
@@ -42091,14 +43004,32 @@ ${bodyHTML}`;
       buildMetaTags(file) {
         try {
           const source = readFileSync7(file.absolutePath, "utf-8");
-          const fm = source.match(/page\s*\{([^}]*)\}/);
-          if (!fm) return "";
-          const body = fm[1];
+          const masked = maskSourceStringsAndComments(source);
+          const fm = masked.match(/page\s*\{/);
+          if (!fm || fm.index === void 0) return "";
+          const bodyStart = fm.index + fm[0].length;
+          const bodyEnd = masked.indexOf("}", bodyStart);
+          if (bodyEnd === -1) return "";
+          const body = source.slice(bodyStart, bodyEnd);
           const AMP = String.fromCharCode(38);
           const esc = (v) => v.split(AMP).join(AMP + "amp;").split(String.fromCharCode(34)).join(AMP + "quot;").split("<").join(AMP + "lt;");
           const pick = (key) => {
-            const m = body.match(new RegExp(key + '\\s+"([^"]*)"'));
-            return m ? m[1] : null;
+            const i = body.indexOf(key + ' "');
+            if (i === -1) return null;
+            const rest = body.slice(i + key.length + 2);
+            let end = -1;
+            for (let j = 0; j < rest.length; j++) {
+              if (rest[j] === "\\") {
+                j++;
+                continue;
+              }
+              if (rest[j] === '"') {
+                end = j;
+                break;
+              }
+            }
+            if (end === -1) return null;
+            return rest.slice(0, end).replace(/\\([{}"])/g, "$1");
           };
           let tags = "";
           const description = pick("description");
@@ -43546,7 +44477,6 @@ function securityHeadersMiddleware() {
   return (req, res, next) => {
     res.headers.set("X-Content-Type-Options", "nosniff");
     res.headers.set("X-Frame-Options", "SAMEORIGIN");
-    res.headers.set("X-XSS-Protection", "1; mode=block");
     res.headers.set("X-Permitted-Cross-Domain-Policies", "none");
     res.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
     res.headers.set("Cross-Origin-Opener-Policy", "same-origin");
@@ -43723,13 +44653,15 @@ function compressionMiddleware() {
     await next();
   };
 }
-function securityHeadersMiddleware2() {
+function securityHeadersMiddleware2(opts) {
   return async (ctx, next) => {
     ctx.headers["x-content-type-options"] = "nosniff";
     ctx.headers["x-frame-options"] = "DENY";
-    ctx.headers["x-xss-protection"] = "1; mode=block";
     ctx.headers["referrer-policy"] = "strict-origin-when-cross-origin";
     ctx.headers["permissions-policy"] = "camera=(), microphone=(), geolocation=()";
+    if (opts?.csp !== false && !ctx.headers["content-security-policy"]) {
+      ctx.headers["content-security-policy"] = typeof opts?.csp === "string" ? opts.csp : "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'";
+    }
     await next();
   };
 }
@@ -43812,6 +44744,161 @@ var init_middleware2 = __esm({
   }
 });
 
+// ../../packages/server/tw/compression.ts
+function shouldCompress(contentType, options = {}) {
+  const opts = { ...DEFAULT_OPTIONS4, ...options };
+  const ct = contentType.split(";")[0].trim();
+  return opts.contentTypes.includes(ct);
+}
+function isLargeEnough(size, options = {}) {
+  const opts = { ...DEFAULT_OPTIONS4, ...options };
+  return size >= opts.threshold;
+}
+async function compress(data, encoding = "gzip", options = {}) {
+  const opts = { ...DEFAULT_OPTIONS4, ...options };
+  const input = typeof data === "string" ? new TextEncoder().encode(data) : data;
+  if (input.length < opts.threshold) {
+    return input;
+  }
+  try {
+    if (typeof Bun !== "undefined" && Bun.gzipSync) {
+      if (encoding === "gzip") return Bun.gzipSync(input, { level: opts.level });
+      if (encoding === "deflate" && Bun.deflateSync) return Bun.deflateSync(input, { level: opts.level });
+    }
+  } catch {
+  }
+  try {
+    const zlib2 = await import("node:zlib");
+    if (encoding === "gzip") {
+      return zlib2.gzipSync(input, { level: opts.level });
+    }
+    if (encoding === "deflate") {
+      return zlib2.deflateSync(input, { level: opts.level });
+    }
+    if (encoding === "brotli" && zlib2.brotliCompressSync) {
+      return zlib2.brotliCompressSync(input, {
+        params: {
+          [zlib2.constants.BROTLI_PARAM_QUALITY]: opts.level
+        }
+      });
+    }
+  } catch {
+  }
+  return input;
+}
+async function decompress(data, encoding = "gzip") {
+  try {
+    if (typeof Bun !== "undefined" && Bun.gunzipSync) {
+      if (encoding === "gzip") return Bun.gunzipSync(data);
+      if (encoding === "deflate" && Bun.inflateSync) return Bun.inflateSync(data);
+    }
+  } catch {
+  }
+  try {
+    const zlib2 = await import("node:zlib");
+    if (encoding === "gzip") return zlib2.gunzipSync(data);
+    if (encoding === "deflate") return zlib2.inflateSync(data);
+    if (encoding === "brotli" && zlib2.brotliDecompressSync) return zlib2.brotliDecompressSync(data);
+  } catch {
+  }
+  return data;
+}
+function negotiateEncoding(acceptEncoding) {
+  const encodings = acceptEncoding.split(",").map((e) => e.trim().split(";")[0].trim()).filter(Boolean);
+  if (encodings.includes("br")) return "brotli";
+  if (encodings.includes("gzip")) return "gzip";
+  if (encodings.includes("deflate")) return "deflate";
+  return null;
+}
+function createCompressionHeaders(encoding, originalSize, compressedSize) {
+  return {
+    "Content-Encoding": encoding === "brotli" ? "br" : encoding,
+    "Vary": "Accept-Encoding",
+    "X-Original-Size": String(originalSize),
+    "X-Compressed-Size": String(compressedSize),
+    "X-Compression-Ratio": originalSize > 0 ? `${((1 - compressedSize / originalSize) * 100).toFixed(1)}%` : "0%"
+  };
+}
+async function compressResponse(body, contentType, acceptEncoding, options = {}) {
+  const input = typeof body === "string" ? new TextEncoder().encode(body) : body;
+  const opts = { ...DEFAULT_OPTIONS4, ...options };
+  if (!shouldCompress(contentType, opts) || !isLargeEnough(input.length, opts)) {
+    return { body: input, headers: {}, compressed: false };
+  }
+  const encoding = negotiateEncoding(acceptEncoding);
+  if (!encoding) {
+    return { body: input, headers: {}, compressed: false };
+  }
+  try {
+    const compressed = await compress(input, encoding, opts);
+    const headers = createCompressionHeaders(encoding, input.length, compressed.length);
+    return { body: compressed, headers, compressed: true };
+  } catch {
+    return { body: input, headers: {}, compressed: false };
+  }
+}
+var DEFAULT_OPTIONS4, StreamingCompressor;
+var init_compression = __esm({
+  "../../packages/server/tw/compression.ts"() {
+    DEFAULT_OPTIONS4 = {
+      level: 6,
+      threshold: 1024,
+      // Don't compress < 1KB
+      brotli: true,
+      contentTypes: [
+        "text/html",
+        "text/css",
+        "text/plain",
+        "text/javascript",
+        "application/javascript",
+        "application/json",
+        "application/xml",
+        "application/xhtml+xml",
+        "image/svg+xml",
+        "font/woff",
+        "font/woff2",
+        "application/wasm"
+      ]
+    };
+    StreamingCompressor = class {
+      chunks = [];
+      encoding;
+      options;
+      constructor(encoding = "gzip", options = {}) {
+        this.encoding = encoding;
+        this.options = { ...DEFAULT_OPTIONS4, ...options };
+      }
+      /**
+       * Add a chunk of data to be compressed.
+       */
+      push(data) {
+        const input = typeof data === "string" ? new TextEncoder().encode(data) : data;
+        this.chunks.push(input);
+      }
+      /**
+       * Flush all data and return compressed result.
+       */
+      async flush() {
+        const totalLength = this.chunks.reduce((sum, c) => sum + c.length, 0);
+        const combined = new Uint8Array(totalLength);
+        let offset = 0;
+        for (const chunk of this.chunks) {
+          combined.set(chunk, offset);
+          offset += chunk.length;
+        }
+        this.chunks = [];
+        return compress(combined, this.encoding, this.options);
+      }
+      /**
+       * Get the total uncompressed size so far.
+       */
+      get uncompressedSize() {
+        return this.chunks.reduce((sum, c) => sum + c.length, 0);
+      }
+    };
+  }
+});
+
 // ../../packages/server/tw/static/index.ts
 import { existsSync as existsSync11, statSync as statSync6 } from "node:fs";
 import { join as join15, extname as extname7, normalize as normalize2, resolve as resolve4, sep } from "node:path";
@@ -44021,7 +45108,7 @@ var init_policy = __esm({
           "Content-Security-Policy": this.build(),
           "X-Content-Type-Options": "nosniff",
           "X-Frame-Options": "DENY",
-          "X-XSS-Protection": "1; mode=block",
+          // BUG 48: x-xss-protection removed (deprecated, harmful in old browsers)
           "Referrer-Policy": "strict-origin-when-cross-origin",
           "Permissions-Policy": "geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()",
           "Cross-Origin-Opener-Policy": "same-origin",
@@ -48655,9 +49742,10 @@ function devSecurityHeaders() {
     removePoweredBy: true
   });
 }
-var DEFAULTS2, SecurityHeaders2;
+var BASELINE_CSP, DEFAULTS2, SecurityHeaders2;
 var init_security_headers = __esm({
   "../../packages/security/tw/headers/security-headers.ts"() {
+    BASELINE_CSP = "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'";
     DEFAULTS2 = {
       hstsMaxAge: 31536e3,
       // 1 year
@@ -48666,7 +49754,9 @@ var init_security_headers = __esm({
       frameOptions: "SAMEORIGIN",
       contentTypeOptions: true,
       referrerPolicy: "strict-origin-when-cross-origin",
-      xssProtection: "1; mode=block",
+      // v1.0.8 round 5 (BUG 48): x-xss-protection deprecated since 2019 --
+      // OFF by default now; opt back in with security.xssProtection.
+      xssProtection: void 0,
       removePoweredBy: true,
       coep: "unsafe-none",
       coop: "same-origin",
@@ -48722,6 +49812,9 @@ var init_security_headers = __esm({
         if (this.config.serverHeader) {
           headers["Server"] = this.config.serverHeader;
         }
+        if (this.config.csp !== false && !headers["Content-Security-Policy"]) {
+          headers["Content-Security-Policy"] = typeof this.config.csp === "string" ? this.config.csp : BASELINE_CSP;
+        }
         return headers;
       }
       /** Returns the security headers object. */
@@ -52932,161 +54025,6 @@ var init_ssr = __esm({
   }
 });
 
-// ../../packages/server/tw/compression.ts
-function shouldCompress(contentType, options = {}) {
-  const opts = { ...DEFAULT_OPTIONS4, ...options };
-  const ct = contentType.split(";")[0].trim();
-  return opts.contentTypes.includes(ct);
-}
-function isLargeEnough(size, options = {}) {
-  const opts = { ...DEFAULT_OPTIONS4, ...options };
-  return size >= opts.threshold;
-}
-async function compress(data, encoding = "gzip", options = {}) {
-  const opts = { ...DEFAULT_OPTIONS4, ...options };
-  const input = typeof data === "string" ? new TextEncoder().encode(data) : data;
-  if (input.length < opts.threshold) {
-    return input;
-  }
-  try {
-    if (typeof Bun !== "undefined" && Bun.gzipSync) {
-      if (encoding === "gzip") return Bun.gzipSync(input, { level: opts.level });
-      if (encoding === "deflate" && Bun.deflateSync) return Bun.deflateSync(input, { level: opts.level });
-    }
-  } catch {
-  }
-  try {
-    const zlib2 = await import("node:zlib");
-    if (encoding === "gzip") {
-      return zlib2.gzipSync(input, { level: opts.level });
-    }
-    if (encoding === "deflate") {
-      return zlib2.deflateSync(input, { level: opts.level });
-    }
-    if (encoding === "brotli" && zlib2.brotliCompressSync) {
-      return zlib2.brotliCompressSync(input, {
-        params: {
-          [zlib2.constants.BROTLI_PARAM_QUALITY]: opts.level
-        }
-      });
-    }
-  } catch {
-  }
-  return input;
-}
-async function decompress(data, encoding = "gzip") {
-  try {
-    if (typeof Bun !== "undefined" && Bun.gunzipSync) {
-      if (encoding === "gzip") return Bun.gunzipSync(data);
-      if (encoding === "deflate" && Bun.inflateSync) return Bun.inflateSync(data);
-    }
-  } catch {
-  }
-  try {
-    const zlib2 = await import("node:zlib");
-    if (encoding === "gzip") return zlib2.gunzipSync(data);
-    if (encoding === "deflate") return zlib2.inflateSync(data);
-    if (encoding === "brotli" && zlib2.brotliDecompressSync) return zlib2.brotliDecompressSync(data);
-  } catch {
-  }
-  return data;
-}
-function negotiateEncoding(acceptEncoding) {
-  const encodings = acceptEncoding.split(",").map((e) => e.trim().split(";")[0].trim()).filter(Boolean);
-  if (encodings.includes("br")) return "brotli";
-  if (encodings.includes("gzip")) return "gzip";
-  if (encodings.includes("deflate")) return "deflate";
-  return null;
-}
-function createCompressionHeaders(encoding, originalSize, compressedSize) {
-  return {
-    "Content-Encoding": encoding === "brotli" ? "br" : encoding,
-    "Vary": "Accept-Encoding",
-    "X-Original-Size": String(originalSize),
-    "X-Compressed-Size": String(compressedSize),
-    "X-Compression-Ratio": originalSize > 0 ? `${((1 - compressedSize / originalSize) * 100).toFixed(1)}%` : "0%"
-  };
-}
-async function compressResponse(body, contentType, acceptEncoding, options = {}) {
-  const input = typeof body === "string" ? new TextEncoder().encode(body) : body;
-  const opts = { ...DEFAULT_OPTIONS4, ...options };
-  if (!shouldCompress(contentType, opts) || !isLargeEnough(input.length, opts)) {
-    return { body: input, headers: {}, compressed: false };
-  }
-  const encoding = negotiateEncoding(acceptEncoding);
-  if (!encoding) {
-    return { body: input, headers: {}, compressed: false };
-  }
-  try {
-    const compressed = await compress(input, encoding, opts);
-    const headers = createCompressionHeaders(encoding, input.length, compressed.length);
-    return { body: compressed, headers, compressed: true };
-  } catch {
-    return { body: input, headers: {}, compressed: false };
-  }
-}
-var DEFAULT_OPTIONS4, StreamingCompressor;
-var init_compression = __esm({
-  "../../packages/server/tw/compression.ts"() {
-    DEFAULT_OPTIONS4 = {
-      level: 6,
-      threshold: 1024,
-      // Don't compress < 1KB
-      brotli: true,
-      contentTypes: [
-        "text/html",
-        "text/css",
-        "text/plain",
-        "text/javascript",
-        "application/javascript",
-        "application/json",
-        "application/xml",
-        "application/xhtml+xml",
-        "image/svg+xml",
-        "font/woff",
-        "font/woff2",
-        "application/wasm"
-      ]
-    };
-    StreamingCompressor = class {
-      chunks = [];
-      encoding;
-      options;
-      constructor(encoding = "gzip", options = {}) {
-        this.encoding = encoding;
-        this.options = { ...DEFAULT_OPTIONS4, ...options };
-      }
-      /**
-       * Add a chunk of data to be compressed.
-       */
-      push(data) {
-        const input = typeof data === "string" ? new TextEncoder().encode(data) : data;
-        this.chunks.push(input);
-      }
-      /**
-       * Flush all data and return compressed result.
-       */
-      async flush() {
-        const totalLength = this.chunks.reduce((sum, c) => sum + c.length, 0);
-        const combined = new Uint8Array(totalLength);
-        let offset = 0;
-        for (const chunk of this.chunks) {
-          combined.set(chunk, offset);
-          offset += chunk.length;
-        }
-        this.chunks = [];
-        return compress(combined, this.encoding, this.options);
-      }
-      /**
-       * Get the total uncompressed size so far.
-       */
-      get uncompressedSize() {
-        return this.chunks.reduce((sum, c) => sum + c.length, 0);
-      }
-    };
-  }
-});
-
 // ../../packages/server/tw/edge.ts
 function createEdgeHandler(config) {
   const cache = /* @__PURE__ */ new Map();
@@ -53507,6 +54445,13 @@ function generateSecurityHeaders(options = {}) {
   const headers = {};
   if (opts.csp) {
     headers["Content-Security-Policy"] = buildCSPHeader(opts.csp);
+    try {
+      const scriptSrc = Array.isArray(opts.csp["script-src"]) ? opts.csp["script-src"].join(" ") : String(opts.csp["script-src"] ?? "");
+      if (scriptSrc && !scriptSrc.includes("'unsafe-eval'") && !scriptSrc.includes("'strict-dynamic'")) {
+        console.warn("[tw] security: configured CSP has no 'unsafe-eval' in script-src -- the island hydration runtime needs it (add script-src: ['self', ''unsafe-eval''] or migrate handlers).");
+      }
+    } catch {
+    }
   }
   if (opts.hsts) {
     const hstsOpts = typeof opts.hsts === "object" ? opts.hsts : { maxAge: 31536e3, includeSubDomains: true };
@@ -53798,8 +54743,11 @@ var init_tw6 = __esm({
     init_tw2();
     init_websocket_manager();
     init_routing2();
+    init_twm_rules();
     init_router();
     init_middleware2();
+    init_compression();
+    init_signal_stream();
     init_static();
     init_tw5();
     init_ssr();
@@ -53848,6 +54796,7 @@ var init_tw6 = __esm({
       }
       ssr = null;
       server = null;
+      compressionMode = "off";
       isRunning = false;
       pluginManager = null;
       imageHandler = null;
@@ -53864,6 +54813,40 @@ var init_tw6 = __esm({
             const entries = Object.entries(cfgIn.redirects);
             cfgIn.redirects = entries.map(([from, to]) => typeof to === "string" ? { from, to } : { from, ...to });
           }
+          if (Array.isArray(cfgIn.redirects)) {
+            const REDIRECT_KNOWN = /* @__PURE__ */ new Set(["from", "to", "status", "source", "destination", "permanent"]);
+            let redirectDropped = false;
+            const normalizedRedirects = cfgIn.redirects.map((r) => {
+              if (!r || typeof r !== "object") return r;
+              let touched = false;
+              const mapped = { ...r };
+              if (mapped.from === void 0 && mapped.source !== void 0) {
+                mapped.from = mapped.source;
+                touched = true;
+              }
+              if (mapped.to === void 0 && mapped.destination !== void 0) {
+                mapped.to = mapped.destination;
+                touched = true;
+              }
+              if (mapped.status === void 0 && mapped.permanent !== void 0) {
+                mapped.status = mapped.permanent ? 301 : 302;
+                touched = true;
+              }
+              const unknown = Object.keys(mapped).filter((k) => !REDIRECT_KNOWN.has(k));
+              if (unknown.length > 0) {
+                console.warn("[tw] redirects: unrecognized field" + (unknown.length > 1 ? "s" : "") + " " + unknown.join(", ") + " in entry { from: " + JSON.stringify(mapped.from) + " } -- accepted fields: from, to, status");
+              }
+              if (typeof mapped.from !== "string" || typeof mapped.to !== "string") {
+                console.warn("[tw] redirects: entry missing from/to after normalization -- skipped (" + JSON.stringify(r).slice(0, 80) + ")");
+                redirectDropped = true;
+                return null;
+              }
+              return touched ? mapped : r;
+            }).filter((x) => x !== null || (redirectDropped = true));
+            if (redirectDropped || normalizedRedirects.some((x, i) => x !== cfgIn.redirects[i])) {
+              cfgIn.redirects = normalizedRedirects.filter(Boolean);
+            }
+          }
           if (cfgIn.headers && !Array.isArray(cfgIn.headers)) {
             const entries = Object.entries(cfgIn.headers);
             cfgIn.headers = entries.map(([source, headers]) => ({ source, headers }));
@@ -53881,6 +54864,12 @@ var init_tw6 = __esm({
           }
         }
         this.pluginManager = this.options.plugins ?? null;
+        {
+          const raw = this.options.compression ?? true;
+          if (raw === false || raw === "none" || raw === "off" || raw === "false") this.compressionMode = "off";
+          else if (raw === "gzip") this.compressionMode = "gzip";
+          else this.compressionMode = "brotli";
+        }
         try {
           this.imageHandler = createImageHandler({
             rootDir: this.options.rootDir,
@@ -53990,31 +54979,72 @@ var init_tw6 = __esm({
         if (existsSync13(middlewarePath)) {
           this.middlewarePath = middlewarePath;
           console.log("  Middleware: middleware.twm loaded");
+          try {
+            const src = readFileSync9(middlewarePath, "utf-8");
+            const rules = parseRules(src, "middleware.twm");
+            for (const r of rules) {
+              const conds = [];
+              if (r.userAgent) conds.push("user_agent");
+              if (r.path) conds.push("path");
+              if (r.auth) conds.push("auth");
+              if (r.rateLimit) conds.push("rate_limit");
+              if (r.origin) conds.push("origin");
+              if (r.methods && r.methods.length > 0) conds.push("methods");
+              const label = conds.length > 0 ? conds.join(" + ") : "no conditions -> every matching request gets this response";
+              console.log(`    \u2022 "${r.name}" [${label}]`);
+            }
+          } catch {
+          }
         }
         return this;
       }
       async start() {
         if (this.isRunning) return;
-        const { port, host } = this.options;
-        this.server = (typeof Bun !== "undefined" ? Bun : null)?.serve({
-          port,
-          hostname: host,
-          fetch: async (request) => {
-            const res = await this.handleRequest(request);
-            if (this.securityHeaders) {
-              try {
-                return this.securityHeaders.apply(res);
-              } catch {
-                return res;
+        const host = this.options.host ?? "0.0.0.0";
+        const wanted = this.options.port ?? 8e3;
+        let port = wanted;
+        let bound = null;
+        let lastErr = null;
+        for (let p = wanted; p < wanted + 10; p++) {
+          try {
+            bound = (typeof Bun !== "undefined" ? Bun : null)?.serve({
+              port: p,
+              hostname: host,
+              fetch: async (request) => {
+                const res = await this.handleRequest(request);
+                let withHeaders = res;
+                if (this.securityHeaders) {
+                  try {
+                    withHeaders = this.securityHeaders.apply(res);
+                  } catch {
+                    withHeaders = res;
+                  }
+                }
+                return this.compressResponse(withHeaders, request);
+              },
+              error: (err3) => {
+                console.error("Server error:", err3);
+                return new Response("Internal Server Error", { status: 500 });
               }
-            }
-            return res;
-          },
-          error: (err3) => {
-            console.error("Server error:", err3);
-            return new Response("Internal Server Error", { status: 500 });
+            });
+            port = p;
+            break;
+          } catch (e) {
+            lastErr = e;
+            const msg = String(e?.message ?? e);
+            if (!/address already in use|EADDRINUSE|Failed to start server/i.test(msg)) throw e;
+            if (p < wanted + 9) console.log(`  Port ${p} busy \u2014 trying ${p + 1}...`);
           }
-        });
+        }
+        if (!bound) {
+          console.error(`
+  ERROR: could not bind ${host} on ports ${wanted}\u2013${wanted + 9}.`);
+          console.error(`  ${lastErr?.message ?? lastErr}
+`);
+          throw lastErr ?? new Error("could not start server");
+        }
+        this.server = bound;
+        this.options.port = port;
         this.isRunning = true;
         console.log(`
   TW Server running at http://${host}:${port}
@@ -54028,6 +55058,10 @@ var init_tw6 = __esm({
       // finishes ongoing requests, then closes
       async gracefulShutdown(timeout = 5e3) {
         this.isRunning = false;
+        try {
+          getSignalHub().closeAll();
+        } catch {
+        }
         if (this.server) {
           this.server.stop?.(false);
           const start = Date.now();
@@ -54053,6 +55087,35 @@ var init_tw6 = __esm({
        *   - return { headers: {...} }  -> headers merged into the final response
        *   - return null/undefined      -> continue
        */
+      /** BUG 7 (v1.0.8): real response compression. `compression` in
+       * tw.config.ts was silently ignored -- the middleware was a no-op and
+       * nothing on the response path ever set Content-Encoding. */
+      async compressResponse(res, request) {
+        if (this.compressionMode === "off") return res;
+        try {
+          if (res.headers.get("content-encoding")) return res;
+          const ct = res.headers.get("content-type") || "";
+          if (ct.includes("text/event-stream")) return res;
+          if (res.__twRawStream) return res;
+          const buf = new Uint8Array(await res.arrayBuffer());
+          if (!isLargeEnough(buf.length)) return new Response(buf, { status: res.status, headers: res.headers });
+          const accept = request.headers.get("accept-encoding") || "";
+          let enc = negotiateEncoding(accept);
+          if (this.compressionMode === "gzip" && enc === "brotli") enc = "gzip";
+          if (!enc) return new Response(buf, { status: res.status, headers: res.headers });
+          const out = await compress(buf, enc);
+          if (out.length >= buf.length) return new Response(buf, { status: res.status, headers: res.headers });
+          const h = new Headers(res.headers);
+          h.set("Content-Encoding", enc === "brotli" ? "br" : enc);
+          h.set("Vary", "Accept-Encoding");
+          h.delete("Content-Length");
+          return new Response(out, { status: res.status, headers: h });
+        } catch {
+          return res;
+        }
+      }
+      /** v1.0.8 round 5 (BUG 39): public now -- serverless adapters (Vercel
+       *  functions, edge runtimes) drive the server through this entry. */
       async handleRequest(request) {
         try {
           const u = new URL(request.url);
@@ -54225,69 +55288,12 @@ var init_tw6 = __esm({
        * `data: {"v":1,"seq":N,"updates":[...]}` frames.
        */
       handleSignalStream(request, url) {
-        const hub2 = getSignalHub();
-        const names = (url.searchParams.get("s") ?? "").split(",").map((x) => x.trim()).filter(Boolean);
-        const since = Number(url.searchParams.get("since") ?? "0") || 0;
-        const declared = /* @__PURE__ */ new Map();
-        for (const n of names) declared.set(n, "public");
-        let session;
-        try {
-          const header = request.headers.get("cookie") ?? "";
-          const m = /(?:^|;\s*)tw_session=([^;]+)/.exec(header);
-          if (m) session = decodeURIComponent(m[1].trim().replace(/^"|"$/g, ""));
-        } catch {
-        }
-        const enc = new TextEncoder();
-        const sse = (payload) => enc.encode("data: " + payload + "\n\n");
-        const stream = new ReadableStream({
-          start(controller) {
-            const client = hub2.register(declared, session);
-            client.send = (payload) => {
-              try {
-                controller.enqueue(sse(payload));
-              } catch {
-                client.close();
-              }
-            };
-            client.close = () => {
-              try {
-                controller.close();
-              } catch {
-              }
-              hub2["clients"];
-            };
-            for (const payload of hub2.connectPayloads(since, declared, session)) {
-              try {
-                controller.enqueue(sse(payload));
-              } catch {
-                break;
-              }
-            }
-            const keepAlive = setInterval(() => {
-              try {
-                controller.enqueue(enc.encode(": keep-alive\n\n"));
-              } catch {
-                clearInterval(keepAlive);
-              }
-            }, 25e3);
-            client.close = () => {
-              clearInterval(keepAlive);
-              try {
-                controller.close();
-              } catch {
-              }
-            };
-          }
-        });
-        return new Response(stream, {
-          status: 200,
-          headers: {
-            "Content-Type": "text/event-stream; charset=utf-8",
-            "Cache-Control": "no-store",
-            "X-Accel-Buffering": "no",
-            Connection: "keep-alive"
-          }
-        });
+        const cfg = this.options.config?.signalStream;
+        return createSignalStream(request, url, cfg ? { maxClients: cfg.maxClients, maxHistory: cfg.maxHistory } : void 0);
+      }
+      async handleClientSignalWrite(request) {
+        const cfg = this.options.config?.signalStream;
+        return writeSignalFromClient(request, { clientWrites: cfg?.clientWrites });
       }
       /**
        * PPR hole fill: render the page fresh and return only the requested
@@ -54361,15 +55367,33 @@ var init_tw6 = __esm({
             controller.close();
           }
         });
-        return new Response(stream, {
+        const streamRes = new Response(stream, {
           status: 200,
           headers: { "Content-Type": "text/html; charset=utf-8" }
         });
+        streamRes.__twRawStream = true;
+        return streamRes;
       }
       async handleRequestInner(request) {
         const url = new URL(request.url);
         const method = request.method;
-        const pathname = normalizePathname(url.pathname);
+        let rawPath = url.pathname;
+        try {
+          const decoded = decodeURIComponent(rawPath);
+          if (decoded !== rawPath) rawPath = decoded;
+        } catch {
+        }
+        let canonical = normalizePathname(rawPath);
+        if (canonical.length > 1 && canonical.endsWith("/")) {
+          canonical = canonical.slice(0, -1);
+        }
+        if (canonical !== rawPath) {
+          return new Response(null, {
+            status: 308,
+            headers: { Location: encodeURI(canonical) + url.search }
+          });
+        }
+        const pathname = canonical;
         if (pathname === "/_tw/img" || pathname.startsWith("/_tw/img/")) {
           const imgRes = await this.imageHandler.handle(request);
           if (imgRes) return imgRes;
@@ -54377,6 +55401,9 @@ var init_tw6 = __esm({
         if (pathname === "/_tw/stream") {
           return this.handleSignalStream(request, url);
         }
+        if (pathname === "/_tw/signal" && method === "POST") {
+          return this.handleClientSignalWrite(request);
+        }
         if (pathname === "/_tw/ppr") {
           return this.handlePPRHoleFill(url);
         }
@@ -54541,13 +55568,39 @@ __export(twm_loader_exports, {
   loadTWMModule: () => loadTWMModule,
   revalidateRoute: () => revalidateRoute,
   shouldMatchMiddleware: () => shouldMatchMiddleware,
-  stripCommentsSafe: () => stripCommentsSafe
+  stripCommentsSafe: () => stripCommentsSafe,
+  validateTWMSyntax: () => validateTWMSyntax
 });
 import { readFileSync as readFileSync10, existsSync as existsSync14 } from "node:fs";
 import { join as join18 } from "node:path";
 function clearTWMCache() {
   moduleCache.clear();
 }
+function validateTWMSyntax(filePath) {
+  let source;
+  try {
+    source = readFileSync10(filePath, "utf-8");
+  } catch (err3) {
+    return "cannot read: " + (err3?.message ?? err3);
+  }
+  if (isRuleDsl(source)) {
+    try {
+      parseRules(source, filePath);
+      return null;
+    } catch (err3) {
+      return "rule DSL: " + (err3?.message ?? String(err3));
+    }
+  }
+  try {
+    const imports = extractImports(source);
+    const jsCode = compileTwm(source);
+    const codeWithoutImports = stripImports(jsCode);
+    new Function("__tw_unused", codeWithoutImports);
+    return null;
+  } catch (err3) {
+    return (err3?.message ?? String(err3)).replace(/\n/g, " ").slice(0, 200);
+  }
+}
 function stripCommentsSafe(src) {
   let out = "";
   let i = 0;
@@ -54785,7 +55838,7 @@ async function loadTWMModule(filePath, rootDir) {
       console.error("[tw] " + e.message + " (" + filePath + ":" + cm[1] + ")");
     }
   }
-  const moduleCode = codeWithoutImports + "\nreturn { get: typeof get !== 'undefined' ? get : null, post: typeof post !== 'undefined' ? post : null, put: typeof put !== 'undefined' ? put : null, patch: typeof patch !== 'undefined' ? patch : null, deleteFn: typeof deleteFn !== 'undefined' ? deleteFn : null, GET: typeof GET !== 'undefined' ? GET : null, POST: typeof POST !== 'undefined' ? POST : null, PUT: typeof PUT !== 'undefined' ? PUT : null, PATCH: typeof PATCH !== 'undefined' ? PATCH : null, DELETE: typeof DELETE !== 'undefined' ? DELETE : null, middleware: typeof middleware !== 'undefined' ? middleware : null, generate: typeof generate !== 'undefined' ? generate : null, config: typeof config !== 'undefined' ? config : null, action: typeof action !== 'undefined' ? action : null, revalidate: typeof revalidate !== 'undefined' ? revalidate : null, " + [...actionNames].map((n) => `${n}: typeof ${n} !== 'undefined' ? ${n} : null`).join(", ") + " };";
+  const moduleCode = codeWithoutImports + "\nreturn { get: typeof get !== 'undefined' ? get : null, post: typeof post !== 'undefined' ? post : null, put: typeof put !== 'undefined' ? put : null, patch: typeof patch !== 'undefined' ? patch : null, deleteFn: typeof deleteFn !== 'undefined' ? deleteFn : null, GET: typeof GET !== 'undefined' ? GET : null, POST: typeof POST !== 'undefined' ? POST : null, PUT: typeof PUT !== 'undefined' ? PUT : null, PATCH: typeof PATCH !== 'undefined' ? PATCH : null, DELETE: typeof DELETE !== 'undefined' ? DELETE : null, options: typeof options !== 'undefined' ? options : null, OPTIONS: typeof OPTIONS !== 'undefined' ? OPTIONS : null, middleware: typeof middleware !== 'undefined' ? middleware : null, generate: typeof generate !== 'undefined' ? generate : null, config: typeof config !== 'undefined' ? config : null, action: typeof action !== 'undefined' ? action : null, revalidate: typeof revalidate !== 'undefined' ? revalidate : null, " + [...actionNames].map((n) => `${n}: typeof ${n} !== 'undefined' ? ${n} : null`).join(", ") + " };";
   const injectedKeys = Object.keys(injected);
   let module = {};
   try {
@@ -54800,6 +55853,8 @@ async function loadTWMModule(filePath, rootDir) {
       put: H.put || H.PUT || void 0,
       delete: H.deleteFn || H.DELETE || void 0,
       patch: H.patch || H.PATCH || void 0,
+      // v1.0.8 round 4 (BUG 33): route-level OPTIONS handlers
+      options: H.options || H.OPTIONS || void 0,
       middleware: H.middleware || void 0,
       generate: H.generate || void 0,
       config: H.config || void 0,
@@ -54931,9 +55986,26 @@ async function executeRouteHandler(filePath, method, request, rootDir) {
     }
   } else if (typeof request?.json === "function") {
     try {
-      parsedBody = await request.json();
+      const rawBody2 = await request.text();
+      if (rawBody2.length > MAX_BODY_BYTES) {
+        return { status: 413, json: { ok: false, error: "Payload too large" } };
+      }
+      if (!rawBody2) {
+        parsedBody = {};
+      } else if (__ct.includes("application/x-www-form-urlencoded")) {
+        parsedBody = Object.fromEntries(new URLSearchParams(rawBody2).entries());
+      } else if (__ct.startsWith("text/")) {
+        parsedBody = rawBody2;
+      } else if (__ct.includes("json") || __ct === "") {
+        try {
+          parsedBody = JSON.parse(rawBody2);
+        } catch (e) {
+          return { status: 400, json: { ok: false, error: "Invalid JSON body: " + (e?.message ?? "parse error") } };
+        }
+      } else {
+        return { status: 415, json: { ok: false, error: "Unsupported Content-Type: " + (__ct || "(none)") } };
+      }
     } catch {
-      parsedBody = {};
     }
   } else if (request?.body && typeof request.body === "object") {
     parsedBody = request.body;
@@ -54941,7 +56013,18 @@ async function executeRouteHandler(filePath, method, request, rootDir) {
   let query2 = {};
   try {
     const u = new URL(request.url);
-    query2 = Object.fromEntries(u.searchParams.entries());
+    for (const [rawKey, value] of u.searchParams.entries()) {
+      const isPhpArray = rawKey.endsWith("[]");
+      const key = isPhpArray ? rawKey.slice(0, -2) : rawKey;
+      const existing = query2[key];
+      if (existing === void 0) {
+        query2[key] = isPhpArray ? [value] : value;
+      } else if (Array.isArray(existing)) {
+        existing.push(value);
+      } else {
+        query2[key] = [existing, value];
+      }
+    }
   } catch {
   }
   const headersObj = typeof request.headers?.entries === "function" ? Object.fromEntries(request.headers.entries()) : request.headers ?? {};
@@ -55070,9 +56153,17 @@ async function executeRouteHandler(filePath, method, request, rootDir) {
     console.error("[tw] route handler error (" + filePath + "):", err3?.message ?? err3);
     return { status: 500, json: { ok: false, error: "Internal Server Error" } };
   }
-  if (!result || typeof result !== "object") {
-    console.error("[tw] route handler returned no result (" + filePath + ")");
-    return { status: 500, json: { ok: false, error: "Internal Server Error" } };
+  if (typeof result === "string") {
+    result = { status: 200, text: result };
+  } else if (!result || typeof result !== "object") {
+    console.error("[tw] route handler returned " + JSON.stringify(result) + " (" + filePath + ")");
+    return {
+      status: 500,
+      json: {
+        ok: false,
+        error: "Unsupported handler return shape: " + (result === null ? "null" : typeof result) + ". Return { status, json|text|html } (or a plain string for text/plain)."
+      }
+    };
   }
   const finalResult = {
     status: typeof result.status === "number" ? result.status : 200,
@@ -55211,7 +56302,9 @@ function findCompilerPath2() {
   return resolve6(process.cwd(), "packages/compiler/tw/index.ts");
 }
 function extractRenderMode2(src) {
-  const m = /render\s+(static|ssr|island|edge|csr|stream|ppr|signalStream)\b/.exec(src);
+  const m = /render\s+(static|ssr|island|edge|csr|stream|ppr|signalStream)\b/.exec(
+    maskSourceStringsAndComments(src)
+  );
   return m ? m[1] : "static";
 }
 function csrifyHtml(html) {
@@ -55325,18 +56418,32 @@ function scanComponents2(rootDir) {
   for (const d of privDirs) registerComponentsFrom2(d);
 }
 function buildMetaTagsFromSource(source) {
-  const fm = source.match(/page\s*\{([^}]*)\}/);
-  if (!fm) return "";
-  const body = fm[1];
+  const masked = maskSourceStringsAndComments(source);
+  const fm = masked.match(/page\s*\{/);
+  if (!fm || fm.index === void 0) return "";
+  const bodyStart = fm.index + fm[0].length;
+  const bodyEnd = masked.indexOf("}", bodyStart);
+  if (bodyEnd === -1) return "";
+  const body = source.slice(bodyStart, bodyEnd);
   const AMP = String.fromCharCode(38);
   const esc = (v) => v.split(AMP).join(AMP + "amp;").split(String.fromCharCode(34)).join(AMP + "quot;").split("<").join(AMP + "lt;");
   const pick = (key) => {
     const i = body.indexOf(key + ' "');
     if (i === -1) return null;
     const rest = body.slice(i + key.length + 2);
-    const end = rest.indexOf('"');
+    let end = -1;
+    for (let j = 0; j < rest.length; j++) {
+      if (rest[j] === "\\") {
+        j++;
+        continue;
+      }
+      if (rest[j] === '"') {
+        end = j;
+        break;
+      }
+    }
     if (end === -1) return null;
-    return rest.slice(0, end);
+    return rest.slice(0, end).replace(/\\([{}"])/g, "$1");
   };
   let tags = "";
   const description = pick("description");
@@ -55411,11 +56518,18 @@ async function buildCommand() {
   } catch {
   }
   let pageCount = 0;
+  let requestRenderedCount = 0;
   let apiCount = 0;
   let errorCount = 0;
   const isrRoutes = /* @__PURE__ */ new Map();
   const pageFiles = [];
   collectFiles(homeDir, "page.tw", pageFiles);
+  for (const pf of pageFiles) {
+    if (existsSync16(join20(dirname6(pf), "index.tw"))) {
+      console.log("  \x1B[33m!\x1B[0m " + dirname6(pf).replace(homeDir, "").replace(/^\//, "") + "/ has BOTH page.tw and index.tw");
+      console.log("      index.tw wins this route -- delete one of them");
+    }
+  }
   begin("compile", pageFiles.length);
   const htmlOutputs = [];
   _compilerMod.clearCssCapture?.();
@@ -55433,11 +56547,20 @@ async function buildCommand() {
           const pmod = await loadTWMModule2(paramsTwm, rootDir);
           if (typeof pmod.generate === "function") {
             const arr = pmod.generate();
-            if (Array.isArray(arr) && arr.length > 0) paramSets = arr.map((x) => {
-              const o = {};
-              for (const [k, v] of Object.entries(x)) o[k] = String(v);
-              return o;
-            });
+            if (Array.isArray(arr) && arr.length > 0) {
+              const dynNames = pageFile.split("/").map((seg) => /^\[([^\]]+)\]$/.exec(seg)?.[1]).filter(Boolean);
+              paramSets = arr.map((x) => {
+                if (x !== null && typeof x !== "object") {
+                  const o2 = {};
+                  const key = dynNames[0] ?? "slug";
+                  o2[key] = String(x);
+                  return o2;
+                }
+                const o = {};
+                for (const [k, v] of Object.entries(x)) o[k] = String(v);
+                return o;
+              });
+            }
           }
         } catch (e) {
           console.log("  Warning: params.twm failed: " + e.message);
@@ -55466,7 +56589,7 @@ async function buildCommand() {
           errorCount++;
         }
       }
-      const revM = resolved ? null : /page\s*\{[^}]*revalidate\s+(\d+)/.exec(pageSrc);
+      const revM = resolved ? null : /page\s*\{[^}]*revalidate\s+(\d+)/.exec(maskSourceStringsAndComments(pageSrc));
       if (resolved || revM) {
         for (const ps of paramSets) {
           const rp = routePath.split("/").map((seg) => {
@@ -55488,6 +56611,7 @@ async function buildCommand() {
     }
     const hasExplicitParams = paramSets.length > 1 || Object.keys(paramSets[0] ?? {}).length > 0;
     if ((renderMode === "ssr" || renderMode === "stream") && !hasExplicitParams) {
+      requestRenderedCount++;
       console.log("  \x1B[36m~\x1B[0m " + routePath + " [" + renderMode + ": rendered at request time]");
       try {
         const src = readFileSync12(pageFile, "utf-8");
@@ -55498,6 +56622,29 @@ async function buildCommand() {
           for (const d of errs.slice(0, 5)) console.log("      " + d.line + ":" + d.col + "  " + d.message);
           errorCount++;
         }
+        const warns = (r.diagnostics || []).filter((d) => d.severity !== "error");
+        if (warns.length > 0) {
+          console.log("      \x1B[33m" + warns.length + " warning" + (warns.length === 1 ? "" : "s") + "\x1B[0m");
+          for (const d of warns.slice(0, 3)) {
+            console.log("        " + d.line + ":" + d.col + "  " + d.code + "  " + d.message);
+          }
+          if (warns.length > 3) console.log("        ... " + (warns.length - 3) + " more (tw check)");
+        }
+        {
+          const used = /* @__PURE__ */ new Set();
+          collectComponentUsages(r.ast, used);
+          const BUILTIN_ALIASES = /* @__PURE__ */ new Set(["Link", "RouterLink", "Image", "optImage", "Suspense"]);
+          const unknownSsr = [...used].filter((t2) => !BUILTIN_ALIASES.has(t2) && !registeredComponentNames.has(t2));
+          if (unknownSsr.length > 0) {
+            const importSpecs = /* @__PURE__ */ new Map();
+            for (const im of src.matchAll(/import\s+([A-Za-z_]\w*)\s+from\s+["']([^"']+)["']/g)) {
+              importSpecs.set(im[1], im[2]);
+            }
+            const hints = unknownSsr.map((t2) => importSpecs.has(t2) ? `<${t2}> (imported from ${importSpecs.get(t2)} -- file not found)` : `<${t2}> (no components/${t2}.tw found)`);
+            console.log("  \x1B[31m\u2717 " + routePath + ": unknown component" + (unknownSsr.length > 1 ? "s" : "") + " " + hints.join(", ") + "\x1B[0m");
+            errorCount++;
+          }
+        }
       } catch (e) {
         console.log("  \x1B[33m! " + routePath + ": " + (e && e.message ? e.message : e) + "\x1B[0m");
         errorCount++;
@@ -55516,7 +56663,12 @@ async function buildCommand() {
           const BUILTIN_ALIASES = /* @__PURE__ */ new Set(["Link", "RouterLink", "Image", "optImage", "Suspense"]);
           const unknown = [...used].filter((t2) => !BUILTIN_ALIASES.has(t2) && !registeredComponentNames.has(t2));
           if (unknown.length > 0) {
-            console.error("  \x1B[31m\u2717 " + pageFile.replace(rootDir + "/", "") + ": unknown component" + (unknown.length > 1 ? "s" : "") + " <" + unknown.join(">, <") + "> -- no components/" + unknown[0] + ".tw found (create the file or fix the import)\x1B[0m");
+            const importSpecs = /* @__PURE__ */ new Map();
+            for (const im of source.matchAll(/import\s+([A-Za-z_]\w*)\s+from\s+["']([^"']+)["']/g)) {
+              importSpecs.set(im[1], im[2]);
+            }
+            const hints = unknown.map((t2) => importSpecs.has(t2) ? `<${t2}> (imported from ${importSpecs.get(t2)} -- file not found)` : `<${t2}> (no components/${t2}.tw found)`);
+            console.error("  \x1B[31m\u2717 " + pageFile.replace(rootDir + "/", "") + ": unknown component" + (unknown.length > 1 ? "s" : "") + " " + hints.join(", ") + " -- create the file or fix the import\x1B[0m");
             process.exit(1);
           }
         }
@@ -55550,7 +56702,10 @@ async function buildCommand() {
             const headResult = _compileSync(headSource, { filePath: headSrc });
             const headBody = headResult.html.match(/<body>([\s\S]*)<\/body>/);
             if (headBody && headBody[1].trim()) {
-              html = html.replace("</head>", "  " + headBody[1].trim() + "\n</head>");
+              html = html.replace(
+                "</head>",
+                "  " + headBody[1].trim().replace(/\\([{}])/g, "$1") + "\n</head>"
+              );
             }
           } catch (e) {
             console.log("  Warning: head.tw failed: " + e.message);
@@ -55605,9 +56760,12 @@ async function buildCommand() {
             if (pu) clientTag += `<script defer src="/${pu}"></script>
   `;
           }
-          const runtimeTag = `<script defer src="/__tw_runtime.js"></script>`;
-          html = html.replace("</body>", "  " + clientTag + runtimeTag + "\n</body>");
-          needsRuntime = true;
+          const needsClient = interactive || pageMods.deps.length > 0 || pageMods.own.length > 0 || renderMode === "csr" || renderMode === "ppr" || renderMode === "stream" || renderMode === "signalStream";
+          if (needsClient) {
+            const runtimeTag = `<script defer src="/__tw_runtime.js"></script>`;
+            html = html.replace("</body>", "  " + clientTag + runtimeTag + "\n</body>");
+            needsRuntime = true;
+          }
         }
         if (renderMode === "csr") {
           html = csrifyHtml(html);
@@ -55662,6 +56820,14 @@ async function buildCommand() {
         } else {
           console.log("  \x1B[32mOK\x1B[0m " + displayPath + " -> " + (outRoute === "" ? ".tw/index.html" : ".tw/" + outRoute + "/index.html"));
         }
+        const warnings = result.diagnostics.filter((d) => d.severity !== "error");
+        if (warnings.length > 0) {
+          console.log("      \x1B[33m" + warnings.length + " warning" + (warnings.length === 1 ? "" : "s") + "\x1B[0m");
+          for (const d of warnings.slice(0, 3)) {
+            console.log("        " + d.line + ":" + d.col + "  " + d.code + "  " + d.message);
+          }
+          if (warnings.length > 3) console.log("        ... " + (warnings.length - 3) + " more (tw check)");
+        }
         pageCount++;
       } catch (err3) {
         console.log("  \x1B[31mX " + routePath + ": " + err3.message + "\x1B[0m");
@@ -55680,8 +56846,16 @@ async function buildCommand() {
     const outputDir = routeName === "" ? outDir : join20(outDir, routeName);
     mkdirSync6(outputDir, { recursive: true });
     copyFileSync2(twmFile, join20(outputDir, "route.twm"));
-    console.log("  \x1B[32mOK\x1B[0m /" + routeName + " [api]");
-    apiCount++;
+    const { validateTWMSyntax: validateTWMSyntax2 } = await Promise.resolve().then(() => (init_twm_loader(), twm_loader_exports));
+    const syntaxError = validateTWMSyntax2(twmFile);
+    if (syntaxError) {
+      console.log("  \x1B[31mX\x1B[0m /" + routeName + " [api] -- .twm syntax error");
+      console.log("      " + twmFile.replace(rootDir + "/", "") + ": " + syntaxError);
+      errorCount++;
+    } else {
+      console.log("  \x1B[32mOK\x1B[0m /" + routeName + " [api]");
+      apiCount++;
+    }
   }
   if (existsSync16(libDir)) {
     copyDir2(libDir, join20(outDir, "lib"));
@@ -55760,7 +56934,8 @@ async function buildCommand() {
     }
   }
   console.log("\n  \x1B[32mBuild complete!\x1B[0m");
-  console.log("  Pages: " + pageCount + " compiled");
+  console.log("  Pages: " + pageCount + " compiled" + (requestRenderedCount > 0 ? " (+" + requestRenderedCount + " rendered at request time)" : ""));
+  if (pageCount === 0) console.warn("  [!] No static pages were compiled -- every page is SSR/API. Static hosts (Vercel/Cloudflare Pages output) will serve an empty site. Use `render static` or check your render modes.");
   console.log("  APIs:  " + apiCount + " routes");
   if (isrRoutes.size > 0) {
     const manifest = {};
@@ -57709,9 +58884,11 @@ var init_provider2 = __esm({
       getExpressionCompletions(doc) {
         const items = [];
         const definedVars = /* @__PURE__ */ new Set();
-        const scriptMatch = doc.content.match(/<script[^>]*>([\s\S]*?)<\/script>/i);
+        const scriptMatches = [...doc.content.matchAll(/<script[^>]*>([\s\S]*?)<\/script>/gi)];
+        const scriptMatch = scriptMatches.length ? [scriptMatches.map((m) => m[1]).join("\n")] : null;
+        const scriptContent = scriptMatch ? scriptMatch[0] : "";
         if (scriptMatch) {
-          const sc = scriptMatch[1];
+          const sc = scriptContent;
           const varRegex = /(?:const|let|var)\s+(\w+)/g;
           let m;
           while ((m = varRegex.exec(sc)) !== null) {
@@ -58286,8 +59463,10 @@ var init_symbols = __esm({
         const doc = this.docManager.getDocument(uri);
         if (!doc) return [];
         const symbols = [];
-        const scriptMatch = doc.content.match(/<script[^>]*>([\s\S]*?)<\/script>/i);
-        if (scriptMatch) symbols.push(...this.parseScriptSymbols(scriptMatch[1], this.findScriptStart(doc)));
+        const scriptMatches = [...doc.content.matchAll(/<script[^>]*>([\s\S]*?)<\/script>/gi)];
+        const scriptMatch = scriptMatches.length ? [scriptMatches.map((m) => m[1]).join("\n")] : null;
+        const scriptContent = scriptMatch ? scriptMatch[0] : "";
+        if (scriptMatch) symbols.push(...this.parseScriptSymbols(scriptContent, this.findScriptStart(doc)));
         symbols.push(...this.parseTemplateSymbols(doc));
         return symbols;
       }
@@ -58600,6 +59779,11 @@ var init_provider14 = __esm({
 });
 
 // ../../packages/lsp/tw/code-lens/provider.ts
+function stripLineComments(src) {
+  return src.split("\n").map(function(l) {
+    return l.replace(/(^|\s)\/\/.*$/, "");
+  }).join("\n");
+}
 var CodeLensProvider;
 var init_provider15 = __esm({
   "../../packages/lsp/tw/code-lens/provider.ts"() {
@@ -58632,7 +59816,7 @@ var init_provider15 = __esm({
         const esc = symbol.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
         const regex = new RegExp(`\\b${esc}\\b`, "g");
         for (const d of this.docManager.getAllDocuments()) {
-          const m = d.content.match(regex);
+          const m = stripLineComments(d.content).match(regex);
           if (m) count += m.length - 1;
         }
         return Math.max(0, count);
@@ -58642,7 +59826,7 @@ var init_provider15 = __esm({
         const esc = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
         const regex = new RegExp(`<${esc}\\b`, "g");
         for (const d of this.docManager.getAllDocuments()) {
-          const m = d.content.match(regex);
+          const m = stripLineComments(d.content).match(regex);
           if (m) count += m.length;
         }
         return count;
@@ -59854,15 +61038,37 @@ ${name}/
 async function createVercelJson(dir) {
   const config = {
     buildCommand: "npx tw build",
-    outputDirectory: ".tw",
-    installCommand: "bun install",
-    framework: null
+    installCommand: "npm install",
+    functions: {
+      "api/tw-server.ts": { memory: 512 }
+    },
+    rewrites: [
+      { source: "/(.*)", destination: "/api/tw-server" }
+    ]
   };
   await writeFile(join(dir, "vercel.json"), JSON.stringify(config, null, 2));
   console.log("  \u2713 vercel.json");
+  const fnDir = join(dir, "api");
+  await mkdir(fnDir, { recursive: true });
+  await writeFile(join(fnDir, "tw-server.ts"), [
+    "// TW Framework -- Vercel serverless entry (v1.0.8 round 5, BUG 39).",
+    "// Runs the full TW server (SSR pages + .twm API routes) as a Vercel",
+    "// function. vercel.json rewrites every route here.",
+    'import { TWServer } from "tw-framework/server";',
+    "",
+    "const server = new TWServer({",
+    "  rootDir: process.cwd(),",
+    "});",
+    "",
+    "export default async function handler(request: Request): Promise<Response> {",
+    "  return server.handleRequest(request);",
+    "}",
+    ""
+  ].join("\n"));
+  console.log("  \u2713 api/tw-server.ts");
 }
 async function createDefaultProject(dir, name) {
-  const T = (s) => s;
+  const T = (s) => s.split("${name}").join(name);
   for (const d of [
     ["home"],
     ["home", "about"],
@@ -59885,8 +61091,6 @@ html {
   head {
     meta charset "utf-8"
     meta name "viewport" content "width=device-width, initial-scale=1"
-    meta name "description" content "{page.description}"
-    title "{page.title} -- ${"$"}{name}"
   }
   body {
     header.sitenav {
@@ -60222,6 +61426,10 @@ a:hover { td underline }
 // This sample blocks known bot user agents everywhere. Guards are
 // fail-closed: a matching request that fails the condition gets the
 // rule's response, and no page code ever runs.
+//
+// Note: a rule with ONLY match + response (no condition blocks) applies
+// to EVERY matching request -- e.g. a site-wide maintenance page. tw serve
+// lists each rule at startup and flags those unconditional ones.
 
 rule "block bots" {
     match "/**"
@@ -60983,38 +62191,15 @@ function destroySession(req) {
   const match = cookie.match(new RegExp(`${SESSION_COOKIE}=([^;]+)`));
   if (match) sessions.delete(match[1]);
 }
-function loadMiddleware(rootDir) {
-  const mwPath = join19(rootDir, "middleware.twm");
-  if (!existsSync15(mwPath)) return [];
-  const source = readFileSync11(mwPath, "utf-8");
-  const rules = [];
-  const ruleRegex = /rule\s+"([^"]+)"\s*{([^}]+)}/g;
-  let match;
-  while ((match = ruleRegex.exec(source)) !== null) {
-    const name = match[1];
-    const body = match[2];
-    const pathMatch = body.match(/match\s+"([^"]+)"/);
-    const authMatch = body.match(/auth\s+(true|false)/);
-    const redirectMatch = body.match(/redirect\s+"([^"]+)"/);
-    if (pathMatch) {
-      rules.push({
-        name,
-        match: pathMatch[1],
-        auth: authMatch ? authMatch[1] === "true" : false,
-        redirect: redirectMatch ? redirectMatch[1] : "/login"
-      });
-    }
-  }
-  return rules;
-}
-function matchGlob(path, pattern) {
-  if (pattern === "/**") return true;
-  if (pattern === path) return true;
-  if (pattern.endsWith("/**")) {
-    const prefix = pattern.slice(0, -3);
-    return path === prefix || path.startsWith(prefix + "/");
+async function loadMiddlewareRules(mwPath) {
+  try {
+    const source = readFileSync11(mwPath, "utf-8");
+    const { parseRules: parseRules2 } = await Promise.resolve().then(() => (init_twm_rules(), twm_rules_exports));
+    return parseRules2(source);
+  } catch (e) {
+    console.log("    Middleware error: " + e.message);
+    return [];
   }
-  return false;
 }
 function get404() {
   return `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>404 - Page Not Found</title><style>${DEFAULT_CSS}</style></head><body><div class="wrapper"><section class="hero"><div class="container"><h1>404</h1><p>Page not found</p><a class="btn" href="/">Go Home</a></div></section></div></body></html>`;
@@ -61093,7 +62278,8 @@ async function devCommand() {
     if (existsSync15(stylePath)) parts.push(readFileSync11(stylePath, "utf-8"));
     if (parts.length) css = parts.join("\n");
   }
-  const middlewareRules = loadMiddleware(rootDir);
+  const mwPath = join19(rootDir, "middleware.twm");
+  const middlewareRules = existsSync15(mwPath) ? await loadMiddlewareRules(mwPath) : [];
   scanComponents(rootDir);
   const compDir = join19(rootDir, "components");
   if (existsSync15(compDir)) {
@@ -61168,13 +62354,13 @@ async function devCommand() {
   }
   async function runUserMiddleware(req) {
     try {
-      const mwPath = join19(rootDir, "middleware.twm");
-      if (!existsSync15(mwPath)) return null;
+      const mwPath2 = join19(rootDir, "middleware.twm");
+      if (!existsSync15(mwPath2)) return null;
       const { executeMiddleware: executeMiddleware2, loadTWMModule: loadTWMModule2, shouldMatchMiddleware: shouldMatchMiddleware2 } = await Promise.resolve().then(() => (init_twm_loader(), twm_loader_exports));
-      const mod = await loadTWMModule2(mwPath, rootDir);
+      const mod = await loadTWMModule2(mwPath2, rootDir);
       const mwPathname = new URL(req.url).pathname;
       if (!mod.config?.matcher || shouldMatchMiddleware2(mod.config.matcher, mwPathname)) {
-        const mwResult = await executeMiddleware2(mwPath, req, rootDir);
+        const mwResult = await executeMiddleware2(mwPath2, req, rootDir);
         if (mwResult instanceof Response) return mwResult;
         if (mwResult && typeof mwResult === "object" && mwResult.headers && !mwResult.status && !mwResult.json) {
           return mwResult.headers;
@@ -61207,6 +62393,7 @@ async function devCommand() {
   }
   let devRedirects = [];
   let devCfgHeaders = [];
+  let devSigCfg = void 0;
   try {
     const cfgFile = join19(rootDir, "tw.config.ts");
     if (existsSync15(cfgFile)) {
@@ -61219,27 +62406,38 @@ async function devCommand() {
       if (cfg?.headers) {
         devCfgHeaders = Array.isArray(cfg.headers) ? cfg.headers : Object.entries(cfg.headers).map(([source, headers]) => ({ source, headers }));
       }
+      if (cfg?.signalStream) devSigCfg = cfg.signalStream;
     }
   } catch {
   }
   const devPathMatch = (pattern, pathname) => pattern === pathname || pattern.endsWith("/**") && pathname.startsWith(pattern.slice(0, -2) + "/") || pattern.endsWith("/") && pathname.startsWith(pattern) || pattern === "/**" && pathname.startsWith("/");
   async function devFetchInner(req) {
     const url = new URL(req.url);
+    try {
+      let rawPath = url.pathname;
+      const decoded = decodeURIComponent(rawPath);
+      if (decoded !== rawPath) rawPath = decoded;
+      let canonical = rawPath.replace(/\/{2,}/g, "/");
+      if (canonical.length > 1 && canonical.endsWith("/")) canonical = canonical.slice(0, -1);
+      if (canonical !== rawPath) {
+        return new Response(null, { status: 308, headers: { Location: encodeURI(canonical) + url.search } });
+      }
+    } catch {
+    }
     const path = url.pathname;
     const time = (/* @__PURE__ */ new Date()).toISOString().split("T")[1].split(".")[0];
     rescanComponentsIfNeeded(rootDir);
     console.log("  [" + time + "] " + req.method + " " + path);
     const session = getSession(req);
-    for (const rule of middlewareRules) {
-      if (rule.auth && matchGlob(path, rule.match)) {
-        if (!session || !session.userId) {
-          console.log("    -> 302 Redirect to " + rule.redirect + " (auth required)");
-          return new Response(null, {
-            status: 302,
-            headers: { Location: rule.redirect }
-          });
-        }
+    try {
+      const { evaluateRules: evaluateRules2 } = await Promise.resolve().then(() => (init_twm_rules(), twm_rules_exports));
+      const mwRes = evaluateRules2(middlewareRules, req);
+      if (mwRes) {
+        console.log("    -> middleware response " + mwRes.status + " for " + path);
+        return mwRes;
       }
+    } catch (e) {
+      console.log("    Middleware error: " + e.message);
     }
     if (path === "/__tw_runtime.js") {
       const _fu = import.meta.url.replace("file://", "");
@@ -61449,13 +62647,20 @@ async function devCommand() {
         if (/<\/body>/.test(html)) {
           html = html.replace("</body>", devClientTag + '  <script src="/__tw_runtime.js"></script>\n</body>');
         }
+        const devGlobalHead = join19(homeDir, "head.tw");
+        const devHeadSources = [];
+        if (existsSync15(devGlobalHead)) devHeadSources.push(devGlobalHead);
         const headTw = join19(dirname5(resolved.file), "head.tw");
-        if (existsSync15(headTw)) {
+        if (headTw !== devGlobalHead && existsSync15(headTw)) devHeadSources.push(headTw);
+        for (const devHeadTw of devHeadSources) {
           try {
-            const headRes = compileSync3(readFileSync11(headTw, "utf-8"), { filePath: headTw });
+            const headRes = compileSync3(readFileSync11(devHeadTw, "utf-8"), { filePath: devHeadTw });
             const headBody = headRes.html.match(/<body>([\s\S]*)<\/body>/);
             if (headBody && headBody[1].trim()) {
-              html = html.replace("</head>", "  " + headBody[1].trim() + "\n</head>");
+              html = html.replace(
+                "</head>",
+                "  " + headBody[1].trim().replace(/\\([{}])/g, "$1") + "\n</head>"
+              );
             }
           } catch (e) {
             console.log("    Warning: head.tw failed: " + e.message);
@@ -61498,56 +62703,108 @@ async function devCommand() {
       headers: { "Content-Type": "text/html" }
     });
   }
-  const server = Bun.serve({
-    port,
-    hostname: host,
-    async fetch(req) {
-      const reqUrl = new URL(req.url);
-      for (const r of devRedirects) {
-        if (!r?.from || !r?.to) continue;
-        if (devPathMatch(r.from, reqUrl.pathname)) {
-          const status = [301, 302, 307, 308].includes(r.status) ? r.status : 301;
-          let loc = r.to.startsWith("http") ? r.to : new URL(r.to, req.url).toString();
-          if (reqUrl.search && !loc.includes("?")) loc += reqUrl.search;
-          return new Response(null, { status, headers: { Location: loc } });
-        }
-      }
-      const mwHeaders = await runUserMiddleware(req);
-      if (mwHeaders instanceof Response) return mwHeaders;
-      const u = new URL(req.url);
-      if (u.pathname === "/_tw/img" || u.pathname.startsWith("/_tw/img/")) {
-        const imgRes = await devImageHandler?.handle(req);
-        if (imgRes) return imgRes;
-      }
-      const response = await devFetchInner(req);
-      if (mwHeaders && typeof mwHeaders === "object") {
-        for (const key of Object.keys(mwHeaders)) {
-          try {
-            if (!response.headers.has(key)) response.headers.set(key, mwHeaders[key]);
-          } catch {
-          }
+  async function devHandle(req) {
+    {
+      const u3 = new URL(req.url);
+      if (u3.pathname === "/_tw/stream") {
+        const { createSignalStream: createSignalStream2 } = await Promise.resolve().then(() => (init_signal_stream(), signal_stream_exports));
+        return createSignalStream2(req, u3, devSigCfg ? { maxClients: devSigCfg.maxClients, maxHistory: devSigCfg.maxHistory } : void 0);
+      }
+      if (u3.pathname === "/_tw/signal" && req.method === "POST") {
+        const { writeSignalFromClient: writeSignalFromClient2 } = await Promise.resolve().then(() => (init_signal_stream(), signal_stream_exports));
+        return writeSignalFromClient2(req, { clientWrites: devSigCfg?.clientWrites });
+      }
+    }
+    const reqUrl = new URL(req.url);
+    for (const r of devRedirects) {
+      if (!r?.from || !r?.to) continue;
+      if (devPathMatch(r.from, reqUrl.pathname)) {
+        const status = [301, 302, 307, 308].includes(r.status) ? r.status : 301;
+        let loc = r.to.startsWith("http") ? r.to : new URL(r.to, req.url).toString();
+        if (reqUrl.search && !loc.includes("?")) loc += reqUrl.search;
+        return new Response(null, { status, headers: { Location: loc } });
+      }
+    }
+    const mwHeaders = await runUserMiddleware(req);
+    if (mwHeaders instanceof Response) return mwHeaders;
+    const u = new URL(req.url);
+    if (u.pathname === "/_tw/img" || u.pathname.startsWith("/_tw/img/")) {
+      const imgRes = await devImageHandler?.handle(req);
+      if (imgRes) return imgRes;
+    }
+    const response = await devFetchInner(req);
+    if (mwHeaders && typeof mwHeaders === "object") {
+      for (const key of Object.keys(mwHeaders)) {
+        try {
+          if (!response.headers.has(key)) response.headers.set(key, mwHeaders[key]);
+        } catch {
         }
       }
-      const u2 = new URL(req.url);
-      for (const h of devCfgHeaders) {
-        if (h?.source && h?.headers && devPathMatch(h.source, u2.pathname)) {
-          for (const key of Object.keys(h.headers)) {
-            try {
-              if (!response.headers.has(key)) response.headers.set(key, String(h.headers[key]).replace(/[\r\n]/g, ""));
-            } catch {
-            }
+    }
+    const u2 = new URL(req.url);
+    for (const h of devCfgHeaders) {
+      if (h?.source && h?.headers && devPathMatch(h.source, u2.pathname)) {
+        for (const key of Object.keys(h.headers)) {
+          try {
+            if (!response.headers.has(key)) response.headers.set(key, String(h.headers[key]).replace(/[\r\n]/g, ""));
+          } catch {
           }
         }
       }
-      if (devSecurityHeaders2) {
-        try {
-          return devSecurityHeaders2.apply(response);
-        } catch {
-        }
+    }
+    if (devSecurityHeaders2) {
+      try {
+        return devSecurityHeaders2.apply(response);
+      } catch {
       }
-      return response;
     }
-  });
+    return response;
+  }
+  if (typeof Bun !== "undefined" && typeof Bun.serve === "function") {
+    Bun.serve({ port, hostname: host, fetch: devHandle });
+  } else {
+    const { createServer } = await import("node:http");
+    const srv = createServer(async (nreq, nres) => {
+      try {
+        const hostHdr = String(nreq.headers.host ?? `${host}:${port}`);
+        const chunks = [];
+        for await (const c of nreq) chunks.push(Buffer.from(c));
+        const raw = nreq.method === "GET" || nreq.method === "HEAD" ? void 0 : Buffer.concat(chunks);
+        const request = new Request(`http://${hostHdr}${nreq.url}`, {
+          method: nreq.method,
+          headers: nreq.headers,
+          body: raw && raw.length > 0 ? raw : void 0
+        });
+        const resp = await devHandle(request);
+        const out = Buffer.from(await resp.arrayBuffer());
+        const headers = {};
+        resp.headers.forEach((v, k) => {
+          headers[k] = v;
+        });
+        nres.writeHead(resp.status, headers);
+        nres.end(out);
+      } catch (e) {
+        nres.writeHead(500, { "Content-Type": "text/plain" });
+        nres.end("Internal dev server error: " + (e?.message ?? e));
+      }
+    });
+    await new Promise((r) => srv.listen(port, host, () => r()));
+    console.log("  [tw] runtime: node (Bun not found \u2014 using node:http)");
+  }
+  try {
+    const { watch: watch2 } = await import("node:fs");
+    const seen = /* @__PURE__ */ new Set();
+    watch2(rootDir, { recursive: true }, (_t, f) => {
+      const name = String(f);
+      if (name.includes("node_modules") || name.includes(".git") || name.split("/").includes(".tw")) return;
+      if (seen.has(name)) return;
+      seen.add(name);
+      const t2 = setTimeout(() => seen.delete(name), 400);
+      if (typeof t2?.unref === "function") t2.unref();
+      console.log(`  [tw] ${name} changed -- reload the browser`);
+    });
+  } catch {
+  }
   console.log("  Server running! Open http://" + host + ":" + port + " in your browser.");
   console.log("  Press Ctrl+C to stop.\n");
 }
@@ -61560,6 +62817,25 @@ import { join as join22 } from "node:path";
 import { existsSync as existsSync18 } from "node:fs";
 async function serveCommand() {
   const args = process.argv.slice(3);
+  if (args.includes("-h") || args.includes("--help")) {
+    console.log(`
+  tw serve \u2014 start the production server
+
+  Usage:
+    tw serve [--port <number>] [--host <address>]
+
+  Options:
+    --port <number>   port to listen on (default: 8000; tw.config.ts
+                      server.port and the PORT env var also work,
+                      in that order of precedence)
+    --host <address>  bind address (default: 0.0.0.0)
+    -h, --help        show this help
+
+  Requires a build first (tw build); serves .tw/ output with SSR,
+  middleware and API routes.
+`);
+    process.exit(0);
+  }
   let port = null;
   let host = "0.0.0.0";
   for (let i = 0; i < args.length; i++) {
@@ -61574,8 +62850,8 @@ async function serveCommand() {
   const envPath = join22(rootDir, ".env");
   if (existsSync18(envPath)) {
     try {
-      const { readFileSync: readFileSync19 } = await import("node:fs");
-      for (const line of readFileSync19(envPath, "utf-8").split("\n")) {
+      const { readFileSync: readFileSync20 } = await import("node:fs");
+      for (const line of readFileSync20(envPath, "utf-8").split("\n")) {
         const m = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)\s*$/.exec(line);
         if (m && !(m[1] in process.env)) {
           process.env[m[1]] = m[2].replace(/^["']|["']$/g, "");
@@ -61621,7 +62897,7 @@ async function serveCommand() {
       staticDir: outDir,
       config,
       ...config?.rateLimit ? { rateLimit: config.rateLimit } : {},
-      ...typeof config?.compression === "boolean" ? { compression: config.compression } : {},
+      ...config?.compression !== void 0 || config?.server?.compression !== void 0 ? { compression: config?.compression ?? config?.server?.compression } : {},
       ...pluginManager && pluginManager.size() > 0 ? { plugins: pluginManager } : {},
       ...config?.images ? { images: config.images } : {},
       ...config?.security ? { security: config.security } : {}
@@ -61900,7 +63176,7 @@ async function adapterCommand() {
 // tw/commands/test.ts
 import { join as join27 } from "node:path";
 import { createRequire as _cr } from "node:module";
-import { existsSync as existsSync22, readdirSync as readdirSync9, statSync as statSync9 } from "node:fs";
+import { existsSync as existsSync22, readdirSync as readdirSync9, statSync as statSync9, readFileSync as readFileSync15 } from "node:fs";
 var _require = _cr(import.meta.url);
 function collectTests(dir, out) {
   if (!existsSync22(dir)) return;
@@ -61956,6 +63232,17 @@ async function testCommand() {
     }
   }
   console.log("\n  tw test -- running " + files.length + " test file" + (files.length === 1 ? "" : "s") + "\n");
+  for (const f of files) {
+    try {
+      const src = readFileSync15(f, "utf-8");
+      const hasBunTest = src.includes("bun:test");
+      const hasTestCall = /\b(test|it|describe)\s*\(/.test(src);
+      if (!hasBunTest && !hasTestCall) {
+        console.log("  \x1B[33m! " + f.replace(rootDir + "/", "") + ' defined no tests -- only bun:test format runs (import { test, expect } from "bun:test")\x1B[0m');
+      }
+    } catch {
+    }
+  }
   if (files.length === 0) {
     console.log("  No tests found. Create tests/your-name.test.ts:");
     console.log(`
@@ -61987,8 +63274,9 @@ async function testCommand() {
 }
 
 // tw/commands/check.ts
-import { join as join28 } from "node:path";
-import { existsSync as existsSync23, readFileSync as readFileSync15, readdirSync as readdirSync10, statSync as statSync10 } from "node:fs";
+init_tw();
+import { join as join28, dirname as dirname8 } from "node:path";
+import { existsSync as existsSync23, readFileSync as readFileSync16, readdirSync as readdirSync10, statSync as statSync10 } from "node:fs";
 async function checkCommand() {
   const args = process.argv.slice(3);
   const rootDir = process.cwd();
@@ -62010,7 +63298,7 @@ async function checkCommand() {
     for (const filePath of twFiles) {
       const relativePath = filePath.replace(rootDir + "/", "");
       try {
-        const source = readFileSync15(filePath, "utf-8");
+        const source = readFileSync16(filePath, "utf-8");
         const result = await compile2(source, {
           filePath,
           optimize: false,
@@ -62021,6 +63309,42 @@ async function checkCommand() {
         const errors = diagnostics.filter((d) => d.severity === "error");
         const warnings = diagnostics.filter((d) => d.severity === "warning");
         const info = diagnostics.filter((d) => d.severity === "info");
+        const checkSource = readFileSync16(filePath, "utf-8");
+        const usedTags = /* @__PURE__ */ new Set();
+        const collectUsed = (n) => {
+          if (!n) return;
+          if (n.type === "Element" || n.type === "Component") {
+            const t2 = n.tag ?? n.name;
+            if (typeof t2 === "string" && t2[0] === t2[0].toUpperCase()) usedTags.add(t2);
+          }
+          for (const c of n.children ?? []) collectUsed(c);
+          if (n.type === "If" || n.type === "For" || n.type === "While") for (const c of n.body ?? []) collectUsed(c);
+        };
+        if (result.ast) {
+          for (const n of result.ast.body ?? []) collectUsed(n);
+        }
+        const SAFE_TAGS = /* @__PURE__ */ new Set(["Link", "Suspense", "RouterLink", "Image", "optImage"]);
+        const importedNames = /* @__PURE__ */ new Set();
+        for (const im of checkSource.matchAll(/import\s+([A-Za-z_]\w*)\s+from/g)) importedNames.add(im[1]);
+        for (const im of checkSource.matchAll(/import\s*\{([^}]+)\}/g)) {
+          for (const part of im[1].split(",")) {
+            const nm = part.split(" as ").pop().trim();
+            if (nm) importedNames.add(nm);
+          }
+        }
+        const unknownComponents = [];
+        for (const tag of usedTags) {
+          if (SAFE_TAGS.has(tag) || importedNames.has(tag)) continue;
+          if (findComponentUp(dirname8(filePath), tag)) continue;
+          unknownComponents.push(tag);
+        }
+        if (unknownComponents.length > 0) {
+          console.debug(`  ? ${relativePath} -- ${unknownComponents.length} unknown component(s)`);
+          for (const t2 of unknownComponents) {
+            console.debug(`    ? TW098 unknown component <${t2}> -- no import resolves it and no components/${t2}.tw exists`);
+          }
+          totalWarnings += unknownComponents.length;
+        }
         totalErrors += errors.length;
         totalWarnings += warnings.length;
         totalInfo += info.length;
@@ -62043,26 +63367,55 @@ async function checkCommand() {
     console.debug("  Compiler not found, running basic checks...\n");
     for (const filePath of twFiles) {
       const relativePath = filePath.replace(rootDir + "/", "");
-      const source = readFileSync15(filePath, "utf-8");
-      const openBraces = (source.match(/\{/g) || []).length;
-      const closeBraces = (source.match(/\}/g) || []).length;
+      const source = readFileSync16(filePath, "utf-8");
+      const maskedSource = maskSourceStringsAndComments(source);
+      const openBraces = (maskedSource.match(/\{/g) || []).length;
+      const closeBraces = (maskedSource.match(/\}/g) || []).length;
       if (openBraces !== closeBraces) {
         totalErrors++;
-        console.debug(`  X ${relativePath}: unbalanced braces (${openBraces} open, ${closeBraces} close)`);
+        console.log(`  X ${relativePath}: unbalanced braces (${openBraces} open, ${closeBraces} close)`);
       } else {
-        console.debug(`  OK ${relativePath} -- syntax OK`);
+        console.log(`  OK ${relativePath} -- syntax OK`);
       }
     }
   }
-  console.debug(`
+  console.log(`
   Summary: ${totalErrors} errors, ${totalWarnings} warnings, ${totalInfo} info`);
+  const argv = process.argv.slice(2);
+  let maxWarnings = null;
+  if (argv.includes("--strict")) maxWarnings = 0;
+  const mwIdx = argv.indexOf("--max-warnings");
+  if (mwIdx !== -1 && argv[mwIdx + 1] !== void 0 && /^\d+$/.test(argv[mwIdx + 1])) {
+    maxWarnings = Number(argv[mwIdx + 1]);
+  } else {
+    const eq = argv.find((a) => a.startsWith("--max-warnings="));
+    if (eq && /^\d+$/.test(eq.split("=")[1])) maxWarnings = Number(eq.split("=")[1]);
+  }
   if (totalErrors > 0) {
-    console.debug("  Status: FAILED\n");
+    console.log("  Status: FAILED\n");
+    process.exit(1);
+  } else if (maxWarnings !== null && totalWarnings > maxWarnings) {
+    console.log(`  Status: FAILED -- ${totalWarnings} warnings exceed --max-warnings=${maxWarnings}
+`);
     process.exit(1);
   } else {
-    console.debug("  Status: PASSED\n");
+    console.log("  Status: PASSED\n");
   }
 }
+function findComponentUp(dir, name) {
+  let cur = dir;
+  for (let i = 0; i < 12 && cur && cur !== "/"; i++) {
+    try {
+      const candidate = join28(cur, "components", name + ".tw");
+      if (existsSync23(candidate)) return true;
+    } catch {
+    }
+    const parent = dirname8(cur);
+    if (parent === cur) break;
+    cur = parent;
+  }
+  return false;
+}
 function collectFiles2(dir, ext, results) {
   const entries = readdirSync10(dir);
   for (const entry of entries) {
@@ -62077,11 +63430,12 @@ function collectFiles2(dir, ext, results) {
 }
 
 // tw/commands/plugin.ts
+init_tw();
 import { join as join29 } from "node:path";
-import { existsSync as existsSync24, readFileSync as readFileSync16, writeFileSync as writeFileSync9, mkdirSync as mkdirSync9, readdirSync as readdirSync11 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync17, writeFileSync as writeFileSync9, mkdirSync as mkdirSync9, readdirSync as readdirSync11 } from "node:fs";
 function readConfigPlugins(cfgPath) {
   if (!existsSync24(cfgPath)) return [];
-  const src = readFileSync16(cfgPath, "utf-8");
+  const src = stripCommentsStringAware(readFileSync17(cfgPath, "utf-8"));
   const m = /plugins\s*:\s*\[([^\]]*)\]/s.exec(src);
   if (!m) return [];
   const out = [];
@@ -62100,7 +63454,7 @@ function addConfigPlugin(cfgPath, name) {
 `);
     return true;
   }
-  const src = readFileSync16(cfgPath, "utf-8");
+  const src = stripCommentsStringAware(readFileSync17(cfgPath, "utf-8"));
   if (new RegExp(`["'\`]${name}["'\`]`).test(src)) return false;
   const m = /plugins\s*:\s*\[([^\]]*)\]/s.exec(src);
   if (m) {
@@ -62117,7 +63471,7 @@ function addConfigPlugin(cfgPath, name) {
 }
 function removeConfigPlugin(cfgPath, name) {
   if (!existsSync24(cfgPath)) return false;
-  const src = readFileSync16(cfgPath, "utf-8");
+  const src = stripCommentsStringAware(readFileSync17(cfgPath, "utf-8"));
   const m = /plugins\s*:\s*\[([^\]]*)\]/s.exec(src);
   if (!m) return false;
   const kept = m[1].split(",").map((e) => e.trim()).filter((e) => e && e !== `"${name}"` && e !== `'${name}'` && e !== "`" + name + "`");
@@ -62321,13 +63675,13 @@ async function lspCommand() {
 }
 
 // tw/help.ts
-import { readFileSync as readFileSync17 } from "node:fs";
+import { readFileSync as readFileSync18 } from "node:fs";
 import { join as join31 } from "node:path";
 function cliVersion() {
   try {
     const bd = globalThis.__TW_BUNDLE_DIR;
     const pj = bd ? join31(bd, "..", "package.json") : new URL("../../package.json", import.meta.url).pathname;
-    return JSON.parse(readFileSync17(pj, "utf-8")).version ?? "0.0.0";
+    return JSON.parse(readFileSync18(pj, "utf-8")).version ?? "0.0.0";
   } catch {
     return "0.0.0";
   }
@@ -62400,13 +63754,13 @@ var helpText = `
 
 // tw/commands/index.ts
 await init_build();
-import { readFileSync as readFileSync18 } from "node:fs";
+import { readFileSync as readFileSync19 } from "node:fs";
 import { join as join32 } from "node:path";
 var VERSION = (() => {
   try {
     const bd = globalThis.__TW_BUNDLE_DIR;
     const pj = bd ? join32(bd, "..", "package.json") : new URL("../../package.json", import.meta.url).pathname;
-    return JSON.parse(readFileSync18(pj, "utf-8")).version ?? "0.0.0";
+    return JSON.parse(readFileSync19(pj, "utf-8")).version ?? "0.0.0";
   } catch {
     return "0.0.0";
   }