tw-framework 1.0.7 → 1.0.9

package/dist/tw.mjs

@@ -13372,6 +13372,13 @@ function consumeSignalDeclaration(cursor) {
 function consumeStateValue(cursor) {
   const t2 = cursor.peek();
   if (!t2) return "";
+  if (t2.value === "-" || t2.value === "+") {
+    const after = cursor.peek(1);
+    if (after && (after.type === "NUMBER" || after.type === "IDENT" || after.type === "KEYWORD")) {
+      cursor.advance();
+      return (t2.value === "-" ? "-" : "") + String(after.value);
+    }
+  }
   if (t2.type === "STRING" || t2.type === "NUMBER" || t2.type === "IDENT" || t2.type === "KEYWORD") {
     cursor.advance();
     if (t2.type === "STRING") return String(t2.value).replace(/\\([{}"])/g, "$1");
@@ -14389,6 +14396,20 @@ function parseTWSelector(cursor, errors, state, parseBody) {
         }
         cursor.consumeIf("RBRACE");
       } else {
+        for (; ; ) {
+          const t2 = cursor.peek();
+          if (!t2 || t2.type === "RBRACE" || t2.type === "EOF") break;
+          if ((t2.type === "IDENT" || t2.type === "KEYWORD") && ATTR_PAIR_NAMES.has(t2.value)) {
+            const after = cursor.peek(1);
+            if (after && (after.type === "STRING" || after.type === "NUMBER")) {
+              cursor.advance();
+              cursor.advance();
+              el.attrs.push(createAttribute(t2.value, after.value, t2.pos.line, t2.pos.col));
+              continue;
+            }
+          }
+          break;
+        }
         el.children = parseBody(["RBRACE"]);
         cursor.consumeIf("RBRACE");
       }
@@ -15007,10 +15028,13 @@ function parseWhileStatement(cursor, errors, parseBody) {
   const whileToken = cursor.advance();
   if (!whileToken) return null;
   cursor.skipWhitespace();
-  const condToken = cursor.peek();
   let condition = "";
-  if (condToken) {
-    condition = condToken.value;
+  while (!cursor.done) {
+    cursor.skipWhitespace();
+    const t2 = cursor.peek();
+    if (!t2 || t2.type === "EOF") break;
+    if (t2.type === "LBRACE" || t2.value === "{") break;
+    condition += (condition ? " " : "") + t2.value;
     cursor.advance();
   }
   const body = parseBlockBody2(cursor, parseBody);
@@ -15131,13 +15155,133 @@ function parseBlockBody2(cursor, parseBody) {
   }
   return parseBody(["KEYWORD", "RBRACE"]);
 }
-var CLASS_BOUNDARY_BOOLEAN_ATTRS;
+var ATTR_PAIR_NAMES, CLASS_BOUNDARY_BOOLEAN_ATTRS;
 var init_statements = __esm({
   "../../packages/compiler/tw/parser/statements/index.ts"() {
     init_nodes();
     init_recovery();
     init_directives();
     init_tw();
+    ATTR_PAIR_NAMES = /* @__PURE__ */ new Set([
+      "href",
+      "src",
+      "type",
+      "id",
+      "name",
+      "value",
+      "placeholder",
+      "action",
+      "method",
+      "title",
+      "alt",
+      "rel",
+      "target",
+      "lang",
+      "charset",
+      "content",
+      "width",
+      "height",
+      "loading",
+      "for",
+      "role",
+      "min",
+      "max",
+      "step",
+      "pattern",
+      "accept",
+      "list",
+      "download",
+      "tabindex",
+      "cols",
+      "rows",
+      "wrap",
+      "datetime",
+      "method",
+      "action",
+      "placeholder",
+      "disabled",
+      "required",
+      "readonly",
+      "checked",
+      "selected",
+      "target",
+      "rel",
+      "download",
+      "autocomplete",
+      "autofocus",
+      "min",
+      "max",
+      "step",
+      "pattern",
+      "multiple",
+      "size",
+      "cols",
+      "rows",
+      "wrap",
+      "for",
+      "hidden",
+      "width",
+      "height",
+      "loading",
+      "loop",
+      "muted",
+      "controls",
+      "poster",
+      "preload",
+      "contenteditable",
+      "draggable",
+      "spellcheck",
+      "translate",
+      "accesskey",
+      "tabindex",
+      "role",
+      "slot",
+      "is",
+      "part",
+      "enterkeyhint",
+      "inert",
+      "inputmode",
+      "sandbox",
+      "allow",
+      "allowfullscreen",
+      "referrerpolicy",
+      "fetchpriority",
+      "blocking",
+      "property",
+      "itemprop",
+      "itemtype",
+      "itemid",
+      "itemref",
+      "itemscope",
+      "charset",
+      "http-equiv",
+      "data",
+      "nonce",
+      "crossorigin",
+      "integrity",
+      "async",
+      "defer",
+      "srcset",
+      "sizes",
+      "media",
+      "ping",
+      "coords",
+      "shape",
+      "usemap",
+      "ismap",
+      "kind",
+      "srclang",
+      "default",
+      "autoplay",
+      "playsinline",
+      "enctype",
+      "novalidate",
+      "formaction",
+      "formmethod",
+      "formtarget",
+      "formenctype",
+      "formnovalidate"
+    ]);
     CLASS_BOUNDARY_BOOLEAN_ATTRS = /* @__PURE__ */ new Set([
       "disabled",
       "required",
@@ -22950,7 +23094,7 @@ var init_types4 = __esm({
 var TW_VERSION, TW_GENERATOR_META;
 var init_version = __esm({
   "../../packages/compiler/tw/codegen/version.ts"() {
-    TW_VERSION = "1.0.7";
+    TW_VERSION = "1.0.9";
     TW_GENERATOR_META = `<meta name="generator" content="TW Framework ${TW_VERSION}">`;
   }
 });
@@ -23337,6 +23481,16 @@ function collectBuiltinImports(program) {
   for (const dir of program.directives ?? []) {
     if (dir.type !== "ImportDirective") continue;
     const imp = dir;
+    if (imp.source === "tw" || imp.source === "@tw/server") {
+      for (const item of imp.items ?? []) {
+        const name = item.split(" as ").pop().trim();
+        const spec = TW_NAMED_BUILTINS[name];
+        if (spec) out.set(name, spec);
+      }
+      if (imp.defaultImport && TW_NAMED_BUILTINS[imp.defaultImport]) {
+        out.set(imp.defaultImport, TW_NAMED_BUILTINS[imp.defaultImport]);
+      }
+    }
     if (!BUILTIN_COMPONENT_SPECIFIERS.includes(imp.source)) continue;
     if (imp.defaultImport) out.set(imp.defaultImport, imp.source);
     for (const item of imp.items ?? []) {
@@ -23406,7 +23560,7 @@ function normalizePrefetchProp(props) {
   return p;
 }
 function generateRouterLinkTag(props, textContent) {
-  const href = (props.href ?? "").trim();
+  const href = (props.href ?? props.to ?? "").trim();
   if (!href) return `<!-- @tw/RouterLink: missing href -->`;
   const opts = {
     href,
@@ -23433,13 +23587,18 @@ function generateBuiltinTag(specifier, props, textContent) {
   if (specifier === "@tw/RouterLink") return generateRouterLinkTag(props, textContent);
   return null;
 }
-var BUILTIN_COMPONENT_SPECIFIERS, imageConfig;
+var BUILTIN_COMPONENT_SPECIFIERS, imageConfig, TW_NAMED_BUILTINS;
 var init_builtin_components = __esm({
   "../../packages/compiler/tw/codegen/builtin-components.ts"() {
     init_tw2();
     init_tw3();
     BUILTIN_COMPONENT_SPECIFIERS = ["@tw/optImage", "@tw/RouterLink"];
     imageConfig = DEFAULT_IMAGE_CONFIG;
+    TW_NAMED_BUILTINS = {
+      RouterLink: "@tw/RouterLink",
+      optImage: "@tw/optImage",
+      Image: "@tw/optImage"
+    };
   }
 });
 
@@ -24076,6 +24235,58 @@ function stripTssComments(src) {
   return out;
 }
 function compileTSS(source) {
+  {
+    let depth = 0;
+    let line = 1;
+    let inString = null;
+    let inComment = false;
+    let inUrl = false;
+    for (let i = 0; i < source.length; i++) {
+      const ch = source[i];
+      const prev = i > 0 ? source[i - 1] : "";
+      if (ch === "\n") {
+        line++;
+        inComment = false;
+        continue;
+      }
+      if (inComment) continue;
+      if (inString) {
+        if (ch === inString && prev !== "\\") inString = null;
+        continue;
+      }
+      if (inUrl) {
+        if (ch === ")") inUrl = false;
+        continue;
+      }
+      if (ch === "/" && source[i + 1] === "/" && source.slice(Math.max(0, i - 3), i).includes(":")) {
+        inUrl = true;
+        continue;
+      }
+      if (ch === "u" && source.slice(i, i + 4) === "url(") {
+        inUrl = true;
+        i += 3;
+        continue;
+      }
+      if (ch === "/" && source[i + 1] === "/") {
+        inComment = true;
+        continue;
+      }
+      if (ch === '"' || ch === "'") {
+        inString = ch;
+        continue;
+      }
+      if (ch === "{") depth++;
+      else if (ch === "}") {
+        depth--;
+        if (depth < 0) {
+          throw new Error("TW303: unbalanced '}' in stylesheet (line " + line + ")\n  " + (source.split("\n")[line - 1] ?? "").trim().slice(0, 80));
+        }
+      }
+    }
+    if (depth !== 0) {
+      throw new Error("TW303: " + depth + " unclosed '{' in stylesheet -- a rule block is never closed\n  last line: " + (source.split("\n").pop() ?? "").trim().slice(0, 80));
+    }
+  }
   const __twOut = __twCompileTSSInner(source);
   const leftover = __twOut.match(/\$[A-Za-z_][\w-]*/g);
   if (leftover && !/\$\{/.test(__twOut)) {
@@ -24620,11 +24831,11 @@ function emit(items, parent, env, mixins, out) {
 }
 function compileSCSS(source) {
   const cleaned0 = stripComments(source);
-  const UNSUPPORTED = /@(import|mixin|include|extend|use|forward|function|each|if)\b/g;
+  const UNSUPPORTED = /@(import|extend|use|forward|function|each|if|else|for|while)\b/g;
   const m = cleaned0.match(UNSUPPORTED);
   if (m) {
     const seen = Array.from(new Set(m.map((x) => x.trim())));
-    console.warn("[scss] unsupported at-rule(s) ignored: " + seen.join(", ") + " -- TW's SCSS subset supports nesting, $vars and & references only");
+    console.warn("[scss] unsupported at-rule(s) ignored: " + seen.join(", ") + " -- TW's SCSS subset supports nesting, $vars, & references and @mixin/@include");
   }
   const items = parseItems(stripComments(source));
   const out = [];
@@ -24766,13 +24977,13 @@ function collectTssImports(programs, ctx) {
               else ctx.inlineStyles.push(css);
             }
           } catch (e) {
-            if (e && typeof e.message === "string" && /^TW30[12]/.test(e.message)) throw e;
+            if (e && typeof e.message === "string" && /^TW30[123]/.test(e.message)) throw e;
           }
         }
       }
     }
   } catch (e) {
-    if (e && typeof e.message === "string" && /^TW30[12]/.test(e.message)) throw e;
+    if (e && typeof e.message === "string" && /^TW30[123]/.test(e.message)) throw e;
   }
 }
 function resolveTssPath(fromDir, rel) {
@@ -24992,6 +25203,10 @@ function generateSuspense(el, ctx) {
 function generateElement(el, ctx) {
   const tag = el.tag;
   const voidTag = VOID_TAGS5.has(tag.toLowerCase());
+  if (tag.length > 0 && tag[0] === tag[0].toUpperCase() && !["Link", "Suspense"].includes(tag) && !componentRegistry.has(tag) && !resolveBuiltin(tag, activeBuiltinImports)) {
+    console.warn("[tw] unknown component <" + tag + "> (" + el.line + ":" + el.col + ") -- no import resolves it; nothing was rendered");
+    return "<!-- TW: unknown component '" + tag + "' -- check the import -->";
+  }
   {
     const builtinSpec = resolveBuiltin(tag, activeBuiltinImports);
     if (builtinSpec) {
@@ -25251,7 +25466,13 @@ function generateComponent(comp, ctx) {
     ctx.slotContent = savedSlot;
     ctx.inHead = compSavedInHead;
   } else {
-    childrenHTML = comp.children.map((c) => generateNode(c, ctx)).join("");
+    const known = ["Link", "Suspense"];
+    if (!known.includes(compName)) {
+      console.warn("[tw] unknown component <" + compName + "> (" + comp.line + ":" + comp.col + ") -- unresolvable import; nothing was rendered");
+      childrenHTML = "<!-- TW: unknown component '" + compName + "' -- check the import -->";
+    } else {
+      childrenHTML = comp.children.map((c) => generateNode(c, ctx)).join("");
+    }
   }
   ctx.stateVars = savedStateVars;
   ctx.componentStack.pop();
@@ -29046,13 +29267,27 @@ ${indentation})` : type;
 });
 
 // ../../packages/compiler/tw/codegen/vdom.ts
+function stateLiteralForRender(raw) {
+  const evalNum = (v) => typeof v === "number" || typeof v === "boolean" ? String(v) : null;
+  try {
+    const n = evalNum(JSON.parse(raw));
+    if (n !== null) return n;
+  } catch {
+  }
+  try {
+    const n = evalNum(new Function("return (" + raw + ")")());
+    if (n !== null) return n;
+  } catch {
+  }
+  return raw;
+}
 function generateWithLayout(layoutProgram, pageProgram, stateVars) {
   const ctx = createContext("ssr");
   if (stateVars) ctx.stateVars = { ...stateVars };
   for (const dir of pageProgram.directives || []) {
     if (dir.type === "StateDirective") {
       for (const decl of dir.declarations || []) {
-        ctx.stateVars[decl.name] = decl.value;
+        ctx.stateVars[decl.name] = stateLiteralForRender(decl.value);
       }
     }
   }
@@ -29084,7 +29319,7 @@ function generateWithLayoutChain(layoutPrograms, pageProgram, stateVars) {
     for (const dir of pageProgram.directives || []) {
       if (dir.type === "StateDirective") {
         for (const decl of dir.declarations || []) {
-          ctx2.stateVars[decl.name] = decl.value;
+          ctx2.stateVars[decl.name] = stateLiteralForRender(decl.value);
         }
       }
     }
@@ -29275,7 +29510,9 @@ function generate(program, stateVars) {
           ctx.hasInteractivity = true;
           continue;
         }
-        ctx.stateVars[decl.name] = decl.value;
+        if (!(decl.name in ctx.stateVars)) {
+          ctx.stateVars[decl.name] = stateLiteralForRender(decl.value);
+        }
         let v = decl.value;
         try {
           v = JSON.parse(decl.value);
@@ -29608,7 +29845,11 @@ var init_codes = __esm({
       TW090: { message: "cache { } requires a revalidate window or a life profile", severity: "error", category: "syntax" },
       TW091: { message: "fn cached handler is impure (request.cookies/headers/body or setSignal)", severity: "error", category: "semantic" },
       TW092: { message: "Unknown cache profile", severity: "error", category: "semantic" },
-      TW093: { message: "Non-deterministic call in a cached handler (value freezes into the cache entry)", severity: "warning", category: "best-practice" }
+      TW093: { message: "Non-deterministic call in a cached handler (value freezes into the cache entry)", severity: "warning", category: "best-practice" },
+      TW094: { message: "Invalid state literal -- array/object elements must be comma-separated (and objects need colons)", severity: "error", category: "syntax" },
+      TW095: { message: "Invalid for-loop iterable -- use {varName} or a valid comma-separated literal", severity: "error", category: "syntax" },
+      TW096: { message: "Unknown state variable in interpolation (renders empty)", severity: "warning", category: "semantic" },
+      TW097: { message: "while with a comparison renders its body ONCE at build time (state cannot mutate during SSR) -- use for loops for repetition", severity: "warning", category: "semantic" }
     };
   }
 });
@@ -29929,6 +30170,124 @@ function checkUnusedDeclarations(program, filePath, diags) {
     }
   }
 }
+function literalIsBroken(value) {
+  const v = value.trim();
+  if (!v.startsWith("[") && !v.startsWith("{")) return false;
+  try {
+    new Function("return (" + v + ")");
+    return false;
+  } catch {
+    return true;
+  }
+}
+function checkStateLiterals(program, filePath, diags) {
+  for (const decl of collectStateDecls(program)) {
+    if (decl.signalKind === "derived") continue;
+    if (literalIsBroken(String(decl.value))) {
+      diags.push(createDiagnostic(
+        "TW094",
+        decl.line,
+        decl.col,
+        filePath,
+        `${decl.name} = ${decl.value}`,
+        [
+          `Comma-separate array elements: ${decl.name} = ["a", "b", "c"]`,
+          `Objects need colons: ${decl.name} = { key: "value" }`
+        ]
+      ));
+    }
+  }
+}
+function checkLoopIterables(program, filePath, diags) {
+  forEachNode(program, (node) => {
+    if (!node || node.type !== "For") return;
+    const iterable = String(node.iterable ?? "").trim();
+    if (!iterable) {
+      diags.push(createDiagnostic(
+        "TW095",
+        node.line,
+        node.col,
+        filePath,
+        "for-loop has no iterable",
+        [`Use: for item in {list} { ... }`]
+      ));
+      return;
+    }
+    if (/^\{[A-Za-z_][\w.]*\}$/.test(iterable)) return;
+    if (/^[A-Za-z_][\w.]*$/.test(iterable)) return;
+    if (literalIsBroken(iterable)) {
+      diags.push(createDiagnostic(
+        "TW095",
+        node.line,
+        node.col,
+        filePath,
+        "for x in " + iterable,
+        [
+          `Wrap a state variable in braces: for item in {items}`,
+          `Literals need commas: for item in {["a", "b", "c"]}`
+        ]
+      ));
+    }
+  });
+}
+function checkUnknownStateVars(program, filePath, diags) {
+  const known = /* @__PURE__ */ new Set();
+  for (const decl of collectStateDecls(program)) known.add(decl.name);
+  forEachNode(program, (node) => {
+    if (node && node.type === "For" && node.varName) known.add(node.varName);
+    if (node && node.type === "For" && node.indexName) known.add(node.indexName);
+  });
+  const BUILTINS2 = /* @__PURE__ */ new Set([
+    "params",
+    "props",
+    "Math",
+    "Date",
+    "JSON",
+    "String",
+    "Number",
+    "Boolean",
+    "Array",
+    "Object",
+    "window",
+    "true",
+    "false",
+    "null",
+    "undefined"
+  ]);
+  forEachNode(program, (node) => {
+    if (!isText(node)) return;
+    const text = String(node.value ?? "");
+    if (!text.includes("{")) return;
+    for (const m of text.matchAll(/\{\s*([A-Za-z_][\w]*)\s*\}/g)) {
+      const name = m[1];
+      if (known.has(name) || BUILTINS2.has(name)) continue;
+      diags.push(createDiagnostic(
+        "TW096",
+        node.line,
+        node.col,
+        filePath,
+        `{${name}}`,
+        [`Declare it in the state block, or check the spelling`]
+      ));
+    }
+  });
+}
+function checkWhileComparisons(program, filePath, diags) {
+  forEachNode(program, (node) => {
+    if (!node || node.type !== "While") return;
+    const cond = String(node.condition ?? "");
+    if (/[<>=!]/.test(cond)) {
+      diags.push(createDiagnostic(
+        "TW097",
+        node.line,
+        node.col,
+        filePath,
+        "while " + cond,
+        ["Use `for item in {list}` for repetition", "while is for boolean flags (state { loading = true })"]
+      ));
+    }
+  });
+}
 var HTML_ELEMENTS2, HTML_ATTRIBUTES2, GLOBAL_ATTRIBUTES2, CSS_PROPERTIES2, CSS_ALIASES2, EVENT_TYPES2, ARIA_ROLES2, ARIA_ATTRIBUTES2;
 var init_rules = __esm({
   "../../packages/compiler/tw/diagnostics/rules.ts"() {
@@ -30819,6 +31178,10 @@ function diagnose(program, filePath) {
   checkSemanticErrors(program, filePath, diagnostics);
   checkDirectives(program, filePath, diagnostics);
   checkUnusedDeclarations(program, filePath, diagnostics);
+  checkStateLiterals(program, filePath, diagnostics);
+  checkLoopIterables(program, filePath, diagnostics);
+  checkUnknownStateVars(program, filePath, diagnostics);
+  checkWhileComparisons(program, filePath, diagnostics);
   return diagnostics;
 }
 var RuleEngine;
@@ -40443,6 +40806,8 @@ function matchPath(pattern, pathname) {
 }
 function ruleBlocked(rule, request, pathname) {
   const headers = request.headers;
+  const hasCondition = rule.userAgent || rule.path || rule.auth || rule.rateLimit || rule.origin || rule.methods && rule.methods.length > 0;
+  if (!hasCondition) return true;
   if (rule.userAgent) {
     const ua = (headers.get("user-agent") ?? "").toLowerCase();
     if (!ua) {
@@ -41011,6 +41376,15 @@ var init_revalidate = __esm({
 });
 
 // ../../packages/server/tw/routing/signal-stream.ts
+var signal_stream_exports = {};
+__export(signal_stream_exports, {
+  SignalHub: () => SignalHub,
+  createSignalStream: () => createSignalStream,
+  getSignalHub: () => getSignalHub,
+  setSignal: () => setSignal,
+  sseFrameWithId: () => sseFrameWithId,
+  writeSignalFromClient: () => writeSignalFromClient
+});
 function getSignalHub() {
   if (!hub) hub = new SignalHub();
   return hub;
@@ -41032,11 +41406,158 @@ function setSignal(name, value, opts) {
   }
   return getSignalHub().setSignal(name, value, session ? { session } : void 0);
 }
-var BATCH_MS, HISTORY_LIMIT, SignalHub, hub;
+function sseFrameWithId(payload) {
+  try {
+    const seq = JSON.parse(payload).seq;
+    if (typeof seq === "number") return "id: " + seq + "\ndata: " + payload + "\n\n";
+  } catch {
+  }
+  return "data: " + payload + "\n\n";
+}
+function createSignalStream(request, url, opts) {
+  const hub2 = getSignalHub();
+  if (opts && !hub2.__cfg) {
+    hub2.__cfg = true;
+    try {
+      hub2.configure({ maxClients: opts.maxClients, maxHistory: opts.maxHistory });
+    } catch {
+    }
+  }
+  if (url.searchParams.get("stats")) {
+    return new Response(JSON.stringify(hub2.getStats(), null, 2), {
+      status: 200,
+      headers: { "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store" }
+    });
+  }
+  if (!hub2.canAcceptClient()) {
+    return new Response("Too many signal-stream connections", {
+      status: 503,
+      headers: { "Content-Type": "text/plain", "Retry-After": "5" }
+    });
+  }
+  const names = (url.searchParams.get("s") ?? "").split(",").map((x) => x.trim()).filter(Boolean);
+  let since = Number(url.searchParams.get("since") ?? "0") || 0;
+  if (!since) {
+    const lei = Number(request.headers.get("last-event-id") ?? "0") || 0;
+    if (lei) since = lei;
+  }
+  const declared = /* @__PURE__ */ new Map();
+  for (const n of names) declared.set(n, "public");
+  let session;
+  try {
+    const header = request.headers.get("cookie") ?? "";
+    const m = /(?:^|;\s*)tw_session=([^;]+)/.exec(header);
+    if (m) session = decodeURIComponent(m[1].trim().replace(/^"|"$/g, ""));
+  } catch {
+  }
+  const enc = new TextEncoder();
+  const sse = (payload) => enc.encode(sseFrameWithId(payload));
+  let registered = null;
+  let keepAlive = null;
+  const stream = new ReadableStream({
+    start(controller) {
+      const client = hub2.register(declared, session);
+      registered = client;
+      const cleanup = () => {
+        if (keepAlive) clearInterval(keepAlive);
+        hub2.unregister(client.id);
+        try {
+          controller.close();
+        } catch {
+        }
+      };
+      client.send = (payload) => {
+        try {
+          controller.enqueue(sse(payload));
+        } catch {
+          cleanup();
+        }
+      };
+      client.close = cleanup;
+      for (const payload of hub2.connectPayloads(since, declared, session)) {
+        try {
+          controller.enqueue(sse(payload));
+        } catch {
+          break;
+        }
+      }
+      keepAlive = setInterval(() => {
+        try {
+          controller.enqueue(enc.encode(": keep-alive\n\n"));
+        } catch {
+          cleanup();
+        }
+      }, 25e3);
+    },
+    // v2: when the browser drops the connection (tab close, network
+    // loss) cancel fires -- remove THIS hub entry immediately instead
+    // of waiting for the next failed send.
+    cancel() {
+      if (keepAlive) clearInterval(keepAlive);
+      try {
+        registered?.close?.();
+      } catch {
+      }
+    }
+  });
+  return new Response(stream, {
+    status: 200,
+    headers: {
+      "Content-Type": "text/event-stream; charset=utf-8",
+      "Cache-Control": "no-store",
+      "X-Accel-Buffering": "no",
+      Connection: "keep-alive"
+    }
+  });
+}
+async function writeSignalFromClient(request, opts) {
+  if (!opts?.clientWrites) {
+    return new Response(JSON.stringify({ error: "client signal writes are disabled" }), {
+      status: 403,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  let body = null;
+  try {
+    body = await request.json();
+  } catch {
+  }
+  const name = body?.name;
+  if (typeof name !== "string" || !("value" in (body ?? {}))) {
+    return new Response(JSON.stringify({ error: "body must be { name, value }" }), {
+      status: 400,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  const hub2 = getSignalHub();
+  const kind = (hub2.getStats().signals ?? {})[name];
+  if (kind && kind !== "public") {
+    return new Response(JSON.stringify({ error: "only public signals are client-writable" }), {
+      status: 403,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  const res = hub2.setSignal(name, body.value);
+  if (!res.queued) {
+    return new Response(JSON.stringify({ error: res.error ?? "rejected" }), {
+      status: 400,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  return new Response(JSON.stringify({ ok: true, kind: res.kind }), {
+    status: 202,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+var BATCH_MS, HISTORY_LIMIT, MAX_CLIENTS, MAX_VALUE_BYTES, MAX_NAME_LEN, NAME_RE, SignalHub, hub;
 var init_signal_stream = __esm({
   "../../packages/server/tw/routing/signal-stream.ts"() {
     BATCH_MS = 100;
     HISTORY_LIMIT = 1e3;
+    MAX_CLIENTS = 500;
+    MAX_VALUE_BYTES = 64 * 1024;
+    MAX_NAME_LEN = 64;
+    NAME_RE = /^[A-Za-z0-9_$.-]{1,64}$/;
     SignalHub = class {
       clients = /* @__PURE__ */ new Map();
       nextClientId = 1;
@@ -41047,12 +41568,82 @@ var init_signal_stream = __esm({
       pending = /* @__PURE__ */ new Map();
       pendingSession;
       timer = null;
+      // v2 stats + caps
+      maxClients = MAX_CLIENTS;
+      createdAt = Date.now();
+      totalUpdates = 0;
+      batchesFlushed = 0;
+      rejectedCount = 0;
+      /** v2: configure caps (from tw.config.ts signalStream options). */
+      configure(opts) {
+        if (opts?.maxClients && opts.maxClients > 0) this.maxClients = opts.maxClients;
+        if (opts?.maxHistory && opts.maxHistory > 0) this.historyLimit = opts.maxHistory;
+      }
+      historyLimit = HISTORY_LIMIT;
+      /** v2: observability for /_tw/stream?stats=1 and window.__tw stats. */
+      getStats() {
+        const signals = {};
+        for (const [n, k] of this.kinds) signals[n] = k;
+        return {
+          clients: this.clients.size,
+          clientCap: this.maxClients,
+          seq: this.seq,
+          signals,
+          valueCount: this.values.size,
+          history: this.history.length,
+          historyCap: this.historyLimit,
+          pending: this.pending.size,
+          totalUpdates: this.totalUpdates,
+          batchesFlushed: this.batchesFlushed,
+          rejected: this.rejectedCount,
+          uptimeMs: Date.now() - this.createdAt
+        };
+      }
+      /** v2: graceful shutdown -- close every connected stream now. */
+      closeAll() {
+        for (const c of [...this.clients.values()]) {
+          try {
+            c.close();
+          } catch {
+          }
+        }
+        this.clients.clear();
+        if (this.timer != null) {
+          clearTimeout(this.timer);
+          this.timer = null;
+        }
+        this.pending.clear();
+      }
+      /** v2: connection cap check BEFORE registering a stream client. */
+      canAcceptClient() {
+        return this.clients.size < this.maxClients;
+      }
+      /** v2: validate a setSignal name/value without throwing. */
+      validateSignal(name, value) {
+        if (typeof name !== "string" || name.length === 0 || name.length > MAX_NAME_LEN) {
+          return "signal name must be 1-" + MAX_NAME_LEN + " chars";
+        }
+        if (!NAME_RE.test(name)) return "signal name has invalid characters";
+        if (value === void 0) return "signal value is undefined";
+        try {
+          const size = typeof value === "string" ? value.length : JSON.stringify(value)?.length ?? 0;
+          if (size > MAX_VALUE_BYTES) return "signal value exceeds " + MAX_VALUE_BYTES + " bytes";
+        } catch {
+          return "signal value is not serializable";
+        }
+        return null;
+      }
       /**
        * Server-side mutation (route handlers): queue an update, batch-flush.
        * With `session` (derived from the request's tw_session cookie) private
        * signals are delivered only to clients authenticated as that session.
        */
       setSignal(name, value, opts) {
+        const invalid = this.validateSignal(name, value);
+        if (invalid) {
+          this.rejectedCount++;
+          return { queued: false, kind: this.kinds.get(name), error: invalid };
+        }
         const kind = this.kinds.get(name) ?? "public";
         this.values.set(name, value);
         this.kinds.set(name, kind);
@@ -41083,9 +41674,27 @@ var init_signal_stream = __esm({
         this.clients.set(id, client);
         return client;
       }
+      /** v2: remove a stream client (its connection died / was cancelled).
+       *  The old handler overwrote client.close() with a closure that only
+       *  closed the controller -- the Map entry leaked forever, so every
+       *  disconnected browser still occupied a slot (and got flushed frames).
+       */
+      unregister(id) {
+        this.clients.delete(id);
+      }
       /** Build the replay/snapshot preamble for a connecting client. */
       connectPayloads(since, declared, session) {
         const out = [];
+        if (since <= 0 && this.values.size > 0) {
+          const snap = {};
+          for (const [name, value] of this.values) {
+            if (this.sessionMatches(session, { names: [name], session: this.valueSessions.get(name) }) && this.deliversTo(declared, [name])) snap[name] = value;
+          }
+          if (Object.keys(snap).length > 0) {
+            out.push(this.frame({ v: 1, seq: this.seq, snapshot: snap }));
+          }
+          return out;
+        }
         const hasCoverage = since <= this.seq && this.history.length > 0 && since >= this.history[0].seq - 1;
         if (hasCoverage) {
           for (const entry of this.history) {
@@ -41128,7 +41737,9 @@ var init_signal_stream = __esm({
         for (const [n] of updates) this.valueSessions.set(n, session);
         const payload = this.frame({ v: 1, seq: this.seq, updates });
         this.history.push({ seq: this.seq, payload, names, session });
-        if (this.history.length > HISTORY_LIMIT) this.history.shift();
+        this.totalUpdates += updates.length;
+        this.batchesFlushed++;
+        if (this.history.length > this.historyLimit) this.history.shift();
         for (const client of this.clients.values()) {
           if (this.sessionMatches(client.session, { names, session }) && this.deliversTo(client.declared, names)) client.send(payload);
         }
@@ -41815,6 +42426,7 @@ var init_render_pipeline = __esm({
     init_twm_loader();
     init_scanner();
     init_layout_chain();
+    init_signal_stream();
     init_helpers();
     init_tw6();
     init_twm_loader();
@@ -41968,6 +42580,17 @@ var init_render_pipeline = __esm({
         try {
           const pageState = { ...stateVars ?? {}, ...match.params ?? {}, params: match.params ?? {} };
           const requestVarKeys = new Set(Object.keys({ ...stateVars ?? {}, ...match.params ?? {} }));
+          try {
+            const hub2 = getSignalHub();
+            const snap = hub2.snapshot();
+            if (snap && snap.snapshot && typeof snap.snapshot === "object") {
+              for (const [k, v] of Object.entries(snap.snapshot)) {
+                pageState[k] = v;
+                requestVarKeys.add(k);
+              }
+            }
+          } catch {
+          }
           const pageCompiled = this.compileFile(ctx.page, pageState);
           {
             const seed = pageCompiled.stateSeed;
@@ -42013,24 +42636,30 @@ var init_render_pipeline = __esm({
           let layoutTitle;
           const liftedParts = [];
           {
-            for (const headMatch of bodyHTML.matchAll(/<head[^>]*>([\s\S]*?)<\/head>/gi)) {
+            const collectedTitles = [];
+            for (const headMatch of bodyHTML.matchAll(/<head(?:\s[^>]*)?>([\s\S]*?)<\/head\s*>/gi)) {
               const headInner = headMatch[1];
               const tMatch = headInner.match(/<title>([^<]*)<\/title>/i);
-              if (tMatch) layoutTitle = tMatch[1].trim().replace(/&quot;/g, '"').replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
-              const kids = headInner.replace(/<title>[^<]*<\/title>/gi, "").replace(/<meta[^>]+charset[^>]*>/gi, "").replace(/<meta[^>]+viewport[^>]*>/gi, "").trim();
+              if (tMatch) collectedTitles.push(tMatch[1].trim().replace(/&(amp|lt|gt|quot);/g, (m, k) => k === "amp" ? String.fromCharCode(38) : k === "lt" ? String.fromCharCode(60) : k === "gt" ? String.fromCharCode(62) : String.fromCharCode(34)));
+              else collectedTitles.push("");
+              const kids = headInner.replace(/<title>[^<]*<\/title>/gi, "").replace(/<meta[^>]+charset[^>]*>/gi, "").replace(/<meta[^>]+viewport[^>]*>/gi, "").replace(/<meta[^>]+generator[^>]*>/gi, "").trim();
               if (kids) liftedParts.push(kids);
             }
-            bodyHTML = bodyHTML.replace(/<head[^>]*>[\s\S]*?<\/head>/gi, "");
+            bodyHTML = bodyHTML.replace(/<head(?:\s[^>]*)?>[\s\S]*?<\/head\s*>/gi, "");
+            const templateTitle = collectedTitles.find((t2) => t2.includes("__TW_PAGETITLE__"));
+            layoutTitle = templateTitle ?? collectedTitles.filter(Boolean).pop();
             bodyHTML = bodyHTML.replace(/<\/?(?:html|body)[^>]*>/gi, "");
             bodyHTML = bodyHTML.replace(/<!DOCTYPE[^>]*>/gi, "");
           }
           const liftedHead = liftedParts.join("\n");
-          if (ctx.error) {
+          const liveRenderMode = this.extractRenderMode(ctx.page);
+          if (ctx.error && (liveRenderMode === "ssr" || liveRenderMode === "stream")) {
             const errorCompiled = this.compileFile(ctx.error);
             allCSS = errorCompiled.css + "\n" + allCSS;
             bodyHTML = `<div data-error-boundary>${bodyHTML}</div>`;
           }
-          if (ctx.loading) {
+          const needsSkeleton = bodyHTML.includes("data-tw-suspense") || bodyHTML.includes("data-tw-ppr");
+          if (ctx.loading && needsSkeleton) {
             const loadingCompiled = this.compileFile(ctx.loading);
             allCSS = loadingCompiled.css + "\n" + allCSS;
             let lh = String(loadingCompiled.html || "");
@@ -42042,7 +42671,7 @@ ${bodyHTML}`;
           const pageTitle = this.extractTitle(ctx.page) || "TW Page";
           let title = pageTitle;
           if (layoutTitle !== void 0) {
-            title = layoutTitle.replace(/\{\s*page\.title\s*\}/g, pageTitle);
+            title = layoutTitle.replace(/__TW_PAGETITLE__/g, pageTitle).replace(/\{\s*page\.title\s*\}/g, pageTitle);
             if (!title.trim()) title = pageTitle;
           }
           const metaTags = this.buildMetaTags(ctx.page);
@@ -42062,7 +42691,9 @@ ${bodyHTML}`;
           } catch {
           }
           let fullHTML = this.assembleHTML(bodyHTML, allCSS, allJS, title, metaTags + headExtra);
-          if (!/__tw_runtime\.js/.test(fullHTML)) {
+          const pageRenderMode = this.extractRenderMode(ctx.page);
+          const needsClientRuntime = /data-tw-event|data-tw-i|__TW_SIGNALS__|data-tw-suspense|data-tw-ppr/.test(fullHTML) || pageRenderMode === "csr" || pageRenderMode === "stream" || pageRenderMode === "ppr" || pageRenderMode === "signalStream";
+          if (needsClientRuntime && !/__tw_runtime\.js/.test(fullHTML)) {
             let stateSeed = "{}";
             try {
               stateSeed = JSON.stringify(pageState ?? {});
@@ -42181,7 +42812,8 @@ ${bodyHTML}`;
           throw new Error(`Route file not found: ${file.absolutePath}`);
         }
         const source = readFileSync7(file.absolutePath, "utf-8");
-        const result = compileSync(source, {
+        const srcWithSentinel = source.replace(/\{\s*page\.title\s*\}/g, "__TW_PAGETITLE__");
+        const result = compileSync(srcWithSentinel, {
           filePath: file.absolutePath,
           optimize: true,
           diagnostics: false,
@@ -42255,12 +42887,13 @@ ${bodyHTML}`;
         try {
           const source = readFileSync7(file.absolutePath, "utf-8");
           const masked = maskSourceStringsAndComments(source);
-          const m = masked.match(/page\s*\{[^}]*title\s+"/);
+          const m = masked.match(/page\s*\{[^}]*title\s/);
           if (!m || m.index === void 0) return null;
           const start = m.index + m[0].length;
-          const end = source.indexOf('"', start);
-          if (end === -1 || end === start) return null;
-          return source.slice(start, end).replace(/\\([{}"])/g, "$1");
+          if (source[start] !== '"') return null;
+          const end = source.indexOf('"', start + 1);
+          if (end === -1 || end === start + 1) return null;
+          return source.slice(start + 1, end).replace(/\\([{}"])/g, "$1");
         } catch {
           return null;
         }
@@ -42309,7 +42942,8 @@ ${bodyHTML}`;
        *     render-cache never reads `stale`.
        */
       stampCacheHeaders(headers, entry, now, verdict) {
-        const out = { ...headers ?? {}, "x-tw-cache": verdict };
+        const out = { ...headers ?? {} };
+        if (process.env.TW_DEBUG_CACHE || process.env.NODE_ENV === "test") out["x-tw-cache"] = verdict;
         const c = entry?.cache;
         if (c) {
           const ageSec = entry?.createdAt ? Math.max(0, Math.floor((now - entry.createdAt) / 1e3)) : 0;
@@ -43843,7 +44477,6 @@ function securityHeadersMiddleware() {
   return (req, res, next) => {
     res.headers.set("X-Content-Type-Options", "nosniff");
     res.headers.set("X-Frame-Options", "SAMEORIGIN");
-    res.headers.set("X-XSS-Protection", "1; mode=block");
     res.headers.set("X-Permitted-Cross-Domain-Policies", "none");
     res.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
     res.headers.set("Cross-Origin-Opener-Policy", "same-origin");
@@ -44020,13 +44653,15 @@ function compressionMiddleware() {
     await next();
   };
 }
-function securityHeadersMiddleware2() {
+function securityHeadersMiddleware2(opts) {
   return async (ctx, next) => {
     ctx.headers["x-content-type-options"] = "nosniff";
     ctx.headers["x-frame-options"] = "DENY";
-    ctx.headers["x-xss-protection"] = "1; mode=block";
     ctx.headers["referrer-policy"] = "strict-origin-when-cross-origin";
     ctx.headers["permissions-policy"] = "camera=(), microphone=(), geolocation=()";
+    if (opts?.csp !== false && !ctx.headers["content-security-policy"]) {
+      ctx.headers["content-security-policy"] = typeof opts?.csp === "string" ? opts.csp : "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'";
+    }
     await next();
   };
 }
@@ -44109,6 +44744,161 @@ var init_middleware2 = __esm({
   }
 });
 
+// ../../packages/server/tw/compression.ts
+function shouldCompress(contentType, options = {}) {
+  const opts = { ...DEFAULT_OPTIONS4, ...options };
+  const ct = contentType.split(";")[0].trim();
+  return opts.contentTypes.includes(ct);
+}
+function isLargeEnough(size, options = {}) {
+  const opts = { ...DEFAULT_OPTIONS4, ...options };
+  return size >= opts.threshold;
+}
+async function compress(data, encoding = "gzip", options = {}) {
+  const opts = { ...DEFAULT_OPTIONS4, ...options };
+  const input = typeof data === "string" ? new TextEncoder().encode(data) : data;
+  if (input.length < opts.threshold) {
+    return input;
+  }
+  try {
+    if (typeof Bun !== "undefined" && Bun.gzipSync) {
+      if (encoding === "gzip") return Bun.gzipSync(input, { level: opts.level });
+      if (encoding === "deflate" && Bun.deflateSync) return Bun.deflateSync(input, { level: opts.level });
+    }
+  } catch {
+  }
+  try {
+    const zlib2 = await import("node:zlib");
+    if (encoding === "gzip") {
+      return zlib2.gzipSync(input, { level: opts.level });
+    }
+    if (encoding === "deflate") {
+      return zlib2.deflateSync(input, { level: opts.level });
+    }
+    if (encoding === "brotli" && zlib2.brotliCompressSync) {
+      return zlib2.brotliCompressSync(input, {
+        params: {
+          [zlib2.constants.BROTLI_PARAM_QUALITY]: opts.level
+        }
+      });
+    }
+  } catch {
+  }
+  return input;
+}
+async function decompress(data, encoding = "gzip") {
+  try {
+    if (typeof Bun !== "undefined" && Bun.gunzipSync) {
+      if (encoding === "gzip") return Bun.gunzipSync(data);
+      if (encoding === "deflate" && Bun.inflateSync) return Bun.inflateSync(data);
+    }
+  } catch {
+  }
+  try {
+    const zlib2 = await import("node:zlib");
+    if (encoding === "gzip") return zlib2.gunzipSync(data);
+    if (encoding === "deflate") return zlib2.inflateSync(data);
+    if (encoding === "brotli" && zlib2.brotliDecompressSync) return zlib2.brotliDecompressSync(data);
+  } catch {
+  }
+  return data;
+}
+function negotiateEncoding(acceptEncoding) {
+  const encodings = acceptEncoding.split(",").map((e) => e.trim().split(";")[0].trim()).filter(Boolean);
+  if (encodings.includes("br")) return "brotli";
+  if (encodings.includes("gzip")) return "gzip";
+  if (encodings.includes("deflate")) return "deflate";
+  return null;
+}
+function createCompressionHeaders(encoding, originalSize, compressedSize) {
+  return {
+    "Content-Encoding": encoding === "brotli" ? "br" : encoding,
+    "Vary": "Accept-Encoding",
+    "X-Original-Size": String(originalSize),
+    "X-Compressed-Size": String(compressedSize),
+    "X-Compression-Ratio": originalSize > 0 ? `${((1 - compressedSize / originalSize) * 100).toFixed(1)}%` : "0%"
+  };
+}
+async function compressResponse(body, contentType, acceptEncoding, options = {}) {
+  const input = typeof body === "string" ? new TextEncoder().encode(body) : body;
+  const opts = { ...DEFAULT_OPTIONS4, ...options };
+  if (!shouldCompress(contentType, opts) || !isLargeEnough(input.length, opts)) {
+    return { body: input, headers: {}, compressed: false };
+  }
+  const encoding = negotiateEncoding(acceptEncoding);
+  if (!encoding) {
+    return { body: input, headers: {}, compressed: false };
+  }
+  try {
+    const compressed = await compress(input, encoding, opts);
+    const headers = createCompressionHeaders(encoding, input.length, compressed.length);
+    return { body: compressed, headers, compressed: true };
+  } catch {
+    return { body: input, headers: {}, compressed: false };
+  }
+}
+var DEFAULT_OPTIONS4, StreamingCompressor;
+var init_compression = __esm({
+  "../../packages/server/tw/compression.ts"() {
+    DEFAULT_OPTIONS4 = {
+      level: 6,
+      threshold: 1024,
+      // Don't compress < 1KB
+      brotli: true,
+      contentTypes: [
+        "text/html",
+        "text/css",
+        "text/plain",
+        "text/javascript",
+        "application/javascript",
+        "application/json",
+        "application/xml",
+        "application/xhtml+xml",
+        "image/svg+xml",
+        "font/woff",
+        "font/woff2",
+        "application/wasm"
+      ]
+    };
+    StreamingCompressor = class {
+      chunks = [];
+      encoding;
+      options;
+      constructor(encoding = "gzip", options = {}) {
+        this.encoding = encoding;
+        this.options = { ...DEFAULT_OPTIONS4, ...options };
+      }
+      /**
+       * Add a chunk of data to be compressed.
+       */
+      push(data) {
+        const input = typeof data === "string" ? new TextEncoder().encode(data) : data;
+        this.chunks.push(input);
+      }
+      /**
+       * Flush all data and return compressed result.
+       */
+      async flush() {
+        const totalLength = this.chunks.reduce((sum, c) => sum + c.length, 0);
+        const combined = new Uint8Array(totalLength);
+        let offset = 0;
+        for (const chunk of this.chunks) {
+          combined.set(chunk, offset);
+          offset += chunk.length;
+        }
+        this.chunks = [];
+        return compress(combined, this.encoding, this.options);
+      }
+      /**
+       * Get the total uncompressed size so far.
+       */
+      get uncompressedSize() {
+        return this.chunks.reduce((sum, c) => sum + c.length, 0);
+      }
+    };
+  }
+});
+
 // ../../packages/server/tw/static/index.ts
 import { existsSync as existsSync11, statSync as statSync6 } from "node:fs";
 import { join as join15, extname as extname7, normalize as normalize2, resolve as resolve4, sep } from "node:path";
@@ -44318,7 +45108,7 @@ var init_policy = __esm({
           "Content-Security-Policy": this.build(),
           "X-Content-Type-Options": "nosniff",
           "X-Frame-Options": "DENY",
-          "X-XSS-Protection": "1; mode=block",
+          // BUG 48: x-xss-protection removed (deprecated, harmful in old browsers)
           "Referrer-Policy": "strict-origin-when-cross-origin",
           "Permissions-Policy": "geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()",
           "Cross-Origin-Opener-Policy": "same-origin",
@@ -48952,9 +49742,11 @@ function devSecurityHeaders() {
     removePoweredBy: true
   });
 }
-var DEFAULTS2, SecurityHeaders2;
+var BASELINE_CSP, DEFAULTS2, SecurityHeaders2;
 var init_security_headers = __esm({
   "../../packages/security/tw/headers/security-headers.ts"() {
+    BASELINE_CSP = // 'unsafe-eval' is needed: the client runtime evaluates state expressions and event handlers with new Function (packages/runtime/tw/client/hydration-runtime.js). Apps that precompile can drop it via the csp option.
+    "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'";
     DEFAULTS2 = {
       hstsMaxAge: 31536e3,
       // 1 year
@@ -48963,7 +49755,9 @@ var init_security_headers = __esm({
       frameOptions: "SAMEORIGIN",
       contentTypeOptions: true,
       referrerPolicy: "strict-origin-when-cross-origin",
-      xssProtection: "1; mode=block",
+      // v1.0.8 round 5 (BUG 48): x-xss-protection deprecated since 2019 --
+      // OFF by default now; opt back in with security.xssProtection.
+      xssProtection: void 0,
       removePoweredBy: true,
       coep: "unsafe-none",
       coop: "same-origin",
@@ -49019,6 +49813,9 @@ var init_security_headers = __esm({
         if (this.config.serverHeader) {
           headers["Server"] = this.config.serverHeader;
         }
+        if (this.config.csp !== false && !headers["Content-Security-Policy"]) {
+          headers["Content-Security-Policy"] = typeof this.config.csp === "string" ? this.config.csp : BASELINE_CSP;
+        }
         return headers;
       }
       /** Returns the security headers object. */
@@ -53229,161 +54026,6 @@ var init_ssr = __esm({
   }
 });
 
-// ../../packages/server/tw/compression.ts
-function shouldCompress(contentType, options = {}) {
-  const opts = { ...DEFAULT_OPTIONS4, ...options };
-  const ct = contentType.split(";")[0].trim();
-  return opts.contentTypes.includes(ct);
-}
-function isLargeEnough(size, options = {}) {
-  const opts = { ...DEFAULT_OPTIONS4, ...options };
-  return size >= opts.threshold;
-}
-async function compress(data, encoding = "gzip", options = {}) {
-  const opts = { ...DEFAULT_OPTIONS4, ...options };
-  const input = typeof data === "string" ? new TextEncoder().encode(data) : data;
-  if (input.length < opts.threshold) {
-    return input;
-  }
-  try {
-    if (typeof Bun !== "undefined" && Bun.gzipSync) {
-      if (encoding === "gzip") return Bun.gzipSync(input, { level: opts.level });
-      if (encoding === "deflate" && Bun.deflateSync) return Bun.deflateSync(input, { level: opts.level });
-    }
-  } catch {
-  }
-  try {
-    const zlib2 = await import("node:zlib");
-    if (encoding === "gzip") {
-      return zlib2.gzipSync(input, { level: opts.level });
-    }
-    if (encoding === "deflate") {
-      return zlib2.deflateSync(input, { level: opts.level });
-    }
-    if (encoding === "brotli" && zlib2.brotliCompressSync) {
-      return zlib2.brotliCompressSync(input, {
-        params: {
-          [zlib2.constants.BROTLI_PARAM_QUALITY]: opts.level
-        }
-      });
-    }
-  } catch {
-  }
-  return input;
-}
-async function decompress(data, encoding = "gzip") {
-  try {
-    if (typeof Bun !== "undefined" && Bun.gunzipSync) {
-      if (encoding === "gzip") return Bun.gunzipSync(data);
-      if (encoding === "deflate" && Bun.inflateSync) return Bun.inflateSync(data);
-    }
-  } catch {
-  }
-  try {
-    const zlib2 = await import("node:zlib");
-    if (encoding === "gzip") return zlib2.gunzipSync(data);
-    if (encoding === "deflate") return zlib2.inflateSync(data);
-    if (encoding === "brotli" && zlib2.brotliDecompressSync) return zlib2.brotliDecompressSync(data);
-  } catch {
-  }
-  return data;
-}
-function negotiateEncoding(acceptEncoding) {
-  const encodings = acceptEncoding.split(",").map((e) => e.trim().split(";")[0].trim()).filter(Boolean);
-  if (encodings.includes("br")) return "brotli";
-  if (encodings.includes("gzip")) return "gzip";
-  if (encodings.includes("deflate")) return "deflate";
-  return null;
-}
-function createCompressionHeaders(encoding, originalSize, compressedSize) {
-  return {
-    "Content-Encoding": encoding === "brotli" ? "br" : encoding,
-    "Vary": "Accept-Encoding",
-    "X-Original-Size": String(originalSize),
-    "X-Compressed-Size": String(compressedSize),
-    "X-Compression-Ratio": originalSize > 0 ? `${((1 - compressedSize / originalSize) * 100).toFixed(1)}%` : "0%"
-  };
-}
-async function compressResponse(body, contentType, acceptEncoding, options = {}) {
-  const input = typeof body === "string" ? new TextEncoder().encode(body) : body;
-  const opts = { ...DEFAULT_OPTIONS4, ...options };
-  if (!shouldCompress(contentType, opts) || !isLargeEnough(input.length, opts)) {
-    return { body: input, headers: {}, compressed: false };
-  }
-  const encoding = negotiateEncoding(acceptEncoding);
-  if (!encoding) {
-    return { body: input, headers: {}, compressed: false };
-  }
-  try {
-    const compressed = await compress(input, encoding, opts);
-    const headers = createCompressionHeaders(encoding, input.length, compressed.length);
-    return { body: compressed, headers, compressed: true };
-  } catch {
-    return { body: input, headers: {}, compressed: false };
-  }
-}
-var DEFAULT_OPTIONS4, StreamingCompressor;
-var init_compression = __esm({
-  "../../packages/server/tw/compression.ts"() {
-    DEFAULT_OPTIONS4 = {
-      level: 6,
-      threshold: 1024,
-      // Don't compress < 1KB
-      brotli: true,
-      contentTypes: [
-        "text/html",
-        "text/css",
-        "text/plain",
-        "text/javascript",
-        "application/javascript",
-        "application/json",
-        "application/xml",
-        "application/xhtml+xml",
-        "image/svg+xml",
-        "font/woff",
-        "font/woff2",
-        "application/wasm"
-      ]
-    };
-    StreamingCompressor = class {
-      chunks = [];
-      encoding;
-      options;
-      constructor(encoding = "gzip", options = {}) {
-        this.encoding = encoding;
-        this.options = { ...DEFAULT_OPTIONS4, ...options };
-      }
-      /**
-       * Add a chunk of data to be compressed.
-       */
-      push(data) {
-        const input = typeof data === "string" ? new TextEncoder().encode(data) : data;
-        this.chunks.push(input);
-      }
-      /**
-       * Flush all data and return compressed result.
-       */
-      async flush() {
-        const totalLength = this.chunks.reduce((sum, c) => sum + c.length, 0);
-        const combined = new Uint8Array(totalLength);
-        let offset = 0;
-        for (const chunk of this.chunks) {
-          combined.set(chunk, offset);
-          offset += chunk.length;
-        }
-        this.chunks = [];
-        return compress(combined, this.encoding, this.options);
-      }
-      /**
-       * Get the total uncompressed size so far.
-       */
-      get uncompressedSize() {
-        return this.chunks.reduce((sum, c) => sum + c.length, 0);
-      }
-    };
-  }
-});
-
 // ../../packages/server/tw/edge.ts
 function createEdgeHandler(config) {
   const cache = /* @__PURE__ */ new Map();
@@ -54102,8 +54744,11 @@ var init_tw6 = __esm({
     init_tw2();
     init_websocket_manager();
     init_routing2();
+    init_twm_rules();
     init_router();
     init_middleware2();
+    init_compression();
+    init_signal_stream();
     init_static();
     init_tw5();
     init_ssr();
@@ -54152,6 +54797,7 @@ var init_tw6 = __esm({
       }
       ssr = null;
       server = null;
+      compressionMode = "off";
       isRunning = false;
       pluginManager = null;
       imageHandler = null;
@@ -54168,6 +54814,40 @@ var init_tw6 = __esm({
             const entries = Object.entries(cfgIn.redirects);
             cfgIn.redirects = entries.map(([from, to]) => typeof to === "string" ? { from, to } : { from, ...to });
           }
+          if (Array.isArray(cfgIn.redirects)) {
+            const REDIRECT_KNOWN = /* @__PURE__ */ new Set(["from", "to", "status", "source", "destination", "permanent"]);
+            let redirectDropped = false;
+            const normalizedRedirects = cfgIn.redirects.map((r) => {
+              if (!r || typeof r !== "object") return r;
+              let touched = false;
+              const mapped = { ...r };
+              if (mapped.from === void 0 && mapped.source !== void 0) {
+                mapped.from = mapped.source;
+                touched = true;
+              }
+              if (mapped.to === void 0 && mapped.destination !== void 0) {
+                mapped.to = mapped.destination;
+                touched = true;
+              }
+              if (mapped.status === void 0 && mapped.permanent !== void 0) {
+                mapped.status = mapped.permanent ? 301 : 302;
+                touched = true;
+              }
+              const unknown = Object.keys(mapped).filter((k) => !REDIRECT_KNOWN.has(k));
+              if (unknown.length > 0) {
+                console.warn("[tw] redirects: unrecognized field" + (unknown.length > 1 ? "s" : "") + " " + unknown.join(", ") + " in entry { from: " + JSON.stringify(mapped.from) + " } -- accepted fields: from, to, status");
+              }
+              if (typeof mapped.from !== "string" || typeof mapped.to !== "string") {
+                console.warn("[tw] redirects: entry missing from/to after normalization -- skipped (" + JSON.stringify(r).slice(0, 80) + ")");
+                redirectDropped = true;
+                return null;
+              }
+              return touched ? mapped : r;
+            }).filter((x) => x !== null || (redirectDropped = true));
+            if (redirectDropped || normalizedRedirects.some((x, i) => x !== cfgIn.redirects[i])) {
+              cfgIn.redirects = normalizedRedirects.filter(Boolean);
+            }
+          }
           if (cfgIn.headers && !Array.isArray(cfgIn.headers)) {
             const entries = Object.entries(cfgIn.headers);
             cfgIn.headers = entries.map(([source, headers]) => ({ source, headers }));
@@ -54185,6 +54865,12 @@ var init_tw6 = __esm({
           }
         }
         this.pluginManager = this.options.plugins ?? null;
+        {
+          const raw = this.options.compression ?? true;
+          if (raw === false || raw === "none" || raw === "off" || raw === "false") this.compressionMode = "off";
+          else if (raw === "gzip") this.compressionMode = "gzip";
+          else this.compressionMode = "brotli";
+        }
         try {
           this.imageHandler = createImageHandler({
             rootDir: this.options.rootDir,
@@ -54294,31 +54980,72 @@ var init_tw6 = __esm({
         if (existsSync13(middlewarePath)) {
           this.middlewarePath = middlewarePath;
           console.log("  Middleware: middleware.twm loaded");
+          try {
+            const src = readFileSync9(middlewarePath, "utf-8");
+            const rules = parseRules(src, "middleware.twm");
+            for (const r of rules) {
+              const conds = [];
+              if (r.userAgent) conds.push("user_agent");
+              if (r.path) conds.push("path");
+              if (r.auth) conds.push("auth");
+              if (r.rateLimit) conds.push("rate_limit");
+              if (r.origin) conds.push("origin");
+              if (r.methods && r.methods.length > 0) conds.push("methods");
+              const label = conds.length > 0 ? conds.join(" + ") : "no conditions -> every matching request gets this response";
+              console.log(`    \u2022 "${r.name}" [${label}]`);
+            }
+          } catch {
+          }
         }
         return this;
       }
       async start() {
         if (this.isRunning) return;
-        const { port, host } = this.options;
-        this.server = (typeof Bun !== "undefined" ? Bun : null)?.serve({
-          port,
-          hostname: host,
-          fetch: async (request) => {
-            const res = await this.handleRequest(request);
-            if (this.securityHeaders) {
-              try {
-                return this.securityHeaders.apply(res);
-              } catch {
-                return res;
+        const host = this.options.host ?? "0.0.0.0";
+        const wanted = this.options.port ?? 8e3;
+        let port = wanted;
+        let bound = null;
+        let lastErr = null;
+        for (let p = wanted; p < wanted + 10; p++) {
+          try {
+            bound = (typeof Bun !== "undefined" ? Bun : null)?.serve({
+              port: p,
+              hostname: host,
+              fetch: async (request) => {
+                const res = await this.handleRequest(request);
+                let withHeaders = res;
+                if (this.securityHeaders) {
+                  try {
+                    withHeaders = this.securityHeaders.apply(res);
+                  } catch {
+                    withHeaders = res;
+                  }
+                }
+                return this.compressResponse(withHeaders, request);
+              },
+              error: (err3) => {
+                console.error("Server error:", err3);
+                return new Response("Internal Server Error", { status: 500 });
               }
-            }
-            return res;
-          },
-          error: (err3) => {
-            console.error("Server error:", err3);
-            return new Response("Internal Server Error", { status: 500 });
+            });
+            port = p;
+            break;
+          } catch (e) {
+            lastErr = e;
+            const msg = String(e?.message ?? e);
+            if (!/address already in use|EADDRINUSE|Failed to start server/i.test(msg)) throw e;
+            if (p < wanted + 9) console.log(`  Port ${p} busy \u2014 trying ${p + 1}...`);
           }
-        });
+        }
+        if (!bound) {
+          console.error(`
+  ERROR: could not bind ${host} on ports ${wanted}\u2013${wanted + 9}.`);
+          console.error(`  ${lastErr?.message ?? lastErr}
+`);
+          throw lastErr ?? new Error("could not start server");
+        }
+        this.server = bound;
+        this.options.port = port;
         this.isRunning = true;
         console.log(`
   TW Server running at http://${host}:${port}
@@ -54332,6 +55059,10 @@ var init_tw6 = __esm({
       // finishes ongoing requests, then closes
       async gracefulShutdown(timeout = 5e3) {
         this.isRunning = false;
+        try {
+          getSignalHub().closeAll();
+        } catch {
+        }
         if (this.server) {
           this.server.stop?.(false);
           const start = Date.now();
@@ -54357,6 +55088,35 @@ var init_tw6 = __esm({
        *   - return { headers: {...} }  -> headers merged into the final response
        *   - return null/undefined      -> continue
        */
+      /** BUG 7 (v1.0.8): real response compression. `compression` in
+       * tw.config.ts was silently ignored -- the middleware was a no-op and
+       * nothing on the response path ever set Content-Encoding. */
+      async compressResponse(res, request) {
+        if (this.compressionMode === "off") return res;
+        try {
+          if (res.headers.get("content-encoding")) return res;
+          const ct = res.headers.get("content-type") || "";
+          if (ct.includes("text/event-stream")) return res;
+          if (res.__twRawStream) return res;
+          const buf = new Uint8Array(await res.arrayBuffer());
+          if (!isLargeEnough(buf.length)) return new Response(buf, { status: res.status, headers: res.headers });
+          const accept = request.headers.get("accept-encoding") || "";
+          let enc = negotiateEncoding(accept);
+          if (this.compressionMode === "gzip" && enc === "brotli") enc = "gzip";
+          if (!enc) return new Response(buf, { status: res.status, headers: res.headers });
+          const out = await compress(buf, enc);
+          if (out.length >= buf.length) return new Response(buf, { status: res.status, headers: res.headers });
+          const h = new Headers(res.headers);
+          h.set("Content-Encoding", enc === "brotli" ? "br" : enc);
+          h.set("Vary", "Accept-Encoding");
+          h.delete("Content-Length");
+          return new Response(out, { status: res.status, headers: h });
+        } catch {
+          return res;
+        }
+      }
+      /** v1.0.8 round 5 (BUG 39): public now -- serverless adapters (Vercel
+       *  functions, edge runtimes) drive the server through this entry. */
       async handleRequest(request) {
         try {
           const u = new URL(request.url);
@@ -54529,69 +55289,12 @@ var init_tw6 = __esm({
        * `data: {"v":1,"seq":N,"updates":[...]}` frames.
        */
       handleSignalStream(request, url) {
-        const hub2 = getSignalHub();
-        const names = (url.searchParams.get("s") ?? "").split(",").map((x) => x.trim()).filter(Boolean);
-        const since = Number(url.searchParams.get("since") ?? "0") || 0;
-        const declared = /* @__PURE__ */ new Map();
-        for (const n of names) declared.set(n, "public");
-        let session;
-        try {
-          const header = request.headers.get("cookie") ?? "";
-          const m = /(?:^|;\s*)tw_session=([^;]+)/.exec(header);
-          if (m) session = decodeURIComponent(m[1].trim().replace(/^"|"$/g, ""));
-        } catch {
-        }
-        const enc = new TextEncoder();
-        const sse = (payload) => enc.encode("data: " + payload + "\n\n");
-        const stream = new ReadableStream({
-          start(controller) {
-            const client = hub2.register(declared, session);
-            client.send = (payload) => {
-              try {
-                controller.enqueue(sse(payload));
-              } catch {
-                client.close();
-              }
-            };
-            client.close = () => {
-              try {
-                controller.close();
-              } catch {
-              }
-              hub2["clients"];
-            };
-            for (const payload of hub2.connectPayloads(since, declared, session)) {
-              try {
-                controller.enqueue(sse(payload));
-              } catch {
-                break;
-              }
-            }
-            const keepAlive = setInterval(() => {
-              try {
-                controller.enqueue(enc.encode(": keep-alive\n\n"));
-              } catch {
-                clearInterval(keepAlive);
-              }
-            }, 25e3);
-            client.close = () => {
-              clearInterval(keepAlive);
-              try {
-                controller.close();
-              } catch {
-              }
-            };
-          }
-        });
-        return new Response(stream, {
-          status: 200,
-          headers: {
-            "Content-Type": "text/event-stream; charset=utf-8",
-            "Cache-Control": "no-store",
-            "X-Accel-Buffering": "no",
-            Connection: "keep-alive"
-          }
-        });
+        const cfg = this.options.config?.signalStream;
+        return createSignalStream(request, url, cfg ? { maxClients: cfg.maxClients, maxHistory: cfg.maxHistory } : void 0);
+      }
+      async handleClientSignalWrite(request) {
+        const cfg = this.options.config?.signalStream;
+        return writeSignalFromClient(request, { clientWrites: cfg?.clientWrites });
       }
       /**
        * PPR hole fill: render the page fresh and return only the requested
@@ -54665,15 +55368,33 @@ var init_tw6 = __esm({
             controller.close();
           }
         });
-        return new Response(stream, {
+        const streamRes = new Response(stream, {
           status: 200,
           headers: { "Content-Type": "text/html; charset=utf-8" }
         });
+        streamRes.__twRawStream = true;
+        return streamRes;
       }
       async handleRequestInner(request) {
         const url = new URL(request.url);
         const method = request.method;
-        const pathname = normalizePathname(url.pathname);
+        let rawPath = url.pathname;
+        try {
+          const decoded = decodeURIComponent(rawPath);
+          if (decoded !== rawPath) rawPath = decoded;
+        } catch {
+        }
+        let canonical = normalizePathname(rawPath);
+        if (canonical.length > 1 && canonical.endsWith("/")) {
+          canonical = canonical.slice(0, -1);
+        }
+        if (canonical !== rawPath) {
+          return new Response(null, {
+            status: 308,
+            headers: { Location: encodeURI(canonical) + url.search }
+          });
+        }
+        const pathname = canonical;
         if (pathname === "/_tw/img" || pathname.startsWith("/_tw/img/")) {
           const imgRes = await this.imageHandler.handle(request);
           if (imgRes) return imgRes;
@@ -54681,6 +55402,9 @@ var init_tw6 = __esm({
         if (pathname === "/_tw/stream") {
           return this.handleSignalStream(request, url);
         }
+        if (pathname === "/_tw/signal" && method === "POST") {
+          return this.handleClientSignalWrite(request);
+        }
         if (pathname === "/_tw/ppr") {
           return this.handlePPRHoleFill(url);
         }
@@ -54845,13 +55569,39 @@ __export(twm_loader_exports, {
   loadTWMModule: () => loadTWMModule,
   revalidateRoute: () => revalidateRoute,
   shouldMatchMiddleware: () => shouldMatchMiddleware,
-  stripCommentsSafe: () => stripCommentsSafe
+  stripCommentsSafe: () => stripCommentsSafe,
+  validateTWMSyntax: () => validateTWMSyntax
 });
 import { readFileSync as readFileSync10, existsSync as existsSync14 } from "node:fs";
 import { join as join18 } from "node:path";
 function clearTWMCache() {
   moduleCache.clear();
 }
+function validateTWMSyntax(filePath) {
+  let source;
+  try {
+    source = readFileSync10(filePath, "utf-8");
+  } catch (err3) {
+    return "cannot read: " + (err3?.message ?? err3);
+  }
+  if (isRuleDsl(source)) {
+    try {
+      parseRules(source, filePath);
+      return null;
+    } catch (err3) {
+      return "rule DSL: " + (err3?.message ?? String(err3));
+    }
+  }
+  try {
+    const imports = extractImports(source);
+    const jsCode = compileTwm(source);
+    const codeWithoutImports = stripImports(jsCode);
+    new Function("__tw_unused", codeWithoutImports);
+    return null;
+  } catch (err3) {
+    return (err3?.message ?? String(err3)).replace(/\n/g, " ").slice(0, 200);
+  }
+}
 function stripCommentsSafe(src) {
   let out = "";
   let i = 0;
@@ -55089,7 +55839,7 @@ async function loadTWMModule(filePath, rootDir) {
       console.error("[tw] " + e.message + " (" + filePath + ":" + cm[1] + ")");
     }
   }
-  const moduleCode = codeWithoutImports + "\nreturn { get: typeof get !== 'undefined' ? get : null, post: typeof post !== 'undefined' ? post : null, put: typeof put !== 'undefined' ? put : null, patch: typeof patch !== 'undefined' ? patch : null, deleteFn: typeof deleteFn !== 'undefined' ? deleteFn : null, GET: typeof GET !== 'undefined' ? GET : null, POST: typeof POST !== 'undefined' ? POST : null, PUT: typeof PUT !== 'undefined' ? PUT : null, PATCH: typeof PATCH !== 'undefined' ? PATCH : null, DELETE: typeof DELETE !== 'undefined' ? DELETE : null, middleware: typeof middleware !== 'undefined' ? middleware : null, generate: typeof generate !== 'undefined' ? generate : null, config: typeof config !== 'undefined' ? config : null, action: typeof action !== 'undefined' ? action : null, revalidate: typeof revalidate !== 'undefined' ? revalidate : null, " + [...actionNames].map((n) => `${n}: typeof ${n} !== 'undefined' ? ${n} : null`).join(", ") + " };";
+  const moduleCode = codeWithoutImports + "\nreturn { get: typeof get !== 'undefined' ? get : null, post: typeof post !== 'undefined' ? post : null, put: typeof put !== 'undefined' ? put : null, patch: typeof patch !== 'undefined' ? patch : null, deleteFn: typeof deleteFn !== 'undefined' ? deleteFn : null, GET: typeof GET !== 'undefined' ? GET : null, POST: typeof POST !== 'undefined' ? POST : null, PUT: typeof PUT !== 'undefined' ? PUT : null, PATCH: typeof PATCH !== 'undefined' ? PATCH : null, DELETE: typeof DELETE !== 'undefined' ? DELETE : null, options: typeof options !== 'undefined' ? options : null, OPTIONS: typeof OPTIONS !== 'undefined' ? OPTIONS : null, middleware: typeof middleware !== 'undefined' ? middleware : null, generate: typeof generate !== 'undefined' ? generate : null, config: typeof config !== 'undefined' ? config : null, action: typeof action !== 'undefined' ? action : null, revalidate: typeof revalidate !== 'undefined' ? revalidate : null, " + [...actionNames].map((n) => `${n}: typeof ${n} !== 'undefined' ? ${n} : null`).join(", ") + " };";
   const injectedKeys = Object.keys(injected);
   let module = {};
   try {
@@ -55104,6 +55854,8 @@ async function loadTWMModule(filePath, rootDir) {
       put: H.put || H.PUT || void 0,
       delete: H.deleteFn || H.DELETE || void 0,
       patch: H.patch || H.PATCH || void 0,
+      // v1.0.8 round 4 (BUG 33): route-level OPTIONS handlers
+      options: H.options || H.OPTIONS || void 0,
       middleware: H.middleware || void 0,
       generate: H.generate || void 0,
       config: H.config || void 0,
@@ -55239,9 +55991,22 @@ async function executeRouteHandler(filePath, method, request, rootDir) {
       if (rawBody2.length > MAX_BODY_BYTES) {
         return { status: 413, json: { ok: false, error: "Payload too large" } };
       }
-      parsedBody = rawBody2 ? JSON.parse(rawBody2) : {};
+      if (!rawBody2) {
+        parsedBody = {};
+      } else if (__ct.includes("application/x-www-form-urlencoded")) {
+        parsedBody = Object.fromEntries(new URLSearchParams(rawBody2).entries());
+      } else if (__ct.startsWith("text/")) {
+        parsedBody = rawBody2;
+      } else if (__ct.includes("json") || __ct === "") {
+        try {
+          parsedBody = JSON.parse(rawBody2);
+        } catch (e) {
+          return { status: 400, json: { ok: false, error: "Invalid JSON body: " + (e?.message ?? "parse error") } };
+        }
+      } else {
+        return { status: 415, json: { ok: false, error: "Unsupported Content-Type: " + (__ct || "(none)") } };
+      }
     } catch {
-      parsedBody = {};
     }
   } else if (request?.body && typeof request.body === "object") {
     parsedBody = request.body;
@@ -55249,7 +56014,18 @@ async function executeRouteHandler(filePath, method, request, rootDir) {
   let query2 = {};
   try {
     const u = new URL(request.url);
-    query2 = Object.fromEntries(u.searchParams.entries());
+    for (const [rawKey, value] of u.searchParams.entries()) {
+      const isPhpArray = rawKey.endsWith("[]");
+      const key = isPhpArray ? rawKey.slice(0, -2) : rawKey;
+      const existing = query2[key];
+      if (existing === void 0) {
+        query2[key] = isPhpArray ? [value] : value;
+      } else if (Array.isArray(existing)) {
+        existing.push(value);
+      } else {
+        query2[key] = [existing, value];
+      }
+    }
   } catch {
   }
   const headersObj = typeof request.headers?.entries === "function" ? Object.fromEntries(request.headers.entries()) : request.headers ?? {};
@@ -55378,9 +56154,17 @@ async function executeRouteHandler(filePath, method, request, rootDir) {
     console.error("[tw] route handler error (" + filePath + "):", err3?.message ?? err3);
     return { status: 500, json: { ok: false, error: "Internal Server Error" } };
   }
-  if (!result || typeof result !== "object") {
-    console.error("[tw] route handler returned no result (" + filePath + ")");
-    return { status: 500, json: { ok: false, error: "Internal Server Error" } };
+  if (typeof result === "string") {
+    result = { status: 200, text: result };
+  } else if (!result || typeof result !== "object") {
+    console.error("[tw] route handler returned " + JSON.stringify(result) + " (" + filePath + ")");
+    return {
+      status: 500,
+      json: {
+        ok: false,
+        error: "Unsupported handler return shape: " + (result === null ? "null" : typeof result) + ". Return { status, json|text|html } (or a plain string for text/plain)."
+      }
+    };
   }
   const finalResult = {
     status: typeof result.status === "number" ? result.status : 200,
@@ -55735,11 +56519,18 @@ async function buildCommand() {
   } catch {
   }
   let pageCount = 0;
+  let requestRenderedCount = 0;
   let apiCount = 0;
   let errorCount = 0;
   const isrRoutes = /* @__PURE__ */ new Map();
   const pageFiles = [];
   collectFiles(homeDir, "page.tw", pageFiles);
+  for (const pf of pageFiles) {
+    if (existsSync16(join20(dirname6(pf), "index.tw"))) {
+      console.log("  \x1B[33m!\x1B[0m " + dirname6(pf).replace(homeDir, "").replace(/^\//, "") + "/ has BOTH page.tw and index.tw");
+      console.log("      index.tw wins this route -- delete one of them");
+    }
+  }
   begin("compile", pageFiles.length);
   const htmlOutputs = [];
   _compilerMod.clearCssCapture?.();
@@ -55757,11 +56548,20 @@ async function buildCommand() {
           const pmod = await loadTWMModule2(paramsTwm, rootDir);
           if (typeof pmod.generate === "function") {
             const arr = pmod.generate();
-            if (Array.isArray(arr) && arr.length > 0) paramSets = arr.map((x) => {
-              const o = {};
-              for (const [k, v] of Object.entries(x)) o[k] = String(v);
-              return o;
-            });
+            if (Array.isArray(arr) && arr.length > 0) {
+              const dynNames = pageFile.split("/").map((seg) => /^\[([^\]]+)\]$/.exec(seg)?.[1]).filter(Boolean);
+              paramSets = arr.map((x) => {
+                if (x !== null && typeof x !== "object") {
+                  const o2 = {};
+                  const key = dynNames[0] ?? "slug";
+                  o2[key] = String(x);
+                  return o2;
+                }
+                const o = {};
+                for (const [k, v] of Object.entries(x)) o[k] = String(v);
+                return o;
+              });
+            }
           }
         } catch (e) {
           console.log("  Warning: params.twm failed: " + e.message);
@@ -55812,6 +56612,7 @@ async function buildCommand() {
     }
     const hasExplicitParams = paramSets.length > 1 || Object.keys(paramSets[0] ?? {}).length > 0;
     if ((renderMode === "ssr" || renderMode === "stream") && !hasExplicitParams) {
+      requestRenderedCount++;
       console.log("  \x1B[36m~\x1B[0m " + routePath + " [" + renderMode + ": rendered at request time]");
       try {
         const src = readFileSync12(pageFile, "utf-8");
@@ -55822,6 +56623,29 @@ async function buildCommand() {
           for (const d of errs.slice(0, 5)) console.log("      " + d.line + ":" + d.col + "  " + d.message);
           errorCount++;
         }
+        const warns = (r.diagnostics || []).filter((d) => d.severity !== "error");
+        if (warns.length > 0) {
+          console.log("      \x1B[33m" + warns.length + " warning" + (warns.length === 1 ? "" : "s") + "\x1B[0m");
+          for (const d of warns.slice(0, 3)) {
+            console.log("        " + d.line + ":" + d.col + "  " + d.code + "  " + d.message);
+          }
+          if (warns.length > 3) console.log("        ... " + (warns.length - 3) + " more (tw check)");
+        }
+        {
+          const used = /* @__PURE__ */ new Set();
+          collectComponentUsages(r.ast, used);
+          const BUILTIN_ALIASES = /* @__PURE__ */ new Set(["Link", "RouterLink", "Image", "optImage", "Suspense"]);
+          const unknownSsr = [...used].filter((t2) => !BUILTIN_ALIASES.has(t2) && !registeredComponentNames.has(t2));
+          if (unknownSsr.length > 0) {
+            const importSpecs = /* @__PURE__ */ new Map();
+            for (const im of src.matchAll(/import\s+([A-Za-z_]\w*)\s+from\s+["']([^"']+)["']/g)) {
+              importSpecs.set(im[1], im[2]);
+            }
+            const hints = unknownSsr.map((t2) => importSpecs.has(t2) ? `<${t2}> (imported from ${importSpecs.get(t2)} -- file not found)` : `<${t2}> (no components/${t2}.tw found)`);
+            console.log("  \x1B[31m\u2717 " + routePath + ": unknown component" + (unknownSsr.length > 1 ? "s" : "") + " " + hints.join(", ") + "\x1B[0m");
+            errorCount++;
+          }
+        }
       } catch (e) {
         console.log("  \x1B[33m! " + routePath + ": " + (e && e.message ? e.message : e) + "\x1B[0m");
         errorCount++;
@@ -55840,7 +56664,12 @@ async function buildCommand() {
           const BUILTIN_ALIASES = /* @__PURE__ */ new Set(["Link", "RouterLink", "Image", "optImage", "Suspense"]);
           const unknown = [...used].filter((t2) => !BUILTIN_ALIASES.has(t2) && !registeredComponentNames.has(t2));
           if (unknown.length > 0) {
-            console.error("  \x1B[31m\u2717 " + pageFile.replace(rootDir + "/", "") + ": unknown component" + (unknown.length > 1 ? "s" : "") + " <" + unknown.join(">, <") + "> -- no components/" + unknown[0] + ".tw found (create the file or fix the import)\x1B[0m");
+            const importSpecs = /* @__PURE__ */ new Map();
+            for (const im of source.matchAll(/import\s+([A-Za-z_]\w*)\s+from\s+["']([^"']+)["']/g)) {
+              importSpecs.set(im[1], im[2]);
+            }
+            const hints = unknown.map((t2) => importSpecs.has(t2) ? `<${t2}> (imported from ${importSpecs.get(t2)} -- file not found)` : `<${t2}> (no components/${t2}.tw found)`);
+            console.error("  \x1B[31m\u2717 " + pageFile.replace(rootDir + "/", "") + ": unknown component" + (unknown.length > 1 ? "s" : "") + " " + hints.join(", ") + " -- create the file or fix the import\x1B[0m");
             process.exit(1);
           }
         }
@@ -55932,9 +56761,12 @@ async function buildCommand() {
             if (pu) clientTag += `<script defer src="/${pu}"></script>
   `;
           }
-          const runtimeTag = `<script defer src="/__tw_runtime.js"></script>`;
-          html = html.replace("</body>", "  " + clientTag + runtimeTag + "\n</body>");
-          needsRuntime = true;
+          const needsClient = interactive || pageMods.deps.length > 0 || pageMods.own.length > 0 || renderMode === "csr" || renderMode === "ppr" || renderMode === "stream" || renderMode === "signalStream";
+          if (needsClient) {
+            const runtimeTag = `<script defer src="/__tw_runtime.js"></script>`;
+            html = html.replace("</body>", "  " + clientTag + runtimeTag + "\n</body>");
+            needsRuntime = true;
+          }
         }
         if (renderMode === "csr") {
           html = csrifyHtml(html);
@@ -55989,6 +56821,14 @@ async function buildCommand() {
         } else {
           console.log("  \x1B[32mOK\x1B[0m " + displayPath + " -> " + (outRoute === "" ? ".tw/index.html" : ".tw/" + outRoute + "/index.html"));
         }
+        const warnings = result.diagnostics.filter((d) => d.severity !== "error");
+        if (warnings.length > 0) {
+          console.log("      \x1B[33m" + warnings.length + " warning" + (warnings.length === 1 ? "" : "s") + "\x1B[0m");
+          for (const d of warnings.slice(0, 3)) {
+            console.log("        " + d.line + ":" + d.col + "  " + d.code + "  " + d.message);
+          }
+          if (warnings.length > 3) console.log("        ... " + (warnings.length - 3) + " more (tw check)");
+        }
         pageCount++;
       } catch (err3) {
         console.log("  \x1B[31mX " + routePath + ": " + err3.message + "\x1B[0m");
@@ -56007,8 +56847,16 @@ async function buildCommand() {
     const outputDir = routeName === "" ? outDir : join20(outDir, routeName);
     mkdirSync6(outputDir, { recursive: true });
     copyFileSync2(twmFile, join20(outputDir, "route.twm"));
-    console.log("  \x1B[32mOK\x1B[0m /" + routeName + " [api]");
-    apiCount++;
+    const { validateTWMSyntax: validateTWMSyntax2 } = await Promise.resolve().then(() => (init_twm_loader(), twm_loader_exports));
+    const syntaxError = validateTWMSyntax2(twmFile);
+    if (syntaxError) {
+      console.log("  \x1B[31mX\x1B[0m /" + routeName + " [api] -- .twm syntax error");
+      console.log("      " + twmFile.replace(rootDir + "/", "") + ": " + syntaxError);
+      errorCount++;
+    } else {
+      console.log("  \x1B[32mOK\x1B[0m /" + routeName + " [api]");
+      apiCount++;
+    }
   }
   if (existsSync16(libDir)) {
     copyDir2(libDir, join20(outDir, "lib"));
@@ -56087,7 +56935,7 @@ async function buildCommand() {
     }
   }
   console.log("\n  \x1B[32mBuild complete!\x1B[0m");
-  console.log("  Pages: " + pageCount + " compiled");
+  console.log("  Pages: " + pageCount + " compiled" + (requestRenderedCount > 0 ? " (+" + requestRenderedCount + " rendered at request time)" : ""));
   if (pageCount === 0) console.warn("  [!] No static pages were compiled -- every page is SSR/API. Static hosts (Vercel/Cloudflare Pages output) will serve an empty site. Use `render static` or check your render modes.");
   console.log("  APIs:  " + apiCount + " routes");
   if (isrRoutes.size > 0) {
@@ -60191,15 +61039,37 @@ ${name}/
 async function createVercelJson(dir) {
   const config = {
     buildCommand: "npx tw build",
-    outputDirectory: ".tw",
-    installCommand: "bun install",
-    framework: null
+    installCommand: "npm install",
+    functions: {
+      "api/tw-server.ts": { memory: 512 }
+    },
+    rewrites: [
+      { source: "/(.*)", destination: "/api/tw-server" }
+    ]
   };
   await writeFile(join(dir, "vercel.json"), JSON.stringify(config, null, 2));
   console.log("  \u2713 vercel.json");
+  const fnDir = join(dir, "api");
+  await mkdir(fnDir, { recursive: true });
+  await writeFile(join(fnDir, "tw-server.ts"), [
+    "// TW Framework -- Vercel serverless entry (v1.0.8 round 5, BUG 39).",
+    "// Runs the full TW server (SSR pages + .twm API routes) as a Vercel",
+    "// function. vercel.json rewrites every route here.",
+    'import { TWServer } from "tw-framework/server";',
+    "",
+    "const server = new TWServer({",
+    "  rootDir: process.cwd(),",
+    "});",
+    "",
+    "export default async function handler(request: Request): Promise<Response> {",
+    "  return server.handleRequest(request);",
+    "}",
+    ""
+  ].join("\n"));
+  console.log("  \u2713 api/tw-server.ts");
 }
 async function createDefaultProject(dir, name) {
-  const T = (s) => s;
+  const T = (s) => s.split("${name}").join(name);
   for (const d of [
     ["home"],
     ["home", "about"],
@@ -60222,8 +61092,6 @@ html {
   head {
     meta charset "utf-8"
     meta name "viewport" content "width=device-width, initial-scale=1"
-    meta name "description" content "{page.description}"
-    title "{page.title} -- ${"$"}{name}"
   }
   body {
     header.sitenav {
@@ -60559,6 +61427,10 @@ a:hover { td underline }
 // This sample blocks known bot user agents everywhere. Guards are
 // fail-closed: a matching request that fails the condition gets the
 // rule's response, and no page code ever runs.
+//
+// Note: a rule with ONLY match + response (no condition blocks) applies
+// to EVERY matching request -- e.g. a site-wide maintenance page. tw serve
+// lists each rule at startup and flags those unconditional ones.
 
 rule "block bots" {
     match "/**"
@@ -61522,6 +62394,7 @@ async function devCommand() {
   }
   let devRedirects = [];
   let devCfgHeaders = [];
+  let devSigCfg = void 0;
   try {
     const cfgFile = join19(rootDir, "tw.config.ts");
     if (existsSync15(cfgFile)) {
@@ -61534,12 +62407,24 @@ async function devCommand() {
       if (cfg?.headers) {
         devCfgHeaders = Array.isArray(cfg.headers) ? cfg.headers : Object.entries(cfg.headers).map(([source, headers]) => ({ source, headers }));
       }
+      if (cfg?.signalStream) devSigCfg = cfg.signalStream;
     }
   } catch {
   }
   const devPathMatch = (pattern, pathname) => pattern === pathname || pattern.endsWith("/**") && pathname.startsWith(pattern.slice(0, -2) + "/") || pattern.endsWith("/") && pathname.startsWith(pattern) || pattern === "/**" && pathname.startsWith("/");
   async function devFetchInner(req) {
     const url = new URL(req.url);
+    try {
+      let rawPath = url.pathname;
+      const decoded = decodeURIComponent(rawPath);
+      if (decoded !== rawPath) rawPath = decoded;
+      let canonical = rawPath.replace(/\/{2,}/g, "/");
+      if (canonical.length > 1 && canonical.endsWith("/")) canonical = canonical.slice(0, -1);
+      if (canonical !== rawPath) {
+        return new Response(null, { status: 308, headers: { Location: encodeURI(canonical) + url.search } });
+      }
+    } catch {
+    }
     const path = url.pathname;
     const time = (/* @__PURE__ */ new Date()).toISOString().split("T")[1].split(".")[0];
     rescanComponentsIfNeeded(rootDir);
@@ -61819,56 +62704,108 @@ async function devCommand() {
       headers: { "Content-Type": "text/html" }
     });
   }
-  const server = Bun.serve({
-    port,
-    hostname: host,
-    async fetch(req) {
-      const reqUrl = new URL(req.url);
-      for (const r of devRedirects) {
-        if (!r?.from || !r?.to) continue;
-        if (devPathMatch(r.from, reqUrl.pathname)) {
-          const status = [301, 302, 307, 308].includes(r.status) ? r.status : 301;
-          let loc = r.to.startsWith("http") ? r.to : new URL(r.to, req.url).toString();
-          if (reqUrl.search && !loc.includes("?")) loc += reqUrl.search;
-          return new Response(null, { status, headers: { Location: loc } });
-        }
-      }
-      const mwHeaders = await runUserMiddleware(req);
-      if (mwHeaders instanceof Response) return mwHeaders;
-      const u = new URL(req.url);
-      if (u.pathname === "/_tw/img" || u.pathname.startsWith("/_tw/img/")) {
-        const imgRes = await devImageHandler?.handle(req);
-        if (imgRes) return imgRes;
-      }
-      const response = await devFetchInner(req);
-      if (mwHeaders && typeof mwHeaders === "object") {
-        for (const key of Object.keys(mwHeaders)) {
-          try {
-            if (!response.headers.has(key)) response.headers.set(key, mwHeaders[key]);
-          } catch {
-          }
+  async function devHandle(req) {
+    {
+      const u3 = new URL(req.url);
+      if (u3.pathname === "/_tw/stream") {
+        const { createSignalStream: createSignalStream2 } = await Promise.resolve().then(() => (init_signal_stream(), signal_stream_exports));
+        return createSignalStream2(req, u3, devSigCfg ? { maxClients: devSigCfg.maxClients, maxHistory: devSigCfg.maxHistory } : void 0);
+      }
+      if (u3.pathname === "/_tw/signal" && req.method === "POST") {
+        const { writeSignalFromClient: writeSignalFromClient2 } = await Promise.resolve().then(() => (init_signal_stream(), signal_stream_exports));
+        return writeSignalFromClient2(req, { clientWrites: devSigCfg?.clientWrites });
+      }
+    }
+    const reqUrl = new URL(req.url);
+    for (const r of devRedirects) {
+      if (!r?.from || !r?.to) continue;
+      if (devPathMatch(r.from, reqUrl.pathname)) {
+        const status = [301, 302, 307, 308].includes(r.status) ? r.status : 301;
+        let loc = r.to.startsWith("http") ? r.to : new URL(r.to, req.url).toString();
+        if (reqUrl.search && !loc.includes("?")) loc += reqUrl.search;
+        return new Response(null, { status, headers: { Location: loc } });
+      }
+    }
+    const mwHeaders = await runUserMiddleware(req);
+    if (mwHeaders instanceof Response) return mwHeaders;
+    const u = new URL(req.url);
+    if (u.pathname === "/_tw/img" || u.pathname.startsWith("/_tw/img/")) {
+      const imgRes = await devImageHandler?.handle(req);
+      if (imgRes) return imgRes;
+    }
+    const response = await devFetchInner(req);
+    if (mwHeaders && typeof mwHeaders === "object") {
+      for (const key of Object.keys(mwHeaders)) {
+        try {
+          if (!response.headers.has(key)) response.headers.set(key, mwHeaders[key]);
+        } catch {
         }
       }
-      const u2 = new URL(req.url);
-      for (const h of devCfgHeaders) {
-        if (h?.source && h?.headers && devPathMatch(h.source, u2.pathname)) {
-          for (const key of Object.keys(h.headers)) {
-            try {
-              if (!response.headers.has(key)) response.headers.set(key, String(h.headers[key]).replace(/[\r\n]/g, ""));
-            } catch {
-            }
+    }
+    const u2 = new URL(req.url);
+    for (const h of devCfgHeaders) {
+      if (h?.source && h?.headers && devPathMatch(h.source, u2.pathname)) {
+        for (const key of Object.keys(h.headers)) {
+          try {
+            if (!response.headers.has(key)) response.headers.set(key, String(h.headers[key]).replace(/[\r\n]/g, ""));
+          } catch {
           }
         }
       }
-      if (devSecurityHeaders2) {
-        try {
-          return devSecurityHeaders2.apply(response);
-        } catch {
-        }
+    }
+    if (devSecurityHeaders2) {
+      try {
+        return devSecurityHeaders2.apply(response);
+      } catch {
       }
-      return response;
     }
-  });
+    return response;
+  }
+  if (typeof Bun !== "undefined" && typeof Bun.serve === "function") {
+    Bun.serve({ port, hostname: host, fetch: devHandle });
+  } else {
+    const { createServer } = await import("node:http");
+    const srv = createServer(async (nreq, nres) => {
+      try {
+        const hostHdr = String(nreq.headers.host ?? `${host}:${port}`);
+        const chunks = [];
+        for await (const c of nreq) chunks.push(Buffer.from(c));
+        const raw = nreq.method === "GET" || nreq.method === "HEAD" ? void 0 : Buffer.concat(chunks);
+        const request = new Request(`http://${hostHdr}${nreq.url}`, {
+          method: nreq.method,
+          headers: nreq.headers,
+          body: raw && raw.length > 0 ? raw : void 0
+        });
+        const resp = await devHandle(request);
+        const out = Buffer.from(await resp.arrayBuffer());
+        const headers = {};
+        resp.headers.forEach((v, k) => {
+          headers[k] = v;
+        });
+        nres.writeHead(resp.status, headers);
+        nres.end(out);
+      } catch (e) {
+        nres.writeHead(500, { "Content-Type": "text/plain" });
+        nres.end("Internal dev server error: " + (e?.message ?? e));
+      }
+    });
+    await new Promise((r) => srv.listen(port, host, () => r()));
+    console.log("  [tw] runtime: node (Bun not found \u2014 using node:http)");
+  }
+  try {
+    const { watch: watch2 } = await import("node:fs");
+    const seen = /* @__PURE__ */ new Set();
+    watch2(rootDir, { recursive: true }, (_t, f) => {
+      const name = String(f);
+      if (name.includes("node_modules") || name.includes(".git") || name.split("/").includes(".tw")) return;
+      if (seen.has(name)) return;
+      seen.add(name);
+      const t2 = setTimeout(() => seen.delete(name), 400);
+      if (typeof t2?.unref === "function") t2.unref();
+      console.log(`  [tw] ${name} changed -- reload the browser`);
+    });
+  } catch {
+  }
   console.log("  Server running! Open http://" + host + ":" + port + " in your browser.");
   console.log("  Press Ctrl+C to stop.\n");
 }
@@ -61881,6 +62818,25 @@ import { join as join22 } from "node:path";
 import { existsSync as existsSync18 } from "node:fs";
 async function serveCommand() {
   const args = process.argv.slice(3);
+  if (args.includes("-h") || args.includes("--help")) {
+    console.log(`
+  tw serve \u2014 start the production server
+
+  Usage:
+    tw serve [--port <number>] [--host <address>]
+
+  Options:
+    --port <number>   port to listen on (default: 8000; tw.config.ts
+                      server.port and the PORT env var also work,
+                      in that order of precedence)
+    --host <address>  bind address (default: 0.0.0.0)
+    -h, --help        show this help
+
+  Requires a build first (tw build); serves .tw/ output with SSR,
+  middleware and API routes.
+`);
+    process.exit(0);
+  }
   let port = null;
   let host = "0.0.0.0";
   for (let i = 0; i < args.length; i++) {
@@ -61895,8 +62851,8 @@ async function serveCommand() {
   const envPath = join22(rootDir, ".env");
   if (existsSync18(envPath)) {
     try {
-      const { readFileSync: readFileSync19 } = await import("node:fs");
-      for (const line of readFileSync19(envPath, "utf-8").split("\n")) {
+      const { readFileSync: readFileSync20 } = await import("node:fs");
+      for (const line of readFileSync20(envPath, "utf-8").split("\n")) {
         const m = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)\s*$/.exec(line);
         if (m && !(m[1] in process.env)) {
           process.env[m[1]] = m[2].replace(/^["']|["']$/g, "");
@@ -61942,7 +62898,7 @@ async function serveCommand() {
       staticDir: outDir,
       config,
       ...config?.rateLimit ? { rateLimit: config.rateLimit } : {},
-      ...typeof config?.compression === "boolean" ? { compression: config.compression } : {},
+      ...config?.compression !== void 0 || config?.server?.compression !== void 0 ? { compression: config?.compression ?? config?.server?.compression } : {},
       ...pluginManager && pluginManager.size() > 0 ? { plugins: pluginManager } : {},
       ...config?.images ? { images: config.images } : {},
       ...config?.security ? { security: config.security } : {}
@@ -62221,7 +63177,7 @@ async function adapterCommand() {
 // tw/commands/test.ts
 import { join as join27 } from "node:path";
 import { createRequire as _cr } from "node:module";
-import { existsSync as existsSync22, readdirSync as readdirSync9, statSync as statSync9 } from "node:fs";
+import { existsSync as existsSync22, readdirSync as readdirSync9, statSync as statSync9, readFileSync as readFileSync15 } from "node:fs";
 var _require = _cr(import.meta.url);
 function collectTests(dir, out) {
   if (!existsSync22(dir)) return;
@@ -62277,6 +63233,17 @@ async function testCommand() {
     }
   }
   console.log("\n  tw test -- running " + files.length + " test file" + (files.length === 1 ? "" : "s") + "\n");
+  for (const f of files) {
+    try {
+      const src = readFileSync15(f, "utf-8");
+      const hasBunTest = src.includes("bun:test");
+      const hasTestCall = /\b(test|it|describe)\s*\(/.test(src);
+      if (!hasBunTest && !hasTestCall) {
+        console.log("  \x1B[33m! " + f.replace(rootDir + "/", "") + ' defined no tests -- only bun:test format runs (import { test, expect } from "bun:test")\x1B[0m');
+      }
+    } catch {
+    }
+  }
   if (files.length === 0) {
     console.log("  No tests found. Create tests/your-name.test.ts:");
     console.log(`
@@ -62309,8 +63276,8 @@ async function testCommand() {
 
 // tw/commands/check.ts
 init_tw();
-import { join as join28 } from "node:path";
-import { existsSync as existsSync23, readFileSync as readFileSync15, readdirSync as readdirSync10, statSync as statSync10 } from "node:fs";
+import { join as join28, dirname as dirname8 } from "node:path";
+import { existsSync as existsSync23, readFileSync as readFileSync16, readdirSync as readdirSync10, statSync as statSync10 } from "node:fs";
 async function checkCommand() {
   const args = process.argv.slice(3);
   const rootDir = process.cwd();
@@ -62332,7 +63299,7 @@ async function checkCommand() {
     for (const filePath of twFiles) {
       const relativePath = filePath.replace(rootDir + "/", "");
       try {
-        const source = readFileSync15(filePath, "utf-8");
+        const source = readFileSync16(filePath, "utf-8");
         const result = await compile2(source, {
           filePath,
           optimize: false,
@@ -62343,6 +63310,42 @@ async function checkCommand() {
         const errors = diagnostics.filter((d) => d.severity === "error");
         const warnings = diagnostics.filter((d) => d.severity === "warning");
         const info = diagnostics.filter((d) => d.severity === "info");
+        const checkSource = readFileSync16(filePath, "utf-8");
+        const usedTags = /* @__PURE__ */ new Set();
+        const collectUsed = (n) => {
+          if (!n) return;
+          if (n.type === "Element" || n.type === "Component") {
+            const t2 = n.tag ?? n.name;
+            if (typeof t2 === "string" && t2[0] === t2[0].toUpperCase()) usedTags.add(t2);
+          }
+          for (const c of n.children ?? []) collectUsed(c);
+          if (n.type === "If" || n.type === "For" || n.type === "While") for (const c of n.body ?? []) collectUsed(c);
+        };
+        if (result.ast) {
+          for (const n of result.ast.body ?? []) collectUsed(n);
+        }
+        const SAFE_TAGS = /* @__PURE__ */ new Set(["Link", "Suspense", "RouterLink", "Image", "optImage"]);
+        const importedNames = /* @__PURE__ */ new Set();
+        for (const im of checkSource.matchAll(/import\s+([A-Za-z_]\w*)\s+from/g)) importedNames.add(im[1]);
+        for (const im of checkSource.matchAll(/import\s*\{([^}]+)\}/g)) {
+          for (const part of im[1].split(",")) {
+            const nm = part.split(" as ").pop().trim();
+            if (nm) importedNames.add(nm);
+          }
+        }
+        const unknownComponents = [];
+        for (const tag of usedTags) {
+          if (SAFE_TAGS.has(tag) || importedNames.has(tag)) continue;
+          if (findComponentUp(dirname8(filePath), tag)) continue;
+          unknownComponents.push(tag);
+        }
+        if (unknownComponents.length > 0) {
+          console.debug(`  ? ${relativePath} -- ${unknownComponents.length} unknown component(s)`);
+          for (const t2 of unknownComponents) {
+            console.debug(`    ? TW098 unknown component <${t2}> -- no import resolves it and no components/${t2}.tw exists`);
+          }
+          totalWarnings += unknownComponents.length;
+        }
         totalErrors += errors.length;
         totalWarnings += warnings.length;
         totalInfo += info.length;
@@ -62365,7 +63368,7 @@ async function checkCommand() {
     console.debug("  Compiler not found, running basic checks...\n");
     for (const filePath of twFiles) {
       const relativePath = filePath.replace(rootDir + "/", "");
-      const source = readFileSync15(filePath, "utf-8");
+      const source = readFileSync16(filePath, "utf-8");
       const maskedSource = maskSourceStringsAndComments(source);
       const openBraces = (maskedSource.match(/\{/g) || []).length;
       const closeBraces = (maskedSource.match(/\}/g) || []).length;
@@ -62379,13 +63382,41 @@ async function checkCommand() {
   }
   console.log(`
   Summary: ${totalErrors} errors, ${totalWarnings} warnings, ${totalInfo} info`);
+  const argv = process.argv.slice(2);
+  let maxWarnings = null;
+  if (argv.includes("--strict")) maxWarnings = 0;
+  const mwIdx = argv.indexOf("--max-warnings");
+  if (mwIdx !== -1 && argv[mwIdx + 1] !== void 0 && /^\d+$/.test(argv[mwIdx + 1])) {
+    maxWarnings = Number(argv[mwIdx + 1]);
+  } else {
+    const eq = argv.find((a) => a.startsWith("--max-warnings="));
+    if (eq && /^\d+$/.test(eq.split("=")[1])) maxWarnings = Number(eq.split("=")[1]);
+  }
   if (totalErrors > 0) {
     console.log("  Status: FAILED\n");
     process.exit(1);
+  } else if (maxWarnings !== null && totalWarnings > maxWarnings) {
+    console.log(`  Status: FAILED -- ${totalWarnings} warnings exceed --max-warnings=${maxWarnings}
+`);
+    process.exit(1);
   } else {
     console.log("  Status: PASSED\n");
   }
 }
+function findComponentUp(dir, name) {
+  let cur = dir;
+  for (let i = 0; i < 12 && cur && cur !== "/"; i++) {
+    try {
+      const candidate = join28(cur, "components", name + ".tw");
+      if (existsSync23(candidate)) return true;
+    } catch {
+    }
+    const parent = dirname8(cur);
+    if (parent === cur) break;
+    cur = parent;
+  }
+  return false;
+}
 function collectFiles2(dir, ext, results) {
   const entries = readdirSync10(dir);
   for (const entry of entries) {
@@ -62402,10 +63433,10 @@ function collectFiles2(dir, ext, results) {
 // tw/commands/plugin.ts
 init_tw();
 import { join as join29 } from "node:path";
-import { existsSync as existsSync24, readFileSync as readFileSync16, writeFileSync as writeFileSync9, mkdirSync as mkdirSync9, readdirSync as readdirSync11 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync17, writeFileSync as writeFileSync9, mkdirSync as mkdirSync9, readdirSync as readdirSync11 } from "node:fs";
 function readConfigPlugins(cfgPath) {
   if (!existsSync24(cfgPath)) return [];
-  const src = stripCommentsStringAware(readFileSync16(cfgPath, "utf-8"));
+  const src = stripCommentsStringAware(readFileSync17(cfgPath, "utf-8"));
   const m = /plugins\s*:\s*\[([^\]]*)\]/s.exec(src);
   if (!m) return [];
   const out = [];
@@ -62424,7 +63455,7 @@ function addConfigPlugin(cfgPath, name) {
 `);
     return true;
   }
-  const src = stripCommentsStringAware(readFileSync16(cfgPath, "utf-8"));
+  const src = stripCommentsStringAware(readFileSync17(cfgPath, "utf-8"));
   if (new RegExp(`["'\`]${name}["'\`]`).test(src)) return false;
   const m = /plugins\s*:\s*\[([^\]]*)\]/s.exec(src);
   if (m) {
@@ -62441,7 +63472,7 @@ function addConfigPlugin(cfgPath, name) {
 }
 function removeConfigPlugin(cfgPath, name) {
   if (!existsSync24(cfgPath)) return false;
-  const src = stripCommentsStringAware(readFileSync16(cfgPath, "utf-8"));
+  const src = stripCommentsStringAware(readFileSync17(cfgPath, "utf-8"));
   const m = /plugins\s*:\s*\[([^\]]*)\]/s.exec(src);
   if (!m) return false;
   const kept = m[1].split(",").map((e) => e.trim()).filter((e) => e && e !== `"${name}"` && e !== `'${name}'` && e !== "`" + name + "`");
@@ -62645,13 +63676,13 @@ async function lspCommand() {
 }
 
 // tw/help.ts
-import { readFileSync as readFileSync17 } from "node:fs";
+import { readFileSync as readFileSync18 } from "node:fs";
 import { join as join31 } from "node:path";
 function cliVersion() {
   try {
     const bd = globalThis.__TW_BUNDLE_DIR;
     const pj = bd ? join31(bd, "..", "package.json") : new URL("../../package.json", import.meta.url).pathname;
-    return JSON.parse(readFileSync17(pj, "utf-8")).version ?? "0.0.0";
+    return JSON.parse(readFileSync18(pj, "utf-8")).version ?? "0.0.0";
   } catch {
     return "0.0.0";
   }
@@ -62724,13 +63755,13 @@ var helpText = `
 
 // tw/commands/index.ts
 await init_build();
-import { readFileSync as readFileSync18 } from "node:fs";
+import { readFileSync as readFileSync19 } from "node:fs";
 import { join as join32 } from "node:path";
 var VERSION = (() => {
   try {
     const bd = globalThis.__TW_BUNDLE_DIR;
     const pj = bd ? join32(bd, "..", "package.json") : new URL("../../package.json", import.meta.url).pathname;
-    return JSON.parse(readFileSync18(pj, "utf-8")).version ?? "0.0.0";
+    return JSON.parse(readFileSync19(pj, "utf-8")).version ?? "0.0.0";
   } catch {
     return "0.0.0";
   }