tw-framework 2.0.0 → 2.0.1

package/dist/tw-server.mjs

@@ -6908,20 +6908,39 @@ function sha12(data) {
 async function md52(data) {
   return hashWithWebCrypto("md5", data);
 }
+function webcryptoHashName(algorithm) {
+  const key2 = String(algorithm).toLowerCase().replace(/[-_]/g, "");
+  const map2 = {
+    md5: "MD5",
+    sha1: "SHA-1",
+    sha224: "SHA-224",
+    sha256: "SHA-256",
+    sha384: "SHA-384",
+    sha512: "SHA-512"
+  };
+  return map2[key2] ?? algorithm;
+}
 async function hmac2(data, key2, algorithm = "sha256") {
   const encoder2 = new TextEncoder();
   const keyData = encoder2.encode(key2);
   const messageData = encoder2.encode(data);
-  const cryptoKey = await crypto.subtle.importKey("raw", keyData, { name: "HMAC", hash: algorithm }, false, ["sign"]);
+  const cryptoKey = await crypto.subtle.importKey("raw", keyData, { name: "HMAC", hash: webcryptoHashName(algorithm) }, false, ["sign"]);
   const signature = await crypto.subtle.sign("HMAC", cryptoKey, messageData);
   const hashArray = Array.from(new Uint8Array(signature));
   return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+async function verifyHmac(data, key2, signature, algorithm = "sha256") {
+  const expected = await hmac2(data, key2, algorithm);
+  if (expected.length !== signature.length) return false;
+  let diff2 = 0;
+  for (let i = 0; i < expected.length; i++) diff2 |= expected.charCodeAt(i) ^ signature.charCodeAt(i);
+  return diff2 === 0;
+}
 async function pbkdf2(password, salt, iterations = 1e5, keyLength = 256) {
   const encoder2 = new TextEncoder();
   const keyMaterial = await crypto.subtle.importKey("raw", encoder2.encode(password), "PBKDF2", false, ["deriveBits"]);
   const derivedBits = await crypto.subtle.deriveBits(
-    { name: "PBKDF2", salt: encoder2.encode(salt), iterations, hash: "sha256" },
+    { name: "PBKDF2", salt: encoder2.encode(salt), iterations, hash: "SHA-256" },
     keyMaterial,
     keyLength
   );
@@ -6966,9 +6985,16 @@ async function decryptString(encryptedData, password, salt) {
   const key2 = await deriveKey(password, salt);
   return decryptAES(encrypted, key2, iv);
 }
+async function generateRSASigningKeyPair(bits = 2048) {
+  return crypto.subtle.generateKey(
+    { name: "RSASSA-PKCS1-v1_5", modulusLength: bits, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" },
+    true,
+    ["sign", "verify"]
+  );
+}
 async function generateRSAKeyPair(bits = 2048) {
   return crypto.subtle.generateKey(
-    { name: "RSA-OAEP", modulusLength: bits, publicExponent: new Uint8Array([1, 0, 1]), hash: "sha256" },
+    { name: "RSA-OAEP", modulusLength: bits, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" },
     true,
     ["encrypt", "decrypt"]
   );
@@ -8416,36 +8442,6 @@ var init_etag = __esm({
 });
 
 // ../../packages/shared/tw/hashing/hmac.ts
-function bufferToHex2(buffer) {
-  const bytes = new Uint8Array(buffer);
-  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-function timingSafeEqual2(a, b) {
-  if (a.length !== b.length) return false;
-  let result = 0;
-  for (let i = 0; i < a.length; i++) {
-    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return result === 0;
-}
-async function hmac3(key2, message, algorithm = "SHA-256") {
-  const encoder2 = new TextEncoder();
-  const keyData = encoder2.encode(key2);
-  const messageData = encoder2.encode(message);
-  const cryptoKey = await crypto.subtle.importKey(
-    "raw",
-    keyData,
-    { name: "HMAC", hash: algorithm },
-    false,
-    ["sign"]
-  );
-  const signature = await crypto.subtle.sign("HMAC", cryptoKey, messageData);
-  return bufferToHex2(signature);
-}
-async function verifyHmac(key2, message, signature, algorithm = "SHA-256") {
-  const computed6 = await hmac3(key2, message, algorithm);
-  return timingSafeEqual2(computed6, signature);
-}
 var init_hmac = __esm({
   "../../packages/shared/tw/hashing/hmac.ts"() {
   }
@@ -9110,6 +9106,7 @@ __export(tw_exports, {
   generatePIN: () => generatePIN,
   generateProofOfKnowledge: () => generateProofOfKnowledge,
   generateRSAKeyPair: () => generateRSAKeyPair,
+  generateRSASigningKeyPair: () => generateRSASigningKeyPair,
   generateSecret: () => generateSecret,
   generateTOTP: () => generateTOTP,
   geolocation: () => geolocation,
@@ -9615,6 +9612,7 @@ __export(tw_exports, {
   zip: () => zip,
   zipWith: () => zipWith
 });
+import { createHmac } from "node:crypto";
 function generateETag(data) {
   let hash2 = 0;
   for (let i = 0; i < data.length; i++) {
@@ -9640,19 +9638,14 @@ function merkleRoot(hashes) {
   return level[0];
 }
 function hmacSign(data, key2) {
-  let h1 = 0, h22 = 0;
-  for (let i = 0; i < data.length; i++) {
-    h1 = (h1 << 5) - h1 + data.charCodeAt(i);
-    h1 |= 0;
-  }
-  for (let i = 0; i < key2.length; i++) {
-    h22 = (h22 << 5) - h22 + key2.charCodeAt(i);
-    h22 |= 0;
-  }
-  return (h1 ^ h22).toString(16);
+  return createHmac("sha256", key2).update(data).digest("hex");
 }
 function hmacVerify(data, key2, signature) {
-  return hmacSign(data, key2) === signature;
+  const expected = hmacSign(data, key2);
+  if (expected.length !== signature.length) return false;
+  let diff2 = 0;
+  for (let i = 0; i < expected.length; i++) diff2 |= expected.charCodeAt(i) ^ signature.charCodeAt(i);
+  return diff2 === 0;
 }
 var HTML_TAGS;
 var init_tw = __esm({
@@ -9809,6 +9802,9 @@ function optimizedImageUrl(src, opts = {}) {
   if (opts.quality) p.set("q", String(opts.quality));
   p.set("f", opts.format ?? "auto");
   const qs = p.toString();
+  if (/^https?:\/\//i.test(src)) {
+    return `/_tw/img/_remote?src=${encodeURIComponent(src)}&${qs}`;
+  }
   return `/_tw/img${src.startsWith("/") ? src : "/" + src}?${qs}`;
 }
 function imageAttributesFor(opts, config = DEFAULT_IMAGE_CONFIG) {
@@ -9816,7 +9812,7 @@ function imageAttributesFor(opts, config = DEFAULT_IMAGE_CONFIG) {
   const quality = opts.quality ?? config.quality;
   const format = config.formats[0] ?? "webp";
   const isRemote = /^https?:\/\//i.test(opts.src);
-  const src = isRemote ? `/_tw/img/_remote?src=${encodeURIComponent(opts.src)}&w=${opts.width ?? ""}&h=${opts.height ?? ""}&q=${quality}&f=auto` : optimizedImageUrl(opts.src, { width: opts.width, height: opts.height, quality });
+  const src = isRemote ? `/_tw/img/_remote?src=${encodeURIComponent(opts.src)}${opts.width ? `&w=${opts.width}` : ""}${opts.height ? `&h=${opts.height}` : ""}&q=${quality}&f=auto` : optimizedImageUrl(opts.src, { width: opts.width, height: opts.height, quality });
   const widths = config.breakpoints.filter((bp) => width === 0 || bp <= width * 2);
   const srcset = widths.map(
     (bp) => isRemote ? `/_tw/img/_remote?src=${encodeURIComponent(opts.src)}&w=${bp}&q=${quality}&f=auto ${bp}w` : `${optimizedImageUrl(opts.src, { width: bp, quality })} ${bp}w`
@@ -9996,7 +9992,7 @@ function createImageHandler(options) {
     }
     if (!warnedNoSharp) {
       warnedNoSharp = true;
-      console.warn("  [tw/image] sharp not installed \u2014 serving original images (bun add sharp to enable resizing/WebP/AVIF)");
+      console.warn("  [tw/image] sharp not installed \u2014 using the built-in converter (WebP/AVIF); install sharp for faster resizing");
     }
     return { data, contentType: "", viaSharp: false };
   }
@@ -10788,6 +10784,18 @@ function findGlobalError(rootNode2) {
 function findRootError(rootNode2) {
   return (rootNode2.files || []).find((f) => f.type === "error");
 }
+function findNearestNotFound(rootNode2, pathParts) {
+  let found = (rootNode2.files || []).find((f) => f.type === "not-found");
+  let node = rootNode2;
+  for (const part of pathParts) {
+    const child = (node.children || []).find((c) => c.segment === part);
+    if (!child) break;
+    const f = (child.files || []).find((x) => x.type === "not-found");
+    if (f) found = f;
+    node = child;
+  }
+  return found;
+}
 function findRootNotFound(rootNode2) {
   return rootNode2.files.find((f) => f.type === "not-found");
 }
@@ -228157,6 +228165,10 @@ function parseTWSelector(cursor, errors, state, parseBody) {
         while (!cursor.done) {
           const ct = cursor.peek();
           if (!ct) break;
+          if (ct.type === "IDENT" && ct.value === "on") {
+            const after2 = cursor.peek(1);
+            if (after2 && after2.type === "COLON") break;
+          }
           if (ct.type === "IDENT" && !nextPrevMinus && nextClass.length > 0 && (CLASS_BOUNDARY_BOOLEAN_ATTRS.has(ct.value) || inlineAttrStartsAt(cursor))) {
             break;
           }
@@ -228447,7 +228459,9 @@ function parseTWSelector(cursor, errors, state, parseBody) {
       const first = cursor.peek();
       const second = cursor.peek(1);
       const CONTROL_FLOW = /* @__PURE__ */ new Set(["for", "if", "while", "switch", "else", "try", "catch"]);
-      const isAttrBlock = first && (first.type === "IDENT" || first.type === "KEYWORD") && !CONTROL_FLOW.has(first.value) && HTML_ATTRS_ONLY.has(first.value) && second && (second.type === "STRING" || second.type === "NUMBER" || second.type === "IDENT" || second.type === "KEYWORD");
+      const third = cursor.peek(2);
+      const isPropBlock = second && second.type === "ASSIGN" && third && third.type === "LBRACE";
+      const isAttrBlock = first && (first.type === "IDENT" || first.type === "KEYWORD") && !CONTROL_FLOW.has(first.value) && (HTML_ATTRS_ONLY.has(first.value) || isPropBlock) && second && (second.type === "STRING" || second.type === "NUMBER" || second.type === "IDENT" || second.type === "KEYWORD" || second.type === "ASSIGN");
       if (isAttrBlock) {
         while (!cursor.done) {
           const t3 = cursor.peek();
@@ -228455,6 +228469,34 @@ function parseTWSelector(cursor, errors, state, parseBody) {
           if (t3.type === "IDENT" || t3.type === "KEYWORD") {
             const attrName = t3.value;
             cursor.advance();
+            if (cursor.peek() && (cursor.peek().type === "ASSIGN" || cursor.peek().type === "EQUALS")) {
+              cursor.advance();
+              cursor.skipWhitespace();
+              if (cursor.peek() && cursor.peek().type === "LBRACE") {
+                cursor.advance();
+                let expr = "";
+                let depth = 1;
+                let prevWS = false;
+                while (!cursor.done) {
+                  const tk = cursor.peek();
+                  if (!tk || tk.type === "EOF") break;
+                  if (tk.type === "LBRACE") depth++;
+                  else if (tk.type === "RBRACE") {
+                    depth--;
+                    if (depth === 0) {
+                      cursor.advance();
+                      break;
+                    }
+                  }
+                  if (expr && prevWS) expr += " ";
+                  expr += tk.raw ?? tk.value;
+                  prevWS = !!tk.followedByWhitespace;
+                  cursor.advance();
+                }
+                el.attrs.push(createAttribute(attrName, expr.trim(), t3.pos.line, t3.pos.col, true));
+                continue;
+              }
+            }
             const vToken = cursor.peek();
             if (vToken && (vToken.type === "STRING" || vToken.type === "NUMBER")) {
               cursor.advance();
@@ -237200,13 +237242,17 @@ var init_types4 = __esm({
 var TW_VERSION, TW_GENERATOR_META;
 var init_version = __esm({
   "../../packages/compiler/tw/codegen/version.ts"() {
-    TW_VERSION = "2.0.0";
+    TW_VERSION = "2.0.1";
     TW_GENERATOR_META = `<meta name="generator" content="TW Framework ${TW_VERSION}">`;
   }
 });
 
 // ../../packages/link/tw/index.ts
+function isDangerousHref(href) {
+  return DANGEROUS_SCHEME.test(href.replace(/[\u0000-\u0020]/g, ""));
+}
 function isExternalHref(href) {
+  if (isDangerousHref(href)) return false;
   return /^[a-z][a-z0-9+.-]*:/i.test(href) || // any scheme: http(s), mailto, tel, ...
   href.startsWith("//");
 }
@@ -237215,7 +237261,8 @@ function isWebExternal(href) {
   return true;
 }
 function linkAttributesFor(opts) {
-  const href = (opts.href ?? "").trim();
+  const rawHref = (opts.href ?? "").trim();
+  const href = isDangerousHref(rawHref) ? "#" : rawHref;
   const external = opts.external === true || isExternalHref(href);
   const attrs = {};
   if (external) {
@@ -237244,8 +237291,10 @@ function linkAttributesFor(opts) {
   if (opts.id) attrs["id"] = opts.id;
   return { href, external, attrs };
 }
+var DANGEROUS_SCHEME;
 var init_tw3 = __esm({
   "../../packages/link/tw/index.ts"() {
+    DANGEROUS_SCHEME = /^(javascript|data|vbscript):/i;
   }
 });
 
@@ -237758,12 +237807,31 @@ var init_interpolate = __esm({
 });
 
 // ../../packages/compiler/tw/eval/evaluate.ts
+function setEvalBindings(bindings) {
+  extraBindings = bindings ?? {};
+}
 function evaluate(expr, vars, sandbox) {
   if (!expr) return "";
   const sb = sandbox ?? defaultSandbox;
   if (vars[expr] !== void 0) {
     return vars[expr];
   }
+  if (expr.startsWith("(") && expr.endsWith(")")) {
+    let d = 0;
+    let wraps = true;
+    for (let i = 0; i < expr.length; i++) {
+      const ch = expr[i];
+      if (ch === "(") d++;
+      else if (ch === ")") {
+        d--;
+        if (d === 0 && i < expr.length - 1) {
+          wraps = false;
+          break;
+        }
+      }
+    }
+    if (wraps && d === 0) return evaluate(expr.slice(1, -1).trim(), vars, sb);
+  }
   if (/^-?\d+(\.\d+)?$/.test(expr)) return expr;
   if (expr.startsWith('"') && expr.endsWith('"') || expr.startsWith("'") && expr.endsWith("'")) {
     return expr.slice(1, -1);
@@ -237771,11 +237839,54 @@ function evaluate(expr, vars, sandbox) {
   if (expr === "true") return "true";
   if (expr === "false") return "false";
   if (expr === "null" || expr === "undefined") return "";
-  const ternMatch = expr.match(/^(.+?)\s*\?\s*(.+?)\s*:\s*(.+)$/);
-  if (ternMatch) {
-    const cond = isTruthy(resolve2(ternMatch[1].trim(), vars, sb));
-    return cond ? resolve2(ternMatch[2].trim(), vars, sb) : resolve2(ternMatch[3].trim(), vars, sb);
+  {
+    let depth = 0;
+    let pending2 = 0;
+    let q = -1;
+    let quote = "";
+    for (let i = 0; i < expr.length; i++) {
+      const ch = expr[i];
+      if (quote) {
+        if (ch === "\\") {
+          i++;
+          continue;
+        }
+        if (ch === quote) quote = "";
+        continue;
+      }
+      if (ch === "'" || ch === '"' || ch === "`") {
+        quote = ch;
+        continue;
+      }
+      if (ch === "(" || ch === "[" || ch === "{") {
+        depth++;
+        continue;
+      }
+      if (ch === ")" || ch === "]" || ch === "}") {
+        depth--;
+        continue;
+      }
+      if (depth !== 0) continue;
+      if (ch === "?") {
+        if (pending2 === 0) q = i;
+        pending2++;
+        continue;
+      }
+      if (ch === ":" && pending2 > 0) {
+        pending2--;
+        if (pending2 > 0) continue;
+        const cond = expr.slice(0, q).trim();
+        const cons = expr.slice(q + 1, i).trim();
+        const alt = expr.slice(i + 1).trim();
+        if (cond && cons && alt) {
+          return isTruthy(resolve2(cond, vars, sb)) ? resolve2(cons, vars, sb) : resolve2(alt, vars, sb);
+        }
+        break;
+      }
+    }
   }
+  const dyn = evalWithVars(expr, vars);
+  if (dyn !== null) return dyn;
   const orParts = splitLogical(expr, "||");
   if (orParts.length > 1) {
     for (const part of orParts) {
@@ -237852,7 +237963,7 @@ function evaluate(expr, vars, sandbox) {
     return current2 !== void 0 && current2 !== null ? String(current2) : "";
   }
   const fnMatch = expr.match(/^(\w+)\((.*)\)$/);
-  if (fnMatch) {
+  if (fnMatch && isBuiltinName(fnMatch[1])) {
     const fn = fnMatch[1];
     const arg = resolve2(fnMatch[2].trim(), vars, sb);
     return callBuiltin(fn, arg, sb);
@@ -237871,6 +237982,38 @@ function evaluate(expr, vars, sandbox) {
   }
   return expr;
 }
+function evalWithVars(expr, vars) {
+  if (!expr || /[`\\]/.test(expr)) return null;
+  if (!/^[\w\s.$[\]{}()'"`,+\-*/%?:<>=!&|]*$/.test(expr)) return null;
+  for (const m of expr.matchAll(/\.([A-Za-z_$][\w$]*)\s*\(/g)) {
+    if (!SAFE_MEMBERS.has(m[1])) return null;
+  }
+  const names = [];
+  const vals = [];
+  for (const k of Object.keys(vars)) {
+    if (!/^[A-Za-z_$][\w$]*$/.test(k)) continue;
+    if (k in extraBindings) continue;
+    names.push(k);
+    try {
+      vals.push(JSON.parse(vars[k]));
+    } catch {
+      vals.push(vars[k]);
+    }
+  }
+  for (const k of Object.keys(extraBindings)) {
+    if (!/^[A-Za-z_$][\w$]*$/.test(k)) continue;
+    names.push(k);
+    vals.push(extraBindings[k]);
+  }
+  try {
+    const fn = new Function(...names, `"use strict"; return (${expr});`);
+    const out = fn(...vals);
+    if (out === void 0 || out === null) return null;
+    return typeof out === "object" ? JSON.stringify(out) : String(out);
+  } catch {
+    return null;
+  }
+}
 function resolve2(token, vars, sandbox) {
   const trimmed = token.trim();
   if (!trimmed) return "";
@@ -238039,7 +238182,7 @@ function coerce(value, targetType) {
       return value;
   }
 }
-var defaultSandbox;
+var defaultSandbox, extraBindings, SAFE_MEMBERS;
 var init_evaluate = __esm({
   "../../packages/compiler/tw/eval/evaluate.ts"() {
     init_sandbox();
@@ -238047,6 +238190,64 @@ var init_evaluate = __esm({
     init_builtins();
     init_interpolate();
     defaultSandbox = new Sandbox();
+    extraBindings = {};
+    SAFE_MEMBERS = /* @__PURE__ */ new Set([
+      "length",
+      "toUpperCase",
+      "toLowerCase",
+      "trim",
+      "trimStart",
+      "trimEnd",
+      "slice",
+      "substring",
+      "substr",
+      "charAt",
+      "at",
+      "includes",
+      "indexOf",
+      "lastIndexOf",
+      "startsWith",
+      "endsWith",
+      "replace",
+      "replaceAll",
+      "split",
+      "join",
+      "concat",
+      "repeat",
+      "padStart",
+      "padEnd",
+      "toString",
+      "toFixed",
+      "map",
+      "filter",
+      "find",
+      "some",
+      "every",
+      "reduce",
+      "sort",
+      "reverse",
+      // Static helpers on the built-ins (JSON.stringify, Object.keys, Math.round).
+      "stringify",
+      "parse",
+      "keys",
+      "values",
+      "entries",
+      "from",
+      "isArray",
+      "isInteger",
+      "isFinite",
+      "abs",
+      "ceil",
+      "floor",
+      "round",
+      "max",
+      "min",
+      "pow",
+      "sqrt",
+      "random",
+      "now",
+      "toISOString"
+    ]);
   }
 });
 
@@ -238201,9 +238402,78 @@ function callBuiltin(fn, arg, sandbox) {
 function applyFilter(value, filter, args, vars, sandbox) {
   return callBuiltin(filter, value, sandbox);
 }
+function isBuiltinName(fn) {
+  return BUILTIN_NAMES.has(fn);
+}
+var BUILTIN_NAMES;
 var init_builtins = __esm({
   "../../packages/compiler/tw/eval/builtins.ts"() {
     init_evaluate();
+    BUILTIN_NAMES = /* @__PURE__ */ new Set([
+      "Boolean",
+      "Number",
+      "String",
+      "abs",
+      "base64decode",
+      "base64encode",
+      "bool",
+      "camelCase",
+      "capitalize",
+      "ceil",
+      "cos",
+      "date",
+      "decodeURI",
+      "encodeURI",
+      "endsWith",
+      "exp",
+      "first",
+      "float",
+      "floor",
+      "includes",
+      "indexOf",
+      "int",
+      "join",
+      "json",
+      "kebabCase",
+      "last",
+      "len",
+      "length",
+      "log",
+      "lower",
+      "lowercase",
+      "match",
+      "max",
+      "min",
+      "now",
+      "num",
+      "padEnd",
+      "padStart",
+      "parseFloat",
+      "parseInt",
+      "parseJSON",
+      "pow",
+      "random",
+      "repeat",
+      "replace",
+      "reverse",
+      "round",
+      "sin",
+      "size",
+      "slice",
+      "snakeCase",
+      "split",
+      "sqrt",
+      "startsWith",
+      "str",
+      "stringify",
+      "tan",
+      "test",
+      "time",
+      "title",
+      "trim",
+      "upper",
+      "uppercase"
+    ]);
   }
 });
 
@@ -239252,16 +239522,61 @@ function addScope(css, scopeId) {
   out += prelude;
   return out;
 }
-function interpolate2(expr, vars) {
-  const masked = expr.replace(/\\\{/g, "
O").replace(/\\\}/g, "
C");
-  const out = masked.replace(/\{([^}]+)\}/g, (_, name) => {
-    const key2 = name.trim();
+function interpolateBraces(input, vars) {
+  let out = "";
+  let i = 0;
+  while (i < input.length) {
+    const ch = input[i];
+    if (ch !== "{") {
+      out += ch;
+      i++;
+      continue;
+    }
+    let depth = 1;
+    let j = i + 1;
+    let quote = "";
+    while (j < input.length && depth > 0) {
+      const c = input[j];
+      if (quote) {
+        if (c === "\\") {
+          j += 2;
+          continue;
+        }
+        if (c === quote) quote = "";
+        j++;
+        continue;
+      }
+      if (c === "'" || c === '"' || c === "`") {
+        quote = c;
+        j++;
+        continue;
+      }
+      if (c === "{") depth++;
+      else if (c === "}") {
+        depth--;
+        if (depth === 0) break;
+      }
+      j++;
+    }
+    if (depth !== 0) {
+      out += ch;
+      i++;
+      continue;
+    }
+    const key2 = input.slice(i + 1, j).trim();
     if (/^[a-zA-Z_$][\w$]*$/.test(key2)) {
-      return vars[key2] ?? "";
+      out += vars[key2] ?? "";
+    } else {
+      const val = evaluate(key2, vars);
+      out += val === null ? "" : val;
     }
-    const val = evaluate(key2, vars);
-    return val === null ? "" : val;
-  });
+    i = j + 1;
+  }
+  return out;
+}
+function interpolate2(expr, vars) {
+  const masked = expr.replace(/\\\{/g, "
O").replace(/\\\}/g, "
C");
+  const out = interpolateBraces(masked, vars);
   return out.replace(/\u0001O/g, "{").replace(/\u0001C/g, "}");
 }
 function isTruthy2(val) {
@@ -239740,7 +240055,21 @@ function renderBindings(bindings, ctx) {
   if (bindings.length === 0) return "";
   const parts = [];
   for (const binding of bindings) {
-    parts.push(`data-tw-bind-${binding.property}="${escapeAttr3(String(binding.expression ?? ""))}"`);
+    const expr = String(binding.expression ?? "");
+    let initial = "";
+    try {
+      if (/^[A-Za-z_$][\w$]*$/.test(expr)) {
+        const v = ctx.stateVars[expr];
+        if (v !== void 0 && v !== null) initial = String(v);
+      } else if (expr) {
+        initial = interpolate2("{" + expr + "}", ctx.stateVars);
+      }
+    } catch {
+    }
+    if (initial && !/[{}]/.test(initial)) {
+      parts.push(`${binding.property}="${escapeAttr3(initial)}"`);
+    }
+    parts.push(`data-tw-bind-${binding.property}="${escapeAttr3(expr)}"`);
   }
   return parts.join(" ");
 }
@@ -239855,8 +240184,13 @@ function generateComponent(comp, ctx) {
   const savedStateVars = { ...ctx.stateVars };
   for (const prop of comp.props) {
     if (typeof prop.value === "string") {
-      const resolved = interpolate2(prop.value, ctx.stateVars);
-      ctx.stateVars[prop.name] = resolved;
+      const raw = String(prop.value);
+      const head = raw.split(/[.[]/)[0];
+      if (!/[{}]/.test(raw) && Object.prototype.hasOwnProperty.call(ctx.stateVars, head)) {
+        ctx.stateVars[prop.name] = interpolate2("{" + raw + "}", ctx.stateVars);
+      } else {
+        ctx.stateVars[prop.name] = interpolate2(raw, ctx.stateVars);
+      }
     }
   }
   const componentProgram = componentRegistry.get(comp.name);
@@ -239950,6 +240284,14 @@ function generateFor(node, ctx) {
       }
     }
   }
+  if (items.length === 0 && !/^\s*\[/.test(iterableStr)) {
+    try {
+      const evaluated = evaluate(String(node.iterable ?? "").replace(/^\{/, "").replace(/\}$/, "").trim(), ctx.stateVars);
+      const parsed = JSON.parse(evaluated);
+      if (Array.isArray(parsed)) items = parsed;
+    } catch {
+    }
+  }
   for (let i = 0; i < items.length; i++) {
     const childCtx = { ...ctx };
     childCtx.stateVars = { ...ctx.stateVars };
@@ -243756,16 +244098,22 @@ function generateWithLayoutChain(layoutPrograms, pageProgram, stateVars) {
     }
   };
   let pageTitle = "TW Page";
+  let pageDescription = "";
   for (const dir of pageProgram.directives || []) {
-    if (dir.type === "PageDirective" && dir.key === "title") {
-      const t3 = dir.value;
-      if (t3 != null && String(t3) !== "") pageTitle = String(t3);
+    if (dir.type === "PageDirective") {
+      if (dir.key === "title") {
+        const t3 = dir.value;
+        if (t3 != null && String(t3) !== "") pageTitle = String(t3);
+      } else if (dir.key === "description") {
+        const d = dir.value;
+        if (d != null) pageDescription = String(d);
+      }
     }
   }
   const pageCtx = createContext("ssr");
   seedCtx(pageCtx);
   try {
-    pageCtx.stateVars["page"] = JSON.stringify({ title: pageTitle });
+    pageCtx.stateVars["page"] = JSON.stringify({ title: pageTitle, description: pageDescription });
   } catch {
   }
   {
@@ -243921,6 +244269,10 @@ function generate(program, stateVars, genOpts2) {
   const startTime = performance.now();
   const ctx = createContext("ssr");
   if (stateVars) ctx.stateVars = stateVars;
+  if (genOpts2?.imports) {
+    ctx.imports = genOpts2.imports;
+    setEvalBindings(genOpts2.imports);
+  } else setEvalBindings({});
   if (genOpts2 && genOpts2.scopedStyles === false) ctx.scopedStyles = false;
   if (genOpts2?.scopeId) ctx.scopeId = genOpts2.scopeId;
   if (genOpts2?.cssPrefix) ctx.cssPrefix = genOpts2.cssPrefix;
@@ -244005,6 +244357,7 @@ var init_vdom = __esm({
     init_types4();
     init_html2();
     init_builtin_components();
+    init_evaluate();
   }
 });
 
@@ -244345,6 +244698,7 @@ var init_codes = __esm({
       TW095: { message: "Invalid for-loop iterable -- use {varName} or a valid comma-separated literal", severity: "error", category: "syntax" },
       TW096: { message: "Unknown state variable in interpolation (renders empty)", severity: "warning", category: "semantic" },
       TW097: { message: "while with a comparison renders its body ONCE at build time (state cannot mutate during SSR) -- use for loops for repetition", severity: "warning", category: "semantic" },
+      TW098: { message: "Interpolation cannot be evaluated at build time -- it renders as its source text", severity: "warning", category: "semantic" },
       // Server blocks (TW099-TW101)
       TW099: { message: "Unknown server modifier (only ':defer' is supported)", severity: "error", category: "syntax" },
       TW100: { message: "Expected '{' after 'server'", severity: "error", category: "syntax" },
@@ -244432,6 +244786,7 @@ function checkUnknownTags(program, filePath, diags) {
   forEachNode(program, (node, ctx) => {
     if (!isElement(node)) return;
     if (node.tag[0] === node.tag[0]?.toUpperCase()) return;
+    if (BUILTIN_COMPONENT_TAGS.has(node.tag)) return;
     const parent = ctx?.parent;
     if (parent && (parent.type === "Element" && typeof parent.tag === "string" && parent.tag[0] === parent.tag[0]?.toUpperCase() || parent.type === "Component")) return;
     if (HTML_ELEMENTS2.has(node.tag.toLowerCase())) return;
@@ -244786,6 +245141,59 @@ function checkUnknownStateVars(program, filePath, diags) {
     "null",
     "undefined"
   ]);
+  const EVALUABLE_METHODS = /* @__PURE__ */ new Set([
+    "length",
+    "toUpperCase",
+    "toLowerCase",
+    "trim",
+    "trimStart",
+    "trimEnd",
+    "slice",
+    "substring",
+    "substr",
+    "charAt",
+    "at",
+    "includes",
+    "indexOf",
+    "lastIndexOf",
+    "startsWith",
+    "endsWith",
+    "replace",
+    "replaceAll",
+    "split",
+    "join",
+    "concat",
+    "repeat",
+    "padStart",
+    "padEnd",
+    "toString",
+    "toFixed",
+    "map",
+    "filter",
+    "find",
+    "some",
+    "every",
+    "reduce",
+    "sort",
+    "reverse",
+    "stringify",
+    "parse",
+    "keys",
+    "values",
+    "entries",
+    "from",
+    "isArray",
+    "round",
+    "floor",
+    "ceil",
+    "abs",
+    "max",
+    "min",
+    "pow",
+    "sqrt",
+    "random",
+    "now"
+  ]);
   for (const node of texts) {
     const text = String(node.value ?? "");
     if (!text.includes("{")) continue;
@@ -244801,6 +245209,22 @@ function checkUnknownStateVars(program, filePath, diags) {
         [`Declare it in the state block, or check the spelling`]
       ));
     }
+    for (const m of text.matchAll(/\{([^{}]+)\}/g)) {
+      const expr = m[1].trim();
+      if (/^[A-Za-z_$][\w$]*$/.test(expr)) continue;
+      for (const c of expr.matchAll(/([A-Za-z_$][\w$]*)\s*\(/g)) {
+        const fn = c[1];
+        if (known.has(fn) || BUILTINS2.has(fn) || EVALUABLE_METHODS.has(fn)) continue;
+        diags.push(createDiagnostic(
+          "TW098",
+          node.line,
+          node.col,
+          filePath,
+          `{${expr}}`,
+          [`Cannot evaluate this at build time -- it renders as its source. Check the name, or simplify the expression`]
+        ));
+      }
+    }
   }
 }
 function checkWhileComparisons(program, filePath, diags) {
@@ -244833,7 +245257,7 @@ function checkDeprecatedImports(program, filePath, diags) {
     }
   }
 }
-var HTML_ELEMENTS2, HTML_ATTRIBUTES2, GLOBAL_ATTRIBUTES2, CSS_PROPERTIES2, CSS_ALIASES2, EVENT_TYPES2, ARIA_ROLES2, ARIA_ATTRIBUTES2, DEPRECATED_IMPORTS;
+var HTML_ELEMENTS2, HTML_ATTRIBUTES2, GLOBAL_ATTRIBUTES2, CSS_PROPERTIES2, CSS_ALIASES2, EVENT_TYPES2, ARIA_ROLES2, ARIA_ATTRIBUTES2, BUILTIN_COMPONENT_TAGS, DEPRECATED_IMPORTS;
 var init_rules = __esm({
   "../../packages/compiler/tw/diagnostics/rules.ts"() {
     init_visitors();
@@ -245697,6 +246121,7 @@ var init_rules = __esm({
       "aria-valuenow",
       "aria-valuetext"
     ]);
+    BUILTIN_COMPONENT_TAGS = /* @__PURE__ */ new Set(["optImage", "twImage", "twLink", "twImg"]);
     DEPRECATED_IMPORTS = [
       { source: "utils/string/transform", name: "toHex", replacement: "stringToHex", removal: "2.1.0" },
       { source: "utils/string/transform", name: "fromHex", replacement: "hexToString", removal: "2.1.0" },
@@ -256009,7 +256434,8 @@ function genOpts(opts, scopeId) {
     scopedStyles: opts?.compiler?.scopedStyles,
     scopeId,
     cssPrefix: opts?.cssPrefix,
-    cssImportPaths: opts?.cssImportPaths
+    cssImportPaths: opts?.cssImportPaths,
+    imports: opts?.imports
   };
 }
 function scopeIdFor(filePath) {
@@ -256283,7 +256709,7 @@ __export(twm_rules_exports, {
   isRuleDsl: () => isRuleDsl,
   parseRules: () => parseRules
 });
-import { createHmac, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 function isRuleDsl(source) {
   const stripped = source.split("\n").map((l) => l.replace(/\/\/.*$/, "").trim()).filter((l) => l.length > 0).join("\n");
   return stripped.startsWith('rule "') || stripped.startsWith("rule '");
@@ -256381,14 +256807,14 @@ function verifyJwt_hs256(token, secret) {
     return false;
   }
   if (header?.alg !== "HS256") return false;
-  const expected = createHmac("sha256", secret).update(`${h3}.${p}`).digest();
+  const expected = createHmac2("sha256", secret).update(`${h3}.${p}`).digest();
   let got;
   try {
     got = b64urlDecode(sig);
   } catch {
     return false;
   }
-  if (expected.length !== got.length || !timingSafeEqual3(expected, got)) return false;
+  if (expected.length !== got.length || !timingSafeEqual2(expected, got)) return false;
   if (typeof payload?.exp === "number" && payload.exp * 1e3 < Date.now()) return false;
   return true;
 }
@@ -256764,6 +257190,32 @@ var init_twm_rules = __esm({
 });
 
 // ../../packages/runtime/tw/dependency-graph.ts
+function flushPendingSubs() {
+  if (isFlushing || !pendingSubs) return;
+  isFlushing = true;
+  try {
+    let guard = 0;
+    while (pendingSubs && pendingSubs.size > 0 && guard++ < 1e5) {
+      const batchOf = pendingSubs;
+      pendingSubs = /* @__PURE__ */ new Set();
+      for (const sub of batchOf) {
+        try {
+          sub();
+        } catch (e) {
+          console.error("[TW Reactivity] Signal subscriber error:", e);
+        }
+      }
+    }
+  } finally {
+    isFlushing = false;
+    pendingSubs = null;
+  }
+}
+function enqueueSubs(subs) {
+  if (!pendingSubs) pendingSubs = /* @__PURE__ */ new Set();
+  for (const s of subs) pendingSubs.add(s);
+  if (batchDepth === 0) flushPendingSubs();
+}
 function startBatch() {
   batchDepth++;
 }
@@ -256773,13 +257225,7 @@ function endBatch() {
     batchDepth = 0;
     const effects = Array.from(batchedEffects);
     batchedEffects.clear();
-    for (const eff of effects) {
-      try {
-        eff();
-      } catch (e) {
-        console.error("[TW Reactivity] Batch effect error:", e);
-      }
-    }
+    enqueueSubs(effects);
   }
 }
 function batch(fn) {
@@ -256961,12 +257407,14 @@ function isComputed(value) {
 function createScope3() {
   return new ReactiveScope();
 }
-var currentEffect, batchDepth, batchedEffects, SignalImpl, ComputedImpl, watchEffect, currentCleanup, ReactiveScope;
+var currentEffect, batchDepth, batchedEffects, pendingSubs, isFlushing, SignalImpl, ComputedImpl, watchEffect, currentCleanup, ReactiveScope;
 var init_dependency_graph = __esm({
   "../../packages/runtime/tw/dependency-graph.ts"() {
     currentEffect = null;
     batchDepth = 0;
     batchedEffects = /* @__PURE__ */ new Set();
+    pendingSubs = null;
+    isFlushing = false;
     SignalImpl = class {
       value;
       subscribers = /* @__PURE__ */ new Set();
@@ -256985,19 +257433,9 @@ var init_dependency_graph = __esm({
         if (this.equals(this.value, value)) return;
         this.value = value;
         if (batchDepth > 0) {
-          for (const sub of this.subscribers) {
-            batchedEffects.add(sub);
-          }
-        } else {
-          const subs = Array.from(this.subscribers);
-          for (const sub of subs) {
-            try {
-              sub();
-            } catch (e) {
-              console.error("[TW Reactivity] Signal subscriber error:", e);
-            }
-          }
+          for (const sub of this.subscribers) batchedEffects.add(sub);
         }
+        enqueueSubs(this.subscribers);
       }
       update(fn) {
         this.set(fn(this.value));
@@ -257063,14 +257501,11 @@ var init_dependency_graph = __esm({
         return this.cachedValue;
       }
       notify() {
-        const subs = Array.from(this.subscribers);
-        for (const sub of subs) {
-          try {
-            sub();
-          } catch (e) {
-            console.error("[TW Reactivity] Computed subscriber error:", e);
-          }
+        if (batchDepth > 0) {
+          for (const sub of this.subscribers) batchedEffects.add(sub);
+          return;
         }
+        enqueueSubs(this.subscribers);
       }
       set(_value) {
         throw new Error("Cannot set a computed signal");
@@ -260255,10 +260690,12 @@ var init_diff = __esm({
   "../../packages/runtime/tw/diff.ts"() {
     init_vdom2();
     HTML_ESCAPE_MAP = {
-      "&": "&",
-      "<": "<",
-      ">": ">",
-      '"': '"',
+      // These four mapped to THEMSELVES, so a <script> tag passed through
+      // untouched -- only ' was actually escaped.
+      "&": "&amp;",
+      "<": "&lt;",
+      ">": "&gt;",
+      '"': "&quot;",
       "'": "&#39;"
     };
     HTML_ESCAPE_REGEX = /[&<>"']/g;
@@ -263788,8 +264225,19 @@ async function hydrateElementById(id, component, root = typeof document !== "und
   );
 }
 function markForHydration(element, componentId, props) {
+  if (!element || typeof componentId !== "string") return;
   element.setAttribute(HYDRATE_ATTR, componentId);
-  element.setAttribute("data-tw-props", JSON.stringify(props));
+  let serialised = null;
+  if (props && typeof props === "object") {
+    try {
+      serialised = JSON.stringify(props);
+    } catch {
+      serialised = null;
+    }
+  }
+  if (serialised !== null && serialised !== void 0) {
+    element.setAttribute("data-tw-props", serialised);
+  }
 }
 function unmarkForHydration(element) {
   element.removeAttribute(HYDRATE_ATTR);
@@ -267089,15 +267537,21 @@ function usePathname(opts) {
 function matchPathPattern(path, pattern) {
   const pSeg = path.split("/").filter(Boolean);
   const tSeg = pattern.split("/").filter(Boolean);
-  if (pSeg.length !== tSeg.length) return { matches: false, params: {}, score: 0 };
+  const catchAllAt = tSeg.findIndex((t3) => t3.startsWith("[...") || t3.startsWith(":..."));
+  if (catchAllAt === -1) {
+    if (pSeg.length !== tSeg.length) return { matches: false, params: {}, score: 0 };
+  } else if (pSeg.length < tSeg.length) {
+    return { matches: false, params: {}, score: 0 };
+  }
   const params = {};
   let literal = 0;
   for (let i = 0; i < tSeg.length; i++) {
     const t3 = tSeg[i];
     const isParam = t3.startsWith("[") && t3.endsWith("]") || t3.startsWith(":");
     if (isParam) {
-      const name = t3.startsWith("[") ? t3.slice(1, -1).replace(/\.\.\.$/, "") : t3.slice(1);
-      params[name] = decodeURIComponent(pSeg[i]);
+      const name = t3.startsWith("[") ? t3.slice(1, -1).replace(/^\.\.\./, "") : t3.slice(1);
+      const isCatchAll = t3.startsWith("[...") || t3.startsWith(":...");
+      params[name] = isCatchAll ? pSeg.slice(i).map((seg) => decodeURIComponent(seg)).join("/") : decodeURIComponent(pSeg[i]);
     } else if (t3 !== pSeg[i]) {
       return { matches: false, params: {}, score: 0 };
     } else {
@@ -267912,7 +268366,11 @@ function defineStore(idOrDefinition, maybeDefinition) {
     const getterDeps = Object.values(reactiveState);
     for (const key2 of Object.keys(getters)) {
       const getter = getters[key2];
-      getterValues[key2] = computed4(getterDeps, getter);
+      getterValues[key2] = computed4(getterDeps, () => {
+        const snap = {};
+        for (const k of Object.keys(reactiveState)) snap[k] = reactiveState[k].value;
+        return getter.call(snap, snap);
+      });
     }
     const subscribers = /* @__PURE__ */ new Set();
     const actionListeners = /* @__PURE__ */ new Set();
@@ -267955,7 +268413,7 @@ function defineStore(idOrDefinition, maybeDefinition) {
       const fn = actions[key2];
       boundActions[key2] = (...args) => {
         actionListeners.forEach((cb) => cb({ name: key2, args }));
-        return fn.call(ctx, stateProxy, ...args);
+        return fn.call(stateProxy, stateProxy, ...args);
       };
     }
     for (const rv of Object.values(reactiveState)) {
@@ -268067,9 +268525,10 @@ var init_store = __esm({
         };
       }
       _notify() {
+        const current2 = this.value ?? this._value;
         for (const l of this._listeners) {
           try {
-            l();
+            l(current2);
           } catch {
           }
         }
@@ -269075,7 +269534,8 @@ var init_virtual_list = __esm({
         return this.container.scrollTop;
       }
       getFirstVisibleIndex() {
-        return this.visibleRange.start;
+        const last = Math.max(0, this.options?.itemCount ?? 0 - 1);
+        return Math.min(Math.max(this.visibleRange.start, 0), last);
       }
       getLastVisibleIndex() {
         return this.visibleRange.end;
@@ -271924,6 +272384,12 @@ var init_xss_detector = __esm({
           { name: "SQL comment", regex: /--\s/g, severity: "medium", recommendation: "Check for SQL comment injection" },
           { name: "Stacked queries", regex: /;\s*(SELECT|INSERT|UPDATE|DELETE|DROP|UNION)/gi, severity: "high", recommendation: "Prevent stacked queries" },
           { name: "UNION injection", regex: /UNION\s+SELECT/gi, severity: "critical", recommendation: "Filter UNION SELECT from user input" },
+          // Comment-only injections (`admin'--`, `admin'#`, `admin'/*`): a quote
+          // followed by a comment truncates the query and bypasses the login
+          // check, with no OR/UNION for the other patterns to catch.
+          { name: "Comment-terminated injection", regex: /['"`]\s*(--|#|\/\*)/g, severity: "high", recommendation: "A quote followed by a comment truncates the query -- use parameterized queries" },
+          // Parenthesised boolean injection: `') OR ('1'='1`.
+          { name: "Parenthesised boolean injection", regex: /['"`]?\s*\)\s*(OR|AND)\s*\(?\s*['"`]?\s*\d/i, severity: "high", recommendation: "Use parameterized queries instead of building boolean expressions" },
           { name: "Boolean-based injection", regex: /OR\s+1\s*=\s*1/gi, severity: "high", recommendation: "Use parameterized queries to prevent boolean injection" },
           { name: "Time-based injection", regex: /WAITFOR\s+DELAY/gi, severity: "high", recommendation: "Filter WAITFOR DELAY from user input" },
           { name: "DROP statement", regex: /DROP\s+(TABLE|DATABASE)/gi, severity: "critical", recommendation: "Prevent DROP statements in queries" },
@@ -272454,6 +272920,7 @@ var init_logger4 = __esm({
       }
       /** Records an audit event. */
       log(event) {
+        event = { type: "system", actor: "unknown", resource: "unknown", ...event };
         const fullEvent = {
           ...event,
           id: crypto.randomUUID(),
@@ -273470,6 +273937,13 @@ var FILE_SIGNATURES, DANGEROUS_EXTENSIONS, DANGEROUS_MIME_TYPES, ContentSecurity
 var init_protector = __esm({
   "../../packages/security/tw/content-security/protector.ts"() {
     FILE_SIGNATURES = [
+      // Executables and HTML: without these, content renamed to an image extension
+      // had no detected type, the signature check was skipped, and the upload was
+      // accepted as risk "low" -- the exact rename bypass the check exists for.
+      { ext: ["exe", "dll", "sys"], mime: "application/x-msdownload", signature: [77, 90] },
+      { ext: ["elf", "so", "bin"], mime: "application/x-executable", signature: [127, 69, 76, 70] },
+      { ext: ["html", "htm", "xhtml"], mime: "text/html", signature: [60, 104, 116, 109, 108] },
+      { ext: ["html", "htm"], mime: "text/html", signature: [60, 33, 68, 79, 67, 84, 89, 80, 69] },
       { ext: ["jpg", "jpeg"], mime: "image/jpeg", signature: [255, 216, 255] },
       { ext: ["png"], mime: "image/png", signature: [137, 80, 78, 71, 13, 10, 26, 10] },
       { ext: ["gif"], mime: "image/gif", signature: [71, 73, 70, 56] },
@@ -273521,10 +273995,39 @@ var init_protector = __esm({
       ".htpasswd",
       ".svg",
       // Can contain JavaScript
-      ".xml"
+      ".xml",
       // Can contain XXE
+      // Active-content types the set used to let through while still blocking .svg
+      // "because it can contain JavaScript" -- .html/.js are script-capable by
+      // definition, so an accepted upload served from our own origin is stored XSS.
+      ".html",
+      ".htm",
+      ".xhtml",
+      ".shtml",
+      ".js",
+      ".mjs",
+      ".cjs",
+      ".jsx",
+      ".ts",
+      ".tsx",
+      ".mhtml",
+      ".hta",
+      ".jsp",
+      ".asp",
+      ".aspx",
+      ".cgi",
+      ".pl"
     ]);
     DANGEROUS_MIME_TYPES = /* @__PURE__ */ new Set([
+      // Active-content types: they can carry script (svg, xhtml, xml) or be
+      // rendered as a document (html, pdf). Blocking .svg by extension while
+      // reporting isContentTypeSafe("image/svg+xml") === true was inconsistent.
+      "image/svg+xml",
+      "text/html",
+      "application/xhtml+xml",
+      "application/pdf",
+      "text/xml",
+      "application/xml",
       "application/javascript",
       "text/javascript",
       "application/x-javascript",
@@ -273579,7 +274082,9 @@ var init_protector = __esm({
             reason: "Empty file",
             sanitizedFilename: sanitized,
             detectedType: "unknown",
-            risk: "low"
+            // Unknown content is not low risk -- it is content whose type we could
+            // not establish, which is what a rename bypass looks like.
+            risk: "medium"
           };
         }
         if (this.blockedExtensions.has(ext)) {
@@ -274742,6 +275247,7 @@ var init_nonce_manager = __esm({
       validate(nonce) {
         const entry = this.nonces.get(nonce);
         if (!entry) return false;
+        if (entry.used) return false;
         if (Date.now() > entry.expiresAt) {
           this.nonces.delete(nonce);
           return false;
@@ -275534,7 +276040,15 @@ var init_token_manager = __esm({
       rotateAfterUse;
       maxTokens;
       tokens = /* @__PURE__ */ new Map();
+      /** Tokens this manager issued and already consumed. A rotated token is
+       *  deleted from `tokens`, so without this marker a replay found no entry and
+       *  fell through to the stateless branch, which accepted it -- defeating the
+       *  documented single-use guarantee of `rotateAfterUse`. */
+      consumedTokens = /* @__PURE__ */ new Set();
       constructor(options) {
+        if (!options || typeof options.secret !== "string" || options.secret.length === 0) {
+          throw new Error("createCSRFManager: options.secret is required (the HMAC key used to sign tokens)");
+        }
         this.secret = options.secret;
         this.tokenLength = options.tokenLength ?? 32;
         this.ttl = options.ttl ?? 36e5;
@@ -275634,12 +276148,16 @@ var init_token_manager = __esm({
           }
           entry.used = true;
           if (this.rotateAfterUse) {
+            this.consumedTokens.add(headerPart);
             this.tokens.delete(headerPart);
             const rotated = await this.generate(sessionId ?? void 0);
             return { valid: true, rotated };
           }
           return { valid: true };
         }
+        if (this.consumedTokens.has(headerPart)) {
+          return { valid: false, reason: "Token already used" };
+        }
         const expectedSig = await hmacSign3(
           this.secret,
           `${headerPart}.${sessionId ?? ""}`
@@ -281709,6 +282227,26 @@ var init_render_pipeline = __esm({
             };
           }
           console.error(`[tw] server block failed for ${pageFile}: ${err2?.message ?? err2}`);
+          try {
+            const errFile = ctx.error ?? findRootError(tree);
+            if (errFile) {
+              const compiled = this.compileFile(errFile);
+              let eh = String(compiled.html || "");
+              const em = eh.match(/<body[^>]*>([\s\S]*)<\/body>/i);
+              eh = (em ? em[1] : eh).replace(/<\/?html[^>]*>/gi, "").replace(/<\/?body[^>]*>/gi, "");
+              return {
+                html: this.assembleHTML(eh, compiled.css, "", "Error"),
+                css: "",
+                js: "",
+                status: 500,
+                headers: { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "private, no-store" },
+                fromCache: false,
+                durationMs: 0,
+                serverBlocks: true
+              };
+            }
+          } catch {
+          }
           return {
             html: "<!DOCTYPE html><html><head><title>Server Error</title></head><body><h1>Internal Server Error</h1></body></html>",
             css: "",
@@ -281774,7 +282312,7 @@ var init_render_pipeline = __esm({
         }
         const match = matchRoute2(tree, pathname);
         if (!match) {
-          const rootNotFound = findRootNotFound(tree);
+          const rootNotFound = findNearestNotFound(tree, pathname.split("/").filter(Boolean));
           if (rootNotFound) {
             const compiled = this.compileFile(rootNotFound);
             let nf = String(compiled.html || "");
@@ -281840,6 +282378,7 @@ var init_render_pipeline = __esm({
           }
           let bodyHTML = pageCompiled.html;
           let allCSS = pageCompiled.css;
+          const parallelSlots = [];
           try {
             const parentNode = match?.node;
             if (parentNode && Array.isArray(parentNode.children)) {
@@ -281850,9 +282389,7 @@ var init_render_pipeline = __esm({
                 const sbm = slotBody.match(/<body[^>]*>([\s\S]*)<\/body>/i);
                 if (sbm) slotBody = sbm[1];
                 slotBody = slotBody.replace(/<\/?html[^>]*>/gi, "").replace(/<\/?body[^>]*>/gi, "");
-                const comp = slotName.charAt(0).toUpperCase() + slotName.slice(1);
-                const slotRe = new RegExp(`<${comp}(s[^>]*)?>([sS]*?)</${comp}>|<${comp}(s[^>]*)?/>`, "gi");
-                bodyHTML = bodyHTML.replace(slotRe, slotBody);
+                parallelSlots.push({ comp: slotName.charAt(0).toUpperCase() + slotName.slice(1), body: slotBody });
                 if (slotCompiled.css) allCSS = slotCompiled.css + "\n" + allCSS;
               }
             }
@@ -281871,6 +282408,11 @@ var init_render_pipeline = __esm({
             allJS = templateCompiled.js + "\n" + allJS;
             bodyHTML = this.wrapInLayout(templateCompiled.html, bodyHTML);
           }
+          for (const { comp, body } of parallelSlots) {
+            const slotRe = new RegExp(`<${comp}(\\s[^>]*)?>([\\s\\S]*?)<\\/${comp}>|<${comp}(\\s[^>]*)?/>`, "gi");
+            bodyHTML = bodyHTML.replace(slotRe, body);
+            bodyHTML = bodyHTML.replace(new RegExp(`<!--\\s*TW: unknown component '${comp}'[\\s\\S]*?-->`, "gi"), body);
+          }
           let layoutTitle;
           const liftedParts = [];
           {
@@ -282289,8 +282831,6 @@ ${bodyHTML}`;
           };
           let tags = "";
           const description = pick2("description");
-          if (description) tags += `    <meta name="description" content="${esc4(description)}">
-`;
           const keywords = pick2("keywords");
           if (keywords) tags += `    <meta name="keywords" content="${esc4(keywords)}">
 `;
@@ -284472,6 +285012,7 @@ var init_static = __esm({
         if (!existsSync15(filePath)) {
           filePath = join19(this.root, safePath + ".html");
         }
+        let notFoundFallback = false;
         if (!existsSync15(filePath)) {
           filePath = join19(this.root, safePath, this.indexFile);
         }
@@ -284483,6 +285024,7 @@ var init_static = __esm({
             }
           } else {
             filePath = join19(this.root, "404.html");
+            notFoundFallback = true;
             if (!existsSync15(filePath)) {
               return new Response("Not Found", { status: 404, headers: { "Content-Type": "text/plain" } });
             }
@@ -284550,12 +285092,12 @@ var init_static = __esm({
               const gzHeaders = { ...headers, "Content-Encoding": "gzip", "Content-Length": String(gz.length), Vary: "Accept-Encoding" };
               delete gzHeaders["Content-Length"];
               if (this.lastModified) delete gzHeaders["Last-Modified"];
-              return new Response(gz, { headers: gzHeaders });
+              return new Response(gz, { headers: gzHeaders, status: notFoundFallback ? 404 : 200 });
             }
           } catch {
           }
         }
-        return new Response(bytes, { headers });
+        return new Response(bytes, { headers, status: notFoundFallback ? 404 : 200 });
       }
       /**
        * Parse a `Range: bytes=...` header against a known content length.
@@ -285879,17 +286421,17 @@ async function hs256(payload, secret, maxAge) {
   const header = { alg: "HS256", typ: "JWT" };
   const body = { ...payload, iat: now, exp: now + maxAge };
   const data = enc(header) + "." + enc(body);
-  const { createHmac: createHmac2 } = await import("node:crypto");
-  const sig = createHmac2("sha256", secret).update(data).digest("base64url");
+  const { createHmac: createHmac3 } = await import("node:crypto");
+  const sig = createHmac3("sha256", secret).update(data).digest("base64url");
   return data + "." + sig;
 }
 async function verifyHs256(token, secret) {
   const parts = token.split(".");
   if (parts.length !== 3) return null;
-  const { createHmac: createHmac2, timingSafeEqual: timingSafeEqual4 } = await import("node:crypto");
-  const expected = createHmac2("sha256", secret).update(parts[0] + "." + parts[1]).digest("base64url");
+  const { createHmac: createHmac3, timingSafeEqual: timingSafeEqual3 } = await import("node:crypto");
+  const expected = createHmac3("sha256", secret).update(parts[0] + "." + parts[1]).digest("base64url");
   const a = Buffer.from(expected), b = Buffer.from(parts[2]);
-  if (a.length !== b.length || !timingSafeEqual4(a, b)) return null;
+  if (a.length !== b.length || !timingSafeEqual3(a, b)) return null;
   try {
     const body = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
     if (typeof body.exp === "number" && body.exp < Math.floor(Date.now() / 1e3)) return null;
@@ -287194,6 +287736,19 @@ ${err2.stack ?? ""}`);
         const isrLookupPath = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname;
         if (this.staticHandler && !this.isrRoutes.has(isrLookupPath)) {
           let staticResponse = await this.staticHandler.serve(pathname, request);
+          if (staticResponse.status !== 404) {
+            const reqMethod = request.method.toUpperCase();
+            const allow = "GET, HEAD, OPTIONS";
+            if (reqMethod === "TRACE") {
+              return new Response("Method Not Allowed", { status: 405, headers: { Allow: allow } });
+            }
+            if (reqMethod === "OPTIONS") {
+              return new Response(null, { status: 204, headers: { Allow: allow } });
+            }
+            if (reqMethod !== "GET" && reqMethod !== "HEAD") {
+              return new Response("Method Not Allowed", { status: 405, headers: { Allow: allow } });
+            }
+          }
           if (staticResponse && this.cspEnabled() && (staticResponse.headers.get("content-type") || "").includes("text/html")) {
             try {
               let buf = Buffer.from(await staticResponse.arrayBuffer());