tw-framework 2.0.0 → 2.0.1

package/dist/tw.mjs

@@ -6915,20 +6915,39 @@ function sha12(data) {
 async function md52(data) {
   return hashWithWebCrypto("md5", data);
 }
+function webcryptoHashName(algorithm) {
+  const key2 = String(algorithm).toLowerCase().replace(/[-_]/g, "");
+  const map2 = {
+    md5: "MD5",
+    sha1: "SHA-1",
+    sha224: "SHA-224",
+    sha256: "SHA-256",
+    sha384: "SHA-384",
+    sha512: "SHA-512"
+  };
+  return map2[key2] ?? algorithm;
+}
 async function hmac2(data, key2, algorithm = "sha256") {
   const encoder2 = new TextEncoder();
   const keyData = encoder2.encode(key2);
   const messageData = encoder2.encode(data);
-  const cryptoKey = await crypto.subtle.importKey("raw", keyData, { name: "HMAC", hash: algorithm }, false, ["sign"]);
+  const cryptoKey = await crypto.subtle.importKey("raw", keyData, { name: "HMAC", hash: webcryptoHashName(algorithm) }, false, ["sign"]);
   const signature = await crypto.subtle.sign("HMAC", cryptoKey, messageData);
   const hashArray = Array.from(new Uint8Array(signature));
   return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+async function verifyHmac(data, key2, signature, algorithm = "sha256") {
+  const expected = await hmac2(data, key2, algorithm);
+  if (expected.length !== signature.length) return false;
+  let diff2 = 0;
+  for (let i = 0; i < expected.length; i++) diff2 |= expected.charCodeAt(i) ^ signature.charCodeAt(i);
+  return diff2 === 0;
+}
 async function pbkdf2(password, salt, iterations = 1e5, keyLength = 256) {
   const encoder2 = new TextEncoder();
   const keyMaterial = await crypto.subtle.importKey("raw", encoder2.encode(password), "PBKDF2", false, ["deriveBits"]);
   const derivedBits = await crypto.subtle.deriveBits(
-    { name: "PBKDF2", salt: encoder2.encode(salt), iterations, hash: "sha256" },
+    { name: "PBKDF2", salt: encoder2.encode(salt), iterations, hash: "SHA-256" },
     keyMaterial,
     keyLength
   );
@@ -6973,9 +6992,16 @@ async function decryptString(encryptedData, password, salt) {
   const key2 = await deriveKey(password, salt);
   return decryptAES(encrypted, key2, iv);
 }
+async function generateRSASigningKeyPair(bits = 2048) {
+  return crypto.subtle.generateKey(
+    { name: "RSASSA-PKCS1-v1_5", modulusLength: bits, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" },
+    true,
+    ["sign", "verify"]
+  );
+}
 async function generateRSAKeyPair(bits = 2048) {
   return crypto.subtle.generateKey(
-    { name: "RSA-OAEP", modulusLength: bits, publicExponent: new Uint8Array([1, 0, 1]), hash: "sha256" },
+    { name: "RSA-OAEP", modulusLength: bits, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" },
     true,
     ["encrypt", "decrypt"]
   );
@@ -8423,36 +8449,6 @@ var init_etag = __esm({
 });
 
 // ../../packages/shared/tw/hashing/hmac.ts
-function bufferToHex2(buffer) {
-  const bytes = new Uint8Array(buffer);
-  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-function timingSafeEqual2(a, b) {
-  if (a.length !== b.length) return false;
-  let result = 0;
-  for (let i = 0; i < a.length; i++) {
-    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return result === 0;
-}
-async function hmac3(key2, message, algorithm = "SHA-256") {
-  const encoder2 = new TextEncoder();
-  const keyData = encoder2.encode(key2);
-  const messageData = encoder2.encode(message);
-  const cryptoKey = await crypto.subtle.importKey(
-    "raw",
-    keyData,
-    { name: "HMAC", hash: algorithm },
-    false,
-    ["sign"]
-  );
-  const signature = await crypto.subtle.sign("HMAC", cryptoKey, messageData);
-  return bufferToHex2(signature);
-}
-async function verifyHmac(key2, message, signature, algorithm = "SHA-256") {
-  const computed6 = await hmac3(key2, message, algorithm);
-  return timingSafeEqual2(computed6, signature);
-}
 var init_hmac = __esm({
   "../../packages/shared/tw/hashing/hmac.ts"() {
   }
@@ -9117,6 +9113,7 @@ __export(tw_exports, {
   generatePIN: () => generatePIN,
   generateProofOfKnowledge: () => generateProofOfKnowledge,
   generateRSAKeyPair: () => generateRSAKeyPair,
+  generateRSASigningKeyPair: () => generateRSASigningKeyPair,
   generateSecret: () => generateSecret,
   generateTOTP: () => generateTOTP,
   geolocation: () => geolocation,
@@ -9622,6 +9619,7 @@ __export(tw_exports, {
   zip: () => zip,
   zipWith: () => zipWith
 });
+import { createHmac } from "node:crypto";
 function generateETag(data) {
   let hash3 = 0;
   for (let i = 0; i < data.length; i++) {
@@ -9647,19 +9645,14 @@ function merkleRoot(hashes) {
   return level[0];
 }
 function hmacSign(data, key2) {
-  let h1 = 0, h22 = 0;
-  for (let i = 0; i < data.length; i++) {
-    h1 = (h1 << 5) - h1 + data.charCodeAt(i);
-    h1 |= 0;
-  }
-  for (let i = 0; i < key2.length; i++) {
-    h22 = (h22 << 5) - h22 + key2.charCodeAt(i);
-    h22 |= 0;
-  }
-  return (h1 ^ h22).toString(16);
+  return createHmac("sha256", key2).update(data).digest("hex");
 }
 function hmacVerify(data, key2, signature) {
-  return hmacSign(data, key2) === signature;
+  const expected = hmacSign(data, key2);
+  if (expected.length !== signature.length) return false;
+  let diff2 = 0;
+  for (let i = 0; i < expected.length; i++) diff2 |= expected.charCodeAt(i) ^ signature.charCodeAt(i);
+  return diff2 === 0;
 }
 var HTML_TAGS;
 var init_tw = __esm({
@@ -227257,6 +227250,10 @@ function parseTWSelector(cursor, errors, state, parseBody) {
         while (!cursor.done) {
           const ct = cursor.peek();
           if (!ct) break;
+          if (ct.type === "IDENT" && ct.value === "on") {
+            const after2 = cursor.peek(1);
+            if (after2 && after2.type === "COLON") break;
+          }
           if (ct.type === "IDENT" && !nextPrevMinus && nextClass.length > 0 && (CLASS_BOUNDARY_BOOLEAN_ATTRS.has(ct.value) || inlineAttrStartsAt(cursor))) {
             break;
           }
@@ -227547,7 +227544,9 @@ function parseTWSelector(cursor, errors, state, parseBody) {
       const first = cursor.peek();
       const second = cursor.peek(1);
       const CONTROL_FLOW = /* @__PURE__ */ new Set(["for", "if", "while", "switch", "else", "try", "catch"]);
-      const isAttrBlock = first && (first.type === "IDENT" || first.type === "KEYWORD") && !CONTROL_FLOW.has(first.value) && HTML_ATTRS_ONLY.has(first.value) && second && (second.type === "STRING" || second.type === "NUMBER" || second.type === "IDENT" || second.type === "KEYWORD");
+      const third = cursor.peek(2);
+      const isPropBlock = second && second.type === "ASSIGN" && third && third.type === "LBRACE";
+      const isAttrBlock = first && (first.type === "IDENT" || first.type === "KEYWORD") && !CONTROL_FLOW.has(first.value) && (HTML_ATTRS_ONLY.has(first.value) || isPropBlock) && second && (second.type === "STRING" || second.type === "NUMBER" || second.type === "IDENT" || second.type === "KEYWORD" || second.type === "ASSIGN");
       if (isAttrBlock) {
         while (!cursor.done) {
           const t3 = cursor.peek();
@@ -227555,6 +227554,34 @@ function parseTWSelector(cursor, errors, state, parseBody) {
           if (t3.type === "IDENT" || t3.type === "KEYWORD") {
             const attrName = t3.value;
             cursor.advance();
+            if (cursor.peek() && (cursor.peek().type === "ASSIGN" || cursor.peek().type === "EQUALS")) {
+              cursor.advance();
+              cursor.skipWhitespace();
+              if (cursor.peek() && cursor.peek().type === "LBRACE") {
+                cursor.advance();
+                let expr = "";
+                let depth = 1;
+                let prevWS = false;
+                while (!cursor.done) {
+                  const tk = cursor.peek();
+                  if (!tk || tk.type === "EOF") break;
+                  if (tk.type === "LBRACE") depth++;
+                  else if (tk.type === "RBRACE") {
+                    depth--;
+                    if (depth === 0) {
+                      cursor.advance();
+                      break;
+                    }
+                  }
+                  if (expr && prevWS) expr += " ";
+                  expr += tk.raw ?? tk.value;
+                  prevWS = !!tk.followedByWhitespace;
+                  cursor.advance();
+                }
+                el.attrs.push(createAttribute(attrName, expr.trim(), t3.pos.line, t3.pos.col, true));
+                continue;
+              }
+            }
             const vToken = cursor.peek();
             if (vToken && (vToken.type === "STRING" || vToken.type === "NUMBER")) {
               cursor.advance();
@@ -236300,7 +236327,7 @@ var init_types4 = __esm({
 var TW_VERSION, TW_GENERATOR_META;
 var init_version = __esm({
   "../../packages/compiler/tw/codegen/version.ts"() {
-    TW_VERSION = "2.0.0";
+    TW_VERSION = "2.0.1";
     TW_GENERATOR_META = `<meta name="generator" content="TW Framework ${TW_VERSION}">`;
   }
 });
@@ -236324,6 +236351,9 @@ function optimizedImageUrl(src, opts = {}) {
   if (opts.quality) p.set("q", String(opts.quality));
   p.set("f", opts.format ?? "auto");
   const qs = p.toString();
+  if (/^https?:\/\//i.test(src)) {
+    return `/_tw/img/_remote?src=${encodeURIComponent(src)}&${qs}`;
+  }
   return `/_tw/img${src.startsWith("/") ? src : "/" + src}?${qs}`;
 }
 function imageAttributesFor(opts, config = DEFAULT_IMAGE_CONFIG) {
@@ -236331,7 +236361,7 @@ function imageAttributesFor(opts, config = DEFAULT_IMAGE_CONFIG) {
   const quality = opts.quality ?? config.quality;
   const format = config.formats[0] ?? "webp";
   const isRemote = /^https?:\/\//i.test(opts.src);
-  const src = isRemote ? `/_tw/img/_remote?src=${encodeURIComponent(opts.src)}&w=${opts.width ?? ""}&h=${opts.height ?? ""}&q=${quality}&f=auto` : optimizedImageUrl(opts.src, { width: opts.width, height: opts.height, quality });
+  const src = isRemote ? `/_tw/img/_remote?src=${encodeURIComponent(opts.src)}${opts.width ? `&w=${opts.width}` : ""}${opts.height ? `&h=${opts.height}` : ""}&q=${quality}&f=auto` : optimizedImageUrl(opts.src, { width: opts.width, height: opts.height, quality });
   const widths = config.breakpoints.filter((bp) => width === 0 || bp <= width * 2);
   const srcset = widths.map(
     (bp) => isRemote ? `/_tw/img/_remote?src=${encodeURIComponent(opts.src)}&w=${bp}&q=${quality}&f=auto ${bp}w` : `${optimizedImageUrl(opts.src, { width: bp, quality })} ${bp}w`
@@ -236511,7 +236541,7 @@ function createImageHandler(options) {
     }
     if (!warnedNoSharp) {
       warnedNoSharp = true;
-      console.warn("  [tw/image] sharp not installed \u2014 serving original images (bun add sharp to enable resizing/WebP/AVIF)");
+      console.warn("  [tw/image] sharp not installed \u2014 using the built-in converter (WebP/AVIF); install sharp for faster resizing");
     }
     return { data, contentType: "", viaSharp: false };
   }
@@ -236626,7 +236656,11 @@ var init_tw2 = __esm({
 });
 
 // ../../packages/link/tw/index.ts
+function isDangerousHref(href) {
+  return DANGEROUS_SCHEME.test(href.replace(/[\u0000-\u0020]/g, ""));
+}
 function isExternalHref(href) {
+  if (isDangerousHref(href)) return false;
   return /^[a-z][a-z0-9+.-]*:/i.test(href) || // any scheme: http(s), mailto, tel, ...
   href.startsWith("//");
 }
@@ -236635,7 +236669,8 @@ function isWebExternal(href) {
   return true;
 }
 function linkAttributesFor(opts) {
-  const href = (opts.href ?? "").trim();
+  const rawHref = (opts.href ?? "").trim();
+  const href = isDangerousHref(rawHref) ? "#" : rawHref;
   const external = opts.external === true || isExternalHref(href);
   const attrs = {};
   if (external) {
@@ -236664,8 +236699,10 @@ function linkAttributesFor(opts) {
   if (opts.id) attrs["id"] = opts.id;
   return { href, external, attrs };
 }
+var DANGEROUS_SCHEME;
 var init_tw3 = __esm({
   "../../packages/link/tw/index.ts"() {
+    DANGEROUS_SCHEME = /^(javascript|data|vbscript):/i;
   }
 });
 
@@ -237178,12 +237215,31 @@ var init_interpolate = __esm({
 });
 
 // ../../packages/compiler/tw/eval/evaluate.ts
+function setEvalBindings(bindings) {
+  extraBindings = bindings ?? {};
+}
 function evaluate(expr, vars, sandbox) {
   if (!expr) return "";
   const sb = sandbox ?? defaultSandbox;
   if (vars[expr] !== void 0) {
     return vars[expr];
   }
+  if (expr.startsWith("(") && expr.endsWith(")")) {
+    let d = 0;
+    let wraps = true;
+    for (let i = 0; i < expr.length; i++) {
+      const ch = expr[i];
+      if (ch === "(") d++;
+      else if (ch === ")") {
+        d--;
+        if (d === 0 && i < expr.length - 1) {
+          wraps = false;
+          break;
+        }
+      }
+    }
+    if (wraps && d === 0) return evaluate(expr.slice(1, -1).trim(), vars, sb);
+  }
   if (/^-?\d+(\.\d+)?$/.test(expr)) return expr;
   if (expr.startsWith('"') && expr.endsWith('"') || expr.startsWith("'") && expr.endsWith("'")) {
     return expr.slice(1, -1);
@@ -237191,11 +237247,54 @@ function evaluate(expr, vars, sandbox) {
   if (expr === "true") return "true";
   if (expr === "false") return "false";
   if (expr === "null" || expr === "undefined") return "";
-  const ternMatch = expr.match(/^(.+?)\s*\?\s*(.+?)\s*:\s*(.+)$/);
-  if (ternMatch) {
-    const cond = isTruthy(resolve3(ternMatch[1].trim(), vars, sb));
-    return cond ? resolve3(ternMatch[2].trim(), vars, sb) : resolve3(ternMatch[3].trim(), vars, sb);
+  {
+    let depth = 0;
+    let pending2 = 0;
+    let q = -1;
+    let quote = "";
+    for (let i = 0; i < expr.length; i++) {
+      const ch = expr[i];
+      if (quote) {
+        if (ch === "\\") {
+          i++;
+          continue;
+        }
+        if (ch === quote) quote = "";
+        continue;
+      }
+      if (ch === "'" || ch === '"' || ch === "`") {
+        quote = ch;
+        continue;
+      }
+      if (ch === "(" || ch === "[" || ch === "{") {
+        depth++;
+        continue;
+      }
+      if (ch === ")" || ch === "]" || ch === "}") {
+        depth--;
+        continue;
+      }
+      if (depth !== 0) continue;
+      if (ch === "?") {
+        if (pending2 === 0) q = i;
+        pending2++;
+        continue;
+      }
+      if (ch === ":" && pending2 > 0) {
+        pending2--;
+        if (pending2 > 0) continue;
+        const cond = expr.slice(0, q).trim();
+        const cons = expr.slice(q + 1, i).trim();
+        const alt = expr.slice(i + 1).trim();
+        if (cond && cons && alt) {
+          return isTruthy(resolve3(cond, vars, sb)) ? resolve3(cons, vars, sb) : resolve3(alt, vars, sb);
+        }
+        break;
+      }
+    }
   }
+  const dyn = evalWithVars(expr, vars);
+  if (dyn !== null) return dyn;
   const orParts = splitLogical(expr, "||");
   if (orParts.length > 1) {
     for (const part of orParts) {
@@ -237272,7 +237371,7 @@ function evaluate(expr, vars, sandbox) {
     return current2 !== void 0 && current2 !== null ? String(current2) : "";
   }
   const fnMatch = expr.match(/^(\w+)\((.*)\)$/);
-  if (fnMatch) {
+  if (fnMatch && isBuiltinName(fnMatch[1])) {
     const fn = fnMatch[1];
     const arg = resolve3(fnMatch[2].trim(), vars, sb);
     return callBuiltin(fn, arg, sb);
@@ -237291,6 +237390,38 @@ function evaluate(expr, vars, sandbox) {
   }
   return expr;
 }
+function evalWithVars(expr, vars) {
+  if (!expr || /[`\\]/.test(expr)) return null;
+  if (!/^[\w\s.$[\]{}()'"`,+\-*/%?:<>=!&|]*$/.test(expr)) return null;
+  for (const m of expr.matchAll(/\.([A-Za-z_$][\w$]*)\s*\(/g)) {
+    if (!SAFE_MEMBERS.has(m[1])) return null;
+  }
+  const names = [];
+  const vals = [];
+  for (const k of Object.keys(vars)) {
+    if (!/^[A-Za-z_$][\w$]*$/.test(k)) continue;
+    if (k in extraBindings) continue;
+    names.push(k);
+    try {
+      vals.push(JSON.parse(vars[k]));
+    } catch {
+      vals.push(vars[k]);
+    }
+  }
+  for (const k of Object.keys(extraBindings)) {
+    if (!/^[A-Za-z_$][\w$]*$/.test(k)) continue;
+    names.push(k);
+    vals.push(extraBindings[k]);
+  }
+  try {
+    const fn = new Function(...names, `"use strict"; return (${expr});`);
+    const out = fn(...vals);
+    if (out === void 0 || out === null) return null;
+    return typeof out === "object" ? JSON.stringify(out) : String(out);
+  } catch {
+    return null;
+  }
+}
 function resolve3(token, vars, sandbox) {
   const trimmed = token.trim();
   if (!trimmed) return "";
@@ -237459,7 +237590,7 @@ function coerce(value, targetType) {
       return value;
   }
 }
-var defaultSandbox;
+var defaultSandbox, extraBindings, SAFE_MEMBERS;
 var init_evaluate = __esm({
   "../../packages/compiler/tw/eval/evaluate.ts"() {
     init_sandbox();
@@ -237467,6 +237598,64 @@ var init_evaluate = __esm({
     init_builtins();
     init_interpolate();
     defaultSandbox = new Sandbox();
+    extraBindings = {};
+    SAFE_MEMBERS = /* @__PURE__ */ new Set([
+      "length",
+      "toUpperCase",
+      "toLowerCase",
+      "trim",
+      "trimStart",
+      "trimEnd",
+      "slice",
+      "substring",
+      "substr",
+      "charAt",
+      "at",
+      "includes",
+      "indexOf",
+      "lastIndexOf",
+      "startsWith",
+      "endsWith",
+      "replace",
+      "replaceAll",
+      "split",
+      "join",
+      "concat",
+      "repeat",
+      "padStart",
+      "padEnd",
+      "toString",
+      "toFixed",
+      "map",
+      "filter",
+      "find",
+      "some",
+      "every",
+      "reduce",
+      "sort",
+      "reverse",
+      // Static helpers on the built-ins (JSON.stringify, Object.keys, Math.round).
+      "stringify",
+      "parse",
+      "keys",
+      "values",
+      "entries",
+      "from",
+      "isArray",
+      "isInteger",
+      "isFinite",
+      "abs",
+      "ceil",
+      "floor",
+      "round",
+      "max",
+      "min",
+      "pow",
+      "sqrt",
+      "random",
+      "now",
+      "toISOString"
+    ]);
   }
 });
 
@@ -237621,9 +237810,78 @@ function callBuiltin(fn, arg, sandbox) {
 function applyFilter(value, filter, args, vars, sandbox) {
   return callBuiltin(filter, value, sandbox);
 }
+function isBuiltinName(fn) {
+  return BUILTIN_NAMES.has(fn);
+}
+var BUILTIN_NAMES;
 var init_builtins = __esm({
   "../../packages/compiler/tw/eval/builtins.ts"() {
     init_evaluate();
+    BUILTIN_NAMES = /* @__PURE__ */ new Set([
+      "Boolean",
+      "Number",
+      "String",
+      "abs",
+      "base64decode",
+      "base64encode",
+      "bool",
+      "camelCase",
+      "capitalize",
+      "ceil",
+      "cos",
+      "date",
+      "decodeURI",
+      "encodeURI",
+      "endsWith",
+      "exp",
+      "first",
+      "float",
+      "floor",
+      "includes",
+      "indexOf",
+      "int",
+      "join",
+      "json",
+      "kebabCase",
+      "last",
+      "len",
+      "length",
+      "log",
+      "lower",
+      "lowercase",
+      "match",
+      "max",
+      "min",
+      "now",
+      "num",
+      "padEnd",
+      "padStart",
+      "parseFloat",
+      "parseInt",
+      "parseJSON",
+      "pow",
+      "random",
+      "repeat",
+      "replace",
+      "reverse",
+      "round",
+      "sin",
+      "size",
+      "slice",
+      "snakeCase",
+      "split",
+      "sqrt",
+      "startsWith",
+      "str",
+      "stringify",
+      "tan",
+      "test",
+      "time",
+      "title",
+      "trim",
+      "upper",
+      "uppercase"
+    ]);
   }
 });
 
@@ -238672,16 +238930,61 @@ function addScope(css, scopeId) {
   out += prelude;
   return out;
 }
-function interpolate2(expr, vars) {
-  const masked = expr.replace(/\\\{/g, "
O").replace(/\\\}/g, "
C");
-  const out = masked.replace(/\{([^}]+)\}/g, (_, name) => {
-    const key2 = name.trim();
+function interpolateBraces(input, vars) {
+  let out = "";
+  let i = 0;
+  while (i < input.length) {
+    const ch = input[i];
+    if (ch !== "{") {
+      out += ch;
+      i++;
+      continue;
+    }
+    let depth = 1;
+    let j = i + 1;
+    let quote = "";
+    while (j < input.length && depth > 0) {
+      const c = input[j];
+      if (quote) {
+        if (c === "\\") {
+          j += 2;
+          continue;
+        }
+        if (c === quote) quote = "";
+        j++;
+        continue;
+      }
+      if (c === "'" || c === '"' || c === "`") {
+        quote = c;
+        j++;
+        continue;
+      }
+      if (c === "{") depth++;
+      else if (c === "}") {
+        depth--;
+        if (depth === 0) break;
+      }
+      j++;
+    }
+    if (depth !== 0) {
+      out += ch;
+      i++;
+      continue;
+    }
+    const key2 = input.slice(i + 1, j).trim();
     if (/^[a-zA-Z_$][\w$]*$/.test(key2)) {
-      return vars[key2] ?? "";
+      out += vars[key2] ?? "";
+    } else {
+      const val = evaluate(key2, vars);
+      out += val === null ? "" : val;
     }
-    const val = evaluate(key2, vars);
-    return val === null ? "" : val;
-  });
+    i = j + 1;
+  }
+  return out;
+}
+function interpolate2(expr, vars) {
+  const masked = expr.replace(/\\\{/g, "
O").replace(/\\\}/g, "
C");
+  const out = interpolateBraces(masked, vars);
   return out.replace(/\u0001O/g, "{").replace(/\u0001C/g, "}");
 }
 function isTruthy2(val) {
@@ -239160,7 +239463,21 @@ function renderBindings(bindings, ctx) {
   if (bindings.length === 0) return "";
   const parts = [];
   for (const binding of bindings) {
-    parts.push(`data-tw-bind-${binding.property}="${escapeAttr3(String(binding.expression ?? ""))}"`);
+    const expr = String(binding.expression ?? "");
+    let initial = "";
+    try {
+      if (/^[A-Za-z_$][\w$]*$/.test(expr)) {
+        const v = ctx.stateVars[expr];
+        if (v !== void 0 && v !== null) initial = String(v);
+      } else if (expr) {
+        initial = interpolate2("{" + expr + "}", ctx.stateVars);
+      }
+    } catch {
+    }
+    if (initial && !/[{}]/.test(initial)) {
+      parts.push(`${binding.property}="${escapeAttr3(initial)}"`);
+    }
+    parts.push(`data-tw-bind-${binding.property}="${escapeAttr3(expr)}"`);
   }
   return parts.join(" ");
 }
@@ -239275,8 +239592,13 @@ function generateComponent(comp, ctx) {
   const savedStateVars = { ...ctx.stateVars };
   for (const prop of comp.props) {
     if (typeof prop.value === "string") {
-      const resolved = interpolate2(prop.value, ctx.stateVars);
-      ctx.stateVars[prop.name] = resolved;
+      const raw = String(prop.value);
+      const head = raw.split(/[.[]/)[0];
+      if (!/[{}]/.test(raw) && Object.prototype.hasOwnProperty.call(ctx.stateVars, head)) {
+        ctx.stateVars[prop.name] = interpolate2("{" + raw + "}", ctx.stateVars);
+      } else {
+        ctx.stateVars[prop.name] = interpolate2(raw, ctx.stateVars);
+      }
     }
   }
   const componentProgram = componentRegistry.get(comp.name);
@@ -239370,6 +239692,14 @@ function generateFor(node, ctx) {
       }
     }
   }
+  if (items.length === 0 && !/^\s*\[/.test(iterableStr)) {
+    try {
+      const evaluated = evaluate(String(node.iterable ?? "").replace(/^\{/, "").replace(/\}$/, "").trim(), ctx.stateVars);
+      const parsed = JSON.parse(evaluated);
+      if (Array.isArray(parsed)) items = parsed;
+    } catch {
+    }
+  }
   for (let i = 0; i < items.length; i++) {
     const childCtx = { ...ctx };
     childCtx.stateVars = { ...ctx.stateVars };
@@ -243176,16 +243506,22 @@ function generateWithLayoutChain(layoutPrograms, pageProgram, stateVars) {
     }
   };
   let pageTitle = "TW Page";
+  let pageDescription = "";
   for (const dir of pageProgram.directives || []) {
-    if (dir.type === "PageDirective" && dir.key === "title") {
-      const t3 = dir.value;
-      if (t3 != null && String(t3) !== "") pageTitle = String(t3);
+    if (dir.type === "PageDirective") {
+      if (dir.key === "title") {
+        const t3 = dir.value;
+        if (t3 != null && String(t3) !== "") pageTitle = String(t3);
+      } else if (dir.key === "description") {
+        const d = dir.value;
+        if (d != null) pageDescription = String(d);
+      }
     }
   }
   const pageCtx = createContext("ssr");
   seedCtx(pageCtx);
   try {
-    pageCtx.stateVars["page"] = JSON.stringify({ title: pageTitle });
+    pageCtx.stateVars["page"] = JSON.stringify({ title: pageTitle, description: pageDescription });
   } catch {
   }
   {
@@ -243341,6 +243677,10 @@ function generate(program, stateVars, genOpts2) {
   const startTime = performance.now();
   const ctx = createContext("ssr");
   if (stateVars) ctx.stateVars = stateVars;
+  if (genOpts2?.imports) {
+    ctx.imports = genOpts2.imports;
+    setEvalBindings(genOpts2.imports);
+  } else setEvalBindings({});
   if (genOpts2 && genOpts2.scopedStyles === false) ctx.scopedStyles = false;
   if (genOpts2?.scopeId) ctx.scopeId = genOpts2.scopeId;
   if (genOpts2?.cssPrefix) ctx.cssPrefix = genOpts2.cssPrefix;
@@ -243425,6 +243765,7 @@ var init_vdom = __esm({
     init_types4();
     init_html2();
     init_builtin_components();
+    init_evaluate();
   }
 });
 
@@ -243765,6 +244106,7 @@ var init_codes = __esm({
       TW095: { message: "Invalid for-loop iterable -- use {varName} or a valid comma-separated literal", severity: "error", category: "syntax" },
       TW096: { message: "Unknown state variable in interpolation (renders empty)", severity: "warning", category: "semantic" },
       TW097: { message: "while with a comparison renders its body ONCE at build time (state cannot mutate during SSR) -- use for loops for repetition", severity: "warning", category: "semantic" },
+      TW098: { message: "Interpolation cannot be evaluated at build time -- it renders as its source text", severity: "warning", category: "semantic" },
       // Server blocks (TW099-TW101)
       TW099: { message: "Unknown server modifier (only ':defer' is supported)", severity: "error", category: "syntax" },
       TW100: { message: "Expected '{' after 'server'", severity: "error", category: "syntax" },
@@ -243852,6 +244194,7 @@ function checkUnknownTags(program, filePath, diags) {
   forEachNode(program, (node, ctx) => {
     if (!isElement(node)) return;
     if (node.tag[0] === node.tag[0]?.toUpperCase()) return;
+    if (BUILTIN_COMPONENT_TAGS.has(node.tag)) return;
     const parent = ctx?.parent;
     if (parent && (parent.type === "Element" && typeof parent.tag === "string" && parent.tag[0] === parent.tag[0]?.toUpperCase() || parent.type === "Component")) return;
     if (HTML_ELEMENTS2.has(node.tag.toLowerCase())) return;
@@ -244206,6 +244549,59 @@ function checkUnknownStateVars(program, filePath, diags) {
     "null",
     "undefined"
   ]);
+  const EVALUABLE_METHODS = /* @__PURE__ */ new Set([
+    "length",
+    "toUpperCase",
+    "toLowerCase",
+    "trim",
+    "trimStart",
+    "trimEnd",
+    "slice",
+    "substring",
+    "substr",
+    "charAt",
+    "at",
+    "includes",
+    "indexOf",
+    "lastIndexOf",
+    "startsWith",
+    "endsWith",
+    "replace",
+    "replaceAll",
+    "split",
+    "join",
+    "concat",
+    "repeat",
+    "padStart",
+    "padEnd",
+    "toString",
+    "toFixed",
+    "map",
+    "filter",
+    "find",
+    "some",
+    "every",
+    "reduce",
+    "sort",
+    "reverse",
+    "stringify",
+    "parse",
+    "keys",
+    "values",
+    "entries",
+    "from",
+    "isArray",
+    "round",
+    "floor",
+    "ceil",
+    "abs",
+    "max",
+    "min",
+    "pow",
+    "sqrt",
+    "random",
+    "now"
+  ]);
   for (const node of texts) {
     const text = String(node.value ?? "");
     if (!text.includes("{")) continue;
@@ -244221,6 +244617,22 @@ function checkUnknownStateVars(program, filePath, diags) {
         [`Declare it in the state block, or check the spelling`]
       ));
     }
+    for (const m of text.matchAll(/\{([^{}]+)\}/g)) {
+      const expr = m[1].trim();
+      if (/^[A-Za-z_$][\w$]*$/.test(expr)) continue;
+      for (const c of expr.matchAll(/([A-Za-z_$][\w$]*)\s*\(/g)) {
+        const fn = c[1];
+        if (known.has(fn) || BUILTINS2.has(fn) || EVALUABLE_METHODS.has(fn)) continue;
+        diags.push(createDiagnostic(
+          "TW098",
+          node.line,
+          node.col,
+          filePath,
+          `{${expr}}`,
+          [`Cannot evaluate this at build time -- it renders as its source. Check the name, or simplify the expression`]
+        ));
+      }
+    }
   }
 }
 function checkWhileComparisons(program, filePath, diags) {
@@ -244253,7 +244665,7 @@ function checkDeprecatedImports(program, filePath, diags) {
     }
   }
 }
-var HTML_ELEMENTS2, HTML_ATTRIBUTES2, GLOBAL_ATTRIBUTES2, CSS_PROPERTIES2, CSS_ALIASES2, EVENT_TYPES2, ARIA_ROLES2, ARIA_ATTRIBUTES2, DEPRECATED_IMPORTS;
+var HTML_ELEMENTS2, HTML_ATTRIBUTES2, GLOBAL_ATTRIBUTES2, CSS_PROPERTIES2, CSS_ALIASES2, EVENT_TYPES2, ARIA_ROLES2, ARIA_ATTRIBUTES2, BUILTIN_COMPONENT_TAGS, DEPRECATED_IMPORTS;
 var init_rules = __esm({
   "../../packages/compiler/tw/diagnostics/rules.ts"() {
     init_visitors();
@@ -245117,6 +245529,7 @@ var init_rules = __esm({
       "aria-valuenow",
       "aria-valuetext"
     ]);
+    BUILTIN_COMPONENT_TAGS = /* @__PURE__ */ new Set(["optImage", "twImage", "twLink", "twImg"]);
     DEPRECATED_IMPORTS = [
       { source: "utils/string/transform", name: "toHex", replacement: "stringToHex", removal: "2.1.0" },
       { source: "utils/string/transform", name: "fromHex", replacement: "hexToString", removal: "2.1.0" },
@@ -255429,7 +255842,8 @@ function genOpts(opts, scopeId) {
     scopedStyles: opts?.compiler?.scopedStyles,
     scopeId,
     cssPrefix: opts?.cssPrefix,
-    cssImportPaths: opts?.cssImportPaths
+    cssImportPaths: opts?.cssImportPaths,
+    imports: opts?.imports
   };
 }
 function scopeIdFor(filePath) {
@@ -256881,7 +257295,8 @@ var init_tw8 = __esm({
       }
       async runHook(name, ctx, ...args) {
         const results = await this.runHooks(name, ctx, ...args);
-        return results[results.length - 1];
+        for (const r of results) if (r !== void 0) return r;
+        return void 0;
       }
       // Value-chaining hook: each plugin receives the previous plugin's return
       // value and may return a new one. The transform:* and optimize:asset hooks
@@ -257739,7 +258154,7 @@ __export(twm_rules_exports, {
   isRuleDsl: () => isRuleDsl,
   parseRules: () => parseRules
 });
-import { createHmac, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 function isRuleDsl(source) {
   const stripped = source.split("\n").map((l) => l.replace(/\/\/.*$/, "").trim()).filter((l) => l.length > 0).join("\n");
   return stripped.startsWith('rule "') || stripped.startsWith("rule '");
@@ -257837,14 +258252,14 @@ function verifyJwt_hs256(token, secret) {
     return false;
   }
   if (header?.alg !== "HS256") return false;
-  const expected = createHmac("sha256", secret).update(`${h3}.${p}`).digest();
+  const expected = createHmac2("sha256", secret).update(`${h3}.${p}`).digest();
   let got;
   try {
     got = b64urlDecode(sig);
   } catch {
     return false;
   }
-  if (expected.length !== got.length || !timingSafeEqual3(expected, got)) return false;
+  if (expected.length !== got.length || !timingSafeEqual2(expected, got)) return false;
   if (typeof payload?.exp === "number" && payload.exp * 1e3 < Date.now()) return false;
   return true;
 }
@@ -258529,6 +258944,18 @@ function findGlobalError(rootNode2) {
 function findRootError(rootNode2) {
   return (rootNode2.files || []).find((f) => f.type === "error");
 }
+function findNearestNotFound(rootNode2, pathParts) {
+  let found = (rootNode2.files || []).find((f) => f.type === "not-found");
+  let node = rootNode2;
+  for (const part of pathParts) {
+    const child = (node.children || []).find((c) => c.segment === part);
+    if (!child) break;
+    const f = (child.files || []).find((x) => x.type === "not-found");
+    if (f) found = f;
+    node = child;
+  }
+  return found;
+}
 function findRootNotFound(rootNode2) {
   return rootNode2.files.find((f) => f.type === "not-found");
 }
@@ -259330,6 +259757,26 @@ var init_render_pipeline = __esm({
             };
           }
           console.error(`[tw] server block failed for ${pageFile}: ${err2?.message ?? err2}`);
+          try {
+            const errFile = ctx.error ?? findRootError(tree);
+            if (errFile) {
+              const compiled = this.compileFile(errFile);
+              let eh = String(compiled.html || "");
+              const em = eh.match(/<body[^>]*>([\s\S]*)<\/body>/i);
+              eh = (em ? em[1] : eh).replace(/<\/?html[^>]*>/gi, "").replace(/<\/?body[^>]*>/gi, "");
+              return {
+                html: this.assembleHTML(eh, compiled.css, "", "Error"),
+                css: "",
+                js: "",
+                status: 500,
+                headers: { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "private, no-store" },
+                fromCache: false,
+                durationMs: 0,
+                serverBlocks: true
+              };
+            }
+          } catch {
+          }
           return {
             html: "<!DOCTYPE html><html><head><title>Server Error</title></head><body><h1>Internal Server Error</h1></body></html>",
             css: "",
@@ -259395,7 +259842,7 @@ var init_render_pipeline = __esm({
         }
         const match = matchRoute(tree, pathname);
         if (!match) {
-          const rootNotFound = findRootNotFound(tree);
+          const rootNotFound = findNearestNotFound(tree, pathname.split("/").filter(Boolean));
           if (rootNotFound) {
             const compiled = this.compileFile(rootNotFound);
             let nf = String(compiled.html || "");
@@ -259461,6 +259908,7 @@ var init_render_pipeline = __esm({
           }
           let bodyHTML = pageCompiled.html;
           let allCSS = pageCompiled.css;
+          const parallelSlots = [];
           try {
             const parentNode = match?.node;
             if (parentNode && Array.isArray(parentNode.children)) {
@@ -259471,9 +259919,7 @@ var init_render_pipeline = __esm({
                 const sbm = slotBody.match(/<body[^>]*>([\s\S]*)<\/body>/i);
                 if (sbm) slotBody = sbm[1];
                 slotBody = slotBody.replace(/<\/?html[^>]*>/gi, "").replace(/<\/?body[^>]*>/gi, "");
-                const comp = slotName.charAt(0).toUpperCase() + slotName.slice(1);
-                const slotRe = new RegExp(`<${comp}(s[^>]*)?>([sS]*?)</${comp}>|<${comp}(s[^>]*)?/>`, "gi");
-                bodyHTML = bodyHTML.replace(slotRe, slotBody);
+                parallelSlots.push({ comp: slotName.charAt(0).toUpperCase() + slotName.slice(1), body: slotBody });
                 if (slotCompiled.css) allCSS = slotCompiled.css + "\n" + allCSS;
               }
             }
@@ -259492,6 +259938,11 @@ var init_render_pipeline = __esm({
             allJS = templateCompiled.js + "\n" + allJS;
             bodyHTML = this.wrapInLayout(templateCompiled.html, bodyHTML);
           }
+          for (const { comp, body } of parallelSlots) {
+            const slotRe = new RegExp(`<${comp}(\\s[^>]*)?>([\\s\\S]*?)<\\/${comp}>|<${comp}(\\s[^>]*)?/>`, "gi");
+            bodyHTML = bodyHTML.replace(slotRe, body);
+            bodyHTML = bodyHTML.replace(new RegExp(`<!--\\s*TW: unknown component '${comp}'[\\s\\S]*?-->`, "gi"), body);
+          }
           let layoutTitle;
           const liftedParts = [];
           {
@@ -259910,8 +260361,6 @@ ${bodyHTML}`;
           };
           let tags = "";
           const description = pick2("description");
-          if (description) tags += `    <meta name="description" content="${esc5(description)}">
-`;
           const keywords = pick2("keywords");
           if (keywords) tags += `    <meta name="keywords" content="${esc5(keywords)}">
 `;
@@ -262093,6 +262542,7 @@ var init_static = __esm({
         if (!existsSync21(filePath)) {
           filePath = join26(this.root, safePath + ".html");
         }
+        let notFoundFallback = false;
         if (!existsSync21(filePath)) {
           filePath = join26(this.root, safePath, this.indexFile);
         }
@@ -262104,6 +262554,7 @@ var init_static = __esm({
             }
           } else {
             filePath = join26(this.root, "404.html");
+            notFoundFallback = true;
             if (!existsSync21(filePath)) {
               return new Response("Not Found", { status: 404, headers: { "Content-Type": "text/plain" } });
             }
@@ -262171,12 +262622,12 @@ var init_static = __esm({
               const gzHeaders = { ...headers, "Content-Encoding": "gzip", "Content-Length": String(gz.length), Vary: "Accept-Encoding" };
               delete gzHeaders["Content-Length"];
               if (this.lastModified) delete gzHeaders["Last-Modified"];
-              return new Response(gz, { headers: gzHeaders });
+              return new Response(gz, { headers: gzHeaders, status: notFoundFallback ? 404 : 200 });
             }
           } catch {
           }
         }
-        return new Response(bytes, { headers });
+        return new Response(bytes, { headers, status: notFoundFallback ? 404 : 200 });
       }
       /**
        * Parse a `Range: bytes=...` header against a known content length.
@@ -262826,6 +263277,12 @@ var init_xss_detector = __esm({
           { name: "SQL comment", regex: /--\s/g, severity: "medium", recommendation: "Check for SQL comment injection" },
           { name: "Stacked queries", regex: /;\s*(SELECT|INSERT|UPDATE|DELETE|DROP|UNION)/gi, severity: "high", recommendation: "Prevent stacked queries" },
           { name: "UNION injection", regex: /UNION\s+SELECT/gi, severity: "critical", recommendation: "Filter UNION SELECT from user input" },
+          // Comment-only injections (`admin'--`, `admin'#`, `admin'/*`): a quote
+          // followed by a comment truncates the query and bypasses the login
+          // check, with no OR/UNION for the other patterns to catch.
+          { name: "Comment-terminated injection", regex: /['"`]\s*(--|#|\/\*)/g, severity: "high", recommendation: "A quote followed by a comment truncates the query -- use parameterized queries" },
+          // Parenthesised boolean injection: `') OR ('1'='1`.
+          { name: "Parenthesised boolean injection", regex: /['"`]?\s*\)\s*(OR|AND)\s*\(?\s*['"`]?\s*\d/i, severity: "high", recommendation: "Use parameterized queries instead of building boolean expressions" },
           { name: "Boolean-based injection", regex: /OR\s+1\s*=\s*1/gi, severity: "high", recommendation: "Use parameterized queries to prevent boolean injection" },
           { name: "Time-based injection", regex: /WAITFOR\s+DELAY/gi, severity: "high", recommendation: "Filter WAITFOR DELAY from user input" },
           { name: "DROP statement", regex: /DROP\s+(TABLE|DATABASE)/gi, severity: "critical", recommendation: "Prevent DROP statements in queries" },
@@ -263356,6 +263813,7 @@ var init_logger3 = __esm({
       }
       /** Records an audit event. */
       log(event) {
+        event = { type: "system", actor: "unknown", resource: "unknown", ...event };
         const fullEvent = {
           ...event,
           id: crypto.randomUUID(),
@@ -264372,6 +264830,13 @@ var FILE_SIGNATURES, DANGEROUS_EXTENSIONS, DANGEROUS_MIME_TYPES, ContentSecurity
 var init_protector = __esm({
   "../../packages/security/tw/content-security/protector.ts"() {
     FILE_SIGNATURES = [
+      // Executables and HTML: without these, content renamed to an image extension
+      // had no detected type, the signature check was skipped, and the upload was
+      // accepted as risk "low" -- the exact rename bypass the check exists for.
+      { ext: ["exe", "dll", "sys"], mime: "application/x-msdownload", signature: [77, 90] },
+      { ext: ["elf", "so", "bin"], mime: "application/x-executable", signature: [127, 69, 76, 70] },
+      { ext: ["html", "htm", "xhtml"], mime: "text/html", signature: [60, 104, 116, 109, 108] },
+      { ext: ["html", "htm"], mime: "text/html", signature: [60, 33, 68, 79, 67, 84, 89, 80, 69] },
       { ext: ["jpg", "jpeg"], mime: "image/jpeg", signature: [255, 216, 255] },
       { ext: ["png"], mime: "image/png", signature: [137, 80, 78, 71, 13, 10, 26, 10] },
       { ext: ["gif"], mime: "image/gif", signature: [71, 73, 70, 56] },
@@ -264423,10 +264888,39 @@ var init_protector = __esm({
       ".htpasswd",
       ".svg",
       // Can contain JavaScript
-      ".xml"
+      ".xml",
       // Can contain XXE
+      // Active-content types the set used to let through while still blocking .svg
+      // "because it can contain JavaScript" -- .html/.js are script-capable by
+      // definition, so an accepted upload served from our own origin is stored XSS.
+      ".html",
+      ".htm",
+      ".xhtml",
+      ".shtml",
+      ".js",
+      ".mjs",
+      ".cjs",
+      ".jsx",
+      ".ts",
+      ".tsx",
+      ".mhtml",
+      ".hta",
+      ".jsp",
+      ".asp",
+      ".aspx",
+      ".cgi",
+      ".pl"
     ]);
     DANGEROUS_MIME_TYPES = /* @__PURE__ */ new Set([
+      // Active-content types: they can carry script (svg, xhtml, xml) or be
+      // rendered as a document (html, pdf). Blocking .svg by extension while
+      // reporting isContentTypeSafe("image/svg+xml") === true was inconsistent.
+      "image/svg+xml",
+      "text/html",
+      "application/xhtml+xml",
+      "application/pdf",
+      "text/xml",
+      "application/xml",
       "application/javascript",
       "text/javascript",
       "application/x-javascript",
@@ -264481,7 +264975,9 @@ var init_protector = __esm({
             reason: "Empty file",
             sanitizedFilename: sanitized,
             detectedType: "unknown",
-            risk: "low"
+            // Unknown content is not low risk -- it is content whose type we could
+            // not establish, which is what a rename bypass looks like.
+            risk: "medium"
           };
         }
         if (this.blockedExtensions.has(ext)) {
@@ -265644,6 +266140,7 @@ var init_nonce_manager = __esm({
       validate(nonce) {
         const entry = this.nonces.get(nonce);
         if (!entry) return false;
+        if (entry.used) return false;
         if (Date.now() > entry.expiresAt) {
           this.nonces.delete(nonce);
           return false;
@@ -266436,7 +266933,15 @@ var init_token_manager = __esm({
       rotateAfterUse;
       maxTokens;
       tokens = /* @__PURE__ */ new Map();
+      /** Tokens this manager issued and already consumed. A rotated token is
+       *  deleted from `tokens`, so without this marker a replay found no entry and
+       *  fell through to the stateless branch, which accepted it -- defeating the
+       *  documented single-use guarantee of `rotateAfterUse`. */
+      consumedTokens = /* @__PURE__ */ new Set();
       constructor(options) {
+        if (!options || typeof options.secret !== "string" || options.secret.length === 0) {
+          throw new Error("createCSRFManager: options.secret is required (the HMAC key used to sign tokens)");
+        }
         this.secret = options.secret;
         this.tokenLength = options.tokenLength ?? 32;
         this.ttl = options.ttl ?? 36e5;
@@ -266536,12 +267041,16 @@ var init_token_manager = __esm({
           }
           entry.used = true;
           if (this.rotateAfterUse) {
+            this.consumedTokens.add(headerPart);
             this.tokens.delete(headerPart);
             const rotated = await this.generate(sessionId ?? void 0);
             return { valid: true, rotated };
           }
           return { valid: true };
         }
+        if (this.consumedTokens.has(headerPart)) {
+          return { valid: false, reason: "Token already used" };
+        }
         const expectedSig = await hmacSign3(
           this.secret,
           `${headerPart}.${sessionId ?? ""}`
@@ -272417,17 +272926,17 @@ async function hs256(payload, secret, maxAge) {
   const header = { alg: "HS256", typ: "JWT" };
   const body = { ...payload, iat: now, exp: now + maxAge };
   const data = enc(header) + "." + enc(body);
-  const { createHmac: createHmac2 } = await import("node:crypto");
-  const sig = createHmac2("sha256", secret).update(data).digest("base64url");
+  const { createHmac: createHmac3 } = await import("node:crypto");
+  const sig = createHmac3("sha256", secret).update(data).digest("base64url");
   return data + "." + sig;
 }
 async function verifyHs256(token, secret) {
   const parts = token.split(".");
   if (parts.length !== 3) return null;
-  const { createHmac: createHmac2, timingSafeEqual: timingSafeEqual4 } = await import("node:crypto");
-  const expected = createHmac2("sha256", secret).update(parts[0] + "." + parts[1]).digest("base64url");
+  const { createHmac: createHmac3, timingSafeEqual: timingSafeEqual3 } = await import("node:crypto");
+  const expected = createHmac3("sha256", secret).update(parts[0] + "." + parts[1]).digest("base64url");
   const a = Buffer.from(expected), b = Buffer.from(parts[2]);
-  if (a.length !== b.length || !timingSafeEqual4(a, b)) return null;
+  if (a.length !== b.length || !timingSafeEqual3(a, b)) return null;
   try {
     const body = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
     if (typeof body.exp === "number" && body.exp < Math.floor(Date.now() / 1e3)) return null;
@@ -273732,6 +274241,19 @@ ${err2.stack ?? ""}`);
         const isrLookupPath = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname;
         if (this.staticHandler && !this.isrRoutes.has(isrLookupPath)) {
           let staticResponse = await this.staticHandler.serve(pathname, request);
+          if (staticResponse.status !== 404) {
+            const reqMethod = request.method.toUpperCase();
+            const allow = "GET, HEAD, OPTIONS";
+            if (reqMethod === "TRACE") {
+              return new Response("Method Not Allowed", { status: 405, headers: { Allow: allow } });
+            }
+            if (reqMethod === "OPTIONS") {
+              return new Response(null, { status: 204, headers: { Allow: allow } });
+            }
+            if (reqMethod !== "GET" && reqMethod !== "HEAD") {
+              return new Response("Method Not Allowed", { status: 405, headers: { Allow: allow } });
+            }
+          }
           if (staticResponse && this.cspEnabled() && (staticResponse.headers.get("content-type") || "").includes("text/html")) {
             try {
               let buf = Buffer.from(await staticResponse.arrayBuffer());
@@ -273876,6 +274398,32 @@ ${err2.stack ?? ""}`);
 });
 
 // ../../packages/runtime/tw/dependency-graph.ts
+function flushPendingSubs() {
+  if (isFlushing || !pendingSubs) return;
+  isFlushing = true;
+  try {
+    let guard = 0;
+    while (pendingSubs && pendingSubs.size > 0 && guard++ < 1e5) {
+      const batchOf = pendingSubs;
+      pendingSubs = /* @__PURE__ */ new Set();
+      for (const sub of batchOf) {
+        try {
+          sub();
+        } catch (e) {
+          console.error("[TW Reactivity] Signal subscriber error:", e);
+        }
+      }
+    }
+  } finally {
+    isFlushing = false;
+    pendingSubs = null;
+  }
+}
+function enqueueSubs(subs) {
+  if (!pendingSubs) pendingSubs = /* @__PURE__ */ new Set();
+  for (const s of subs) pendingSubs.add(s);
+  if (batchDepth === 0) flushPendingSubs();
+}
 function startBatch() {
   batchDepth++;
 }
@@ -273885,13 +274433,7 @@ function endBatch() {
     batchDepth = 0;
     const effects = Array.from(batchedEffects);
     batchedEffects.clear();
-    for (const eff of effects) {
-      try {
-        eff();
-      } catch (e) {
-        console.error("[TW Reactivity] Batch effect error:", e);
-      }
-    }
+    enqueueSubs(effects);
   }
 }
 function batch(fn) {
@@ -274073,12 +274615,14 @@ function isComputed(value) {
 function createScope3() {
   return new ReactiveScope();
 }
-var currentEffect, batchDepth, batchedEffects, SignalImpl, ComputedImpl, watchEffect, currentCleanup, ReactiveScope;
+var currentEffect, batchDepth, batchedEffects, pendingSubs, isFlushing, SignalImpl, ComputedImpl, watchEffect, currentCleanup, ReactiveScope;
 var init_dependency_graph = __esm({
   "../../packages/runtime/tw/dependency-graph.ts"() {
     currentEffect = null;
     batchDepth = 0;
     batchedEffects = /* @__PURE__ */ new Set();
+    pendingSubs = null;
+    isFlushing = false;
     SignalImpl = class {
       value;
       subscribers = /* @__PURE__ */ new Set();
@@ -274097,19 +274641,9 @@ var init_dependency_graph = __esm({
         if (this.equals(this.value, value)) return;
         this.value = value;
         if (batchDepth > 0) {
-          for (const sub of this.subscribers) {
-            batchedEffects.add(sub);
-          }
-        } else {
-          const subs = Array.from(this.subscribers);
-          for (const sub of subs) {
-            try {
-              sub();
-            } catch (e) {
-              console.error("[TW Reactivity] Signal subscriber error:", e);
-            }
-          }
+          for (const sub of this.subscribers) batchedEffects.add(sub);
         }
+        enqueueSubs(this.subscribers);
       }
       update(fn) {
         this.set(fn(this.value));
@@ -274175,14 +274709,11 @@ var init_dependency_graph = __esm({
         return this.cachedValue;
       }
       notify() {
-        const subs = Array.from(this.subscribers);
-        for (const sub of subs) {
-          try {
-            sub();
-          } catch (e) {
-            console.error("[TW Reactivity] Computed subscriber error:", e);
-          }
+        if (batchDepth > 0) {
+          for (const sub of this.subscribers) batchedEffects.add(sub);
+          return;
         }
+        enqueueSubs(this.subscribers);
       }
       set(_value) {
         throw new Error("Cannot set a computed signal");
@@ -277367,10 +277898,12 @@ var init_diff = __esm({
   "../../packages/runtime/tw/diff.ts"() {
     init_vdom2();
     HTML_ESCAPE_MAP = {
-      "&": "&",
-      "<": "<",
-      ">": ">",
-      '"': '"',
+      // These four mapped to THEMSELVES, so a <script> tag passed through
+      // untouched -- only ' was actually escaped.
+      "&": "&amp;",
+      "<": "&lt;",
+      ">": "&gt;",
+      '"': "&quot;",
       "'": "&#39;"
     };
     HTML_ESCAPE_REGEX = /[&<>"']/g;
@@ -280900,8 +281433,19 @@ async function hydrateElementById(id, component, root = typeof document !== "und
   );
 }
 function markForHydration(element, componentId, props) {
+  if (!element || typeof componentId !== "string") return;
   element.setAttribute(HYDRATE_ATTR, componentId);
-  element.setAttribute("data-tw-props", JSON.stringify(props));
+  let serialised = null;
+  if (props && typeof props === "object") {
+    try {
+      serialised = JSON.stringify(props);
+    } catch {
+      serialised = null;
+    }
+  }
+  if (serialised !== null && serialised !== void 0) {
+    element.setAttribute("data-tw-props", serialised);
+  }
 }
 function unmarkForHydration(element) {
   element.removeAttribute(HYDRATE_ATTR);
@@ -284201,15 +284745,21 @@ function usePathname(opts) {
 function matchPathPattern(path, pattern) {
   const pSeg = path.split("/").filter(Boolean);
   const tSeg = pattern.split("/").filter(Boolean);
-  if (pSeg.length !== tSeg.length) return { matches: false, params: {}, score: 0 };
+  const catchAllAt = tSeg.findIndex((t3) => t3.startsWith("[...") || t3.startsWith(":..."));
+  if (catchAllAt === -1) {
+    if (pSeg.length !== tSeg.length) return { matches: false, params: {}, score: 0 };
+  } else if (pSeg.length < tSeg.length) {
+    return { matches: false, params: {}, score: 0 };
+  }
   const params = {};
   let literal = 0;
   for (let i = 0; i < tSeg.length; i++) {
     const t3 = tSeg[i];
     const isParam = t3.startsWith("[") && t3.endsWith("]") || t3.startsWith(":");
     if (isParam) {
-      const name = t3.startsWith("[") ? t3.slice(1, -1).replace(/\.\.\.$/, "") : t3.slice(1);
-      params[name] = decodeURIComponent(pSeg[i]);
+      const name = t3.startsWith("[") ? t3.slice(1, -1).replace(/^\.\.\./, "") : t3.slice(1);
+      const isCatchAll = t3.startsWith("[...") || t3.startsWith(":...");
+      params[name] = isCatchAll ? pSeg.slice(i).map((seg) => decodeURIComponent(seg)).join("/") : decodeURIComponent(pSeg[i]);
     } else if (t3 !== pSeg[i]) {
       return { matches: false, params: {}, score: 0 };
     } else {
@@ -285024,7 +285574,11 @@ function defineStore(idOrDefinition, maybeDefinition) {
     const getterDeps = Object.values(reactiveState);
     for (const key2 of Object.keys(getters)) {
       const getter = getters[key2];
-      getterValues[key2] = computed4(getterDeps, getter);
+      getterValues[key2] = computed4(getterDeps, () => {
+        const snap = {};
+        for (const k of Object.keys(reactiveState)) snap[k] = reactiveState[k].value;
+        return getter.call(snap, snap);
+      });
     }
     const subscribers = /* @__PURE__ */ new Set();
     const actionListeners = /* @__PURE__ */ new Set();
@@ -285067,7 +285621,7 @@ function defineStore(idOrDefinition, maybeDefinition) {
       const fn = actions[key2];
       boundActions[key2] = (...args) => {
         actionListeners.forEach((cb) => cb({ name: key2, args }));
-        return fn.call(ctx, stateProxy, ...args);
+        return fn.call(stateProxy, stateProxy, ...args);
       };
     }
     for (const rv of Object.values(reactiveState)) {
@@ -285179,9 +285733,10 @@ var init_store = __esm({
         };
       }
       _notify() {
+        const current2 = this.value ?? this._value;
         for (const l of this._listeners) {
           try {
-            l();
+            l(current2);
           } catch {
           }
         }
@@ -286187,7 +286742,8 @@ var init_virtual_list = __esm({
         return this.container.scrollTop;
       }
       getFirstVisibleIndex() {
-        return this.visibleRange.start;
+        const last = Math.max(0, this.options?.itemCount ?? 0 - 1);
+        return Math.min(Math.max(this.visibleRange.start, 0), last);
       }
       getLastVisibleIndex() {
         return this.visibleRange.end;
@@ -289490,8 +290046,6 @@ function buildMetaTagsFromSource(source) {
   };
   let tags = "";
   const description = pick2("description");
-  if (description) tags += `    <meta name="description" content="${esc5(description)}">
-`;
   const keywords = pick2("keywords");
   if (keywords) tags += `    <meta name="keywords" content="${esc5(keywords)}">
 `;
@@ -290108,6 +290662,7 @@ async function buildCommand() {
     if ((renderMode === "ssr" || renderMode === "stream") && !hasExplicitParams) {
       requestRenderedCount++;
       console.log("  \x1B[36m~\x1B[0m " + routePath + " [" + renderMode + ": rendered at request time]");
+      isrRoutes.set(routePath === "" ? "/" : routePath, 0);
       try {
         const src = readFileSync18(pageFile, "utf-8");
         if (serverBlocksOn) {
@@ -290208,7 +290763,30 @@ async function buildCommand() {
           }
         }
         const scopeVars = { ...paramSet, params: paramSet, ...serverVars };
-        const result = _compileSync(source, { filePath: pageFile, stateVars: scopeVars, ...compilePassOpts() });
+        let pageImports = {};
+        try {
+          const { twImportTs: twImportTs2 } = await Promise.resolve().then(() => (init_node_import(), node_import_exports));
+          const { dirname: dirname17, resolve: resolvePath } = await import("node:path");
+          const parseFn = _compilerMod.parseWithDetails;
+          const parsed = parseFn(source, pageFile);
+          const prog = parsed?.program ?? parsed?.ast;
+          for (const d of prog?.directives ?? []) {
+            if (d?.type !== "ImportDirective" || !d.source || d.isTypeOnly) continue;
+            const spec = String(d.source);
+            if (!(spec.startsWith("./") || spec.startsWith("../") || spec.startsWith("@./"))) continue;
+            const abs = spec.startsWith("@./") ? resolvePath(rootDir, spec.slice(3)) : resolvePath(dirname17(pageFile), spec);
+            const mod = await twImportTs2(abs);
+            if (d.namespaceImport) pageImports[d.namespaceImport] = mod;
+            if (d.defaultImport) pageImports[d.defaultImport] = mod?.default ?? mod;
+            for (const it of d.items ?? []) {
+              const name = String(it).split(/\s+as\s+/).pop()?.trim();
+              if (name && mod && name in mod) pageImports[name] = mod[name];
+            }
+          }
+        } catch (e) {
+          if (process.env.TW_DEBUG === "1") console.error("[tw] page imports failed:", e?.message ?? e);
+        }
+        const result = _compileSync(source, { filePath: pageFile, stateVars: scopeVars, imports: pageImports, ...compilePassOpts() });
         {
           const used = /* @__PURE__ */ new Set();
           collectComponentUsages(result.ast, used);
@@ -293906,7 +294484,7 @@ async function createPackageJson(dir, name) {
       ship: "tw ship"
     },
     dependencies: {
-      "tw-framework": "^2.0.0"
+      "tw-framework": "^2.0.1"
     },
     devDependencies: {
       typescript: "^5.4.0",
@@ -293993,7 +294571,7 @@ dist/
 async function createReadme(dir, name) {
   const content = `# ${name}
 
-Built with TW Framework 2.0.0.
+Built with TW Framework 2.0.1.
 
 ## Getting Started
 
@@ -295685,7 +296263,31 @@ async function devCommand() {
       try {
         const source = readFileSync19(twFile, "utf-8");
         if (typeof beginCssRouteCapture2 === "function") beginCssRouteCapture2(path);
-        const result = compileSync3(source, { filePath: twFile, stateVars: resolved.params });
+        let result = compileSync3(source, { filePath: twFile, stateVars: resolved.params });
+        try {
+          const _c = await Promise.resolve().then(() => (init_tw7(), tw_exports3));
+          const blocks = _c.collectServerBlocks(result.ast);
+          if (blocks.length) {
+            const values = await _c.executeServerBlocks(blocks.filter((b) => !b.deferred), { label: twFile });
+            if (values && Object.keys(values).length) {
+              result = compileSync3(source, { filePath: twFile, stateVars: { ...resolved.params, ...values } });
+            }
+          }
+        } catch (e) {
+          console.log("    -> 500 Error (server block): " + (e?.message ?? e));
+          if (devOpts?.overlay === false) {
+            return new Response(
+              "500 - Server Error\n\n" + (e?.message ?? String(e)),
+              { status: 500, headers: { "Content-Type": "text/plain; charset=utf-8" } }
+            );
+          }
+          return new Response(devErrorPage({
+            title: "Server Error",
+            message: e?.message ?? String(e),
+            stack: e?.stack,
+            file: twFile
+          }), { status: 500, headers: { "Content-Type": "text/html; charset=utf-8" } });
+        }
         let html = result.html;
         const pageDir = twFile.substring(0, twFile.lastIndexOf("/"));
         const chain2 = [];
@@ -296511,7 +297113,7 @@ function ensureTestingShim(rootDir) {
     if (existsSync32(marker)) return;
     const { mkdirSync: mkdirSync12, writeFileSync: writeFileSync14 } = _require("node:fs");
     mkdirSync12(join37(shimPkgDir, "tw"), { recursive: true });
-    writeFileSync14(marker, JSON.stringify({ name: "@tw/server", version: "2.0.0", private: true }, null, 2));
+    writeFileSync14(marker, JSON.stringify({ name: "@tw/server", version: "2.0.1", private: true }, null, 2));
     let testingBundle = null;
     try {
       const here = new URL(".", import.meta.url).pathname;
@@ -297408,7 +298010,7 @@ import { join as join42 } from "node:path";
 function cliVersion() {
   try {
     const bd = globalThis.__TW_BUNDLE_DIR;
-    const pj = bd ? join42(bd, "..", "package.json") : new URL("../../package.json", import.meta.url).pathname;
+    const pj = bd ? join42(bd, "..", "package.json") : new URL("../package.json", import.meta.url).pathname;
     return JSON.parse(readFileSync26(pj, "utf-8")).version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -297517,7 +298119,20 @@ async function run() {
     console.log(`  ${colors.bold("tw")} ${colors.cyan(`v${VERSION2}`)}`);
     return;
   }
-  const handler = commands[parsed.command];
+  let handler = commands[parsed.command];
+  if (!handler) {
+    try {
+      const { loadPlugins: loadPlugins2 } = await Promise.resolve().then(() => (init_tw8(), tw_exports4));
+      const pm = await loadPlugins2(process.cwd());
+      const cmd = pm?.getCommands?.()[parsed.command];
+      if (typeof cmd === "function") {
+        handler = async () => {
+          await cmd(process.argv.slice(3));
+        };
+      }
+    } catch {
+    }
+  }
   if (!handler) {
     console.error(`  ${colors.red("?")} Unknown command: ${parsed.command}`);
     console.log("\n" + helpText);