what-server 0.11.6 → 0.11.8

package/src/action-handler.js

@@ -9,7 +9,7 @@
 import { handleActionRequest } from './actions.js';
 
 const DEFAULT_BASE_PATH = '/__what_action';
-const MAX_BODY_BYTES = 1024 * 1024; // 1 MB
+export const MAX_BODY_BYTES = 1024 * 1024; // 1 MB
 
 function lowerHeaders(headers) {
   if (!headers) return {};
@@ -51,7 +51,15 @@ function htmlResponse(status, message) {
 // "/\evil.com" canonicalizes to http://evil.com (an open redirect). We reject
 // anything starting with two slash-or-backslash chars or containing a
 // backslash, then canonicalize via URL and require the localhost origin.
-function safeLocalPath(value) {
+//
+// Sibling predicate: isSafeUrl in packages/router/src/index.js. That one gates
+// a client navigation target and legitimately allows absolute http(s), mailto:
+// and tel:. This one gates a server-issued `Location:` header, an
+// attacker-controllable open-redirect primitive, so it must stay strictly
+// narrower: same-origin local paths only. Harden one, re-read the other; do not
+// unify them. packages/server/test/redirect-predicate-parity.test.js gates the
+// ordering. Exported for that test only, not part of the package surface.
+export function safeLocalPath(value) {
   if (typeof value !== 'string' || !value.startsWith('/')) return null;
   // Reject protocol-relative / backslash-smuggled targets up front.
   if (/^[/\\]{2}/.test(value) || value.includes('\\')) return null;

package/src/actions.js

@@ -78,11 +78,24 @@ export function csrfMetaTag(token) {
 // --- Define a server action ---
 
 let _actionCounter = 0;
+let _fallbackWarningShown = false;
 
 function generateActionId() {
-  // Generate a deterministic ID — prefer crypto.getRandomValues, fall back to a
-  // monotonic counter (never Math.random, which is not cryptographically safe and
-  // produces predictable IDs in some runtimes).
+  if (
+    !_fallbackWarningShown
+    && typeof process !== 'undefined'
+    && process.env?.NODE_ENV !== 'production'
+  ) {
+    _fallbackWarningShown = true;
+    console.warn(
+      '[what-server] action() is using a runtime-generated ID because compiler metadata is missing. ' +
+      'Build with what-compiler/vite-plugin-what or pass an explicit { id } so client and server bundles agree.'
+    );
+  }
+  // Compatibility fallback for direct, uncompiled script users. Normal builds
+  // receive a deterministic compiler ID derived from source path + binding.
+  // Never use Math.random here; crypto avoids predictable collisions, and the
+  // monotonic fallback keeps older runtimes functional.
   const rand = typeof crypto !== 'undefined' && crypto.getRandomValues
     ? Array.from(crypto.getRandomValues(new Uint8Array(6)), b => b.toString(16).padStart(2, '0')).join('')
     : `c${(++_actionCounter).toString(36)}_${Date.now().toString(36)}`;

package/src/adapter/core.js

@@ -39,8 +39,14 @@ async function readActionBody(request) {
   } catch { return {}; }
 }
 
+// Same cap for the revalidate webhook: the secret is only checked once the body
+// is parsed, so an unauthenticated client must never be able to make the origin
+// buffer an unbounded payload before its 401.
 async function readJsonBody(request) {
-  try { return await request.json(); } catch { return {}; }
+  let read;
+  try { read = await readFetchBodyCapped(request); } catch { return { json: {} }; }
+  if (read.tooLarge) return { tooLarge: true };
+  try { return { json: JSON.parse(read.raw) }; } catch { return { json: {} }; }
 }
 
 function defaultRenderRoute(documentOptions) {
@@ -164,8 +170,14 @@ export function createRequestHandler(options = {}) {
 
     // On-demand revalidation webhook
     if (request.method === 'POST' && pathname === REVALIDATE_PATH && revalidateWebhook) {
-      const body = await readJsonBody(request);
-      const out = await revalidateWebhook({ headers: headersToObject(request.headers), body });
+      const read = await readJsonBody(request);
+      if (read.tooLarge) {
+        return new Response(JSON.stringify({ message: 'Payload too large' }), {
+          status: 413,
+          headers: { 'content-type': 'application/json' },
+        });
+      }
+      const out = await revalidateWebhook({ headers: headersToObject(request.headers), body: read.json });
       return new Response(JSON.stringify(out.body), {
         status: out.status,
         headers: { 'content-type': 'application/json' },
@@ -187,6 +199,10 @@ export function createRequestHandler(options = {}) {
     // NOTE: cached HTML is shared across users, so the per-user CSRF token is
     // NOT embedded in the page here — clients read it from the cookie instead.
     if (cache && config.mode !== 'server') {
+      // The cache engine resolves the route's declared `vary` names against
+      // these. Without them it fails closed: warns and bypasses on every
+      // request, which is how the vary control shipped never executing.
+      routeMatch.varyHeaders = headersToObject(request.headers);
       const result = await cache.handle(routeMatch, () => renderRoute(routeMatch));
       return new Response(result.html, {
         status: result.status || 200,

package/src/adapter/node.js

@@ -4,6 +4,17 @@
 
 import http from 'node:http';
 import { createRequestHandler } from './core.js';
+import { MAX_BODY_BYTES } from '../action-handler.js';
+
+// A Request object only exists after the body is read, so the cap the fetch
+// path enforces would run too late here. Returned instead of a Request when the
+// body is over the limit, so the caller answers 413 without buffering it all.
+const TOO_LARGE = Symbol('what.bodyTooLarge');
+
+const TOO_LARGE_RESPONSE = () => new Response(
+  JSON.stringify({ message: 'Payload too large' }),
+  { status: 413, headers: { 'content-type': 'application/json' } },
+);
 
 async function nodeToWebRequest(req) {
   const host = req.headers.host || 'localhost';
@@ -14,8 +25,25 @@ async function nodeToWebRequest(req) {
   }
   let body;
   if (req.method !== 'GET' && req.method !== 'HEAD') {
+    const declared = Number(req.headers['content-length']);
+    let tooLarge = Number.isFinite(declared) && declared > MAX_BODY_BYTES;
     const chunks = [];
-    for await (const chunk of req) chunks.push(chunk);
+    let size = 0;
+    // Once over the cap the remaining chunks are drained and discarded rather
+    // than buffered: memory stays bounded, and the socket survives long enough
+    // to carry the 413 back. Chunked transfer or a spoofed Content-Length
+    // cannot get past the running total.
+    for await (const chunk of req) {
+      if (tooLarge) continue;
+      size += chunk.length;
+      if (size > MAX_BODY_BYTES) {
+        tooLarge = true;
+        chunks.length = 0;
+        continue;
+      }
+      chunks.push(chunk);
+    }
+    if (tooLarge) return TOO_LARGE;
     if (chunks.length) body = Buffer.concat(chunks);
   }
   return new Request(url, { method: req.method, headers, body });
@@ -33,6 +61,7 @@ export function toNodeListener(handler) {
   return async function listener(req, res) {
     try {
       const webReq = await nodeToWebRequest(req);
+      if (webReq === TOO_LARGE) return await sendWebResponse(res, TOO_LARGE_RESPONSE());
       const webRes = await handler(webReq);
       await sendWebResponse(res, webRes);
     } catch (err) {
@@ -49,6 +78,7 @@ export function whatMiddleware(options = {}) {
   const handler = createRequestHandler(options);
   return async function middleware(req, res, next) {
     const webReq = await nodeToWebRequest(req);
+    if (webReq === TOO_LARGE) return await sendWebResponse(res, TOO_LARGE_RESPONSE());
     const webRes = await handler(webReq);
     if (webRes.status === 404 && typeof next === 'function') return next();
     await sendWebResponse(res, webRes);

package/src/adapter/static.js

@@ -3,7 +3,7 @@
 // navigation, mirroring Next's _next/data).
 
 import { mkdir, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { join, resolve, sep } from 'node:path';
 import { matchRoute } from 'what-router/match';
 import { renderDocument, serializeState } from '../index.js';
 
@@ -19,6 +19,19 @@ function buildConcretePath(pattern, params) {
     .replace(/[:*](\w+)/g, (_, n) => params[n] ?? '');
 }
 
+// getStaticPaths params come from user data (a CMS slug, a filename), so a value
+// like '../../etc/cron.d/x' would escape outDir once join() collapses it. Every
+// output directory is checked against the resolved outDir before anything is
+// written.
+function resolveInsideOutDir(outDir, urlPath) {
+  const root = resolve(outDir);
+  const dirPath = resolve(join(outDir, urlPath === '/' ? '' : urlPath));
+  if (dirPath !== root && !dirPath.startsWith(root + sep)) {
+    throw new Error(`[what-server] Refusing to write outside outDir: ${urlPath}`);
+  }
+  return dirPath;
+}
+
 export async function exportStatic({ routes = [], outDir, render, documentOptions = {} } = {}) {
   const written = [];
 
@@ -36,6 +49,7 @@ export async function exportStatic({ routes = [], outDir, render, documentOption
     }
 
     for (const urlPath of concrete) {
+      const dirPath = resolveInsideOutDir(outDir, urlPath);
       const matched = matchRoute(urlPath, [route]);
       const params = matched ? matched.params : {};
       const reqCtx = { params, query: {} };
@@ -44,7 +58,6 @@ export async function exportStatic({ routes = [], outDir, render, documentOption
         ? await render(pageModule, reqCtx)
         : await renderDocument(pageModule, reqCtx, documentOptions);
 
-      const dirPath = join(outDir, urlPath === '/' ? '' : urlPath);
       await mkdir(dirPath, { recursive: true });
       await writeFile(join(dirPath, 'index.html'), html);
 

package/src/index.js

@@ -2,7 +2,13 @@
 // SSR, static site generation, server components.
 // Zero-JS pages by default. Islands opt-in to client JS.
 
-import { h, runWithServerContext, beginHeadCollection, endHeadCollection } from 'what-core';
+import {
+  h,
+  getServerContext,
+  runWithServerContext,
+  beginHeadCollection,
+  endHeadCollection,
+} from 'what-core';
 import { serializeState } from './serialize.js';
 import { getIslandStoresSnapshot } from './islands.js';
 import { csrfMetaTag } from './actions.js';
@@ -13,6 +19,7 @@ function createRenderContext(loaderData) {
     head: beginHeadCollection(),
     loaderData,
     resources: new Map(),
+    islandStores: new Map(),
     resourceCounter: 0,
     boundaryCounter: 0,
     suspended: [],
@@ -35,6 +42,10 @@ function nextHydrationId() {
 // so the client can reuse the server-rendered DOM.
 
 export function renderToHydratableString(vnode) {
+  if (typeof document === 'undefined' && !getServerContext()) {
+    const ctx = createRenderContext(undefined);
+    return runWithServerContext(ctx, () => renderToHydratableString(vnode));
+  }
   resetHydrationId();
   return _renderHydratable(vnode);
 }
@@ -80,6 +91,7 @@ function _renderHydratable(vnode) {
 
   // Element
   const { tag, props, children } = vnode;
+  assertSafeTag(tag);
   const attrs = renderAttrs(props || {});
   const open = `<${tag}${attrs}>`;
 
@@ -108,6 +120,10 @@ function injectHydrationKey(html, hkId) {
 // Renders a VNode tree to an HTML string. Used for SSR and static gen.
 
 export function renderToString(vnode) {
+  if (typeof document === 'undefined' && !getServerContext()) {
+    const ctx = createRenderContext(undefined);
+    return runWithServerContext(ctx, () => renderToString(vnode));
+  }
   if (vnode == null || vnode === false || vnode === true) return '';
 
   // Text
@@ -159,6 +175,7 @@ export function renderToString(vnode) {
 
   // Element
   const { tag, props, children } = vnode;
+  assertSafeTag(tag);
   const attrs = renderAttrs(props || {});
   const open = `<${tag}${attrs}>`;
 
@@ -243,7 +260,7 @@ export async function renderDocument(pageModule, reqCtx = {}, options = {}) {
   const payload = {
     loaderData: loaderData ?? null,
     resources,
-    islandStores: getIslandStoresSnapshot(),
+    islandStores: getIslandStoresSnapshot(ctx),
   };
   return wrapHtmlDocument({ body, head, payload, options });
 }
@@ -283,14 +300,16 @@ export async function* renderToStream(vnode, ctx) {
 
   // Signal — unwrap by calling it
   if (typeof vnode === 'function' && vnode._signal) {
-    yield* renderToStream(vnode(), ctx);
+    const value = runWithServerContext(ctx, () => vnode());
+    yield* renderToStream(value, ctx);
     return;
   }
 
   // Reactive function child — call to get value
   if (typeof vnode === 'function') {
     try {
-      yield* renderToStream(vnode(), ctx);
+      const value = runWithServerContext(ctx, () => vnode());
+      yield* renderToStream(value, ctx);
     } catch (e) {
       if (typeof process !== 'undefined' && process.env?.NODE_ENV !== 'production') {
         console.warn('[what-server] Error rendering reactive function in stream SSR:', e.message);
@@ -333,7 +352,10 @@ export async function* renderToStream(vnode, ctx) {
 
   if (typeof vnode.tag === 'function') {
     try {
-      const result = vnode.tag({ ...vnode.props, children: vnode.children });
+      const result = runWithServerContext(
+        ctx,
+        () => vnode.tag({ ...vnode.props, children: vnode.children })
+      );
       // Support async components
       const resolved = result instanceof Promise ? await result : result;
       yield* renderToStream(resolved, ctx);
@@ -349,6 +371,7 @@ export async function* renderToStream(vnode, ctx) {
   }
 
   const { tag, props, children } = vnode;
+  assertSafeTag(tag);
   const attrs = renderAttrs(props || {});
   yield `<${tag}${attrs}>`;
 
@@ -380,8 +403,11 @@ export function definePage(config) {
 
 // Generate static HTML for a page
 export function generateStaticPage(page, data = {}) {
-  const vnode = page.component(data);
-  const html = renderToString(vnode);
+  const ctx = createRenderContext(data);
+  const html = runWithServerContext(ctx, () => {
+    const vnode = page.component(data);
+    return renderToString(vnode);
+  });
   const islands = page.islands || [];
 
   return wrapDocument({
@@ -489,11 +515,24 @@ function _resolveInnerHTML(props) {
 // xlink:href, SVG names like stroke-width, and namespaced attributes.
 const SAFE_ATTR_NAME = /^[a-zA-Z_:][a-zA-Z0-9:._-]*$/;
 
+// Tag names are emitted verbatim too, so they get the same treatment:
+//   h('div onload=alert(1) x', {})  ->  <div onload=alert(1) x>
+// Allows custom elements (my-el), SVG camelCase (clipPath) and the internal
+// '__suspense' marker tag.
+const SAFE_TAG_NAME = /^[a-zA-Z_][a-zA-Z0-9._:-]*$/;
+
+function assertSafeTag(tag) {
+  if (typeof tag !== 'string' || !SAFE_TAG_NAME.test(tag)) {
+    throw new Error(`[what-server] Invalid tag name in SSR: ${JSON.stringify(tag)}`);
+  }
+}
+
 function renderAttrs(props) {
   let out = '';
   for (const [key, val] of Object.entries(props)) {
     if (key === 'key' || key === 'ref' || key === 'children' || key === 'dangerouslySetInnerHTML' || key === 'innerHTML') continue;
-    if (key.startsWith('on') && key.length > 2) continue; // Skip event handlers in SSR
+    const lowerKey = key.toLowerCase();
+    if (lowerKey.startsWith('on') && key.length > 2) continue; // Skip event handlers in SSR
     if (val === false || val == null) continue;
     if (!SAFE_ATTR_NAME.test(key)) {
       if (_isDevMode) {
@@ -501,6 +540,12 @@ function renderAttrs(props) {
       }
       continue;
     }
+    if (REFUSED_ATTRS.has(lowerKey)) {
+      if (_isDevMode) {
+        console.warn(`[what-server] Skipping unsafe attribute in SSR: ${JSON.stringify(key)}`);
+      }
+      continue;
+    }
 
     if (key === 'className' || key === 'class') {
       out += ` class="${escapeHtml(String(val))}"`;
@@ -533,10 +578,17 @@ function isUnsafeUrlAttribute(key, val) {
   return normalizedValue.startsWith('javascript:') || normalizedValue.startsWith('vbscript:') || normalizedValue.startsWith('data:');
 }
 
+// Must stay in step with URL_ATTRS in what-core's dom.js. Both sets are gated by
+// the parity test in test/ssr-security.test.js.
 const URL_ATTRS = new Set([
-  'href', 'src', 'action', 'formaction', 'xlink:href',
+  'href', 'src', 'action', 'formaction', 'data', 'ping', 'xlink:href',
 ]);
 
+// Attributes whose value the browser parses as markup or code, so escaping is
+// not a defense: srcdoc is entity-decoded and parsed as a full document, which
+// revives "&lt;script&gt;". These are refused outright.
+const REFUSED_ATTRS = new Set(['srcdoc']);
+
 function escapeHtml(str) {
   return str
     .replace(/&/g, '&amp;')
@@ -589,12 +641,11 @@ export {
   getRevalidationHandler,
 } from './revalidation-registry.js';
 
-// Deploy adapters — framework-agnostic core + Node / static / edge wrappers
+// Runtime-neutral deploy adapters. Node-only adapters are re-exported by the
+// package's conditional Node entry so browser/edge bundles never resolve Node
+// builtins merely because they import a client-safe server action.
 export { createRequestHandler } from './adapter/core.js';
-export { createServer, toNodeListener, whatMiddleware } from './adapter/node.js';
-export { exportStatic } from './adapter/static.js';
 export { createCloudflareHandler } from './adapter/cloudflare.js';
-export { createVercelHandler, buildVercelOutput } from './adapter/vercel.js';
 
 // Safe state serialization for inlining into <script> tags (AUDIT-2026-06-06 M13)
 export { serializeState } from './serialize.js';

package/src/islands.js

@@ -16,7 +16,7 @@
 //   'media'   - Hydrate when media query matches (e.g., mobile-only)
 //   'action'  - Hydrate on first user interaction (click, focus, hover)
 
-import { mount, hydrate, signal, batch } from 'what-core';
+import { mount, hydrate, signal, batch, getServerContext } from 'what-core';
 import { serializeState } from './serialize.js';
 
 const islandRegistry = new Map();
@@ -25,20 +25,41 @@ const hydrationQueue = [];
 let isProcessingQueue = false;
 
 // --- Shared Island State ---
-// Global reactive store that persists across islands and page navigations
-
-const sharedStores = new Map();
-
-export function createIslandStore(name, initialState) {
-  if (sharedStores.has(name)) {
-    return sharedStores.get(name);
+// Browser stores intentionally persist across islands and client navigations.
+// Server stores belong to the active render context so one request can never
+// observe another request's state. Module-scoped server declarations receive a
+// lightweight handle that resolves to the current request's concrete store.
+
+const browserStores = new Map();
+const serverStoreDefinitions = new Map();
+
+function cloneInitialState(value) {
+  if (typeof structuredClone === 'function') {
+    try {
+      return structuredClone(value);
+    } catch {
+      // Fall through for values structuredClone cannot represent. Island
+      // state is expected to be serializable, but preserving a shallow copy is
+      // a safer compatibility fallback than sharing the original object.
+    }
+  }
+  if (Array.isArray(value)) return value.map(cloneInitialState);
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, item]) => [key, cloneInitialState(item)])
+    );
   }
+  return value;
+}
+
+function createConcreteStore(storeMap, name, initialState) {
+  if (storeMap.has(name)) return storeMap.get(name);
 
   const store = {};
   const signals = {};
 
   // Create signals for each key in initial state
-  for (const [key, value] of Object.entries(initialState)) {
+  for (const [key, value] of Object.entries(cloneInitialState(initialState))) {
     signals[key] = signal(value);
     Object.defineProperty(store, key, {
       get: () => signals[key](),
@@ -72,16 +93,86 @@ export function createIslandStore(name, initialState) {
     });
   };
 
-  sharedStores.set(name, store);
+  storeMap.set(name, store);
   return store;
 }
 
+function activeServerStoreMap(context) {
+  const ctx = context || getServerContext();
+  return ctx && ctx.islandStores instanceof Map ? ctx.islandStores : null;
+}
+
+function serverStoreHandle(name, initialState) {
+  if (serverStoreDefinitions.has(name)) {
+    return serverStoreDefinitions.get(name).handle;
+  }
+
+  const definition = {
+    initialState: cloneInitialState(initialState),
+    handle: null,
+  };
+
+  const resolve = () => {
+    const storeMap = activeServerStoreMap();
+    if (!storeMap) {
+      throw new Error(
+        `[what-server] Island store "${name}" was accessed outside an active server render. ` +
+        'Read or write module-scoped island stores from a component rendered by renderDocument/renderPage.'
+      );
+    }
+    return createConcreteStore(storeMap, name, definition.initialState);
+  };
+
+  definition.handle = new Proxy({}, {
+    get(_target, property) {
+      return Reflect.get(resolve(), property);
+    },
+    set(_target, property, value) {
+      return Reflect.set(resolve(), property, value);
+    },
+    has(_target, property) {
+      return Reflect.has(resolve(), property);
+    },
+    ownKeys() {
+      return Reflect.ownKeys(resolve());
+    },
+    getOwnPropertyDescriptor(_target, property) {
+      const descriptor = Reflect.getOwnPropertyDescriptor(resolve(), property);
+      return descriptor ? { ...descriptor, configurable: true } : undefined;
+    },
+  });
+
+  serverStoreDefinitions.set(name, definition);
+  return definition.handle;
+}
+
+export function createIslandStore(name, initialState) {
+  if (typeof document !== 'undefined') {
+    return createConcreteStore(browserStores, name, initialState);
+  }
+
+  const storeMap = activeServerStoreMap();
+  if (storeMap) {
+    const definition = serverStoreDefinitions.get(name);
+    return createConcreteStore(storeMap, name, definition?.initialState ?? initialState);
+  }
+
+  return serverStoreHandle(name, initialState);
+}
+
 // Get or create a shared store
 export function useIslandStore(name, fallbackInitial = {}) {
-  if (sharedStores.has(name)) {
-    return sharedStores.get(name);
+  if (typeof document !== 'undefined') {
+    return createConcreteStore(browserStores, name, fallbackInitial);
   }
-  return createIslandStore(name, fallbackInitial);
+
+  const storeMap = activeServerStoreMap();
+  if (storeMap) {
+    const definition = serverStoreDefinitions.get(name);
+    return createConcreteStore(storeMap, name, definition?.initialState ?? fallbackInitial);
+  }
+
+  return serverStoreHandle(name, fallbackInitial);
 }
 
 // Serialize all shared stores for SSR.
@@ -94,9 +185,12 @@ export function serializeIslandStores() {
 
 // Raw (unserialized) snapshot of all shared island stores, so renderDocument can
 // merge it into the single consolidated #__what_data payload (one serialize pass).
-export function getIslandStoresSnapshot() {
+export function getIslandStoresSnapshot(context) {
+  const storeMap = typeof document !== 'undefined'
+    ? browserStores
+    : activeServerStoreMap(context);
   const data = {};
-  for (const [name, store] of sharedStores) {
+  for (const [name, store] of storeMap || []) {
     data[name] = store._getSnapshot();
   }
   return data;
@@ -202,10 +296,16 @@ export function boostIslandPriority(name, newPriority = 100) {
 // --- Client-side hydration ---
 
 export function hydrateIslands() {
-  // First, hydrate any shared stores from the page
-  const storeScript = document.querySelector('script[data-island-stores]');
-  if (storeScript) {
-    hydrateIslandStores(storeScript.textContent);
+  // First, hydrate any shared stores from the page. renderDocument emits them
+  // inside the consolidated #__what_data payload.
+  const dataScript = document.getElementById('__what_data');
+  if (dataScript) {
+    try {
+      const payload = JSON.parse(dataScript.textContent || '{}');
+      if (payload && payload.islandStores) hydrateIslandStores(payload.islandStores);
+    } catch (e) {
+      console.warn('[what] Failed to parse hydration payload:', e);
+    }
   }
 
   const islands = document.querySelectorAll('[data-island]');
@@ -231,7 +331,7 @@ export function hydrateIslands() {
 }
 
 function scheduleHydration(el, entry, props, mode, priority, name, stores) {
-  const hydrate = async () => {
+  const hydrateIsland = async () => {
     if (hydratedIslands.has(el)) return;
     hydratedIslands.add(el);
 
@@ -269,17 +369,17 @@ function scheduleHydration(el, entry, props, mode, priority, name, stores) {
   switch (mode) {
     case 'load':
       // Immediate hydration via queue (respects priority)
-      enqueueHydration({ name, priority: priority + 1000, hydrate });
+      enqueueHydration({ name, priority: priority + 1000, hydrate: hydrateIsland });
       break;
 
     case 'idle':
       if ('requestIdleCallback' in window) {
         requestIdleCallback(() => {
-          enqueueHydration({ name, priority, hydrate });
+          enqueueHydration({ name, priority, hydrate: hydrateIsland });
         });
       } else {
         setTimeout(() => {
-          enqueueHydration({ name, priority, hydrate });
+          enqueueHydration({ name, priority, hydrate: hydrateIsland });
         }, 200);
       }
       break;
@@ -289,7 +389,7 @@ function scheduleHydration(el, entry, props, mode, priority, name, stores) {
         for (const entry of entries) {
           if (entry.isIntersecting) {
             obs.disconnect();
-            enqueueHydration({ name, priority, hydrate });
+            enqueueHydration({ name, priority, hydrate: hydrateIsland });
             break;
           }
         }
@@ -301,11 +401,11 @@ function scheduleHydration(el, entry, props, mode, priority, name, stores) {
     case 'media': {
       const mq = window.matchMedia(entry.media || '(max-width: 768px)');
       if (mq.matches) {
-        enqueueHydration({ name, priority, hydrate });
+        enqueueHydration({ name, priority, hydrate: hydrateIsland });
       } else {
         mq.addEventListener('change', (e) => {
           if (e.matches) {
-            enqueueHydration({ name, priority, hydrate });
+            enqueueHydration({ name, priority, hydrate: hydrateIsland });
           }
         }, { once: true });
       }
@@ -317,7 +417,7 @@ function scheduleHydration(el, entry, props, mode, priority, name, stores) {
       const handler = () => {
         events.forEach(e => el.removeEventListener(e, handler));
         // Boost priority since user interacted
-        enqueueHydration({ name, priority: priority + 500, hydrate });
+        enqueueHydration({ name, priority: priority + 500, hydrate: hydrateIsland });
       };
       events.forEach(e => el.addEventListener(e, handler, { once: true, passive: true }));
       break;
@@ -328,7 +428,7 @@ function scheduleHydration(el, entry, props, mode, priority, name, stores) {
       break;
 
     default:
-      enqueueHydration({ name, priority, hydrate });
+      enqueueHydration({ name, priority, hydrate: hydrateIsland });
   }
 }
 
@@ -428,12 +528,15 @@ export function enhanceForms(selector = 'form[data-enhance]') {
 // --- Debugging ---
 
 export function getIslandStatus() {
+  const stores = typeof document !== 'undefined'
+    ? [...browserStores.keys()]
+    : [...(activeServerStoreMap()?.keys() || serverStoreDefinitions.keys())];
   const status = {
     registered: [...islandRegistry.keys()],
     hydrated: hydratedIslands.size,
     pending: hydrationQueue.length,
     queue: hydrationQueue.map(t => ({ name: t.name, priority: t.priority })),
-    stores: [...sharedStores.keys()],
+    stores,
   };
   return status;
 }