feat(core): drop superjson, ship built-in ESM rich-type serializer

Replaces `superjson` with a pure-ESM, dependency-free serializer in
`@webjskit/core` (`packages/core/src/serialize.js`). Tagged-inline wire
format, async sync API. Single async `stringify`/`serialize` so AI
agents can't pick the wrong variant; `parse`/`deserialize` stay sync.

Wire surface mirrors React Server Actions (the de-facto reference for
RPC payloads), plus webjs niceties:
  Date, BigInt, Map, Set, Error, undefined, registered Symbols,
  NaN/Infinity/-Infinity/-0, TypedArrays (Int8/Uint8/.../Float64),
  ArrayBuffer, DataView, Blob, File, FormData, reference cycles
  + shared refs.

Skips superjson's class-instance preservation, custom transformer
registry, and local Symbols — features webjs apps don't need that
add API surface AI agents can misuse.

Why drop superjson:
  - It ships CJS, requiring esbuild to bundle for the browser at
    first request. With our own ESM serializer the dev server stops
    bundling at runtime.
  - Two transitive deps (`copy-anything`, `is-what`) gone.
  - One less dimension of API surface (`registerClass`,
    `registerCustom`).

Other changes:
  - `packages/core/src/serialize.js` — new module (~430 lines).
  - `packages/core/index.js` — exports `stringify`/`parse`/
    `serialize`/`deserialize`.
  - `packages/core/src/rich-fetch.js` — uses local serializer.
  - `packages/server/src/serializer.js` — `Serializer.serialize` is
    now async; default uses `@webjskit/core`'s `stringify`.
  - `packages/server/src/actions.js` — `rpcResponse()` async; action
    stub generator emits `@webjskit/core` import + `await stringify`.
  - `packages/server/src/json.js` — `json()` async (rich path needs
    to await Blob bytes).
  - `packages/server/src/dev.js` — drops `serveBundledSuperjson` and
    its esbuild bundling call.
  - `packages/server/src/importmap.js` — drops superjson entry.
  - `packages/server/src/vendor.js` — drops superjson from BUILTIN.
  - `packages/server/package.json` — removes `superjson` dep.

Tests:
  - New `test/serialize.test.js` (37 tests): primitives, special
    numbers, undefined, BigInt, Date, Map, Set, Error, Symbols,
    cycles, typed arrays, key collision protection, Blob/File/
    FormData round-trip, realistic mixed payload.
  - Updated `test/actions.test.js`, `test/json-negotiation.test.js`,
    `test/rich-fetch.test.js`, `test/vendor.test.js`,
    `test/lazy-loading.test.js`, `test/dev-handler.test.js`,
    `test/e2e.test.mjs`, `test/browser/e2e/blog.test.js`,
    `test/serializer.test.js` to use the new serializer + async API.
  - 678 unit + 36 e2e + 21 browser tests all pass.

Documentation:
  - README.md, AGENTS.md, server README, website hero copy.
  - docs pages: server-actions, typescript, api-routes, backend-only,
    architecture, database, configuration, deployment, ai-first.

Versions:
  - `@webjskit/core`: 0.2.0 → 0.3.0 (new public exports)
  - `@webjskit/server`: 0.2.1 → 0.3.0 (removed dep, async json/serialize)
  - `@webjskit/cli`: 0.2.1 → 0.3.0 (server pin updated)

Author: vivek7405

AGENTS.md

@@ -197,8 +197,9 @@ inspired by NextJs, Lit, and Rails.
 - **Server actions with rich types.** Any file ending `.server.js` / `.server.ts`
   (or starting with `'use server'`) exports functions the client imports and
   calls directly — the import is rewritten into an RPC stub. The RPC wire uses
-  **superjson**, so `Date`, `Map`, `Set`, `BigInt`, `undefined`, `URL`, `RegExp`
-  round-trip as their real types.
+  webjs's built-in ESM serializer, so `Date`, `Map`, `Set`, `BigInt`,
+  `undefined`, `Error`, `TypedArray`, `ArrayBuffer`, `Blob`, `File`, `FormData`,
+  registered Symbols, and reference cycles all round-trip as their real types.
 - **Server-file source is unreachable from the browser (framework invariant).**
   The HTTP layer independently re-verifies every JS/TS request against the
   server-file predicate (filename suffix OR `'use server'` directive) before
@@ -256,7 +257,7 @@ node_modules/@webjskit/
       csrf.js                     ← double-submit CSRF protection
       websocket.js                ← WS route upgrade + attachWebSocket
       broadcast.js                ← broadcast() for fan-out messaging
-      serializer.js               ← pluggable wire format (superjson default)
+      serializer.js               ← pluggable wire format (webjs built-in default)
       check.js                    ← convention validator (webjs check)
       vendor.js                   ← auto-bundle npm deps for browser
       module-graph.js             ← dependency graph for transitive preloads
@@ -363,7 +364,7 @@ import { html, css, WebComponent, render, renderToString } from '@webjskit/core'
 | `repeat(items, k, t)` | Keyed list directive — `${repeat(items, it => it.id, it => html\`...\`)}`. Preserves element identity / focus when items reorder. |
 | `Suspense({fallback, children})` | Streaming boundary — server flushes `fallback` immediately, streams `children` (a Promise<TemplateResult>) when it resolves. |
 | `connectWS(url, handlers)` | Client-side WebSocket with auto-reconnect, JSON parse/stringify, queued sends. |
-| `richFetch<T>(url, init?)` | Client-side fetch that adds `Accept: application/vnd.webjs+json`, encodes plain-object bodies via superjson, and decodes responses with rich types. |
+| `richFetch<T>(url, init?)` | Client-side fetch that adds `Accept: application/vnd.webjs+json`, encodes plain-object bodies via webjs's built-in serializer, and decodes responses with rich types. |
 
 ### Directives — `import { … } from '@webjskit/core/directives'`
 
@@ -1438,12 +1439,15 @@ const r = await createPost({ title, body });
 if (r.success) r.data.title;   // ← PostFormatted.title: string
 ```
 
-**Runtime reality matches the types** because the RPC wire is superjson:
-a `Date` on the server is a `Date` on the client, a `Map` is a `Map`, a
-`BigInt` is a `BigInt`. Supported types: everything superjson handles
-(Date, Map, Set, BigInt, undefined, URL, RegExp, Error, Decimal, plus
-any custom transformer you register). Class instances come through as
-plain objects — prototypes are lost, methods don't survive.
+**Runtime reality matches the types** because the RPC wire uses webjs's
+built-in ESM serializer: a `Date` on the server is a `Date` on the client,
+a `Map` is a `Map`, a `BigInt` is a `BigInt`. Supported types: `Date`,
+`Map`, `Set`, `BigInt`, `Error`, `undefined`, `NaN`/`Infinity`/`-0`,
+`TypedArray` (Int8/Uint8/.../Float64), `ArrayBuffer`, `DataView`, `Blob`,
+`File`, `FormData`, `Symbol.for(...)` registered symbols, and reference
+cycles / shared refs. Class instances come through as plain objects —
+prototypes are lost, methods don't survive (matching React Server
+Actions' behavior).
 
 ### API routes — opt in via content negotiation
 
@@ -1466,12 +1470,12 @@ export async function GET() {
 import { richFetch } from '@webjskit/core';
 const posts = await richFetch<Post[]>('/api/posts');
 // posts[0].createdAt is a Date here (richFetch sends
-// Accept: application/vnd.webjs+json and superjson-parses the response).
+// Accept: application/vnd.webjs+json and parses the rich response).
 ```
 
 The `json()` helper reads the in-flight Request via the AsyncLocalStorage
 context:
-- `Accept: application/vnd.webjs+json` → superjson-encoded response,
+- `Accept: application/vnd.webjs+json` → encoded with the webjs serializer,
   `Content-Type: application/vnd.webjs+json`, `Vary: Accept` for
   correct shared-cache keying.
 - Otherwise → plain JSON with `Content-Type: application/json`.

README.md

@@ -15,7 +15,7 @@ TypeScript with zero build step, real SSR with Declarative Shadow DOM.
 - **No build step you run.** `.ts` files served directly. The dev server transforms TypeScript via esbuild for both server-side imports (SSR) and browser-bound modules (hydration) — same transformer for both, ~1ms/file, cached by mtime. Full TS feature support (enums, decorators, parameter properties — anything esbuild handles). Edit, refresh, done.
 - **Web components, light DOM by default.** Pages and components render as light DOM so global CSS and Tailwind utilities apply directly — no `::part`, no `:host`, no CSS-var plumbing. Shadow DOM is opt-in (`static shadow = true`) when you need scoped styles or real `<slot>` projection. Both modes SSR fully, no hydration runtime.
 - **Tailwind CSS by default.** The scaffold ships with the Tailwind browser runtime + `@theme` design tokens. Prefer hand-written CSS? Opt out entirely — the framework works just as well with vanilla CSS when you follow the wrapper-scoping convention (`.page-<route>`, `.layout-<name>`, component-tag scoped). Full recipe in the [Styling docs](./docs/app/docs/styling/page.ts).
-- **Full-stack type safety.** Import a `.server.ts` function from a component — TypeScript sees the real signature. superjson on the wire preserves `Date`, `Map`, `Set`, `BigInt`.
+- **Full-stack type safety.** Import a `.server.ts` function from a component — TypeScript sees the real signature. webjs's built-in ESM serializer on the wire preserves `Date`, `Map`, `Set`, `BigInt`, `TypedArray`, `Blob`, `File`, `FormData`, and reference cycles.
 - **Server-file source is unreachable from the browser.** Framework invariant: any file ending `.server.{js,ts}` or starting with `'use server'` is always served as an RPC stub, never its real source. Enforced in the HTTP layer with regression tests.
 - **NextJs-style routing.** `page.ts`, `layout.ts`, `route.ts`, `error.ts`, `middleware.ts`, `[params]`, `(groups)`, `_private`. Layouts persist across navigations.
 - **Client router.** Turbo-Drive-style link interception. Shadow-DOM-aware via `composedPath()`. Layouts stay mounted, only page content swaps. No white flash.
@@ -171,7 +171,7 @@ Pre-1.0. 632 unit tests (96.6% line coverage, 87.5% branch, 93.6% function),
 36 puppeteer e2e tests, 27 WTR browser tests. Key features:
 
 - **Core:** SSR with DSD (opt-in) + light-DOM hydration (default), fine-grained client renderer, `repeat()`, `Suspense()`, client router with `composedPath()` for shadow DOM, mixed-attribute interpolation, MutationObserver upgrade safety net
-- **Data:** server actions + superjson (Date/Map/Set/BigInt survive the wire), `expose()` for REST, `json()` + `richFetch()` for content-negotiated APIs, `cache()` for server-side query caching with TTL + `invalidate()`
+- **Data:** server actions with webjs's built-in serializer (Date/Map/Set/BigInt/TypedArray/Blob/File/FormData/cycles survive the wire), `expose()` for REST, `json()` + `richFetch()` for content-negotiated APIs, `cache()` for server-side query caching with TTL + `invalidate()`
 - **Server:** file router, per-segment middleware, `rateLimit()`, WebSockets + `broadcast()`, CSRF, compression, HTTP/2, 103 Early Hints, health probes, graceful shutdown, `Session` class with `SessionStorage` (cookie or store-backed), NextAuth-style `createAuth()` (Credentials, Google, GitHub)
 - **DX:** TypeScript with zero build, `AGENTS.md` contract, `CLAUDE.md`, live reload in dev, optional esbuild bundle for prod, `@webjskit/ts-plugin` for tsserver — tag-name and CSS-class-name go-to-definition inside `html\`\`` templates.
 

docs/app/docs/ai-first/page.ts

@@ -70,7 +70,7 @@ modules/posts/queries/get-post.server.ts      → exports getPost()</pre>
 export async function createPost(
   input: { title: string; body: string }
 ): Promise&lt;ActionResult&lt;PostFormatted&gt;&gt; { ... }</pre>
-    <p>The TypeScript signature IS the API contract. No separate schema file, no OpenAPI spec, no GraphQL SDL. The client component imports the function, TypeScript checks the types, and superjson preserves them on the wire. An AI agent can:</p>
+    <p>The TypeScript signature IS the API contract. No separate schema file, no OpenAPI spec, no GraphQL SDL. The client component imports the function, TypeScript checks the types, and webjs's built-in serializer preserves them on the wire. An AI agent can:</p>
     <ol>
       <li>Read the function signature to understand the API.</li>
       <li>Modify the function and know every call site that breaks (via tsc).</li>
@@ -134,7 +134,7 @@ Convention validator   ✅ webjs check ❌ none      ❌ none
 File = function        ✅ one/file   ⚠️ varies     ❌ free-form
 No build transforms    ✅ none       ❌ SWC/webpack ✅ none
 Explicit server bound. ✅ .server.ts ⚠️ 'use srv'  n/a
-Typed RPC (no schema)  ✅ superjson  ⚠️ Flight     ❌ manual
+Typed RPC (no schema)  ✅ rich types ⚠️ Flight     ❌ manual
 Autonomous mode        ✅ defaults   ❌ n/a        ❌ n/a</pre>
 
     <h2>The AGENTS.md File</h2>

docs/app/docs/api-routes/page.ts

@@ -97,7 +97,7 @@ export async function POST(req: Request) {
     <h2>json() Helper -- Content Negotiation</h2>
     <p>The <code>json()</code> helper from <code>@webjskit/server</code> adds smart content negotiation. It inspects the incoming request's <code>Accept</code> header and responds accordingly:</p>
     <ul>
-      <li>If the client sent <code>Accept: application/vnd.webjs+json</code> (e.g. via <code>richFetch()</code>), the response is encoded with <strong>superjson</strong> so that <code>Date</code>, <code>Map</code>, <code>Set</code>, and <code>BigInt</code> survive the round trip.</li>
+      <li>If the client sent <code>Accept: application/vnd.webjs+json</code> (e.g. via <code>richFetch()</code>), the response is encoded with the <strong>webjs serializer</strong> so that <code>Date</code>, <code>Map</code>, <code>Set</code>, <code>BigInt</code>, <code>TypedArray</code>, <code>Blob</code>, <code>File</code>, <code>FormData</code>, and reference cycles all survive the round trip.</li>
       <li>Otherwise, the response is plain <code>application/json</code> -- standard for curl, mobile apps, and third-party consumers.</li>
     </ul>
     <pre>// app/api/posts/route.ts
@@ -109,7 +109,7 @@ export async function GET() {
   });
   return json(posts);
   // External client:  plain JSON, createdAt is an ISO string
-  // richFetch client: superjson, createdAt is a real Date object
+  // richFetch client: rich types, createdAt is a real Date object
 }
 
 export async function POST(req: Request) {
@@ -120,7 +120,7 @@ export async function POST(req: Request) {
     <p>The helper reads the in-flight Request from an <code>AsyncLocalStorage</code> context set up by the request pipeline, so you do not need to pass the request explicitly.</p>
 
     <h2>readBody() -- Parsing Rich Request Bodies</h2>
-    <p>The <code>readBody()</code> helper from <code>@webjskit/server</code> is the inverse of <code>json()</code>. It parses the request body as superjson when the client sent the <code>application/vnd.webjs+json</code> content type, and as plain JSON otherwise:</p>
+    <p>The <code>readBody()</code> helper from <code>@webjskit/server</code> is the inverse of <code>json()</code>. It parses the request body with the webjs rich serializer when the client sent the <code>application/vnd.webjs+json</code> content type, and as plain JSON otherwise:</p>
     <pre>import { json, readBody } from '@webjskit/server';
 
 export async function POST(req: Request) {
@@ -132,7 +132,7 @@ export async function POST(req: Request) {
 }</pre>
 
     <h2>richFetch() -- Typed Client Calls</h2>
-    <p>On the client side, <code>richFetch()</code> from <code>webjs</code> is a drop-in replacement for <code>fetch()</code> that enables the superjson round trip:</p>
+    <p>On the client side, <code>richFetch()</code> from <code>webjs</code> is a drop-in replacement for <code>fetch()</code> that enables the rich-type round trip:</p>
     <pre>import { richFetch } from '@webjskit/core';
 
 // GET with rich types
@@ -143,7 +143,7 @@ const posts = await richFetch('/api/posts');
 const newPost = await richFetch('/api/posts', {
   method: 'POST',
   body: { title: 'Hello', publishAt: new Date(2026, 5, 1) },
-  // body is automatically superjson-stringified
+  // body is automatically encoded with the rich serializer
   // Content-Type is set to application/vnd.webjs+json
 });
 
@@ -158,8 +158,8 @@ try {
     <p><code>richFetch</code> automatically:</p>
     <ul>
       <li>Sets <code>Accept: application/vnd.webjs+json</code> on outgoing requests</li>
-      <li>If <code>body</code> is a plain object (not FormData, Blob, ArrayBuffer, or string), stringifies it with superjson and sets the content type</li>
-      <li>Parses the response with superjson when the server responds with the vendor content type, or with plain <code>JSON.parse</code> otherwise</li>
+      <li>If <code>body</code> is a plain object (not FormData, Blob, ArrayBuffer, or string), encodes it with the webjs serializer and sets the content type</li>
+      <li>Parses the response with the webjs serializer when the server responds with the vendor content type, or with plain <code>JSON.parse</code> otherwise</li>
       <li>Throws an <code>Error</code> with <code>.status</code> and <code>.body</code> properties for non-2xx responses</li>
     </ul>
 
@@ -354,8 +354,8 @@ export async function DELETE(_req: Request, { params }: Ctx) {
       <li>Handler signature: <code>(req: Request, { params }) =&gt; Response | object</code></li>
       <li>Dynamic params via <code>[slug]</code> folder names, catch-all via <code>[...rest]</code></li>
       <li>Return a <code>Response</code> for full control, or return a plain object for auto-JSON</li>
-      <li><code>json()</code> from <code>@webjskit/server</code> provides content negotiation (plain JSON vs superjson)</li>
-      <li><code>readBody()</code> parses incoming superjson or JSON based on content type</li>
+      <li><code>json()</code> from <code>@webjskit/server</code> provides content negotiation (plain JSON vs webjs rich JSON)</li>
+      <li><code>readBody()</code> parses incoming rich-format or plain JSON based on content type</li>
       <li><code>richFetch()</code> on the client for typed API calls with rich types</li>
       <li>Export <code>WS</code> from the same <code>route.ts</code> for WebSocket support</li>
       <li>Per-segment <code>middleware.ts</code> applies to all routes underneath</li>

docs/app/docs/architecture/page.ts

@@ -29,7 +29,8 @@ export default function Architecture() {
       <li><code>expose()</code> — tag an action for REST exposure</li>
       <li><code>notFound()</code> / <code>redirect()</code> — navigation sentinels</li>
       <li><code>connectWS()</code> — auto-reconnecting WebSocket client</li>
-      <li><code>richFetch()</code> — superjson-aware fetch wrapper</li>
+      <li><code>richFetch()</code> — rich-type-aware fetch wrapper</li>
+      <li><code>stringify()</code> / <code>parse()</code> — webjs's built-in serializer (Date, Map, Set, BigInt, TypedArray, Blob, File, FormData, cycles)</li>
     </ul>
 
     <h3>@webjskit/server</h3>

docs/app/docs/backend-only/page.ts

@@ -188,7 +188,7 @@ export function WS(ws: WebSocket, req: Request, { params }: { params: Record<
     <p>WebSocket endpoints coexist with HTTP handlers in the same <code>route.ts</code>. The second argument is a <code>Request</code> object from the upgrade handshake, so you can read cookies, headers, and query params for auth.</p>
 
     <h2>Content-Negotiated JSON</h2>
-    <p>Use the <code>json()</code> helper from <code>@webjskit/server</code> and the <code>richFetch()</code> client helper from <code>webjs</code> for superjson-encoded responses that preserve <code>Date</code>, <code>Map</code>, <code>Set</code>, and <code>BigInt</code>:</p>
+    <p>Use the <code>json()</code> helper from <code>@webjskit/server</code> and the <code>richFetch()</code> client helper from <code>webjs</code> for rich-encoded responses that preserve <code>Date</code>, <code>Map</code>, <code>Set</code>, <code>BigInt</code>, <code>TypedArray</code>, <code>Blob</code>, <code>File</code>, <code>FormData</code>, and reference cycles:</p>
     <pre>// app/api/events/route.ts
 import { json } from '@webjskit/server';
 
@@ -204,7 +204,7 @@ const events = await richFetch('/api/events');
 
 // External client (curl, Postman) gets plain JSON automatically
 // curl http://localhost:3000/api/events</pre>
-    <p>The <code>json()</code> helper reads the <code>Accept</code> header. If the client sent <code>Accept: application/vnd.webjs+json</code> (as <code>richFetch</code> does), the response is superjson-encoded. Otherwise, plain <code>application/json</code>. The <code>Vary: Accept</code> header is set automatically.</p>
+    <p>The <code>json()</code> helper reads the <code>Accept</code> header. If the client sent <code>Accept: application/vnd.webjs+json</code> (as <code>richFetch</code> does), the response is encoded with the webjs serializer. Otherwise, plain <code>application/json</code>. The <code>Vary: Accept</code> header is set automatically.</p>
     <p>For reading request bodies with the same content negotiation, use <code>readBody(req)</code> from <code>@webjskit/server</code>.</p>
 
     <h2>Health Probes, Graceful Shutdown, Compression</h2>
@@ -258,7 +258,7 @@ fastify.listen({ port: 3000 });</pre>
       <li><strong>File-based routing</strong> — no manual <code>app.get()</code> / <code>app.post()</code> registration. Drop a <code>route.ts</code> in a folder and it is live.</li>
       <li><strong>Nested middleware</strong> — middleware scoped to route subtrees, not global or per-route.</li>
       <li><strong>TypeScript first</strong> — no build step, no compilation, no config. <code>.ts</code> files run directly.</li>
-      <li><strong>superjson wire format</strong> — rich types survive <code>Date</code>/<code>Map</code>/<code>Set</code>/<code>BigInt</code> serialisation.</li>
+      <li><strong>Rich wire format</strong> — webjs's built-in serializer round-trips <code>Date</code>/<code>Map</code>/<code>Set</code>/<code>BigInt</code>/<code>TypedArray</code>/<code>Blob</code>/<code>File</code>/<code>FormData</code> and reference cycles.</li>
       <li><strong>WebSocket support</strong> — export a <code>WS</code> function from a route file, no separate setup.</li>
       <li><strong>Health probes</strong> — built-in, zero config.</li>
       <li><strong>expose()</strong> — turn server functions into REST endpoints with validation and CORS.</li>

docs/app/docs/configuration/page.ts

@@ -100,7 +100,7 @@ const resp = await app.handle(new Request('http://x/api/hello'));
       <li><strong>Routing conventions</strong> — <code>page.ts</code>, <code>layout.ts</code>, <code>route.ts</code>, <code>middleware.ts</code>, <code>error.ts</code>, <code>not-found.ts</code> are the file names. No aliases.</li>
       <li><strong>Shadow DOM by default</strong> — components use shadow DOM unless <code>static shadow = false</code>. No global opt-out.</li>
       <li><strong>CSRF on server actions</strong> — always on for <code>/__webjs/action/*</code> RPC. Can't disable.</li>
-      <li><strong>Import map</strong> — auto-generated. Maps <code>webjs</code> and <code>superjson</code> to framework-served URLs.</li>
+      <li><strong>Import map</strong> — auto-generated. Maps <code>@webjskit/core</code> sub-paths to framework-served URLs and any bare npm imports your client code uses to vendor bundles.</li>
     </ul>
   `;
 }