Guides

Start

• Dusk: Build a full-stack ShadowJS app with file routes, loaders, server functions and a secure request handler, and learn what runs on the server and what in the browser.

Routes and data

• Routing and data: File routes, layouts and API routes, then loaders, the document head, redirects, errors and not-found, navigation and preloading.
• Server functions: Write functions that run on the server, call them from loaders and the browser, validate input, add middleware, and see what the build keeps out of client bundles.
• Mutations, forms and results: Submit forms and server functions with one mutation model, read the outcome in the page, work without JavaScript and show deferred data with Await.
• Real time: Choose between typed streaming server functions, server-sent events and WebSocket routes, and configure their auth, limits, heartbeats and scale-out.
• The response from a component, a loader or middleware: useResponse sets the status, headers and cookies of a page's response from render, a loader or middleware, and what can still change after the first byte.

Pages

• Images, scripts and islands: Responsive images with an optimizer, scripts with loading strategies, a nonce and callbacks, and islands that hydrate server markup on a directive.
• Metadata, head and metadata routes: Export metadata and viewport from routes and layouts, serve sitemap, robots and manifest, and draw social images.

Ship it

• Configuration with dusk.config.ts: The declarative configuration of a Dusk app (routing rules, headers, security, env, caching, draft mode, instrumentation) and the order in which the rules apply.
• Deploy: Build a Dusk app, run it with the Node server, put it in a container or behind a proxy, export it as static files, and wire up logging, health checks and graceful shutdown.
• Security: What the request handler does with no configuration, how to configure headers, CSP, CSRF, cookies, sessions, rate limits and hosts, and a production checklist.
• Sign-in with OAuth and OpenID Connect: Sign users in with any OpenID Connect or OAuth 2.0 provider using the authorization code flow with PKCE, with ID token checks, refresh tokens, logout and a route guard.
• Auth.js and better-auth: Use Auth.js or better-auth in a Dusk app, mounted as an API route, with the same requireUser guard as the built-in OpenID Connect client.
• Databases: Connect a database from server functions and loaders, with examples for Drizzle on libSQL and Turso, for Supabase, and a Prisma setup.
• Installable apps and offline: pwa() writes the web app manifest, an offline page and a service worker from the build; caching rules per route, and what is never kept.