Blog
Posts on the design decisions, the trade-offs, the things that did not work, and what the framework looks like in production.
WebJs borrows file-based routing from Next.js, a component API shaped like Lit, and import maps from Rails, then diverges in exactly 24 documented places. Why an AI-first, no-build web components framework treats novelty as a cost, and what that buys a developer and an AI coding agent.
Strict Content-Security-Policy with a per-request nonce is the thing client-side routers classically break, because the browser keeps enforcing the original document's nonce. How WebJs keeps a strict CSP intact across soft navigations, with a header-enforced policy and a meta-tag nonce carrier the router re-stamps.
Most frameworks ask you to forget JavaScript and learn their abstractions. WebJs bets the opposite: native ES modules, real prototype-based classes, and a wire that speaks the full type system. A tour through the language fundamentals, framed by You Don't Know JS.
WebJs closed the last Next.js 15/16 file-routing parity gaps. forbidden() and unauthorized() control-flow throws, nearest-wins not-found boundaries, sync-or-await params, and an instrumentation.js boot hook, explained for anyone migrating from Next.js.
How WebJs sanitizes production server-action errors so a thrown action returns a generic message plus a digest instead of leaking a database string, internal IP, or filesystem path. Safe by default in prod, with a digest to keep debuggability.
WebJs now ships a declarative optimistic() API with full React 19 useOptimistic parity for Web Components. No try-catch, no manual state caching, no temp-id reconciliation. Just add, await, and reconcile.
How WebJs's client router prefetches links with a device-adaptive default: intent-based prefetch on desktop hover, dwell-gated viewport prefetch on mobile. Instant navigation without a bandwidth tax, tuned to the device, no import required.
In WebJs, pages and layouts never hydrate, so their JavaScript has no job in the browser. An import-only page or layout is dropped entirely and the boot ships just the interactive component leaves it imported. How it works, when a page still ships whole, and how to check.
WebJs strips the JavaScript for any component it can prove is display-only, so an islands app ships only its interactive leaves. How the elision analyser works, why it is conservative by construction, and how the invariant is enforced in code.
AI coding agents commit to main, skip tests, and ignore your conventions. WebJs is an AI-first framework that bakes those guardrails into tooling so drift is caught early.
How WebJs adds real-time features with WebSockets folded into the file router: a WS export in route.ts, connectWS with auto-reconnect and queued sends on the client, and a broadcast built-in for fan-out, no separate WebSocket server required.
Prisma vs Drizzle for a no-build framework. Why WebJs picked Drizzle ORM as the scaffold's default ORM, how the buildless, source-is-the-runtime model made the decision, and how to bring your own if you prefer Prisma.
A beginner guide to server-side caching in WebJs. Learn HTTP Cache-Control, the cache() helper, tag-based invalidation, and conditional GET with ETags and 304s.
In WebJs, progressive enhancement is the default architecture. Pages SSR and never hydrate, forms submit through server actions with JS off, and interactivity is opt-in.
How @webjsdev/ui ships accessible web components by default, with keyboard navigation, screen-reader labels, and focus management wired in from the start.
WebJs has no server/client component split, no Flight protocol, and no use client boundary. It gets await-data-in-the-leaf and typed server mutations from one RPC boundary instead. How the execution model works and why it drops the RSC machinery.
How WebJs attaches per-action middleware to a single server action for auth, rate-limit checks, logging, and tenant resolution. Declarative middleware that runs automatically on the RPC boundary, short-circuits cleanly, and feeds context via actionContext().
WebJs ships a read-only MCP server for AI coding agents. Learn how the Model Context Protocol lets Claude, Cursor, and other AI assistants read your app's real routes, actions, and components instead of guessing them.
WebJs wires the platform's own AbortSignal through the server-action RPC boundary in both directions, so a client that navigates away actually cancels the in-flight request and the server stops paying for work nobody is waiting for.
Make a server action cacheable in WebJs by declaring it a GET. Args ride the URL, it is CSRF-exempt, and a weak ETag answers 304 so repeat reads are nearly free.
Fix relative import paths for good using a path alias backed by the Node package.json imports field. WebJs aliases every top-level folder with no webpack and no tsconfig paths, resolved at runtime by Node 24+ and Bun with no build step.
How WebJs handles file uploads with a built-in FileStore and diskStore default: streaming multipart uploads, path-traversal-safe keys, signed URLs for private files, and an S3-ready swap that never touches your call sites.
End-to-end type safety in WebJs with no build TypeScript. Typed server actions flow the real function signature across the network boundary, so full-stack types are just a normal import, with no codegen and no compile step.
On Bun, WebJs serves through native Bun.serve instead of routing every request through Node's compatibility bridge. That is roughly 1.9x more requests per second on the listening path, at near-complete feature parity, with 103 Early Hints the one honest gap.
A no-build framework serves modules instead of bundling them, which risks a request waterfall. How WebJs stays fast with modulepreload over the vendor graph and HTTP/2.
The classic SSR double-fetch problem, where the server renders with data and the client hydrates and fetches the same data again. How WebJs eliminates it with automatic SSR action-result seeding, no props to pass down and no query-cache hydration boundary.
How WebJs does CSRF protection with a Sec-Fetch-Site and Origin check instead of a token cookie. CSRF without a token keeps your SSR pages same-origin safe and CDN-edge-cacheable, the modern browser-native approach explained for beginners.
WebJs dropped the better-sqlite3 native addon for the runtime's built-in SQLite: node:sqlite on Node 24+ and bun:sqlite on Bun. No node-gyp, no compile step, no prebuilt-binary roulette, and a pure Bun Docker image with no Node toolchain.
WebJs runs the same buildless source on Node 24+ and Bun. Adding the second runtime meant a runtime-neutral listener seam, two TypeScript strippers, and a parity test matrix that surfaced five genuine Node-versus-Bun divergences.
How to stream an LLM response token by token in WebJs by returning an async generator from a server action. Streaming server actions push each AI token over one RPC response, no WebSockets, no SSE, no hand-written ReadableStream plumbing.
How WebJs streams slow web components with <webjs-suspense> so the first byte flushes immediately, the fallback shows, and the slow data streams in over plain HTML with no RSC or Flight protocol, all while keeping progressive enhancement.
Web component data fetching without useEffect or a first-paint spinner. WebJs lets you await server data right inside async render(), so SSR bakes the data into the first paint, the client stays stale-while-revalidate, and there is no request waterfall.
How WebJs loads no-build npm packages by putting jspm.io CDN URLs directly in the import map, no esbuild bundler, matching Rails 7's importmap-rails, plus the SRI and CSP hardening that fell out.
Publishing an npm package taught me how the typosquatting similarity filter blocks names like wjs and webjscli, plus the create-* convention and what we shipped.
Why WebJs deleted its setState/this.state API and went all-in on TC39 Stage 1 Signals. What it broke, what shipped instead, and the breaking-change recipe.
What an AI-first framework actually means for WebJs: the AGENTS.md contract, hooks, lint rules, and operational details that make a codebase agent-readable.
WebJs ships built-in auth, sessions, cookies, caching, and rate limiting in @webjsdev/server, all sharing one cache store you can swap to Redis in one line.
How WebJs does client-side routing by default. SPA navigation with no full-page reload and no white flash, keeping nested layouts mounted across page changes.
WebJs ships its own web-component runtime whose public API mirrors Lit (reactive properties, the Lit lifecycle, lit-html directives), so Lit knowledge transfers with no Lit dependency. What that buys and what it costs.
File-based routing in WebJs copies Next.js app-router conventions verbatim: page, layout, route, and dynamic params, plus where WebJs diverges from it.
How WebJs serves buildless TypeScript by stripping types at runtime with Node 24's module.stripTypeScriptTypes instead of esbuild, with no sourcemaps needed.
Light-DOM slots in web components with full shadow-DOM parity. WebJs ships named slots, fallback content, assignedNodes, and slotchange with no shadow DOM required.
Why WebJs keeps the light-DOM default for web components. Tailwind and global CSS cascade in, DOM queries work, accessibility behaves, and tests need no shadow-piercing helpers. Shadow DOM stays an opt-in.
WebJs is a no-build, web-components-first full-stack framework that stays close to web standards, with a Next.js-style developer experience. AI-first.
