react_on_rails 16.0.1.rc.2 → 16.0.1.rc.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 447fa3382ac19a61525d8e17f67534ed0d6243cb8352512bae81b002165aef9b
-  data.tar.gz: 26b1a80ba765de1cf379e7fddc7adda75de353c39fea0a8c8965d314099d1b91
+  metadata.gz: 1866bb608bf6b62df70e1ebb9e708596b59f620d08311ea8116e534bdb1180be
+  data.tar.gz: bc7ad5c8cca569395d3da1db1e3ee3d9a0f3a986ac8777eadae28b06d8514e6a
 SHA512:
-  metadata.gz: ee112925a900c99b9b060e4eccf6fa18b5e249d2993b66d1a5b9ead17e989693d3dd512049a2276663616f9edb792b940f23334a600f56a4888deab47ea57ca2
-  data.tar.gz: dc7ba94789cfda1fcfce115d6db988b523810ed146d1db71d72d5942e920c7abf798317f8644ddc2e18dead08c4eacce62fb4b1a8c7ea751caaf63c85f40d35c
+  metadata.gz: 5d5651560869dc69bb9a7ce4f1d5666b7cc10c3fa84827087aa9c1c2c7afb20100eee674ca2b906ca3fec49ca4558af111c38558104976ad49290e07a0751b9a
+  data.tar.gz: 1cabd8aea0ef8545861f325494c6c051550a463ec73d9e206dfb8548060db0c8fe78bde5359e1ce921d787c9d99ad3961858e9a5ab81d7ae9e490b150ed32cd2

data/CHANGELOG.md

@@ -23,9 +23,59 @@ After a release, please make sure to run `bundle exec rake update_changelog`. Th
 
 Changes since the last non-beta release.
 
+#### Breaking Changes
+
+- **Removed `generated_assets_dirs` configuration**: The legacy `config.generated_assets_dirs` option is no longer supported and will raise an error if used. Since Shakapacker is now required, asset paths are automatically determined from `shakapacker.yml` configuration. Remove any `config.generated_assets_dirs` from your `config/initializers/react_on_rails.rb` file. Use `public_output_path` in `config/shakapacker.yml` to customize asset output location instead. [PR 1798](https://github.com/shakacode/react_on_rails/pull/1798)
+
+#### New Features
+
+- **Server Bundle Security**: Added new configuration options for enhanced server bundle security and organization:
+
+  - `server_bundle_output_path`: Configurable directory (relative to the Rails root) for server bundle output (default: "ssr-generated"). If set to `nil`, the server bundle will be loaded from the same public directory as client bundles.
+  - `enforce_private_server_bundles`: When enabled, ensures server bundles are only loaded from private directories outside the public folder (default: false for backward compatibility)
+
+- **Improved Bundle Path Resolution**: Bundle path resolution for server bundles now works as follows:
+  - If `server_bundle_output_path` is set, the server bundle is loaded from that directory.
+  - If `server_bundle_output_path` is not set, the server bundle falls back to the client bundle directory (typically the public output path).
+  - If `enforce_private_server_bundles` is enabled:
+    - The server bundle will only be loaded from the private directory specified by `server_bundle_output_path`.
+    - If the bundle is not found there, it will _not_ fall back to the public directory.
+  - If `enforce_private_server_bundles` is not enabled and the bundle is not found in the private directory, it will fall back to the public directory.
+  - This logic ensures that, when strict enforcement is enabled, server bundles are never loaded from public directories, improving security and clarity of bundle resolution.
+
+#### API Improvements
+
+- **Method Naming Clarification**: Added `public_bundles_full_path` method to clarify bundle path handling:
+  - `public_bundles_full_path`: New method specifically for webpack bundles in public directories
+  - `generated_assets_full_path`: Now deprecated (backwards-compatible alias)
+  - This eliminates confusion between webpack bundles and general Rails public assets
+
+#### Security Enhancements
+
+- **Private Server Bundle Enforcement**: When `enforce_private_server_bundles` is enabled, server bundles bypass public directory fallbacks and are only loaded from designated private locations
+- **Path Validation**: Added validation to ensure `server_bundle_output_path` points to private directories when enforcement is enabled
+
+#### Bug Fixes
+
+- **Non-Packer Environment Compatibility**: Fixed potential NoMethodError when using bundle path resolution in environments without Shakapacker
+- **Shakapacker version requirements**: Fixed inconsistent version requirements between basic pack generation (6.5.1+) and advanced auto-bundling features (7.0.0+). Added backward compatibility for users on Shakapacker 6.5.1-6.9.x while providing clear upgrade guidance for advanced features. Added new constants `MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_BUNDLING` and improved version checking performance with caching. [PR 1798](https://github.com/shakacode/react_on_rails/pull/1798)
+
+### [16.0.1-rc.2] - 2025-09-20
+
+#### Bug Fixes
+
+- **Packs generator**: Fixed error when `server_bundle_js_file` configuration is empty (default). Added safety check to prevent attempting operations on invalid file paths when server-side rendering is not configured. [PR 1802](https://github.com/shakacode/react_on_rails/pull/1802)
+
+### [16.0.1-rc.2] - 2025-09-20
+
 #### Bug Fixes
 
 - **Doctor rake task**: Fixed LoadError in `rake react_on_rails:doctor` when using packaged gem. The task was trying to require excluded `rakelib/task_helpers` file. [PR 1795](https://github.com/shakacode/react_on_rails/pull/1795)
+- **Shakapacker version requirements**: Fixed inconsistent version requirements between basic pack generation (6.5.1+) and advanced auto-registration features (7.0.0+). Added backward compatibility for users on Shakapacker 6.5.1-6.9.x while providing clear upgrade guidance for advanced features. Added new constants `MINIMUM_SHAKAPACKER_VERSION_FOR_AUTO_REGISTRATION` and improved version checking performance with caching. [PR 1798](https://github.com/shakacode/react_on_rails/pull/1798)
+
+#### Code Cleanup
+
+- **PackerUtils abstraction removal**: Removed unnecessary `PackerUtils.packer` abstraction method and replaced all calls with direct `::Shakapacker` usage. This simplifies the codebase by eliminating an abstraction layer that was originally created to support multiple webpack tools but is no longer needed since we only support Shakapacker. All tests updated accordingly. [PR 1798](https://github.com/shakacode/react_on_rails/pull/1798) by [claude-code](https://claude.ai/code)
 
 ### [16.0.1-rc.0] - 2025-09-19
 
@@ -1652,7 +1702,8 @@ such as:
 
 - Fix several generator-related issues.
 
-[Unreleased]: https://github.com/shakacode/react_on_rails/compare/16.0.1-rc.0...master
+[Unreleased]: https://github.com/shakacode/react_on_rails/compare/16.0.1-rc.2...master
+[16.0.1-rc.2]: https://github.com/shakacode/react_on_rails/compare/16.0.1-rc.0...16.0.1-rc.2
 [16.0.1-rc.0]: https://github.com/shakacode/react_on_rails/compare/16.0.0...16.0.1-rc.0
 [16.0.0]: https://github.com/shakacode/react_on_rails/compare/14.2.0...16.0.0
 [14.2.0]: https://github.com/shakacode/react_on_rails/compare/14.1.1...14.2.0

data/CLAUDE.md

@@ -9,7 +9,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 1. **ALWAYS run `bundle exec rubocop` and fix ALL violations**
 2. **ALWAYS ensure files end with a newline character**
 3. **NEVER push without running full lint check first**
-4. **ALWAYS let Prettier handle ALL formatting - never manually format**
+4. **ALWAYS let Prettier and RuboCop handle ALL formatting - never manually format**
 
 These requirements are non-negotiable. CI will fail if not followed.
 
@@ -39,10 +39,11 @@ Git hooks will automatically run linting on **all changed files (staged + unstag
 - **Build**: `yarn run build` (compiles TypeScript to JavaScript in node_package/lib)
 - **Type checking**: `yarn run type-check`
 - **⚠️ MANDATORY BEFORE GIT PUSH**: `bundle exec rubocop` and fix ALL violations + ensure trailing newlines
+- Never run `npm` commands, only equivalent Yarn Classic ones
 
 ## ⚠️ FORMATTING RULES
 
-**Prettier is the SOLE authority for formatting. NEVER manually format code.**
+**Prettier is the SOLE authority for formatting non-Ruby files, and RuboCop for formatting Ruby files. NEVER manually format code.**
 
 ### Standard Workflow
 1. Make code changes
@@ -120,10 +121,10 @@ This project maintains both a Ruby gem and an NPM package:
 ## Important Notes
 
 - Use `yalc` for local development when testing with external apps
-- The project supports both Webpacker and Shakapacker
 - Server-side rendering uses isolated Node.js processes
 - React Server Components support available in Pro version
 - Generated examples are in `gen-examples/` (ignored by git)
+- Only use `yarn` as the JS package manager, never `npm`
 
 ## IDE Configuration
 

data/CODING_AGENTS.md

@@ -30,6 +30,7 @@ cd spec/dummy && foreman start       # Start dummy app with webpack
 - [ ] No trailing whitespace
 - [ ] Line length ≤120 characters
 - [ ] Security violations properly scoped with disable comments
+- [ ] No `package-lock.json` or other non-Yarn lock files (except `Gemfile.lock`)
 
 ## Development Patterns for AI Contributors
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    react_on_rails (16.0.1.rc.0)
+    react_on_rails (16.0.1.rc.4)
       addressable
       connection_pool
       execjs (~> 2.5)

data/NEWS.md

@@ -21,7 +21,7 @@ _A history of the news. A few bullets at the top will also show on the [README.m
 - 2017-04-09: 8.0.0 beta work to include webpacker_lite gem has begun. See [#786](https://github.com/shakacode/react_on_rails/issues/786).
 - 2017-04-03: 6.9.3 Released! Props rendered in JSON script tag. Page size is smaller now due to less escaping!
 - 2017-03-06: Updated to Webpack v2!
-- 2017-03-02: Demo of internationalization (i18n) is live at [reactrails.com](https://www.reactrails.com/). Docs [here](docs/guides/i18n.md).
+- 2017-03-02: Demo of internationalization (i18n) is live at [reactrails.com](https://reactrails.com/). Docs [here](docs/guides/i18n.md).
 - 2017-02-28: See [discussions here on Webpacker](https://github.com/rails/webpacker/issues/139) regarding how Webpacker will allow React on Rails to avoid using the asset pipeline in the near future.
 - 2017-02-28: Upgrade to Webpack v2 or use the `--bail` option in your Webpack script for test and production builds. See the discussion on [PR #730](https://github.com/shakacode/react_on_rails/pull/730).
 - 2016-11-03: Spoke at [LA Ruby: "React on Rails: Why, What, and How?"](http://www.meetup.com/laruby/events/234825187/). [Video and pictures in this article](https://blog.shakacode.com/my-react-on-rails-talk-at-the-la-ruby-rails-meetup-november-10-2016-eaaa83aff800#.ej6h4eglp).

data/README.md

@@ -140,16 +140,21 @@ _Requires creating a free account._
 - Node.js >= 20 (CI tested: 20 - 22)
 - A JavaScript package manager (npm, yarn, pnpm, or bun)
 
-# Support
+# 🆘 Get Help & Support
 
-- [Click to join **React + Rails Slack**](https://join.slack.com/t/reactrails/shared_invite/zt-38oicm9d0-OO0V~bdg4aYNuZuUbRFSXg).
+**Need immediate help?** Here are your options, ordered by response time:
 
-- [**Subscribe**](https://app.mailerlite.com/webforms/landing/l1d9x5) for announcements of new releases of React on Rails and of our latest [blog articles](https://blog.shakacode.com) and tutorials.
-- [Discussions](https://github.com/shakacode/react_on_rails/discussions): Post your questions regarding React on Rails
-- **[forum.shakacode.com](https://forum.shakacode.com)**: Other discussions
-- **[@railsonmaui on Twitter](https://twitter.com/railsonmaui)**
-- _See [NEWS.md](https://github.com/shakacode/react_on_rails/tree/master/NEWS.md) for more notes over time._
-- See [Projects](https://github.com/shakacode/react_on_rails/tree/master/PROJECTS.md) using and [KUDOS](https://github.com/shakacode/react_on_rails/tree/master/KUDOS.md) for React on Rails. Please submit yours! Please edit either page or [email us](mailto:contact@shakacode.com) and we'll add your info. We also **love stars** as it helps us attract new users and contributors.
+- 🚀 **Professional Support**: [react_on_rails@shakacode.com](mailto:react_on_rails@shakacode.com) - Fastest resolution for bugs, upgrades, and consulting
+- 💬 **React + Rails Slack**: [Join our community](https://invite.reactrails.com) - Chat with other developers
+- 🆓 **GitHub Issues**: [Report bugs](https://github.com/shakacode/react_on_rails/issues) - Community support
+- 📖 **Discussions**: [Ask questions](https://github.com/shakacode/react_on_rails/discussions) - General help
+
+**Additional Resources:**
+
+- [**Subscribe**](https://app.mailerlite.com/webforms/landing/l1d9x5) for announcements of new releases and tutorials
+- **[forum.shakacode.com](https://forum.shakacode.com)** - Development discussions
+- **[@railsonmaui on Twitter](https://twitter.com/railsonmaui)** - Updates and tips
+- [Projects using React on Rails](https://github.com/shakacode/react_on_rails/tree/master/PROJECTS.md) - Submit yours!
 
 ## Contributing
 
@@ -163,6 +168,8 @@ ShakaCode is **[hiring passionate software engineers](http://www.shakacode.com/c
 
 The gem is available as open source under the terms of the [MIT License](https://github.com/shakacode/react_on_rails/tree/master/LICENSE.md).
 
+Note, some features are available only with a React on Rails Pro subscription. See [React on Rails Pro](https://www.shakacode.com/react-on-rails-pro/) for more information.
+
 # Supporters
 
 The following companies support our open-source projects, and ShakaCode uses their products!

data/lib/generators/react_on_rails/base_generator.rb

@@ -24,7 +24,7 @@ module ReactOnRails
       end
 
       def create_react_directories
-        # Create auto-registration directory structure for non-Redux components only
+        # Create auto-bundling directory structure for non-Redux components only
         # Redux components handle their own directory structure
         return if options.redux?
 
@@ -41,7 +41,7 @@ module ReactOnRails
         base_templates = %w[config/initializers/react_on_rails.rb]
         base_files.each { |file| copy_file("#{base_path}#{file}", file) }
         base_templates.each do |file|
-          template("#{base_path}/#{file}.tt", file, { packer_type: ReactOnRails::PackerUtils.packer_type })
+          template("#{base_path}/#{file}.tt", file)
         end
       end
 
@@ -95,55 +95,22 @@ module ReactOnRails
         run "bundle"
       end
 
-      def add_js_dependencies
-        add_react_on_rails_package
-        add_react_dependencies
-        add_css_dependencies
-        add_dev_dependencies
-      end
-
-      def install_js_dependencies
-        # Detect which package manager to use
-        success = if File.exist?(File.join(destination_root, "yarn.lock"))
-                    system("yarn", "install")
-                  elsif File.exist?(File.join(destination_root, "pnpm-lock.yaml"))
-                    system("pnpm", "install")
-                  elsif File.exist?(File.join(destination_root, "package-lock.json")) ||
-                        File.exist?(File.join(destination_root, "package.json"))
-                    # Use npm for package-lock.json or as default fallback
-                    system("npm", "install")
-                  else
-                    true # No package manager detected, skip
-                  end
-
-        unless success
-          GeneratorMessages.add_warning(<<~MSG.strip)
-            ⚠️  JavaScript dependencies installation failed.
-
-            This could be due to network issues or missing package manager.
-            You can install dependencies manually later by running:
-            • npm install (if using npm)
-            • yarn install (if using yarn)
-            • pnpm install (if using pnpm)
-          MSG
-        end
-
-        success
-      end
-
       def update_gitignore_for_auto_registration
         gitignore_path = File.join(destination_root, ".gitignore")
         return unless File.exist?(gitignore_path)
 
         gitignore_content = File.read(gitignore_path)
-        return if gitignore_content.include?("**/generated/**")
 
-        append_to_file ".gitignore" do
-          <<~GITIGNORE
+        additions = []
+        additions << "**/generated/**" unless gitignore_content.include?("**/generated/**")
+        additions << "ssr-generated" unless gitignore_content.include?("ssr-generated")
+
+        return if additions.empty?
 
-            # Generated React on Rails packs
-            **/generated/**
-          GITIGNORE
+        append_to_file ".gitignore" do
+          lines = ["\n# Generated React on Rails packs"]
+          lines.concat(additions)
+          "#{lines.join("\n")}\n"
         end
       end
 
@@ -157,6 +124,28 @@ module ReactOnRails
         end
       end
 
+      CONFIGURE_RSPEC_TO_COMPILE_ASSETS = <<-STR.strip_heredoc
+        RSpec.configure do |config|
+          # Ensure that if we are running js tests, we are using latest webpack assets
+          # This will use the defaults of :js and :server_rendering meta tags
+          ReactOnRails::TestHelper.configure_rspec_to_compile_assets(config)
+        end
+      STR
+
+      private
+
+      def setup_js_dependencies
+        add_js_dependencies
+        install_js_dependencies
+      end
+
+      def add_js_dependencies
+        add_react_on_rails_package
+        add_react_dependencies
+        add_css_dependencies
+        add_dev_dependencies
+      end
+
       def add_react_on_rails_package
         major_minor_patch_only = /\A\d+\.\d+\.\d+\z/
 
@@ -219,15 +208,34 @@ module ReactOnRails
         handle_npm_failure("development dependencies", dev_deps, dev: true) unless success
       end
 
-      CONFIGURE_RSPEC_TO_COMPILE_ASSETS = <<-STR.strip_heredoc
-        RSpec.configure do |config|
-          # Ensure that if we are running js tests, we are using latest webpack assets
-          # This will use the defaults of :js and :server_rendering meta tags
-          ReactOnRails::TestHelper.configure_rspec_to_compile_assets(config)
+      def install_js_dependencies
+        # Detect which package manager to use
+        success = if File.exist?(File.join(destination_root, "yarn.lock"))
+                    system("yarn", "install")
+                  elsif File.exist?(File.join(destination_root, "pnpm-lock.yaml"))
+                    system("pnpm", "install")
+                  elsif File.exist?(File.join(destination_root, "package-lock.json")) ||
+                        File.exist?(File.join(destination_root, "package.json"))
+                    # Use npm for package-lock.json or as default fallback
+                    system("npm", "install")
+                  else
+                    true # No package manager detected, skip
+                  end
+
+        unless success
+          GeneratorMessages.add_warning(<<~MSG.strip)
+            ⚠️  JavaScript dependencies installation failed.
+
+            This could be due to network issues or missing package manager.
+            You can install dependencies manually later by running:
+            • npm install (if using npm)
+            • yarn install (if using yarn)
+            • pnpm install (if using pnpm)
+          MSG
         end
-      STR
 
-      private
+        success
+      end
 
       def handle_npm_failure(dependency_type, packages, dev: false)
         install_command = dev ? "npm install --save-dev" : "npm install"

data/lib/generators/react_on_rails/install_generator.rb

@@ -40,7 +40,9 @@ module ReactOnRails
         if installation_prerequisites_met? || options.ignore_warnings?
           invoke_generators
           add_bin_scripts
-          add_post_install_message
+          # Only add the post install message if not using Redux
+          # Redux generator handles its own messages
+          add_post_install_message unless options.redux?
         else
           error = <<~MSG.strip
             🚫 React on Rails generator prerequisites not met!
@@ -77,6 +79,14 @@ module ReactOnRails
         else
           invoke "react_on_rails:react_no_redux", [], { typescript: options.typescript? }
         end
+        setup_react_dependencies
+      end
+
+      def setup_react_dependencies
+        @added_dependencies_to_package_json ||= false
+        @ran_direct_installs ||= false
+        add_js_dependencies
+        install_js_dependencies if @added_dependencies_to_package_json && !@ran_direct_installs
       end
 
       # NOTE: other requirements for existing files such as .gitignore or application.
@@ -410,6 +420,134 @@ module ReactOnRails
         puts Rainbow("✅ Created tsconfig.json").green
       end
 
+      def add_js_dependencies
+        add_react_on_rails_package
+        add_react_dependencies
+        add_css_dependencies
+        add_dev_dependencies
+      end
+
+      def add_react_on_rails_package
+        major_minor_patch_only = /\A\d+\.\d+\.\d+\z/
+
+        # Try to use package_json gem first, fall back to direct npm commands
+        react_on_rails_pkg = if ReactOnRails::VERSION.match?(major_minor_patch_only)
+                               ["react-on-rails@#{ReactOnRails::VERSION}"]
+                             else
+                               puts "Adding the latest react-on-rails NPM module. " \
+                                    "Double check this is correct in package.json"
+                               ["react-on-rails"]
+                             end
+
+        puts "Installing React on Rails package..."
+        if add_npm_dependencies(react_on_rails_pkg)
+          @added_dependencies_to_package_json = true
+          return
+        end
+
+        puts "Using direct npm commands as fallback"
+        success = system("npm", "install", *react_on_rails_pkg)
+        @ran_direct_installs = true if success
+        handle_npm_failure("react-on-rails package", react_on_rails_pkg) unless success
+      end
+
+      def add_react_dependencies
+        puts "Installing React dependencies..."
+        react_deps = %w[
+          react
+          react-dom
+          @babel/preset-react
+          prop-types
+          babel-plugin-transform-react-remove-prop-types
+          babel-plugin-macros
+        ]
+        if add_npm_dependencies(react_deps)
+          @added_dependencies_to_package_json = true
+          return
+        end
+
+        success = system("npm", "install", *react_deps)
+        @ran_direct_installs = true if success
+        handle_npm_failure("React dependencies", react_deps) unless success
+      end
+
+      def add_css_dependencies
+        puts "Installing CSS handling dependencies..."
+        css_deps = %w[
+          css-loader
+          css-minimizer-webpack-plugin
+          mini-css-extract-plugin
+          style-loader
+        ]
+        if add_npm_dependencies(css_deps)
+          @added_dependencies_to_package_json = true
+          return
+        end
+
+        success = system("npm", "install", *css_deps)
+        @ran_direct_installs = true if success
+        handle_npm_failure("CSS dependencies", css_deps) unless success
+      end
+
+      def add_dev_dependencies
+        puts "Installing development dependencies..."
+        dev_deps = %w[
+          @pmmmwh/react-refresh-webpack-plugin
+          react-refresh
+        ]
+        if add_npm_dependencies(dev_deps, dev: true)
+          @added_dependencies_to_package_json = true
+          return
+        end
+
+        success = system("npm", "install", "--save-dev", *dev_deps)
+        @ran_direct_installs = true if success
+        handle_npm_failure("development dependencies", dev_deps, dev: true) unless success
+      end
+
+      def install_js_dependencies
+        # Detect which package manager to use
+        success = if File.exist?(File.join(destination_root, "yarn.lock"))
+                    system("yarn", "install")
+                  elsif File.exist?(File.join(destination_root, "pnpm-lock.yaml"))
+                    system("pnpm", "install")
+                  elsif File.exist?(File.join(destination_root, "package-lock.json")) ||
+                        File.exist?(File.join(destination_root, "package.json"))
+                    # Use npm for package-lock.json or as default fallback
+                    system("npm", "install")
+                  else
+                    true # No package manager detected, skip
+                  end
+
+        unless success
+          GeneratorMessages.add_warning(<<~MSG.strip)
+            ⚠️  JavaScript dependencies installation failed.
+
+            This could be due to network issues or missing package manager.
+            You can install dependencies manually later by running:
+            • npm install (if using npm)
+            • yarn install (if using yarn)
+            • pnpm install (if using pnpm)
+          MSG
+        end
+
+        success
+      end
+
+      def handle_npm_failure(dependency_type, packages, dev: false)
+        install_command = dev ? "npm install --save-dev" : "npm install"
+        GeneratorMessages.add_warning(<<~MSG.strip)
+          ⚠️  Failed to install #{dependency_type}.
+
+          The following packages could not be installed automatically:
+          #{packages.map { |pkg| "  • #{pkg}" }.join("\n")}
+
+          This could be due to network issues or missing package manager.
+          You can install them manually later by running:
+            #{install_command} #{packages.join(' ')}
+        MSG
+      end
+
       # Removed: Shakapacker auto-installation logic (now explicit dependency)
 
       # Removed: Shakapacker 8+ is now required as explicit dependency

data/lib/generators/react_on_rails/react_with_redux_generator.rb

@@ -19,7 +19,7 @@ module ReactOnRails
                    aliases: "-T"
 
       def create_redux_directories
-        # Create auto-registration directory structure for Redux
+        # Create auto-bundling directory structure for Redux
         empty_directory("app/javascript/src/HelloWorldApp/ror_components")
 
         # Create Redux support directories within the component directory
@@ -31,7 +31,7 @@ module ReactOnRails
         base_js_path = "redux/base"
         ext = component_extension(options)
 
-        # Copy Redux-connected component to auto-registration structure
+        # Copy Redux-connected component to auto-bundling structure
         copy_file("#{base_js_path}/app/javascript/bundles/HelloWorld/startup/HelloWorldApp.client.#{ext}",
                   "app/javascript/src/HelloWorldApp/ror_components/HelloWorldApp.client.#{ext}")
         copy_file("#{base_js_path}/app/javascript/bundles/HelloWorld/startup/HelloWorldApp.server.#{ext}",
@@ -89,6 +89,13 @@ module ReactOnRails
         install_packages_with_fallback(regular_packages, dev: false, package_manager: package_manager)
       end
 
+      def add_redux_specific_messages
+        # Append Redux-specific post-install instructions
+        GeneratorMessages.add_info(
+          GeneratorMessages.helpful_message_after_installation(component_name: "HelloWorldApp", route: "hello_world")
+        )
+      end
+
       private
 
       def install_packages_with_fallback(packages, dev:, package_manager:)
@@ -132,14 +139,6 @@ module ReactOnRails
         when "yarn", "bun" then "--dev"
         end
       end
-
-      def add_redux_specific_messages
-        # Override the generic messages with Redux-specific instructions
-        GeneratorMessages.output.clear
-        GeneratorMessages.add_info(
-          GeneratorMessages.helpful_message_after_installation(component_name: "HelloWorldApp", route: "hello_world")
-        )
-      end
     end
   end
 end

data/lib/generators/react_on_rails/templates/base/base/config/initializers/react_on_rails.rb.tt

@@ -24,8 +24,8 @@ ReactOnRails.configure do |config|
   # to automatically refresh your webpack assets on every test run.
   #
   # Alternately, you can remove the `ReactOnRails::TestHelper.configure_rspec_to_compile_assets`
-  # and set the config/<%= config[:packer_type] %>.yml option for test to true.
-  config.build_test_command = "RAILS_ENV=test bin/<%= config[:packer_type] %>"
+  # and set the config/shakapacker.yml option for test to true.
+  config.build_test_command = "RAILS_ENV=test bin/shakapacker"
 
   ################################################################################
   ################################################################################
@@ -43,6 +43,15 @@ ReactOnRails.configure do |config|
   #
   config.server_bundle_js_file = "server-bundle.js"
 
+  # Configure where server bundles are output. Defaults to "ssr-generated".
+  # This should match your webpack configuration for server bundles.
+  config.server_bundle_output_path = "ssr-generated"
+
+  # Enforce that server bundles are only loaded from private (non-public) directories.
+  # When true, server bundles will only be loaded from the configured server_bundle_output_path.
+  # This is recommended for production to prevent server-side code from being exposed.
+  config.enforce_private_server_bundles = true
+
   ################################################################################
   ################################################################################
   # FILE SYSTEM BASED COMPONENT REGISTRY

data/lib/generators/react_on_rails/templates/base/base/config/webpack/serverWebpackConfig.js.tt

@@ -44,13 +44,14 @@ const configureServer = () => {
 
   // Custom output for the server-bundle that matches the config in
   // config/initializers/react_on_rails.rb
+  // Server bundles are output to a private directory (not public) for security
   serverWebpackConfig.output = {
     filename: 'server-bundle.js',
     globalObject: 'this',
     // If using the React on Rails Pro node server renderer, uncomment the next line
     // libraryTarget: 'commonjs2',
-    path: config.outputPath,
-    publicPath: config.publicPath,
+    path: require('path').resolve(__dirname, '../../ssr-generated'),
+    // No publicPath needed since server bundles are not served via web
     // https://webpack.js.org/configuration/output/#outputglobalobject
   };