@decocms/tanstack 7.20.5 → 7.20.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/tanstack",
-  "version": "7.20.5",
+  "version": "7.20.7",
   "type": "module",
   "description": "Deco framework binding for TanStack Start + Cloudflare Workers",
   "repository": {
@@ -24,9 +24,9 @@
     "lint:unused": "knip"
   },
   "dependencies": {
-    "@decocms/blocks": "7.20.5",
-    "@decocms/blocks-admin": "7.20.5",
-    "@decocms/blocks-cli": "7.20.5",
+    "@decocms/blocks": "7.20.7",
+    "@decocms/blocks-admin": "7.20.7",
+    "@decocms/blocks-cli": "7.20.7",
     "@deco-cx/warp-node": "^0.3.16",
     "fast-json-patch": "^3.1.0",
     "ws": "^8.18.0"

package/src/vite/plugin.js

@@ -19,6 +19,15 @@
  *   it on the client cuts a typically-large module out of the browser bundle.
  *   Match is done by substring on the import id, so any path style works.
  *
+ * loaders.gen.ts handling:
+ *   The site invoke registry (`export const siteLoaders`) registers every site
+ *   loader/action behind a dynamic `import()`. It is reachable from the client
+ *   entry (router -> setup -> commerce-loaders -> loaders.gen), so without a stub
+ *   Vite emits each loader/action module as a public client chunk — leaking the
+ *   module source (including any hardcoded credential) into the browser assets.
+ *   Invoke runs server-side only, so the client never needs it. Stubbed to an
+ *   empty object on the client; SSR keeps the real module.
+ *
  * manualChunks:
  *   `@decocms/tanstack` and `@decocms/apps` are intentionally NOT split
  *   into their own chunks. They have circular re-exports that produce a
@@ -193,6 +202,22 @@ export function decoVitePlugin() {
         // backward-compatible sites that haven't regenerated).
       }
 
+      // loaders.gen.ts — the site's invoke registry (`export const siteLoaders`).
+      // It registers every site loader/action behind a dynamic `import()`, so if
+      // it stays in the CLIENT module graph (it's reachable via
+      // router -> setup -> commerce-loaders -> loaders.gen) Vite emits each
+      // loader/action module as a public client chunk. That leaks the module's
+      // source — including any hardcoded credential in it — into the browser
+      // assets. The invoke handler runs server-side only (`/deco/invoke` ->
+      // handleInvoke reads the registry via getRegisteredLoaders()), and client
+      // components reach loaders/actions exclusively through the HTTP `invoke`
+      // proxy (which imports no modules). So the client never needs `siteLoaders`.
+      // Stub it to an empty object on the client, mirroring blocks.gen.ts above;
+      // SSR keeps the real module.
+      if (id.endsWith("loaders.gen.ts") && !options?.ssr) {
+        return "export const siteLoaders = {};";
+      }
+
       // Virtual module stubs.
       return STUB_SOURCE[id];
     },

package/src/vite/plugin.test.ts

@@ -0,0 +1,52 @@
+import { describe, expect, it } from "vitest";
+import { decoVitePlugin } from "./plugin.js";
+
+/**
+ * Permanent regression test for the site-action/loader bundle leak.
+ *
+ * `.deco/loaders.gen.ts` registers every site loader/action behind a dynamic
+ * `import()` and is reachable from the CLIENT entry (router -> setup ->
+ * commerce-loaders -> loaders.gen). Without the client stub, Vite emits each
+ * loader/action module as a public client chunk, leaking the module source
+ * (including any hardcoded credential in it) into the browser assets.
+ *
+ * The load() hook must replace loaders.gen.ts with an empty `siteLoaders` on
+ * the client so those dynamic imports vanish from the client graph, while SSR
+ * keeps the real module (invoke runs server-side only). If this ever regresses,
+ * a token hardcoded in a site action becomes publicly downloadable again.
+ */
+describe("decoVitePlugin — loaders.gen client stub", () => {
+  // The plugin's load hook is a plain function that uses no `this`.
+  const plugin = decoVitePlugin() as {
+    load: (id: string, options?: { ssr?: boolean }) => string | undefined;
+  };
+  const id = "/repo/.deco/loaders.gen.ts";
+
+  it("stubs loaders.gen.ts to an empty siteLoaders in the CLIENT build", () => {
+    const out = plugin.load(id, { ssr: false });
+    expect(out).toBe("export const siteLoaders = {};");
+    // The stub must carry no dynamic import — that's the whole point.
+    expect(out).not.toMatch(/import\s*\(/);
+  });
+
+  it("leaves loaders.gen.ts untouched in the SSR build (real registry)", () => {
+    expect(plugin.load(id, { ssr: true })).toBeUndefined();
+  });
+
+  it("defaults to the client (stubbed) behavior when ssr is unset", () => {
+    // Rollup/Vite may call load() without an options.ssr flag; the guard is
+    // `!options?.ssr`, so an absent flag must be treated as client.
+    expect(plugin.load(id)).toBe("export const siteLoaders = {};");
+    expect(plugin.load(id, {})).toBe("export const siteLoaders = {};");
+  });
+
+  it("still stubs blocks.gen.ts on the client (existing behavior intact)", () => {
+    const out = plugin.load("/repo/.deco/blocks.gen.ts", { ssr: false });
+    expect(out).toBe("export const blocks = {};");
+  });
+
+  it("does not touch unrelated modules", () => {
+    expect(plugin.load("/repo/src/sections/Hero.tsx", { ssr: false })).toBeUndefined();
+    expect(plugin.load("/repo/src/actions/foo.ts", { ssr: false })).toBeUndefined();
+  });
+});