@decocms/tanstack 7.77.6 → 7.77.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/tanstack",
-  "version": "7.77.6",
+  "version": "7.77.8",
   "type": "module",
   "description": "Deco framework binding for TanStack Start + Cloudflare Workers",
   "repository": {
@@ -27,9 +27,9 @@
     "lint:unused": "knip"
   },
   "dependencies": {
-    "@decocms/blocks": "7.77.6",
-    "@decocms/blocks-admin": "7.77.6",
-    "@decocms/blocks-cli": "7.77.6",
+    "@decocms/blocks": "7.77.8",
+    "@decocms/blocks-admin": "7.77.8",
+    "@decocms/blocks-cli": "7.77.8",
     "@deco-cx/warp-node": "^0.3.16",
     "fast-json-patch": "^3.1.0",
     "ws": "^8.18.0"

package/src/sdk/router.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, it } from "vitest";
+import { decoParseSearch, decoStringifySearch } from "./router";
+
+describe("decoStringifySearch ∘ decoParseSearch is a fixed point", () => {
+  // TanStack Router redirects (307) on the server when
+  // stringifySearch(parseSearch(search)) differs from the request's search —
+  // every query string that round-trips unchanged is a request that never
+  // redirects.
+  it.each([
+    "?q=camisa&sort=",
+    "?utm_source=",
+    "?a=&b=",
+    "?q=camisa",
+    "?filter.brand=Nike&filter.brand=Adidas",
+    // (`%20` is re-encoded as `+` by URLSearchParams — a pre-existing
+    // normalization, out of this fix's scope.)
+    "?q=a+b&page=2",
+  ])("round-trips %s unchanged", (search) => {
+    expect(decoStringifySearch(decoParseSearch(search))).toBe(search);
+  });
+
+  it("parses a value-less param to an empty string", () => {
+    expect(decoParseSearch("?q=camisa&sort=")).toEqual({ q: "camisa", sort: "" });
+  });
+
+  it("still drops undefined and null (how navigate() removes a param)", () => {
+    expect(decoStringifySearch({ q: "camisa", sort: undefined, page: null })).toBe("?q=camisa");
+    expect(decoStringifySearch({ q: undefined })).toBe("");
+  });
+
+  it("keeps an explicit empty string as key= and arrays as repeated keys", () => {
+    expect(decoStringifySearch({ sort: "", f: ["a", "b"] })).toBe("?sort=&f=a&f=b");
+  });
+});

package/src/sdk/router.ts

@@ -30,10 +30,22 @@ export const decoParseSearch: SearchParser = (searchStr) => {
   return result;
 };
 
+/**
+ * Serializes the router's search object back to a query string.
+ *
+ * Must be a fixed point of {@link decoParseSearch}: on the server, TanStack
+ * Router compares the request's href with `stringifySearch(parseSearch(...))`
+ * (`router.beforeLoad`) and answers a 307 to the normalized URL when they
+ * differ. A value-less parameter (`?sort=`, `?utm_source=`) parses to `""`,
+ * so dropping `""` here turned every such request into a redirect that
+ * Fresh — and TanStack's own default serializer, which only drops
+ * `undefined` — never issued. `undefined`/`null` still remove a param, which
+ * is how `navigate({ search: { q: undefined } })` clears one.
+ */
 export const decoStringifySearch: SearchSerializer = (search) => {
   const params = new URLSearchParams();
   for (const [key, value] of Object.entries(search)) {
-    if (value === undefined || value === null || value === "") continue;
+    if (value === undefined || value === null) continue;
     if (Array.isArray(value)) {
       for (const v of value) params.append(key, String(v));
     } else {

package/src/sdk/workerEntry.test.ts

@@ -7,6 +7,7 @@ import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import { segmentToken } from "./cdnSegment";
 import { __resetKvHydrationStateForTests } from "./kvHydration";
 import {
+  aliasLiveInvoke,
   buildEnforcedCsp,
   buildGeoCacheParam,
   createDecoWorkerEntry,
@@ -1082,3 +1083,55 @@ describe("Set-Cookie deduplication keys on name + Domain + Path", () => {
     expect(out).not.toContain("checkout.vtex.com=__ofid=old; Path=/");
   });
 });
+
+describe("/live/invoke alias (Fresh compat)", () => {
+  it("leaves every other path untouched (same Request reference)", () => {
+    for (const path of ["/", "/deco/invoke/site/loaders/x.ts", "/live/_meta", "/live/invoke-not"]) {
+      const req = new Request(`https://example.com${path}`);
+      expect(aliasLiveInvoke(req)).toBe(req);
+    }
+  });
+
+  it("rewrites /live/invoke and /live/invoke/* to /deco/invoke[/*], keeping query, method, headers, body and cf", async () => {
+    const req = new Request("https://example.com/live/invoke/site/loaders/x.ts?select=a,b", {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-custom": "1" },
+      body: JSON.stringify({ id: 1 }),
+    });
+    Object.defineProperty(req, "cf", { value: { colo: "GRU" }, configurable: true });
+
+    const out = aliasLiveInvoke(req);
+    expect(out.url).toBe("https://example.com/deco/invoke/site/loaders/x.ts?select=a,b");
+    expect(out.method).toBe("POST");
+    expect(out.headers.get("x-custom")).toBe("1");
+    expect(await out.json()).toEqual({ id: 1 });
+    expect((out as unknown as { cf?: unknown }).cf).toEqual({ colo: "GRU" });
+
+    expect(aliasLiveInvoke(new Request("https://example.com/live/invoke")).url).toBe(
+      "https://example.com/deco/invoke",
+    );
+  });
+
+  it("end-to-end: the server entry receives the /deco/invoke URL", async () => {
+    setBlocks({});
+    const urls: string[] = [];
+    const entry = {
+      fetch: async (req: Request) => {
+        urls.push(req.url);
+        return Response.json({ ok: true });
+      },
+    };
+    const worker = createDecoWorkerEntry(entry, { observability: false });
+    const res = await worker.fetch(
+      new Request("https://example.com/live/invoke/site/loaders/x.ts", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: "{}",
+      }),
+      EMPTY_ENV,
+      MOCK_CTX,
+    );
+    expect(res.status).toBe(200);
+    expect(urls).toEqual(["https://example.com/deco/invoke/site/loaders/x.ts"]);
+  });
+});

package/src/sdk/workerEntry.ts

@@ -982,6 +982,46 @@ function deduplicateSetCookies(response: Response): void {
 
 const FINGERPRINTED_ASSET_RE = /(?:\/_build)?\/assets\/.*-[a-zA-Z0-9_-]{8,}\.\w+$/;
 
+const LIVE_INVOKE_PREFIX = "/live/invoke";
+
+/**
+ * Fresh-compat alias: serve `/live/invoke` and `/live/invoke/*` as
+ * `/deco/invoke[/*]`. deco-runtime registered both prefixes for the same
+ * handler (`runtime/handler.tsx`: `paths: ["/live/invoke", "/deco/invoke"]`),
+ * and clients built against a Fresh site — the mobile app, partner
+ * integrations — still call `/live/invoke/...`. Here that path fell through
+ * to the CMS router and answered a 404 HTML page.
+ *
+ * Returns the same Request when the path is not a `/live/invoke` one, so the
+ * common path allocates nothing. The rewritten Request keeps method, headers,
+ * body and `cf` (the `new Request(url, request)` form does not reliably carry
+ * `cf` across runtimes — see `revalidationRequest`).
+ */
+export function aliasLiveInvoke(request: Request): Request {
+  const url = new URL(request.url);
+  const { pathname } = url;
+  if (pathname !== LIVE_INVOKE_PREFIX && !pathname.startsWith(`${LIVE_INVOKE_PREFIX}/`)) {
+    return request;
+  }
+  url.pathname = `/deco/invoke${pathname.slice(LIVE_INVOKE_PREFIX.length)}`;
+  const hasBody = request.method !== "GET" && request.method !== "HEAD";
+  const cf = (request as unknown as { cf?: unknown }).cf;
+  const aliased = new Request(url.toString(), {
+    method: request.method,
+    headers: request.headers,
+    redirect: request.redirect,
+    signal: request.signal,
+    ...(hasBody ? { body: request.body, duplex: "half" } : {}),
+    ...(cf ? { cf } : {}),
+  } as RequestInit);
+  // Runtimes other than workerd ignore the `cf` init field; re-attach it so a
+  // location matcher downstream never reads a dropped `cf`.
+  if (cf !== undefined && (aliased as unknown as { cf?: unknown }).cf === undefined) {
+    Object.defineProperty(aliased, "cf", { value: cf, configurable: true });
+  }
+  return aliased;
+}
+
 // ---------------------------------------------------------------------------
 // Auto geo-key detection (module-level singleton)
 // ---------------------------------------------------------------------------
@@ -2199,10 +2239,13 @@ export function createDecoWorkerEntry(
     : instrumentWorker(handler, (observabilityOpt as OtelOptions | undefined) ?? {});
 
   async function handleRequest(
-    request: Request,
+    incomingRequest: Request,
     env: Record<string, unknown>,
     ctx: WorkerExecutionContext,
   ): Promise<Response> {
+    // Fresh-compat `/live/invoke` → `/deco/invoke`, before anything reads
+    // the path (admin routes, bypass paths, the site's `/deco/invoke/$` route).
+    const request = aliasLiveInvoke(incomingRequest);
     const url = new URL(request.url);
 
     // NOTE: fast-deploy hydration does NOT run here. It must happen before