@lovable.dev/vite-tanstack-config 2.23.1 → 2.24.0

package/README.md

@@ -19,4 +19,6 @@ Inside a Lovable build with prerender enabled, the build process is forced to ex
 
 ## Route manifest
 
-Inside a Lovable build, the route surface of the app is written to `dist/.lovable/routes.json` after the build: `{ version, generator, basepath?, serverEntry, requestMiddleware?, routes }`, where `routes` is the generated route tree's `fullPaths` union in TanStack path syntax (`/posts/$postId`, `/files/$`, `/docs/{-$version}`). Lovable's serving layer uses it to answer requests no route can match without starting the app. The file is enumerated with `@tanstack/router-generator` through an in-memory overlay, so the build never rewrites `routeTree.gen.ts`, and it is skipped — with a warning naming the reason — whenever the app can answer paths outside its route tree: `tanstackStart.spa`, `router.virtualRouteConfig`, `nitro.routeRules`/`handlers`, a project `nitro.config.*` / `.config/nitro.*` / `.nitrorc` file (Nitro loads it on its own, so the wrapper cannot see what it adds), a `rewrite` in the router file, a `basepath` there that `tanstackStart.router.basepath` does not declare (a computed or shorthand one included), or a router file (`router.entry`, resolved the way TanStack Start resolves it) that cannot be read to check either.
+Inside a Lovable build, the route surface of the app is written to `dist/.lovable/routes.json` after the build: `{ version, generator, basepath?, serverEntry, requestMiddleware?, urlInspection, routes }`, where `routes` is the generated route tree's `fullPaths` union in TanStack path syntax (`/posts/$postId`, `/files/$`, `/docs/{-$version}`). Lovable's serving layer uses it to answer requests no route can match without starting the app. The file is enumerated with `@tanstack/router-generator` through an in-memory overlay, so the build never rewrites `routeTree.gen.ts`, and it is skipped — with a warning naming the reason — whenever the app can answer paths outside its route tree: `tanstackStart.spa`, `router.virtualRouteConfig`, `nitro.routeRules`/`handlers`, a project `nitro.config.*` / `.config/nitro.*` / `.nitrorc` file (Nitro loads it on its own, so the wrapper cannot see what it adds), a `rewrite` in the router file, a `basepath` there that `tanstackStart.router.basepath` does not declare (a computed or shorthand one included), or a router file (`router.entry`, resolved the way TanStack Start resolves it) that cannot be read to check either.
+
+`urlInspection` tells the serving layer whether the code that runs ahead of route matching could answer a request from its URL; only `none` lets it enforce the manifest, every other value keeps it advisory. The wrapper reads the server entry (`server.entry`, or `src/server.ts` by convention — the same rule sets `serverEntry`) and the start entry (`start.entry` or `src/start.ts`, whose `requestMiddleware` runs before the router) together with every module they import through relative or `@/` paths, with comments and string contents removed, and reports `server_entry`, `request_middleware` or `both` when any of it names the URL, one of its parts (`pathname`, `searchParams`, `path`), a redirect (`redirect`, `Location`, a `30x` status) or a not-found answer (`404`, `notFound`). It reports `unknown` instead of guessing when a module cannot be resolved or read, when a module is loaded by a computed specifier or `import.meta.glob`, when the closure imports a package other than `node:*`/`@tanstack/*` (a mounted framework can route without naming the URL), or when it outgrows 32 files / 256 KiB. The template's `server.ts` and `start.ts` read as `none`; keep them free of those names, or new projects stop asserting it.

package/dist/hmr-gate.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-let node_fs = require("node:fs");
 let node_crypto = require("node:crypto");
+let node_fs = require("node:fs");
 //#region src/hmr-gate/index.ts
 const statusCorsOriginRe = /^(?:https:\/\/(?:[^/]+\.)?lovable\.dev|https?:\/\/(?:(?:[^/:]+\.)?localhost|127\.0\.0\.1|\[::1\]))(?::\d+)?$/;
 function requestPathname(req) {

package/dist/hmr-gate.js

@@ -1,5 +1,5 @@
-import { readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
 //#region src/hmr-gate/index.ts
 const statusCorsOriginRe = /^(?:https:\/\/(?:[^/]+\.)?lovable\.dev|https?:\/\/(?:(?:[^/:]+\.)?localhost|127\.0\.0\.1|\[::1\]))(?::\d+)?$/;
 function requestPathname(req) {

package/dist/index.cjs

@@ -21,12 +21,12 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-let node_fs = require("node:fs");
 let node_path = require("node:path");
 let node_url = require("node:url");
 let vite = require("vite");
 let node_https = require("node:https");
 node_https = __toESM(node_https, 1);
+let node_fs_promises = require("node:fs/promises");
 //#region src/assetsProxyPlugin.ts
 const ASSET_RE = /^\/__l5e\/assets-v1\//;
 const PREVIEW_HOST_ENV = "LOVABLE_PREVIEW_HOST";
@@ -154,7 +154,7 @@ function bundledDevCssUrlShim() {
 //#endregion
 //#region package.json
 var name = "@lovable.dev/vite-tanstack-config";
-var version = "2.23.1";
+var version = "2.24.0";
 //#endregion
 //#region src/logging.ts
 const PACKAGE_NAME = "@lovable.dev/vite-tanstack-config";
@@ -368,6 +368,305 @@ function createDocumentSet(routerBasePath) {
 	};
 }
 //#endregion
+//#region src/linkedDependencies.ts
+function linkedDependenciesPlugin() {
+	return {
+		name: "lovable-linked-dependencies",
+		apply: "serve",
+		async configResolved(config) {
+			let dependencies;
+			let root;
+			try {
+				root = await (0, node_fs_promises.realpath)(config.root);
+				dependencies = await (0, node_fs_promises.realpath)((0, node_path.join)(root, "node_modules"));
+			} catch {
+				return;
+			}
+			if (dependencies.startsWith(root + node_path.sep)) return;
+			if (!config.server.fs.allow.includes(dependencies)) config.server.fs.allow.push(dependencies);
+		}
+	};
+}
+//#endregion
+//#region src/urlInspection.ts
+const URL_TOKENS = /\b(?:url|URL|URLPattern|URLSearchParams|pathname|searchParams|path|404|30\d|notFound|isNotFound|redirect|isRedirect|Location|location)\b/;
+const REQUEST_MIDDLEWARE = /\brequestMiddleware\b/;
+const STATIC_IMPORT = /\b(?:import|export)\b(?<type>\s+type\b)?[^'"`;]*?(?<!\.)\bfrom\s*(['"])(?<from>[^'"\n]+)\2|\bimport\s*(['"])(?<side>[^'"\n]+)\4/g;
+const DYNAMIC_IMPORT = /\b(?:import|require)\s*\(\s*(['"`])(?<spec>[^'"`\n]+)\1\s*(?:,[^)]*)?\)/g;
+const DYNAMIC_LOAD = /\b(?:import|require)\s*(?:\.\s*meta\s*\.\s*glob\s*)?\(/g;
+const READABLE_LOAD = /\b(?:import|require)\s*\(\s*(['"`])\1\s*(?:,[^)]*)?\)/y;
+const IMPORT_EXTENSIONS = [
+	".ts",
+	".js",
+	".mts",
+	".mjs",
+	".tsx",
+	".jsx"
+];
+const JS_TO_TS = {
+	".js": [".ts", ".tsx"],
+	".jsx": [".tsx"],
+	".mjs": [".mts"]
+};
+const CODE_EXTENSIONS = /* @__PURE__ */ new Set([
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mts",
+	".mjs",
+	".cts",
+	".cjs"
+]);
+const TRUSTED_SPECIFIERS = ["node:", "@tanstack/"];
+const REGEX_AFTER_KEYWORDS = /* @__PURE__ */ new Set([
+	"return",
+	"typeof",
+	"instanceof",
+	"in",
+	"of",
+	"new",
+	"delete",
+	"void",
+	"throw",
+	"case",
+	"do",
+	"else",
+	"yield",
+	"await"
+]);
+/**
+* Splits comments, string and regex literals from code with a small state machine, so a
+* `//` inside a URL literal or a quote inside a regex cannot swallow the code after it.
+*/
+function lexSource(source) {
+	const code = [];
+	const text = [];
+	let i = 0;
+	let word = "";
+	let slashDivides = false;
+	let prev = "";
+	let closedIncrement = false;
+	const resetOperand = (divides) => {
+		word = "";
+		slashDivides = divides;
+		prev = "";
+		closedIncrement = false;
+	};
+	const regexAllowed = () => word === "" ? !slashDivides : REGEX_AFTER_KEYWORDS.has(word);
+	const readQuoted = (quote) => {
+		const start = i++;
+		while (i < source.length && source[i] !== quote && source[i] !== "\n") {
+			if (source[i] === "\\") i++;
+			i++;
+		}
+		if (source[i] === quote) i++;
+		text.push(source.slice(start, i));
+		code.push(quote + quote);
+		resetOperand(true);
+	};
+	const readRegex = () => {
+		const start = i;
+		let inClass = false;
+		for (i++; i < source.length && source[i] !== "\n"; i++) {
+			const char = source[i];
+			if (char === "\\") i++;
+			else if (char === "[") inClass = true;
+			else if (char === "]") inClass = false;
+			else if (char === "/" && !inClass) {
+				i++;
+				while (i < source.length && /[a-z]/.test(source[i])) i++;
+				text.push(source.slice(start, i));
+				code.push("//");
+				resetOperand(true);
+				return;
+			}
+		}
+		i = start + 1;
+		text.push("/");
+		code.push("/");
+		resetOperand(false);
+	};
+	const readTemplate = () => {
+		i++;
+		text.push("`");
+		code.push("`");
+		while (i < source.length) {
+			const char = source[i];
+			if (char === "\\") {
+				text.push(source.slice(i, i + 2));
+				i += 2;
+			} else if (char === "`") {
+				text.push("`");
+				code.push("`");
+				i++;
+				resetOperand(true);
+				return;
+			} else if (char === "$" && source[i + 1] === "{") {
+				text.push("${");
+				code.push("${");
+				i += 2;
+				resetOperand(false);
+				readCode(true);
+				text.push("}");
+				code.push("}");
+			} else {
+				text.push(char);
+				i++;
+			}
+		}
+	};
+	const readCode = (untilBrace) => {
+		let depth = 0;
+		while (i < source.length) {
+			const char = source[i];
+			const next = source[i + 1];
+			if (char === "/" && next === "/") {
+				const end = source.indexOf("\n", i);
+				i = end === -1 ? source.length : end;
+				continue;
+			}
+			if (char === "/" && next === "*") {
+				const end = source.indexOf("*/", i + 2);
+				i = end === -1 ? source.length : end + 2;
+				text.push(" ");
+				code.push(" ");
+				prev = " ";
+				continue;
+			}
+			if (char === "'" || char === "\"") {
+				readQuoted(char);
+				continue;
+			}
+			if (char === "`") {
+				readTemplate();
+				continue;
+			}
+			if (char === "/" && regexAllowed()) {
+				readRegex();
+				continue;
+			}
+			if (untilBrace && char === "{") depth++;
+			if (untilBrace && char === "}") {
+				if (depth === 0) {
+					i++;
+					return;
+				}
+				depth--;
+			}
+			text.push(char);
+			code.push(char);
+			i++;
+			if (/[\w$]/.test(char)) word += char;
+			else if (!/\s/.test(char)) {
+				const closesIncrement = (char === "+" || char === "-") && prev === char && !closedIncrement;
+				closedIncrement = closesIncrement;
+				word = "";
+				slashDivides = closesIncrement || /[)\]}<]/.test(char);
+			}
+			prev = char;
+		}
+	};
+	readCode(false);
+	return {
+		code: code.join(""),
+		text: text.join("")
+	};
+}
+/** Every module specifier `text` (comment-free source) imports at runtime, in source order. */
+function importSpecifiers(text) {
+	const specifiers = [];
+	for (const match of text.matchAll(STATIC_IMPORT)) {
+		if (match.groups?.type !== void 0) continue;
+		const specifier = match.groups?.from ?? match.groups?.side;
+		if (specifier !== void 0) specifiers.push(specifier);
+	}
+	for (const match of text.matchAll(DYNAMIC_IMPORT)) if (match.groups?.spec !== void 0) specifiers.push(match.groups.spec);
+	return specifiers;
+}
+/** Whether `code` loads a module importSpecifiers cannot name: a computed specifier, `import.meta.glob`, an argument list it does not read. */
+function hasUnreadImports(code) {
+	for (const match of code.matchAll(DYNAMIC_LOAD)) {
+		READABLE_LOAD.lastIndex = match.index;
+		if (!READABLE_LOAD.test(code)) return true;
+	}
+	return false;
+}
+function inspectsUrl(code) {
+	return URL_TOKENS.test(code);
+}
+function classifySpecifier(specifier, fromDir, aliasDir, nodePath) {
+	if (specifier.includes("${")) return "opaque";
+	const file = specifier.replace(/\?.*$/, "");
+	if (file.startsWith("./") || file.startsWith("../")) return { file: nodePath.resolve(fromDir, file) };
+	if (file.startsWith("@/")) return { file: nodePath.resolve(aliasDir, file.slice(2)) };
+	return TRUSTED_SPECIFIERS.some((prefix) => specifier.startsWith(prefix)) ? "trusted" : "opaque";
+}
+async function isFile(file) {
+	const { stat } = await import("node:fs/promises");
+	return stat(file).then((stats) => stats.isFile(), () => false);
+}
+async function resolveLocalImport(base, nodePath) {
+	const candidates = [base, ...IMPORT_EXTENSIONS.map((extension) => `${base}${extension}`)];
+	const extension = nodePath.extname(base);
+	for (const swapped of JS_TO_TS[extension] ?? []) candidates.push(`${base.slice(0, -extension.length)}${swapped}`);
+	candidates.push(...IMPORT_EXTENSIONS.map((suffix) => nodePath.join(base, `index${suffix}`)));
+	for (const candidate of candidates) if (await isFile(candidate)) return candidate;
+}
+/**
+* Scans `entryFile` and every local module it imports, transitively; undefined without
+* an entry. Anything it cannot read or vouch for leaves the scan incomplete, not guessed.
+*/
+async function scanEntry(entryFile, options) {
+	if (entryFile === void 0) return void 0;
+	const nodePath = await import("node:path");
+	const { readFile } = await import("node:fs/promises");
+	const scan = {
+		complete: true,
+		inspectsUrl: false,
+		requestMiddleware: false
+	};
+	const incomplete = () => ({
+		...scan,
+		complete: false
+	});
+	const seen = /* @__PURE__ */ new Set();
+	const queue = [entryFile];
+	let bytes = 0;
+	while (queue.length > 0) {
+		const file = queue.shift();
+		if (seen.has(file)) continue;
+		seen.add(file);
+		if (seen.size > 32 || file.split(nodePath.sep).includes("node_modules")) return incomplete();
+		const source = await readFile(file, "utf8").catch(() => void 0);
+		if (source === void 0) return incomplete();
+		bytes += Buffer.byteLength(source, "utf8");
+		if (bytes > 262144) return incomplete();
+		const { code, text } = lexSource(source);
+		scan.inspectsUrl ||= inspectsUrl(code);
+		scan.requestMiddleware ||= REQUEST_MIDDLEWARE.test(code);
+		if (hasUnreadImports(code)) return incomplete();
+		for (const specifier of importSpecifiers(text)) {
+			const resolution = classifySpecifier(specifier, nodePath.dirname(file), options.aliasDir, nodePath);
+			if (resolution === "trusted") continue;
+			const resolved = resolution === "opaque" ? void 0 : await resolveLocalImport(resolution.file, nodePath);
+			if (resolved === void 0) return incomplete();
+			if (CODE_EXTENSIONS.has(nodePath.extname(resolved))) queue.push(resolved);
+		}
+	}
+	return scan;
+}
+/** The manifest's verdict over the server entry and the start entry (request middleware). */
+function urlInspectionOf(server, start) {
+	const serverInspects = server?.inspectsUrl === true;
+	const middlewareInspects = start?.inspectsUrl === true;
+	if (serverInspects && middlewareInspects) return "both";
+	if (serverInspects) return "server_entry";
+	if (middlewareInspects) return "request_middleware";
+	if (server?.complete === false || start?.complete === false) return "unknown";
+	return "none";
+}
+//#endregion
 //#region src/routes.ts
 const ROUTE_MANIFEST_VERSION = 1;
 const GENERATOR = `${name}@${version}`;
@@ -642,13 +941,17 @@ function createRouteManifestPlugin(inputs) {
 					logWarning("Not publishing a route manifest: the route tree has no routes.");
 					return;
 				}
-				const startSource = await readSource(await resolveEntryFile(sourceDir, stringOption(subOptions(tanstackStart, "start"), "entry", "start")));
+				const serverFile = await resolveEntryFile(sourceDir, stringOption(subOptions(tanstackStart, "server"), "entry", "server"));
+				const startFile = await resolveEntryFile(sourceDir, stringOption(subOptions(tanstackStart, "start"), "entry", "start"));
+				const aliasDir = nodePath.resolve(process.cwd(), "src");
+				const [server, start] = await Promise.all([scanEntry(serverFile, { aliasDir }), scanEntry(startFile, { aliasDir })]);
 				const payload = serializeRouteManifest({
 					version: ROUTE_MANIFEST_VERSION,
 					generator: GENERATOR,
 					...basepath === "" ? {} : { basepath },
-					serverEntry: typeof subOptions(tanstackStart, "server").entry === "string" ? "custom" : "default",
-					...startSource === void 0 ? {} : { requestMiddleware: /\brequestMiddleware\b/.test(startSource) },
+					serverEntry: serverFile === void 0 ? "default" : "custom",
+					...start === void 0 ? {} : { requestMiddleware: start.requestMiddleware },
+					urlInspection: urlInspectionOf(server, start),
 					routes
 				});
 				if (payload === void 0) return;
@@ -669,18 +972,6 @@ const LOVABLE_SANDBOX_ENV_VAR = "LOVABLE_SANDBOX";
 function isSandboxEnvironment() {
 	return process.env[LOVABLE_SANDBOX_ENV_VAR] === "1" || !!process.env[SANDBOX_ENV_VAR];
 }
-function sandboxFsAllow(root) {
-	let nodeModules;
-	let realRoot;
-	try {
-		nodeModules = node_fs.realpathSync.native((0, node_path.join)(root, "node_modules"));
-		realRoot = node_fs.realpathSync.native(root);
-	} catch {
-		return;
-	}
-	if (nodeModules.startsWith(realRoot + node_path.sep)) return void 0;
-	return [(0, vite.searchForWorkspaceRoot)(root), nodeModules];
-}
 const TOOL_MANAGED_WATCH_IGNORES = [
 	"**/.workspace/**",
 	"**/.agents/**",
@@ -1606,6 +1897,7 @@ function defineConfig(configOrOptions = {}) {
 			}
 		}
 		if (command === "serve" && isSandbox) {
+			internalPlugins.push(linkedDependenciesPlugin());
 			const { devServerBridgePlugin } = await Promise.resolve().then(() => require("./dev-server-bridge.cjs"));
 			internalPlugins.push(devServerBridgePlugin());
 		}
@@ -1656,14 +1948,12 @@ function defineConfig(configOrOptions = {}) {
 		}
 		if (isSandbox) {
 			validateConfig(config);
-			const fsAllow = sandboxFsAllow(process.cwd());
 			config = cleanServerConfig((0, vite.mergeConfig)(config, { server: {
 				host: "::",
 				port: 8080,
 				strictPort: true,
 				watch: { ignored: [...TOOL_MANAGED_WATCH_IGNORES] },
-				hmr: { overlay: false },
-				...fsAllow ? { fs: { allow: fsAllow } } : {}
+				hmr: { overlay: false }
 			} }));
 		} else config = (0, vite.mergeConfig)({ server: {
 			host: "::",

package/dist/index.js

@@ -1,8 +1,8 @@
-import { realpathSync } from "node:fs";
 import { basename, extname, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { loadEnv, mergeConfig, searchForWorkspaceRoot } from "vite";
+import { loadEnv, mergeConfig } from "vite";
 import https from "node:https";
+import { realpath } from "node:fs/promises";
 //#region src/assetsProxyPlugin.ts
 const ASSET_RE = /^\/__l5e\/assets-v1\//;
 const PREVIEW_HOST_ENV = "LOVABLE_PREVIEW_HOST";
@@ -130,7 +130,7 @@ function bundledDevCssUrlShim() {
 //#endregion
 //#region package.json
 var name = "@lovable.dev/vite-tanstack-config";
-var version = "2.23.1";
+var version = "2.24.0";
 //#endregion
 //#region src/logging.ts
 const PACKAGE_NAME = "@lovable.dev/vite-tanstack-config";
@@ -344,6 +344,305 @@ function createDocumentSet(routerBasePath) {
 	};
 }
 //#endregion
+//#region src/linkedDependencies.ts
+function linkedDependenciesPlugin() {
+	return {
+		name: "lovable-linked-dependencies",
+		apply: "serve",
+		async configResolved(config) {
+			let dependencies;
+			let root;
+			try {
+				root = await realpath(config.root);
+				dependencies = await realpath(join(root, "node_modules"));
+			} catch {
+				return;
+			}
+			if (dependencies.startsWith(root + sep)) return;
+			if (!config.server.fs.allow.includes(dependencies)) config.server.fs.allow.push(dependencies);
+		}
+	};
+}
+//#endregion
+//#region src/urlInspection.ts
+const URL_TOKENS = /\b(?:url|URL|URLPattern|URLSearchParams|pathname|searchParams|path|404|30\d|notFound|isNotFound|redirect|isRedirect|Location|location)\b/;
+const REQUEST_MIDDLEWARE = /\brequestMiddleware\b/;
+const STATIC_IMPORT = /\b(?:import|export)\b(?<type>\s+type\b)?[^'"`;]*?(?<!\.)\bfrom\s*(['"])(?<from>[^'"\n]+)\2|\bimport\s*(['"])(?<side>[^'"\n]+)\4/g;
+const DYNAMIC_IMPORT = /\b(?:import|require)\s*\(\s*(['"`])(?<spec>[^'"`\n]+)\1\s*(?:,[^)]*)?\)/g;
+const DYNAMIC_LOAD = /\b(?:import|require)\s*(?:\.\s*meta\s*\.\s*glob\s*)?\(/g;
+const READABLE_LOAD = /\b(?:import|require)\s*\(\s*(['"`])\1\s*(?:,[^)]*)?\)/y;
+const IMPORT_EXTENSIONS = [
+	".ts",
+	".js",
+	".mts",
+	".mjs",
+	".tsx",
+	".jsx"
+];
+const JS_TO_TS = {
+	".js": [".ts", ".tsx"],
+	".jsx": [".tsx"],
+	".mjs": [".mts"]
+};
+const CODE_EXTENSIONS = /* @__PURE__ */ new Set([
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mts",
+	".mjs",
+	".cts",
+	".cjs"
+]);
+const TRUSTED_SPECIFIERS = ["node:", "@tanstack/"];
+const REGEX_AFTER_KEYWORDS = /* @__PURE__ */ new Set([
+	"return",
+	"typeof",
+	"instanceof",
+	"in",
+	"of",
+	"new",
+	"delete",
+	"void",
+	"throw",
+	"case",
+	"do",
+	"else",
+	"yield",
+	"await"
+]);
+/**
+* Splits comments, string and regex literals from code with a small state machine, so a
+* `//` inside a URL literal or a quote inside a regex cannot swallow the code after it.
+*/
+function lexSource(source) {
+	const code = [];
+	const text = [];
+	let i = 0;
+	let word = "";
+	let slashDivides = false;
+	let prev = "";
+	let closedIncrement = false;
+	const resetOperand = (divides) => {
+		word = "";
+		slashDivides = divides;
+		prev = "";
+		closedIncrement = false;
+	};
+	const regexAllowed = () => word === "" ? !slashDivides : REGEX_AFTER_KEYWORDS.has(word);
+	const readQuoted = (quote) => {
+		const start = i++;
+		while (i < source.length && source[i] !== quote && source[i] !== "\n") {
+			if (source[i] === "\\") i++;
+			i++;
+		}
+		if (source[i] === quote) i++;
+		text.push(source.slice(start, i));
+		code.push(quote + quote);
+		resetOperand(true);
+	};
+	const readRegex = () => {
+		const start = i;
+		let inClass = false;
+		for (i++; i < source.length && source[i] !== "\n"; i++) {
+			const char = source[i];
+			if (char === "\\") i++;
+			else if (char === "[") inClass = true;
+			else if (char === "]") inClass = false;
+			else if (char === "/" && !inClass) {
+				i++;
+				while (i < source.length && /[a-z]/.test(source[i])) i++;
+				text.push(source.slice(start, i));
+				code.push("//");
+				resetOperand(true);
+				return;
+			}
+		}
+		i = start + 1;
+		text.push("/");
+		code.push("/");
+		resetOperand(false);
+	};
+	const readTemplate = () => {
+		i++;
+		text.push("`");
+		code.push("`");
+		while (i < source.length) {
+			const char = source[i];
+			if (char === "\\") {
+				text.push(source.slice(i, i + 2));
+				i += 2;
+			} else if (char === "`") {
+				text.push("`");
+				code.push("`");
+				i++;
+				resetOperand(true);
+				return;
+			} else if (char === "$" && source[i + 1] === "{") {
+				text.push("${");
+				code.push("${");
+				i += 2;
+				resetOperand(false);
+				readCode(true);
+				text.push("}");
+				code.push("}");
+			} else {
+				text.push(char);
+				i++;
+			}
+		}
+	};
+	const readCode = (untilBrace) => {
+		let depth = 0;
+		while (i < source.length) {
+			const char = source[i];
+			const next = source[i + 1];
+			if (char === "/" && next === "/") {
+				const end = source.indexOf("\n", i);
+				i = end === -1 ? source.length : end;
+				continue;
+			}
+			if (char === "/" && next === "*") {
+				const end = source.indexOf("*/", i + 2);
+				i = end === -1 ? source.length : end + 2;
+				text.push(" ");
+				code.push(" ");
+				prev = " ";
+				continue;
+			}
+			if (char === "'" || char === "\"") {
+				readQuoted(char);
+				continue;
+			}
+			if (char === "`") {
+				readTemplate();
+				continue;
+			}
+			if (char === "/" && regexAllowed()) {
+				readRegex();
+				continue;
+			}
+			if (untilBrace && char === "{") depth++;
+			if (untilBrace && char === "}") {
+				if (depth === 0) {
+					i++;
+					return;
+				}
+				depth--;
+			}
+			text.push(char);
+			code.push(char);
+			i++;
+			if (/[\w$]/.test(char)) word += char;
+			else if (!/\s/.test(char)) {
+				const closesIncrement = (char === "+" || char === "-") && prev === char && !closedIncrement;
+				closedIncrement = closesIncrement;
+				word = "";
+				slashDivides = closesIncrement || /[)\]}<]/.test(char);
+			}
+			prev = char;
+		}
+	};
+	readCode(false);
+	return {
+		code: code.join(""),
+		text: text.join("")
+	};
+}
+/** Every module specifier `text` (comment-free source) imports at runtime, in source order. */
+function importSpecifiers(text) {
+	const specifiers = [];
+	for (const match of text.matchAll(STATIC_IMPORT)) {
+		if (match.groups?.type !== void 0) continue;
+		const specifier = match.groups?.from ?? match.groups?.side;
+		if (specifier !== void 0) specifiers.push(specifier);
+	}
+	for (const match of text.matchAll(DYNAMIC_IMPORT)) if (match.groups?.spec !== void 0) specifiers.push(match.groups.spec);
+	return specifiers;
+}
+/** Whether `code` loads a module importSpecifiers cannot name: a computed specifier, `import.meta.glob`, an argument list it does not read. */
+function hasUnreadImports(code) {
+	for (const match of code.matchAll(DYNAMIC_LOAD)) {
+		READABLE_LOAD.lastIndex = match.index;
+		if (!READABLE_LOAD.test(code)) return true;
+	}
+	return false;
+}
+function inspectsUrl(code) {
+	return URL_TOKENS.test(code);
+}
+function classifySpecifier(specifier, fromDir, aliasDir, nodePath) {
+	if (specifier.includes("${")) return "opaque";
+	const file = specifier.replace(/\?.*$/, "");
+	if (file.startsWith("./") || file.startsWith("../")) return { file: nodePath.resolve(fromDir, file) };
+	if (file.startsWith("@/")) return { file: nodePath.resolve(aliasDir, file.slice(2)) };
+	return TRUSTED_SPECIFIERS.some((prefix) => specifier.startsWith(prefix)) ? "trusted" : "opaque";
+}
+async function isFile(file) {
+	const { stat } = await import("node:fs/promises");
+	return stat(file).then((stats) => stats.isFile(), () => false);
+}
+async function resolveLocalImport(base, nodePath) {
+	const candidates = [base, ...IMPORT_EXTENSIONS.map((extension) => `${base}${extension}`)];
+	const extension = nodePath.extname(base);
+	for (const swapped of JS_TO_TS[extension] ?? []) candidates.push(`${base.slice(0, -extension.length)}${swapped}`);
+	candidates.push(...IMPORT_EXTENSIONS.map((suffix) => nodePath.join(base, `index${suffix}`)));
+	for (const candidate of candidates) if (await isFile(candidate)) return candidate;
+}
+/**
+* Scans `entryFile` and every local module it imports, transitively; undefined without
+* an entry. Anything it cannot read or vouch for leaves the scan incomplete, not guessed.
+*/
+async function scanEntry(entryFile, options) {
+	if (entryFile === void 0) return void 0;
+	const nodePath = await import("node:path");
+	const { readFile } = await import("node:fs/promises");
+	const scan = {
+		complete: true,
+		inspectsUrl: false,
+		requestMiddleware: false
+	};
+	const incomplete = () => ({
+		...scan,
+		complete: false
+	});
+	const seen = /* @__PURE__ */ new Set();
+	const queue = [entryFile];
+	let bytes = 0;
+	while (queue.length > 0) {
+		const file = queue.shift();
+		if (seen.has(file)) continue;
+		seen.add(file);
+		if (seen.size > 32 || file.split(nodePath.sep).includes("node_modules")) return incomplete();
+		const source = await readFile(file, "utf8").catch(() => void 0);
+		if (source === void 0) return incomplete();
+		bytes += Buffer.byteLength(source, "utf8");
+		if (bytes > 262144) return incomplete();
+		const { code, text } = lexSource(source);
+		scan.inspectsUrl ||= inspectsUrl(code);
+		scan.requestMiddleware ||= REQUEST_MIDDLEWARE.test(code);
+		if (hasUnreadImports(code)) return incomplete();
+		for (const specifier of importSpecifiers(text)) {
+			const resolution = classifySpecifier(specifier, nodePath.dirname(file), options.aliasDir, nodePath);
+			if (resolution === "trusted") continue;
+			const resolved = resolution === "opaque" ? void 0 : await resolveLocalImport(resolution.file, nodePath);
+			if (resolved === void 0) return incomplete();
+			if (CODE_EXTENSIONS.has(nodePath.extname(resolved))) queue.push(resolved);
+		}
+	}
+	return scan;
+}
+/** The manifest's verdict over the server entry and the start entry (request middleware). */
+function urlInspectionOf(server, start) {
+	const serverInspects = server?.inspectsUrl === true;
+	const middlewareInspects = start?.inspectsUrl === true;
+	if (serverInspects && middlewareInspects) return "both";
+	if (serverInspects) return "server_entry";
+	if (middlewareInspects) return "request_middleware";
+	if (server?.complete === false || start?.complete === false) return "unknown";
+	return "none";
+}
+//#endregion
 //#region src/routes.ts
 const ROUTE_MANIFEST_VERSION = 1;
 const GENERATOR = `${name}@${version}`;
@@ -618,13 +917,17 @@ function createRouteManifestPlugin(inputs) {
 					logWarning("Not publishing a route manifest: the route tree has no routes.");
 					return;
 				}
-				const startSource = await readSource(await resolveEntryFile(sourceDir, stringOption(subOptions(tanstackStart, "start"), "entry", "start")));
+				const serverFile = await resolveEntryFile(sourceDir, stringOption(subOptions(tanstackStart, "server"), "entry", "server"));
+				const startFile = await resolveEntryFile(sourceDir, stringOption(subOptions(tanstackStart, "start"), "entry", "start"));
+				const aliasDir = nodePath.resolve(process.cwd(), "src");
+				const [server, start] = await Promise.all([scanEntry(serverFile, { aliasDir }), scanEntry(startFile, { aliasDir })]);
 				const payload = serializeRouteManifest({
 					version: ROUTE_MANIFEST_VERSION,
 					generator: GENERATOR,
 					...basepath === "" ? {} : { basepath },
-					serverEntry: typeof subOptions(tanstackStart, "server").entry === "string" ? "custom" : "default",
-					...startSource === void 0 ? {} : { requestMiddleware: /\brequestMiddleware\b/.test(startSource) },
+					serverEntry: serverFile === void 0 ? "default" : "custom",
+					...start === void 0 ? {} : { requestMiddleware: start.requestMiddleware },
+					urlInspection: urlInspectionOf(server, start),
 					routes
 				});
 				if (payload === void 0) return;
@@ -645,18 +948,6 @@ const LOVABLE_SANDBOX_ENV_VAR = "LOVABLE_SANDBOX";
 function isSandboxEnvironment() {
 	return process.env[LOVABLE_SANDBOX_ENV_VAR] === "1" || !!process.env[SANDBOX_ENV_VAR];
 }
-function sandboxFsAllow(root) {
-	let nodeModules;
-	let realRoot;
-	try {
-		nodeModules = realpathSync.native(join(root, "node_modules"));
-		realRoot = realpathSync.native(root);
-	} catch {
-		return;
-	}
-	if (nodeModules.startsWith(realRoot + sep)) return void 0;
-	return [searchForWorkspaceRoot(root), nodeModules];
-}
 const TOOL_MANAGED_WATCH_IGNORES = [
 	"**/.workspace/**",
 	"**/.agents/**",
@@ -1582,6 +1873,7 @@ function defineConfig(configOrOptions = {}) {
 			}
 		}
 		if (command === "serve" && isSandbox) {
+			internalPlugins.push(linkedDependenciesPlugin());
 			const { devServerBridgePlugin } = await import("./dev-server-bridge.js");
 			internalPlugins.push(devServerBridgePlugin());
 		}
@@ -1632,14 +1924,12 @@ function defineConfig(configOrOptions = {}) {
 		}
 		if (isSandbox) {
 			validateConfig(config);
-			const fsAllow = sandboxFsAllow(process.cwd());
 			config = cleanServerConfig(mergeConfig(config, { server: {
 				host: "::",
 				port: 8080,
 				strictPort: true,
 				watch: { ignored: [...TOOL_MANAGED_WATCH_IGNORES] },
-				hmr: { overlay: false },
-				...fsAllow ? { fs: { allow: fsAllow } } : {}
+				hmr: { overlay: false }
 			} }));
 		} else config = mergeConfig({ server: {
 			host: "::",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/vite-tanstack-config",
-  "version": "2.23.1",
+  "version": "2.24.0",
   "description": "Vite config wrapper for Lovable TanStack Start projects",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",