@lovable.dev/vite-tanstack-config 2.23.2 → 2.25.0

package/README.md

@@ -19,4 +19,6 @@ Inside a Lovable build with prerender enabled, the build process is forced to ex
 
 ## Route manifest
 
-Inside a Lovable build, the route surface of the app is written to `dist/.lovable/routes.json` after the build: `{ version, generator, basepath?, serverEntry, requestMiddleware?, routes }`, where `routes` is the generated route tree's `fullPaths` union in TanStack path syntax (`/posts/$postId`, `/files/$`, `/docs/{-$version}`). Lovable's serving layer uses it to answer requests no route can match without starting the app. The file is enumerated with `@tanstack/router-generator` through an in-memory overlay, so the build never rewrites `routeTree.gen.ts`, and it is skipped — with a warning naming the reason — whenever the app can answer paths outside its route tree: `tanstackStart.spa`, `router.virtualRouteConfig`, `nitro.routeRules`/`handlers`, a project `nitro.config.*` / `.config/nitro.*` / `.nitrorc` file (Nitro loads it on its own, so the wrapper cannot see what it adds), a `rewrite` in the router file, a `basepath` there that `tanstackStart.router.basepath` does not declare (a computed or shorthand one included), or a router file (`router.entry`, resolved the way TanStack Start resolves it) that cannot be read to check either.
+Inside a Lovable build, the route surface of the app is written to `dist/.lovable/routes.json` after the build: `{ version, generator, basepath?, serverEntry, requestMiddleware?, urlInspection, routes }`, where `routes` is the generated route tree's `fullPaths` union in TanStack path syntax (`/posts/$postId`, `/files/$`, `/docs/{-$version}`). Lovable's serving layer uses it to answer requests no route can match without starting the app. The file is enumerated with `@tanstack/router-generator` through an in-memory overlay, so the build never rewrites `routeTree.gen.ts`, and it is skipped — with a warning naming the reason — whenever the app can answer paths outside its route tree: `tanstackStart.spa`, `router.virtualRouteConfig`, `nitro.routeRules`/`handlers`, a project `nitro.config.*` / `.config/nitro.*` / `.nitrorc` file (Nitro loads it on its own, so the wrapper cannot see what it adds), a `rewrite` in the router file, a `basepath` there that `tanstackStart.router.basepath` does not declare (a computed or shorthand one included), or a router file (`router.entry`, resolved the way TanStack Start resolves it) that cannot be read to check either.
+
+`urlInspection` tells the serving layer whether the code that runs ahead of route matching could answer a request from its URL; only `none` lets it enforce the manifest, every other value keeps it advisory. The wrapper reads the server entry (`server.entry`, or `src/server.ts` by convention — the same rule sets `serverEntry`) and the start entry (`start.entry` or `src/start.ts`, whose `requestMiddleware` runs before the router) together with every module they import through relative or `@/` paths, with comments and string contents removed, and reports `server_entry`, `request_middleware` or `both` when any of it names the URL, one of its parts (`pathname`, `searchParams`, `path`), a redirect (`redirect`, `Location`, a `30x` status) or a not-found answer (`404`, `notFound`). It reports `unknown` instead of guessing when a module cannot be resolved or read, when a module is loaded by a computed specifier or `import.meta.glob`, when the closure imports a package other than `node:*`/`@tanstack/*` (a mounted framework can route without naming the URL), or when it outgrows 32 files / 256 KiB. The template's `server.ts` and `start.ts` read as `none`; keep them free of those names, or new projects stop asserting it.

package/dist/index.cjs

@@ -103,58 +103,9 @@ function lovableAssetsProxyPlugin() {
 	};
 }
 //#endregion
-//#region src/bundledDev.ts
-const BUNDLED_DEV_ENV_VAR = "LOVABLE_FEATURE_BUNDLED_DEV";
-function bundledDevRequested() {
-	return process.env[BUNDLED_DEV_ENV_VAR] === "true";
-}
-function viteVersionSupportsBundledDev(version) {
-	if (!version || version.includes("-")) return false;
-	const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
-	if (!match) return false;
-	const [major, minor] = [Number(match[1]), Number(match[2])];
-	return major === 8 && minor === 1;
-}
-async function resolveInstalledViteVersion() {
-	try {
-		const { createRequire } = await import("node:module");
-		const { version } = createRequire(`${process.cwd()}/package.json`)("vite/package.json");
-		return typeof version === "string" ? version : void 0;
-	} catch {
-		return;
-	}
-}
-//#endregion
-//#region src/bundledDevCssUrlShim.ts
-const VIRTUAL_PREFIX = "\0lovable-bundled-dev-css-url:";
-const VIRTUAL_SUFFIX = ".shim.js";
-function bundledDevCssUrlShim() {
-	return {
-		name: "lovable-bundled-dev-css-url-shim",
-		apply: "serve",
-		enforce: "pre",
-		async resolveId(id, importer) {
-			if (!id.endsWith(".css?url")) return null;
-			const resolved = await this.resolve(id.slice(0, -4), importer, { skipSelf: true });
-			if (!resolved) return null;
-			return VIRTUAL_PREFIX + resolved.id + VIRTUAL_SUFFIX;
-		},
-		load(id) {
-			if (!id.startsWith(VIRTUAL_PREFIX) || !id.endsWith(VIRTUAL_SUFFIX)) return null;
-			const file = id.slice(29, -8);
-			const inlineSpecifier = file.includes("?") ? `${file}&inline` : `${file}?inline`;
-			return [
-				`import css from ${JSON.stringify(inlineSpecifier)};`,
-				`const b64 = typeof Buffer !== "undefined" ? Buffer.from(css, "utf8").toString("base64") : btoa(unescape(encodeURIComponent(css)));`,
-				`export default "data:text/css;base64," + b64;`
-			].join("\n");
-		}
-	};
-}
-//#endregion
 //#region package.json
 var name = "@lovable.dev/vite-tanstack-config";
-var version = "2.23.2";
+var version = "2.25.0";
 //#endregion
 //#region src/logging.ts
 const PACKAGE_NAME = "@lovable.dev/vite-tanstack-config";
@@ -388,6 +339,285 @@ function linkedDependenciesPlugin() {
 	};
 }
 //#endregion
+//#region src/urlInspection.ts
+const URL_TOKENS = /\b(?:url|URL|URLPattern|URLSearchParams|pathname|searchParams|path|404|30\d|notFound|isNotFound|redirect|isRedirect|Location|location)\b/;
+const REQUEST_MIDDLEWARE = /\brequestMiddleware\b/;
+const STATIC_IMPORT = /\b(?:import|export)\b(?<type>\s+type\b)?[^'"`;]*?(?<!\.)\bfrom\s*(['"])(?<from>[^'"\n]+)\2|\bimport\s*(['"])(?<side>[^'"\n]+)\4/g;
+const DYNAMIC_IMPORT = /\b(?:import|require)\s*\(\s*(['"`])(?<spec>[^'"`\n]+)\1\s*(?:,[^)]*)?\)/g;
+const DYNAMIC_LOAD = /\b(?:import|require)\s*(?:\.\s*meta\s*\.\s*glob\s*)?\(/g;
+const READABLE_LOAD = /\b(?:import|require)\s*\(\s*(['"`])\1\s*(?:,[^)]*)?\)/y;
+const IMPORT_EXTENSIONS = [
+	".ts",
+	".js",
+	".mts",
+	".mjs",
+	".tsx",
+	".jsx"
+];
+const JS_TO_TS = {
+	".js": [".ts", ".tsx"],
+	".jsx": [".tsx"],
+	".mjs": [".mts"]
+};
+const CODE_EXTENSIONS = /* @__PURE__ */ new Set([
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mts",
+	".mjs",
+	".cts",
+	".cjs"
+]);
+const TRUSTED_SPECIFIERS = ["node:", "@tanstack/"];
+const REGEX_AFTER_KEYWORDS = /* @__PURE__ */ new Set([
+	"return",
+	"typeof",
+	"instanceof",
+	"in",
+	"of",
+	"new",
+	"delete",
+	"void",
+	"throw",
+	"case",
+	"do",
+	"else",
+	"yield",
+	"await"
+]);
+/**
+* Splits comments, string and regex literals from code with a small state machine, so a
+* `//` inside a URL literal or a quote inside a regex cannot swallow the code after it.
+*/
+function lexSource(source) {
+	const code = [];
+	const text = [];
+	let i = 0;
+	let word = "";
+	let slashDivides = false;
+	let prev = "";
+	let closedIncrement = false;
+	const resetOperand = (divides) => {
+		word = "";
+		slashDivides = divides;
+		prev = "";
+		closedIncrement = false;
+	};
+	const regexAllowed = () => word === "" ? !slashDivides : REGEX_AFTER_KEYWORDS.has(word);
+	const readQuoted = (quote) => {
+		const start = i++;
+		while (i < source.length && source[i] !== quote && source[i] !== "\n") {
+			if (source[i] === "\\") i++;
+			i++;
+		}
+		if (source[i] === quote) i++;
+		text.push(source.slice(start, i));
+		code.push(quote + quote);
+		resetOperand(true);
+	};
+	const readRegex = () => {
+		const start = i;
+		let inClass = false;
+		for (i++; i < source.length && source[i] !== "\n"; i++) {
+			const char = source[i];
+			if (char === "\\") i++;
+			else if (char === "[") inClass = true;
+			else if (char === "]") inClass = false;
+			else if (char === "/" && !inClass) {
+				i++;
+				while (i < source.length && /[a-z]/.test(source[i])) i++;
+				text.push(source.slice(start, i));
+				code.push("//");
+				resetOperand(true);
+				return;
+			}
+		}
+		i = start + 1;
+		text.push("/");
+		code.push("/");
+		resetOperand(false);
+	};
+	const readTemplate = () => {
+		i++;
+		text.push("`");
+		code.push("`");
+		while (i < source.length) {
+			const char = source[i];
+			if (char === "\\") {
+				text.push(source.slice(i, i + 2));
+				i += 2;
+			} else if (char === "`") {
+				text.push("`");
+				code.push("`");
+				i++;
+				resetOperand(true);
+				return;
+			} else if (char === "$" && source[i + 1] === "{") {
+				text.push("${");
+				code.push("${");
+				i += 2;
+				resetOperand(false);
+				readCode(true);
+				text.push("}");
+				code.push("}");
+			} else {
+				text.push(char);
+				i++;
+			}
+		}
+	};
+	const readCode = (untilBrace) => {
+		let depth = 0;
+		while (i < source.length) {
+			const char = source[i];
+			const next = source[i + 1];
+			if (char === "/" && next === "/") {
+				const end = source.indexOf("\n", i);
+				i = end === -1 ? source.length : end;
+				continue;
+			}
+			if (char === "/" && next === "*") {
+				const end = source.indexOf("*/", i + 2);
+				i = end === -1 ? source.length : end + 2;
+				text.push(" ");
+				code.push(" ");
+				prev = " ";
+				continue;
+			}
+			if (char === "'" || char === "\"") {
+				readQuoted(char);
+				continue;
+			}
+			if (char === "`") {
+				readTemplate();
+				continue;
+			}
+			if (char === "/" && regexAllowed()) {
+				readRegex();
+				continue;
+			}
+			if (untilBrace && char === "{") depth++;
+			if (untilBrace && char === "}") {
+				if (depth === 0) {
+					i++;
+					return;
+				}
+				depth--;
+			}
+			text.push(char);
+			code.push(char);
+			i++;
+			if (/[\w$]/.test(char)) word += char;
+			else if (!/\s/.test(char)) {
+				const closesIncrement = (char === "+" || char === "-") && prev === char && !closedIncrement;
+				closedIncrement = closesIncrement;
+				word = "";
+				slashDivides = closesIncrement || /[)\]}<]/.test(char);
+			}
+			prev = char;
+		}
+	};
+	readCode(false);
+	return {
+		code: code.join(""),
+		text: text.join("")
+	};
+}
+/** Every module specifier `text` (comment-free source) imports at runtime, in source order. */
+function importSpecifiers(text) {
+	const specifiers = [];
+	for (const match of text.matchAll(STATIC_IMPORT)) {
+		if (match.groups?.type !== void 0) continue;
+		const specifier = match.groups?.from ?? match.groups?.side;
+		if (specifier !== void 0) specifiers.push(specifier);
+	}
+	for (const match of text.matchAll(DYNAMIC_IMPORT)) if (match.groups?.spec !== void 0) specifiers.push(match.groups.spec);
+	return specifiers;
+}
+/** Whether `code` loads a module importSpecifiers cannot name: a computed specifier, `import.meta.glob`, an argument list it does not read. */
+function hasUnreadImports(code) {
+	for (const match of code.matchAll(DYNAMIC_LOAD)) {
+		READABLE_LOAD.lastIndex = match.index;
+		if (!READABLE_LOAD.test(code)) return true;
+	}
+	return false;
+}
+function inspectsUrl(code) {
+	return URL_TOKENS.test(code);
+}
+function classifySpecifier(specifier, fromDir, aliasDir, nodePath) {
+	if (specifier.includes("${")) return "opaque";
+	const file = specifier.replace(/\?.*$/, "");
+	if (file.startsWith("./") || file.startsWith("../")) return { file: nodePath.resolve(fromDir, file) };
+	if (file.startsWith("@/")) return { file: nodePath.resolve(aliasDir, file.slice(2)) };
+	return TRUSTED_SPECIFIERS.some((prefix) => specifier.startsWith(prefix)) ? "trusted" : "opaque";
+}
+async function isFile(file) {
+	const { stat } = await import("node:fs/promises");
+	return stat(file).then((stats) => stats.isFile(), () => false);
+}
+async function resolveLocalImport(base, nodePath) {
+	const candidates = [base, ...IMPORT_EXTENSIONS.map((extension) => `${base}${extension}`)];
+	const extension = nodePath.extname(base);
+	for (const swapped of JS_TO_TS[extension] ?? []) candidates.push(`${base.slice(0, -extension.length)}${swapped}`);
+	candidates.push(...IMPORT_EXTENSIONS.map((suffix) => nodePath.join(base, `index${suffix}`)));
+	for (const candidate of candidates) if (await isFile(candidate)) return candidate;
+}
+/**
+* Scans `entryFile` and every local module it imports, transitively; undefined without
+* an entry. Anything it cannot read or vouch for leaves the scan incomplete, not guessed.
+*/
+async function scanEntry(entryFile, options) {
+	if (entryFile === void 0) return void 0;
+	const nodePath = await import("node:path");
+	const { readFile } = await import("node:fs/promises");
+	const scan = {
+		complete: true,
+		inspectsUrl: false,
+		requestMiddleware: false
+	};
+	const incomplete = () => ({
+		...scan,
+		complete: false
+	});
+	const seen = /* @__PURE__ */ new Set();
+	const queue = [entryFile];
+	let bytes = 0;
+	while (queue.length > 0) {
+		const file = queue.shift();
+		if (seen.has(file)) continue;
+		seen.add(file);
+		if (seen.size > 32 || file.split(nodePath.sep).includes("node_modules")) return incomplete();
+		const source = await readFile(file, "utf8").catch(() => void 0);
+		if (source === void 0) return incomplete();
+		bytes += Buffer.byteLength(source, "utf8");
+		if (bytes > 262144) return incomplete();
+		const { code, text } = lexSource(source);
+		scan.inspectsUrl ||= inspectsUrl(code);
+		scan.requestMiddleware ||= REQUEST_MIDDLEWARE.test(code);
+		if (hasUnreadImports(code)) return incomplete();
+		for (const specifier of importSpecifiers(text)) {
+			const resolution = classifySpecifier(specifier, nodePath.dirname(file), options.aliasDir, nodePath);
+			if (resolution === "trusted") continue;
+			const resolved = resolution === "opaque" ? void 0 : await resolveLocalImport(resolution.file, nodePath);
+			if (resolved === void 0) return incomplete();
+			if (CODE_EXTENSIONS.has(nodePath.extname(resolved))) queue.push(resolved);
+		}
+	}
+	return scan;
+}
+/** The manifest's verdict over the server entry and the start entry (request middleware). */
+function urlInspectionOf(server, start) {
+	const serverInspects = server?.inspectsUrl === true;
+	const middlewareInspects = start?.inspectsUrl === true;
+	if (serverInspects && middlewareInspects) return "both";
+	if (serverInspects) return "server_entry";
+	if (middlewareInspects) return "request_middleware";
+	if (server?.complete === false || start?.complete === false) return "unknown";
+	return "none";
+}
+//#endregion
 //#region src/routes.ts
 const ROUTE_MANIFEST_VERSION = 1;
 const GENERATOR = `${name}@${version}`;
@@ -662,13 +892,17 @@ function createRouteManifestPlugin(inputs) {
 					logWarning("Not publishing a route manifest: the route tree has no routes.");
 					return;
 				}
-				const startSource = await readSource(await resolveEntryFile(sourceDir, stringOption(subOptions(tanstackStart, "start"), "entry", "start")));
+				const serverFile = await resolveEntryFile(sourceDir, stringOption(subOptions(tanstackStart, "server"), "entry", "server"));
+				const startFile = await resolveEntryFile(sourceDir, stringOption(subOptions(tanstackStart, "start"), "entry", "start"));
+				const aliasDir = nodePath.resolve(process.cwd(), "src");
+				const [server, start] = await Promise.all([scanEntry(serverFile, { aliasDir }), scanEntry(startFile, { aliasDir })]);
 				const payload = serializeRouteManifest({
 					version: ROUTE_MANIFEST_VERSION,
 					generator: GENERATOR,
 					...basepath === "" ? {} : { basepath },
-					serverEntry: typeof subOptions(tanstackStart, "server").entry === "string" ? "custom" : "default",
-					...startSource === void 0 ? {} : { requestMiddleware: /\brequestMiddleware\b/.test(startSource) },
+					serverEntry: serverFile === void 0 ? "default" : "custom",
+					...start === void 0 ? {} : { requestMiddleware: start.requestMiddleware },
+					urlInspection: urlInspectionOf(server, start),
 					routes
 				});
 				if (payload === void 0) return;
@@ -1655,14 +1889,6 @@ function defineConfig(configOrOptions = {}) {
 			plugins: [...internalPlugins, ...options.plugins ?? []]
 		};
 		if (options.vite) config = (0, vite.mergeConfig)(config, options.vite);
-		if (command === "serve" && isSandbox && bundledDevRequested()) {
-			const viteVersion = await resolveInstalledViteVersion();
-			if (viteVersionSupportsBundledDev(viteVersion)) config = (0, vite.mergeConfig)(config, {
-				experimental: { bundledDev: true },
-				plugins: [bundledDevCssUrlShim()]
-			});
-			else logWarning(`Bundled dev requested (${BUNDLED_DEV_ENV_VAR}) but the installed vite (${viteVersion ?? "unresolved"}) is outside the supported 8.1.x range — starting classic dev.`);
-		}
 		if (isSandbox) {
 			validateConfig(config);
 			config = cleanServerConfig((0, vite.mergeConfig)(config, { server: {

package/dist/index.js

@@ -79,58 +79,9 @@ function lovableAssetsProxyPlugin() {
 	};
 }
 //#endregion
-//#region src/bundledDev.ts
-const BUNDLED_DEV_ENV_VAR = "LOVABLE_FEATURE_BUNDLED_DEV";
-function bundledDevRequested() {
-	return process.env[BUNDLED_DEV_ENV_VAR] === "true";
-}
-function viteVersionSupportsBundledDev(version) {
-	if (!version || version.includes("-")) return false;
-	const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
-	if (!match) return false;
-	const [major, minor] = [Number(match[1]), Number(match[2])];
-	return major === 8 && minor === 1;
-}
-async function resolveInstalledViteVersion() {
-	try {
-		const { createRequire } = await import("node:module");
-		const { version } = createRequire(`${process.cwd()}/package.json`)("vite/package.json");
-		return typeof version === "string" ? version : void 0;
-	} catch {
-		return;
-	}
-}
-//#endregion
-//#region src/bundledDevCssUrlShim.ts
-const VIRTUAL_PREFIX = "\0lovable-bundled-dev-css-url:";
-const VIRTUAL_SUFFIX = ".shim.js";
-function bundledDevCssUrlShim() {
-	return {
-		name: "lovable-bundled-dev-css-url-shim",
-		apply: "serve",
-		enforce: "pre",
-		async resolveId(id, importer) {
-			if (!id.endsWith(".css?url")) return null;
-			const resolved = await this.resolve(id.slice(0, -4), importer, { skipSelf: true });
-			if (!resolved) return null;
-			return VIRTUAL_PREFIX + resolved.id + VIRTUAL_SUFFIX;
-		},
-		load(id) {
-			if (!id.startsWith(VIRTUAL_PREFIX) || !id.endsWith(VIRTUAL_SUFFIX)) return null;
-			const file = id.slice(29, -8);
-			const inlineSpecifier = file.includes("?") ? `${file}&inline` : `${file}?inline`;
-			return [
-				`import css from ${JSON.stringify(inlineSpecifier)};`,
-				`const b64 = typeof Buffer !== "undefined" ? Buffer.from(css, "utf8").toString("base64") : btoa(unescape(encodeURIComponent(css)));`,
-				`export default "data:text/css;base64," + b64;`
-			].join("\n");
-		}
-	};
-}
-//#endregion
 //#region package.json
 var name = "@lovable.dev/vite-tanstack-config";
-var version = "2.23.2";
+var version = "2.25.0";
 //#endregion
 //#region src/logging.ts
 const PACKAGE_NAME = "@lovable.dev/vite-tanstack-config";
@@ -364,6 +315,285 @@ function linkedDependenciesPlugin() {
 	};
 }
 //#endregion
+//#region src/urlInspection.ts
+const URL_TOKENS = /\b(?:url|URL|URLPattern|URLSearchParams|pathname|searchParams|path|404|30\d|notFound|isNotFound|redirect|isRedirect|Location|location)\b/;
+const REQUEST_MIDDLEWARE = /\brequestMiddleware\b/;
+const STATIC_IMPORT = /\b(?:import|export)\b(?<type>\s+type\b)?[^'"`;]*?(?<!\.)\bfrom\s*(['"])(?<from>[^'"\n]+)\2|\bimport\s*(['"])(?<side>[^'"\n]+)\4/g;
+const DYNAMIC_IMPORT = /\b(?:import|require)\s*\(\s*(['"`])(?<spec>[^'"`\n]+)\1\s*(?:,[^)]*)?\)/g;
+const DYNAMIC_LOAD = /\b(?:import|require)\s*(?:\.\s*meta\s*\.\s*glob\s*)?\(/g;
+const READABLE_LOAD = /\b(?:import|require)\s*\(\s*(['"`])\1\s*(?:,[^)]*)?\)/y;
+const IMPORT_EXTENSIONS = [
+	".ts",
+	".js",
+	".mts",
+	".mjs",
+	".tsx",
+	".jsx"
+];
+const JS_TO_TS = {
+	".js": [".ts", ".tsx"],
+	".jsx": [".tsx"],
+	".mjs": [".mts"]
+};
+const CODE_EXTENSIONS = /* @__PURE__ */ new Set([
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mts",
+	".mjs",
+	".cts",
+	".cjs"
+]);
+const TRUSTED_SPECIFIERS = ["node:", "@tanstack/"];
+const REGEX_AFTER_KEYWORDS = /* @__PURE__ */ new Set([
+	"return",
+	"typeof",
+	"instanceof",
+	"in",
+	"of",
+	"new",
+	"delete",
+	"void",
+	"throw",
+	"case",
+	"do",
+	"else",
+	"yield",
+	"await"
+]);
+/**
+* Splits comments, string and regex literals from code with a small state machine, so a
+* `//` inside a URL literal or a quote inside a regex cannot swallow the code after it.
+*/
+function lexSource(source) {
+	const code = [];
+	const text = [];
+	let i = 0;
+	let word = "";
+	let slashDivides = false;
+	let prev = "";
+	let closedIncrement = false;
+	const resetOperand = (divides) => {
+		word = "";
+		slashDivides = divides;
+		prev = "";
+		closedIncrement = false;
+	};
+	const regexAllowed = () => word === "" ? !slashDivides : REGEX_AFTER_KEYWORDS.has(word);
+	const readQuoted = (quote) => {
+		const start = i++;
+		while (i < source.length && source[i] !== quote && source[i] !== "\n") {
+			if (source[i] === "\\") i++;
+			i++;
+		}
+		if (source[i] === quote) i++;
+		text.push(source.slice(start, i));
+		code.push(quote + quote);
+		resetOperand(true);
+	};
+	const readRegex = () => {
+		const start = i;
+		let inClass = false;
+		for (i++; i < source.length && source[i] !== "\n"; i++) {
+			const char = source[i];
+			if (char === "\\") i++;
+			else if (char === "[") inClass = true;
+			else if (char === "]") inClass = false;
+			else if (char === "/" && !inClass) {
+				i++;
+				while (i < source.length && /[a-z]/.test(source[i])) i++;
+				text.push(source.slice(start, i));
+				code.push("//");
+				resetOperand(true);
+				return;
+			}
+		}
+		i = start + 1;
+		text.push("/");
+		code.push("/");
+		resetOperand(false);
+	};
+	const readTemplate = () => {
+		i++;
+		text.push("`");
+		code.push("`");
+		while (i < source.length) {
+			const char = source[i];
+			if (char === "\\") {
+				text.push(source.slice(i, i + 2));
+				i += 2;
+			} else if (char === "`") {
+				text.push("`");
+				code.push("`");
+				i++;
+				resetOperand(true);
+				return;
+			} else if (char === "$" && source[i + 1] === "{") {
+				text.push("${");
+				code.push("${");
+				i += 2;
+				resetOperand(false);
+				readCode(true);
+				text.push("}");
+				code.push("}");
+			} else {
+				text.push(char);
+				i++;
+			}
+		}
+	};
+	const readCode = (untilBrace) => {
+		let depth = 0;
+		while (i < source.length) {
+			const char = source[i];
+			const next = source[i + 1];
+			if (char === "/" && next === "/") {
+				const end = source.indexOf("\n", i);
+				i = end === -1 ? source.length : end;
+				continue;
+			}
+			if (char === "/" && next === "*") {
+				const end = source.indexOf("*/", i + 2);
+				i = end === -1 ? source.length : end + 2;
+				text.push(" ");
+				code.push(" ");
+				prev = " ";
+				continue;
+			}
+			if (char === "'" || char === "\"") {
+				readQuoted(char);
+				continue;
+			}
+			if (char === "`") {
+				readTemplate();
+				continue;
+			}
+			if (char === "/" && regexAllowed()) {
+				readRegex();
+				continue;
+			}
+			if (untilBrace && char === "{") depth++;
+			if (untilBrace && char === "}") {
+				if (depth === 0) {
+					i++;
+					return;
+				}
+				depth--;
+			}
+			text.push(char);
+			code.push(char);
+			i++;
+			if (/[\w$]/.test(char)) word += char;
+			else if (!/\s/.test(char)) {
+				const closesIncrement = (char === "+" || char === "-") && prev === char && !closedIncrement;
+				closedIncrement = closesIncrement;
+				word = "";
+				slashDivides = closesIncrement || /[)\]}<]/.test(char);
+			}
+			prev = char;
+		}
+	};
+	readCode(false);
+	return {
+		code: code.join(""),
+		text: text.join("")
+	};
+}
+/** Every module specifier `text` (comment-free source) imports at runtime, in source order. */
+function importSpecifiers(text) {
+	const specifiers = [];
+	for (const match of text.matchAll(STATIC_IMPORT)) {
+		if (match.groups?.type !== void 0) continue;
+		const specifier = match.groups?.from ?? match.groups?.side;
+		if (specifier !== void 0) specifiers.push(specifier);
+	}
+	for (const match of text.matchAll(DYNAMIC_IMPORT)) if (match.groups?.spec !== void 0) specifiers.push(match.groups.spec);
+	return specifiers;
+}
+/** Whether `code` loads a module importSpecifiers cannot name: a computed specifier, `import.meta.glob`, an argument list it does not read. */
+function hasUnreadImports(code) {
+	for (const match of code.matchAll(DYNAMIC_LOAD)) {
+		READABLE_LOAD.lastIndex = match.index;
+		if (!READABLE_LOAD.test(code)) return true;
+	}
+	return false;
+}
+function inspectsUrl(code) {
+	return URL_TOKENS.test(code);
+}
+function classifySpecifier(specifier, fromDir, aliasDir, nodePath) {
+	if (specifier.includes("${")) return "opaque";
+	const file = specifier.replace(/\?.*$/, "");
+	if (file.startsWith("./") || file.startsWith("../")) return { file: nodePath.resolve(fromDir, file) };
+	if (file.startsWith("@/")) return { file: nodePath.resolve(aliasDir, file.slice(2)) };
+	return TRUSTED_SPECIFIERS.some((prefix) => specifier.startsWith(prefix)) ? "trusted" : "opaque";
+}
+async function isFile(file) {
+	const { stat } = await import("node:fs/promises");
+	return stat(file).then((stats) => stats.isFile(), () => false);
+}
+async function resolveLocalImport(base, nodePath) {
+	const candidates = [base, ...IMPORT_EXTENSIONS.map((extension) => `${base}${extension}`)];
+	const extension = nodePath.extname(base);
+	for (const swapped of JS_TO_TS[extension] ?? []) candidates.push(`${base.slice(0, -extension.length)}${swapped}`);
+	candidates.push(...IMPORT_EXTENSIONS.map((suffix) => nodePath.join(base, `index${suffix}`)));
+	for (const candidate of candidates) if (await isFile(candidate)) return candidate;
+}
+/**
+* Scans `entryFile` and every local module it imports, transitively; undefined without
+* an entry. Anything it cannot read or vouch for leaves the scan incomplete, not guessed.
+*/
+async function scanEntry(entryFile, options) {
+	if (entryFile === void 0) return void 0;
+	const nodePath = await import("node:path");
+	const { readFile } = await import("node:fs/promises");
+	const scan = {
+		complete: true,
+		inspectsUrl: false,
+		requestMiddleware: false
+	};
+	const incomplete = () => ({
+		...scan,
+		complete: false
+	});
+	const seen = /* @__PURE__ */ new Set();
+	const queue = [entryFile];
+	let bytes = 0;
+	while (queue.length > 0) {
+		const file = queue.shift();
+		if (seen.has(file)) continue;
+		seen.add(file);
+		if (seen.size > 32 || file.split(nodePath.sep).includes("node_modules")) return incomplete();
+		const source = await readFile(file, "utf8").catch(() => void 0);
+		if (source === void 0) return incomplete();
+		bytes += Buffer.byteLength(source, "utf8");
+		if (bytes > 262144) return incomplete();
+		const { code, text } = lexSource(source);
+		scan.inspectsUrl ||= inspectsUrl(code);
+		scan.requestMiddleware ||= REQUEST_MIDDLEWARE.test(code);
+		if (hasUnreadImports(code)) return incomplete();
+		for (const specifier of importSpecifiers(text)) {
+			const resolution = classifySpecifier(specifier, nodePath.dirname(file), options.aliasDir, nodePath);
+			if (resolution === "trusted") continue;
+			const resolved = resolution === "opaque" ? void 0 : await resolveLocalImport(resolution.file, nodePath);
+			if (resolved === void 0) return incomplete();
+			if (CODE_EXTENSIONS.has(nodePath.extname(resolved))) queue.push(resolved);
+		}
+	}
+	return scan;
+}
+/** The manifest's verdict over the server entry and the start entry (request middleware). */
+function urlInspectionOf(server, start) {
+	const serverInspects = server?.inspectsUrl === true;
+	const middlewareInspects = start?.inspectsUrl === true;
+	if (serverInspects && middlewareInspects) return "both";
+	if (serverInspects) return "server_entry";
+	if (middlewareInspects) return "request_middleware";
+	if (server?.complete === false || start?.complete === false) return "unknown";
+	return "none";
+}
+//#endregion
 //#region src/routes.ts
 const ROUTE_MANIFEST_VERSION = 1;
 const GENERATOR = `${name}@${version}`;
@@ -638,13 +868,17 @@ function createRouteManifestPlugin(inputs) {
 					logWarning("Not publishing a route manifest: the route tree has no routes.");
 					return;
 				}
-				const startSource = await readSource(await resolveEntryFile(sourceDir, stringOption(subOptions(tanstackStart, "start"), "entry", "start")));
+				const serverFile = await resolveEntryFile(sourceDir, stringOption(subOptions(tanstackStart, "server"), "entry", "server"));
+				const startFile = await resolveEntryFile(sourceDir, stringOption(subOptions(tanstackStart, "start"), "entry", "start"));
+				const aliasDir = nodePath.resolve(process.cwd(), "src");
+				const [server, start] = await Promise.all([scanEntry(serverFile, { aliasDir }), scanEntry(startFile, { aliasDir })]);
 				const payload = serializeRouteManifest({
 					version: ROUTE_MANIFEST_VERSION,
 					generator: GENERATOR,
 					...basepath === "" ? {} : { basepath },
-					serverEntry: typeof subOptions(tanstackStart, "server").entry === "string" ? "custom" : "default",
-					...startSource === void 0 ? {} : { requestMiddleware: /\brequestMiddleware\b/.test(startSource) },
+					serverEntry: serverFile === void 0 ? "default" : "custom",
+					...start === void 0 ? {} : { requestMiddleware: start.requestMiddleware },
+					urlInspection: urlInspectionOf(server, start),
 					routes
 				});
 				if (payload === void 0) return;
@@ -1631,14 +1865,6 @@ function defineConfig(configOrOptions = {}) {
 			plugins: [...internalPlugins, ...options.plugins ?? []]
 		};
 		if (options.vite) config = mergeConfig(config, options.vite);
-		if (command === "serve" && isSandbox && bundledDevRequested()) {
-			const viteVersion = await resolveInstalledViteVersion();
-			if (viteVersionSupportsBundledDev(viteVersion)) config = mergeConfig(config, {
-				experimental: { bundledDev: true },
-				plugins: [bundledDevCssUrlShim()]
-			});
-			else logWarning(`Bundled dev requested (${BUNDLED_DEV_ENV_VAR}) but the installed vite (${viteVersion ?? "unresolved"}) is outside the supported 8.1.x range — starting classic dev.`);
-		}
 		if (isSandbox) {
 			validateConfig(config);
 			config = cleanServerConfig(mergeConfig(config, { server: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovable.dev/vite-tanstack-config",
-  "version": "2.23.2",
+  "version": "2.25.0",
   "description": "Vite config wrapper for Lovable TanStack Start projects",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",