@nifrajs/web 2.4.0 → 2.6.0

package/src/manifest.ts

@@ -320,7 +320,10 @@ const errorIdFor = (dir: string): string => (dir === "" ? "_error" : `${dir}/_er
  * the last segment.
  */
 /** Every `[…]` marker in a file segment, so a part-literal segment can be spliced into a pattern. */
-const FILE_MARKER = /\[([^\]]*)\]/g
+// `[` is excluded from the inner class as well as `]`: marker names are identifiers, and letting the
+// class swallow `[` makes a run of unclosed brackets backtrack quadratically (each start position
+// re-scans the rest of the segment before failing).
+const FILE_MARKER = /\[([^\][]*)\]/g
 const FILE_PARAM_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/
 
 /**

package/src/plugins/svg.ts

@@ -77,14 +77,46 @@ export interface SvgToJsxOptions {
   readonly classProp?: string
 }
 
+/**
+ * Strip the XML declaration, comments, and DOCTYPE from an SVG source by index scan. Shared by every
+ * adapter's SVG-component transform instead of chained regex `replace`s, for two reasons: the lazy
+ * `[\s\S]*?` scans backtrack quadratically on an unterminated marker, and sequential single-pass
+ * replaces can splice removed delimiters back together (`<<!---->!DOCTYPE …>` survives them). The
+ * scan removes each block in one forward pass, so neither failure mode exists. An unterminated
+ * marker swallows the rest of the input - the correct reading, matching an XML parser.
+ */
+export function stripSvgPreamble(xml: string): string {
+  const parts: string[] = []
+  let keepFrom = 0
+  let i = 0
+  while (i < xml.length) {
+    let skipEnd = -1
+    if (xml.startsWith("<?", i)) {
+      const close = xml.indexOf("?>", i + 2)
+      skipEnd = close === -1 ? xml.length : close + 2
+    } else if (xml.startsWith("<!--", i)) {
+      const close = xml.indexOf("-->", i + 4)
+      skipEnd = close === -1 ? xml.length : close + 3
+    } else if (xml.slice(i, i + 9).toLowerCase() === "<!doctype") {
+      const close = xml.indexOf(">", i + 9)
+      skipEnd = close === -1 ? xml.length : close + 1
+    }
+    if (skipEnd === -1) {
+      i++
+    } else {
+      parts.push(xml.slice(keepFrom, i))
+      i = skipEnd
+      keepFrom = skipEnd
+    }
+  }
+  parts.push(xml.slice(keepFrom))
+  return parts.join("").trim()
+}
+
 /** Convert an SVG XML string into a JSX-safe `<svg>…</svg>` element with `{...props}` spread on the root. */
 export function svgToJsx(xml: string, options: SvgToJsxOptions = {}): string {
   const classProp = options.classProp ?? "className"
-  let out = xml
-    .replace(/<\?xml[\s\S]*?\?>/g, "") // XML declaration
-    .replace(/<!--[\s\S]*?-->/g, "") // comments
-    .replace(/<!DOCTYPE[^>]*>/gi, "")
-    .trim()
+  let out = stripSvgPreamble(xml)
 
   // Namespaced attributes → camelCase (xlink:href → xlinkHref, xmlns:xlink → xmlnsXlink).
   out = out.replace(/\b([a-z]+):([a-z]+)=/gi, (_m, ns: string, name: string) => {

package/src/prerender.ts

@@ -52,9 +52,17 @@ export interface PrerenderResult {
   readonly fallbacks: Readonly<Record<string, "ssr" | "404">>
 }
 
+/** Strip trailing `/` runs by index scan - an unanchored-start `/\/+$/` replace backtracks
+ * quadratically on a long slash run, and route patterns are input here. */
+function trimTrailingSlashes(path: string): string {
+  let end = path.length
+  while (end > 0 && path.charCodeAt(end - 1) === 47 /* '/' */) end--
+  return path.slice(0, end)
+}
+
 /** Map a route path to its output file: `/` → `index.html`, `/a/b` → `a/b/index.html`. */
 export function htmlFileFor(pattern: string): string {
-  const trimmed = pattern.replace(/^\/+/, "").replace(/\/+$/, "")
+  const trimmed = trimTrailingSlashes(pattern.replace(/^\/+/, ""))
   return trimmed === "" ? "index.html" : `${trimmed}/index.html`
 }
 
@@ -203,7 +211,7 @@ export function cloudflarePagesRoutes(
   const exclude = [...(options.staticGlobs ?? ["/assets/*"])]
   for (const path of options.prerendered) {
     exclude.push(path) // the prerendered document
-    exclude.push(path === "/" ? "/_data.json" : `${path.replace(/\/+$/, "")}/_data.json`) // its data
+    exclude.push(path === "/" ? "/_data.json" : `${trimTrailingSlashes(path)}/_data.json`) // its data
   }
   return { version: 1, include: ["/*"], exclude }
 }

package/src/router.ts

@@ -322,10 +322,18 @@ const readResponseData = (res: Response, signal?: AbortSignal): Promise<unknown>
     ? parseNdjsonData(res.body, signal)
     : res.json()
 
+// Index scan, not `/\/+$/` - the unanchored-start trailing-run replace backtracks quadratically and
+// the pathname is caller-controlled.
+const trimTrailingSlashes = (path: string): string => {
+  let end = path.length
+  while (end > 0 && path.charCodeAt(end - 1) === 47 /* '/' */) end--
+  return path.slice(0, end)
+}
+
 // The static `_data.json` URL for a prerendered path: `/` → `/_data.json`, `/users/7` →
 // `/users/7/_data.json` (mirrors the build's `dataFileFor`).
 const dataUrlFor = (pathname: string): string =>
-  pathname === "/" ? "/_data.json" : `${pathname.replace(/\/+$/, "")}/_data.json`
+  pathname === "/" ? "/_data.json" : `${trimTrailingSlashes(pathname)}/_data.json`
 
 const defaultFetchData: FetchRouteData = async (path, _match, signal, navigation) => {
   // SSG fast path: if this path was prerendered, its loader data is a static file - fetch that (no
@@ -333,7 +341,10 @@ const defaultFetchData: FetchRouteData = async (path, _match, signal, navigation
   // or a stale set), so it's always safe. Non-SSG apps have no global → the dynamic path, unchanged.
   const prerendered = (globalThis as { [PRERENDERED_GLOBAL]?: unknown })[PRERENDERED_GLOBAL]
   if (Array.isArray(prerendered)) {
-    const pathname = path.replace(/[?#].*$/, "")
+    // `search` + `slice` rather than `replace(/[?#].*$/)`: the trailing `.*$` backtracks
+    // quadratically on adversarial input, and the URL is caller-controlled.
+    const cut = path.search(/[?#]/)
+    const pathname = cut === -1 ? path : path.slice(0, cut)
     if (prerendered.includes(pathname)) {
       const staticRes = await fetch(dataUrlFor(pathname), { signal: signal ?? null })
       if (staticRes.ok) return readResponseData(staticRes, signal)

package/src/service-worker.ts

@@ -45,6 +45,8 @@ export interface ServiceWorkerOptions {
 const SW_URL = /^\/[\w\-./@%]*$/
 
 /** A precache URL has to be same-origin, rooted, and free of anything that could break out of a list. */
+import { jsStringLiteral } from "./internal/js-string.ts"
+
 function assertPrecachable(url: string, label: string): void {
   if (typeof url !== "string" || url === "") {
     throw new Error(`[nifra/service-worker] ${label} must be a non-empty string`)
@@ -161,5 +163,5 @@ self.addEventListener("fetch", (event) => {
  */
 export function serviceWorkerRegistration(scriptUrl = "/sw.js"): string {
   assertPrecachable(scriptUrl, "scriptUrl")
-  return `if("serviceWorker"in navigator){addEventListener("load",function(){navigator.serviceWorker.register(${JSON.stringify(scriptUrl)}).catch(function(){})})}`
+  return `if("serviceWorker"in navigator){addEventListener("load",function(){navigator.serviceWorker.register(${jsStringLiteral(scriptUrl)}).catch(function(){})})}`
 }

package/src/vite.ts

@@ -271,6 +271,22 @@ export function normalizeRolldownPlugins(
   })
 }
 
+/**
+ * The npm package a bare module specifier belongs to (`@nifrajs/web-react/client` →
+ * `@nifrajs/web-react`, `some-adapter/client` → `some-adapter`), or `undefined` for a path-shaped
+ * specifier (relative/absolute), which names no package.
+ */
+function packageNameOf(specifier: string): string | undefined {
+  if (specifier.startsWith(".") || specifier.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(specifier))
+    return undefined
+  const parts = specifier.split("/")
+  return specifier.startsWith("@")
+    ? parts.length >= 2
+      ? `${parts[0]}/${parts[1]}`
+      : undefined
+    : parts[0]
+}
+
 /**
  * Start the Vite-backed dev server: Vite serves/HMRs the client; nifra SSRs each request and Vite
  * injects its HMR client + the framework refresh preamble via `transformIndexHtml`.
@@ -349,6 +365,34 @@ export async function createViteDevServer(options: ViteDevServerOptions): Promis
 
   // `conditions: ["bun"]` makes Vite resolve nifra's workspace packages (`@nifrajs/web-react/client`, …) to
   // their TS **source** - so the dev server needs no prior `dist` build of the adapter packages.
+  //
+  // That covers the CLIENT half only: Vite resolves SSR through `ssr.resolve.*`, which ignores
+  // `resolve.conditions`. Left at its defaults, SSR resolves a package's `default` export (`dist/…`)
+  // while the app's own imports of the same package run under Bun and resolve the `bun` export
+  // (`src/…`). Two consequences, both real bugs:
+  //   1. The adapter package loads TWICE - the app's Bun import (the adapter passed to `createWebApp`)
+  //      and the route modules' Vite-SSR import - so `createContext` runs twice and the routing hooks
+  //      (`useSearch`/`useParams`/`useLocation`) read a context the render never provided: they
+  //      SSR-render their EMPTY defaults in dev while the loader (same request!) sees the real values.
+  //   2. SSR reads `dist`, which nothing in the dev loop rebuilds - a stale `dist` then 500s inside
+  //      framework code and reads exactly like a framework regression.
+  // Fix, below: `ssr.resolve.{conditions,externalConditions}` mirror the client conditions (so SSR
+  // resolves the same files Bun does), and the adapter package + `@nifrajs/web` are `ssr.external`
+  // (so Bun's OWN module cache serves them to route modules - one instance, one `RouterContext`).
+  const resolveConditions = [
+    ...(options.conditions ?? []),
+    "bun",
+    "module",
+    "browser",
+    "development",
+  ]
+  // SSR must not pick `browser` builds; otherwise identical to the client list so both halves agree.
+  const ssrConditions = [...(options.conditions ?? []), "bun", "module", "node", "development"]
+  // The adapter package (from `clientModule`, e.g. `@nifrajs/web-react/client` → `@nifrajs/web-react`)
+  // - identity-sensitive (its `RouterContext` must be the ONE the Bun-imported adapter provides). A
+  // path-shaped `clientModule` (tests) names no package; there is then nothing to externalize.
+  const adapterPackage = packageNameOf(options.clientModule)
+  const ssrExternal = [...(adapterPackage !== undefined ? [adapterPackage] : []), "@nifrajs/web"]
   const usePolling = options.poll ?? process.env.CHOKIDAR_USEPOLLING === "1"
   // Never `import("vite")` directly here: the guard in `importVite` has to run first, and the dev
   // server importing vite unguarded is precisely what poisoned the module for the whole process.
@@ -376,7 +420,7 @@ export async function createViteDevServer(options: ViteDevServerOptions): Promis
     // reads it, and the dev server is a client bundler like any other.
     plugins: [viteServerFnStub(), viteServerOnlyEmpty(), ...plugins],
     resolve: {
-      conditions: [...(options.conditions ?? []), "bun", "module", "browser", "development"],
+      conditions: resolveConditions,
       // Dedupe React to ONE copy. In a multi-root workspace a shared package can pull react/react-dom
       // from a SIBLING app's node_modules, so the dev server loads two React cores → a second hook
       // dispatcher → `resolveDispatcher().useState` null on any hook-using route (the error points at the
@@ -384,6 +428,20 @@ export async function createViteDevServer(options: ViteDevServerOptions): Promis
       // dev matches prod. No-op for non-React apps (the package simply isn't present to dedupe).
       dedupe: ["react", "react-dom"],
     },
+    ssr: {
+      // Explicit listing forces external even for workspace-LINKED packages (Vite's default keeps
+      // linked deps internal), so a monorepo dev run gets the same single-instance guarantee as an
+      // npm-installed one.
+      external: ssrExternal,
+      resolve: {
+        // Non-externalized deps (a linked `@platform/*`, say): Vite's runner evaluates them, but from
+        // the same files Bun would pick - `bun`-conditioned source, never a stale `dist`.
+        conditions: ssrConditions,
+        // Externalized deps: Vite resolves the specifier, Bun imports the result. `bun` first so the
+        // resolved file IS the one already in Bun's module cache (one evaluation, shared context).
+        externalConditions: ssrConditions,
+      },
+    },
     ...(options.define ? { define: options.define } : {}),
   })