@nifrajs/web 4.0.2 → 5.1.0

package/src/internal/wire-date.ts

@@ -0,0 +1,16 @@
+/**
+ * `t.date()` across the wire, server half. JSON has no dates, so the output guard hands the page a
+ * `wireDate()`: a real `Date` for the server render that serializes as `{ "__nifra_date": iso }`. The
+ * browser half (`revive-dates.ts`) rebuilds those tags, so both renders see the same value.
+ */
+import { DATE_TAG } from "./revive-dates.ts"
+
+const WIRE_JSON: PropertyDescriptor = {
+  value(this: Date): Readonly<Record<string, string>> {
+    return { [DATE_TAG]: this.toISOString() }
+  },
+}
+
+/** A `Date` that crosses JSON tagged, so the browser can tell it from a string that looks like one. */
+export const wireDate = (time: number): Date =>
+  Object.defineProperty(new Date(time), "toJSON", WIRE_JSON)

package/src/internal/without-query.ts

@@ -0,0 +1,8 @@
+/** A module id or specifier up to its first `?` or `#`. An index scan, since `/[?#].*$/` retries
+ * from every `#` and runs in quadratic time on a long run of them before a line break. */
+export function withoutQuery(value: string): string {
+  const query = value.indexOf("?")
+  const hash = value.indexOf("#")
+  const cut = query === -1 ? hash : hash === -1 ? query : Math.min(query, hash)
+  return cut === -1 ? value : value.slice(0, cut)
+}

package/src/internal/zone-graph.ts

@@ -19,6 +19,7 @@ import {
 } from "../zones.ts"
 import { codeUnitOrder } from "./code-unit-order.ts"
 import { isBareNodeBuiltin } from "./node-builtins.ts"
+import { withoutQuery } from "./without-query.ts"
 
 /** What a graph module id names. */
 export type ModuleSource =
@@ -30,9 +31,8 @@ export type ModuleSource =
 
 /** A namespace prefix needs two characters, so a Windows drive letter still reads as a path. */
 const NAMESPACED = /^([a-z][\w.+-]+):(.*)$/i
-const stripQuery = (id: string): string => id.replace(/[?#].*$/, "")
 const virtualOf = (rest: string): ModuleSource => {
-  const file = stripQuery(rest)
+  const file = withoutQuery(rest)
   return isAbsolute(file) && existsSync(file) ? { kind: "virtual", file } : { kind: "virtual" }
 }
 
@@ -42,7 +42,7 @@ export function bunModuleSource(cwd: string): (id: string) => ModuleSource {
     if (id.startsWith("node:") || id.startsWith("bun:")) return { kind: "builtin" }
     const namespaced = NAMESPACED.exec(id)
     if (namespaced !== null && namespaced[1] !== "file") return virtualOf(namespaced[2] ?? "")
-    return { kind: "file", file: resolve(cwd, stripQuery(namespaced?.[2] ?? id)) }
+    return { kind: "file", file: resolve(cwd, withoutQuery(namespaced?.[2] ?? id)) }
   }
 }
 
@@ -50,7 +50,7 @@ export function bunModuleSource(cwd: string): (id: string) => ModuleSource {
 export function rollupModuleSource(id: string): ModuleSource {
   if (id.startsWith("node:") || id.includes("__vite-browser-external")) return { kind: "builtin" }
   if (id.startsWith("\0")) return virtualOf(id.slice(1).replace(/^[\w-]+:/, ""))
-  const file = stripQuery(id)
+  const file = withoutQuery(id)
   return isAbsolute(file) ? { kind: "file", file } : { kind: "virtual" }
 }
 
@@ -60,6 +60,38 @@ export interface ZoneLeak {
   readonly reason: string
   /** Shortest import path from an entry: `[entry, ...as-written specifiers]`. */
   readonly chain: readonly string[]
+  /** The undeclared package the refusal is about; its files share one line in the report. */
+  readonly package?: string
+}
+
+const leakLine = (leak: ZoneLeak, module = leak.module): string =>
+  `  - ${module}: ${leak.reason}${leak.chain.length > 1 ? `\n      via ${leak.chain.join(" → ")}` : ""}`
+
+/** One line per leak, except that the files of one undeclared package share a single line. */
+function leakLines(leaks: readonly ZoneLeak[]): string[] {
+  const byPackage = new Map<string, ZoneLeak[]>()
+  for (const leak of leaks) {
+    if (leak.package === undefined) continue
+    const group = byPackage.get(leak.package)
+    if (group === undefined) byPackage.set(leak.package, [leak])
+    else group.push(leak)
+  }
+  const lines: string[] = []
+  for (const leak of leaks) {
+    const group = leak.package === undefined ? undefined : byPackage.get(leak.package)
+    if (group === undefined || group.length < 2) {
+      lines.push(leakLine(leak))
+      continue
+    }
+    if (group[0] !== leak) continue
+    const shown = group
+      .slice(0, 3)
+      .map((item) => item.module)
+      .join(", ")
+    const more = group.length > 3 ? ` and ${group.length - 3} more` : ""
+    lines.push(leakLine(leak, `${group.length} files (${shown}${more})`))
+  }
+  return lines
 }
 
 export interface ClientGraphVerdict {
@@ -71,6 +103,8 @@ export interface ClientGraphVerdict {
 }
 
 export interface VerifyClientGraphOptions {
+  /** Exact modules certified by the component compiler in this generation. */
+  readonly componentModules?: ReadonlySet<string>
   readonly classifier: ZoneClassifier
   readonly sourceOf: (id: string) => ModuleSource
   /** The private-env denial for a browser-code file (see `privateEnvCheck`); unchecked when absent. */
@@ -192,16 +226,21 @@ export function verifyClientGraph(
   }
 
   const denied = new Map<string, string>()
+  const deniedPackage = new Map<string, string>()
   for (const id of [...Object.keys(graph.modules), ...dropped]) {
     const source = sourceOf(id)
     const file = source.kind === "builtin" ? undefined : source.file
     if (file === undefined) continue
     const classification = classifier.classify(file)
     let reason = browserDenial(classification)
-    for (const spec of specifiers.get(id) ?? []) reason ??= browserDenial(classification, spec)
+    // An import that names a package entry is judged by that entry's own declared side.
+    for (const spec of specifiers.get(id) ?? [])
+      reason ??= browserDenial(classifier.classify(file, spec), spec)
     if (reason === undefined && BROWSER_CODE.has(classification.zone))
       reason = options.privateEnv?.(file)
     if (reason !== undefined) denied.set(id, reason)
+    if (classification.zone === "error" && classification.package !== undefined)
+      deniedPackage.set(id, classification.package)
   }
 
   // Chains start at a route file where they can: a lazily split module is an entry of its own chunk,
@@ -225,11 +264,15 @@ export function verifyClientGraph(
       : entries
   const chains = denied.size === 0 ? new Map<string, string[]>() : shortestChains(roots, edges)
   const leaks = [...denied]
-    .map(([id, reason]) => ({
-      module: labelOf(id),
-      reason,
-      chain: (chains.get(id) ?? [id]).map((label, i) => (i === 0 ? labelOf(label) : label)),
-    }))
+    .map(([id, reason]): ZoneLeak => {
+      const leak = {
+        module: labelOf(id),
+        reason,
+        chain: (chains.get(id) ?? [id]).map((label, i) => (i === 0 ? labelOf(label) : label)),
+      }
+      const pkg = deniedPackage.get(id)
+      return pkg === undefined ? leak : { ...leak, package: pkg }
+    })
     .sort((a, b) => codeUnitOrder(a.module, b.module))
 
   const misplacedExports: string[] = []
@@ -333,10 +376,14 @@ export function verifyServerGraph(
     readonly module: string
     readonly reason: string
     readonly tail?: string
+    readonly package?: string
   }> = []
   for (const [id, module] of Object.entries(graph.modules)) {
     const from = classOf(id)
-    if (from?.zone === "error") found.push({ at: id, module: labelOf(id), reason: from.reason })
+    if (from?.zone === "error") {
+      const at = { at: id, module: labelOf(id), reason: from.reason }
+      found.push(from.package === undefined ? at : { ...at, package: from.package })
+    }
     const file = fileOf(id)
     const env =
       from !== undefined && file !== undefined && BROWSER_CODE.has(from.zone)
@@ -361,10 +408,23 @@ export function verifyServerGraph(
       const target = resolveEdge(im)
       if (target === undefined) continue
       out.push({ to: target, label: im.original ?? labelOf(target) })
-      const to = classOf(target)
+      const targetFile = fileOf(target)
+      const to =
+        im.original === undefined || targetFile === undefined
+          ? classOf(target)
+          : classifier.classify(targetFile, im.original)
+      if (to?.zone === "error" && to.entry !== undefined)
+        found.push({
+          at: id,
+          module: labelOf(target),
+          reason: to.reason,
+          tail: im.original ?? labelOf(target),
+        })
       if (from === undefined || to === undefined || from.zone === "error" || to.zone === "error")
         continue
-      if (!importAllowed(from.zone, to.zone)) {
+      const componentBridge =
+        to.zone === "component" && options.componentModules?.has(fileOf(target) ?? "") === true
+      if (!componentBridge && !importAllowed(from.zone, to.zone)) {
         found.push({
           at: id,
           module: labelOf(target),
@@ -386,9 +446,10 @@ export function verifyServerGraph(
   ]
   const chains = shortestChains(entries, edges)
   const violations = found
-    .map(({ at, module, reason, tail }) => {
+    .map(({ at, module, reason, tail, package: pkg }): ZoneLeak => {
       const chain = (chains.get(at) ?? [at]).map((label, i) => (i === 0 ? labelOf(label) : label))
-      return { module, reason, chain: tail === undefined ? chain : [...chain, tail] }
+      const violation = { module, reason, chain: tail === undefined ? chain : [...chain, tail] }
+      return pkg === undefined ? violation : { ...violation, package: pkg }
     })
     .sort((a, b) => codeUnitOrder(a.module, b.module) || codeUnitOrder(a.reason, b.reason))
   return { violations }
@@ -397,11 +458,7 @@ export function verifyServerGraph(
 /** The build-failing message for a server graph that breaks the zone rules. */
 export function formatServerGraphVerdict(verdict: ServerGraphVerdict): string | undefined {
   if (verdict.violations.length === 0) return undefined
-  const lines = verdict.violations.map(
-    (v) =>
-      `  - ${v.module}: ${v.reason}${v.chain.length > 1 ? `\n      via ${v.chain.join(" → ")}` : ""}`,
-  )
-  return `[nifra/web] the server build breaks the zone rules:\n${lines.join("\n")}`
+  return `[nifra/web] the server build breaks the zone rules:\n${leakLines(verdict.violations).join("\n")}`
 }
 
 /** One emitted file, as the accounting sees it. */
@@ -561,12 +618,8 @@ const indent = (lines: readonly string[]): string => lines.map((line) => `  - ${
 export function formatClientGraphVerdict(verdict: ClientGraphVerdict): string | undefined {
   const sections: string[] = []
   if (verdict.leaks.length > 0) {
-    const lines = verdict.leaks.map(
-      (leak) =>
-        `  - ${leak.module}: ${leak.reason}${leak.chain.length > 1 ? `\n      via ${leak.chain.join(" → ")}` : ""}`,
-    )
     sections.push(
-      `[nifra/web] the browser build reached code that may not ship to a browser:\n${lines.join("\n")}\n` +
+      `[nifra/web] the browser build reached code that may not ship to a browser:\n${leakLines(verdict.leaks).join("\n")}\n` +
         "Reach backend code through a route's backend half (x.backend.ts) or a *.fn.ts server function; " +
         "code both sides need belongs in shared/.",
     )