@pylonsync/react 0.6.1 → 0.8.0

package/dist/ssr.d.ts

@@ -131,7 +131,23 @@ export interface ServerData {
  * Read request-derived data through `serverData` or a server function.
  */
 export interface PageProps<TParams extends Record<string, string> = Record<string, string>, TSearchParams extends Record<string, string> = Record<string, string>> {
-    /** The incoming URL path (e.g. `/blog/hello-world`). */
+    /**
+     * The incoming request PATH — no query string, no origin
+     * (e.g. `/blog/hello-world`). The query arrives separately, already
+     * parsed, as `searchParams`.
+     */
+    pathname: string;
+    /**
+     * The request path. Same value as `pathname`.
+     *
+     * @deprecated Use `pathname`, or `searchParams` for the query. The name is
+     * a trap: a prop called `url` reads as if it carries the query string, so
+     * `new URL(props.url).searchParams.get("next")` looks correct, compiles,
+     * and silently returns null on every request — the runtime split the query
+     * off before the render. That exact mistake shipped a production auth bug
+     * (a login page dropped `?next=`, stranding every OIDC sign-in). Kept so
+     * existing pages keep working; it will be removed in a later release.
+     */
     url: string;
     /** Dynamic-segment matches keyed by name (e.g. `{ slug: "hello-world" }`). */
     params: TParams;

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.6.1",
+  "version": "0.8.0",
   "type": "module",
   "main": "./src/index.ts",
   "types": "./dist/index.d.ts",
@@ -14,8 +14,8 @@
     "prepack": "bun run build"
   },
   "dependencies": {
-    "@pylonsync/sdk": "0.6.1",
-    "@pylonsync/sync": "0.6.1"
+    "@pylonsync/sdk": "0.8.0",
+    "@pylonsync/sync": "0.8.0"
   },
   "peerDependencies": {
     "react": ">=19.0.0"

package/src/ssr.ts

@@ -162,7 +162,23 @@ export interface PageProps<
   TParams extends Record<string, string> = Record<string, string>,
   TSearchParams extends Record<string, string> = Record<string, string>,
 > {
-  /** The incoming URL path (e.g. `/blog/hello-world`). */
+  /**
+   * The incoming request PATH — no query string, no origin
+   * (e.g. `/blog/hello-world`). The query arrives separately, already
+   * parsed, as `searchParams`.
+   */
+  pathname: string;
+  /**
+   * The request path. Same value as `pathname`.
+   *
+   * @deprecated Use `pathname`, or `searchParams` for the query. The name is
+   * a trap: a prop called `url` reads as if it carries the query string, so
+   * `new URL(props.url).searchParams.get("next")` looks correct, compiles,
+   * and silently returns null on every request — the runtime split the query
+   * off before the render. That exact mistake shipped a production auth bug
+   * (a login page dropped `?next=`, stranding every OIDC sign-in). Kept so
+   * existing pages keep working; it will be removed in a later release.
+   */
   url: string;
   /** Dynamic-segment matches keyed by name (e.g. `{ slug: "hello-world" }`). */
   params: TParams;