@rangojs/router 0.20.0 → 0.22.0

package/src/vite/discovery/shell-prerender-phase.ts

@@ -24,6 +24,14 @@ import { join, resolve } from "node:path";
 import { jsonParseExpression } from "../utils/manifest-utils.js";
 import { writeBuildAssetModule } from "../utils/prerender-utils.js";
 import { buildShellManifestKey } from "../../prerender/shell-manifest-key.js";
+import {
+  resolveVersionsFrom,
+  type RouterVersionsTable,
+} from "../../router-versions.js";
+import {
+  environmentOutDir,
+  type BuilderLike,
+} from "./router-versions-phase.js";
 // Type-only: the producer stages exactly the record shape the runtime
 // read-through consumes, so the contract cannot drift (the KEY half of that
 // contract is shell-manifest-key.ts). No runtime coupling — the RSC-runtime
@@ -35,30 +43,22 @@ import { createRangoDebugger, NS } from "../debug.js";
 const debug = createRangoDebugger(NS.prerender);
 
 /**
- * Minimal builder surface the phase reads: resolved plugins (for the main
- * build's version plugin) and per-environment outDirs.
+ * @param versionsTable The versions the shipped build serves with
+ *   (router-versions-phase.ts), `undefined` outside a build. Never the temp
+ *   server's own version-plugin stamp, which is a dev Date.now() and would
+ *   fail the serve-side isValidShellHit gate forever.
  */
-interface BuilderLike {
-  config?: {
-    base?: string;
-    plugins?: readonly unknown[];
-  };
-  environments?: Record<
-    string,
-    { config?: { build?: { outDir?: string } } } | undefined
-  >;
-}
-
 export async function runShellPrerenderPhase(
   s: DiscoveryState,
   builder: BuilderLike | undefined,
+  versionsTable: RouterVersionsTable | undefined,
 ): Promise<void> {
   // The kept temp server (and the buildEnv deferred with it) is OWNED by the
   // callers — the buildApp post hook's finally on success, buildEnd on an
   // aborted build — so this function stays a pure producer: it only tears
   // down the globals it installs itself.
   const tempServer = s.shellPhaseTempServer;
-  if (!s.isBuildMode || !s.shellCandidates?.length || !tempServer) return;
+  if (!versionsTable || !s.shellCandidates?.length || !tempServer) return;
 
   const candidates: ShellPrerenderCandidate[] = s.shellCandidates;
   const startTotal = performance.now();
@@ -87,21 +87,6 @@ export async function runShellPrerenderPhase(
       return;
     }
 
-    // The MAIN build's version (the value folded into the shipped worker) —
-    // never the temp server's own version-plugin stamp, which is a different
-    // Date.now() and would fail the serve-side isValidShellHit gate forever.
-    const versionPlugin = (builder?.config?.plugins ?? []).find(
-      (p: any) => p?.name === "@rangojs/router:version",
-    ) as { api?: { getBuildVersion?: () => string } } | undefined;
-    const buildVersion = versionPlugin?.api?.getBuildVersion?.();
-    if (!buildVersion) {
-      console.warn(
-        "[rango] shell prerender: main build version unavailable; skipping — " +
-          "routes keep runtime shell capture.",
-      );
-      return;
-    }
-
     // In-realm prerender store over the retained phase-A payloads, so the
     // capture's match() re-enters withCacheLookup and REPLAYS the build-time
     // segments (globalThis is shared between the plugin process and the temp
@@ -130,9 +115,7 @@ export async function runShellPrerenderPhase(
     );
 
     // Built client bootstrap: the prelude must embed the BUILT entry URL.
-    const clientOutDir =
-      builder?.environments?.client?.config?.build?.outDir ??
-      resolve(s.projectRoot, "dist/client");
+    const clientOutDir = environmentOutDir(builder, s.projectRoot, "client");
     const clientAssetsDir = join(clientOutDir, "assets");
     const entryFile = existsSync(clientAssetsDir)
       ? readdirSync(clientAssetsDir).find((f) => /^index-.*\.js$/.test(f))
@@ -223,10 +206,10 @@ export async function runShellPrerenderPhase(
     const staged: Array<{ key: string; value: string }> = [];
     let skipCount = 0;
 
-    // Manifest keys are pathname-only (see shell-manifest-key.ts): two
-    // candidates on one pathname (two routers prerendering the same path)
-    // would be ambiguous at serve time — decline ALL of that pathname's
-    // entries rather than bake a wrong-router shell.
+    // A candidate names no router (the sweep below gives it to the first one
+    // whose match lands on its route): two candidates on one pathname (two
+    // routers prerendering the same path) would be ambiguous — decline ALL of
+    // that pathname's entries rather than bake a wrong-router shell.
     const pathCounts = new Map<string, number>();
     for (const cand of candidates) {
       pathCounts.set(cand.urlPath, (pathCounts.get(cand.urlPath) ?? 0) + 1);
@@ -245,8 +228,14 @@ export async function runShellPrerenderPhase(
       const mainKey = `${cand.routeName}/${cand.paramHash}`;
       let handled = false;
       const mismatches: string[] = [];
-      for (const [, routerInstance] of registry) {
+      for (const [routerId, routerInstance] of registry) {
         if (typeof routerInstance.match !== "function") continue;
+        // The build's table always holds the whole-build pair.
+        const versions = resolveVersionsFrom(
+          versionsTable,
+          routerId,
+          routerInstance.version,
+        )!;
         try {
           const res = await captureMod.captureShellForBuild({
             router: routerInstance,
@@ -259,7 +248,7 @@ export async function runShellPrerenderPhase(
             maxSnapshotBytes: policy.maxSnapshotBytes,
             captureTimeout: policy.captureTimeout,
             buildEnv: s.resolvedBuildEnv,
-            buildVersion,
+            versions,
             captureShellHTML,
             debug: !!debug,
           });
@@ -293,7 +282,7 @@ export async function runShellPrerenderPhase(
             tags: res.tags,
           };
           staged.push({
-            key: buildShellManifestKey(cand.urlPath),
+            key: buildShellManifestKey(routerId, cand.urlPath),
             value: JSON.stringify(value),
           });
           console.log(
@@ -323,10 +312,11 @@ export async function runShellPrerenderPhase(
     }
 
     if (staged.length > 0) {
-      const rscOutDir =
-        builder?.environments?.rsc?.config?.build?.outDir ??
-        resolve(s.projectRoot, "dist/rsc");
-      writeShellManifest(s, rscOutDir, staged);
+      writeShellManifest(
+        s,
+        environmentOutDir(builder, s.projectRoot, "rsc"),
+        staged,
+      );
     }
 
     const totalElapsed = (performance.now() - startTotal).toFixed(0);

package/src/vite/discovery/state.ts

@@ -10,6 +10,7 @@ import type { ScanFilter } from "../../build/generate-route-types.js";
 import type { ClientUrlProjection } from "../../client-urls/server-projection.js";
 
 export const VIRTUAL_ROUTES_MANIFEST_ID = "virtual:rsc-router/routes-manifest";
+export const VIRTUAL_LOADER_MANIFEST_ID = "virtual:rsc-router/loader-manifest";
 
 export interface PluginOptions {
   enableBuildPrerender?: boolean;
@@ -60,7 +61,12 @@ export interface PrecomputedEntry {
 
 export interface ChunkInfo {
   fileName: string;
-  exports: Array<{ name: string; handlerId: string; passthrough: boolean }>;
+  exports: Array<{
+    name: string;
+    handlerId: string;
+    passthrough: boolean;
+    onDemand: boolean;
+  }>;
 }
 
 export interface PerRouterManifestEntry {
@@ -147,8 +153,31 @@ export interface DiscoveryState {
    * buildEnd (aborted build).
    */
   shellPhaseTempServer: import("vite").ViteDevServer | null;
+  /**
+   * Inputs of the per-router cache versions (build-versions.ts), recorded by
+   * generateBundle. plugin-rsc builds the RSC and SSR environments twice (a
+   * scan pass, then the real pass); each pass overwrites its slot, so the
+   * buildApp post hook reads the real pass.
+   */
+  serverBuildGraph: import("./build-versions.js").ServerBuildGraph | null;
+  clientBuildGraph: import("./build-versions.js").ClientBuildGraph | null;
+  ssrBundle: import("./build-versions.js").BundleFiles | null;
+  /** Per environment, the chunk files holding the version module. */
+  versionModuleFiles: Map<string, string[]>;
+  /** Prerender and Static payloads the build rendered, by content digest. */
+  buildData: import("./build-versions.js").BuildDataRecord[];
   handlerChunkInfoMap: Map<string, ChunkInfo>;
   staticHandlerChunkInfoMap: Map<string, ChunkInfo>;
+  /**
+   * handlerId ($$id) -> route name for every route the evaluated source marks
+   * onDemand. Written during discovery (buildStart), consumed by the
+   * generateBundle chunk scan (extractHandlerExportsFromChunk) as the
+   * authoritative onDemand set driving producer retention — the same source
+   * that sets the runtime od trie flag, so any truthy onDemand spelling
+   * (literal, spread, imported const) both marks the route and retains its
+   * producer.
+   */
+  onDemandHandlerIds: Map<string, string>;
   rscEntryFileName: string | null;
   resolvedPrerenderModules: Map<string, string[]> | undefined;
   resolvedStaticModules: Map<string, string[]> | undefined;
@@ -204,8 +233,14 @@ export function createDiscoveryState(
     shellCandidates: null,
     prerenderPayloadValues: null,
     shellPhaseTempServer: null,
+    serverBuildGraph: null,
+    clientBuildGraph: null,
+    ssrBundle: null,
+    versionModuleFiles: new Map(),
+    buildData: [],
     handlerChunkInfoMap: new Map(),
     staticHandlerChunkInfoMap: new Map(),
+    onDemandHandlerIds: new Map(),
     rscEntryFileName: null,
     resolvedPrerenderModules: undefined,
     resolvedStaticModules: undefined,

package/src/vite/discovery/virtual-module-codegen.ts

@@ -8,6 +8,7 @@
 import { mkdirSync, writeFileSync } from "node:fs";
 import { dirname, basename, join } from "node:path";
 import { jsonParseExpression } from "../utils/manifest-utils.js";
+import { compareStrings } from "../utils/compare-strings.js";
 import { VIRTUAL_ROUTES_MANIFEST_ID } from "./state.js";
 import type { DiscoveryState } from "./state.js";
 
@@ -111,8 +112,12 @@ export function generateRoutesManifestModule(state: DiscoveryState): string {
 
     if (hasClientUrlModules) {
       lines.push(`clearClientUrlProjections();`);
-      for (const [referenceId, projection] of state.clientUrlProjectionMap ??
-        []) {
+      // Sorted: the map fills in transform order, which varies between runs,
+      // and this module's bytes feed cache versions (build-versions.ts).
+      const projections = [...(state.clientUrlProjectionMap ?? [])].sort(
+        ([a], [b]) => compareStrings(a, b),
+      );
+      for (const [referenceId, projection] of projections) {
         lines.push(
           `setClientUrlProjection(${JSON.stringify(referenceId)}, ${jsonParseExpression(projection)});`,
         );

package/src/vite/encryption-key.ts

@@ -9,17 +9,104 @@ import { randomBytes } from "node:crypto";
 // via plugin-rsc's `defineEncryptionKey` so build-time-encrypted bound args
 // decrypt at runtime.
 //
-// Cached per process so the temp server (created during the main build's
-// buildStart) and the main build share one key. Overridable via
-// RANGO_ENCRYPTION_KEY for a stable key across builds/deploys; otherwise a fresh
-// key is generated per build (matching plugin-rsc's default posture, where the
-// key is emitted into the build output regardless).
-let cachedKey: string | undefined;
+// Resolved once per process so the temp server (created during the main
+// build's buildStart) and the main build share one key. Source order:
+// rango({ encryptionKey }), then RANGO_ENCRYPTION_KEY, then a key generated for
+// this build. Only the first two are stable across builds.
+//
+// The key is part of the cache version of every router whose server code
+// encrypts with it (discovery/build-versions.ts adds the emitted key file to
+// that router's hash): a payload cached under the old key carries bound args
+// the new build cannot decrypt. So a generated key gives those routers a new
+// version on every build, which is correct and also means their cache is
+// cleared on every deploy.
+
+/** AES key sizes Web Crypto imports for AES-GCM, in bytes. */
+const AES_KEY_BYTES: ReadonlySet<number> = new Set([16, 24, 32]);
+
+const EXPECTED =
+  "a base64-encoded AES key of 16, 24 or 32 bytes (openssl rand -base64 32)";
+
+interface ResolvedEncryptionKey {
+  key: string;
+  /** True when the consumer supplied the key (option or env variable). */
+  stable: boolean;
+}
+
+let resolvedKey: ResolvedEncryptionKey | undefined;
+
+/**
+ * Throws unless `value` is the base64 form of an AES key (16, 24 or 32 bytes).
+ * `source` names where the value came from, for the message.
+ */
+export function assertValidEncryptionKey(value: unknown, source: string): void {
+  if (typeof value !== "string") {
+    throw new Error(
+      `[rango] ${source} must be a string, received ${typeof value}. Expected ${EXPECTED}.`,
+    );
+  }
+  if (value === "") {
+    throw new Error(
+      `[rango] ${source} is an empty string. Unset it to generate a key per build, ` +
+        `or set it to ${EXPECTED}.`,
+    );
+  }
+  const bytes = /^[A-Za-z0-9+/]+={0,2}$/.test(value)
+    ? Buffer.from(value, "base64")
+    : undefined;
+  // Buffer.from tolerates malformed base64 by dropping what it cannot decode;
+  // the round-trip rejects those inputs instead of using a shorter key.
+  if (
+    !bytes ||
+    bytes.toString("base64").replace(/=+$/, "") !== value.replace(/=+$/, "")
+  ) {
+    throw new Error(
+      `[rango] ${source} is not valid base64. Expected ${EXPECTED}.`,
+    );
+  }
+  if (!AES_KEY_BYTES.has(bytes.length)) {
+    throw new Error(
+      `[rango] ${source} decodes to ${bytes.length} bytes. Expected ${EXPECTED}.`,
+    );
+  }
+}
+
+/**
+ * Resolve the build's encryption key from rango({ encryptionKey }) or the
+ * RANGO_ENCRYPTION_KEY fallback, validating whichever is set. Called by
+ * rango() at config time, before any plugin-rsc instance reads the key, so an
+ * invalid key fails the config load instead of the first encrypted action.
+ * A key generated earlier in the process is kept when neither source is set:
+ * the discovery temp server must encrypt with the main build's key.
+ */
+export function configureEncryptionKey(option: string | undefined): void {
+  if (option !== undefined) {
+    assertValidEncryptionKey(option, "rango({ encryptionKey })");
+    resolvedKey = { key: option, stable: true };
+    return;
+  }
+  const fromEnv = process.env.RANGO_ENCRYPTION_KEY;
+  if (fromEnv !== undefined) {
+    assertValidEncryptionKey(fromEnv, "RANGO_ENCRYPTION_KEY");
+    resolvedKey = { key: fromEnv, stable: true };
+    return;
+  }
+  if (resolvedKey && !resolvedKey.stable) return;
+  resolvedKey = { key: randomBytes(32).toString("base64"), stable: false };
+}
+
+function resolved(): ResolvedEncryptionKey {
+  if (!resolvedKey) configureEncryptionKey(undefined);
+  return resolvedKey!;
+}
 
 export function buildEncryptionKey(): string {
-  cachedKey ??=
-    process.env.RANGO_ENCRYPTION_KEY ?? randomBytes(32).toString("base64");
-  return cachedKey;
+  return resolved().key;
+}
+
+/** False when this build generated its own key (it differs on every build). */
+export function isEncryptionKeyStable(): boolean {
+  return resolved().stable;
 }
 
 // The value plugin-rsc inlines as `export default () => (<expr>)`. A JSON string
@@ -27,3 +114,8 @@ export function buildEncryptionKey(): string {
 export function defineEncryptionKeyExpr(): string {
   return JSON.stringify(buildEncryptionKey());
 }
+
+/** @internal Test seam: forget the process-wide key. */
+export function resetEncryptionKeyForTests(): void {
+  resolvedKey = undefined;
+}

package/src/vite/inject-client-debug.ts

@@ -12,37 +12,59 @@ import type { Connect } from "vite";
  * runs on the module regardless of how (or whether) the define is delivered, in
  * both dev and build and for every environment, so the discovery plugin uses this
  * to replace the module with the resolved literal.
+ *
+ * internal-suspense-audit.ts takes the same path for INTERNAL_RANGO_SUSPENSE_AUDIT,
+ * the repo-only switch of the dev suspense audit.
  */
 
+// The router's flag modules, by file name: each exports one boolean named after
+// the env var it is baked from.
+const FLAG_MODULE =
+  /\/(internal-debug|internal-suspense-audit)\.[cm]?[jt]sx?(\?|$)/;
+const FLAG_NAMES: Record<string, string> = {
+  "internal-debug": "INTERNAL_RANGO_DEBUG",
+  "internal-suspense-audit": "INTERNAL_RANGO_SUSPENSE_AUDIT",
+};
+
 /**
- * Scope to the router's own internal-debug module: the published package
- * (`/@rangojs/router/`, incl. pnpm's nested layout) or the monorepo workspace
- * (`/packages/rangojs-router/`). The package-anchored path avoids matching a
- * consumer file that merely sits under a directory named `rangojs-router`.
- * Accepts module ids and dev-server URLs (`/@fs/...internal-debug.ts?v=abc`).
+ * The env var a router flag module is baked from, or undefined. Scoped to the
+ * router's own modules: the published package (`/@rangojs/router/`, incl.
+ * pnpm's nested layout) or the monorepo workspace (`/packages/rangojs-router/`).
+ * The package-anchored path avoids matching a consumer file that merely sits
+ * under a directory named `rangojs-router`. Accepts module ids and dev-server
+ * URLs (`/@fs/...internal-debug.ts?v=abc`).
  */
-export function isRouterInternalDebugId(id: string): boolean {
-  if (!id.includes("internal-debug")) return false;
+function routerFlagName(id: string): string | undefined {
+  if (!id.includes("internal-")) return undefined;
   const norm = id.replace(/\\/g, "/");
-  return (
-    /\/internal-debug\.[cm]?[jt]sx?(\?|$)/.test(norm) &&
-    (norm.includes("/@rangojs/router/") ||
-      norm.includes("/packages/rangojs-router/"))
-  );
+  if (
+    !norm.includes("/@rangojs/router/") &&
+    !norm.includes("/packages/rangojs-router/")
+  ) {
+    return undefined;
+  }
+  const match = FLAG_MODULE.exec(norm);
+  return match ? FLAG_NAMES[match[1]!] : undefined;
+}
+
+/** A router flag module: internal-debug.ts or internal-suspense-audit.ts. */
+export function isRouterInternalDebugId(id: string): boolean {
+  return routerFlagName(id) !== undefined;
 }
 
 /**
- * Transform: replace the module with the resolved literal.
- * Returns null for any module that is not the router's internal-debug module.
+ * Transform: replace a router flag module with the resolved literal.
+ * Returns null for any other module.
  */
 export function injectClientDebugFlag(
   id: string,
 ): { code: string; map: null } | null {
   // Cheap early-out: this hook runs on every module in every environment.
-  if (!isRouterInternalDebugId(id)) return null;
-  // Emit the whole module: internal-debug.ts has a single export, kept in sync.
+  const name = routerFlagName(id);
+  if (name === undefined) return null;
+  // Emit the whole module: each flag module has a single export, kept in sync.
   return {
-    code: `export const INTERNAL_RANGO_DEBUG = ${!!process.env.INTERNAL_RANGO_DEBUG};\n`,
+    code: `export const ${name} = ${!!process.env[name]};\n`,
     map: null,
   };
 }
@@ -63,9 +85,9 @@ export function injectClientDebugFlag(
  * immune -- workspace source is outside node_modules and served no-cache --
  * which is why this bit only npm consumers.
  *
- * internal-debug.ts is the ONLY flag-varying module in the graph (its importers
- * are byte-identical across flag states), so forcing revalidation for this one
- * tiny module is sufficient and costs one conditional request per session. The
+ * The two flag modules are the only flag-varying modules in the graph (their
+ * importers are byte-identical across flag states), so forcing revalidation for
+ * them is sufficient and costs a conditional request each per session. The
  * middleware is unconditional (not gated on the flag) so an already-poisoned
  * cache heals in both directions. Alternatives that do not work: a plugin
  * `resolveId` appending a flag query never fires in Vite 8 dev for

package/src/vite/plugin-types.ts

@@ -239,6 +239,34 @@ interface RangoBaseOptions {
   prerender?: {
     onError?: "fail" | "warn";
   };
+
+  /**
+   * The key inline server actions encrypt their bound arguments with:
+   * base64-encoded 32 bytes (`openssl rand -base64 32`). Pass it from the
+   * environment, never as a literal in the config file:
+   *
+   * ```ts
+   * rango({ encryptionKey: process.env.RANGO_ENCRYPTION_KEY })
+   * ```
+   *
+   * Why set it: the key is part of the cache version of every router whose
+   * server code encrypts with it, because a payload cached under one key
+   * carries arguments another key cannot decrypt. Without a stable key rango
+   * generates one per build, so those routers get a new version, and a cleared
+   * cache, on every deploy. With a stable key their cache survives a deploy
+   * that does not change their server code. It also lets a build decrypt
+   * arguments an earlier build encrypted (a cached or prerendered payload, an
+   * open tab).
+   *
+   * Validated when `rango()` is called: a value that is not base64 or does not
+   * decode to an AES key size (16, 24 or 32 bytes) throws. `undefined` (the
+   * variable is unset) falls back to the `RANGO_ENCRYPTION_KEY` environment
+   * variable, then to a generated key. Rotating the key clears the cache of
+   * the routers that use it.
+   *
+   * @default process.env.RANGO_ENCRYPTION_KEY, else a key generated per build
+   */
+  encryptionKey?: string;
 }
 
 /**

package/src/vite/plugins/{version-injector.ts → entry-bootstrap-injector.ts}

@@ -5,11 +5,9 @@ import { resolveRscEntryFromConfig } from "../utils/shared-utils.js";
 import { RSC_ENTRY_BOOTSTRAP_IMPORTS } from "./virtual-entries.js";
 
 /**
- * Plugin that auto-injects VERSION, routes-manifest, and loader-manifest into
- * custom entry.rsc files. If a custom entry.rsc file uses createRSCHandler but
- * doesn't pass version, this transform adds the import and property
- * automatically. It also ensures the routes-manifest and loader-manifest
- * virtual modules are always imported.
+ * Plugin that auto-injects the routes-manifest and loader-manifest imports
+ * into a custom entry.rsc file (the Cloudflare preset, where the consumer owns
+ * the worker entry).
  *
  * The loader-manifest import is what makes fetchable loaders resolvable on a
  * custom worker entry. The virtual RSC entry (getVirtualEntryRSC) imports the
@@ -23,13 +21,13 @@ import { RSC_ENTRY_BOOTSTRAP_IMPORTS } from "./virtual-entries.js";
  * manifest, hence the production-only failure this fixes.
  * @internal
  */
-export function createVersionInjectorPlugin(
+export function createEntryBootstrapInjectorPlugin(
   rscEntryPath: string | undefined,
 ): Plugin {
   let resolvedEntryPath = "";
 
   return {
-    name: "@rangojs/router:version-injector",
+    name: "@rangojs/router:entry-bootstrap-injector",
     enforce: "pre",
 
     configResolved(config) {
@@ -54,21 +52,8 @@ export function createVersionInjectorPlugin(
       const prepend: string[] = RSC_ENTRY_BOOTSTRAP_IMPORTS.map(
         (id) => `import "${id}";`,
       );
-      let newCode = code;
-      const needsVersion =
-        code.includes("createRSCHandler") &&
-        !code.includes("@rangojs/router:version") &&
-        /createRSCHandler\s*\(\s*\{/.test(code);
 
-      if (needsVersion) {
-        prepend.push(`import { VERSION } from "@rangojs/router:version";`);
-        newCode = newCode.replace(
-          /createRSCHandler\s*\(\s*\{/,
-          "createRSCHandler({\n  version: VERSION,",
-        );
-      }
-
-      const lines = newCode.split("\n");
+      const lines = code.split("\n");
       let insertAt = 0;
       while (insertAt < lines.length) {
         const trimmed = lines[insertAt]!.trim();
@@ -78,7 +63,7 @@ export function createVersionInjectorPlugin(
           break;
         }
       }
-      newCode = [
+      const newCode = [
         ...lines.slice(0, insertAt),
         ...prepend,
         ...lines.slice(insertAt),

package/src/vite/plugins/expose-ids/export-analysis.ts

@@ -55,7 +55,7 @@ export function isExportOnlyFile(
 // (which may be nested, e.g. createLoader<A<B>>(...)) and the call paren are
 // resolved per match via findCallParenAfterGenerics, so a nested `>` no longer
 // defeats the scan the way `<[^>]*>` did (it stopped at the first `>`).
-function createCallPattern(fnNames: string[]): RegExp {
+export function createCallPattern(fnNames: string[]): RegExp {
   return new RegExp(`\\b(?:${fnNames.map(escapeRegExp).join("|")})\\b`, "g");
 }