@rangojs/router 0.22.1 → 0.24.0

package/src/server/context.ts

@@ -117,6 +117,13 @@ export type EntryPropDatas = {
  */
 export type EntryPropRender = {
   loading?: ReactNode | false;
+  /**
+   * loading(fallback, { prefetch: false }) with a renderable fallback: a
+   * prefetch defers what the fallback covers while the entry's segment is
+   * new to the client (router/segment-resolution/prefetch-deferral.ts). Set
+   * on both DSL evaluations, whatever `ssr` did to `loading`.
+   */
+  loadingPrefetch?: false;
   transition?: TransitionConfig;
 };
 
@@ -150,6 +157,12 @@ export type LoaderEntry = {
    * navigation evaluation never has it.
    */
   bake?: true;
+  /**
+   * loader(Def, { prefetch: false }): a prefetch defers this registration
+   * while its segment is new to the client
+   * (router/segment-resolution/prefetch-deferral.ts).
+   */
+  prefetch?: false;
 };
 
 /**
@@ -867,9 +880,14 @@ export function track(label: string, depth?: number): () => void {
  * nested RangoContext.run() calls in Vite's module runner.
  */
 const LOADER_SCOPE_KEY = Symbol.for("rangojs-router:loader-scope");
-const loaderScopeALS: AsyncLocalStorage<{ active: true }> = ((
-  globalThis as any
-)[LOADER_SCOPE_KEY] ??= new AsyncLocalStorage<{ active: true }>());
+interface LoaderScope {
+  active: true;
+  /** $$id of the DSL loader this scope resolves (runInsideLoaderScope). */
+  loaderId?: string;
+}
+const loaderScopeALS: AsyncLocalStorage<LoaderScope> = ((globalThis as any)[
+  LOADER_SCOPE_KEY
+] ??= new AsyncLocalStorage<LoaderScope>());
 
 // Purity-only scope: marks that a loader FUNCTION BODY is executing, regardless
 // of how the loader was invoked (DSL via runInsideLoaderScope, or handler-
@@ -1429,8 +1447,24 @@ export function assertCachedHeaderWriteAllowed(
  * are bypassed because loaders are always fresh (never cached) and
  * their side effects (setCookie, header, etc.) are safe.
  */
-export function runInsideLoaderScope<T>(fn: () => T): T {
-  return loaderScopeALS.run({ active: true }, fn);
+export function runInsideLoaderScope<T>(fn: () => T, loaderId?: string): T {
+  return loaderScopeALS.run({ active: true, loaderId }, fn);
+}
+
+/**
+ * The loader whose run a handle push here belongs to, for the browser's
+ * merge of a partial response (handles/pushed-by.ts): the DSL loader
+ * this scope resolves, else the outermost loader body around the push (a
+ * loader a handler reads with ctx.use). Undefined for a handler's own push.
+ */
+export function getHandlePushOwner(): string | undefined {
+  const dsl = loaderScopeALS.getStore()?.loaderId;
+  if (dsl !== undefined) return dsl;
+  let outermost: string | undefined;
+  for (let s = loaderBodyScopeALS.getStore(); s; s = s.parent) {
+    if (s.loaderId !== undefined) outermost = s.loaderId;
+  }
+  return outermost;
 }
 
 /**

package/src/server/cookie-parse.ts

@@ -10,23 +10,47 @@
 export function parseCookiesFromHeader(
   cookieHeader: string | null,
 ): Record<string, string> {
-  if (!cookieHeader) return {};
-
   const cookies: Record<string, string> = {};
-  const pairs = cookieHeader.split(";");
 
-  for (const pair of pairs) {
-    const [name, ...rest] = pair.trim().split("=");
-    if (name) {
-      const raw = rest.join("=");
-      try {
-        cookies[name] = decodeURIComponent(raw);
-      } catch {
-        // Malformed percent-encoding: fall back to raw value
-        cookies[name] = raw;
+  if (cookieHeader) {
+    for (const pair of cookieHeader.split(";")) {
+      const [name, ...rest] = pair.trim().split("=");
+      if (name) {
+        const raw = rest.join("=");
+        let value: string;
+        try {
+          value = decodeURIComponent(raw);
+        } catch {
+          // Malformed percent-encoding: fall back to raw value
+          value = raw;
+        }
+        setCookie(cookies, name, value);
       }
     }
   }
 
+  // Null prototype (#1109): cookie names come from the request, so a lookup
+  // must never answer `constructor` or `toString` with an inherited member.
+  // Set once at the end: Object.create(null) starts in dictionary mode, which
+  // makes a spread of the jar several times slower.
+  Object.setPrototypeOf(cookies, null);
   return cookies;
 }
+
+/** `cookies[name] = value`, a cookie named `__proto__` as an own key too. */
+function setCookie(
+  cookies: Record<string, string>,
+  name: string,
+  value: string,
+): void {
+  if (name === "__proto__") {
+    Object.defineProperty(cookies, name, {
+      value,
+      writable: true,
+      enumerable: true,
+      configurable: true,
+    });
+  } else {
+    cookies[name] = value;
+  }
+}

package/src/server/cookie-store.ts

@@ -367,12 +367,16 @@ function createCookieStore(
 
     getAll(name?: string): Cookie[] {
       recordLoaderIdentityRead("cookies()");
-      const all = ctx._readCookies();
       if (name !== undefined) {
-        const value = all[name];
+        // The single-name read, not an index into the plain object
+        // _readCookies() returns: that would answer an inherited member.
+        const value = ctx._readCookie(name);
         return value !== undefined ? [{ name, value }] : [];
       }
-      return Object.entries(all).map(([n, v]) => ({ name: n, value: v }));
+      return Object.entries(ctx._readCookies()).map(([n, v]) => ({
+        name: n,
+        value: v,
+      }));
     },
 
     has(name: string): boolean {

package/src/server/handle-store.ts

@@ -1,5 +1,11 @@
-import { findEnclosingLoaderBody, isInsideLoaderScope } from "./context.js";
+import {
+  findEnclosingLoaderBody,
+  getHandlePushOwner,
+  isInsideLoaderScope,
+} from "./context.js";
 import { holdsThenable } from "../router/segment-resolution/mask-nested.js";
+import { pushedByKey } from "../handles/pushed-by.js";
+import { defineSlot } from "./slot-accessors.js";
 
 /**
  * Handle data structure: handleName -> segmentId -> entries[]
@@ -75,6 +81,12 @@ interface SlotTag {
   restoredOf?: string;
   /** A restored slot a dropped settled push of its loader stood in for. */
   matched?: true;
+  /**
+   * The loader whose run made the push, for the browser (pushed-by.ts): the
+   * DSL loader or loader body it is made in (getHandlePushOwner), else the
+   * loader a copy stands for. Unset for a handler's push.
+   */
+  by?: string;
 }
 
 // Shared by every plain DSL-loader push; tags are never mutated in place.
@@ -111,6 +123,24 @@ function cloneHandleData(data: HandleData): HandleData {
   return clone;
 }
 
+// SlotTag.by of each value, index-aligned; undefined when no value has one.
+function pushedByOf(
+  values: unknown[],
+  tags: (SlotTag | undefined)[] | undefined,
+  keep?: (i: number) => boolean,
+): (string | null)[] | undefined {
+  if (!tags) return undefined;
+  const by: (string | null)[] = [];
+  let any = false;
+  for (let i = 0; i < values.length; i++) {
+    if (keep && !keep(i)) continue;
+    const run = tags[i]?.by ?? null;
+    if (run !== null) any = true;
+    by.push(run);
+  }
+  return any ? by : undefined;
+}
+
 /**
  * HandleStore tracks pending handler promises and stores handle data.
  *
@@ -297,7 +327,8 @@ export interface HandleStore {
    * nav/action payloads, whose consumer applies each yield progressively) or
    * "settled" (the document lane, whose consumers drain to completion in
    * blocking positions and must not wait on loader bodies).
-   * Each yield contains the full accumulated state (not just the delta).
+   * Each yield contains the full accumulated state (not just the delta),
+   * with the pushedBy records of its buckets (handles/pushed-by.ts).
    * Safe for concurrent consumers (per-consumer version cursor).
    * The "settled" lane of a frozen store (freezeDocumentSnapshot) yields the
    * frozen state once, at once, and ends. That yield is the store's own
@@ -331,6 +362,17 @@ export interface HandleStore {
     excludeLoaderPushes?: boolean,
   ): Record<string, unknown[]>;
 
+  /**
+   * The loader whose run pushed each value in getDataForSegment(segmentId,
+   * excludeLoaderPushes), index-aligned per handle (null: the handler's).
+   * Handles without such a value are omitted; undefined when none has one.
+   * The browser's pushedBy record (handles/pushed-by.ts).
+   */
+  getPushedBy(
+    segmentId: string,
+    excludeLoaderPushes?: boolean,
+  ): Record<string, (string | null)[]> | undefined;
+
   /**
    * The push `owner` of each value in getDataForSegment(segmentId, true),
    * index-aligned per handle (null: no owner). Handles without an owned
@@ -353,6 +395,34 @@ export interface HandleStore {
   ): void;
 }
 
+/**
+ * settled and fullySettled: shared descriptors (slot-accessors.ts) that call
+ * the store's closure in SETTLEMENT_SLOT with the lane they wait for.
+ */
+const SETTLEMENT_SLOT: unique symbol = Symbol("rango.handleStore.settlement");
+
+type SettlementSlot = { [SETTLEMENT_SLOT]: (full: boolean) => Promise<void> };
+
+const SETTLEMENT_ACCESSORS: Record<
+  "settled" | "fullySettled",
+  PropertyDescriptor
+> = {
+  settled: {
+    get(this: SettlementSlot): Promise<void> {
+      return this[SETTLEMENT_SLOT](false);
+    },
+    enumerable: true,
+    configurable: true,
+  },
+  fullySettled: {
+    get(this: SettlementSlot): Promise<void> {
+      return this[SETTLEMENT_SLOT](true);
+    },
+    enumerable: true,
+    configurable: true,
+  },
+};
+
 /**
  * Create a new HandleStore instance.
  *
@@ -379,6 +449,14 @@ export function createHandleStore(): HandleStore {
   // (not value identity) so primitive values are covered too.
   // replaySegmentData installs fresh arrays, so restored values are untagged.
   const slotTags = new WeakMap<unknown[], (SlotTag | undefined)[]>();
+  // Frozen tags of plain pushes made by a run (SlotTag.by), one per loader.
+  const pushedBySlots = new Map<string, SlotTag>();
+  const pushedBySlot = (loader: true | undefined, by: string): SlotTag => {
+    const key = loader ? `L${by}` : `H${by}`;
+    let tag = pushedBySlots.get(key);
+    if (!tag) pushedBySlots.set(key, (tag = Object.freeze({ loader, by })));
+    return tag;
+  };
   // Copies standing in for a loader that has not pushed live yet: loaderId ->
   // the arrays holding them. Kept apart by kind: only a placeholder gives way
   // to a run that ends without a push, or to a cached unit's delivery.
@@ -602,6 +680,25 @@ export function createHandleStore(): HandleStore {
     }
   }
 
+  // What a stream yields: a copy of the data, with each bucket's pushedBy
+  // record (pushed-by.ts) for the browser's merge.
+  function snapshot(): HandleData {
+    const out: HandleData = {};
+    for (const handleName in data) {
+      const buckets: Record<string, unknown[]> = {};
+      let pushedBy: Record<string, (string | null)[]> | undefined;
+      for (const segmentId in data[handleName]) {
+        const values = data[handleName][segmentId];
+        buckets[segmentId] = [...values];
+        const by = pushedByOf(values, slotTags.get(values));
+        if (by) (pushedBy ??= {})[segmentId] = by;
+      }
+      out[handleName] = buckets;
+      if (pushedBy) out[pushedByKey(handleName)] = pushedBy;
+    }
+    return out;
+  }
+
   // Settlement barriers: `settled` (handler lane) resolves when sealed AND
   // handler inflight === 0. `fullySettled` additionally waits for the
   // auxiliary (loader) lane. seal() signals "no more track() calls"; each
@@ -706,7 +803,9 @@ export function createHandleStore(): HandleStore {
     });
   }
 
-  return {
+  // Data members only: the accessors are SETTLEMENT_ACCESSORS.
+  const store: Omit<HandleStore, "settled" | "fullySettled"> &
+    ThisType<HandleStore> = {
     track<T>(promise: Promise<T>): Promise<T> {
       inflightCount++;
       return trackSettlement(promise, () => {
@@ -725,22 +824,6 @@ export function createHandleStore(): HandleStore {
       sealInternal();
     },
 
-    get settled(): Promise<void> {
-      if (sealed && inflightCount === 0) return Promise.resolve();
-      return new Promise<void>((resolve) => {
-        drainWaiters.push(resolve);
-      });
-    },
-
-    get fullySettled(): Promise<void> {
-      if (sealed && inflightCount === 0 && auxInflightCount === 0) {
-        return Promise.resolve();
-      }
-      return new Promise<void>((resolve) => {
-        fullDrainWaiters.push(resolve);
-      });
-    },
-
     push(
       handleName: string,
       segmentId: string,
@@ -812,6 +895,12 @@ export function createHandleStore(): HandleStore {
         at = restoredInsertIndex(values, restoredBy);
         if (replayOf === undefined) liveOf = restoredBy;
       }
+      const by =
+        getHandlePushOwner() ??
+        replayOf ??
+        restoredOf ??
+        placeholderOf ??
+        owner;
       insertSlot(
         values,
         at,
@@ -829,10 +918,13 @@ export function createHandleStore(): HandleStore {
               liveOf,
               under,
               owner,
+              by,
             }
-          : loader
-            ? LOADER_SLOT
-            : undefined,
+          : by !== undefined
+            ? pushedBySlot(loader, by)
+            : loader
+              ? LOADER_SLOT
+              : undefined,
       );
       if (replayOf !== undefined) {
         addPending(pendingReplays, replayOf, values);
@@ -958,7 +1050,7 @@ export function createHandleStore(): HandleStore {
         if (this.onError) this.onError(error);
         else console.error(error);
       }
-      documentSnapshot = { version, data: cloneHandleData(data) };
+      documentSnapshot = { version, data: snapshot() };
     },
 
     async *stream(
@@ -1005,7 +1097,7 @@ export function createHandleStore(): HandleStore {
       while (true) {
         if (version > seen && Object.keys(data).length > 0) {
           seen = version;
-          yield cloneHandleData(data);
+          yield snapshot();
         }
         if (done) break;
         await waitForEmission(seen, () => done);
@@ -1043,7 +1135,7 @@ export function createHandleStore(): HandleStore {
       while (true) {
         if (version > seen) {
           seen = version;
-          yield cloneHandleData(data);
+          yield snapshot();
         }
         if (done) break;
         await waitForEmission(seen, () => done);
@@ -1069,6 +1161,25 @@ export function createHandleStore(): HandleStore {
       return result;
     },
 
+    getPushedBy(
+      segmentId: string,
+      excludeLoaderPushes?: boolean,
+    ): Record<string, (string | null)[]> | undefined {
+      let result: Record<string, (string | null)[]> | undefined;
+      for (const handleName in data) {
+        const values = data[handleName][segmentId];
+        if (!values) continue;
+        const tags = slotTags.get(values);
+        const by = pushedByOf(
+          values,
+          tags,
+          excludeLoaderPushes ? (i) => !tags?.[i]?.loader : undefined,
+        );
+        if (by) (result ??= {})[handleName] = by;
+      }
+      return result;
+    },
+
     getRecordOwners(
       segmentId: string,
     ): Record<string, (string | null)[]> | undefined {
@@ -1117,4 +1228,20 @@ export function createHandleStore(): HandleStore {
       signalEmission();
     },
   };
+  // settled: the handler lane drained; fullySettled: the auxiliary lane too.
+  defineSlot(store, SETTLEMENT_SLOT, (full: boolean): Promise<void> => {
+    if (sealed && inflightCount === 0 && (!full || auxInflightCount === 0)) {
+      return Promise.resolve();
+    }
+    return new Promise<void>((resolve) => {
+      (full ? fullDrainWaiters : drainWaiters).push(resolve);
+    });
+  });
+  Object.defineProperty(store, "settled", SETTLEMENT_ACCESSORS.settled);
+  Object.defineProperty(
+    store,
+    "fullySettled",
+    SETTLEMENT_ACCESSORS.fullySettled,
+  );
+  return store as HandleStore;
 }