@rangojs/router 0.26.5 → 0.26.6

package/dist/bin/rango.js

@@ -1644,7 +1644,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@rangojs/router",
-      version: "0.26.5",
+      version: "0.26.6",
       description: "Django-inspired RSC router with composable URL patterns",
       keywords: [
         "react",
@@ -1852,7 +1852,7 @@ var init_package = __esm({
       },
       dependencies: {
         "@types/debug": "^4.1.12",
-        "@vitejs/plugin-rsc": "^0.5.36",
+        "@vitejs/plugin-rsc": "^0.5.38",
         debug: "^4.4.1",
         "magic-string": "^0.30.17",
         picomatch: "^4.0.4",

package/dist/types/vite/plugins/server-ref-hashing.d.ts

@@ -3,7 +3,14 @@ import type { Plugin } from "vite";
  * Replace dev-style server-reference ids with their production hashes. The temp
  * server renders Static/Prerender in a dev/serve Vite server, so plugin-rsc mints
  * a dev-style id (e.g. "/src/urls/prerender.tsx"); rewriting only the id (group 2)
- * leaves the hoisted function and its trailing encrypted .bind(...) untouched.
+ * leaves the hoisted function untouched.
+ *
+ * The same id also prefixes the action id ("<id>#<name>") that plugin-rsc
+ * >= 0.5.37 passes to encryptActionBoundArgs/decryptActionBoundArgs as AES-GCM
+ * additional data. The production bundle decrypts under "<hash>#<name>", so bound
+ * args encrypted at build time under the dev-style id fail with OperationError on
+ * invocation. Rewriting every `"<id>#` literal to `"<hash>#` binds them to the
+ * runtime's id.
  * Exported for testing; used by hashServerRefs. Returns null if nothing changed.
  */
 export declare function transformServerRefs(code: string, projectRoot: string): string | null;

package/dist/vite/index.js

@@ -7078,7 +7078,7 @@ function resolveVersionsFrom(table, routerId2) {
 // package.json
 var package_default = {
   name: "@rangojs/router",
-  version: "0.26.5",
+  version: "0.26.6",
   description: "Django-inspired RSC router with composable URL patterns",
   keywords: [
     "react",
@@ -7286,7 +7286,7 @@ var package_default = {
   },
   dependencies: {
     "@types/debug": "^4.1.12",
-    "@vitejs/plugin-rsc": "^0.5.36",
+    "@vitejs/plugin-rsc": "^0.5.38",
     debug: "^4.4.1",
     "magic-string": "^0.30.17",
     picomatch: "^4.0.4",
@@ -10468,18 +10468,22 @@ init_client_ref_hashing();
 var debug9 = createRangoDebugger(NS.transform);
 function transformServerRefs(code, projectRoot) {
   if (!code.includes("registerServerReference")) return null;
-  let hasReplacement = false;
-  const result = code.replace(
+  const hashes = /* @__PURE__ */ new Map();
+  let result = code.replace(
     registerServerReferenceRegex(),
     (match, _value, refKey) => {
       const cleanKey = refKey.split("?")[0];
       const hash = computeProductionHash(projectRoot, cleanKey);
       if (hash === cleanKey) return match;
-      hasReplacement = true;
+      hashes.set(refKey, hash);
       return match.replace(`"${refKey}"`, `"${hash}"`);
     }
   );
-  return hasReplacement ? result : null;
+  if (hashes.size === 0) return null;
+  for (const [refKey, hash] of hashes) {
+    result = result.replaceAll(`"${refKey}#`, `"${hash}#`);
+  }
+  return result;
 }
 function hashServerRefs(projectRoot) {
   const counter = createCounter(debug9, "hash-server-refs");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rangojs/router",
-  "version": "0.26.5",
+  "version": "0.26.6",
   "description": "Django-inspired RSC router with composable URL patterns",
   "keywords": [
     "react",
@@ -194,7 +194,7 @@
   },
   "dependencies": {
     "@types/debug": "^4.1.12",
-    "@vitejs/plugin-rsc": "^0.5.36",
+    "@vitejs/plugin-rsc": "^0.5.38",
     "debug": "^4.4.1",
     "magic-string": "^0.30.17",
     "picomatch": "^4.0.4",

package/src/vite/plugins/server-ref-hashing.ts

@@ -9,7 +9,14 @@ const debug = createRangoDebugger(NS.transform);
  * Replace dev-style server-reference ids with their production hashes. The temp
  * server renders Static/Prerender in a dev/serve Vite server, so plugin-rsc mints
  * a dev-style id (e.g. "/src/urls/prerender.tsx"); rewriting only the id (group 2)
- * leaves the hoisted function and its trailing encrypted .bind(...) untouched.
+ * leaves the hoisted function untouched.
+ *
+ * The same id also prefixes the action id ("<id>#<name>") that plugin-rsc
+ * >= 0.5.37 passes to encryptActionBoundArgs/decryptActionBoundArgs as AES-GCM
+ * additional data. The production bundle decrypts under "<hash>#<name>", so bound
+ * args encrypted at build time under the dev-style id fail with OperationError on
+ * invocation. Rewriting every `"<id>#` literal to `"<hash>#` binds them to the
+ * runtime's id.
  * Exported for testing; used by hashServerRefs. Returns null if nothing changed.
  */
 export function transformServerRefs(
@@ -18,8 +25,8 @@ export function transformServerRefs(
 ): string | null {
   if (!code.includes("registerServerReference")) return null;
 
-  let hasReplacement = false;
-  const result = code.replace(
+  const hashes = new Map<string, string>();
+  let result = code.replace(
     registerServerReferenceRegex(),
     (match, _value: string, refKey: string) => {
       // The temp server is not a long-lived HMR server, so ids are bare; strip a
@@ -27,12 +34,16 @@ export function transformServerRefs(
       const cleanKey = refKey.split("?")[0]!;
       const hash = computeProductionHash(projectRoot, cleanKey);
       if (hash === cleanKey) return match;
-      hasReplacement = true;
+      hashes.set(refKey, hash);
       return match.replace(`"${refKey}"`, `"${hash}"`);
     },
   );
 
-  return hasReplacement ? result : null;
+  if (hashes.size === 0) return null;
+  for (const [refKey, hash] of hashes) {
+    result = result.replaceAll(`"${refKey}#`, `"${hash}#`);
+  }
+  return result;
 }
 
 /**