@react-router/dev 0.0.0-experimental-f887449bb → 0.0.0-experimental-e067e5e52

package/CHANGELOG.md

@@ -1,5 +1,62 @@
 # `@react-router/dev`
 
+## 7.13.0
+
+### Patch Changes
+
+- Bump @remix-run/node-fetch-server dep ([#14704](https://github.com/remix-run/react-router/pull/14704))
+- Updated dependencies:
+  - `react-router@7.13.0`
+  - `@react-router/node@7.13.0`
+  - `@react-router/serve@7.13.0`
+
+## 7.12.0
+
+### Minor Changes
+
+- Add additional layer of CSRF protection by rejecting submissions to UI routes from external origins. If you need to permit access to specific external origins, you can specify them in the `react-router.config.ts` config `allowedActionOrigins` field. ([#14708](https://github.com/remix-run/react-router/pull/14708))
+
+### Patch Changes
+
+- Fix `Maximum call stack size exceeded` errors when HMR is triggered against code with cyclic imports ([#14522](https://github.com/remix-run/react-router/pull/14522))
+
+- fix(vite): Skip SSR middleware in preview server for SPA mode ([#14673](https://github.com/remix-run/react-router/pull/14673))
+
+- \[UNSTABLE] Add a new `future.unstable_trailingSlashAwareDataRequests` flag to provide consistent behavior of `request.pathname` inside `middleware`, `loader`, and `action` functions on document and data requests when a trailing slash is present in the browser URL. ([#14644](https://github.com/remix-run/react-router/pull/14644))
+
+  Currently, your HTTP and `request` pathnames would be as follows for `/a/b/c` and `/a/b/c/`
+
+  | URL `/a/b/c` | **HTTP pathname** | **`request` pathname\`** |
+  | ------------ | ----------------- | ------------------------ |
+  | **Document** | `/a/b/c`          | `/a/b/c` ✅              |
+  | **Data**     | `/a/b/c.data`     | `/a/b/c` ✅              |
+
+  | URL `/a/b/c/` | **HTTP pathname** | **`request` pathname\`** |
+  | ------------- | ----------------- | ------------------------ |
+  | **Document**  | `/a/b/c/`         | `/a/b/c/` ✅             |
+  | **Data**      | `/a/b/c.data`     | `/a/b/c` ⚠️              |
+
+  With this flag enabled, these pathnames will be made consistent though a new `_.data` format for client-side `.data` requests:
+
+  | URL `/a/b/c` | **HTTP pathname** | **`request` pathname\`** |
+  | ------------ | ----------------- | ------------------------ |
+  | **Document** | `/a/b/c`          | `/a/b/c` ✅              |
+  | **Data**     | `/a/b/c.data`     | `/a/b/c` ✅              |
+
+  | URL `/a/b/c/` | **HTTP pathname**  | **`request` pathname\`** |
+  | ------------- | ------------------ | ------------------------ |
+  | **Document**  | `/a/b/c/`          | `/a/b/c/` ✅             |
+  | **Data**      | `/a/b/c/_.data` ⬅️ | `/a/b/c/` ✅             |
+
+  This a bug fix but we are putting it behind an opt-in flag because it has the potential to be a "breaking bug fix" if you are relying on the URL format for any other application or caching logic.
+
+  Enabling this flag also changes the format of client side `.data` requests from `/_root.data` to `/_.data` when navigating to `/` to align with the new format. This does not impact the `request` pathname which is still `/` in all cases.
+
+- Updated dependencies:
+  - `react-router@7.12.0`
+  - `@react-router/node@7.12.0`
+  - `@react-router/serve@7.12.0`
+
 ## 7.11.0
 
 ### Minor Changes

package/dist/cli/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * @react-router/dev v0.0.0-experimental-f887449bb
+ * @react-router/dev v0.0.0-experimental-e067e5e52
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -217,7 +217,7 @@ function validateRouteConfig({
         `Route config in "${routeConfigFile}" is invalid.`,
         root ? `${root}` : [],
         nested ? Object.entries(nested).map(
-          ([path9, message]) => `Path: routes.${path9}
+          ([path10, message]) => `Path: routes.${path10}
 ${message}`
         ) : []
       ].flat().join("\n\n")
@@ -376,7 +376,7 @@ async function resolveConfig({
     basename: basename3,
     buildDirectory: userBuildDirectory,
     buildEnd,
-    prerender,
+    prerender: prerender2,
     routeDiscovery: userRouteDiscovery,
     serverBuildFile,
     serverBundles,
@@ -390,15 +390,15 @@ async function resolveConfig({
   if (!ssr && serverBundles) {
     serverBundles = void 0;
   }
-  if (prerender) {
+  if (prerender2) {
     let isValidPrerenderPathsConfig = (p) => typeof p === "boolean" || typeof p === "function" || Array.isArray(p);
-    let isValidPrerenderConfig = isValidPrerenderPathsConfig(prerender) || typeof prerender === "object" && "paths" in prerender && isValidPrerenderPathsConfig(prerender.paths);
+    let isValidPrerenderConfig = isValidPrerenderPathsConfig(prerender2) || typeof prerender2 === "object" && "paths" in prerender2 && isValidPrerenderPathsConfig(prerender2.paths);
     if (!isValidPrerenderConfig) {
       return err(
         "The `prerender`/`prerender.paths` config must be a boolean, an array of string paths, or a function returning a boolean or array of string paths."
       );
     }
-    let isValidConcurrencyConfig = typeof prerender != "object" || !("unstable_concurrency" in prerender) || typeof prerender.unstable_concurrency === "number" && Number.isInteger(prerender.unstable_concurrency) && prerender.unstable_concurrency > 0;
+    let isValidConcurrencyConfig = typeof prerender2 != "object" || !("unstable_concurrency" in prerender2) || typeof prerender2.unstable_concurrency === "number" && Number.isInteger(prerender2.unstable_concurrency) && prerender2.unstable_concurrency > 0;
     if (!isValidConcurrencyConfig) {
       return err(
         "The `prerender.unstable_concurrency` config must be a positive integer if specified."
@@ -507,23 +507,26 @@ async function resolveConfig({
     unstable_optimizeDeps: userAndPresetConfigs.future?.unstable_optimizeDeps ?? false,
     unstable_subResourceIntegrity: userAndPresetConfigs.future?.unstable_subResourceIntegrity ?? false,
     unstable_trailingSlashAwareDataRequests: userAndPresetConfigs.future?.unstable_trailingSlashAwareDataRequests ?? false,
+    unstable_previewServerPrerendering: userAndPresetConfigs.future?.unstable_previewServerPrerendering ?? false,
     v8_middleware: userAndPresetConfigs.future?.v8_middleware ?? false,
     v8_splitRouteModules: userAndPresetConfigs.future?.v8_splitRouteModules ?? false,
     v8_viteEnvironmentApi: userAndPresetConfigs.future?.v8_viteEnvironmentApi ?? false
   };
+  let allowedActionOrigins = userAndPresetConfigs.allowedActionOrigins ?? false;
   let reactRouterConfig = deepFreeze({
     appDirectory,
     basename: basename3,
     buildDirectory,
     buildEnd,
     future,
-    prerender,
+    prerender: prerender2,
     routes: routes2,
     routeDiscovery,
     serverBuildFile,
     serverBundles,
     serverModuleFormat,
     ssr,
+    allowedActionOrigins,
     unstable_routeConfig: routeConfig
   });
   for (let preset of reactRouterUserConfig.presets ?? []) {
@@ -583,11 +586,11 @@ async function createConfigLoader({
       if (!fsWatcher) {
         fsWatcher = import_chokidar.default.watch([root, appDirectory], {
           ignoreInitial: true,
-          ignored: (path9) => {
-            let dirname5 = import_pathe3.default.dirname(path9);
+          ignored: (path10) => {
+            let dirname5 = import_pathe3.default.dirname(path10);
             return !dirname5.startsWith(appDirectory) && // Ensure we're only watching files outside of the app directory
             // that are at the root level, not nested in subdirectories
-            path9 !== root && // Watch the root directory itself
+            path10 !== root && // Watch the root directory itself
             dirname5 !== root;
           }
         });
@@ -912,7 +915,7 @@ function fullpath(lineage2) {
   if (lineage2.length === 1 && route?.id === "root") return "/";
   const isLayout = route && route.index !== true && route.path === void 0;
   if (isLayout) return void 0;
-  return "/" + lineage2.map((route2) => route2.path?.replace(/^\//, "")?.replace(/\/$/, "")).filter((path9) => path9 !== void 0 && path9 !== "").join("/");
+  return "/" + lineage2.map((route2) => route2.path?.replace(/^\//, "")?.replace(/\/$/, "")).filter((path10) => path10 !== void 0 && path10 !== "").join("/");
 }
 var init_route = __esm({
   "typegen/route.ts"() {
@@ -957,6 +960,7 @@ function generateServerBuild(ctx) {
       export const routeDiscovery: ServerBuild["routeDiscovery"];
       export const routes: ServerBuild["routes"];
       export const ssr: ServerBuild["ssr"];
+      export const allowedActionOrigins: ServerBuild["allowedActionOrigins"];
       export const unstable_getCriticalCss: ServerBuild["unstable_getCriticalCss"];
     }
   `;
@@ -1095,8 +1099,8 @@ function routeModulesType(ctx) {
   );
 }
 function isInAppDirectory(ctx, routeFile) {
-  const path9 = Path3.resolve(ctx.config.appDirectory, routeFile);
-  return path9.startsWith(ctx.config.appDirectory);
+  const path10 = Path3.resolve(ctx.config.appDirectory, routeFile);
+  return path10.startsWith(ctx.config.appDirectory);
 }
 function getRouteAnnotations({
   ctx,
@@ -1208,21 +1212,21 @@ function getRouteAnnotations({
   return { filename: filename2, content };
 }
 function relativeImportSource(from, to) {
-  let path9 = Path3.relative(Path3.dirname(from), to);
-  let extension = Path3.extname(path9);
-  path9 = Path3.join(Path3.dirname(path9), Pathe.filename(path9));
-  if (!path9.startsWith("../")) path9 = "./" + path9;
+  let path10 = Path3.relative(Path3.dirname(from), to);
+  let extension = Path3.extname(path10);
+  path10 = Path3.join(Path3.dirname(path10), Pathe.filename(path10));
+  if (!path10.startsWith("../")) path10 = "./" + path10;
   if (!extension || /\.(js|ts)x?$/.test(extension)) {
     extension = ".js";
   }
-  return path9 + extension;
+  return path10 + extension;
 }
 function rootDirsPath(ctx, typesPath) {
   const rel = Path3.relative(typesDirectory(ctx), typesPath);
   return Path3.join(ctx.rootDirectory, rel);
 }
-function paramsType(path9) {
-  const params = parse2(path9);
+function paramsType(path10) {
+  const params = parse2(path10);
   return t2.tsTypeLiteral(
     Object.entries(params).map(([param, isRequired]) => {
       const property = t2.tsPropertySignature(
@@ -1374,11 +1378,9 @@ var init_has_rsc_plugin = __esm({
 });
 
 // vite/node-adapter.ts
-var import_node_fetch_server;
 var init_node_adapter = __esm({
   "vite/node-adapter.ts"() {
     "use strict";
-    import_node_fetch_server = require("@remix-run/node-fetch-server");
     init_invariant();
   }
 });
@@ -1554,6 +1556,16 @@ var init_warn_on_client_source_maps = __esm({
   }
 });
 
+// vite/plugins/prerender.ts
+var import_promises2, import_node_path2;
+var init_prerender = __esm({
+  "vite/plugins/prerender.ts"() {
+    "use strict";
+    import_promises2 = require("fs/promises");
+    import_node_path2 = __toESM(require("path"));
+  }
+});
+
 // vite/plugin.ts
 async function resolveViteConfig({
   configFile,
@@ -1596,11 +1608,11 @@ function getServerBundleIds(ctx) {
 async function cleanBuildDirectory(viteConfig, ctx) {
   let buildDirectory = ctx.reactRouterConfig.buildDirectory;
   let isWithinRoot = () => {
-    let relativePath = path7.relative(ctx.rootDirectory, buildDirectory);
-    return !relativePath.startsWith("..") && !path7.isAbsolute(relativePath);
+    let relativePath = path8.relative(ctx.rootDirectory, buildDirectory);
+    return !relativePath.startsWith("..") && !path8.isAbsolute(relativePath);
   };
   if (viteConfig.build.emptyOutDir ?? isWithinRoot()) {
-    await (0, import_promises2.rm)(buildDirectory, { force: true, recursive: true });
+    await (0, import_promises3.rm)(buildDirectory, { force: true, recursive: true });
   }
 }
 async function cleanViteManifests(environmentsOptions, ctx) {
@@ -1608,7 +1620,7 @@ async function cleanViteManifests(environmentsOptions, ctx) {
     ([environmentName, options]) => {
       let outDir = options.build?.outDir;
       invariant(outDir, `Expected build.outDir for ${environmentName}`);
-      return path7.join(outDir, ".vite/manifest.json");
+      return path8.join(outDir, ".vite/manifest.json");
     }
   );
   await Promise.all(
@@ -1616,12 +1628,12 @@ async function cleanViteManifests(environmentsOptions, ctx) {
       let manifestExists = (0, import_node_fs3.existsSync)(viteManifestPath);
       if (!manifestExists) return;
       if (!ctx.viteManifestEnabled) {
-        await (0, import_promises2.rm)(viteManifestPath, { force: true, recursive: true });
+        await (0, import_promises3.rm)(viteManifestPath, { force: true, recursive: true });
       }
-      let viteDir = path7.dirname(viteManifestPath);
-      let viteDirFiles = await (0, import_promises2.readdir)(viteDir, { recursive: true });
+      let viteDir = path8.dirname(viteManifestPath);
+      let viteDirFiles = await (0, import_promises3.readdir)(viteDir, { recursive: true });
       if (viteDirFiles.length === 0) {
-        await (0, import_promises2.rm)(viteDir, { force: true, recursive: true });
+        await (0, import_promises3.rm)(viteDir, { force: true, recursive: true });
       }
     })
   );
@@ -1635,10 +1647,10 @@ function mergeEnvironmentOptions(base, ...overrides) {
 }
 async function getEnvironmentOptionsResolvers(ctx, viteCommand) {
   let { serverBuildFile, serverModuleFormat } = ctx.reactRouterConfig;
-  let packageRoot = path7.dirname(
+  let packageRoot = path8.dirname(
     require.resolve("@react-router/dev/package.json")
   );
-  let { moduleSyncEnabled } = await import(`file:///${path7.join(packageRoot, "module-sync-enabled/index.mjs")}`);
+  let { moduleSyncEnabled } = await import(`file:///${path8.join(packageRoot, "module-sync-enabled/index.mjs")}`);
   let vite2 = getVite();
   function getBaseOptions({
     viteUserConfig
@@ -1717,7 +1729,7 @@ async function getEnvironmentOptionsResolvers(ctx, viteCommand) {
             ctx.entryClientFilePath,
             ...Object.values(ctx.reactRouterConfig.routes).flatMap(
               (route) => {
-                let routeFilePath = path7.resolve(
+                let routeFilePath = path8.resolve(
                   ctx.reactRouterConfig.appDirectory,
                   route.file
                 );
@@ -1741,7 +1753,7 @@ async function getEnvironmentOptionsResolvers(ctx, viteCommand) {
               ) : null;
               let routeChunkSuffix = routeChunkName ? `-${(0, import_kebabCase.default)(routeChunkName)}` : "";
               let assetsDir = (ctx.reactRouterConfig.future.v8_viteEnvironmentApi ? viteUserConfig?.environments?.client?.build?.assetsDir : null) ?? viteUserConfig?.build?.assetsDir ?? "assets";
-              return path7.posix.join(
+              return path8.posix.join(
                 assetsDir,
                 `[name]${routeChunkSuffix}-[hash].js`
               );
@@ -1791,17 +1803,16 @@ function resolveEnvironmentsOptions(environmentResolvers, resolverOptions) {
 function isNonNullable(x) {
   return x != null;
 }
-var import_node_crypto, import_node_fs3, import_promises2, path7, url, babel2, import_node_fetch_server2, import_react_router2, import_es_module_lexer, import_pick3, import_jsesc, import_picocolors5, import_kebabCase, CLIENT_NON_COMPONENT_EXPORTS, CLIENT_ROUTE_EXPORTS, BUILD_CLIENT_ROUTE_QUERY_STRING, SSR_BUNDLE_PREFIX, virtualHmrRuntime, virtualInjectHmrRuntime, virtual, getServerBuildDirectory, getClientBuildDirectory, defaultEntriesDir, defaultEntries, REACT_REFRESH_HEADER;
+var import_node_crypto, import_node_fs3, import_promises3, path8, url, babel2, import_react_router2, import_es_module_lexer, import_pick3, import_jsesc, import_picocolors5, import_kebabCase, CLIENT_NON_COMPONENT_EXPORTS, CLIENT_ROUTE_EXPORTS, BUILD_CLIENT_ROUTE_QUERY_STRING, SSR_BUNDLE_PREFIX, virtualHmrRuntime, virtualInjectHmrRuntime, virtual, getServerBuildDirectory, getClientBuildDirectory, defaultEntriesDir, defaultEntries, REACT_REFRESH_HEADER;
 var init_plugin = __esm({
   "vite/plugin.ts"() {
     "use strict";
     import_node_crypto = require("crypto");
     import_node_fs3 = require("fs");
-    import_promises2 = require("fs/promises");
-    path7 = __toESM(require("path"));
+    import_promises3 = require("fs/promises");
+    path8 = __toESM(require("path"));
     url = __toESM(require("url"));
     babel2 = __toESM(require("@babel/core"));
-    import_node_fetch_server2 = require("@remix-run/node-fetch-server");
     import_react_router2 = require("react-router");
     import_es_module_lexer = require("es-module-lexer");
     import_pick3 = __toESM(require("lodash/pick"));
@@ -1828,6 +1839,7 @@ var init_plugin = __esm({
     init_load_dotenv();
     init_validate_plugin_order();
     init_warn_on_client_source_maps();
+    init_prerender();
     CLIENT_NON_COMPONENT_EXPORTS = [
       "clientAction",
       "clientLoader",
@@ -1853,20 +1865,20 @@ var init_plugin = __esm({
       serverManifest: create("server-manifest"),
       browserManifest: create("browser-manifest")
     };
-    getServerBuildDirectory = (reactRouterConfig, { serverBundleId } = {}) => path7.join(
+    getServerBuildDirectory = (reactRouterConfig, { serverBundleId } = {}) => path8.join(
       reactRouterConfig.buildDirectory,
       "server",
       ...serverBundleId ? [serverBundleId] : []
     );
-    getClientBuildDirectory = (reactRouterConfig) => path7.join(reactRouterConfig.buildDirectory, "client");
-    defaultEntriesDir = path7.resolve(
-      path7.dirname(require.resolve("@react-router/dev/package.json")),
+    getClientBuildDirectory = (reactRouterConfig) => path8.join(reactRouterConfig.buildDirectory, "client");
+    defaultEntriesDir = path8.resolve(
+      path8.dirname(require.resolve("@react-router/dev/package.json")),
       "dist",
       "config",
       "defaults"
     );
     defaultEntries = (0, import_node_fs3.readdirSync)(defaultEntriesDir).map(
-      (filename2) => path7.join(defaultEntriesDir, filename2)
+      (filename2) => path8.join(defaultEntriesDir, filename2)
     );
     invariant(defaultEntries.length > 0, "No default entries found");
     REACT_REFRESH_HEADER = `
@@ -2151,8 +2163,8 @@ var import_picocolors9 = __toESM(require("picocolors"));
 
 // cli/commands.ts
 var import_node_fs4 = require("fs");
-var import_promises3 = require("fs/promises");
-var path8 = __toESM(require("path"));
+var import_promises4 = require("fs/promises");
+var path9 = __toESM(require("path"));
 var import_exit_hook = __toESM(require("exit-hook"));
 var import_picocolors8 = __toESM(require("picocolors"));
 var import_react_router3 = require("react-router");
@@ -2325,14 +2337,14 @@ async function generateEntry(entry, rootDirectory, flags = {}) {
     console.error(import_picocolors8.default.red(`No default server entry detected.`));
     return;
   }
-  let defaultsDirectory = path8.resolve(
-    path8.dirname(require.resolve("@react-router/dev/package.json")),
+  let defaultsDirectory = path9.resolve(
+    path9.dirname(require.resolve("@react-router/dev/package.json")),
     "dist",
     "config",
     "defaults"
   );
-  let defaultEntryClient = path8.resolve(defaultsDirectory, "entry.client.tsx");
-  let defaultEntryServer = path8.resolve(
+  let defaultEntryClient = path9.resolve(defaultsDirectory, "entry.client.tsx");
+  let defaultEntryServer = path9.resolve(
     defaultsDirectory,
     `entry.server.node.tsx`
   );
@@ -2341,19 +2353,19 @@ async function generateEntry(entry, rootDirectory, flags = {}) {
   let useTypeScript = flags.typescript ?? true;
   let outputExtension = useTypeScript ? "tsx" : "jsx";
   let outputEntry = `${entry}.${outputExtension}`;
-  let outputFile = path8.resolve(appDirectory, outputEntry);
+  let outputFile = path9.resolve(appDirectory, outputEntry);
   if (!useTypeScript) {
     let javascript = await transpile(contents, {
       cwd: rootDirectory,
       filename: isServerEntry ? defaultEntryServer : defaultEntryClient
     });
-    await (0, import_promises3.writeFile)(outputFile, javascript, "utf-8");
+    await (0, import_promises4.writeFile)(outputFile, javascript, "utf-8");
   } else {
-    await (0, import_promises3.writeFile)(outputFile, contents, "utf-8");
+    await (0, import_promises4.writeFile)(outputFile, contents, "utf-8");
   }
   console.log(
     import_picocolors8.default.blue(
-      `Entry file ${entry} created at ${path8.relative(
+      `Entry file ${entry} created at ${path9.relative(
         rootDirectory,
         outputFile
       )}.`
@@ -2362,16 +2374,16 @@ async function generateEntry(entry, rootDirectory, flags = {}) {
 }
 function resolveRootDirectory(root, flags) {
   if (root) {
-    return path8.resolve(root);
+    return path9.resolve(root);
   }
-  return process.env.REACT_ROUTER_ROOT || (flags?.config ? path8.dirname(path8.resolve(flags.config)) : process.cwd());
+  return process.env.REACT_ROUTER_ROOT || (flags?.config ? path9.dirname(path9.resolve(flags.config)) : process.cwd());
 }
 async function checkForEntry(rootDirectory, appDirectory, entries2) {
   for (let entry of entries2) {
-    let entryPath = path8.resolve(appDirectory, entry);
+    let entryPath = path9.resolve(appDirectory, entry);
     let exists = (0, import_node_fs4.existsSync)(entryPath);
     if (exists) {
-      let relative7 = path8.relative(rootDirectory, entryPath);
+      let relative7 = path9.relative(rootDirectory, entryPath);
       console.error(import_picocolors8.default.red(`Entry file ${relative7} already exists.`));
       return process.exit(1);
     }
@@ -2379,12 +2391,12 @@ async function checkForEntry(rootDirectory, appDirectory, entries2) {
 }
 async function createServerEntry(rootDirectory, appDirectory, inputFile) {
   await checkForEntry(rootDirectory, appDirectory, serverEntries);
-  let contents = await (0, import_promises3.readFile)(inputFile, "utf-8");
+  let contents = await (0, import_promises4.readFile)(inputFile, "utf-8");
   return contents;
 }
 async function createClientEntry(rootDirectory, appDirectory, inputFile) {
   await checkForEntry(rootDirectory, appDirectory, clientEntries);
-  let contents = await (0, import_promises3.readFile)(inputFile, "utf-8");
+  let contents = await (0, import_promises4.readFile)(inputFile, "utf-8");
   return contents;
 }
 async function typegen(root, flags) {

package/dist/config.d.ts

@@ -40,6 +40,10 @@ interface FutureConfig {
     unstable_optimizeDeps: boolean;
     unstable_subResourceIntegrity: boolean;
     unstable_trailingSlashAwareDataRequests: boolean;
+    /**
+     * Prerender with Vite Preview server
+     */
+    unstable_previewServerPrerendering?: boolean;
     /**
      * Enable route middleware
      */
@@ -148,6 +152,47 @@ type ReactRouterConfig = {
      * SPA without server-rendering. Default's to `true`.
      */
     ssr?: boolean;
+    /**
+     * An array of allowed origin hosts for action submissions to UI routes (does not apply
+     * to resource routes). Supports micromatch glob patterns (`*` to match one segment,
+     * `**` to match multiple).
+     *
+     * ```tsx
+     * export default {
+     *   allowedActionOrigins: [
+     *     "example.com",
+     *     "*.example.com", // sub.example.com
+     *     "**.example.com", // sub.domain.example.com
+     *   ],
+     * } satisfies Config;
+     * ```
+     *
+     * If you need to set this value at runtime, you can do in by setting the value
+     * on the server build in your custom server. For example, when using `express`:
+     *
+     * ```ts
+     * import express from "express";
+     * import { createRequestHandler } from "@react-router/express";
+     * import type { ServerBuild } from "react-router";
+     *
+     * export const app = express();
+     *
+     * async function getBuild() {
+     *   let build: ServerBuild = await import(
+     *     "virtual:react-router/server-build"
+     *   );
+     *   return {
+     *     ...build,
+     *     allowedActionOrigins:
+     *       process.env.NODE_ENV === "development"
+     *         ? undefined
+     *         : ["staging.example.com", "www.example.com"],
+     *   };
+     * }
+     *
+     * app.use(createRequestHandler({ build: getBuild }));
+     */
+    allowedActionOrigins?: string[];
 };
 type ResolvedReactRouterConfig = Readonly<{
     /**
@@ -213,6 +258,11 @@ type ResolvedReactRouterConfig = Readonly<{
      * SPA without server-rendering. Default's to `true`.
      */
     ssr: boolean;
+    /**
+     * The allowed origins for actions / mutations. Does not apply to routes
+     * without a component. micromatch glob patterns are supported.
+     */
+    allowedActionOrigins: string[] | false;
     /**
      * The resolved array of route config entries exported from `routes.ts`
      */

package/dist/config.js

@@ -1,5 +1,5 @@
 /**
- * @react-router/dev v0.0.0-experimental-f887449bb
+ * @react-router/dev v0.0.0-experimental-e067e5e52
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/routes.js

@@ -1,5 +1,5 @@
 /**
- * @react-router/dev v0.0.0-experimental-f887449bb
+ * @react-router/dev v0.0.0-experimental-e067e5e52
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/vite/cloudflare.js

@@ -1,5 +1,5 @@
 /**
- * @react-router/dev v0.0.0-experimental-f887449bb
+ * @react-router/dev v0.0.0-experimental-e067e5e52
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -45,12 +45,8 @@ __export(cloudflare_exports, {
 module.exports = __toCommonJS(cloudflare_exports);
 
 // vite/cloudflare-dev-proxy.ts
-var import_node_fetch_server2 = require("@remix-run/node-fetch-server");
 var import_react_router = require("react-router");
 
-// vite/node-adapter.ts
-var import_node_fetch_server = require("@remix-run/node-fetch-server");
-
 // invariant.ts
 function invariant(value, message) {
   if (value === false || value === null || typeof value === "undefined") {
@@ -62,13 +58,14 @@ function invariant(value, message) {
 }
 
 // vite/node-adapter.ts
-function fromNodeRequest(nodeReq, nodeRes) {
+async function fromNodeRequest(nodeReq, nodeRes) {
   invariant(
     nodeReq.originalUrl,
     "Expected `nodeReq.originalUrl` to be defined"
   );
   nodeReq.url = nodeReq.originalUrl;
-  return (0, import_node_fetch_server.createRequest)(nodeReq, nodeRes);
+  const { createRequest } = await import("@remix-run/node-fetch-server");
+  return createRequest(nodeReq, nodeRes);
 }
 
 // vite/vite.ts
@@ -536,10 +533,12 @@ async function resolveConfig({
     unstable_optimizeDeps: userAndPresetConfigs.future?.unstable_optimizeDeps ?? false,
     unstable_subResourceIntegrity: userAndPresetConfigs.future?.unstable_subResourceIntegrity ?? false,
     unstable_trailingSlashAwareDataRequests: userAndPresetConfigs.future?.unstable_trailingSlashAwareDataRequests ?? false,
+    unstable_previewServerPrerendering: userAndPresetConfigs.future?.unstable_previewServerPrerendering ?? false,
     v8_middleware: userAndPresetConfigs.future?.v8_middleware ?? false,
     v8_splitRouteModules: userAndPresetConfigs.future?.v8_splitRouteModules ?? false,
     v8_viteEnvironmentApi: userAndPresetConfigs.future?.v8_viteEnvironmentApi ?? false
   };
+  let allowedActionOrigins = userAndPresetConfigs.allowedActionOrigins ?? false;
   let reactRouterConfig = deepFreeze({
     appDirectory,
     basename,
@@ -553,6 +552,7 @@ async function resolveConfig({
     serverBundles,
     serverModuleFormat,
     ssr,
+    allowedActionOrigins,
     unstable_routeConfig: routeConfig
   });
   for (let preset of reactRouterUserConfig.presets ?? []) {
@@ -818,6 +818,7 @@ var cloudflareDevProxyVitePlugin = (options = {}) => {
       }
     },
     configureServer: async (viteDevServer) => {
+      const { sendResponse } = await import("@remix-run/node-fetch-server");
       let context;
       let getContext = async () => {
         let { getPlatformProxy } = await importWrangler();
@@ -834,11 +835,11 @@ var cloudflareDevProxyVitePlugin = (options = {}) => {
                 serverBuildId
               );
               let handler = (0, import_react_router.createRequestHandler)(build, "development");
-              let req = fromNodeRequest(nodeReq, nodeRes);
+              let req = await fromNodeRequest(nodeReq, nodeRes);
               context ??= await getContext();
               let loadContext = getLoadContext ? await getLoadContext({ request: req, context }) : context;
               let res = await handler(req, loadContext);
-              await (0, import_node_fetch_server2.sendResponse)(nodeRes, res);
+              await sendResponse(nodeRes, res);
             } catch (error) {
               next(error);
             }