@reckona/mreact-router 0.0.132 → 0.0.135

package/src/client.ts

@@ -920,10 +920,16 @@ async function inferClientRouteModuleSource(options: {
         if (exported.clientBoundaryModule) {
           clientProxy = true;
         } else if (exported.clientBoundaryExportNames.length > 0) {
-          for (const exportName of reference.exportedNames) {
-            if (exported.clientBoundaryExportNames.includes(exportName)) {
+          if (reference.exportAll) {
+            for (const exportName of exported.clientBoundaryExportNames) {
               clientBoundaryExportNames.add(exportName);
             }
+          } else {
+            for (const specifier of reference.specifiers) {
+              if (exported.clientBoundaryExportNames.includes(specifier.localName)) {
+                clientBoundaryExportNames.add(specifier.exportedName);
+              }
+            }
           }
         } else if (exported.client) {
           nestedClient = true;
@@ -1110,10 +1116,15 @@ function isStyleModuleSpecifier(source: string): boolean {
 const styleModuleExtensions = new Set([".css", ".less", ".sass", ".scss", ".styl", ".stylus"]);
 
 function isClientBoundaryFallbackEligibleSource(source: string): boolean {
+  if (hasClientBoundaryFallbackUnsafeBrowserGlobal(source)) {
+    return false;
+  }
+
   const destructuredCallbackPropNames = destructuredPropsCallbackNames(source);
   const callbackPropNames = new Set([
     ...destructuredCallbackPropNames,
     ...propsCallbackAliasNames(source),
+    ...memberCallbackNames(source),
   ]);
   const sourceWithoutComponentCallbackProps = source.replaceAll(
     /<[A-Z][A-Za-z0-9_$.]*(?:\s[\s\S]*?)?>/gu,
@@ -1130,36 +1141,97 @@ function isClientBoundaryFallbackEligibleSource(source: string): boolean {
     );
 
   for (const callbackName of callbackPropNames) {
+    const escapedCallbackName = escapeRegExp(callbackName);
+    const callbackHandlerAttributePattern = new RegExp(
+      String.raw`\bon[A-Z][A-Za-z0-9_$]*\s*=\s*\{\s*[^{}]*\b${escapedCallbackName}\b[^{}]*\}`,
+      "gu",
+    );
     sourceWithoutGuardedUndefinedCallbacks = sourceWithoutGuardedUndefinedCallbacks.replaceAll(
       new RegExp(
-        String.raw`\b(?:const|let|var)\s+${escapeRegExp(
-          callbackName,
-        )}\s*=\s*props\.[A-Za-z_$][\w$]*\s*;?`,
+        String.raw`\b(?:const|let|var)\s+${escapedCallbackName}\s*=\s*props\.[A-Za-z_$][\w$]*\s*;?`,
         "gu",
       ),
       "",
     );
     sourceWithoutGuardedUndefinedCallbacks = sourceWithoutGuardedUndefinedCallbacks.replaceAll(
       new RegExp(
-        String.raw`\bon[A-Z][A-Za-z0-9_$]*\s*=\s*\{\s*${escapeRegExp(
-          callbackName,
-        )}\s*\?\s*[^{}]*:\s*undefined\s*\}`,
+        String.raw`\b(?:const|let|var)\s+${escapedCallbackName}\s*=\s*[^;\n]+\.${escapedCallbackName}\s*;?`,
+        "gu",
+      ),
+      "",
+    );
+    sourceWithoutGuardedUndefinedCallbacks = sourceWithoutGuardedUndefinedCallbacks.replaceAll(
+      new RegExp(
+        String.raw`\bon[A-Z][A-Za-z0-9_$]*\s*=\s*\{\s*${escapedCallbackName}\s*\?\s*[^{}]*:\s*undefined\s*\}`,
+        "gu",
+      ),
+      "",
+    );
+    sourceWithoutGuardedUndefinedCallbacks = sourceWithoutGuardedUndefinedCallbacks.replaceAll(
+      new RegExp(
+        String.raw`\bon[A-Z][A-Za-z0-9_$]*\s*=\s*\{\s*${escapedCallbackName}\s*(?:===|==)\s*(?:undefined|null)\s*\?\s*undefined\s*:\s*[^{}]*\}`,
+        "gu",
+      ),
+      "",
+    );
+    sourceWithoutGuardedUndefinedCallbacks = sourceWithoutGuardedUndefinedCallbacks.replaceAll(
+      new RegExp(
+        String.raw`\bon[A-Z][A-Za-z0-9_$]*\s*=\s*\{\s*(?:undefined|null)\s*(?:===|==)\s*${escapedCallbackName}\s*\?\s*undefined\s*:\s*[^{}]*\}`,
+        "gu",
+      ),
+      "",
+    );
+    sourceWithoutGuardedUndefinedCallbacks = sourceWithoutGuardedUndefinedCallbacks.replaceAll(
+      new RegExp(
+        String.raw`\bon[A-Z][A-Za-z0-9_$]*\s*=\s*\{\s*${escapedCallbackName}\s*(?:!==|!=)\s*(?:undefined|null)\s*\?\s*[^{}]*:\s*undefined\s*\}`,
+        "gu",
+      ),
+      "",
+    );
+    sourceWithoutGuardedUndefinedCallbacks = sourceWithoutGuardedUndefinedCallbacks.replaceAll(
+      new RegExp(
+        String.raw`\bon[A-Z][A-Za-z0-9_$]*\s*=\s*\{\s*typeof\s+${escapedCallbackName}\s*===\s*["']function["']\s*\?\s*[^{}]*:\s*undefined\s*\}`,
+        "gu",
+      ),
+      "",
+    );
+    sourceWithoutGuardedUndefinedCallbacks = sourceWithoutGuardedUndefinedCallbacks.replaceAll(
+      new RegExp(
+        String.raw`\bon[A-Z][A-Za-z0-9_$]*\s*=\s*\{\s*${escapedCallbackName}\s*\?\?\s*undefined\s*\}`,
         "gu",
       ),
       "",
     );
 
-    if (hasCallbackAbsenceGuard(source, callbackName)) {
+    if (
+      hasCallbackAbsenceGuard(
+        sourceWithoutComponentCallbackProps.replaceAll(callbackHandlerAttributePattern, ""),
+        callbackName,
+      )
+    ) {
       sourceWithoutGuardedUndefinedCallbacks = sourceWithoutGuardedUndefinedCallbacks.replaceAll(
-        new RegExp(
-          String.raw`\bon[A-Z][A-Za-z0-9_$]*\s*=\s*\{\s*[^{}]*\b${escapeRegExp(
-            callbackName,
-          )}\b[^{}]*\}`,
-          "gu",
-        ),
+        callbackHandlerAttributePattern,
         "",
       );
     }
+    sourceWithoutGuardedUndefinedCallbacks = removeSafeCallbackHandlerAttributes(
+      sourceWithoutGuardedUndefinedCallbacks,
+      callbackName,
+      {
+        externalAbsenceGuard: hasCallbackAbsenceGuard(
+          sourceWithoutComponentCallbackProps.replaceAll(callbackHandlerAttributePattern, ""),
+          callbackName,
+        ),
+      },
+    );
+
+    if (
+      new RegExp(String.raw`\b${escapedCallbackName}\s*\(`, "u").test(
+        sourceWithoutGuardedUndefinedCallbacks,
+      )
+    ) {
+      return false;
+    }
   }
 
   return (
@@ -1168,6 +1240,14 @@ function isClientBoundaryFallbackEligibleSource(source: string): boolean {
   );
 }
 
+function hasClientBoundaryFallbackUnsafeBrowserGlobal(source: string): boolean {
+  const sourceWithoutTypeofGuards = source.replaceAll(
+    /\btypeof\s+(?:window|document|localStorage)\s*(?:(?:={2,3}|!={1,2})\s*["']undefined["'])?/gu,
+    "",
+  );
+  return /\b(?:window|document|localStorage)\b/u.test(sourceWithoutTypeofGuards);
+}
+
 function propsCallbackAliasNames(source: string): Set<string> {
   const names = new Set<string>();
 
@@ -1185,6 +1265,65 @@ function propsCallbackAliasNames(source: string): Set<string> {
     }
   }
 
+  for (const match of source.matchAll(
+    /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*\(\s*props\s+as\s+[^)]+\)\.([A-Za-z_$][\w$]*)\b/gu,
+  )) {
+    const localName = match[1];
+    const propName = match[2];
+
+    if (
+      localName !== undefined &&
+      (isCallbackPropName(propName) || isCallbackPropName(localName))
+    ) {
+      names.add(localName);
+    }
+  }
+
+  for (const match of source.matchAll(
+    /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*\(\s*props\s*\)\.([A-Za-z_$][\w$]*)\b/gu,
+  )) {
+    const localName = match[1];
+    const propName = match[2];
+
+    if (
+      localName !== undefined &&
+      (isCallbackPropName(propName) || isCallbackPropName(localName))
+    ) {
+      names.add(localName);
+    }
+  }
+
+  for (const match of source.matchAll(
+    /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*[^;\n]+\.([A-Za-z_$][\w$]*)\s*;?/gu,
+  )) {
+    const localName = match[1];
+    const propName = match[2];
+
+    if (
+      localName !== undefined &&
+      (isCallbackPropName(propName) || isCallbackPropName(localName))
+    ) {
+      names.add(localName);
+    }
+  }
+
+  let added = true;
+  while (added) {
+    added = false;
+    for (const match of source.matchAll(
+      /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([A-Za-z_$][\w$]*)\b/gu,
+    )) {
+      const localName = match[1];
+      const sourceName = match[2];
+
+      if (localName !== undefined && sourceName !== undefined && names.has(sourceName)) {
+        const previousSize = names.size;
+        names.add(localName);
+        added ||= names.size !== previousSize;
+      }
+    }
+  }
+
   return names;
 }
 
@@ -1197,6 +1336,109 @@ function hasCallbackAbsenceGuard(source: string, name: string): boolean {
   ).test(source);
 }
 
+function memberCallbackNames(source: string): Set<string> {
+  const names = new Set<string>();
+
+  for (const match of source.matchAll(/\.([A-Za-z_$][\w$]*)\b/gu)) {
+    const memberName = match[1];
+
+    if (memberName !== undefined && isCallbackPropName(memberName)) {
+      names.add(memberName);
+    }
+  }
+
+  return names;
+}
+
+function removeSafeCallbackHandlerAttributes(
+  source: string,
+  callbackName: string,
+  options: { externalAbsenceGuard: boolean },
+): string {
+  const attributePattern = /\bon[A-Z][A-Za-z0-9_$]*\s*=\s*\{/gu;
+  let result = "";
+  let cursor = 0;
+
+  for (const match of source.matchAll(attributePattern)) {
+    const start = match.index;
+    const expressionStart = start + match[0].length;
+    const end = matchingBraceEnd(source, expressionStart - 1);
+
+    if (end === undefined) {
+      continue;
+    }
+
+    const expression = source.slice(expressionStart, end);
+    if (isSafeCallbackHandlerExpression(expression, callbackName, options)) {
+      result += source.slice(cursor, start);
+      cursor = end + 1;
+    }
+  }
+
+  return cursor === 0 ? source : result + source.slice(cursor);
+}
+
+function matchingBraceEnd(source: string, openBraceIndex: number): number | undefined {
+  let depth = 0;
+  let quote: "\"" | "'" | "`" | undefined;
+  let escaped = false;
+
+  for (let index = openBraceIndex; index < source.length; index += 1) {
+    const char = source[index];
+
+    if (quote !== undefined) {
+      if (escaped) {
+        escaped = false;
+      } else if (char === "\\") {
+        escaped = true;
+      } else if (char === quote) {
+        quote = undefined;
+      }
+      continue;
+    }
+
+    if (char === "\"" || char === "'" || char === "`") {
+      quote = char;
+      continue;
+    }
+
+    if (char === "{") {
+      depth += 1;
+      continue;
+    }
+
+    if (char === "}") {
+      depth -= 1;
+      if (depth === 0) {
+        return index;
+      }
+    }
+  }
+
+  return undefined;
+}
+
+function isSafeCallbackHandlerExpression(
+  expression: string,
+  callbackName: string,
+  options: { externalAbsenceGuard: boolean },
+): boolean {
+  const escapedName = escapeRegExp(callbackName);
+  if (!new RegExp(String.raw`\b${escapedName}\b`, "u").test(expression)) {
+    return false;
+  }
+
+  if (new RegExp(String.raw`\b${escapedName}\s*\(`, "u").test(expression)) {
+    return false;
+  }
+
+  return (
+    new RegExp(String.raw`\b${escapedName}\s*\?\.\s*\(`, "u").test(expression) ||
+    new RegExp(String.raw`^\s*${escapedName}\s*\?\?\s*undefined\s*$`, "u").test(expression) ||
+    options.externalAbsenceGuard
+  );
+}
+
 function destructuredPropsCallbackNames(source: string): Set<string> {
   const names = new Set<string>();
 
@@ -1205,7 +1447,31 @@ function destructuredPropsCallbackNames(source: string): Set<string> {
   }
 
   for (const match of source.matchAll(
-    /\bfunction\s+[A-Za-z_$][\w$]*\s*\(\s*\{([^}]+)\}/gu,
+    /\{[^{}]*:\s*\{([^{}]+)\}\s*(?:=\s*\{\})?[^{}]*\}/gu,
+  )) {
+    addDestructuredCallbackNames(names, match[1] ?? "");
+  }
+
+  for (const match of source.matchAll(
+    /\bfunction(?:\s+[A-Za-z_$][\w$]*(?:<[^>()]+>)?)?\s*\(\s*\{([^}]+)\}/gu,
+  )) {
+    addDestructuredCallbackNames(names, match[1] ?? "");
+  }
+
+  for (const match of source.matchAll(
+    /\b(?:const|let|var)\s+[A-Za-z_$][\w$]*\s*=\s*(?:async\s*)?\(?\s*\{([^}]+)\}\s*(?::\s*[^)=]+)?\)?\s*=>/gu,
+  )) {
+    addDestructuredCallbackNames(names, match[1] ?? "");
+  }
+
+  for (const match of source.matchAll(
+    /\bexport\s+default\s+(?:async\s*)?\(?\s*\{([^}]+)\}\s*(?::\s*[^)=]+)?\)?\s*=>/gu,
+  )) {
+    addDestructuredCallbackNames(names, match[1] ?? "");
+  }
+
+  for (const match of source.matchAll(
+    /\b(?:const|let|var)\s+[A-Za-z_$][\w$]*\s*=\s*function(?:\s+[A-Za-z_$][\w$]*)?\s*\(\s*\{([^}]+)\}/gu,
   )) {
     addDestructuredCallbackNames(names, match[1] ?? "");
   }
@@ -4315,5 +4581,10 @@ function errorMessage(error: unknown): string {
 }
 
 function escapeScriptJson(value: string): string {
-  return value.replaceAll("<", "\\u003c");
+  return value
+    .replaceAll("&", "\\u0026")
+    .replaceAll("<", "\\u003c")
+    .replaceAll(">", "\\u003e")
+    .replaceAll("\u2028", "\\u2028")
+    .replaceAll("\u2029", "\\u2029");
 }

package/src/http.ts

@@ -2,6 +2,8 @@ import type { ServerResponse } from "node:http";
 import type { IncomingMessage } from "node:http";
 import { Readable } from "node:stream";
 
+const rawUrlByRequest = new WeakMap<Request, string>();
+
 export function nodeRequestToWebRequest(
   incoming: IncomingMessage,
   origin: string,
@@ -32,7 +34,13 @@ export function nodeRequestToWebRequest(
     init.duplex = "half";
   }
 
-  return new Request(new URL(incoming.url ?? "/", origin), init);
+  const request = new Request(new URL(incoming.url ?? "/", origin), init);
+  rawUrlByRequest.set(request, incoming.url ?? "/");
+  return request;
+}
+
+export function rawNodeRequestUrl(request: Request): string | undefined {
+  return rawUrlByRequest.get(request);
 }
 
 /**

package/src/module-runner.ts

@@ -13,6 +13,7 @@ import {
   type InlineConfig,
   type PluginOption,
   type RunnableDevEnvironment,
+  type UserConfig,
 } from "vite";
 import { resolveWorkspacePackageFile } from "./workspace-packages.js";
 import {
@@ -36,7 +37,7 @@ import {
   inferClientRouteModule,
   type ClientRouteInferenceCache,
 } from "./client-route-inference.js";
-import { vitePluginsCacheKey } from "./vite-plugin-cache-key.js";
+import { viteDefineCacheKey, vitePluginsCacheKey } from "./vite-plugin-cache-key.js";
 
 const runnerConfig = {
   configFile: false,
@@ -81,6 +82,7 @@ export function routerModuleRunnerRuntimeCacheStats(): RouterRuntimeCacheStat[]
 export async function importAppRouterSourceModule<T>(options: {
   cacheKey?: string | undefined;
   code: string;
+  define?: UserConfig["define"] | undefined;
   externalizeAppSourceModuleDirs?: readonly string[] | undefined;
   label: string;
   plugins?: readonly RouterCompatPlugin[] | undefined;
@@ -122,6 +124,7 @@ export async function importAppRouterSourceModule<T>(options: {
 
 async function importAppRouterSourceModuleWithoutCache<T>(options: {
   code: string;
+  define?: UserConfig["define"] | undefined;
   externalizeAppSourceModuleDirs?: readonly string[] | undefined;
   label: string;
   plugins?: readonly RouterCompatPlugin[] | undefined;
@@ -273,6 +276,7 @@ export async function importAppRouterBuiltFileModule<T>(options: {
 
 export async function bundleAppRouterSourceModule(options: {
   code: string;
+  define?: UserConfig["define"] | undefined;
   externalizeAppSourceModuleDirs?: readonly string[] | undefined;
   label: string;
   plugins?: readonly RouterCompatPlugin[] | undefined;
@@ -284,6 +288,7 @@ export async function bundleAppRouterSourceModule(options: {
 }): Promise<string> {
   const output = await bundleRouterModule({
     code: options.code,
+    define: options.define,
     externalizeAppSourceModuleDirs: options.externalizeAppSourceModuleDirs,
     filename: options.sourcefile ?? join(options.resolveDir ?? process.cwd(), "module.js"),
     platform: "node",
@@ -334,6 +339,7 @@ export function fileImportMetaUrlPlugin(): RouterCompatPlugin {
 
 interface ServerSourceTransformOptions {
   clientRouteInferenceCache?: ClientRouteInferenceCache | undefined;
+  define?: UserConfig["define"] | undefined;
   dev: boolean;
   serverModules?: ReadonlyMap<string, BuiltServerModuleArtifact> | undefined;
   serverOutput: ServerOutputMode;
@@ -411,7 +417,7 @@ async function transformServerSourceFile(
     console.warn(formatClientRouteInferenceDiagnostic(diagnostic));
   }
 
-  const cacheKey = `${options.serverOutput}\0${options.dev ? "dev" : "prod"}\0${options.filename}\0${transformedSourceHash}\0${clientInference.clientBoundaryImports.join("\0")}\0${clientInference.clientBoundaryFallbackImports.join("\0")}\0${vitePluginsCacheKey(options.vitePlugins)}`;
+  const cacheKey = `${options.serverOutput}\0${options.dev ? "dev" : "prod"}\0${options.filename}\0${transformedSourceHash}\0${clientInference.clientBoundaryImports.join("\0")}\0${clientInference.clientBoundaryFallbackImports.join("\0")}\0${viteDefineCacheKey(options.define)}\0${vitePluginsCacheKey(options.vitePlugins)}`;
   const cached = readRouterRuntimeCacheEntry(
     serverSourceTransformCache,
     cacheKey,