@reckona/mreact-router 0.0.174 → 0.0.176

package/src/built-server-module-artifacts.ts

@@ -0,0 +1,340 @@
+import { readFile } from "node:fs/promises";
+import { dirname, isAbsolute, join, normalize, sep } from "node:path";
+import type { BuiltServerModuleArtifact } from "./build.js";
+import { routeShellCandidates } from "./route-shells.js";
+
+export interface BuiltServerModuleArtifactRuntime {
+  appDir: string;
+  serverModuleArtifactLoads: Map<string, Promise<void>>;
+  serverModuleClosureFiles: Map<string, readonly string[]>;
+  serverModuleFiles: ReadonlyMap<string, string>;
+  serverModuleRenderFiles: ReadonlyMap<string, string>;
+  serverModuleRequestFiles: ReadonlyMap<string, string>;
+  serverModules: Map<string, BuiltServerModuleArtifact>;
+  serverSourceFiles: ReadonlyMap<string, string>;
+}
+
+export type BuiltServerModuleArtifactKind = "all" | "render" | "request";
+
+export async function loadBuiltServerModuleArtifacts(
+  runtime: BuiltServerModuleArtifactRuntime,
+  files: Iterable<string>,
+  kind: BuiltServerModuleArtifactKind = "all",
+): Promise<void> {
+  for (const file of files) {
+    await loadBuiltServerModuleArtifact(runtime, file, kind);
+  }
+}
+
+async function loadBuiltServerModuleArtifact(
+  runtime: BuiltServerModuleArtifactRuntime,
+  file: string,
+  kind: BuiltServerModuleArtifactKind = "all",
+): Promise<void> {
+  if (kind === "all") {
+    await loadBuiltServerModuleArtifact(runtime, file, "request");
+    await loadBuiltServerModuleArtifact(runtime, file, "render");
+    return;
+  }
+
+  const artifactPath =
+    kind === "request"
+      ? runtime.serverModuleRequestFiles.get(file) ?? runtime.serverModuleFiles.get(file)
+      : runtime.serverModuleRenderFiles.get(file) ?? runtime.serverModuleFiles.get(file);
+
+  if (artifactPath === undefined) {
+    return;
+  }
+
+  const cached = runtime.serverModuleArtifactLoads.get(`${kind}\0${file}`);
+
+  if (cached !== undefined) {
+    await cached;
+    return;
+  }
+
+  const loaded = readFile(artifactPath, "utf8")
+    .then((text) => {
+      const existing = runtime.serverModules.get(file) ?? {};
+      runtime.serverModules.set(
+        file,
+        mergeBuiltServerModuleArtifacts(
+          existing,
+          hydrateBuiltServerModuleArtifact(
+            parseBuiltJsonArtifact<BuiltServerModuleArtifact>(
+              text,
+              artifactPath,
+              `built server module artifact for ${file}`,
+            ),
+            builtServerDirForArtifactPath(artifactPath),
+          ),
+        ),
+      );
+    })
+    .catch((error) => {
+      runtime.serverModuleArtifactLoads.delete(`${kind}\0${file}`);
+      if (isMissingFileError(error)) {
+        throw builtArtifactReadError(`built server module artifact for ${file}`, artifactPath, error);
+      }
+      throw error;
+    });
+  runtime.serverModuleArtifactLoads.set(`${kind}\0${file}`, loaded);
+
+  await loaded;
+}
+
+export function allBuiltServerModuleFiles(
+  runtime: BuiltServerModuleArtifactRuntime,
+): Iterable<string> {
+  return new Set([
+    ...runtime.serverModuleFiles.keys(),
+    ...runtime.serverModuleRequestFiles.keys(),
+    ...runtime.serverModuleRenderFiles.keys(),
+  ]);
+}
+
+function builtServerDirForArtifactPath(artifactPath: string): string {
+  const marker = `${sep}server-modules${sep}`;
+  const index = artifactPath.lastIndexOf(marker);
+
+  return index === -1 ? dirname(dirname(artifactPath)) : artifactPath.slice(0, index);
+}
+
+function hydrateBuiltServerModuleArtifact(
+  artifact: BuiltServerModuleArtifact,
+  serverDir: string,
+): BuiltServerModuleArtifact {
+  return {
+    ...(artifact.analysis === undefined ? {} : { analysis: artifact.analysis }),
+    ...(artifact.loader === undefined
+      ? {}
+      : { loader: hydrateBuiltServerModuleOutput(artifact.loader, serverDir) }),
+    ...(artifact.routeMetadata === undefined
+      ? {}
+      : { routeMetadata: hydrateBuiltServerModuleOutput(artifact.routeMetadata, serverDir) }),
+    ...(artifact.request === undefined
+      ? {}
+      : { request: hydrateBuiltServerModuleOutput(artifact.request, serverDir) }),
+    ...(artifact.stream === undefined
+      ? {}
+      : { stream: hydrateBuiltServerModuleOutput(artifact.stream, serverDir) }),
+    ...(artifact.string === undefined
+      ? {}
+      : { string: hydrateBuiltServerModuleOutput(artifact.string, serverDir) }),
+  };
+}
+
+function hydrateBuiltServerModuleOutput<T extends { moduleFile?: string | undefined }>(
+  output: T,
+  serverDir: string,
+): T {
+  if (output.moduleFile === undefined || isAbsolute(output.moduleFile)) {
+    return output;
+  }
+
+  return {
+    ...output,
+    moduleFile: join(serverDir, safeBuiltServerManifestFilePath(output.moduleFile)),
+  };
+}
+
+function mergeBuiltServerModuleArtifacts(
+  existing: BuiltServerModuleArtifact,
+  loaded: BuiltServerModuleArtifact,
+): BuiltServerModuleArtifact {
+  return {
+    ...existing,
+    ...loaded,
+  };
+}
+
+export async function loadBuiltServerModuleArtifactsForRequest(
+  runtime: BuiltServerModuleArtifactRuntime,
+  routeFile: string | undefined,
+  options: {
+    includeRender?: boolean | undefined;
+    includeShells?: boolean | undefined;
+  } = {},
+): Promise<void> {
+  const roots = [
+    join(runtime.appDir, "middleware.ts"),
+    join(runtime.appDir, "middleware.mreact.ts"),
+    ...(routeFile === undefined
+      ? []
+      : [
+          routeFile,
+          ...(options.includeShells === false ? [] : shellFilesForRoute(runtime, routeFile)),
+        ]),
+  ];
+  const seen = new Set<string>();
+
+  for (const file of roots) {
+    await loadBuiltServerModuleArtifactClosure(runtime, file, seen, "request");
+  }
+
+  if (options.includeRender === true) {
+    seen.clear();
+    for (const file of roots) {
+      await loadBuiltServerModuleArtifactClosure(runtime, file, seen, "render");
+    }
+  }
+}
+
+async function loadBuiltServerModuleArtifactClosure(
+  runtime: BuiltServerModuleArtifactRuntime,
+  file: string,
+  seen: Set<string>,
+  kind: BuiltServerModuleArtifactKind,
+): Promise<void> {
+  for (const closureFile of builtServerModuleClosureFiles(runtime, file)) {
+    if (seen.has(closureFile)) {
+      continue;
+    }
+    seen.add(closureFile);
+    await loadBuiltServerModuleArtifact(runtime, closureFile, kind);
+  }
+}
+
+function builtServerModuleClosureFiles(
+  runtime: BuiltServerModuleArtifactRuntime,
+  file: string,
+): readonly string[] {
+  const cached = runtime.serverModuleClosureFiles.get(file);
+  if (cached !== undefined) {
+    return cached;
+  }
+
+  const closure: string[] = [];
+  collectBuiltServerModuleClosureFiles(runtime, file, new Set(), closure);
+  runtime.serverModuleClosureFiles.set(file, closure);
+  return closure;
+}
+
+function collectBuiltServerModuleClosureFiles(
+  runtime: BuiltServerModuleArtifactRuntime,
+  file: string,
+  seen: Set<string>,
+  closure: string[],
+): void {
+  if (seen.has(file)) {
+    return;
+  }
+  seen.add(file);
+  closure.push(file);
+
+  const source = runtime.serverSourceFiles.get(file);
+  if (source === undefined) {
+    return;
+  }
+
+  for (const specifier of localServerModuleSpecifiers(source)) {
+    const resolved = resolveBuiltLocalServerSourceImport(runtime, file, specifier);
+    if (resolved !== undefined) {
+      collectBuiltServerModuleClosureFiles(runtime, resolved, seen, closure);
+    }
+  }
+}
+
+const localServerModuleImportPattern =
+  /\b(?:import|export)\s+(?:type\s+)?(?:[^"']*?\s+from\s*)?["'](?<source>\.{1,2}\/[^"']+)["']/g;
+
+function localServerModuleSpecifiers(code: string): string[] {
+  const specifiers = new Set<string>();
+  localServerModuleImportPattern.lastIndex = 0;
+
+  for (const match of code.matchAll(localServerModuleImportPattern)) {
+    const source = match.groups?.source;
+
+    if (source !== undefined) {
+      specifiers.add(source);
+    }
+  }
+
+  return Array.from(specifiers);
+}
+
+function resolveBuiltLocalServerSourceImport(
+  runtime: BuiltServerModuleArtifactRuntime,
+  fromFile: string,
+  specifier: string,
+): string | undefined {
+  const base = join(dirname(fromFile), specifier);
+
+  for (const candidate of localServerSourceImportCandidates(base)) {
+    if (runtime.serverSourceFiles.has(candidate)) {
+      return candidate;
+    }
+  }
+
+  return undefined;
+}
+
+function localServerSourceImportCandidates(base: string): string[] {
+  const candidates = [base];
+
+  if (base.endsWith(".js")) {
+    const withoutJs = base.slice(0, -".js".length);
+    candidates.push(`${withoutJs}.ts`, `${withoutJs}.tsx`, `${withoutJs}.mreact.tsx`);
+  } else if (base.endsWith(".jsx")) {
+    const withoutJsx = base.slice(0, -".jsx".length);
+    candidates.push(`${withoutJsx}.tsx`, `${withoutJsx}.mreact.tsx`);
+  } else if (base.endsWith(".mreact")) {
+    candidates.push(`${base}.tsx`);
+  } else {
+    candidates.push(
+      `${base}.ts`,
+      `${base}.tsx`,
+      `${base}.mreact.tsx`,
+      join(base, "index.ts"),
+      join(base, "index.tsx"),
+      join(base, "index.mreact.tsx"),
+    );
+  }
+
+  return candidates;
+}
+
+function shellFilesForRoute(
+  runtime: BuiltServerModuleArtifactRuntime,
+  routeFile: string,
+): string[] {
+  return routeShellCandidates(runtime.appDir, routeFile)
+    .map((candidate) => candidate.file)
+    .filter((file) => runtime.serverSourceFiles.has(file));
+}
+
+function isMissingFileError(error: unknown): boolean {
+  return (
+    typeof error === "object" &&
+    error !== null &&
+    "code" in error &&
+    (error as { code?: unknown }).code === "ENOENT"
+  );
+}
+
+function builtArtifactReadError(label: string, artifactPath: string, error: unknown): Error {
+  const prefix = isMissingFileError(error) ? "Missing" : "Unable to read";
+  const detail = error instanceof Error && error.message !== "" ? `: ${error.message}` : "";
+
+  return new Error(`${prefix} ${label}: ${artifactPath}${detail}`, { cause: error });
+}
+
+function parseBuiltJsonArtifact<T>(text: string, artifactPath: string, label: string): T {
+  try {
+    return JSON.parse(text) as T;
+  } catch (error) {
+    const detail = error instanceof Error && error.message !== "" ? `: ${error.message}` : "";
+
+    throw new Error(`Invalid ${label}: ${artifactPath}${detail}`, { cause: error });
+  }
+}
+
+function safeBuiltServerManifestFilePath(pathname: string): string {
+  const normalized = normalize(pathname);
+
+  if (isAbsolute(normalized) || normalized === ".." || normalized.startsWith("../")) {
+    throw new Error(`Invalid built app manifest file path: ${pathname}`);
+  }
+
+  return normalized;
+}

package/src/client-manifest-assets.ts

@@ -0,0 +1,92 @@
+export interface ClientManifestAssetRoute {
+  css?: readonly string[] | undefined;
+  imports?: readonly string[] | undefined;
+  navigationScript?: string | undefined;
+  script?: string | undefined;
+  sourceMap?: string | undefined;
+}
+
+export interface ClientManifestAssetSource {
+  assets?: readonly string[] | undefined;
+  routes: readonly ClientManifestAssetRoute[];
+}
+
+export function clientManifestAssetPaths(
+  manifest: ClientManifestAssetSource,
+  options: {
+    extraPaths?: readonly string[] | undefined;
+    prefix?: string | undefined;
+  } = {},
+): Set<string> {
+  const prefix = normalizeClientManifestAssetPrefix(options.prefix ?? "");
+  const paths = new Set<string>([`${prefix}manifest.json`]);
+
+  for (const route of manifest.routes) {
+    for (const asset of [
+      route.script,
+      route.sourceMap,
+      route.navigationScript,
+      ...(route.css ?? []),
+      ...(route.imports ?? []),
+    ]) {
+      const path = safeClientManifestAssetPath(asset);
+
+      if (path !== undefined) {
+        paths.add(`${prefix}${path}`);
+      }
+    }
+  }
+
+  for (const asset of manifest.assets ?? []) {
+    const path = safeClientManifestAssetPath(asset);
+
+    if (path !== undefined) {
+      paths.add(`${prefix}${path}`);
+    }
+  }
+
+  for (const asset of options.extraPaths ?? []) {
+    const path = safeClientManifestAssetPath(asset);
+
+    if (path !== undefined) {
+      paths.add(`${prefix}${path}`);
+    }
+  }
+
+  return paths;
+}
+
+function normalizeClientManifestAssetPrefix(prefix: string): string {
+  if (prefix === "") {
+    return "";
+  }
+
+  const withLeadingSlash = prefix.startsWith("/") ? prefix : `/${prefix}`;
+
+  return withLeadingSlash.endsWith("/") ? withLeadingSlash : `${withLeadingSlash}/`;
+}
+
+function safeClientManifestAssetPath(asset: string | undefined): string | undefined {
+  if (asset === undefined || asset === "" || asset.startsWith("/") || asset.includes("\\")) {
+    return undefined;
+  }
+
+  const segments = asset.split("/");
+
+  return segments.some((segment) => unsafeClientManifestAssetSegment(segment))
+    ? undefined
+    : segments.join("/");
+}
+
+function unsafeClientManifestAssetSegment(segment: string): boolean {
+  if (segment === "" || segment === "." || segment === "..") {
+    return true;
+  }
+
+  try {
+    const decoded = decodeURIComponent(segment);
+    return decoded === "." || decoded === ".." || decoded.includes("/") || decoded.includes("\\");
+  } catch {
+    return true;
+  }
+}

package/src/client.ts

@@ -2657,7 +2657,7 @@ export async function __mreactPrefetch(url) {
     return true;
   }
 
-  __mreactNavigationState.prefetchedUrls.add(href);
+  __mreactRememberPrefetchedUrl(href);
 
   const script = __mreactRouteScriptForNavigationUrl(href);
 
@@ -2684,6 +2684,33 @@ function __mreactPrefetchNavigationHtml(href) {
 }
 
 const __mreactNavigationHtmlCacheMaxEntries = 64;
+const __mreactNavigationPrefetchHistoryMaxEntries = 64;
+
+function __mreactRememberPrefetchedUrl(href) {
+  __mreactRememberPrefetchHistory(__mreactNavigationState.prefetchedUrls, href);
+}
+
+function __mreactRememberPrefetchedScript(href) {
+  __mreactRememberPrefetchHistory(__mreactNavigationState.prefetchedScripts, href);
+}
+
+function __mreactRememberPrefetchHistory(history, href) {
+  if (history.has(href)) {
+    history.delete(href);
+  }
+
+  history.add(href);
+
+  while (history.size > __mreactNavigationPrefetchHistoryMaxEntries) {
+    const oldestHref = history.keys().next().value;
+
+    if (oldestHref === undefined) {
+      return;
+    }
+
+    history.delete(oldestHref);
+  }
+}
 
 function __mreactCachedNavigationHtml(href) {
   const html = __mreactNavigationState.cache.get(href);
@@ -2712,6 +2739,7 @@ function __mreactRememberNavigationHtml(href, html) {
     }
 
     __mreactNavigationState.cache.delete(oldestHref);
+    __mreactNavigationState.prefetchedUrls.delete(oldestHref);
   }
 }
 
@@ -2732,7 +2760,7 @@ function __mreactPrefetchRouteScript(script) {
 
   for (const link of Array.from(document.querySelectorAll('link[rel="modulepreload"][href]'))) {
     if (link.href === href) {
-      __mreactNavigationState.prefetchedScripts.add(href);
+      __mreactRememberPrefetchedScript(href);
       return true;
     }
   }
@@ -2741,7 +2769,7 @@ function __mreactPrefetchRouteScript(script) {
   link.rel = "modulepreload";
   link.href = href;
   document.head.appendChild(link);
-  __mreactNavigationState.prefetchedScripts.add(href);
+  __mreactRememberPrefetchedScript(href);
   return true;
 }
 

package/src/node-server.ts

@@ -0,0 +1,129 @@
+import { createServer, type Server } from "node:http";
+import { nodeRequestToWebRequest, sendResponse } from "./http.js";
+import {
+  emitRouterLog,
+  logDurationMs,
+  logError,
+  logNow,
+  nodeRequestPath,
+  requestLogFields,
+  type AppRouterLogger,
+} from "./logger.js";
+import type { HttpUpgradeHandler } from "./upgrade.js";
+
+export interface StartNodeRequestServerOptions {
+  allowedHosts?: readonly string[] | undefined;
+  errorHandler?: ((error: unknown) => {
+    body: string;
+    status: number;
+    headers?: Record<string, string>;
+  }) | undefined;
+  hostname?: string | undefined;
+  hostPolicy?: "strict" | "trusted-proxy" | undefined;
+  logger?: AppRouterLogger | undefined;
+  onUpgrade?: HttpUpgradeHandler | undefined;
+  port: number;
+  render(request: Request): Promise<Response>;
+  resolveHost?: ((options: {
+    allowedHosts?: readonly string[] | undefined;
+    fallbackHost: string;
+    hostPolicy?: "strict" | "trusted-proxy" | undefined;
+    rawHost: string | undefined;
+  }) => string) | undefined;
+}
+
+export async function startNodeRequestServer(
+  options: StartNodeRequestServerOptions,
+): Promise<{ close(): Promise<void>; server: Server; url: string }> {
+  const server = createServer(async (incoming, outgoing) => {
+    const startedAt = logNow();
+    const fallbackRequestFields = {
+      method: incoming.method ?? "GET",
+      path: nodeRequestPath(incoming.url),
+      runtime: "node" as const,
+    };
+
+    try {
+      const fallbackHost = `${options.hostname ?? "127.0.0.1"}:${options.port}`;
+      const host = (options.resolveHost ?? defaultResolveRequestHost)({
+        allowedHosts: options.allowedHosts,
+        fallbackHost,
+        hostPolicy: options.hostPolicy,
+        rawHost: incoming.headers.host,
+      });
+      const request = nodeRequestToWebRequest(incoming, `http://${host}`);
+      const logFields = requestLogFields(request, "node");
+      emitRouterLog(options.logger, "info", {
+        ...logFields,
+        type: "router:request:start",
+      });
+      const response = await options.render(request);
+      emitRouterLog(options.logger, "info", {
+        ...logFields,
+        durationMs: logDurationMs(startedAt),
+        status: response.status,
+        type: "router:request:end",
+      });
+
+      await sendResponse(outgoing, response);
+    } catch (error) {
+      // Log the full stack to stderr for operator visibility; never put
+      // it in the response body where attackers can scrape it.
+      emitRouterLog(options.logger, "error", {
+        ...fallbackRequestFields,
+        durationMs: logDurationMs(startedAt),
+        error: logError(error),
+        type: "router:request:error",
+      });
+      if (options.logger === undefined) {
+        console.error("[mreact] startServer request failed:", error);
+      }
+      const payload = options.errorHandler
+        ? options.errorHandler(error)
+        : { body: "Internal Server Error", status: 500 };
+      outgoing.statusCode = payload.status;
+      outgoing.setHeader(
+        "content-type",
+        payload.headers?.["content-type"] ?? "text/plain; charset=utf-8",
+      );
+      for (const [name, value] of Object.entries(payload.headers ?? {})) {
+        if (name.toLowerCase() === "content-type") continue;
+        outgoing.setHeader(name, value);
+      }
+      outgoing.end(payload.body);
+    }
+  });
+
+  if (options.onUpgrade !== undefined) {
+    server.on("upgrade", options.onUpgrade);
+  }
+
+  await new Promise<void>((resolve) =>
+    server.listen(options.port, options.hostname ?? "127.0.0.1", resolve),
+  );
+  const address = server.address();
+  const port = typeof address === "object" && address !== null ? address.port : options.port;
+
+  return {
+    server,
+    url: `http://${options.hostname ?? "127.0.0.1"}:${port}`,
+    close: () =>
+      new Promise<void>((resolve, reject) =>
+        server.close((error) => (error ? reject(error) : resolve())),
+      ),
+  };
+}
+
+function defaultResolveRequestHost(options: {
+  allowedHosts?: readonly string[] | undefined;
+  fallbackHost: string;
+  hostPolicy?: "strict" | "trusted-proxy" | undefined;
+  rawHost: string | undefined;
+}): string {
+  const raw = options.rawHost;
+  if (raw === undefined || raw === "") return options.fallbackHost;
+  if (options.allowedHosts === undefined) {
+    return options.hostPolicy === "strict" ? options.fallbackHost : raw;
+  }
+  return options.allowedHosts.includes(raw) ? raw : options.fallbackHost;
+}