@reckona/mreact-router 0.0.201 → 0.0.202

package/dist/render.js

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { readFileSync } from "node:fs";
 import { access, readFile, stat } from "node:fs/promises";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { formatDiagnostic, transform } from "@reckona/mreact-compiler";
@@ -14,13 +15,15 @@ import { appFileConventionContentType } from "./file-conventions.js";
 import { dispatchServerActionRequest, prepareRouteServerActionPlaceholders, prepareRouteServerActions, } from "./actions.js";
 import { serverActionCookie } from "./csrf.js";
 import { activeRouteCacheContext, withRouteCacheContext, cachedRouteResponse, cacheRouteResponse, routeCacheKey, routeCachePolicyFromSource, } from "./cache.js";
+import { trackRequestHeaderReads, withTrackedRequest, } from "./request-header-tracking.js";
+import { configuredHstsHeader, hasInvalidConfiguredHsts, } from "./security-headers.js";
 import { resolveRouterCacheLimit } from "./cache-config.js";
 import { importAppRouterBuiltFileModule, importAppRouterFileModule, importAppRouterSourceModule, fileImportMetaUrlPlugin, rewriteCompatVendorPlaceholderImportsForRunner, } from "./module-runner.js";
 import { bytesResponse, htmlResponse } from "./http.js";
 import { isNotFoundError, isRedirectError, rewriteLocation } from "./navigation.js";
 import { createAppRouterImportPolicyPlugin } from "./import-policy.js";
 import { existingRouteShellCandidates } from "./route-shells.js";
-import { hasLoaderExport, isStreamRouteSource, routeClosureMayUseAwaitBoundary, stripRouteBuildExports, stripRouteModuleExports, stripRouteClientOnlyExports, stripRouteClientSource, stripRouteLoaderOnlyExports, stripRouteMetadataOnlyExports, } from "./route-source.js";
+import { hasLoaderExport, isStreamRouteSource, routeClosureMayUseAwaitBoundary, routeClosureMayUseRequestInput, stripRouteBuildExports, stripRouteModuleExports, stripRouteClientOnlyExports, stripRouteClientSource, stripRouteLoaderOnlyExports, stripRouteMetadataOnlyExports, } from "./route-source.js";
 import { emitRouterLog, logDurationMs, logNow } from "./logger.js";
 import { createRouterRuntimeCacheCounters, readRouterRuntimeCacheEntry, routerRuntimeCacheStat, } from "./cache-stats.js";
 import { bundleRouterModule } from "./bundle-pipeline.js";
@@ -240,23 +243,17 @@ export function routerRenderRuntimeCacheStats() {
         routerRuntimeCacheStat("middleware-module", middlewareModuleCache, maxMiddlewareModuleCacheEntries, middlewareModuleCacheCounters),
         routerRuntimeCacheStat("server-route-module", serverRouteModuleCache, maxServerRouteModuleCacheEntries, serverRouteModuleCacheCounters),
         routerRuntimeCacheStat("composed-route-metadata", composedRouteMetadataCache, maxComposedRouteMetadataCacheEntries, composedRouteMetadataCacheCounters),
-        routerRuntimeCacheStat("rendered-shell", renderedShellCache, MAX_RENDERED_SHELL_CACHE_ENTRIES, renderedShellCacheCounters),
+        // Preserve the public diagnostics entry while making explicit that rendered HTML reuse is disabled.
+        {
+            evictions: 0,
+            hits: 0,
+            maxEntries: 0,
+            misses: 0,
+            name: "rendered-shell",
+            size: 0,
+        },
     ];
 }
-// Issue 086: per-shell prefix/suffix cache. Pure layouts (whose
-// exported component takes zero arguments and therefore cannot
-// depend on the request props) produce the same HTML for every
-// request, so we cache the already-split { prefix, suffix } strings
-// keyed by appDir + shellFile + serverModuleCacheVersion. Impure
-// layouts (function.length > 0) are tagged "impure" so we skip the
-// detection on subsequent requests but still render per-request.
-//
-// The cache is only active when a version is present (production
-// builds); dev mode keeps the previous behaviour so reloads pick up
-// edits without server restart.
-const renderedShellCache = new Map();
-const MAX_RENDERED_SHELL_CACHE_ENTRIES = 1024;
-const renderedShellCacheCounters = createRouterRuntimeCacheCounters();
 /**
  * Renders a source app-router request into a `Response`.
  */
@@ -449,6 +446,9 @@ async function renderAppRequestInternal(options) {
             renderSingleFlightNavigation: async (singleFlight) => renderAppRequestInternal({
                 ...options,
                 matchedRoute: undefined,
+                // This renders a different route than the caller asked about, so its
+                // header dependence says nothing about the caller's request.
+                renderSignals: undefined,
                 request: singleFlightNavigationRequest({
                     path: singleFlight.path,
                     request: singleFlight.request,
@@ -490,6 +490,9 @@ async function renderAppRequestInternal(options) {
     }
     const queryClient = options.queryClient ?? createQueryClient();
     let recoveryRoute;
+    let trackedRequest;
+    let sourceUsesRequestInput = true;
+    let invalidConfiguredHsts = false;
     return (await withRouteCacheContext(options.routeCache, async () => {
         try {
             if (matched.route.kind === "asset") {
@@ -554,13 +557,15 @@ async function renderAppRequestInternal(options) {
                 timing,
                 vitePlugins: options.vitePlugins,
             });
+            sourceUsesRequestInput = originalAnalysis.usesRequestInput;
             finishRenderTimingPhase(timing, phaseStartedAt, "sourceAnalysisMs");
             const cachePolicy = originalAnalysis.cachePolicy;
             const navigationScript = options.navigationScripts?.get(matched.route.path);
             const cacheKey = routeCacheKey(options.appDir, matched.route.path, url);
-            const mayUseRouteCache = cachePolicy === undefined
-                ? originalAnalysis.usesRuntimeCacheControl
-                : cachePolicy.revalidateSeconds !== 0;
+            const mayUseRouteCache = !sourceUsesRequestInput &&
+                (cachePolicy === undefined
+                    ? originalAnalysis.usesRuntimeCacheControl
+                    : cachePolicy.revalidateSeconds !== 0);
             const reloadRouteCache = isNavigationRouteCacheReloadRequest(options.request);
             phaseStartedAt = renderTimingPhaseStartedAt(timing);
             const cachedResponse = !mayUseRouteCache || reloadRouteCache
@@ -574,6 +579,17 @@ async function renderAppRequestInternal(options) {
             if (cachedResponse !== undefined) {
                 return cachedResponse;
             }
+            // Only a route whose result may be stored pays for header-read tracking;
+            // cache hits returned above never construct it. Application code reads
+            // headers through this request so that a render depending on one is never
+            // stored under a key that ignores it. Callers that store by path alone ask
+            // for tracking through `renderSignals` even when the route itself declares
+            // no cache policy.
+            trackedRequest =
+                mayUseRouteCache || options.renderSignals !== undefined
+                    ? trackRequestHeaderReads(options.request)
+                    : undefined;
+            const appRequest = trackedRequest?.request ?? options.request;
             phaseStartedAt = renderTimingPhaseStartedAt(timing);
             const preparedActions = await prepareRouteServerActions({
                 appDir: options.appDir,
@@ -614,12 +630,11 @@ async function renderAppRequestInternal(options) {
                 ? loadRouteDataWithInstrumentation({
                     appDir: options.appDir,
                     code: originalCode,
-                    context: {
+                    context: withTrackedRequest({
                         env: options.env,
                         params: matched.params,
                         queryClient,
-                        request: options.request,
-                    },
+                    }, appRequest, trackedRequest),
                     filename: matched.route.file,
                     importPolicy: options.importPolicy,
                     instrumentation: options.instrumentation,
@@ -698,12 +713,11 @@ async function renderAppRequestInternal(options) {
                             headers: { "content-type": "text/plain; charset=utf-8" },
                         });
                     }
-                    const renderedPage = await runWithQueryClient(queryClient, () => runServerModuleWithSlots(stringOutput.code, {
+                    const renderedPage = await runWithQueryClient(queryClient, () => runServerModuleWithSlots(stringOutput.code, withTrackedRequest({
                         data,
                         params: matched.params,
                         queryClient,
-                        request: options.request,
-                    }, matched.route.file, options.serverModules, options.serverModuleCacheVersion, options.define, options.vitePlugins, undefined, options.importPolicy, options.devServerModuleCacheVersion));
+                    }, appRequest, trackedRequest), matched.route.file, options.serverModules, options.serverModuleCacheVersion, options.define, options.vitePlugins, undefined, options.importPolicy, options.devServerModuleCacheVersion));
                     const pageHtml = renderedPage.html;
                     const pageHtmlForLayout = clientRoute
                         ? withHydrationMarkers({
@@ -728,12 +742,11 @@ async function renderAppRequestInternal(options) {
                         appDir: options.appDir,
                         pageFile: matched.route.file,
                         html: pageHtmlForLayout,
-                        props: {
+                        props: withTrackedRequest({
                             data,
                             params: matched.params,
                             queryClient,
-                            request: options.request,
-                        },
+                        }, appRequest, trackedRequest),
                         slots: renderedPage.slots,
                         serverModules: options.serverModules,
                         serverModuleCacheVersion: options.serverModuleCacheVersion,
@@ -746,11 +759,10 @@ async function renderAppRequestInternal(options) {
                     const metadata = await loadComposedRouteMetadata({
                         appDir: options.appDir,
                         code: originalCode,
-                        context: {
+                        context: withTrackedRequest({
                             data,
                             params: matched.params,
-                            request: options.request,
-                        },
+                        }, appRequest, trackedRequest),
                         filename: matched.route.file,
                         importPolicy: options.importPolicy,
                         routes,
@@ -851,7 +863,8 @@ async function renderAppRequestInternal(options) {
                         pageFile: matched.route.file,
                         params: matched.params,
                         queryClient,
-                        request: options.request,
+                        request: appRequest,
+                        trackedRequest,
                         routePath: matched.route.path,
                         routeScripts: options.clientScripts,
                         serverModules: options.serverModules,
@@ -871,12 +884,11 @@ async function renderAppRequestInternal(options) {
                     return response;
                 }
                 const data = streamData;
-                const props = {
+                const props = withTrackedRequest({
                     data,
                     params: matched.params,
                     queryClient,
-                    request: options.request,
-                };
+                }, appRequest, trackedRequest);
                 phaseStartedAt = renderTimingPhaseStartedAt(timing);
                 const stream = runServerStreamModule(output.code, {
                     appDir: options.appDir,
@@ -915,6 +927,12 @@ async function renderAppRequestInternal(options) {
                 emitRenderTiming(options, timing, data.status);
                 return data;
             }
+            sourceUsesRequestInput ||= await routeShellsMayUseRequestInput({
+                appDir: options.appDir,
+                pageFile: matched.route.file,
+                serverModuleCacheVersion: options.serverModuleCacheVersion,
+                serverSourceFiles: options.serverSourceFiles,
+            });
             await waitForRenderPreload(options, timing);
             await loadServerRenderArtifacts(options, matched.route.file, timing);
             phaseStartedAt = renderTimingPhaseStartedAt(timing);
@@ -935,12 +953,11 @@ async function renderAppRequestInternal(options) {
                 });
             }
             phaseStartedAt = renderTimingPhaseStartedAt(timing);
-            const renderedPage = await runWithQueryClient(queryClient, () => runServerModuleWithSlots(output.code, {
+            const renderedPage = await runWithQueryClient(queryClient, () => runServerModuleWithSlots(output.code, withTrackedRequest({
                 data,
                 params: matched.params,
                 queryClient,
-                request: options.request,
-            }, matched.route.file, options.serverModules, options.serverModuleCacheVersion, options.define, options.vitePlugins, timing, options.importPolicy, options.devServerModuleCacheVersion));
+            }, appRequest, trackedRequest), matched.route.file, options.serverModules, options.serverModuleCacheVersion, options.define, options.vitePlugins, timing, options.importPolicy, options.devServerModuleCacheVersion));
             finishRenderTimingPhase(timing, phaseStartedAt, "pageRenderMs");
             const pageHtml = renderedPage.html;
             // Wrap the page (not the full document) with the hydration marker so
@@ -972,12 +989,11 @@ async function renderAppRequestInternal(options) {
                 appDir: options.appDir,
                 pageFile: matched.route.file,
                 html: pageHtmlForLayout,
-                props: {
+                props: withTrackedRequest({
                     data,
                     params: matched.params,
                     queryClient,
-                    request: options.request,
-                },
+                }, appRequest, trackedRequest),
                 slots: renderedPage.slots,
                 serverModules: options.serverModules,
                 serverModuleCacheVersion: options.serverModuleCacheVersion,
@@ -991,11 +1007,10 @@ async function renderAppRequestInternal(options) {
             const metadata = await loadComposedRouteMetadata({
                 appDir: options.appDir,
                 code: originalCode,
-                context: {
+                context: withTrackedRequest({
                     data,
                     params: matched.params,
-                    request: options.request,
-                },
+                }, appRequest, trackedRequest),
                 filename: matched.route.file,
                 importPolicy: options.importPolicy,
                 routes,
@@ -1028,11 +1043,21 @@ async function renderAppRequestInternal(options) {
                 headers: responseHeadersForMetadata(metadata, options.request),
             }), preparedActions.csrfToken, preparedActions.csrfTokenIsNew === true);
             const effectiveCachePolicy = cachePolicy ?? activeRouteCacheContext()?.cachePolicy;
+            const configuredHsts = configuredHstsHeader(metadata?.security);
+            invalidConfiguredHsts = hasInvalidConfiguredHsts(metadata?.security);
             const finalResponse = preparedActions.hasFormActions
                 ? withRouteCacheHeader(response, effectiveCachePolicy)
                 : await cacheRouteResponse({
                     key: cacheKey,
                     cache: options.routeCache,
+                    // A policy can still arrive from a runtime cacheControl() call made
+                    // outside the page source, which is what `mayUseRouteCache` scans.
+                    // Without a tracker there is no evidence the render ignored request
+                    // headers, so the entry is treated as header dependent.
+                    headerDependent: sourceUsesRequestInput ||
+                        invalidConfiguredHsts ||
+                        (trackedRequest?.requestDependent() ?? true),
+                    ...(configuredHsts === undefined ? {} : { strictTransportSecurity: configuredHsts }),
                     path: matched.route.path,
                     policy: effectiveCachePolicy,
                     request: options.request,
@@ -1103,13 +1128,31 @@ async function renderAppRequestInternal(options) {
             emitRenderTiming(options, timing, response.status);
             return response;
         }
+        finally {
+            // Reported from every return path, including the streaming ones, so that a
+            // caller storing by path alone never mistakes an unreported render for a
+            // shareable one. The value stays lazy because a streamed render can still
+            // read request headers while its deferred parts resolve; callers read it
+            // after draining the body.
+            if (options.renderSignals !== undefined) {
+                const tracked = trackedRequest;
+                options.renderSignals.headerDependent = () => sourceUsesRequestInput || invalidConfiguredHsts || (tracked?.requestDependent() ?? true);
+            }
+        }
     })).value;
 }
 async function applyAppRouterResponseHook(response, options) {
     const onResponse = await resolveAppRouterResponseHook(options);
-    const hooked = await onResponse?.(response, {
-        request: options.request,
-    });
+    if (onResponse === undefined) {
+        return response;
+    }
+    const renderSignals = options.renderSignals;
+    const trackedRequest = renderSignals === undefined ? undefined : trackRequestHeaderReads(options.request);
+    const hooked = await onResponse(response, withTrackedRequest({}, trackedRequest?.request ?? options.request, trackedRequest));
+    if (renderSignals !== undefined && trackedRequest !== undefined) {
+        const renderHeaderDependent = renderSignals.headerDependent;
+        renderSignals.headerDependent = () => renderHeaderDependent() || trackedRequest.requestDependent();
+    }
     return hooked instanceof Response ? hooked : response;
 }
 export async function resolveAppRouterResponseHook(options) {
@@ -1934,6 +1977,9 @@ function routeSourceAnalysisFromArtifact(artifact) {
         hasLoader: artifact.hasLoader,
         routeCode: artifact.routeCode,
         streamRoute: artifact.streamRoute,
+        // Older built artifacts predate request-input safety analysis. Treat them
+        // as dependent until rebuilt rather than trusting an absent safety signal.
+        usesRequestInput: artifact.usesRequestInput ?? true,
         usesRuntimeCacheControl: artifact.usesRuntimeCacheControl,
     };
 }
@@ -1962,11 +2008,52 @@ async function analyzeRouteSourceUncached(options) {
                 projectRoot: options.appDir,
                 source: options.code,
             }),
+        usesRequestInput: routeClosureMayUseRequestInput({
+            filename: options.filename,
+            files: routeSourceFilesForAnalysis(options),
+            projectRoot: options.appDir,
+            source: options.code,
+        }),
         usesRuntimeCacheControl: usesRuntimeCacheControl(options.code),
     };
 }
 function routeSourceFilesForAnalysis(options) {
-    return (file) => file === options.filename ? options.code : options.serverSourceFiles?.get(file);
+    return (file) => {
+        const known = file === options.filename ? options.code : options.serverSourceFiles?.get(file);
+        if (known !== undefined) {
+            return known;
+        }
+        const relativeFile = relative(resolve(options.appDir), resolve(file));
+        if (relativeFile === "" || relativeFile === ".." || relativeFile.startsWith(`..${sep}`)) {
+            return undefined;
+        }
+        try {
+            return readFileSync(file, "utf8");
+        }
+        catch {
+            return undefined;
+        }
+    };
+}
+async function routeShellsMayUseRequestInput(options) {
+    const shells = await shellFilesForPage(options.appDir, options.pageFile, options.serverModuleCacheVersion);
+    for (const shell of shells) {
+        const source = await readServerSourceFile(shell.file, options.serverModuleCacheVersion, options.serverSourceFiles);
+        if (routeClosureMayUseRequestInput({
+            filename: shell.file,
+            files: routeSourceFilesForAnalysis({
+                appDir: options.appDir,
+                code: source,
+                filename: shell.file,
+                serverSourceFiles: options.serverSourceFiles,
+            }),
+            projectRoot: options.appDir,
+            source,
+        })) {
+            return true;
+        }
+    }
+    return false;
 }
 async function runServerModule(code, props, sourcefile, serverModules, serverModuleCacheVersion, define, vitePlugins) {
     const component = await loadServerComponent(code, sourcefile, serverModules, serverModuleCacheVersion, define, vitePlugins);
@@ -2215,12 +2302,11 @@ function localServerSourceImportCandidates(base) {
     return candidates;
 }
 async function runServerStreamModuleWithLoading(code, options) {
-    const loadingProps = {
+    const loadingProps = withTrackedRequest({
         data: undefined,
         params: options.params,
         queryClient: options.queryClient,
-        request: options.request,
-    };
+    }, options.request, options.trackedRequest);
     const layoutShells = await layoutShellsForPage(options.appDir, options.pageFile, loadingProps, {}, options.serverModules, options.serverModuleCacheVersion, options.serverSourceFiles, options.clientRouteInferenceCache, options.define, options.vitePlugins, options.importPolicy);
     const loadingHtml = await renderServerFileToHtml(options.loadingFile, loadingProps, options.serverModules, options.serverModuleCacheVersion, options.serverSourceFiles, options.define, options.vitePlugins);
     const marker = options.clientRoute
@@ -2247,12 +2333,11 @@ async function runServerStreamModuleWithLoading(code, options) {
         }
         sink.append(marker?.prefix ?? "");
         renderVisibleOutOfOrderBoundary(sink, "mreact-route", options.data, async (boundarySink, data) => {
-            await appendServerStreamModule(code, boundarySink, {
+            await appendServerStreamModule(code, boundarySink, withTrackedRequest({
                 data,
                 params: options.params,
                 queryClient: options.queryClient,
-                request: options.request,
-            }, options.pageFile, options.serverModules, options.serverModuleCacheVersion, options.define, options.vitePlugins, options.importPolicy);
+            }, options.request, options.trackedRequest), options.pageFile, options.serverModules, options.serverModuleCacheVersion, options.define, options.vitePlugins, options.importPolicy);
         }, {
             placeholder(boundarySink) {
                 boundarySink.append(loadingHtml);
@@ -2441,12 +2526,6 @@ async function renderShellPrefixSuffix(appDir, shell, props, slotContext, server
     const cacheKey = serverModuleCacheVersion === undefined || hasNamedSlots || shell.kind === "template"
         ? undefined
         : `${appDir}\0${shell.file}\0${serverModuleCacheVersion}\0${importPolicyCacheKey(importPolicy)}\0${viteDefineCacheKey(define)}\0${vitePluginsCacheKey(vitePlugins)}`;
-    if (cacheKey !== undefined) {
-        const cached = readRouterRuntimeCacheEntry(renderedShellCache, cacheKey, renderedShellCacheCounters);
-        if (cached !== undefined && cached !== "impure") {
-            return cached;
-        }
-    }
     const staticEntry = cacheKey === undefined ? undefined : shellStaticRenderCache.get(cacheKey);
     const loadedStaticEntry = staticEntry ??
         (await loadShellStaticRenderEntry({
@@ -2472,33 +2551,6 @@ async function renderShellPrefixSuffix(appDir, shell, props, slotContext, server
         hasOutOfOrderBoundary: loadedStaticEntry.hasOutOfOrderBoundary,
     };
     addRenderTimingPhaseDuration(timing, phaseStartedAt, "layoutSlotSplitMs");
-    const shellCacheKey = loadedStaticEntry.shellUsesAwait ? undefined : cacheKey;
-    const cached = shellCacheKey !== undefined
-        ? readRouterRuntimeCacheEntry(renderedShellCache, shellCacheKey, renderedShellCacheCounters)
-        : undefined;
-    // Detect purity: a zero-arg component cannot depend on props. The
-    // markShellBoundary + splitLayoutSlot output is then constant for
-    // the (appDir, shellFile, version) tuple. We only set the cache
-    // entry on the first request that observes the function arity; on
-    // an "impure" tag we never overwrite it.
-    if (shellCacheKey !== undefined && cached !== "impure") {
-        if (loadedStaticEntry.component.length === 0) {
-            if (renderedShellCache.size >= MAX_RENDERED_SHELL_CACHE_ENTRIES) {
-                const oldestKey = renderedShellCache.keys().next().value;
-                if (oldestKey !== undefined) {
-                    renderedShellCache.delete(oldestKey);
-                    renderedShellCacheCounters.evictions += 1;
-                }
-            }
-            renderedShellCache.set(shellCacheKey, rendered);
-        }
-        else {
-            // Impure — stamp the cache so subsequent lookups short-circuit
-            // without re-checking arity. We still run the per-request
-            // render path above so the props are honoured.
-            renderedShellCache.set(shellCacheKey, "impure");
-        }
-    }
     return rendered;
 }
 async function loadShellStaticRenderEntry(options) {