@reckona/mreact-router 0.0.202 → 0.0.203

package/dist/build.js

@@ -9,13 +9,13 @@ import { collectStaticImportReferences, collectTopLevelValueExportNames, formatD
 import { transformCompilerModuleContext } from "@reckona/mreact-compiler/internal";
 import { compilerModuleContextForSource, collectClientRouteReferences, createClientRouteInferenceCache, detectAnchorElementUsage, detectClientNavigationOverride, formatClientRouteInferenceDiagnostic, inferClientRouteModule, navigationRuntimeLinkDisabledDiagnostic, resolveNavigationRuntime, } from "./client-route-inference.js";
 import { createBoundaryReport } from "./boundaries.js";
-import { buildClientRouteBatchOutput, buildNavigationRuntimeBundle, clientScriptForPath, routeIdForPath, } from "./navigation-runtime.js";
+import { buildClientRouteBatchOutput, buildNavigationRuntimeBundle, clientScriptForPath, routeIdForPath, routeMarkerParts, } from "./navigation-runtime.js";
 import { COMPAT_VENDOR_PLACEHOLDER_PREFIX, bundleAppRouterSourceModule, fileImportMetaUrlPlugin, importAppRouterSourceModule, resolveCompatVendorEntryFiles, sourceReferencesCompatVendorSpecifier, } from "./module-runner.js";
 import { compileRouteMatcherArtifact, scanAppRoutes } from "./routes.js";
 import { appFileConventionForRootFilename } from "./file-conventions.js";
 import { resolveAppRouterProjectOptions, resolveBuildTargets, } from "./config.js";
 import { routeCachePolicyFromSource } from "./cache.js";
-import { bundleMiddlewareModuleCode, renderAppRequest, } from "./render.js";
+import { bundleMiddlewareModuleCode, prerenderVariantMarkerParts, renderAppRequest, } from "./render.js";
 import { createAppRouterImportPolicyPlugin } from "./import-policy.js";
 import { hasGenerateStaticParamsExport, hasLoaderExport, hasPrerenderExport, isStreamRouteSource, routeClosureMayUseAwaitBoundary, routeClosureMayUseRequestInput, stripRouteBuildExports, stripRouteClientOnlyExports, stripRouteClientSource, stripRouteLoaderOnlyExports, stripRouteMetadataOnlyExports, stripRouteRequestOnlyExports, } from "./route-source.js";
 import { bundleRouterModule, bundleRouterModules, } from "./bundle-pipeline.js";
@@ -23,7 +23,7 @@ import { collectRouteCssFilesFromSources, collectSpecialBoundaryFiles } from "./
 import { existingRouteShellCandidates } from "./route-shells.js";
 import { sourceModuleCandidates } from "./source-modules.js";
 import { collectBuildInferredServerActions } from "./server-action-inference.js";
-import { isVisitorDependentResponse, PRERENDERED_ROUTE_SCHEMA_VERSION, } from "./prerender-entry.js";
+import { isVisitorDependentResponse, PRERENDERED_ROUTE_SCHEMA_VERSION, storedPrerenderedRouteHeaders, } from "./prerender-entry.js";
 import { prepareRouteServerActionPlaceholders } from "./actions.js";
 import { viteDefineCacheKey, vitePluginsCacheKey } from "./vite-plugin-cache-key.js";
 import { workspacePackageFile } from "./workspace-packages.js";
@@ -1605,6 +1605,7 @@ async function prerenderStaticRoutes(options) {
         for (const pathname of await prerenderPathsForRoute(route, analysis, options.vitePlugins)) {
             const renderSignals = {
                 headerDependent: () => true,
+                strictTransportSecurity: () => undefined,
             };
             const renderOptions = {
                 appDir: options.appDir,
@@ -1614,28 +1615,46 @@ async function prerenderStaticRoutes(options) {
                 define: options.define,
                 importPolicy,
                 navigationScripts,
-                request: new Request(`http://mreact.local${pathname}`),
+                request: new Request(`http://mreact.local${pathname}`, analysis.clientRoute
+                    ? undefined
+                    : { headers: { "x-mreact-prerender-variant-capture": "1" } }),
                 renderSignals,
                 serverModuleCacheVersion,
                 serverModules: serverModuleMap,
                 vitePlugins: options.vitePlugins,
             };
             const response = await renderAppRequest(renderOptions);
-            const html = await response.text();
+            const renderedHtml = await response.text();
             if (renderSignals.headerDependent() || isVisitorDependentResponse(response)) {
                 continue;
             }
-            const headers = {};
-            response.headers.forEach((value, key) => {
-                headers[key] = value;
-            });
+            let html = renderedHtml;
+            let navigationHtml = renderedHtml;
+            if (!analysis.clientRoute) {
+                const capture = prerenderVariantMarkerParts(route.path);
+                const start = renderedHtml.indexOf(capture.prefix);
+                const end = renderedHtml.lastIndexOf(capture.suffix);
+                if (start === -1 || end < start + capture.prefix.length) {
+                    throw new Error(`Failed to capture prerender response variants for ${pathname}.`);
+                }
+                const before = renderedHtml.slice(0, start);
+                const content = renderedHtml.slice(start + capture.prefix.length, end);
+                const after = renderedHtml.slice(end + capture.suffix.length);
+                const navigationMarker = routeMarkerParts(route.path);
+                html = `${before}${content}${after}`;
+                navigationHtml = `${before}${navigationMarker.prefix}${content}${navigationMarker.suffix}${after}`;
+            }
+            const headers = storedPrerenderedRouteHeaders(response.headers);
+            const strictTransportSecurity = renderSignals.strictTransportSecurity();
             entries.push([
                 pathname,
                 {
                     headers,
                     html,
+                    navigationHtml,
                     schemaVersion: PRERENDERED_ROUTE_SCHEMA_VERSION,
                     status: response.status,
+                    ...(strictTransportSecurity === undefined ? {} : { strictTransportSecurity }),
                 },
             ]);
         }
@@ -2532,6 +2551,7 @@ function cloudflarePageRouteFacadeModuleSource(componentImport) {
 const componentSlots = readComponentModuleExport(componentModule, "slots");
 const componentGenerateMetadata = readComponentModuleExport(componentModule, "generateMetadata");
 const componentMetadata = readComponentModuleExport(componentModule, "metadata");
+const componentSecurityHeadersApplied = readComponentModuleExport(componentModule, "__mreactSecurityHeadersApplied");
 
 export function App(props) {
   return renderCloudflareRouteComponent(props);
@@ -2546,6 +2566,7 @@ export const slots = componentSlots === undefined ? undefined : { ...componentSl
 export const generateMetadata =
   typeof componentGenerateMetadata === "function" ? componentGenerateMetadata : undefined;
 export const metadata = componentMetadata;
+export const __mreactSecurityHeadersApplied = componentSecurityHeadersApplied === true;
 
 function renderCloudflareRouteComponent(props) {
   const routeComponent = resolveCloudflareRouteComponent();
@@ -3115,7 +3136,9 @@ ${cloudflareShellRuntimeSource()}`;
     });
 }
 function cloudflareShellRuntimeSource() {
-    return `async function renderLayoutShells(shells, props, namedSlots) {
+    return `export const __mreactSecurityHeadersApplied = true;
+
+async function renderLayoutShells(shells, props, namedSlots) {
   const slotContext = { consumedSlots: new Set(), namedSlots };
   const rendered = [];
   for (const shell of shells) {
@@ -3194,7 +3217,7 @@ function cloudflareHydrationMarkerParts(props) {
   const escapedRouteId = escapeHtmlAttribute(routeId);
   const propsJson = escapeScriptJson(JSON.stringify({
     params: props.params,
-    request: { url: props.request.url },
+    request: { url: new URL(props.request.url).pathname },
     data: props.data,
   }));
   const clientReferencesJson = route.clientReferenceManifest === undefined || route.clientReferenceManifest.length === 0
@@ -3617,17 +3640,63 @@ function routeSecurityHeaders(security, request) {
   } else {
     headers["referrer-policy"] = validateHeaderValue(security?.referrerPolicy ?? "strict-origin-when-cross-origin");
   }
+  if (security?.permissionsPolicy === null) {
+    delete headers["permissions-policy"];
+  } else {
+    const permissionsPolicy = serializePermissionsPolicy(security?.permissionsPolicy);
+    if (permissionsPolicy === undefined) {
+      delete headers["permissions-policy"];
+    } else {
+      headers["permissions-policy"] = permissionsPolicy;
+    }
+  }
   if (security?.frameOptions === null) {
     delete headers["x-frame-options"];
   } else if (security?.frameOptions !== undefined) {
     headers["x-frame-options"] = validateHeaderValue(security.frameOptions);
   }
   if (request.url.startsWith("https://") && security?.hsts !== undefined && security.hsts !== false && security.hsts !== null) {
-    headers["strict-transport-security"] = \`max-age=\${Math.trunc(security.hsts.maxAge)}\${security.hsts.includeSubDomains === true ? "; includeSubDomains" : ""}\${security.hsts.preload === true ? "; preload" : ""}\`;
+    headers["strict-transport-security"] = serializeHsts(security.hsts);
   }
   return headers;
 }
 
+function serializeHsts(hsts) {
+  if (hsts === false) {
+    throw new TypeError("Invalid security header value for hsts.");
+  }
+  const maxAge = Math.trunc(hsts.maxAge);
+  if (!Number.isFinite(maxAge) || maxAge < 0) {
+    throw new TypeError("Invalid security header value for hsts.maxAge.");
+  }
+  const parts = [\`max-age=\${maxAge}\`];
+  if (hsts.includeSubDomains === true) {
+    parts.push("includeSubDomains");
+  }
+  if (hsts.preload === true) {
+    parts.push("preload");
+  }
+  return parts.join("; ");
+}
+
+function serializePermissionsPolicy(policy) {
+  if (policy === undefined) {
+    return "camera=(), microphone=(), geolocation=()";
+  }
+  const directives = [];
+  for (const [directive, allowlist] of Object.entries(policy)) {
+    if (allowlist === null || allowlist === undefined) {
+      continue;
+    }
+    validateToken(directive, "permissionsPolicy directive");
+    for (const value of allowlist) {
+      validatePermissionAllowlistValue(value);
+    }
+    directives.push(\`\${directive}=(\${allowlist.join(" ")})\`);
+  }
+  return directives.length === 0 ? undefined : directives.join(", ");
+}
+
 function validateHeaderValue(value) {
   for (let index = 0; index < value.length; index += 1) {
     const code = value.charCodeAt(index);
@@ -3638,6 +3707,22 @@ function validateHeaderValue(value) {
   return value;
 }
 
+function validateToken(value, label) {
+  if (!/^[A-Za-z][A-Za-z0-9-]*$/.test(value)) {
+    throw new TypeError(\`Invalid security header value for \${label}: \${JSON.stringify(value)}\`);
+  }
+}
+
+function validatePermissionAllowlistValue(value) {
+  if (value === "self" || value === "*" || /^[A-Za-z][A-Za-z0-9+.-]*:$/.test(value)) {
+    return;
+  }
+  if (/^https:\\/\\/[A-Za-z0-9.-]+(?::[0-9]+)?$/.test(value)) {
+    return;
+  }
+  throw new TypeError(\`Invalid security header value for permissionsPolicy allowlist: \${JSON.stringify(value)}\`);
+}
+
 function mergeRouteMetadata(metadata) {
   if (metadata.length === 0) {
     return undefined;
@@ -4359,6 +4444,7 @@ async function writeClientRouteBundles(options) {
                 clientNavigation: detectClientNavigationOverride(source) ??
                     (navigation || detectAnchorElementUsage(clientSource, route.file)),
                 routeMayUseOutOfOrderFragments: options.sourceAnalysis.byRouteFile.get(relative(options.projectRoot, route.file).split(sep).join("/"))?.streamRoute === true,
+                restoreRequestUrl: options.sourceAnalysis.byRouteFile.get(relative(options.projectRoot, route.file).split(sep).join("/"))?.usesRequestInput === true,
                 cacheDir: options.cacheDir,
                 dropConsoleFunctions: options.clientConsolePureFunctions,
                 filename: route.file,