@reckona/mreact-router 0.0.73 → 0.0.75

package/src/build.ts

@@ -4,7 +4,6 @@ import { copyFile, cp, mkdir, readdir, readFile, rm, stat, writeFile } from "nod
 import { builtinModules } from "node:module";
 import { dirname, join, relative, sep } from "node:path";
 import {
-  collectFormActionReferenceNames,
   collectStaticImportReferences,
   collectTopLevelValueExportNames,
   formatDiagnostic,
@@ -56,6 +55,7 @@ import {
   routeClosureMayUseAwaitBoundary,
   stripRouteBuildExports,
   stripRouteClientOnlyExports,
+  stripRouteClientSource,
   stripRouteLoaderOnlyExports,
   stripRouteMetadataOnlyExports,
   stripRouteRequestOnlyExports,
@@ -67,6 +67,7 @@ import {
 import { collectRouteCssFiles } from "./route-styles.js";
 import { existingRouteShellCandidates } from "./route-shells.js";
 import { sourceModuleCandidates } from "./source-modules.js";
+import { collectBuildInferredServerActions } from "./server-action-inference.js";
 import { workspacePackageFile } from "./workspace-packages.js";
 import type { PluginOption, UserConfig } from "vite";
 
@@ -112,6 +113,7 @@ export interface BuiltServerManifest {
   prerenderedRoutes?: Record<string, BuiltPrerenderedRoute>;
   publicAssetBaseUrl?: string;
   routesDir?: string;
+  routeServerActionReferences?: Record<string, BuiltServerActionExpressionReference[]>;
   serverActionManifest?: BuiltServerActionReference[];
   serverModuleFiles?: Record<string, string>;
   serverModuleRenderFiles?: Record<string, string>;
@@ -126,6 +128,18 @@ export interface BuiltServerActionReference {
   moduleId: string;
 }
 
+export interface BuiltServerActionExpressionReference {
+  end: number;
+  exportName: string;
+  expression: string;
+  expressionEnd: number;
+  expressionStart: number;
+  inferred: boolean;
+  moduleId: string;
+  sourceHash: string;
+  start: number;
+}
+
 export interface BuiltServerModuleArtifact {
   analysis?: BuiltRouteSourceAnalysisSummary;
   loader?: BuiltServerModuleOutput;
@@ -200,7 +214,7 @@ export async function buildApp(options: BuildAppOptions): Promise<BuildAppResult
     ...new Set([...(await collectPublicAssetPaths(project.publicDir)), ...appConventionPublicAssets]),
   ].sort();
 
-  const serverActionManifest = collectBuildServerActionManifest({
+  const serverActionManifest = await collectBuildServerActionManifest({
     files,
     projectRoot: project.projectRoot,
     routes,
@@ -216,7 +230,7 @@ export async function buildApp(options: BuildAppOptions): Promise<BuildAppResult
     routes,
     vitePlugins,
   });
-  const generatedImportPolicy = buildGeneratedImportPolicy({
+  const generatedImportPolicy = await buildGeneratedImportPolicy({
     files,
     projectRoot: project.projectRoot,
     routes,
@@ -274,6 +288,11 @@ export async function buildApp(options: BuildAppOptions): Promise<BuildAppResult
     });
   }
 
+  const routeServerActionReferences = Object.fromEntries(
+    [...serverActionManifest.routeReferences.entries()].sort(([left], [right]) =>
+      left.localeCompare(right),
+    ),
+  );
   const serverManifest = {
     allowedSourceDirs: project.allowedSourceDirs.map((directory) =>
       relative(project.projectRoot, directory),
@@ -287,7 +306,12 @@ export async function buildApp(options: BuildAppOptions): Promise<BuildAppResult
     ...(project.publicAssetBaseUrl === undefined
       ? {}
       : { publicAssetBaseUrl: project.publicAssetBaseUrl }),
-    ...(serverActionManifest.length === 0 ? {} : { serverActionManifest }),
+    ...(Object.keys(routeServerActionReferences).length === 0
+      ? {}
+      : { routeServerActionReferences }),
+    ...(serverActionManifest.allowedActions.length === 0
+      ? {}
+      : { serverActionManifest: serverActionManifest.allowedActions }),
     ...(Object.keys(serverModuleArtifacts.files).length === 0
       ? {}
       : { serverModuleFiles: serverModuleArtifacts.files }),
@@ -461,22 +485,28 @@ const frameworkRuntimePackages = new Set([
   "@reckona/mreact-router",
   "@reckona/mreact-server",
 ]);
+const maxRuntimePackageManifestReads = 1000;
 
-function buildGeneratedImportPolicy(options: {
+async function buildGeneratedImportPolicy(options: {
   files: Record<string, string>;
   projectRoot: string;
   routes: readonly AppRoute[];
   routesDir: string;
-}): BuiltImportPolicyArtifact {
+}): Promise<BuiltImportPolicyArtifact> {
   const routePackages = new Map<string, string[]>();
   const allPackages = new Set<string>();
   const relativeRoutesDir = relative(options.projectRoot, options.routesDir);
+  const packageJsonLookupCache = new Map<
+    string,
+    Promise<(RuntimePackageManifest & { packageJsonPath: string }) | undefined>
+  >();
 
   for (const route of options.routes) {
     const file = relative(options.projectRoot, route.file);
-    const packages = collectRuntimePackagesForFile({
+    const packages = await collectRuntimePackagesForFile({
       file,
       files: options.files,
+      packageJsonLookupCache,
       projectRoot: options.projectRoot,
       seen: new Set(),
     });
@@ -494,9 +524,10 @@ function buildGeneratedImportPolicy(options: {
     .find((file) => options.files[file] !== undefined);
 
   if (middlewareFile !== undefined) {
-    const packages = collectRuntimePackagesForFile({
+    const packages = await collectRuntimePackagesForFile({
       file: middlewareFile,
       files: options.files,
+      packageJsonLookupCache,
       projectRoot: options.projectRoot,
       seen: new Set(),
     });
@@ -518,12 +549,13 @@ function buildGeneratedImportPolicy(options: {
   };
 }
 
-function collectRuntimePackagesForFile(options: {
+async function collectRuntimePackagesForFile(options: {
   file: string;
   files: Record<string, string>;
+  packageJsonLookupCache: RuntimePackageManifestCache;
   projectRoot: string;
   seen: Set<string>;
-}): string[] {
+}): Promise<string[]> {
   if (options.seen.has(options.file)) {
     return [];
   }
@@ -548,7 +580,15 @@ function collectRuntimePackagesForFile(options: {
     filename: join(options.projectRoot, options.file),
   })) {
     if (isRuntimePackageSpecifier(reference.source)) {
-      packages.add(runtimePackageNameForSpecifier(reference.source));
+      const packageName = runtimePackageNameForSpecifier(reference.source);
+      packages.add(packageName);
+      for (const optionalPackageName of await collectRuntimeOptionalPackages({
+        packageJsonLookupCache: options.packageJsonLookupCache,
+        packageName,
+        projectRoot: options.projectRoot,
+      })) {
+        packages.add(optionalPackageName);
+      }
       continue;
     }
 
@@ -557,7 +597,7 @@ function collectRuntimePackagesForFile(options: {
       continue;
     }
 
-    for (const packageName of collectRuntimePackagesForFile({
+    for (const packageName of await collectRuntimePackagesForFile({
       ...options,
       file: localFile,
     })) {
@@ -570,13 +610,140 @@ function collectRuntimePackagesForFile(options: {
   return [...packages].sort();
 }
 
+interface RuntimePackageManifest {
+  dependencies?: Record<string, unknown> | undefined;
+  optionalDependencies?: Record<string, unknown> | undefined;
+}
+
+type RuntimePackageManifestCache = Map<
+  string,
+  Promise<(RuntimePackageManifest & { packageJsonPath: string }) | undefined>
+>;
+
+async function collectRuntimeOptionalPackages(options: {
+  packageJsonLookupCache: RuntimePackageManifestCache;
+  packageName: string;
+  projectRoot: string;
+}): Promise<string[]> {
+  const optionalPackages = new Set<string>();
+  const seenPackageJson = new Set<string>();
+  const queue: Array<{ packageName: string; optional: boolean; startDir: string }> = [
+    { packageName: options.packageName, optional: false, startDir: options.projectRoot },
+  ];
+
+  for (let index = 0; index < queue.length && seenPackageJson.size < maxRuntimePackageManifestReads; index += 1) {
+    const item = queue[index];
+    if (item === undefined || !isValidRuntimePackageName(item.packageName)) {
+      continue;
+    }
+
+    const manifest = await readRuntimePackageManifest({
+      cache: options.packageJsonLookupCache,
+      packageName: item.packageName,
+      startDir: item.startDir,
+    });
+
+    if (manifest === undefined || seenPackageJson.has(manifest.packageJsonPath)) {
+      continue;
+    }
+
+    seenPackageJson.add(manifest.packageJsonPath);
+    if (item.optional && isRuntimePackageName(item.packageName)) {
+      optionalPackages.add(item.packageName);
+    }
+
+    const packageDir = dirname(manifest.packageJsonPath);
+    for (const dependencyName of Object.keys(manifest.dependencies ?? {})) {
+      if (isValidRuntimePackageName(dependencyName)) {
+        queue.push({ packageName: dependencyName, optional: false, startDir: packageDir });
+      }
+    }
+
+    for (const optionalDependencyName of Object.keys(manifest.optionalDependencies ?? {})) {
+      if (isValidRuntimePackageName(optionalDependencyName)) {
+        queue.push({ packageName: optionalDependencyName, optional: true, startDir: packageDir });
+      }
+    }
+  }
+
+  return [...optionalPackages].sort();
+}
+
+async function readRuntimePackageManifest(options: {
+  cache: RuntimePackageManifestCache;
+  packageName: string;
+  startDir: string;
+}): Promise<(RuntimePackageManifest & { packageJsonPath: string }) | undefined> {
+  const key = `${options.startDir}\0${options.packageName}`;
+  const cached = options.cache.get(key);
+  const manifest =
+    cached ??
+    findRuntimePackageJson(options.packageName, options.startDir).then(async (packageJsonPath) => {
+      if (packageJsonPath === undefined) {
+        return undefined;
+      }
+
+      try {
+        const json = JSON.parse(await readFile(packageJsonPath, "utf8")) as RuntimePackageManifest;
+        return { ...json, packageJsonPath };
+      } catch {
+        return undefined;
+      }
+    });
+
+  if (cached === undefined) {
+    options.cache.set(key, manifest);
+  }
+
+  return (await manifest) as (RuntimePackageManifest & { packageJsonPath: string }) | undefined;
+}
+
+async function findRuntimePackageJson(
+  packageName: string,
+  startDir: string,
+): Promise<string | undefined> {
+  if (!isValidRuntimePackageName(packageName)) {
+    return undefined;
+  }
+
+  let current = startDir;
+
+  while (true) {
+    const candidate = join(current, "node_modules", ...packageName.split("/"), "package.json");
+    try {
+      if ((await stat(candidate)).isFile()) {
+        return candidate;
+      }
+    } catch {
+      // Keep walking toward the filesystem root.
+    }
+
+    const parent = dirname(current);
+    if (parent === current) {
+      return undefined;
+    }
+    current = parent;
+  }
+}
+
 function isRuntimePackageSpecifier(specifier: string): boolean {
   if (specifier.startsWith(".") || specifier.startsWith("/") || /^[A-Za-z][A-Za-z0-9+.-]*:/.test(specifier)) {
     return false;
   }
 
   const packageName = runtimePackageNameForSpecifier(specifier);
-  return !nodeBuiltinPackages.has(specifier) && !frameworkRuntimePackages.has(packageName);
+  return !nodeBuiltinPackages.has(specifier) && isRuntimePackageName(packageName);
+}
+
+function isRuntimePackageName(packageName: string): boolean {
+  return !frameworkRuntimePackages.has(packageName);
+}
+
+function isValidRuntimePackageName(packageName: string): boolean {
+  return (
+    /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/u.test(packageName) &&
+    !packageName.includes("..")
+  );
 }
 
 function runtimePackageNameForSpecifier(specifier: string): string {
@@ -588,13 +755,17 @@ function runtimePackageNameForSpecifier(specifier: string): string {
   return scope !== undefined && name !== undefined ? `${scope}/${name}` : specifier;
 }
 
-function collectBuildServerActionManifest(options: {
+async function collectBuildServerActionManifest(options: {
   files: Record<string, string>;
   projectRoot: string;
   routes: readonly AppRoute[];
   routesDir: string;
-}): BuiltServerActionReference[] {
+}): Promise<{
+  allowedActions: BuiltServerActionReference[];
+  routeReferences: Map<string, BuiltServerActionExpressionReference[]>;
+}> {
   const entries = new Map<string, BuiltServerActionReference>();
+  const routeReferences = new Map<string, BuiltServerActionExpressionReference[]>();
   const relativeRoutesDir = relative(options.projectRoot, options.routesDir);
   const routeSourceFiles = new Set(
     options.routes
@@ -616,26 +787,41 @@ function collectBuildServerActionManifest(options: {
     }
 
     if (routeSourceFiles.has(file)) {
-      for (const reference of collectBuildInferredServerActionReferences({
+      const inference = await collectBuildInferredServerActionReferences({
         file,
         files: options.files,
         relativeRoutesDir,
         source: code,
-      })) {
+      });
+
+      for (const diagnostic of inference.diagnostics) {
+        console.warn(formatServerActionInferenceDiagnostic(diagnostic));
+      }
+
+      routeReferences.set(file, inference.references);
+
+      for (const reference of inference.references) {
         const key = `${reference.moduleId}#${reference.exportName}`;
 
         if (!entries.has(key)) {
-          entries.set(key, reference);
+          entries.set(key, {
+            exportName: reference.exportName,
+            inferred: reference.inferred,
+            moduleId: reference.moduleId,
+          });
         }
       }
     }
   }
 
-  return [...entries.values()].sort((left, right) =>
-    left.moduleId === right.moduleId
-      ? left.exportName.localeCompare(right.exportName)
-      : left.moduleId.localeCompare(right.moduleId),
-  );
+  return {
+    allowedActions: [...entries.values()].sort((left, right) =>
+      left.moduleId === right.moduleId
+        ? left.exportName.localeCompare(right.exportName)
+        : left.moduleId.localeCompare(right.moduleId),
+    ),
+    routeReferences,
+  };
 }
 
 function collectBuildInferredServerActionReferences(options: {
@@ -643,54 +829,25 @@ function collectBuildInferredServerActionReferences(options: {
   files: Record<string, string>;
   relativeRoutesDir: string;
   source: string;
-}): BuiltServerActionReference[] {
-  const actionNames = collectFormActionNames(options.source);
-
-  if (actionNames.size === 0) {
-    return [];
-  }
-
-  const references: BuiltServerActionReference[] = [];
-
-  for (const match of options.source.matchAll(
-    /^import\s+\{\s*(?<specifiers>[^}]+)\s*\}\s+from\s+["'](?<source>[^"']+)["'];?/gm,
-  )) {
-    const source = match.groups?.source;
-    const specifiers = match.groups?.specifiers;
-
-    if (source === undefined || specifiers === undefined || !source.startsWith(".")) {
-      continue;
-    }
-
-    const localFile = resolveBuildLocalSourceImport(options.files, options.file, source);
-
-    if (localFile === undefined) {
-      continue;
-    }
-
-    const moduleId = moduleIdForBuildFile(localFile, options.relativeRoutesDir);
-
-    for (const specifier of specifiers.split(",")) {
-      const [exportName, localName] = specifier.trim().split(/\s+as\s+/);
-      const imported = exportName?.trim();
-      const local = localName?.trim() ?? imported;
-
-      if (
-        imported !== undefined &&
-        imported.length > 0 &&
-        local !== undefined &&
-        actionNames.has(local)
-      ) {
-        references.push({ moduleId, exportName: imported, inferred: true });
-      }
-    }
-  }
-
-  return references;
+}): Promise<{
+  diagnostics: { code: string; message: string }[];
+  references: BuiltServerActionExpressionReference[];
+}> {
+  return collectBuildInferredServerActions({
+    file: options.file,
+    files: options.files,
+    relativeRoutesDir: options.relativeRoutesDir,
+    resolveSourceImport: (importer, source) =>
+      resolveBuildLocalSourceImport(options.files, importer, source),
+    source: options.source,
+  });
 }
 
-function collectFormActionNames(code: string): Set<string> {
-  return new Set(collectFormActionReferenceNames({ code }));
+function formatServerActionInferenceDiagnostic(diagnostic: {
+  code: string;
+  message: string;
+}): string {
+  return `${diagnostic.code}: ${diagnostic.message}`;
 }
 
 function isSourceModuleFile(file: string): boolean {
@@ -1038,7 +1195,10 @@ async function buildServerModuleArtifacts(options: {
     const clientInference = await inferClientRouteModule({
       ...(route === undefined ? {} : { appDir: options.project.routesDir }),
       cache: options.clientRouteInferenceCache,
-      code: stripRouteClientOnlyExports(source),
+      code:
+        route === undefined
+          ? stripRouteClientOnlyExports(source)
+          : stripRouteClientSource({ code: source, filename: route.file }),
       filename: join(options.projectRoot, file),
       ...(route === undefined ? {} : { routePath: route.path }),
       vitePlugins: options.vitePlugins,
@@ -2467,7 +2627,7 @@ async function writeClientRouteBundles(options: {
         vitePlugins: options.vitePlugins,
       });
       const source = await readFile(route.file, "utf8");
-      const clientSource = stripRouteClientOnlyExports(source);
+      const clientSource = stripRouteClientSource({ code: source, filename: route.file });
       const navigation = detectNavigationRuntimeHint(source);
       const references = await collectClientRouteReferences({
         appDir: options.appDir,

package/src/cli-options.ts

@@ -3,6 +3,7 @@ import type {
   AppRouterBuildTarget,
   AppRouterClientSourceMapMode,
 } from "./config.js";
+import type { RequestHostPolicy } from "./serve.js";
 
 export type CliRequestLogMode = "requests";
 export type CliBuildTarget = AppRouterBuildTarget | "all";
@@ -10,8 +11,11 @@ export type CliBuildTarget = AppRouterBuildTarget | "all";
 export interface ParsedCliArguments {
   clientSourceMaps?: AppRouterClientSourceMapMode | undefined;
   command: string;
+  allowedHosts?: readonly string[] | undefined;
   from?: string | undefined;
   help?: boolean | undefined;
+  host?: string | undefined;
+  hostPolicy?: RequestHostPolicy | undefined;
   log?: CliRequestLogMode | undefined;
   out?: string | undefined;
   routeArg?: string | undefined;
@@ -43,6 +47,39 @@ export function parseCliArguments(argv: readonly string[]): ParsedCliArguments {
       continue;
     }
 
+    if (value === "--host") {
+      parsed.host = readOptionValue(argv, index, "host");
+      index += 1;
+      continue;
+    }
+
+    if (value.startsWith("--host=")) {
+      parsed.host = value.slice("--host=".length);
+      continue;
+    }
+
+    if (value === "--host-policy") {
+      parsed.hostPolicy = parseCliHostPolicy(readOptionValue(argv, index, "host-policy"));
+      index += 1;
+      continue;
+    }
+
+    if (value.startsWith("--host-policy=")) {
+      parsed.hostPolicy = parseCliHostPolicy(value.slice("--host-policy=".length));
+      continue;
+    }
+
+    if (value === "--allowed-hosts") {
+      parsed.allowedHosts = parseCliAllowedHosts(readOptionValue(argv, index, "allowed-hosts"));
+      index += 1;
+      continue;
+    }
+
+    if (value.startsWith("--allowed-hosts=")) {
+      parsed.allowedHosts = parseCliAllowedHosts(value.slice("--allowed-hosts=".length));
+      continue;
+    }
+
     if (value === "--from") {
       parsed.from = readOptionValue(argv, index, "from");
       index += 1;
@@ -155,8 +192,21 @@ export function formatCliHelp(command?: string | undefined): string {
       "Serve built mreact app router output with the Node adapter.",
       "",
       "Options:",
+      "  --host <host>  Bind address. Default: 127.0.0.1. Use 0.0.0.0 inside containers behind explicit port publishing or a reverse proxy.",
+      "  --host-policy=strict|trusted-proxy",
+      "      Control Host header trust for request origin reconstruction.",
+      "  --allowed-hosts <host[,host...]>",
+      "      Exact Host header allow-list for public deployments.",
       "  --log=requests  Print request summaries.",
       "  -h, --help      Show this help message.",
+      "",
+      "Environment:",
+      "  HOST            Bind address when --host is not set.",
+      "  MREACT_ROUTER_HOST_POLICY",
+      "                  Host header trust policy when --host-policy is not set.",
+      "  MREACT_ROUTER_ALLOWED_HOSTS",
+      "                  Comma-separated Host header allow-list when --allowed-hosts is not set.",
+      "  PORT            TCP port. Default: 3001.",
     ].join("\n");
   }
 
@@ -222,6 +272,42 @@ export function resolveCliRequestLogMode(
   return parseCliRequestLogMode(envValue);
 }
 
+export function resolveCliHost(
+  flagValue: string | undefined,
+  env: { HOST?: string | undefined },
+): string {
+  if (flagValue !== undefined && flagValue !== "") {
+    return flagValue;
+  }
+
+  const envValue = env.HOST;
+  return envValue === undefined || envValue === "" ? "127.0.0.1" : envValue;
+}
+
+export function resolveCliHostPolicy(
+  flagValue: RequestHostPolicy | undefined,
+  env: { MREACT_ROUTER_HOST_POLICY?: string | undefined },
+): RequestHostPolicy | undefined {
+  if (flagValue !== undefined) {
+    return flagValue;
+  }
+
+  const envValue = env.MREACT_ROUTER_HOST_POLICY;
+  return envValue === undefined || envValue === "" ? undefined : parseCliHostPolicy(envValue);
+}
+
+export function resolveCliAllowedHosts(
+  flagValue: readonly string[] | undefined,
+  env: { MREACT_ROUTER_ALLOWED_HOSTS?: string | undefined },
+): readonly string[] | undefined {
+  if (flagValue !== undefined) {
+    return flagValue;
+  }
+
+  const envValue = env.MREACT_ROUTER_ALLOWED_HOSTS;
+  return envValue === undefined || envValue === "" ? undefined : parseCliAllowedHosts(envValue);
+}
+
 export function createCliRequestLogger(): AppRouterLogger {
   return {
     error(event) {
@@ -245,6 +331,23 @@ function parseCliRequestLogMode(value: string): CliRequestLogMode {
   throw new Error(`Unsupported log mode ${JSON.stringify(value)}. Expected "requests".`);
 }
 
+function parseCliHostPolicy(value: string): RequestHostPolicy {
+  if (value === "strict" || value === "trusted-proxy") {
+    return value;
+  }
+
+  throw new Error(
+    `Unsupported host policy ${JSON.stringify(value)}. Expected "strict" or "trusted-proxy".`,
+  );
+}
+
+function parseCliAllowedHosts(value: string): readonly string[] {
+  return value
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter((entry) => entry !== "");
+}
+
 function parseCliBuildTarget(value: string): CliBuildTarget {
   if (value === "node" || value === "cloudflare" || value === "aws-lambda" || value === "all") {
     return value;

package/src/cli.ts

@@ -7,6 +7,9 @@ import {
   createCliRequestLogger,
   formatCliHelp,
   parseCliArguments,
+  resolveCliAllowedHosts,
+  resolveCliHost,
+  resolveCliHostPolicy,
   resolveCliRequestLogMode,
 } from "./cli-options.js";
 import { startDevServer } from "./dev-server.js";
@@ -77,6 +80,9 @@ if (parsed !== undefined) {
         console.log(`mreact app router ready at ${server.url}`);
       } else if (command === "start") {
         const server = await startServer({
+          allowedHosts: resolveCliAllowedHosts(parsed.allowedHosts, process.env),
+          hostPolicy: resolveCliHostPolicy(parsed.hostPolicy, process.env),
+          hostname: resolveCliHost(parsed.host, process.env),
           logger,
           outDir: resolve(routeArg ?? ".mreact"),
           port: Number(process.env.PORT ?? 3001),