@reckona/mreact-router 0.0.74 → 0.0.75

package/README.md

@@ -291,6 +291,8 @@ MREACT_ROUTER_LOG=requests mreact-router dev
 
 Each line includes method, path, status, duration, and runtime. Query strings, headers, and request bodies are intentionally omitted.
 
+Built Node output binds to `127.0.0.1` by default. Use `mreact-router start .mreact --host 0.0.0.0 --host-policy=strict` or `HOST=0.0.0.0 MREACT_ROUTER_HOST_POLICY=strict mreact-router start .mreact` inside containers behind explicit port publishing or a reverse proxy. This bind address is separate from Host header trust; configure `--allowed-hosts`, `MREACT_ROUTER_ALLOWED_HOSTS`, or `hostPolicy` for public deployments.
+
 Use `mreact-router --help`, `mreact-router help build`, or command-level help such as `mreact-router build --help` to inspect supported commands, build targets, and generated artifacts.
 
 Server-only pages can opt into the lightweight navigation runtime without becoming hydrated client routes:

package/dist/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAI5C,OAAO,EAGL,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EAG1B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA0BnD,OAAO,KAAK,EAAgB,UAAU,EAAE,MAAM,MAAM,CAAC;AAOrD,MAAM,WAAW,eAAgB,SAAQ,uBAAuB;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,CAAC;IACtD,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC;CACtD;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,QAAQ,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC;CACZ;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC;CACZ;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC1D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2BAA2B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oCAAoC,EAAE,CAAC,CAAC;IACrF,oBAAoB,CAAC,EAAE,0BAA0B,EAAE,CAAC;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,uBAAuB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,wBAAwB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,EAAE,QAAQ,EAAE,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oCAAoC;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,+BAA+B,CAAC;IAC3C,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,+BAA+B;IAC9C,kBAAkB,EAAE,OAAO,CAAC;IAC5B,WAAW,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC3C,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAID,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAiLhF;AA41ED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,yBAAyB,CAAC,CAgCpC"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAI5C,OAAO,EAGL,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EAG1B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA0BnD,OAAO,KAAK,EAAgB,UAAU,EAAE,MAAM,MAAM,CAAC;AAOrD,MAAM,WAAW,eAAgB,SAAQ,uBAAuB;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,CAAC;IACtD,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC;CACtD;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,QAAQ,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC;CACZ;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC;CACZ;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC1D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2BAA2B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oCAAoC,EAAE,CAAC,CAAC;IACrF,oBAAoB,CAAC,EAAE,0BAA0B,EAAE,CAAC;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,uBAAuB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,wBAAwB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,EAAE,QAAQ,EAAE,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oCAAoC;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,+BAA+B,CAAC;IAC3C,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,+BAA+B;IAC9C,kBAAkB,EAAE,OAAO,CAAC;IAC5B,WAAW,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC3C,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAID,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAiLhF;AA2+ED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,yBAAyB,CAAC,CAgCpC"}

package/dist/build.js

@@ -65,7 +65,7 @@ export async function buildApp(options) {
         routes,
         vitePlugins,
     });
-    const generatedImportPolicy = buildGeneratedImportPolicy({
+    const generatedImportPolicy = await buildGeneratedImportPolicy({
         files,
         projectRoot: project.projectRoot,
         routes,
@@ -257,15 +257,18 @@ const frameworkRuntimePackages = new Set([
     "@reckona/mreact-router",
     "@reckona/mreact-server",
 ]);
-function buildGeneratedImportPolicy(options) {
+const maxRuntimePackageManifestReads = 1000;
+async function buildGeneratedImportPolicy(options) {
     const routePackages = new Map();
     const allPackages = new Set();
     const relativeRoutesDir = relative(options.projectRoot, options.routesDir);
+    const packageJsonLookupCache = new Map();
     for (const route of options.routes) {
         const file = relative(options.projectRoot, route.file);
-        const packages = collectRuntimePackagesForFile({
+        const packages = await collectRuntimePackagesForFile({
             file,
             files: options.files,
+            packageJsonLookupCache,
             projectRoot: options.projectRoot,
             seen: new Set(),
         });
@@ -280,9 +283,10 @@ function buildGeneratedImportPolicy(options) {
         .map((file) => (relativeRoutesDir === "" ? file : `${relativeRoutesDir}/${file}`))
         .find((file) => options.files[file] !== undefined);
     if (middlewareFile !== undefined) {
-        const packages = collectRuntimePackagesForFile({
+        const packages = await collectRuntimePackagesForFile({
             file: middlewareFile,
             files: options.files,
+            packageJsonLookupCache,
             projectRoot: options.projectRoot,
             seen: new Set(),
         });
@@ -299,7 +303,7 @@ function buildGeneratedImportPolicy(options) {
         version: 1,
     };
 }
-function collectRuntimePackagesForFile(options) {
+async function collectRuntimePackagesForFile(options) {
     if (options.seen.has(options.file)) {
         return [];
     }
@@ -319,14 +323,22 @@ function collectRuntimePackagesForFile(options) {
         filename: join(options.projectRoot, options.file),
     })) {
         if (isRuntimePackageSpecifier(reference.source)) {
-            packages.add(runtimePackageNameForSpecifier(reference.source));
+            const packageName = runtimePackageNameForSpecifier(reference.source);
+            packages.add(packageName);
+            for (const optionalPackageName of await collectRuntimeOptionalPackages({
+                packageJsonLookupCache: options.packageJsonLookupCache,
+                packageName,
+                projectRoot: options.projectRoot,
+            })) {
+                packages.add(optionalPackageName);
+            }
             continue;
         }
         const localFile = resolveBuildLocalSourceImport(options.files, options.file, reference.source);
         if (localFile === undefined) {
             continue;
         }
-        for (const packageName of collectRuntimePackagesForFile({
+        for (const packageName of await collectRuntimePackagesForFile({
             ...options,
             file: localFile,
         })) {
@@ -336,12 +348,99 @@ function collectRuntimePackagesForFile(options) {
     options.seen.delete(options.file);
     return [...packages].sort();
 }
+async function collectRuntimeOptionalPackages(options) {
+    const optionalPackages = new Set();
+    const seenPackageJson = new Set();
+    const queue = [
+        { packageName: options.packageName, optional: false, startDir: options.projectRoot },
+    ];
+    for (let index = 0; index < queue.length && seenPackageJson.size < maxRuntimePackageManifestReads; index += 1) {
+        const item = queue[index];
+        if (item === undefined || !isValidRuntimePackageName(item.packageName)) {
+            continue;
+        }
+        const manifest = await readRuntimePackageManifest({
+            cache: options.packageJsonLookupCache,
+            packageName: item.packageName,
+            startDir: item.startDir,
+        });
+        if (manifest === undefined || seenPackageJson.has(manifest.packageJsonPath)) {
+            continue;
+        }
+        seenPackageJson.add(manifest.packageJsonPath);
+        if (item.optional && isRuntimePackageName(item.packageName)) {
+            optionalPackages.add(item.packageName);
+        }
+        const packageDir = dirname(manifest.packageJsonPath);
+        for (const dependencyName of Object.keys(manifest.dependencies ?? {})) {
+            if (isValidRuntimePackageName(dependencyName)) {
+                queue.push({ packageName: dependencyName, optional: false, startDir: packageDir });
+            }
+        }
+        for (const optionalDependencyName of Object.keys(manifest.optionalDependencies ?? {})) {
+            if (isValidRuntimePackageName(optionalDependencyName)) {
+                queue.push({ packageName: optionalDependencyName, optional: true, startDir: packageDir });
+            }
+        }
+    }
+    return [...optionalPackages].sort();
+}
+async function readRuntimePackageManifest(options) {
+    const key = `${options.startDir}\0${options.packageName}`;
+    const cached = options.cache.get(key);
+    const manifest = cached ??
+        findRuntimePackageJson(options.packageName, options.startDir).then(async (packageJsonPath) => {
+            if (packageJsonPath === undefined) {
+                return undefined;
+            }
+            try {
+                const json = JSON.parse(await readFile(packageJsonPath, "utf8"));
+                return { ...json, packageJsonPath };
+            }
+            catch {
+                return undefined;
+            }
+        });
+    if (cached === undefined) {
+        options.cache.set(key, manifest);
+    }
+    return (await manifest);
+}
+async function findRuntimePackageJson(packageName, startDir) {
+    if (!isValidRuntimePackageName(packageName)) {
+        return undefined;
+    }
+    let current = startDir;
+    while (true) {
+        const candidate = join(current, "node_modules", ...packageName.split("/"), "package.json");
+        try {
+            if ((await stat(candidate)).isFile()) {
+                return candidate;
+            }
+        }
+        catch {
+            // Keep walking toward the filesystem root.
+        }
+        const parent = dirname(current);
+        if (parent === current) {
+            return undefined;
+        }
+        current = parent;
+    }
+}
 function isRuntimePackageSpecifier(specifier) {
     if (specifier.startsWith(".") || specifier.startsWith("/") || /^[A-Za-z][A-Za-z0-9+.-]*:/.test(specifier)) {
         return false;
     }
     const packageName = runtimePackageNameForSpecifier(specifier);
-    return !nodeBuiltinPackages.has(specifier) && !frameworkRuntimePackages.has(packageName);
+    return !nodeBuiltinPackages.has(specifier) && isRuntimePackageName(packageName);
+}
+function isRuntimePackageName(packageName) {
+    return !frameworkRuntimePackages.has(packageName);
+}
+function isValidRuntimePackageName(packageName) {
+    return (/^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/u.test(packageName) &&
+        !packageName.includes(".."));
 }
 function runtimePackageNameForSpecifier(specifier) {
     if (!specifier.startsWith("@")) {