@ressjs/vite-router 0.5.2 → 0.6.0-rc.0

package/dist/head/types.d.ts

@@ -0,0 +1,44 @@
+import type { CollectedHeadTag, HeadAttributes } from '@ressjs/assets';
+import type { PageRenderingConfig } from '../isr/types';
+export type { CollectedHeadTag, HeadAttributes, HeadProps, HeadTagName } from '@ressjs/assets';
+export interface PageHeadConfig {
+    title?: string;
+    robots?: RobotsConfig;
+    meta?: HeadAttributes[];
+    link?: HeadAttributes[];
+    script?: Array<HeadAttributes & {
+        content?: string;
+    }>;
+    style?: Array<HeadAttributes & {
+        content: string;
+    }>;
+    base?: HeadAttributes;
+    noscript?: Array<{
+        content: string;
+    }>;
+}
+export interface PageConfigVariant {
+    head?: PageHeadConfig;
+    htmlAttributes?: HeadAttributes;
+    bodyAttributes?: HeadAttributes;
+}
+export interface PageConfig extends PageConfigVariant, PageRenderingConfig {
+    /** Overrides selected per request with the same platform vocabulary as page assets. */
+    variants?: Record<string, PageConfigVariant>;
+}
+export type { PageRenderingConfig, RenderingMode } from '../isr/types';
+export type RobotsConfig = string | {
+    index?: boolean;
+    follow?: boolean;
+    noarchive?: boolean;
+    nosnippet?: boolean;
+    noimageindex?: boolean;
+    notranslate?: boolean;
+};
+export interface ResolvedPageHead {
+    tags: CollectedHeadTag[];
+    htmlAttributes: HeadAttributes;
+    bodyAttributes: HeadAttributes;
+    /** Effective robots directive after pageConfig and <Head> have been merged. */
+    robots?: string;
+}

package/dist/head/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/helpers/html-generator.d.ts

@@ -1,14 +1,34 @@
-import { PlatformInfo } from '../platform';
+import { type PlatformInfo } from '../platform';
+import { type SecurityContext } from '../security';
+import type { AssetIndex, VariantCatalog } from '../variants/types';
+import type { ResolvedPageHead } from '../head/types';
+export { resolvePageAssets } from '@ressjs/assets';
+/**
+ * Qué archivos servirle a esta plataforma: elige la variante y busca sus artefactos.
+ *
+ * Son dos consultas en memoria. El catálogo ya está armado y los artefactos ya
+ * están indexados desde que arrancó el servidor, así que servir una página no
+ * toca el sistema de archivos ni escribe nada.
+ *
+ * Si la variante elegida no tiene artefactos construidos, responde los de la
+ * base antes que no responder nada.
+ */
 export interface HTMLGenerationContext {
     template: string;
     rendered: any;
     page: any;
-    manifest: any;
     platform: string;
     isProduction: boolean;
     platformInfo: PlatformInfo | null;
-    serverSideResult?: any;
+    pageHead?: ResolvedPageHead;
+    catalog?: VariantCatalog;
+    assets?: AssetIndex;
+    /** Request-scoped links prepared before rendering (and overridable by middleware). */
+    styles?: {
+        js: string;
+        css: string[];
+    };
+    /** `false`: HTML y CSS, sin script de entrada ni estado para el navegador. */
+    hydrate?: boolean;
 }
-export declare function generateClientScript(pageFile: string, platformInfo: PlatformInfo | null, manifest: any, isProduction: boolean): Promise<string | null>;
-export declare function generateClientCSS(pageFile: string, platformInfo: PlatformInfo | null, manifest: any, isProduction: boolean): string;
-export declare function generateCompleteHTML(context: HTMLGenerationContext): Promise<string>;
+export declare function generateCompleteHTML(context: HTMLGenerationContext, security?: SecurityContext): Promise<string>;

package/dist/helpers/html-generator.js

@@ -1,146 +1,104 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateClientScript = generateClientScript;
-exports.generateClientCSS = generateClientCSS;
+exports.resolvePageAssets = void 0;
 exports.generateCompleteHTML = generateCompleteHTML;
-const promises_1 = __importDefault(require("node:fs/promises"));
-async function generateClientScript(pageFile, platformInfo, manifest, isProduction) {
-    // Sanitizar nombre: convertir [id] a _id_ para nombres de archivo (igual que en pages.ts)
-    const rel = pageFile
-        .replace(/^app\/pages\//, '')
-        .replace(/\.tsx$|\.jsx$/, '')
-        .replace(/\//g, '__')
-        .replace(/\[([^\]]+)\]/g, '_$1_');
-    let entryKey = `${rel}__entry-client.tsx`;
-    if (platformInfo && platformInfo.device !== 'desktop') {
-        // Priority order (from highest to lowest):
-        const priorities = [
-            // 1. Specific: device.os.tsx
-            `${rel}__entry-client.${platformInfo.device}.${platformInfo.os}.tsx`,
-            // 2. DeviceType: device.tsx
-            `${rel}__entry-client.${platformInfo.device}.tsx`,
-            // 3. Mobile Fallback: mobile.tsx (only for phone/tablet)
-            ...(platformInfo.device === 'phone' || platformInfo.device === 'tablet'
-                ? [`${rel}__entry-client.mobile.tsx`]
-                : []),
-            // 4. OS General: os.tsx
-            `${rel}__entry-client.${platformInfo.os}.tsx`
-        ];
-        // Find first existing entry following priority order
-        for (const candidate of priorities) {
-            if (isProduction) {
-                // In production, check manifest
-                const manifestKey = `dist/.entries/${candidate}`;
-                if (manifest[manifestKey]) {
-                    entryKey = candidate;
-                    break;
-                }
-            }
-            else {
-                // In development, check if physical file exists
-                try {
-                    await promises_1.default.access(`dist/.entries/${candidate}`);
-                    entryKey = candidate;
-                    break;
-                }
-                catch {
-                    // File doesn't exist, continue to next priority
-                }
-            }
-        }
-    }
-    if (!isProduction) {
-        return `/dist/.entries/${entryKey}`;
-    }
-    else {
-        const chunk = manifest[`dist/.entries/${entryKey}`];
-        return chunk ? `/${chunk.file}` : null;
-    }
+const platform_1 = require("../platform");
+const security_1 = require("../security");
+const assets_1 = require("@ressjs/assets");
+var assets_2 = require("@ressjs/assets");
+Object.defineProperty(exports, "resolvePageAssets", { enumerable: true, get: function () { return assets_2.resolvePageAssets; } });
+/**
+ * Plataforma que se asume cuando la detección está desactivada.
+ *
+ * Es la misma que produce el pipeline cuando nadie declaró nada, de modo que
+ * apagar la detección y recibir una petición anónima den el mismo resultado.
+ */
+function fallbackPlatform() {
+    return platform_1.DEFAULT_PLATFORM;
 }
-function generateClientCSS(pageFile, platformInfo, manifest, isProduction) {
-    if (!isProduction || !pageFile) {
-        return '';
-    }
-    // Sanitizar nombre: convertir [id] a _id_ para nombres de archivo (igual que en pages.ts)
-    const rel = pageFile
-        .replace(/^app\/pages\//, '')
-        .replace(/\.tsx$|\.jsx$/, '')
-        .replace(/\//g, '__')
-        .replace(/\[([^\]]+)\]/g, '_$1_');
-    let entryKey = `dist/.entries/${rel}__entry-client.tsx`;
-    if (platformInfo && platformInfo.device !== 'desktop') {
-        // Priority order (from highest to lowest):
-        const priorities = [
-            // 1. Specific: device.os.tsx
-            `dist/.entries/${rel}__entry-client.${platformInfo.device}.${platformInfo.os}.tsx`,
-            // 2. DeviceType: device.tsx
-            `dist/.entries/${rel}__entry-client.${platformInfo.device}.tsx`,
-            // 3. Mobile Fallback: mobile.tsx (only for phone/tablet)
-            ...(platformInfo.device === 'phone' || platformInfo.device === 'tablet'
-                ? [`dist/.entries/${rel}__entry-client.mobile.tsx`]
-                : []),
-            // 4. OS General: os.tsx
-            `dist/.entries/${rel}__entry-client.${platformInfo.os}.tsx`
-        ];
-        // Find first existing entry following priority order
-        for (const candidate of priorities) {
-            if (manifest[candidate]) {
-                entryKey = candidate;
-                break;
-            }
-        }
-    }
-    const entryChunk = manifest[entryKey];
-    if (entryChunk && entryChunk.css) {
-        return entryChunk.css.map((cssFile) => `<link rel="stylesheet" href="/${cssFile}">`).join('');
+async function generateCompleteHTML(context, security) {
+    const { template, rendered, page, platformInfo, pageHead, catalog, assets, hydrate = true } = context;
+    const ctx = security ?? {
+        isProduction: context.isProduction,
+        options: (0, security_1.resolveSecurityOptions)(),
+        route: page?.route ?? '',
+    };
+    const escapeCtx = { where: '', isProduction: ctx.isProduction, route: ctx.route };
+    const nonce = ctx.nonce;
+    const platform = platformInfo ?? fallbackPlatform();
+    const resolved = context.styles ?? (catalog && assets && page?.pageId
+        ? (0, assets_1.resolvePageAssets)(page.pageId, platform, catalog, assets)
+        : { js: '', css: [] });
+    const scriptTag = hydrate && resolved.js
+        ? `<script type="module"${nonceAttr(nonce)} src="${(0, security_1.escapeAttrValue)(resolved.js)}"></script>`
+        : '';
+    const cssLinks = resolved.css
+        .map((href) => `<link rel="stylesheet" href="${(0, security_1.escapeAttrValue)(href)}">`)
+        .join('');
+    const pageTags = pageHead?.tags.length
+        ? (0, security_1.renderHeadTags)(pageHead.tags.map((tag) => ({ tag: tag.type, attrs: tag.attrs, children: tag.content })), escapeCtx, {
+            // Page head declarations are application source, like the hydration
+            // script itself. CSP still controls whether inline code executes.
+            allowScriptTags: ctx.options.head.allowScriptTags,
+            extraAllowlist: ['noscript', ...ctx.options.head.extraTagAllowlist],
+            nonce,
+        })
+        : '';
+    const headContent = [cssLinks, pageTags].filter(Boolean).join('\n');
+    // La plataforma sólo se escribe si la página varía por algo. Si no varía, el
+    // documento tiene que ser idéntico para todos —es lo que lo hace cacheable— y
+    // el cliente la detecta por su cuenta.
+    const varies = (ctx.varyBy?.length ?? 0) > 0;
+    const platformTravels = ctx.options.serializePlatform === 'always' ||
+        (ctx.options.serializePlatform === 'auto' && varies);
+    // El estado que viaja. `__RESS_PAGE__` sólo en desarrollo: es una ruta del
+    // sistema de archivos del proyecto y no le aporta nada al cliente.
+    //
+    // Una página que no hidrata no lleva estado: nadie lo va a leer, y un
+    // documento sin JavaScript de página es justamente lo que pidió.
+    const blocks = !hydrate ? [] : [
+        ...(platformTravels ? [{ varName: '__RESS_PLATFORM__', value: platform }] : []),
+        { varName: '__RESS_PROPS__', value: rendered.props || {} },
+        { varName: '__RESS_ROUTE__', value: page?.route ?? '' },
+        ...(ctx.isProduction ? [] : [{ varName: '__RESS_PAGE__', value: page?.file ?? '' }]),
+    ];
+    const stateScript = blocks.length ? (0, security_1.renderStateScript)(blocks, nonce) : '';
+    let html = template;
+    if (pageHead?.htmlAttributes)
+        html = applyRootAttributes(html, 'html', pageHead.htmlAttributes, escapeCtx);
+    if (pageHead?.bodyAttributes)
+        html = applyRootAttributes(html, 'body', pageHead.bodyAttributes, escapeCtx);
+    if (pageHead?.tags.some((tag) => tag.type === 'title')) {
+        html = html.replace(/<title(?:\s[^>]*)?>[\s\S]*?<\/title>/i, '');
     }
-    return '';
+    // Los tres valores insertados acá son contenido dinámico: si se pasaran
+    // como string de reemplazo, `$$`, `$&`, `` $` `` y `$'` se interpretarían
+    // como patrones especiales de `String.replace` y corromperían el documento.
+    // La forma función evita esa interpretación.
+    return html
+        .replace('<!--app-head-->', () => headContent)
+        .replace('<!--app-html-->', () => rendered.html)
+        .replace('</body>', () => `${stateScript}${scriptTag}</body>`);
 }
-async function generateCompleteHTML(context) {
-    const { template, rendered, page, manifest, isProduction, platformInfo, serverSideResult } = context;
-    const scriptSrc = await generateClientScript(page.file, platformInfo, manifest, isProduction);
-    const scriptTag = scriptSrc ? `<script type="module" src="${scriptSrc}"></script>` : '';
-    const cssLinks = page?.file ? generateClientCSS(page.file, platformInfo, manifest, isProduction) : '';
-    // Construir contenido HEAD extra y atributos desde serverSideResult
-    let headContent = cssLinks;
-    let htmlAttributes = '';
-    let bodyAttributes = '';
-    let pageTitle = '';
-    if (serverSideResult?.html) {
-        if (serverSideResult.html.head?.attributes) {
-            htmlAttributes = Object.entries(serverSideResult.html.head.attributes)
-                .map(([k, v]) => `${k}="${v}"`).join(' ');
-        }
-        if (serverSideResult.html.body?.attributes) {
-            bodyAttributes = Object.entries(serverSideResult.html.body.attributes)
-                .map(([k, v]) => `${k}="${v}"`).join(' ');
-        }
-        if (serverSideResult.html.head?.extraTags) {
-            headContent += '\n' + serverSideResult.html.head.extraTags.join('\n');
+const nonceAttr = (nonce) => (nonce ? ` nonce="${(0, security_1.escapeAttrValue)(nonce)}"` : '');
+/**
+ * Acepta la forma estructurada y descarta el string de HTML crudo.
+ *
+ * Un array de strings no se puede filtrar sin analizar HTML, y analizarlo para
+ * decidir si es seguro es exactamente el problema que la lista de etiquetas
+ * admitidas evita. F-004 ya produce la forma estructurada.
+ */
+function applyRootAttributes(html, element, attrs, ctx) {
+    return html.replace(new RegExp('<' + element + '([^>]*)>', 'i'), (_opening, existing) => {
+        let merged = existing;
+        for (const [name, value] of Object.entries(attrs)) {
+            const rendered = (0, security_1.renderAttrs)({ [name]: value }, { ...ctx, where: '<' + element + '>' });
+            if (!rendered)
+                continue;
+            const escapedName = name.replace(/[.*+?^$()|[\]\\{}]/g, '\\$&');
+            const present = new RegExp('\\s' + escapedName + '(?:\\s*=\\s*(?:"[^"]*"|\'[^\']*\'|[^\\s>]+))?', 'i');
+            merged = present.test(merged) ? merged.replace(present, () => ' ' + rendered) : merged + ' ' + rendered;
         }
-        if (serverSideResult.title || serverSideResult.html.head?.title) {
-            pageTitle = `<title>${serverSideResult.title || serverSideResult.html.head?.title}</title>`;
-        }
-    }
-    let html = template;
-    if (htmlAttributes)
-        html = html.replace('<html', `<html ${htmlAttributes}`);
-    if (bodyAttributes)
-        html = html.replace('<body', `<body ${bodyAttributes}`);
-    if (pageTitle)
-        html = html.replace(/<title>.*?<\/title>/i, pageTitle);
-    html = html
-        .replace('<!--app-head-->', headContent)
-        .replace('<!--app-html-->', rendered.html)
-        .replace('</body>', `<script>
-        window.__INITIAL_PROPS__=${JSON.stringify(rendered.props || {})};
-        window.__PAGE_ROUTE__=${JSON.stringify(page.route)};
-        window.__PAGE_FILE__=${JSON.stringify(page.file)};
-      </script>
-      ${scriptTag}
-      </body>`);
-    return html;
+        return '<' + element + merged + '>';
+    });
 }

package/dist/helpers/middlewares.d.ts

@@ -1,65 +1,76 @@
 import { Request, RequestHandler, Response } from 'express';
+import type { ModuleLoader } from '../runtime/module-loader';
+import type { MiddlewareEntry } from '../routes/types';
+import type { PageConfig } from '../head/types';
+export type { PageConfig, PageConfigVariant, PageHeadConfig, RobotsConfig } from '../head/types';
 export interface MiddlewareInfo {
     route: string;
     file: string;
     abs: string;
     type: 'page-specific' | 'folder-global';
     depth: number;
+    /** Chunk de servidor registrado por el build. Sólo en producción. */
+    buildChunk?: string;
 }
+/**
+ * Si un middleware de carpeta con alcance `scope` aplica a `route`.
+ *
+ * Se compara por segmentos: `admin/middlewares.ts` protege `/admin` y
+ * `/admin/x`, pero no `/administrator`, que sólo comparte el prefijo de texto.
+ * La raíz aplica a todo.
+ */
+export declare function middlewareAppliesTo(scope: string, route: string): boolean;
+/** Lo que el build escribe en el manifest por cada middleware. */
+export declare function toMiddlewareEntry(info: MiddlewareInfo): MiddlewareEntry;
+/** Los middlewares tal como los registró el build, listos para cargar. */
+export declare function middlewaresFromManifest(entries: readonly MiddlewareEntry[]): MiddlewareInfo[];
 export interface ServerSideResult {
     props?: Record<string, any>;
-    title?: string;
-    html?: {
-        head?: {
-            title?: string;
-            attributes?: Record<string, string>;
-            extraTags?: string[];
-        };
-        body?: {
-            attributes?: Record<string, string>;
-        };
-    };
+    pageConfig?: PageConfig;
 }
 export interface PageModule {
     default?: React.ComponentType<any>;
+    /** Configuración estática: el router la lee al armar la ruta, antes de cualquier petición. */
+    pageConfig?: PageConfig;
     getServerSideProps?: (req: Request, res: Response) => Promise<ServerSideResult> | ServerSideResult;
     errorMiddleware?: (err: any, req: Request, res: Response, next: any) => void;
 }
 /**
  * Busca archivos de middlewares tanto específicos por página como globales por carpeta
  */
-export declare function getMiddlewares(): MiddlewareInfo[];
+export declare function getMiddlewares(options?: {
+    cwd?: string;
+}): MiddlewareInfo[];
 /**
  * Carga middlewares para una página específica y los convierte en middlewares de Express
  */
-export declare function loadPageMiddlewares(pageRoute: string, vite?: any): Promise<RequestHandler[]>;
+export declare function loadPageMiddlewares(pageRoute: string, loader?: ModuleLoader, middlewares?: readonly MiddlewareInfo[]): Promise<RequestHandler[]>;
 /**
  * Carga el módulo completo de una página
  */
-export declare function loadPageModule(pageFile: string, vite?: any): Promise<PageModule | null>;
+export declare function loadPageModule(pageFile: string, loader?: ModuleLoader): Promise<PageModule | null>;
 /**
  * Convierte getServerSideProps en un middleware de Express
  */
-export declare function createGetServerSidePropsMiddleware(pageModule: PageModule): RequestHandler;
+export declare function createGetServerSidePropsMiddleware(pageModule: PageModule, file?: string): RequestHandler;
 /**
  * Creates a unified error handler for a specific page route
  * This replaces the old createPageErrorMiddleware with a more useful approach
  */
-export declare function createPageErrorHandler(pageFile: string, vite?: any): (err: any, req: any, res: any, next: any) => Promise<void>;
+export declare function createPageErrorHandler(pageFile: string, loader?: ModuleLoader, middlewares?: readonly MiddlewareInfo[]): (err: any, req: any, res: any, next: any) => Promise<any>;
 /**
  * Creates a dynamic middleware handler that reloads middlewares on each request in development
  * This enables HMR for middlewares
  * I FUCKING HATE THIS FUNCTION BUT IT SEEMS TO WORK
  */
-export declare function createDynamicPageMiddlewares(pageRoute: string, pageFile: string, vite?: any): RequestHandler;
 /**
  * 1. Resuelve middlewares previos al getServerSideProps
  */
-export declare function getPagePrevMiddlewares(pageRoute: string, vite?: any): Promise<RequestHandler[]>;
+export declare function getPagePrevMiddlewares(pageRoute: string, loader?: ModuleLoader): Promise<RequestHandler[]>;
 /**
  * 2. Convierte getServerSideProps a middleware
  */
-export declare function getServerSidePropsAsMiddleware(pageFile: string, vite?: any): Promise<RequestHandler>;
+export declare function getServerSidePropsAsMiddleware(pageFile: string, loader?: ModuleLoader): Promise<RequestHandler>;
 /**
  * 3. Error middleware con fallback automático y jerarquía
  * Orden de prioridad (el más específico gana):
@@ -67,6 +78,6 @@ export declare function getServerSidePropsAsMiddleware(pageFile: string, vite?:
  * 2. errorMiddleware en [page].middlewares.ts
  * 3. errorMiddleware en carpeta/middlewares.ts
  * 4. errorMiddleware en root middlewares.ts (más general)
- * 5. defaultErrorMiddleware (fallback)
+ * 5. ninguno: null, para que el llamador delegue con next(err)
  */
-export declare function getErrorMiddleware(pageFile: string, vite?: any): Promise<any>;
+export declare function getErrorMiddleware(pageFile: string, loader?: ModuleLoader, middlewares?: readonly MiddlewareInfo[]): Promise<any>;