@rsc-kit/core 0.30.29 → 0.30.30

package/dist/vite.js

@@ -23,7 +23,8 @@ import rsc, { getPluginApi } from "@vitejs/plugin-rsc";
 import { loadEnv, parseAst } from "vite";
 import { stampDisplayNames } from "./stableNames.js";
 import { REPORT_FILE, buildReport } from "./buildReport.js";
-import { edgeShells, pprMarker } from "./edgeShells.js";
+import { contractPath, edgeGuarded, edgeMarker, edgeShells, edgeStatic } from "./edgeShells.js";
+import { EDGE, EDGE_HEADERS } from "./headers.js";
 import { MANIFEST_PATH, manifestWarning, webManifest } from "./webManifest.js";
 import { ASSET_BASE, allAppAssets, assetFile, appAssets, headTags, shareImageUrls, typeOf, } from "./appAssets.js";
 import { reactCacheImports } from "./reactCache.js";
@@ -240,6 +241,8 @@ let siteHosts = [];
 let hostsOption = [];
 let barrelImports = true;
 let identify = true;
+/** RscKitOptions.headers, checked against the edge contract's allow list. */
+let pageHeaders = {};
 /** Resolved from RscKitOptions.openapi; null when off. */
 let openapi = null;
 let foundAssets = {
@@ -401,6 +404,36 @@ function aliasEntries() {
     });
     return entries;
 }
+/**
+ * rscKit({ headers }), in the case the contract spells each name. Refused at
+ * build, never trimmed at runtime: a header that was asked for and quietly not
+ * sent is a security header missing from every page.
+ */
+export function normalisePageHeaders(raw) {
+    if (raw === undefined)
+        return {};
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        throw new Error("[rsc-kit] headers: an object of header names to values, as in { 'X-Frame-Options': 'DENY' }.");
+    const known = new Map(EDGE_HEADERS.map((name) => [name.toLowerCase(), name]));
+    // The renderer's own: an asset is immutable, a guarded page no-store, and
+    // the Link header is the document's early hints. One value for every
+    // response would be wrong for most of them.
+    const owned = new Set(["cache-control", "link"]);
+    const headers = {};
+    for (const [name, value] of Object.entries(raw)) {
+        if (owned.has(name.toLowerCase()))
+            throw new Error(`[rsc-kit] headers: ${name} is the renderer's to set per response. Set it in a middleware if a page needs its own.`);
+        const canonical = known.get(name.toLowerCase());
+        if (!canonical)
+            throw new Error(`[rsc-kit] headers: ${JSON.stringify(name)} is not one an edge may send with a cached page (${EDGE_HEADERS.join(", ")}). Set it in a middleware instead, which runs per request.`);
+        if (typeof value !== "string" || value.trim() === "" || /[\r\n]/.test(value))
+            throw new Error(`[rsc-kit] headers: ${canonical} needs a value on one line, not ${JSON.stringify(value)}.`);
+        if (canonical in headers)
+            throw new Error(`[rsc-kit] headers: ${canonical} is named twice.`);
+        headers[canonical] = value.trim();
+    }
+    return headers;
+}
 /**
  * The prefixes a backend owns, as the matcher reads them: `/auth`, no trailing
  * slash. Refused rather than corrected where a mistake would silently send the
@@ -515,6 +548,7 @@ function resolvePaths(options) {
     hostsOption = options.hosts ?? [];
     barrelImports = options.barrelImports !== false;
     identify = options.identify !== false;
+    pageHeaders = normalisePageHeaders(options.headers);
     openapi = options.openapi
         ? (() => {
             const { path, ...document } = typeof options.openapi === "object" ? options.openapi : {};
@@ -836,6 +870,7 @@ function routeManifest() {
             hosts: siteHosts,
             identify,
             refreshOn: usesRefreshOn() || undefined,
+            headers: Object.keys(pageHeaders).length ? pageHeaders : undefined,
         },
         routes,
         intercepts,
@@ -1609,40 +1644,84 @@ export function workerVersion(precache, storedDir) {
     return version.digest("hex").slice(0, 12);
 }
 /**
- * The PPR contract's build: what an edge checks a cached shell against.
+ * The edge contract's build: what an edge checks a cached page against.
  *
  * Not the client's build id, which is what a browser tab is told and covers
  * only what the browser downloads - a release that changed only what the
- * server renders kept it, and an edge holding the old shell would have joined
- * it to the new server's holes. So it is that id and the bytes of every shell
- * and its postponed state. A server change that reaches a shell is a new
- * build to the edge; one that leaves them all byte for byte the same is not,
- * because the shell the edge holds is then this build's. A tab is not made to
- * reload for either.
- */
-export function pprBuildId(clientBuild, storedDir) {
+ * server renders kept it, and an edge holding the old page would have served
+ * it, or joined it to the new server's holes. So it is that id and the bytes
+ * of every stored document and postponed state. A server change that reaches
+ * one is a new build to the edge; one that leaves them all byte for byte the
+ * same is not, because what the edge holds is then this build's. A tab is not
+ * made to reload for either.
+ */
+export function edgeBuildId(clientBuild, storedDir) {
     const id = createHash("sha256");
     id.update(clientBuild);
-    const shells = [];
+    const pages = [];
     const walk = (dir) => {
         for (const entry of readdirSync(dir, { withFileTypes: true })) {
             const path = join(dir, entry.name);
             if (entry.isDirectory())
                 walk(path);
-            else if (/\.(?:ppr\.html|postponed\.json)$/.test(entry.name))
-                shells.push(path);
+            else if (/\.(?:html|postponed\.json)$/.test(entry.name))
+                pages.push(path);
         }
     };
     if (existsSync(storedDir))
         walk(storedDir);
-    for (const path of shells.sort()) {
+    for (const path of pages.sort()) {
         id.update("\n" + relative(storedDir, path) + "\n");
         id.update(readFileSync(path));
     }
     return id.digest("hex").slice(0, 16);
 }
-/** Where the host reads the PPR build back, beside the shells it describes. */
-export const PPR_BUILD_FILE = "_ppr.build";
+/**
+ * Give a static page a payload it can boot from without the app.
+ *
+ * A page the build wrote whole hydrates from its stored payload, which it
+ * fetched from its own url with X-RSC - a request an edge passes to the app,
+ * so a page the edge answered whole still woke a sleeping app on every visit
+ * from a browser. So its payload is copied to a hashed asset, served as
+ * immutable like every other, and the document names it: a preload, so the
+ * fetch starts as the head parses, and a meta the client boots from. Its
+ * layouts ride the meta, since an asset carries no X-RSC-Layouts.
+ *
+ * Only for the pages the marker lists: a guarded page's payload at a public
+ * url would be read past its guard. Returns the paths it could do it for.
+ */
+export function storedPayloadAssets(staticDir, clientDir, pages) {
+    const done = [];
+    const attribute = (value) => value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
+    for (const { path, key } of pages) {
+        const htmlFile = join(staticDir, `${key}.html`);
+        const flightFile = join(staticDir, `${key}.flight`);
+        if (!existsSync(htmlFile) || !existsSync(flightFile))
+            continue;
+        const html = readFileSync(htmlFile, "utf8");
+        const at = html.indexOf("</head>");
+        if (at === -1)
+            continue;
+        const flight = readFileSync(flightFile);
+        const name = `${createHash("sha256").update(flight).digest("hex").slice(0, 16)}.rsc`;
+        const url = `/assets/_rsc/${name}`;
+        mkdirSync(join(clientDir, "assets", "_rsc"), { recursive: true });
+        writeFileSync(join(clientDir, "assets", "_rsc", name), flight);
+        let layouts = [];
+        try {
+            layouts = JSON.parse(readFileSync(join(staticDir, `${key}.meta.json`), "utf8")).layouts ?? [];
+        }
+        catch {
+            continue;
+        }
+        writeFileSync(htmlFile, html.slice(0, at) +
+            `<link rel="preload" as="fetch" crossorigin="" href="${attribute(url)}"/>` +
+            `<meta name="rsc-kit:payload" content="${attribute(url)}" data-layouts="${attribute(layouts.join(","))}"/>` +
+            html.slice(at));
+        done.push(path);
+    }
+    return done;
+}
 function writeServiceWorker(clientDir, frozen = [], offlineUrl = null, 
 // The pages the build stored, which the worker serves cache-first. Their
 // bytes are part of what a version is - see below.
@@ -2010,6 +2089,8 @@ ${legend(counted)}
             .map((r) => r.url),
         results,
         shells: edgeShells(results, manifest.routes),
+        routes: manifest.routes,
+        pathKey: pathKeyOf,
         build,
     };
 }
@@ -8112,12 +8193,23 @@ export function rscKit(options = {}) {
             const staticDir = clientOut
                 ? join(dirname(clientOut), "server", NITRO_STATIC_DIR)
                 : join(outDir, NITRO_STATIC_DIR);
-            const { frozen, results, shells, build: clientBuild } = await prerenderAfterBundles(bundle, staticDir, clientOut ?? publicAssetsDir, builder ? knownActionsOf(builder.config, projectRoot) : []);
-            // Before the pages are packed into a module or the assets, so the host
-            // finds it wherever it reads the shells from.
-            const build = clientBuild ? pprBuildId(clientBuild, staticDir) : undefined;
-            if (build && existsSync(staticDir))
-                writeFileSync(join(staticDir, PPR_BUILD_FILE), build);
+            const { frozen, results, shells, routes, pathKey: pathKeyOf, build: clientBuild } = await prerenderAfterBundles(bundle, staticDir, clientOut ?? publicAssetsDir, builder ? knownActionsOf(builder.config, projectRoot) : []);
+            // The edge contract's static pages, each given a payload it boots from
+            // without the app - before the build id, which hashes the documents
+            // this changes, and before the pages are packed into a module or the
+            // assets. A server build only: an export has no edge in front of an app.
+            const listed = output !== "export" && clientOut ? edgeStatic(results, routes, shells.shells) : { static: [], left: [] };
+            const keyOf = new Map(results.map((r) => [contractPath(r.url), pathKeyOf(r.url)]));
+            const statics = clientOut
+                ? storedPayloadAssets(staticDir, clientOut, listed.static.map((path) => ({ path, key: keyOf.get(path) })).filter((page) => page.key))
+                : [];
+            const build = clientBuild ? edgeBuildId(clientBuild, staticDir) : undefined;
+            const marker = build ? edgeMarker(build, shells.shells, statics) : null;
+            // Beside the pages too, so the host finds the build and the static
+            // list wherever it reads the pages from.
+            if (marker && output !== "export" && existsSync(staticDir)) {
+                writeFileSync(join(staticDir, EDGE.storedMarker), JSON.stringify(marker));
+            }
             // The same pages once more, as a module. A Worker has no filesystem, and
             // until this existed every Cloudflare deploy rendered its "static" pages
             // live, silently - the reader found no directory and fell through. The
@@ -8153,8 +8245,13 @@ export function rscKit(options = {}) {
             // after the prerender, and an export taken any earlier left them out.
             if (output === "export")
                 await exportAfterPrerender(results, staticDir, clientOut ?? publicAssetsDir);
-            if (shells.left.length) {
-                log(`ppr: not listed for an edge in ppr.json, so served by the origin: ${shells.left.join("; ")}`);
+            if (shells.left.length || listed.left.length) {
+                log(`edge: not listed in edge.json, so served by the origin: ${[...shells.left, ...listed.left].join("; ")}`);
+            }
+            const guarded = output !== "export" && clientOut ? edgeGuarded(results, routes) : [];
+            if (guarded.length) {
+                const none = marker && !marker.shells.length && !marker.static.length;
+                log(`edge: ${none ? "edge.json lists no page: every one is under middleware" : "left out of edge.json, under middleware"}, which runs per request: ${guarded.join(", ")}`);
             }
             // What this build produced, where a deploy can read it without parsing
             // vite.config.ts - which can turn export on through RSC_OUTPUT, or
@@ -8169,19 +8266,22 @@ export function rscKit(options = {}) {
                         ...compileStep(projectRoot),
                         ...(buildCommands().length ? { commands: buildCommands().map((c) => c.name) } : {}),
                     }, null, 2) + "\n");
-                // The PPR contract's marker: the pages an edge may answer from a
-                // cached shell, and the build both endpoints will say they belong to.
-                // Written by every server build, with an empty list when there is no
-                // PPR page, so a platform can tell "none" from "an rsc-kit too old to
-                // say". Not by an export, which has no origin to resume against.
-                const marker = join(dirname(clientOut), "ppr.json");
-                if (output !== "export" && build) {
-                    writeFileSync(marker, JSON.stringify(pprMarker(build, shells.shells), null, 2) + "\n");
+                // The edge contract's marker: the pages an edge may answer from a
+                // cached shell or whole, and the build both endpoints will say they
+                // belong to. Written by every server build, with empty lists when
+                // there are none, so a platform can tell "none" from "an rsc-kit too
+                // old to say". Not by an export, which has no origin to answer for it.
+                const markerFile = join(dirname(clientOut), "edge.json");
+                // v1's marker, from a build before this one: an edge reading it
+                // would ask for endpoints that are no longer here.
+                rmSync(join(dirname(clientOut), "ppr.json"), { force: true });
+                if (output !== "export" && marker) {
+                    writeFileSync(markerFile, JSON.stringify(marker, null, 2) + "\n");
                 }
                 else {
                     // One left by an earlier server build would promise an origin that
                     // is not there.
-                    rmSync(marker, { force: true });
+                    rmSync(markerFile, { force: true });
                 }
             }
         },