@rshono/core 1.0.0-rc.2 → 1.0.0-rc.21

package/bin/rshono.mjs

@@ -1,10 +1,9 @@
 #!/usr/bin/env node
-// Thin launcher for the compiled CLI. Everything it does has to happen *before* the CLI module
-// graph loads, which is why the import below is dynamic rather than a static one at the top.
+// Thin launcher for the compiled CLI. Everything here has to happen before the CLI module graph loads, which is
+// why the import at the bottom is dynamic.
 const args = process.argv.slice(2);
 
-// `build` and `start` are the production commands, so they default NODE_ENV accordingly — the
-// value is read during config resolution and baked into the bundle, so it has to be set this early.
+// The production commands default NODE_ENV, which is read during config resolution and baked into the bundle.
 if ((args[0] === 'build' || args[0] === 'start') && !process.env.NODE_ENV) {
   process.env.NODE_ENV = 'production';
 }

package/dist/builder/env-shadow-loader.cjs

@@ -1,18 +1,103 @@
 'use strict';
-const DIRECTIVE_PROLOGUE = /^(?:\s|\/\/[^\n]*(?:\n|$)|\/\*[\s\S]*?\*\/)*(?:(['"])use [a-z -]+\1\s*;?)?/;
+
+/** Whitespace and comments — what may sit before or between directives without ending the prologue. */
+const TRIVIA = '(?:\\s|//[^\\n]*(?:\\n|$)|/\\*[\\s\\S]*?\\*/)*';
+/** One directive: `'use strict'`, `"use client"`, `'use server'`. The backreference keeps the quotes matched. */
+const DIRECTIVE = '([\'"])use [a-z -]+\\1\\s*;?';
+
+/**
+ * The whole directive prologue, so the prelude below is inserted *after* every directive rather than after the
+ * first one.
+ *
+ * The repetition is load-bearing. A module with two directives — `"use strict"` beside `'use client'`, which is
+ * ordinary output from a published component library, in either order — would otherwise take the prelude
+ * *between* them, and a directive preceded by a statement is just an expression: whichever came second would
+ * silently stop being a directive. That was survivable while this loader only saw the app's own hand-written
+ * source, where `'use client'` comes first and alone; it stopped being survivable when the rule widened to
+ * cover `node_modules` (see the SSR-layer rule in `rspack-config.ts`).
+ *
+ * Each repetition has to consume a whole directive, so the nested quantifiers cannot loop on an empty match.
+ */
+const DIRECTIVE_PROLOGUE = new RegExp(`^${TRIVIA}(?:${DIRECTIVE}${TRIVIA})*`);
+
+/**
+ * The gate: a standalone `process` identifier anywhere in the module, not the literal text `process.env`.
+ *
+ * The prelude replaces the whole `process` *binding*, so every way of reaching the env through that binding is
+ * covered once it is emitted — but a gate on `process.env` only ever saw one of them:
+ *
+ * | source shape                            | `process.env` | this |
+ * | --------------------------------------- | ------------- | ---- |
+ * | `process.env.DATABASE_URL`              | yes           | yes  |
+ * | `const { DATABASE_URL } = process.env`  | yes           | yes  |
+ * | `process?.env.DATABASE_URL`             | **no**        | yes  |
+ * | `process['env'].DATABASE_URL`           | **no**        | yes  |
+ * | `const { env } = process`               | **no**        | yes  |
+ * | `const p = process; p.env.DATABASE_URL` | **no**        | yes  |
+ *
+ * `process?.env` is not a contrived shape — it is how env access is written in code meant to run in a browser
+ * and on a server, which is exactly what a `'use client'` component is. Every "no" above rendered a secret into
+ * the SSR'd HTML while the browser bundle saw the `PUBLIC_`-only view.
+ *
+ * `\b` on both sides, so `preprocess`, `processEnv` and `child_process` do not drag the prelude in. The cost of
+ * being wrong either way is only bytes: a module that mentions `process` in a comment gets a prelude it does
+ * not need.
+ *
+ * The one shape this cannot cover is a module that declares its own module-scope `process` binding — the
+ * prelude would be a redeclaration, and the build fails on it rather than shipping. Naming a module-scope
+ * binding after a well-known global is what has to give.
+ */
+const MENTIONS_PROCESS = /\bprocess\b/;
+
+/**
+ * A read of `process` through the global object rather than through the binding — `globalThis.process.env`,
+ * `globalThis?.process`, `global['process']`, and the `self` spelling Workers use.
+ *
+ * A prelude declares a module-scoped binding, so it cannot reach any of these: `globalThis.process` is the real
+ * `process` however the module names it. `typeof globalThis.process !== 'undefined' && …` is a real isomorphic
+ * idiom, so this is worth saying out loud rather than leaving to be discovered in a rendered page — but only
+ * for the app's own source, since a library feature-detecting `globalThis.process?.env?.NODE_ENV` is doing
+ * nothing wrong and has no app secret to read.
+ */
+const GLOBAL_PROCESS = /\b(?:globalThis|global|self)\s*(?:\?\.|\.)?\s*(?:process\b|\[\s*(['"`])process\1\s*\])/;
+
+/**
+ * A free `process.env.NODE_ENV` read — the one expression the prelude has to hand back to the optimiser —
+ * and the three places that same text can sit without being one.
+ *
+ * The last alternative is the target. The lookbehind rejects a member read off something else
+ * (`this.process.env.NODE_ENV`, `foo.process…`) and a longer identifier (`myprocess`); the trailing `\b`
+ * rejects `NODE_ENVIRONMENT`. That is the shape DefinePlugin substitutes, minus the ones it also declines —
+ * an optional chain and a computed key are left alone here exactly as they are left alone there.
+ *
+ * The alternatives ahead of it are what keeps this a substitution of *code*. DefinePlugin works on the parsed
+ * module and so cannot rewrite a string; this loader is text, and without them
+ * `throw new Error('set process.env.NODE_ENV')` would come out as `throw new Error('set "production"')`.
+ * Comments come first so an apostrophe in one (`// don't`) cannot open a string that swallows the code after
+ * it, then strings, then templates.
+ *
+ * It is a scanner, not a parser, and two things are outside it: a regex literal spelled with unescaped dots
+ * (`/process.env.NODE_ENV/`), and an interpolation inside a template, which is consumed with the template
+ * around it. The first is the residual risk and a strange thing to write; the second only declines a
+ * substitution that would have been valid, which costs bytes and changes nothing. Any position it gets wrong
+ * leaves the text exactly as a bare `.replace()` would have, so this can only improve on one.
+ */
+const NODE_ENV_SCAN = /\/\/[^\n]*|\/\*[\s\S]*?\*\/|(['"])(?:\\[\s\S]|(?!\1)[^\\\n])*\1|`(?:\\[\s\S]|[^\\`])*`|(?<![.$\w])process\.env\.NODE_ENV\b/g;
 
 /**
  * Shadows `process.env` with the PUBLIC_-only view inside SSR-layer modules, so a secret read from a
- * `'use client'` component renders empty on the server instead of leaking into the HTML stream (and
- * SSR output keeps agreeing with hydration, which sees the same view via DefinePlugin).
+ * `'use client'` component renders empty on the server rather than leaking into the HTML stream — and SSR
+ * keeps agreeing with hydration, which sees the same view via DefinePlugin.
  *
- * This is a security control, so it fails the build rather than passing source through when it can't
- * confirm which layer a module is in — `_module` is a private Rspack field, and silently no-op'ing
- * if a future version renames it would drop the guarantee with nothing to notice it.
+ * A security control, so it fails the build rather than passing source through when it cannot confirm a
+ * module's layer: `_module` is a private Rspack field, and a silent no-op if it were renamed would drop the
+ * guarantee with nothing to notice.
  */
 module.exports = function envShadowLoader(source) {
-  if (!source.includes('process.env')) return source;
-  const { prelude, layer } = this.getOptions();
+  // Two steps rather than the regex alone: this loader sees every module in the bundle, and most of them do
+  // not contain the substring at all, which `includes` settles far more cheaply than a scan for word breaks.
+  if (!source.includes('process') || !MENTIONS_PROCESS.test(source)) return source;
+  const { prelude, layer, appSrcPrefix, nodeEnv } = this.getOptions();
   if (!this._module) {
     throw new Error(
       "[rshono] env-shadow-loader could not read the module's layer (Rspack's `this._module` is unavailable). " +
@@ -21,6 +106,36 @@ module.exports = function envShadowLoader(source) {
     );
   }
   if (this._module.layer !== layer) return source;
+
+  if (appSrcPrefix && this.resourcePath?.startsWith(appSrcPrefix) && GLOBAL_PROCESS.test(source)) {
+    // Rspack prints the module path ahead of this, so the message is only the part it does not know.
+    this.emitWarning(
+      new Error(
+        '[rshono] This module reads `process` through the global object. It is rendered on the server as part ' +
+          'of a client component, where `process.env` is shadowed with the `PUBLIC_`-only view — and that ' +
+          'shadow is a binding, so it cannot cover `globalThis.process`. A variable read that way is the real ' +
+          'one, and it ends up in the HTML. Read `process.env` directly instead.',
+      ),
+    );
+  }
+
+  // Hand `process.env.NODE_ENV` back to the optimiser before the prelude takes it away. DefinePlugin — the
+  // pass that erases `if (process.env.NODE_ENV === 'production')` and everything on the dead side of it —
+  // respects lexical scope, and the prelude below declares a module-scope `process`. So without this, every
+  // React entry wrapper in this layer stays a runtime branch and *both* halves are bundled: six development
+  // builds of react / react-dom / react-server-dom-rspack, about half of `dist/server/main.mjs`.
+  //
+  // Substituting is not a behaviour change. `NODE_ENV` is the one key of the prelude's own `env` literal that
+  // is not read from the host environment — it is this build's mode — so the value written here is the value
+  // the shadow would have returned anyway, and the shadow's security property is untouched.
+  //
+  // Textual, like the prelude insertion beside it, but not blindly so: {@link NODE_ENV_SCAN} walks the
+  // comments, strings and templates as well, and hands back everything that is not code untouched.
+  if (nodeEnv) {
+    const literal = JSON.stringify(nodeEnv);
+    source = source.replace(NODE_ENV_SCAN, (match) => (match.startsWith('process') ? literal : match));
+  }
+
   const prologue = source.match(DIRECTIVE_PROLOGUE)[0];
   return prologue + prelude + source.slice(prologue.length);
 };

package/dist/builder/page-entry-loader.cjs

@@ -1,5 +1,32 @@
 'use strict';
-const OPENS_WITH_DIRECTIVE = /^(?:\s|\/\/[^\n]*(?:\n|$)|\/\*[\s\S]*?\*\/)*(['"])use (?:client|server|server-entry)\1\s*(?:;|\n|$)/;
+
+/** Whitespace and comments — what may sit before or between directives without ending the prologue. */
+const TRIVIA = '(?:\\s|//[^\\n]*(?:\\n|$)|/\\*[\\s\\S]*?\\*/)*';
+/**
+ * A directive that is *not* one of the three the RSC compilers act on. `'use strict'` above all, which is
+ * what a transpiler and many a published component library put at the top of a module; `'use cache'` and
+ * whatever else React adds later fall here too, which is the point of writing this as "not those three"
+ * rather than as a list.
+ */
+const OTHER_DIRECTIVE = '([\'"])use (?!(?:client|server|server-entry)\\1)[a-z -]+\\1\\s*;?';
+/** One of the three. `\\2`, because {@link OTHER_DIRECTIVE} ahead of it owns group 1. */
+const RSC_DIRECTIVE = '([\'"])use (?:client|server|server-entry)\\2\\s*;?';
+
+/**
+ * Whether the module already declares one of the three RSC directives — anywhere in its directive prologue,
+ * which is the fix: this used to match only a directive that came *first*.
+ *
+ * A page opening `'use strict';` ahead of its `'use client';` therefore had `'use server-entry';` prepended,
+ * and the injected directive is the one the compiler then acts on. Measured against a real build: a page
+ * whose first line is `'use client'` fails with `assertPageModule`'s message, and the same page with
+ * `'use strict'` above it exits 0 and ships — so the one directive the framework relies on to refuse a client
+ * page was silently neutered, and the page failed inside React at request time instead.
+ *
+ * Structural rather than a substring test, so a comment that *mentions* `'use client'` — plausible at the top
+ * of a page that used to be one — is consumed as trivia rather than read as a directive. And the same shape
+ * as `env-shadow-loader.cjs`'s prologue match, which was widened for this exact class of module.
+ */
+const OPENS_WITH_DIRECTIVE = new RegExp(`^${TRIVIA}(?:${OTHER_DIRECTIVE}${TRIVIA})*${RSC_DIRECTIVE}`);
 
 module.exports = function pageEntryLoader(source) {
   if (OPENS_WITH_DIRECTIVE.test(source)) return source;

package/dist/builder/page-files.d.ts

@@ -1,2 +1 @@
 export declare function scanPageFiles(routesFile: string, srcDir: string, into: Set<string>): void;
-//# sourceMappingURL=page-files.d.ts.map

package/dist/builder/page-files.js

@@ -1,10 +1,14 @@
+/**
+ * Finds the page modules named by inline `component: () => import('…')` thunks in `routes.ts`, so the server
+ * compiler can put `page-entry-loader.cjs` in front of exactly those files. A page wired up any other way
+ * declares its `'use server-entry'` directive itself.
+ */
 import { readFileSync, statSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 const COMPONENT_THUNK = /component:\s*(?:async\s*)?\(\s*\)\s*=>\s*import\(\s*(['"])([^'"]+)\1\s*\)/g;
 const EXTENSIONS = ['.tsx', '.ts', '.jsx', '.js'];
-// The index candidates go through `join` rather than `base + '/index…'`: these paths end up in a Set
-// that rspack compares against its own resource paths, and a hardcoded `/` resolves fine on Windows
-// while storing a path no rspack resource will ever equal.
+// `join` rather than `base + '/index…'`: these are compared against Rspack's own resource paths, which on
+// Windows carry backslashes.
 function resolveCandidates(base) {
     return [...EXTENSIONS.map((ext) => base + ext), ...EXTENSIONS.map((ext) => join(base, `index${ext}`)), base];
 }

package/dist/builder/page-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"page-files.js","sourceRoot":"","sources":["../../src/builder/page-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,MAAM,eAAe,GAAG,4EAA4E,CAAC;AAErG,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAElD,qGAAqG;AACrG,oGAAoG;AACpG,2DAA2D;AAC3D,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,MAAc,EAAE,IAAiB;IACjF,IAAI,CAAC,KAAK,EAAE,CAAC;IACb,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAwB,CAAC;QAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;aAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACpB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { readFileSync, statSync } from 'node:fs';\nimport { dirname, join, resolve } from 'node:path';\n\nconst COMPONENT_THUNK = /component:\\s*(?:async\\s*)?\\(\\s*\\)\\s*=>\\s*import\\(\\s*(['\"])([^'\"]+)\\1\\s*\\)/g;\n\nconst EXTENSIONS = ['.tsx', '.ts', '.jsx', '.js'];\n\n// The index candidates go through `join` rather than `base + '/index…'`: these paths end up in a Set\n// that rspack compares against its own resource paths, and a hardcoded `/` resolves fine on Windows\n// while storing a path no rspack resource will ever equal.\nfunction resolveCandidates(base: string): string[] {\n  return [...EXTENSIONS.map((ext) => base + ext), ...EXTENSIONS.map((ext) => join(base, `index${ext}`)), base];\n}\n\nfunction isFile(path: string): boolean {\n  try {\n    return statSync(path).isFile();\n  } catch {\n    return false;\n  }\n}\n\nexport function scanPageFiles(routesFile: string, srcDir: string, into: Set<string>): void {\n  into.clear();\n  let source: string;\n  try {\n    source = readFileSync(routesFile, 'utf8');\n  } catch {\n    return;\n  }\n  for (const match of source.matchAll(COMPONENT_THUNK)) {\n    const spec = match[2];\n    let base: string | undefined;\n    if (spec.startsWith('.')) base = resolve(dirname(routesFile), spec);\n    else if (spec.startsWith('@/')) base = resolve(srcDir, spec.slice(2));\n    if (!base) continue;\n    for (const candidate of resolveCandidates(base)) {\n      if (isFile(candidate)) {\n        into.add(candidate);\n        break;\n      }\n    }\n  }\n}\n"]}
+{"version":3,"file":"page-files.js","sourceRoot":"","sources":["../../src/builder/page-files.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,MAAM,eAAe,GAAG,4EAA4E,CAAC;AAErG,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAElD,0GAA0G;AAC1G,6BAA6B;AAC7B,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,MAAc,EAAE,IAAiB;IACjF,IAAI,CAAC,KAAK,EAAE,CAAC;IACb,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAwB,CAAC;QAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;aAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACpB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * Finds the page modules named by inline `component: () => import('…')` thunks in `routes.ts`, so the server\n * compiler can put `page-entry-loader.cjs` in front of exactly those files. A page wired up any other way\n * declares its `'use server-entry'` directive itself.\n */\nimport { readFileSync, statSync } from 'node:fs';\nimport { dirname, join, resolve } from 'node:path';\n\nconst COMPONENT_THUNK = /component:\\s*(?:async\\s*)?\\(\\s*\\)\\s*=>\\s*import\\(\\s*(['\"])([^'\"]+)\\1\\s*\\)/g;\n\nconst EXTENSIONS = ['.tsx', '.ts', '.jsx', '.js'];\n\n// `join` rather than `base + '/index…'`: these are compared against Rspack's own resource paths, which on\n// Windows carry backslashes.\nfunction resolveCandidates(base: string): string[] {\n  return [...EXTENSIONS.map((ext) => base + ext), ...EXTENSIONS.map((ext) => join(base, `index${ext}`)), base];\n}\n\nfunction isFile(path: string): boolean {\n  try {\n    return statSync(path).isFile();\n  } catch {\n    return false;\n  }\n}\n\nexport function scanPageFiles(routesFile: string, srcDir: string, into: Set<string>): void {\n  into.clear();\n  let source: string;\n  try {\n    source = readFileSync(routesFile, 'utf8');\n  } catch {\n    return;\n  }\n  for (const match of source.matchAll(COMPONENT_THUNK)) {\n    const spec = match[2];\n    let base: string | undefined;\n    if (spec.startsWith('.')) base = resolve(dirname(routesFile), spec);\n    else if (spec.startsWith('@/')) base = resolve(srcDir, spec.slice(2));\n    if (!base) continue;\n    for (const candidate of resolveCandidates(base)) {\n      if (isFile(candidate)) {\n        into.add(candidate);\n        break;\n      }\n    }\n  }\n}\n"]}

package/dist/builder/public-env.d.ts

@@ -1,2 +1,8 @@
+/**
+ * The `process.env` view compiled into the browser bundle: `NODE_ENV` plus the `PUBLIC_`-prefixed variables.
+ * A stray read of anything else in client code becomes `undefined` rather than shipping the value.
+ *
+ * Also what `env-shadow-loader.cjs` shadows SSR-layer modules with, so the server renders what the browser
+ * hydrates.
+ */
 export declare function publicEnv(isDev: boolean): Record<string, string>;
-//# sourceMappingURL=public-env.d.ts.map

package/dist/builder/public-env.js

@@ -1,3 +1,10 @@
+/**
+ * The `process.env` view compiled into the browser bundle: `NODE_ENV` plus the `PUBLIC_`-prefixed variables.
+ * A stray read of anything else in client code becomes `undefined` rather than shipping the value.
+ *
+ * Also what `env-shadow-loader.cjs` shadows SSR-layer modules with, so the server renders what the browser
+ * hydrates.
+ */
 export function publicEnv(isDev) {
     const entries = Object.entries(process.env).filter((entry) => entry[0].startsWith('PUBLIC_') && entry[1] !== undefined);
     return { NODE_ENV: isDev ? 'development' : 'production', ...Object.fromEntries(entries) };

package/dist/builder/public-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"public-env.js","sourceRoot":"","sources":["../../src/builder/public-env.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACnJ,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAC5F,CAAC","sourcesContent":["export function publicEnv(isDev: boolean): Record<string, string> {\n  const entries = Object.entries(process.env).filter((entry): entry is [string, string] => entry[0].startsWith('PUBLIC_') && entry[1] !== undefined);\n  return { NODE_ENV: isDev ? 'development' : 'production', ...Object.fromEntries(entries) };\n}\n"]}
+{"version":3,"file":"public-env.js","sourceRoot":"","sources":["../../src/builder/public-env.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACnJ,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAC5F,CAAC","sourcesContent":["/**\n * The `process.env` view compiled into the browser bundle: `NODE_ENV` plus the `PUBLIC_`-prefixed variables.\n * A stray read of anything else in client code becomes `undefined` rather than shipping the value.\n *\n * Also what `env-shadow-loader.cjs` shadows SSR-layer modules with, so the server renders what the browser\n * hydrates.\n */\nexport function publicEnv(isDev: boolean): Record<string, string> {\n  const entries = Object.entries(process.env).filter((entry): entry is [string, string] => entry[0].startsWith('PUBLIC_') && entry[1] !== undefined);\n  return { NODE_ENV: isDev ? 'development' : 'production', ...Object.fromEntries(entries) };\n}\n"]}

package/dist/builder/react-versions.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Fails the build when `react` and `react-dom` resolve to different versions, and warns when they are not the
+ * version this release was tested with.
+ *
+ * The mismatch is an error because it never works. A different minor is only a warning: upstream declares
+ * `^19.1.0` and may well be right, and refusing to build would make rshono the reason an app cannot take a
+ * React release — a worse failure than the one it would prevent.
+ *
+ * @param rootDir - The project root, so resolution follows the *app's* `node_modules` rather than the
+ *   framework's.
+ */
+export declare function checkReactVersions(rootDir: string): void;

package/dist/builder/react-versions.js

@@ -0,0 +1,74 @@
+/**
+ * The one dependency check the framework makes on an app: that `react` and `react-dom` are the same build.
+ *
+ * React Server Components couple the two across bundles — `react-server-dom-rspack` reaches into
+ * `ReactSharedInternals` and emits a flight payload the *matching* `react-dom` has to parse — so a split
+ * resolution is not version skew to be tolerated. It is a crash inside minified React at render time, with
+ * nothing in the message pointing at the cause.
+ *
+ * The monorepo prevents it with `overrides` in `pnpm-workspace.yaml` and `packages/create` pins both exactly
+ * for the same reason, because a generated app has no overrides to rely on. Neither helps an app that grew
+ * past its scaffold, which is why the check lives here — on the one path every `dev` and `build` takes.
+ */
+import { createRequire } from 'node:module';
+import { join } from 'node:path';
+/**
+ * The React this release was tested against, read off the framework's own manifest rather than restated as a
+ * constant — the pin and the check cannot drift apart that way. `undefined` if it cannot be read, which only
+ * turns the advisory warning off.
+ */
+function testedReactVersion() {
+    try {
+        const manifest = createRequire(import.meta.url)('../../package.json');
+        return manifest.devDependencies?.react;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The version of an installed package as the *app* resolves it, or `undefined` if it has none. */
+function installedVersion(require, name) {
+    try {
+        return require(`${name}/package.json`).version;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** `19.2.8` → `19.2`, for comparing minors without pulling in a semver parser. */
+function minor(version) {
+    return version.split('.', 2).join('.');
+}
+/**
+ * Fails the build when `react` and `react-dom` resolve to different versions, and warns when they are not the
+ * version this release was tested with.
+ *
+ * The mismatch is an error because it never works. A different minor is only a warning: upstream declares
+ * `^19.1.0` and may well be right, and refusing to build would make rshono the reason an app cannot take a
+ * React release — a worse failure than the one it would prevent.
+ *
+ * @param rootDir - The project root, so resolution follows the *app's* `node_modules` rather than the
+ *   framework's.
+ */
+export function checkReactVersions(rootDir) {
+    // Resolved from the project's manifest, so a pnpm layout answers with what the app actually gets.
+    const require = createRequire(join(rootDir, 'package.json'));
+    const react = installedVersion(require, 'react');
+    const reactDom = installedVersion(require, 'react-dom');
+    // Missing altogether is the resolver's to report, against the import that needed it and with the path.
+    if (!react || !reactDom)
+        return;
+    if (react !== reactDom) {
+        throw new Error(`[rshono] react ${react} and react-dom ${reactDom} resolve to different versions.\n` +
+            '  React Server Components couple them: the RSC runtime emits a payload the matching react-dom parses, ' +
+            'so a split resolution fails inside React while rendering rather than here.\n' +
+            '  Install both at the same version. If a transitive dependency is what split them, pin them — ' +
+            '`overrides` in npm, `pnpm.overrides` in pnpm, `resolutions` in yarn.');
+    }
+    const tested = testedReactVersion();
+    if (tested && minor(tested) !== minor(react)) {
+        console.warn(`  ⚠ react ${react} is not the ${minor(tested)}.x this rshono was tested against. The RSC runtime is pinned\n` +
+            '    to an exact version and reaches into React internals, so a different minor can fail at render time.');
+    }
+}
+//# sourceMappingURL=react-versions.js.map

package/dist/builder/react-versions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"react-versions.js","sourceRoot":"","sources":["../../src/builder/react-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;GAIG;AACH,SAAS,kBAAkB;IACzB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAEnE,CAAC;QACF,OAAO,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,SAAS,gBAAgB,CAAC,OAAuB,EAAE,IAAY;IAC7D,IAAI,CAAC;QACH,OAAQ,OAAO,CAAC,GAAG,IAAI,eAAe,CAA0B,CAAC,OAAO,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,kGAAkG;IAClG,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxD,uGAAuG;IACvG,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEhC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,kBAAkB,KAAK,kBAAkB,QAAQ,mCAAmC;YAClF,wGAAwG;YACxG,8EAA8E;YAC9E,gGAAgG;YAChG,sEAAsE,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,IAAI,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CACV,aAAa,KAAK,eAAe,KAAK,CAAC,MAAM,CAAC,gEAAgE;YAC5G,yGAAyG,CAC5G,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["/**\n * The one dependency check the framework makes on an app: that `react` and `react-dom` are the same build.\n *\n * React Server Components couple the two across bundles — `react-server-dom-rspack` reaches into\n * `ReactSharedInternals` and emits a flight payload the *matching* `react-dom` has to parse — so a split\n * resolution is not version skew to be tolerated. It is a crash inside minified React at render time, with\n * nothing in the message pointing at the cause.\n *\n * The monorepo prevents it with `overrides` in `pnpm-workspace.yaml` and `packages/create` pins both exactly\n * for the same reason, because a generated app has no overrides to rely on. Neither helps an app that grew\n * past its scaffold, which is why the check lives here — on the one path every `dev` and `build` takes.\n */\nimport { createRequire } from 'node:module';\nimport { join } from 'node:path';\n\n/**\n * The React this release was tested against, read off the framework's own manifest rather than restated as a\n * constant — the pin and the check cannot drift apart that way. `undefined` if it cannot be read, which only\n * turns the advisory warning off.\n */\nfunction testedReactVersion(): string | undefined {\n  try {\n    const manifest = createRequire(import.meta.url)('../../package.json') as {\n      devDependencies?: Record<string, string>;\n    };\n    return manifest.devDependencies?.react;\n  } catch {\n    return undefined;\n  }\n}\n\n/** The version of an installed package as the *app* resolves it, or `undefined` if it has none. */\nfunction installedVersion(require: NodeJS.Require, name: string): string | undefined {\n  try {\n    return (require(`${name}/package.json`) as { version?: string }).version;\n  } catch {\n    return undefined;\n  }\n}\n\n/** `19.2.8` → `19.2`, for comparing minors without pulling in a semver parser. */\nfunction minor(version: string): string {\n  return version.split('.', 2).join('.');\n}\n\n/**\n * Fails the build when `react` and `react-dom` resolve to different versions, and warns when they are not the\n * version this release was tested with.\n *\n * The mismatch is an error because it never works. A different minor is only a warning: upstream declares\n * `^19.1.0` and may well be right, and refusing to build would make rshono the reason an app cannot take a\n * React release — a worse failure than the one it would prevent.\n *\n * @param rootDir - The project root, so resolution follows the *app's* `node_modules` rather than the\n *   framework's.\n */\nexport function checkReactVersions(rootDir: string): void {\n  // Resolved from the project's manifest, so a pnpm layout answers with what the app actually gets.\n  const require = createRequire(join(rootDir, 'package.json'));\n  const react = installedVersion(require, 'react');\n  const reactDom = installedVersion(require, 'react-dom');\n  // Missing altogether is the resolver's to report, against the import that needed it and with the path.\n  if (!react || !reactDom) return;\n\n  if (react !== reactDom) {\n    throw new Error(\n      `[rshono] react ${react} and react-dom ${reactDom} resolve to different versions.\\n` +\n        '  React Server Components couple them: the RSC runtime emits a payload the matching react-dom parses, ' +\n        'so a split resolution fails inside React while rendering rather than here.\\n' +\n        '  Install both at the same version. If a transitive dependency is what split them, pin them — ' +\n        '`overrides` in npm, `pnpm.overrides` in pnpm, `resolutions` in yarn.',\n    );\n  }\n\n  const tested = testedReactVersion();\n  if (tested && minor(tested) !== minor(react)) {\n    console.warn(\n      `  ⚠ react ${react} is not the ${minor(tested)}.x this rshono was tested against. The RSC runtime is pinned\\n` +\n        '    to an exact version and reaches into React internals, so a different minor can fail at render time.',\n    );\n  }\n}\n"]}

package/dist/builder/rspack-config.d.ts

@@ -1,14 +1,23 @@
 import { type RspackOptions } from '@rspack/core';
-import type { RSHonoConfig } from '../config.js';
+import type { RshonoConfig } from '../config.js';
 import type { DeployPreset } from '../deploy/presets.js';
+/**
+ * The directory a command writes its bundles to, relative to the project root — one per command, never
+ * shared: a `rshono build` alongside a running `rshono dev` would `clean` away the route chunks that
+ * server imports lazily, and Rspack's watch-mode emit never re-emits a file it believes it wrote.
+ *
+ * Both names are a single level under the root, which `deploy/filesystem.ts` relies on to derive the
+ * project root from where the bundle ended up.
+ */
+export declare const BUILD_OUT_DIR = "dist";
+export declare const DEV_OUT_DIR = ".rshono";
 export interface RspackConfigOptions {
     rootDir: string;
     isDev: boolean;
-    /** The project's resolved config — supplies the {@link RSHonoConfig.rspack} hook and the runtime settings baked into the server bundle. */
-    config: RSHonoConfig;
+    /** The project's resolved config — supplies the {@link RshonoConfig.rspack} hook and the runtime settings baked into the server bundle. */
+    config: RshonoConfig;
     /** The platform being built for: decides the `@rshono/deploy` runtime and any server-compiler overrides. */
     preset: DeployPreset;
     onServerComponentChanges?: () => void;
 }
 export declare function createConfigs(options: RspackConfigOptions): [RspackOptions, RspackOptions];
-//# sourceMappingURL=rspack-config.d.ts.map