@tanstack/router-core 1.157.3 → 1.157.5

package/src/ssr/ssr-server.ts

@@ -1,10 +1,12 @@
 import { crossSerializeStream, getCrossReferenceHeader } from 'seroval'
 import invariant from 'tiny-invariant'
 import { decodePath } from '../utils'
+import { createLRUCache } from '../lru-cache'
 import minifiedTsrBootStrapScript from './tsrScript?script-string'
 import { GLOBAL_TSR, TSR_SCRIPT_BARRIER_ID } from './constants'
 import { defaultSerovalPlugins } from './serializer/seroval-plugins'
 import { makeSsrSerovalPlugin } from './serializer/transformer'
+import type { LRUCache } from '../lru-cache'
 import type { DehydratedMatch, DehydratedRouter } from './types'
 import type { AnySerializationAdapter } from './serializer/transformer'
 import type { AnyRouter } from '../router'
@@ -28,6 +30,10 @@ declare module '../router' {
 
 const SCOPE_ID = 'tsr'
 
+const TSR_PREFIX = GLOBAL_TSR + '.router='
+const P_PREFIX = GLOBAL_TSR + '.p(()=>'
+const P_SUFFIX = ')'
+
 export function dehydrateMatch(match: AnyRouteMatch): DehydratedMatch {
   const dehydratedMatch: DehydratedMatch = {
     i: match.id,
@@ -116,6 +122,10 @@ class ScriptBuffer {
     if (bufferedScripts.length === 0) {
       return undefined
     }
+    // Optimization: if only one script, avoid join
+    if (bufferedScripts.length === 1) {
+      return bufferedScripts[0] + ';document.currentScript.remove()'
+    }
     // Append cleanup script and join - avoid push() to not mutate then iterate
     return bufferedScripts.join(';') + ';document.currentScript.remove()'
   }
@@ -137,6 +147,23 @@ class ScriptBuffer {
   }
 }
 
+const isProd = process.env.NODE_ENV === 'production'
+
+type FilteredRoutes = Manifest['routes']
+
+type ManifestLRU = LRUCache<string, FilteredRoutes>
+
+const MANIFEST_CACHE_SIZE = 100
+const manifestCaches = new WeakMap<Manifest, ManifestLRU>()
+
+function getManifestCache(manifest: Manifest): ManifestLRU {
+  const cache = manifestCaches.get(manifest)
+  if (cache) return cache
+  const newCache = createLRUCache<string, FilteredRoutes>(MANIFEST_CACHE_SIZE)
+  manifestCaches.set(manifest, newCache)
+  return newCache
+}
+
 export function attachRouterServerSsrUtils({
   router,
   manifest,
@@ -152,13 +179,13 @@ export function attachRouterServerSsrUtils({
   const renderFinishedListeners: Array<() => void> = []
   const serializationFinishedListeners: Array<() => void> = []
   const scriptBuffer = new ScriptBuffer(router)
-  let injectedHtmlBuffer: Array<string> = []
+  let injectedHtmlBuffer = ''
 
   router.serverSsr = {
     injectHtml: (html: string) => {
       if (!html) return
       // Buffer the HTML so it can be retrieved via takeBufferedHtml()
-      injectedHtmlBuffer.push(html)
+      injectedHtmlBuffer += html
       // Emit event to notify subscribers that new HTML is available
       router.emit({
         type: 'onInjectedHtml',
@@ -182,31 +209,41 @@ export function attachRouterServerSsrUtils({
       // For currently matched routes, send full manifest (preloads + assets)
       // For all other routes, only send assets (no preloads as they are handled via dynamic imports)
       if (manifest) {
-        const currentRouteIds = new Set(
-          router.state.matches.map((k) => k.routeId),
-        )
-        const filteredRoutes = Object.fromEntries(
-          Object.entries(manifest.routes).flatMap(
-            ([routeId, routeManifest]) => {
-              if (currentRouteIds.has(routeId)) {
-                return [[routeId, routeManifest]]
-              } else if (
-                routeManifest.assets &&
-                routeManifest.assets.length > 0
-              ) {
-                return [
-                  [
-                    routeId,
-                    {
-                      assets: routeManifest.assets,
-                    },
-                  ],
-                ]
+        // Prod-only caching; in dev manifests may be replaced/updated (HMR)
+        const currentRouteIdsList = matchesToDehydrate.map((m) => m.routeId)
+        const manifestCacheKey = currentRouteIdsList.join('\0')
+
+        let filteredRoutes: FilteredRoutes | undefined
+
+        if (isProd) {
+          filteredRoutes = getManifestCache(manifest).get(manifestCacheKey)
+        }
+
+        if (!filteredRoutes) {
+          const currentRouteIds = new Set(currentRouteIdsList)
+          const nextFilteredRoutes: FilteredRoutes = {}
+
+          for (const routeId in manifest.routes) {
+            const routeManifest = manifest.routes[routeId]!
+            if (currentRouteIds.has(routeId)) {
+              nextFilteredRoutes[routeId] = routeManifest
+            } else if (
+              routeManifest.assets &&
+              routeManifest.assets.length > 0
+            ) {
+              nextFilteredRoutes[routeId] = {
+                assets: routeManifest.assets,
               }
-              return []
-            },
-          ),
-        )
+            }
+          }
+
+          if (isProd) {
+            getManifestCache(manifest).set(manifestCacheKey, nextFilteredRoutes)
+          }
+
+          filteredRoutes = nextFilteredRoutes
+        }
+
         manifestToDehydrate = {
           routes: filteredRoutes,
         }
@@ -252,9 +289,9 @@ export function attachRouterServerSsrUtils({
         refs: new Map(),
         plugins,
         onSerialize: (data, initial) => {
-          let serialized = initial ? GLOBAL_TSR + '.router=' + data : data
+          let serialized = initial ? TSR_PREFIX + data : data
           if (trackPlugins.didRun) {
-            serialized = GLOBAL_TSR + '.p(()=>' + serialized + ')'
+            serialized = P_PREFIX + serialized + P_SUFFIX
           }
           scriptBuffer.enqueue(serialized)
         },
@@ -310,11 +347,11 @@ export function attachRouterServerSsrUtils({
       scriptBuffer.liftBarrier()
     },
     takeBufferedHtml() {
-      if (injectedHtmlBuffer.length === 0) {
+      if (!injectedHtmlBuffer) {
         return undefined
       }
-      const buffered = injectedHtmlBuffer.join('')
-      injectedHtmlBuffer = []
+      const buffered = injectedHtmlBuffer
+      injectedHtmlBuffer = ''
       return buffered
     },
     cleanup() {
@@ -322,7 +359,7 @@ export function attachRouterServerSsrUtils({
       if (!router.serverSsr) return
       renderFinishedListeners.length = 0
       serializationFinishedListeners.length = 0
-      injectedHtmlBuffer = []
+      injectedHtmlBuffer = ''
       scriptBuffer.cleanup()
       router.serverSsr = undefined
     },

package/src/ssr/transformStreamWithRouter.ts

@@ -107,60 +107,136 @@ export function transformStreamWithRouter(
     lifetimeMs?: number
   },
 ) {
-  let stopListeningToInjectedHtml: (() => void) | undefined
-  let stopListeningToSerializationFinished: (() => void) | undefined
-  let serializationTimeoutHandle: ReturnType<typeof setTimeout> | undefined
-  let lifetimeTimeoutHandle: ReturnType<typeof setTimeout> | undefined
-  let cleanedUp = false
-
-  let controller: ReadableStreamDefaultController<any>
-  let isStreamClosed = false
-
   // Check upfront if serialization already finished synchronously
   // This is the fast path for routes with no deferred data
   const serializationAlreadyFinished =
     router.serverSsr?.isSerializationFinished() ?? false
 
-  /**
-   * Cleanup function with guards against multiple calls.
-   * Unsubscribes listeners, clears timeouts, frees buffers, and cleans up router SSR state.
-   */
-  function cleanup() {
-    // Guard against multiple cleanup calls - set flag first to prevent re-entry
-    if (cleanedUp) return
-    cleanedUp = true
+  // Take any HTML that was buffered before we started listening
+  const initialBufferedHtml = router.serverSsr?.takeBufferedHtml()
 
-    // Unsubscribe listeners first (wrap in try-catch for safety)
-    try {
-      stopListeningToInjectedHtml?.()
-      stopListeningToSerializationFinished?.()
-    } catch (e) {
-      // Ignore errors during unsubscription
+  // True passthrough: if serialization already finished and nothing buffered,
+  // we can avoid any decoding/scanning while still honoring cleanup + setRenderFinished.
+  if (serializationAlreadyFinished && !initialBufferedHtml) {
+    let cleanedUp = false
+    let controller: ReadableStreamDefaultController<Uint8Array> | undefined
+    let isStreamClosed = false
+    let lifetimeTimeoutHandle: ReturnType<typeof setTimeout> | undefined
+
+    const cleanup = () => {
+      if (cleanedUp) return
+      cleanedUp = true
+
+      if (lifetimeTimeoutHandle !== undefined) {
+        clearTimeout(lifetimeTimeoutHandle)
+        lifetimeTimeoutHandle = undefined
+      }
+
+      router.serverSsr?.cleanup()
     }
-    stopListeningToInjectedHtml = undefined
-    stopListeningToSerializationFinished = undefined
 
-    // Clear all timeouts
-    if (serializationTimeoutHandle !== undefined) {
-      clearTimeout(serializationTimeoutHandle)
-      serializationTimeoutHandle = undefined
+    const safeClose = () => {
+      if (isStreamClosed) return
+      isStreamClosed = true
+      try {
+        controller?.close()
+      } catch {
+        // ignore
+      }
     }
-    if (lifetimeTimeoutHandle !== undefined) {
-      clearTimeout(lifetimeTimeoutHandle)
-      lifetimeTimeoutHandle = undefined
+
+    const safeError = (error: unknown) => {
+      if (isStreamClosed) return
+      isStreamClosed = true
+      try {
+        controller?.error(error)
+      } catch {
+        // ignore
+      }
     }
 
-    // Clear buffers to free memory
-    pendingRouterHtmlParts = []
-    leftover = ''
-    pendingClosingTags = ''
+    const lifetimeMs = opts?.lifetimeMs ?? DEFAULT_LIFETIME_TIMEOUT_MS
+    lifetimeTimeoutHandle = setTimeout(() => {
+      if (!cleanedUp && !isStreamClosed) {
+        console.warn(
+          `SSR stream transform exceeded maximum lifetime (${lifetimeMs}ms), forcing cleanup`,
+        )
+        safeError(new Error('Stream lifetime exceeded'))
+        cleanup()
+      }
+    }, lifetimeMs)
 
-    // Clean up router SSR state (has its own guard)
-    router.serverSsr?.cleanup()
+    const stream = new ReadableStream<Uint8Array>({
+      start(c) {
+        controller = c
+      },
+      cancel() {
+        isStreamClosed = true
+        cleanup()
+      },
+    })
+
+    ;(async () => {
+      const reader = appStream.getReader()
+      try {
+        while (true) {
+          const { done, value } = await reader.read()
+          if (done) break
+          if (cleanedUp || isStreamClosed) return
+          controller?.enqueue(value as unknown as Uint8Array)
+        }
+
+        if (cleanedUp || isStreamClosed) return
+
+        router.serverSsr?.setRenderFinished()
+        safeClose()
+        cleanup()
+      } catch (error) {
+        if (cleanedUp) return
+        console.error('Error reading appStream:', error)
+        router.serverSsr?.setRenderFinished()
+        safeError(error)
+        cleanup()
+      } finally {
+        reader.releaseLock()
+      }
+    })().catch((error) => {
+      if (cleanedUp) return
+      console.error('Error in stream transform:', error)
+      safeError(error)
+      cleanup()
+    })
+
+    return stream
   }
 
+  let stopListeningToInjectedHtml: (() => void) | undefined
+  let stopListeningToSerializationFinished: (() => void) | undefined
+  let serializationTimeoutHandle: ReturnType<typeof setTimeout> | undefined
+  let lifetimeTimeoutHandle: ReturnType<typeof setTimeout> | undefined
+  let cleanedUp = false
+
+  let controller: ReadableStreamDefaultController<any>
+  let isStreamClosed = false
+
   const textDecoder = new TextDecoder()
 
+  // concat'd router HTML; avoids array joins on each flush
+  let pendingRouterHtml = initialBufferedHtml ?? ''
+
+  // between-chunk text buffer; keep bounded to avoid unbounded memory
+  let leftover = ''
+
+  // captured closing tags from </body> onward
+  let pendingClosingTags = ''
+
+  // conservative cap: enough to hold any partial closing tag + a bit
+  const MAX_LEFTOVER_CHARS = 2048
+
+  let isAppRendering = true
+  let streamBarrierLifted = false
+  let serializationFinished = serializationAlreadyFinished
+
   function safeEnqueue(chunk: string | Uint8Array) {
     if (isStreamClosed) return
     if (typeof chunk === 'string') {
@@ -176,7 +252,7 @@ export function transformStreamWithRouter(
     try {
       controller.close()
     } catch {
-      // Stream may already be errored or closed by consumer - safe to ignore
+      // ignore
     }
   }
 
@@ -186,10 +262,42 @@ export function transformStreamWithRouter(
     try {
       controller.error(error)
     } catch {
-      // Stream may already be errored or closed by consumer - safe to ignore
+      // ignore
     }
   }
 
+  /**
+   * Cleanup with guards; must be idempotent.
+   */
+  function cleanup() {
+    if (cleanedUp) return
+    cleanedUp = true
+
+    try {
+      stopListeningToInjectedHtml?.()
+      stopListeningToSerializationFinished?.()
+    } catch {
+      // ignore
+    }
+    stopListeningToInjectedHtml = undefined
+    stopListeningToSerializationFinished = undefined
+
+    if (serializationTimeoutHandle !== undefined) {
+      clearTimeout(serializationTimeoutHandle)
+      serializationTimeoutHandle = undefined
+    }
+    if (lifetimeTimeoutHandle !== undefined) {
+      clearTimeout(lifetimeTimeoutHandle)
+      lifetimeTimeoutHandle = undefined
+    }
+
+    pendingRouterHtml = ''
+    leftover = ''
+    pendingClosingTags = ''
+
+    router.serverSsr?.cleanup()
+  }
+
   const stream = new ReadableStream({
     start(c) {
       controller = c
@@ -200,36 +308,24 @@ export function transformStreamWithRouter(
     },
   })
 
-  let isAppRendering = true
-  let streamBarrierLifted = false
-  let leftover = ''
-  let pendingClosingTags = ''
-  let serializationFinished = serializationAlreadyFinished
-
-  let pendingRouterHtmlParts: Array<string> = []
-
-  // Take any HTML that was buffered before we started listening
-  const bufferedHtml = router.serverSsr?.takeBufferedHtml()
-  if (bufferedHtml) {
-    pendingRouterHtmlParts.push(bufferedHtml)
+  function flushPendingRouterHtml() {
+    if (!pendingRouterHtml) return
+    safeEnqueue(pendingRouterHtml)
+    pendingRouterHtml = ''
   }
 
-  function flushPendingRouterHtml() {
-    if (pendingRouterHtmlParts.length > 0) {
-      safeEnqueue(pendingRouterHtmlParts.join(''))
-      pendingRouterHtmlParts = []
-    }
+  function appendRouterHtml(html: string) {
+    if (!html) return
+    pendingRouterHtml += html
   }
 
   /**
-   * Attempts to finish the stream if all conditions are met.
+   * Finish only when app done and serialization complete.
    */
   function tryFinish() {
-    // Can only finish when app is done rendering and serialization is complete
     if (isAppRendering || !serializationFinished) return
     if (cleanedUp || isStreamClosed) return
 
-    // Clear serialization timeout since we're finishing
     if (serializationTimeoutHandle !== undefined) {
       clearTimeout(serializationTimeoutHandle)
       serializationTimeoutHandle = undefined
@@ -247,8 +343,7 @@ export function transformStreamWithRouter(
     cleanup()
   }
 
-  // Set up lifetime timeout as a safety net
-  // This ensures cleanup happens even if the stream is never consumed or gets stuck
+  // Safety net: cleanup even if consumer never reads
   const lifetimeMs = opts?.lifetimeMs ?? DEFAULT_LIFETIME_TIMEOUT_MS
   lifetimeTimeoutHandle = setTimeout(() => {
     if (!cleanedUp && !isStreamClosed) {
@@ -260,27 +355,21 @@ export function transformStreamWithRouter(
     }
   }, lifetimeMs)
 
-  // Only set up listeners if serialization hasn't already finished
-  // This avoids unnecessary subscriptions for the common case of no deferred data
   if (!serializationAlreadyFinished) {
-    // Listen for injected HTML (for deferred data that resolves later)
     stopListeningToInjectedHtml = router.subscribe('onInjectedHtml', () => {
       if (cleanedUp || isStreamClosed) return
-
-      // Retrieve buffered HTML
       const html = router.serverSsr?.takeBufferedHtml()
       if (!html) return
 
-      if (isAppRendering) {
-        // Buffer for insertion at next valid position
-        pendingRouterHtmlParts.push(html)
+      // If we've already captured </body> (pendingClosingTags), we must keep appending
+      // so injection stays before the stored closing tags.
+      if (isAppRendering || leftover || pendingClosingTags) {
+        appendRouterHtml(html)
       } else {
-        // App is done rendering, write directly to output
         safeEnqueue(html)
       }
     })
 
-    // Listen for serialization finished
     stopListeningToSerializationFinished = router.subscribe(
       'onSerializationFinished',
       () => {
@@ -298,16 +387,16 @@ export function transformStreamWithRouter(
         const { done, value } = await reader.read()
         if (done) break
 
-        // Don't process if already cleaned up
         if (cleanedUp || isStreamClosed) return
 
         const text =
           value instanceof Uint8Array
             ? textDecoder.decode(value, { stream: true })
             : String(value)
-        const chunkString = leftover + text
 
-        // Check for stream barrier (script placeholder) - use indexOf for efficiency
+        // Fast path: most chunks have no pending left-over.
+        const chunkString = leftover ? leftover + text : text
+
         if (!streamBarrierLifted) {
           if (chunkString.includes(TSR_SCRIPT_BARRIER_ID)) {
             streamBarrierLifted = true
@@ -315,70 +404,63 @@ export function transformStreamWithRouter(
           }
         }
 
-        // Check for body/html end tags
+        // If we already saw </body>, everything else is part of tail; buffer it.
+        if (pendingClosingTags) {
+          pendingClosingTags += chunkString
+          leftover = ''
+          continue
+        }
+
         const bodyEndIndex = chunkString.indexOf(BODY_END_TAG)
         const htmlEndIndex = chunkString.indexOf(HTML_END_TAG)
 
-        // If we have both </body> and </html> in proper order,
-        // insert router HTML before </body> and hold the closing tags
         if (
           bodyEndIndex !== -1 &&
           htmlEndIndex !== -1 &&
           bodyEndIndex < htmlEndIndex
         ) {
           pendingClosingTags = chunkString.slice(bodyEndIndex)
-
           safeEnqueue(chunkString.slice(0, bodyEndIndex))
           flushPendingRouterHtml()
-
           leftover = ''
           continue
         }
 
-        // Handling partial closing tags split across chunks:
-        //
-        // Since `chunkString = leftover + text`, any incomplete tag fragment from the
-        // previous chunk is prepended to the current chunk, allowing split tags like
-        // "</di" + "v>" to be re-detected as a complete "</div>" in the combined string.
-        //
-        // - If a closing tag IS found (lastClosingTagEnd > 0): We enqueue content up to
-        //   the end of that tag, flush router HTML, and store the remainder in `leftover`.
-        //   This remainder may contain a partial tag (e.g., "</sp") which will be
-        //   prepended to the next chunk for re-detection.
-        //
-        // - If NO closing tag is found: The entire chunk is buffered in `leftover` and
-        //   will be prepended to the next chunk. This ensures partial tags are never
-        //   lost and will be detected once the rest of the tag arrives.
-        //
-        // This approach guarantees correct injection points even when closing tags span
-        // chunk boundaries.
         const lastClosingTagEnd = findLastClosingTagEnd(chunkString)
 
         if (lastClosingTagEnd > 0) {
-          // Found a closing tag - insert router HTML after it
           safeEnqueue(chunkString.slice(0, lastClosingTagEnd))
           flushPendingRouterHtml()
 
           leftover = chunkString.slice(lastClosingTagEnd)
+          if (leftover.length > MAX_LEFTOVER_CHARS) {
+            // Ensure bounded memory even if a consumer streams long text sequences
+            // without any closing tags. This may reduce injection granularity but is correct.
+            safeEnqueue(leftover.slice(0, leftover.length - MAX_LEFTOVER_CHARS))
+            leftover = leftover.slice(-MAX_LEFTOVER_CHARS)
+          }
         } else {
-          // No closing tag found - buffer the entire chunk
-          leftover = chunkString
-          // Any pending router HTML will be inserted when we find a valid position
+          // No closing tag found; keep small tail to handle split closing tags,
+          // but stream older bytes to prevent unbounded buffering.
+          const combined = chunkString
+          if (combined.length > MAX_LEFTOVER_CHARS) {
+            const flushUpto = combined.length - MAX_LEFTOVER_CHARS
+            safeEnqueue(combined.slice(0, flushUpto))
+            leftover = combined.slice(flushUpto)
+          } else {
+            leftover = combined
+          }
         }
       }
 
-      // Stream ended
       if (cleanedUp || isStreamClosed) return
 
-      // Mark the app as done rendering
       isAppRendering = false
       router.serverSsr?.setRenderFinished()
 
-      // Try to finish if serialization is already done
       if (serializationFinished) {
         tryFinish()
       } else {
-        // Set a timeout for serialization to complete
         const timeoutMs = opts?.timeoutMs ?? DEFAULT_SERIALIZATION_TIMEOUT_MS
         serializationTimeoutHandle = setTimeout(() => {
           if (!cleanedUp && !isStreamClosed) {
@@ -401,7 +483,6 @@ export function transformStreamWithRouter(
       reader.releaseLock()
     }
   })().catch((error) => {
-    // Handle any errors that occur outside the try block (e.g., getReader() failure)
     if (cleanedUp) return
     console.error('Error in stream transform:', error)
     safeError(error)