@timber-js/app 0.1.28 → 0.1.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timber-js/app",
-  "version": "0.1.28",
+  "version": "0.1.29",
   "description": "Vite-native React framework for Cloudflare Workers — correct HTTP semantics, real status codes, pages that work without JavaScript",
   "keywords": [
     "cloudflare-workers",

package/src/cli.ts

@@ -54,12 +54,19 @@ export function parseArgs(args: string[]): ParsedArgs {
 
 // ─── Command Implementations ─────────────────────────────────────────────────
 
+/** @internal Dependency injection for testing. */
+export interface ViteDeps {
+  createServer?: typeof import('vite').createServer;
+  createBuilder?: typeof import('vite').createBuilder;
+  preview?: typeof import('vite').preview;
+}
+
 /**
  * Start the Vite dev server.
  * Middleware re-runs on file change via HMR wiring in timber-routing.
  */
-export async function runDev(options: CommandOptions): Promise<void> {
-  const { createServer } = await import('vite');
+export async function runDev(options: CommandOptions, _deps?: ViteDeps): Promise<void> {
+  const createServer = _deps?.createServer ?? (await import('vite')).createServer;
   const server = await createServer({
     configFile: options.config,
   });
@@ -72,8 +79,8 @@ export async function runDev(options: CommandOptions): Promise<void> {
  * Direct build() calls do NOT trigger the RSC plugin's multi-environment
  * pipeline — createBuilder/buildApp is required.
  */
-export async function runBuild(options: CommandOptions): Promise<void> {
-  const { createBuilder } = await import('vite');
+export async function runBuild(options: CommandOptions, _deps?: ViteDeps): Promise<void> {
+  const createBuilder = _deps?.createBuilder ?? (await import('vite')).createBuilder;
   const builder = await createBuilder({
     configFile: options.config,
   });
@@ -123,7 +130,7 @@ async function loadTimberConfig(
  * If the adapter provides a preview() method, it takes priority.
  * Otherwise falls back to Vite's built-in preview server.
  */
-export async function runPreview(options: CommandOptions): Promise<void> {
+export async function runPreview(options: CommandOptions, _deps?: ViteDeps): Promise<void> {
   const { join } = await import('node:path');
 
   // Try to load timber config for adapter-specific preview
@@ -139,7 +146,7 @@ export async function runPreview(options: CommandOptions): Promise<void> {
   }
 
   // Fallback: Vite's built-in preview server
-  const { preview } = await import('vite');
+  const preview = _deps?.preview ?? (await import('vite')).preview;
   const server = await preview({
     configFile: options.config,
   });

package/src/index.ts

@@ -303,7 +303,7 @@ export function timber(config?: TimberUserConfig): PluginOption[] {
   // Also loads timber.config.ts and merges it into ctx.config (inline config wins).
   const rootSync: Plugin = {
     name: 'timber-root-sync',
-    async config(userConfig) {
+    async config(userConfig, { command }) {
       // Load timber.config.ts early — before configResolved/buildStart — so
       // all plugins (including timber-mdx) see the merged config in their
       // buildStart hooks. The config hook runs once and supports async.
@@ -315,6 +315,29 @@ export function timber(config?: TimberUserConfig): PluginOption[] {
         ctx.clientJavascript = resolveClientJavascript(ctx.config);
       }
       ctx.timer.end('config-load');
+
+      // Force production JSX transform for builds.
+      //
+      // Vite determines dev vs prod JSX via `isProduction`, which checks
+      // `process.env.NODE_ENV === 'production'`. If the shell has
+      // NODE_ENV=development (common in dev toolchains), `vite build`
+      // respects that and emits jsxDEV calls with fileName/lineNumber
+      // args. This causes runtime crashes because the production React
+      // jsx-runtime doesn't export jsxDEV, and also leaks file paths
+      // into production bundles (security concern).
+      //
+      // We explicitly set `oxc.jsx.development: false` for builds so
+      // the client bundle always uses jsx/jsxs from react/jsx-runtime,
+      // regardless of the ambient NODE_ENV value.
+      if (command === 'build') {
+        return {
+          oxc: {
+            jsx: {
+              development: false,
+            },
+          },
+        };
+      }
     },
     configResolved(resolved) {
       ctx.root = resolved.root;