@timber-js/app 0.2.0-alpha.147 → 0.2.0-alpha.148

package/src/plugins/cache.ts

@@ -2,13 +2,21 @@
  * timber-cache-transform — Vite plugin that injects stable callsite IDs
  * into `cache()` calls imported from `@timber-js/app/cache`.
  *
- * Without this plugin, cache keys use a process-local counter (fnIdCounter)
- * which is unstable across cold starts in serverless/multi-instance
- * deployments. With a shared CacheHandler (Redis/KV), colliding counters
- * cause cache key poisoning — serving one route's cached data to another.
+ * Detected callsite forms (TIM-1054):
+ *   - named imports, including aliases: `import { cache as c }` + `c(fn, opts)`
+ *   - namespace imports: `import * as ns` + `ns.cache(fn, opts)`
+ * Forms a per-module transform cannot trace — local variable aliases
+ * (`const c = cache`), user re-export wrapper modules, computed access
+ * (`ns['cache']`) — fall back to the runtime fnId derived from
+ * fnv1a(fn.toString()) (see cache/timber-cache.ts), which is deterministic
+ * across instances and cold starts of the same build. Without either
+ * mechanism, an ordinal counter would collide across instances with a shared
+ * CacheHandler (Redis/KV) — cache key poisoning, serving one route's cached
+ * data to another.
  *
  * The plugin transforms:
- *   cache(fn, opts)  →  cache(fn, opts, "stable-id")
+ *   cache(fn, opts)      →  cache(fn, opts, "stable-id")
+ *   ns.cache(fn, opts)   →  ns.cache(fn, opts, "stable-id")
  *
  * where stable-id =
  *   fnv1a(relPath + ":cache:" + fnv1a(stmtText) + ":" + fnv1a(callSpanText) + ":" + occurrence)
@@ -81,29 +89,72 @@ interface CallExpressionNode extends PositionedNode {
   arguments: PositionedNode[];
 }
 
+interface MemberExpressionNode extends PositionedNode {
+  type: 'MemberExpression';
+  object: PositionedNode;
+  property: PositionedNode;
+  computed: boolean;
+}
+
 interface ProgramNode extends PositionedNode {
   type: 'Program';
   body: PositionedNode[];
 }
 
+interface CacheBindings {
+  /** Local names bound to `cache` via named imports (`import { cache as c }`). */
+  named: Set<string>;
+  /** Local names of namespace imports (`import * as ns`) of a cache module. */
+  namespaces: Set<string>;
+}
+
 /**
- * Find the local binding name(s) for `cache` imported from the cache module.
+ * Find the local binding name(s) for `cache` imported from the cache module —
+ * both named imports and namespace imports (TIM-1054).
  */
-function findCacheBindings(program: ProgramNode): Set<string> {
-  const bindings = new Set<string>();
+function findCacheBindings(program: ProgramNode): CacheBindings {
+  const named = new Set<string>();
+  const namespaces = new Set<string>();
   for (const stmt of program.body) {
     if (stmt.type !== 'ImportDeclaration') continue;
     const decl = stmt as unknown as ImportDeclarationNode;
     if (!CACHE_MODULE_SOURCES.has(decl.source.value)) continue;
     for (const spec of decl.specifiers) {
+      if (spec.type === 'ImportNamespaceSpecifier') {
+        namespaces.add(spec.local.name);
+        continue;
+      }
       if (spec.type !== 'ImportSpecifier') continue;
       const importedName = spec.imported?.name ?? spec.local.name;
       if (importedName === 'cache') {
-        bindings.add(spec.local.name);
+        named.add(spec.local.name);
       }
     }
   }
-  return bindings;
+  return { named, namespaces };
+}
+
+/**
+ * Is this callee a reference to the imported `cache` function — either a bare
+ * identifier bound by a named import, or `ns.cache` on a namespace import?
+ * Computed access (`ns['cache']`) is deliberately not matched; it falls back
+ * to the runtime fnId derivation.
+ */
+function isCacheCallee(callee: PositionedNode, bindings: CacheBindings): boolean {
+  if (callee.type === 'Identifier') {
+    return bindings.named.has((callee as IdentifierNode).name);
+  }
+  if (callee.type === 'MemberExpression') {
+    const member = callee as unknown as MemberExpressionNode;
+    return (
+      !member.computed &&
+      member.object.type === 'Identifier' &&
+      bindings.namespaces.has((member.object as IdentifierNode).name) &&
+      member.property.type === 'Identifier' &&
+      (member.property as IdentifierNode).name === 'cache'
+    );
+  }
+  return false;
 }
 
 /**
@@ -114,16 +165,12 @@ function findCacheBindings(program: ProgramNode): Set<string> {
  */
 function findCacheCallSites(
   node: PositionedNode,
-  cacheBindings: Set<string>,
+  cacheBindings: CacheBindings,
   results: CallExpressionNode[]
 ): void {
   if (node.type === 'CallExpression') {
     const call = node as unknown as CallExpressionNode;
-    if (
-      call.callee.type === 'Identifier' &&
-      cacheBindings.has((call.callee as IdentifierNode).name) &&
-      call.arguments.length === 2
-    ) {
+    if (call.arguments.length === 2 && isCacheCallee(call.callee, cacheBindings)) {
       results.push(call);
     }
   }
@@ -188,7 +235,7 @@ export function timberCacheTransform(ctx: PluginContext): Plugin {
       }
 
       const cacheBindings = findCacheBindings(program);
-      if (cacheBindings.size === 0) return;
+      if (cacheBindings.named.size === 0 && cacheBindings.namespaces.size === 0) return;
 
       // Collect call sites per top-level statement so each call carries its
       // enclosing statement's source text into the ID hash.

package/src/plugins/dev-server.ts

@@ -15,9 +15,9 @@
 import type { Plugin, ViteDevServer, DevEnvironment } from 'vite';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { TLSSocket } from 'node:tls';
+import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import type { PluginContext } from '../plugin-context.js';
-import { setViteServer } from '../dev-tools/warnings.js';
 import {
   sendErrorToOverlay,
   classifyErrorPhase,
@@ -30,6 +30,9 @@ import { extractHmrOptions, type DevErrorHmrOptions } from '../dev-tools/dev-pag
 import { addVirtualModuleContext } from '../config-validation.js';
 import { compressResponse } from '../server/compress.js';
 import { isMetadataRouteServePath } from '../server/metadata-routes.js';
+import { canonicalize } from '../server/canonicalize.js';
+import { matchUrlParts } from '../server/tree-match.js';
+import type { RouteTree } from '../routing/types.js';
 
 // ─── Constants ────────────────────────────────────────────────────────────
 
@@ -93,10 +96,6 @@ export function timberDevServer(ctx: PluginContext): Plugin {
       const configPaths = CONFIG_FILE_NAMES.map((name) => join(ctx.root, name));
       server.watcher.add(configPaths);
 
-      // Register Vite server for browser console warning forwarding.
-      // See 21-dev-server.md §Dev-Mode Warnings.
-      setViteServer(server);
-
       // Listen for client-side errors forwarded from the browser.
       // The browser entry sends 'timber:client-error' events via HMR
       // for uncaught errors and unhandled rejections. We echo them back
@@ -104,7 +103,7 @@ export function timberDevServer(ctx: PluginContext): Plugin {
       listenForClientErrors(server, ctx.root);
 
       // Pre-hook — registers middleware before Vite's internals
-      server.middlewares.use(createTimberMiddleware(server, ctx.root));
+      server.middlewares.use(createTimberMiddleware(server, ctx));
 
       // Wrap server.listen() to close the holding server immediately
       // before Vite binds the port — no gap where nothing is listening.
@@ -146,7 +145,8 @@ export function timberDevServer(ctx: PluginContext): Plugin {
  * For non-route requests (assets, Vite internals, HMR), the middleware
  * calls next() to let Vite handle them.
  */
-function createTimberMiddleware(server: ViteDevServer, projectRoot: string) {
+function createTimberMiddleware(server: ViteDevServer, ctx: PluginContext) {
+  const projectRoot = ctx.root;
   // Extract HMR connection options once so the error page can construct
   // a correct WebSocket URL (TIM-789).
   const hmrOptions = extractHmrOptions(server.config);
@@ -165,8 +165,16 @@ function createTimberMiddleware(server: ViteDevServer, projectRoot: string) {
     }
 
     // Pass through static asset requests — but not metadata routes like
-    // /favicon.ico that match asset extensions but are handled by timber.
-    if (isAssetRequest(url) && !isMetadataRouteServePath(url)) {
+    // /favicon.ico that match asset extensions but are handled by timber,
+    // and not registered routes like app/feed.json/route.ts whose URL ends
+    // in an asset extension. Production serves these through the RSC
+    // handler, so letting them fall through to Vite would 404 in dev only
+    // (TIM-1038).
+    if (
+      isAssetRequest(url) &&
+      !isMetadataRouteServePath(url) &&
+      !isRouteOwnedAsset(ctx.routeTree, server, url)
+    ) {
       next();
       return;
     }
@@ -513,6 +521,50 @@ function isAssetRequest(url: string): boolean {
   return ASSET_EXTENSIONS.test(url);
 }
 
+/**
+ * Check whether an asset-extension URL belongs to a scanned route rather
+ * than a static file.
+ *
+ * Route handlers may live at paths ending in asset-like extensions
+ * (app/feed.json/route.ts → /feed.json), which the asset bypass would
+ * otherwise hand to Vite — 404ing in dev while working in production.
+ * Uses the same canonicalization and tree walker as the runtime matcher
+ * so dev classification agrees with what the pipeline would match.
+ *
+ * A file that actually exists on disk wins over the route match: the
+ * production server serves public/ statics before the RSC handler (see
+ * adapters/nitro.ts), and Vite serves root-relative source files (e.g.
+ * /app/global.css) in dev. Without this, a broad catch-all route like
+ * app/[...slug] would shadow every static asset. Joining the canonical
+ * pathname is traversal-safe — canonicalize() resolves `..` segments and
+ * rejects root escapes and encoded separators.
+ *
+ * Reads ctx.routeTree per request — the routing plugin rescans it on
+ * file add/unlink/change, so newly created routes are picked up live.
+ */
+function isRouteOwnedAsset(
+  routeTree: RouteTree | null,
+  server: ViteDevServer,
+  url: string
+): boolean {
+  if (!routeTree) return false;
+  const rawPathname = url.split('?')[0];
+  const result = canonicalize(rawPathname);
+  // Malformed URLs can't match a route — let Vite handle them as before.
+  if (!result.ok) return false;
+  const parts = result.pathname === '/' ? [] : result.pathname.slice(1).split('/');
+  if (matchUrlParts(routeTree.root, parts) === null) return false;
+
+  // Real static files win over the route match (dev/prod parity: the
+  // production server tries public/ before the RSC handler).
+  const relativePath = result.pathname.slice(1);
+  const { publicDir, root } = server.config;
+  if (publicDir && existsSync(join(publicDir, relativePath))) return false;
+  if (existsSync(join(root, relativePath))) return false;
+
+  return true;
+}
+
 // ─── Client Error Listener ─────────────────────────────────────────────
 
 interface ClientErrorPayload {

package/src/plugins/fonts.ts

@@ -18,13 +18,14 @@
  * Design doc: 24-fonts.md
  */
 
-import type { Plugin, ViteDevServer } from 'vite';
+import type { Plugin, ResolvedConfig, ViteDevServer } from 'vite';
 import type { PluginContext } from '../plugin-context.js';
 import {
   downloadAndCacheFonts,
   generateProductionFontFaces,
   resolveDevFontFaces,
 } from '../fonts/google.js';
+import { fontUrlPrefix } from '../fonts/paths.js';
 import { FontPipeline } from '../fonts/pipeline.js';
 import { runFontsTransform } from '../fonts/transform.js';
 import { installFontDevMiddleware } from '../fonts/dev-middleware.js';
@@ -45,7 +46,7 @@ import {
 // updating every caller. New helpers should be added to the per-concern
 // module first and re-exported here only if external code needs them.
 
-export { FontPipeline, pruneRegistryEntries, type FontRegistry } from '../fonts/pipeline.js';
+export { FontPipeline } from '../fonts/pipeline.js';
 export {
   generateFontId,
   extractFontConfig,
@@ -54,17 +55,27 @@ export {
   parseGoogleFontFamilies,
   parseLocalFontImportName,
 } from '../fonts/transform.js';
-export { generateFontCss, generateAllFontCss } from '../fonts/virtual-modules.js';
 
 /**
  * Create the timber-fonts Vite plugin.
  */
 export function timberFonts(ctx: PluginContext): Plugin {
   const pipeline = new FontPipeline({ hashOnRegister: !ctx.dev });
+  let resolvedBase = '/';
 
   return {
     name: 'timber-fonts',
 
+    /**
+     * Capture Vite's resolved `base` so every font URL the pipeline emits
+     * (@font-face src, manifest hrefs, dev middleware matching) carries
+     * the prefix. Emitted file locations are unaffected — only URLs.
+     */
+    configResolved(config: ResolvedConfig) {
+      resolvedBase = config.base;
+      pipeline.setBase(config.base);
+    },
+
     /**
      * `enforce: 'pre'` is load-bearing for the font CSS pipeline (TIM-828).
      *
@@ -181,7 +192,7 @@ export function timberFonts(ctx: PluginContext): Plugin {
      * this middleware.
      */
     configureServer(server: ViteDevServer) {
-      installFontDevMiddleware(server, pipeline);
+      installFontDevMiddleware(server, pipeline, resolvedBase);
     },
 
     /**
@@ -208,10 +219,14 @@ export function timberFonts(ctx: PluginContext): Plugin {
       // same `CachedFont` objects; the bundle emitter dedupes by
       // `hashedFilename` so each binary is written to disk exactly once.
       const cachedByFamily = groupCachedFontsByFamily(cachedFonts);
+      const urlPrefix = fontUrlPrefix(resolvedBase);
       for (const font of googleFonts) {
         const familyCached = cachedByFamily.get(font.family.toLowerCase()) ?? [];
         pipeline.attachCachedFiles(font.id, familyCached);
-        pipeline.attachFaces(font.id, generateProductionFontFaces(familyCached, font.display));
+        pipeline.attachFaces(
+          font.id,
+          generateProductionFontFaces(familyCached, font.display, urlPrefix)
+        );
       }
     },
 
@@ -239,7 +254,7 @@ export function timberFonts(ctx: PluginContext): Plugin {
         (msg) => this.warn(msg)
       );
       if (!ctx.buildManifest) return;
-      writeFontManifest(pipeline, ctx.buildManifest);
+      writeFontManifest(pipeline, ctx.buildManifest, resolvedBase);
     },
   };
 }