@timber-js/app 0.2.0-alpha.183 → 0.2.0-alpha.184

package/dist/index.js

@@ -20,7 +20,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { styleText } from "node:util";
 import { constants, createGzip, gzipSync } from "node:zlib";
 import { createHash, randomUUID } from "node:crypto";
-import { copyFile, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { copyFile, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 //#region src/plugins/content.ts
 var CONFIG_FILE_NAMES$1 = [
 	"content-collections.ts",
@@ -3491,7 +3491,7 @@ function filterBySubsets(faces, subsets) {
 * Generate a content hash for font data.
 * Returns the first 8 hex chars of the SHA-256 hash.
 */
-function contentHash(data) {
+function contentHash$1(data) {
 	return createHash("sha256").update(data).digest("hex").slice(0, 8);
 }
 /**
@@ -3502,7 +3502,7 @@ function contentHash(data) {
 */
 function hashedFontFilename(face, data) {
 	const slug = face.family.toLowerCase().replace(/\s+/g, "-");
-	const hash = contentHash(data);
+	const hash = contentHash$1(data);
 	return `${slug}-${face.subset}-${face.weight}-${face.style}-${hash}.woff2`;
 }
 /**
@@ -4733,7 +4733,7 @@ var FontPipeline = class {
 			const absolutePath = normalize(resolve(src.path));
 			if (!existsSync(absolutePath)) continue;
 			const data = readFileSync(absolutePath);
-			src.hashedBasename = hashedFontBasename(src.path, contentHash(data));
+			src.hashedBasename = hashedFontBasename(src.path, contentHash$1(data));
 		}
 		this._entries.set(entry.id, entry);
 	}
@@ -6578,6 +6578,30 @@ async function stripJsFromRscAssetsManifests(buildDir) {
 	}
 }
 //#endregion
+//#region src/server/flight-scripts.ts
+/**
+* Shared Flight data script generation.
+*
+* Both html-injectors.ts (Web Streams / dev) and node-stream-transforms.ts
+* (Node streams / production) use this module to generate inline `<script>`
+* tags for RSC Flight data injection.
+*
+* The init script goes in `<head>` as part of the HTML shell (guaranteed
+* to execute before any streaming chunk scripts). Push scripts are emitted
+* as RSC chunks arrive during streaming.
+*
+* See design/02-rendering-pipeline.md, LOCAL-415
+*/
+/**
+* Escape a JSON string for safe embedding inside an HTML `<script>` tag.
+*
+* Prevents XSS via `<\/script>` injection and handles Unicode line/paragraph
+* separators that are valid JSON but invalid in JS string literals (pre-ES2019).
+*/
+function htmlEscapeJsonString(str) {
+	return str.replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+//#endregion
 //#region src/plugins/static-build.ts
 /**
 * Patterns that indicate dynamic per-request API usage.
@@ -6684,6 +6708,10 @@ async function runStaticGeneration(ctx) {
 	const generate = mod.__timber_generateStaticSite;
 	if (typeof generate !== "function") throw new Error("[timber] Static generation: built RSC entry does not export __timber_generateStaticSite — rebuild from a clean build directory");
 	const staticDir = join(ctx.buildDir, "static-pages");
+	await rm(join(staticDir, "_rsc"), {
+		recursive: true,
+		force: true
+	}).catch(() => {});
 	await mkdir(staticDir, { recursive: true });
 	const sitemapConfig = ctx.config.sitemap;
 	const autoSitemapEnabled = Boolean(sitemapConfig?.enabled && sitemapConfig?.baseUrl);
@@ -6709,6 +6737,14 @@ async function runStaticGeneration(ctx) {
 		throw new Error(`[timber] Static generation failed:\n${details}`);
 	}
 	if (Object.keys(contentTypes).length > 0) ctx.staticContentTypes = contentTypes;
+	if (!ctx.clientJavascript.disabled) {
+		const rscManifest = await hashRscPayloads(staticDir);
+		if (Object.keys(rscManifest).length > 0) {
+			await injectRscManifestIntoHtml(staticDir, rscManifest);
+			ctx.rscManifest = rscManifest;
+			console.log(`[timber] Static generation: hashed ${Object.keys(rscManifest).length} RSC flight payloads`);
+		}
+	}
 	if (summary.redirects.length > 0) {
 		const generated = generateRedirectsFile(summary.redirects);
 		const redirectsPath = join(staticDir, "_redirects");
@@ -6724,6 +6760,79 @@ async function runStaticGeneration(ctx) {
 	return summary;
 }
 /**
+* Compute a short content hash for immutable caching.
+* Uses 8 chars of base64url-encoded SHA-256, matching Vite's asset hash style.
+*/
+function contentHash(data) {
+	return createHash("sha256").update(data).digest("base64url").slice(0, 8);
+}
+/**
+* Walk a directory recursively and return all file paths.
+*/
+async function walkDir(dir) {
+	const results = [];
+	let entries;
+	try {
+		entries = await readdir(dir, { withFileTypes: true });
+	} catch {
+		return results;
+	}
+	for (const entry of entries) {
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) results.push(...await walkDir(full));
+		else results.push(full);
+	}
+	return results;
+}
+/**
+* Hash all RSC flight payloads and params sidecars in `_rsc/`, rename
+* them with content hashes, and inject a manifest into each HTML file.
+*
+* Before: `_rsc/index.rsc`, `_rsc/about.rsc`
+* After:  `_rsc/index-B7YxEKdN.rsc`, `_rsc/about-C8ZzFLfO.rsc`
+*
+* The manifest maps the original `_rsc/` URL to the hashed filename:
+* `{"/_rsc/index.rsc":"/_rsc/index-B7YxEKdN.rsc", ...}`
+*
+* Injected into HTML as:
+* `<script>window.__TIMBER_RSC_MANIFEST__={...}<\/script>`
+*
+* @internal Exported for testing.
+*/
+async function hashRscPayloads(staticDir) {
+	const files = await walkDir(join(staticDir, "_rsc"));
+	const manifest = {};
+	for (const filePath of files) {
+		if (!filePath.endsWith(".rsc") && !filePath.endsWith(".params.json")) continue;
+		const hash = contentHash(await readFile(filePath));
+		const rel = relative(staticDir, filePath).replace(/\\/g, "/");
+		const ext = filePath.endsWith(".params.json") ? ".params.json" : ".rsc";
+		const hashedPath = `${filePath.slice(0, -ext.length)}-${hash}${ext}`;
+		await rename(filePath, hashedPath);
+		const hashedRel = relative(staticDir, hashedPath).replace(/\\/g, "/");
+		manifest[`/${rel}`] = `/${hashedRel}`;
+	}
+	return manifest;
+}
+/**
+* Inject the RSC manifest into all HTML files as a `<script>` tag
+* before `</head>`. This lets the client resolve hashed RSC URLs
+* without an extra network request.
+*
+* @internal Exported for testing.
+*/
+async function injectRscManifestIntoHtml(staticDir, manifest) {
+	const htmlFiles = (await walkDir(staticDir)).filter((f) => f.endsWith(".html"));
+	const scriptTag = `<script>window.__TIMBER_RSC_MANIFEST__=${htmlEscapeJsonString(JSON.stringify(manifest))}<\/script>`;
+	for (const htmlFile of htmlFiles) {
+		let html = await readFile(htmlFile, "utf-8");
+		const headClose = html.indexOf("</head>");
+		if (headClose !== -1) html = html.slice(0, headClose) + scriptTag + html.slice(headClose);
+		else html = scriptTag + html;
+		await writeFile(htmlFile, html);
+	}
+}
+/**
 * Read a user-authored `_redirects` file from the project's `public/`
 * directory. Returns `null` if no file exists.
 *