@timber-js/app 0.2.0-alpha.21 → 0.2.0-alpha.210

package/src/plugins/rsc-assets-manifest.ts

@@ -0,0 +1,251 @@
+/**
+ * The RSC plugin's assets manifest (`__vite_rsc_assets_manifest.js`) — read
+ * into the build manifest, and stripped of JavaScript when client JS is off.
+ *
+ * The RSC plugin writes the file to rsc/ and ssr/ as a standalone file, not
+ * a Rollup chunk, so no `generateBundle` can intercept it; both operations
+ * work on the written files. Both run once, from the post-build phase's
+ * manifest finalization step (plugins/post-build.ts), before anything
+ * imports the built bundle.
+ *
+ * Design doc: 18-build-system.md §"Post-Build Phase"
+ */
+
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { readFile, writeFile } from 'node:fs/promises';
+import type { BuildManifest } from '../server/build-manifest.ts';
+import { swallow } from '../server/logger.ts';
+
+/**
+ * Parse the RSC assets manifest at `manifestPath`. Tries JSON.parse first
+ * (fast path for plain-string manifests); falls back to a dynamic import()
+ * for manifests that contain runtime expressions from renderBuiltUrl.
+ * Returns null if both paths fail.
+ */
+async function parseRscManifest(
+  manifestPath: string,
+  content: string
+): Promise<Record<string, unknown> | null> {
+  const jsonStr = content.replace(/^export default\s*/, '').replace(/;?\s*$/, '');
+  try {
+    return JSON.parse(jsonStr);
+  } catch {
+    // Not strict JSON — manifest likely contains renderBuiltUrl runtime
+    // expressions. Fall back to evaluating the module directly.
+  }
+
+  // When renderBuiltUrl's runtime expressions reference external helpers
+  // not defined in the manifest file, this import will fail. That's an
+  // inherent limitation: runtime-computed URLs can't be resolved at build
+  // time for <link> tag injection. The warning below provides observability.
+  try {
+    const url = pathToFileURL(manifestPath).href;
+    const mod = await import(`${url}?t=${Date.now()}`);
+    return mod.default ?? null;
+  } catch (err) {
+    swallow(err, `failed to evaluate RSC assets manifest: ${manifestPath}`, { level: 'warn' });
+    return null;
+  }
+}
+
+/**
+ * Replace all `"js": [...]` array contents with `"js": []` using balanced
+ * bracket matching. Handles nested brackets from runtime expressions like
+ * `__rbu("path/to/[slug]/file.js")`.
+ */
+function clearJsArrays(src: string): string {
+  const pattern = /"js"\s*:\s*\[/g;
+  let result = '';
+  let lastEnd = 0;
+  let match: RegExpExecArray | null;
+
+  while ((match = pattern.exec(src)) !== null) {
+    const arrayStart = match.index + match[0].length;
+    let depth = 1;
+    let i = arrayStart;
+    while (i < src.length && depth > 0) {
+      if (src[i] === '[') depth++;
+      else if (src[i] === ']') depth--;
+      i++;
+    }
+    result += src.slice(lastEnd, match.index) + '"js": []';
+    lastEnd = i;
+  }
+  result += src.slice(lastEnd);
+  return result;
+}
+
+/**
+ * Replace `"bootstrapScriptContent": <value>` with an empty string. The
+ * value may be a JS expression (e.g., concatenation with runtime helpers),
+ * not a simple string literal. Scans forward from the colon, tracking
+ * balanced parens and brackets, and stops at the next unbalanced `,` or `}`.
+ */
+function clearBootstrapScriptContent(src: string): string {
+  const key = '"bootstrapScriptContent"';
+  const idx = src.indexOf(key);
+  if (idx === -1) return src;
+
+  // Find the colon after the key
+  const colonIdx = src.indexOf(':', idx + key.length);
+  if (colonIdx === -1) return src;
+
+  // Skip whitespace after colon
+  let valStart = colonIdx + 1;
+  while (valStart < src.length && /\s/.test(src[valStart])) valStart++;
+
+  // Scan forward to find the end of the value expression
+  let i = valStart;
+  let depth = 0;
+  let inString = false;
+  let stringChar = '';
+
+  while (i < src.length) {
+    const ch = src[i];
+    if (inString) {
+      if (ch === '\\') {
+        i += 2;
+        continue;
+      }
+      if (ch === stringChar) inString = false;
+    } else {
+      if (ch === '"' || ch === "'") {
+        inString = true;
+        stringChar = ch;
+      } else if (ch === '(' || ch === '[') {
+        depth++;
+      } else if (ch === ')' || ch === ']') {
+        depth--;
+      } else if (depth === 0 && (ch === ',' || ch === '}' || ch === '\n')) {
+        break;
+      }
+    }
+    i++;
+  }
+
+  return src.slice(0, idx) + '"bootstrapScriptContent": ""' + src.slice(i);
+}
+
+/**
+ * Read the RSC plugin's assets manifest and merge per-route CSS and
+ * per-route JS modulepreloads into the build manifest.
+ *
+ * CSS: `serverResources` maps server component paths to CSS URLs.
+ * JS: `clientReferenceDeps` maps reference hashes to JS dep URLs.
+ *     Combined with `routeClientRefKeys` (from the RSC generateBundle
+ *     module graph walk) to produce per-route modulepreload entries.
+ */
+export async function mergeRscAssetsManifest(
+  rscDir: string,
+  root: string,
+  buildManifest: BuildManifest,
+  routeClientRefKeys?: Map<string, Set<string>>
+): Promise<void> {
+  const manifestPath = join(rscDir, '__vite_rsc_assets_manifest.js');
+  let content: string;
+  try {
+    content = await readFile(manifestPath, 'utf-8');
+  } catch {
+    return;
+  }
+
+  const manifest = await parseRscManifest(manifestPath, content);
+  if (!manifest) return;
+
+  // Merge serverResources CSS into buildManifest.css.
+  // Keys in serverResources are root-relative (e.g., "app/layout.tsx" or
+  // "src/app/layout.tsx"). Convert to absolute paths to match the runtime
+  // route manifest's filePath values.
+  const serverResources = manifest.serverResources as
+    | Record<string, { js: string[]; css: string[] }>
+    | undefined;
+  if (serverResources) {
+    for (const [relativePath, deps] of Object.entries(serverResources)) {
+      if (deps.css && deps.css.length > 0) {
+        const absolutePath = join(root, relativePath);
+        buildManifest.css[absolutePath] = deps.css;
+      }
+    }
+  }
+
+  // Build per-route modulepreload entries from routeClientRefKeys +
+  // clientReferenceDeps. Each route file's transitive client reference
+  // keys (captured during RSC generateBundle) are mapped to their JS
+  // chunk URLs via clientReferenceDeps.
+  if (routeClientRefKeys && routeClientRefKeys.size > 0) {
+    const clientReferenceDeps = manifest.clientReferenceDeps as
+      | Record<string, { js: string[]; css: string[] }>
+      | undefined;
+    if (clientReferenceDeps) {
+      for (const [filePath, refKeys] of routeClientRefKeys) {
+        const jsUrls = new Set<string>();
+        for (const key of refKeys) {
+          const deps = clientReferenceDeps[key];
+          if (deps?.js) {
+            for (const url of deps.js) jsUrls.add(url);
+          }
+        }
+        if (jsUrls.size > 0) {
+          buildManifest.modulepreload[filePath] = Array.from(jsUrls);
+        }
+      }
+    }
+  }
+}
+
+/**
+ * Strip JS references from the RSC plugin's assets manifest files.
+ *
+ * The RSC plugin writes `__vite_rsc_assets_manifest.js` to rsc/ and ssr/
+ * as standalone files (not Rollup chunks), so generateBundle can't
+ * intercept them. This rewrites the files on disk after all builds
+ * complete but before the adapter copies them to the output directory.
+ */
+export async function stripJsFromRscAssetsManifests(serverDirs: string[]): Promise<void> {
+  const paths = serverDirs.map((dir) => join(dir, '__vite_rsc_assets_manifest.js'));
+
+  for (const path of paths) {
+    let content: string;
+    try {
+      content = await readFile(path, 'utf-8');
+    } catch {
+      continue;
+    }
+
+    // Try JSON.parse to check if we can safely re-serialize
+    const jsonStr = content.replace(/^export default\s*/, '').replace(/;?\s*$/, '');
+    let isStrictJson = true;
+    let manifest: Record<string, unknown> | null = null;
+    try {
+      manifest = JSON.parse(jsonStr);
+    } catch {
+      isStrictJson = false;
+    }
+
+    if (!isStrictJson) {
+      // Manifest contains renderBuiltUrl runtime expressions — cannot
+      // safely re-serialize with JSON.stringify. Use targeted text
+      // transforms to clear JS arrays and bootstrapScriptContent.
+      let rewritten = content;
+      rewritten = clearJsArrays(rewritten);
+      rewritten = clearBootstrapScriptContent(rewritten);
+      await writeFile(path, rewritten);
+      continue;
+    }
+
+    // Clear JS from clientReferenceDeps — preserves CSS
+    const deps = manifest?.clientReferenceDeps as
+      | Record<string, { js: string[]; css: string[] }>
+      | undefined;
+    if (deps) {
+      for (const entry of Object.values(deps)) {
+        entry.js = [];
+      }
+    }
+
+    if (manifest) manifest.bootstrapScriptContent = '';
+
+    await writeFile(path, `export default ${JSON.stringify(manifest, null, 2)};\n`);
+  }
+}

package/src/plugins/server-bundle.ts

@@ -11,7 +11,50 @@
  * Design docs: design/11-platform.md, design/25-production-deployments.md
  */
 
+import { builtinModules } from 'node:module';
 import type { Plugin } from 'vite';
+import { EXPLICIT_MARKERS } from '../analyze/poison-rules.ts';
+
+// The poison-pill marker packages (server-only, client-only) must never be
+// externalized — they have to reach the timber-shims resolveId hook so it
+// can substitute the poison virtual modules. Derived from poison-rules.ts
+// so the list cannot drift from what shims.ts intercepts.
+const POISON_MARKER_SPECIFIERS = EXPLICIT_MARKERS.map((m) => m.specifier);
+
+// Every Node built-in as both bare (`stream`) and prefixed (`node:stream`).
+// Available at runtime on all targets (Node natively, Workers via nodejs_compat).
+// Listing explicitly silences Vite's "Automatically externalized" warnings.
+const NODE_BUILTINS: string[] = builtinModules.flatMap((m) => [m, `node:${m}`]);
+
+// Packages that must never be bundled into the runtime server environments.
+// With `noExternal: true`, rolldown follows all transitive imports. These
+// are build-time-only tools that have no runtime use in a server bundle.
+//
+// The primary leak path (TIM-988) — `virtual:timber-cache-handler` importing
+// `timber.config.ts` and pulling in adapter/MDX deps — was eliminated by
+// TIM-1211: the cache handler virtual module now imports `timber.cache.ts`
+// instead. These externals are retained as defense-in-depth.
+//
+// Cloudflare runtime modules (cloudflare:workers, cloudflare:sockets, etc.)
+// available at runtime on Workers but must not be bundled.
+const CLOUDFLARE_BUILTINS = [
+  'cloudflare:workers',
+  'cloudflare:sockets',
+  'cloudflare:email',
+  'cloudflare:workflows',
+];
+
+const BUILD_ONLY_EXTERNALS: string[] = [
+  ...NODE_BUILTINS,
+  ...CLOUDFLARE_BUILTINS,
+  'vite',
+  'nitro',
+  'rollup',
+  'vite-plugin-satteri',
+  'satteri',
+  'fsevents',
+  'chokidar',
+];
 
 export function timberServerBundle(): Plugin[] {
   const bundlePlugin: Plugin = {
@@ -44,12 +87,12 @@ export function timberServerBundle(): Plugin[] {
           environments: {
             rsc: {
               resolve: {
-                noExternal: ['server-only', 'client-only'],
+                noExternal: [...POISON_MARKER_SPECIFIERS],
               },
             },
             ssr: {
               resolve: {
-                noExternal: ['server-only', 'client-only', 'nuqs'],
+                noExternal: [...POISON_MARKER_SPECIFIERS, 'nuqs'],
               },
             },
           },
@@ -80,11 +123,13 @@ export function timberServerBundle(): Plugin[] {
         ssr: { target: 'webworker' },
         environments: {
           rsc: {
-            resolve: { noExternal: true },
+            resolve: { noExternal: true, external: BUILD_ONLY_EXTERNALS },
+            build: { rolldownOptions: { external: [/^cloudflare:/] } },
             define: serverDefine,
           },
           ssr: {
-            resolve: { noExternal: true },
+            resolve: { noExternal: true, external: BUILD_ONLY_EXTERNALS },
+            build: { rolldownOptions: { external: [/^cloudflare:/] } },
             define: serverDefine,
           },
         },
@@ -103,15 +148,18 @@ export function timberServerBundle(): Plugin[] {
   // back to lazy retry on failure. This handles two failure modes:
   //
   // 1. Forward references (e.g. Zod v4): `init_iso` calls `init_schemas`
-  //    which hasn't been defined yet. Eager execution fails, but when the
-  //    function is called lazily later, all dependencies are available.
+  //    which hasn't been defined yet. Eager execution fails silently, but
+  //    when the function is called lazily later, all dependencies are
+  //    available and the retry succeeds (and caches).
   //
   // 2. Optional peer dep shims (e.g. @emotion/is-prop-valid for
   //    framer-motion): Vite generates shims that throw for missing
-  //    optional deps. The throw is deferred to lazy execution where
-  //    the consuming package's try/catch handles it.
+  //    optional deps. The eager attempt swallows the throw; the lazy call
+  //    PROPAGATES it so the consuming package's try/catch handles it.
   //
-  // The key: on failure, `fn` is NOT cleared, so the next call retries.
+  // The key: only the eager attempt swallows errors. Once the helper is
+  // returned, lazy calls use the original Rolldown semantics — a throwing
+  // init propagates to the caller (and clears `fn`, matching upstream).
   // On success, `fn` is set to 0 so subsequent calls are no-ops.
   const esmInitFixPlugin: Plugin = {
     name: 'timber-esm-init-fix',
@@ -122,13 +170,19 @@ export function timberServerBundle(): Plugin[] {
       const lazy = 'var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);';
       if (!code.includes(lazy)) return null;
 
-      // Eager-with-retry: attempt init immediately. On success, mark done
-      // (fn = 0). On failure, leave fn intact so the lazy wrapper retries
-      // on next call — by then forward dependencies are initialized.
+      // Eager-with-retry: attempt init immediately, swallowing failures
+      // (forward refs aren't defined yet). After the eager attempt, flip
+      // to lazy mode where errors propagate to the caller — consumers'
+      // try/catch (framer-motion's optional @emotion dep) must see them.
       const eager = [
         'var __esmMin = (fn, res) => {',
-        '  var l = () => { if (fn) { var f = fn; try { res = f(); fn = 0; } catch(e) {} } return res; };',
+        '  var eager = 1;',
+        '  var l = () => {',
+        '    if (fn) { if (eager) { try { res = fn(); fn = 0; } catch(e) {} } else { res = fn(fn = 0); } }',
+        '    return res;',
+        '  };',
         '  l();',
+        '  eager = 0;',
         '  return l;',
         '};',
       ].join(' ');
@@ -137,5 +191,36 @@ export function timberServerBundle(): Plugin[] {
     },
   };
 
-  return [bundlePlugin, esmInitFixPlugin];
+  // Fix Rolldown's `createRequire(import.meta.url)` CJS interop shim for
+  // Cloudflare Workers. Rolldown emits this for CJS dependencies (e.g.
+  // @opentelemetry/context-async-hooks) that use `require()`. On Workers,
+  // `import.meta.url` is `undefined` for non-entry modules, causing:
+  //   TypeError: The argument 'path' must be a file URL object, a file URL
+  //   string, or an absolute path string. Received 'undefined'
+  //
+  // The fix: provide a fallback URL when `import.meta.url` is undefined.
+  // The actual URL doesn't matter — `createRequire` only needs it for
+  // resolving relative paths, but the only `__require()` calls are for
+  // Node built-ins (events, async_hooks) which resolve from any base.
+  //
+  // The top-level `ssr: { target: 'webworker' }` was supposed to prevent
+  // this, but it doesn't propagate to custom environments (rsc) in Vite's
+  // Environment API. See LOCAL-405.
+  const createRequireFixPlugin: Plugin = {
+    name: 'timber-create-require-fix',
+    applyToEnvironment(environment) {
+      return environment.name === 'rsc' || environment.name === 'ssr';
+    },
+    renderChunk(code) {
+      const pattern = 'createRequire(import.meta.url)';
+      if (!code.includes(pattern)) return null;
+
+      return {
+        code: code.replace(pattern, 'createRequire(import.meta.url || "file:///app")'),
+        map: null,
+      };
+    },
+  };
+
+  return [bundlePlugin, esmInitFixPlugin, createRequireFixPlugin];
 }