@uniflowed/vite 0.2.0 → 0.3.0

package/driver.js

@@ -535,6 +535,8 @@ async function preview() {
       previewServer.middlewares.use((request, response, next) => {
         if ((request.url ?? "").split("?")[0].endsWith("/__uf.flight")) {
           response.setHeader("content-type", "text/x-component");
+          // As every other door answers a payload: never sniffed into a document.
+          response.setHeader("x-content-type-options", "nosniff");
         }
         if ((request.url ?? "").split("?")[0] === "/.well-known/apple-app-site-association") {
           response.setHeader("content-type", "application/json; charset=utf-8");
@@ -1512,6 +1514,28 @@ const ADAPTERS = {
     // partially is refused by name; see [`deploy`].
     streams: false,
   },
+  // Vercel's Build Output API. `uf` writes the directory layout and the two
+  // JSON files (`config.json`, `.vc-config.json`); this links the function's
+  // `index.js`, a Node.js function over the same `handler.js`. Node's export
+  // conditions, like `node`: it is Node that runs it.
+  vercel: {
+    entries: (document, cache, build, _schedules, regeneration, images, partial) => ({
+      handler: handlerEntrySource(
+        document,
+        cache,
+        VERCEL_CAPABILITIES,
+        build,
+        regeneration,
+        images,
+        partial,
+      ),
+      index: vercelEntrySource("./handler.js"),
+    }),
+    // A function instance's memory and `/tmp` go with the instance, as a
+    // Lambda's do, so a build that regenerates pages names a provider module
+    // in `rendering.cache.store` or is refused by name; see [`deploy`].
+    regenerationStore: null,
+  },
 };
 
 /**
@@ -1536,6 +1560,7 @@ const BUN_CAPABILITIES = { module: "@uniflowed/server/bun", name: "bunCapabiliti
 const DENO_CAPABILITIES = { module: "@uniflowed/server/deno", name: "denoCapabilities" };
 const EDGE_CAPABILITIES = { module: "@uniflowed/server/edge", name: "edgeCapabilities" };
 const SERVERLESS_CAPABILITIES = { module: "@uniflowed/server/lambda", name: "lambdaCapabilities" };
+const VERCEL_CAPABILITIES = { module: "@uniflowed/server/vercel", name: "vercelCapabilities" };
 
 /**
  * Link the application into a directory that can be copied, for
@@ -2348,6 +2373,33 @@ export default {
 `;
 }
 
+/**
+ * The source of `index.js`: the Vercel Node.js function around that handler.
+ *
+ * Its default export is what Vercel's Node.js launcher calls with Node's
+ * request and response; `@uniflowed/server/vercel` says what it does with
+ * them. The static directory is resolved from this file, for the reason
+ * [`nodeEntrySource`] gives.
+ */
+function vercelEntrySource(handlerSpecifier) {
+  return `// Generated by \`uf build --adapter vercel\`. Not checked in, not edited.
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { createVercelHandler } from "@uniflowed/server/vercel";
+
+// \`beginRequest\` comes from the handler beside this file rather than from
+// \`@uniflowed/server/vercel\` above, because the request has to be established
+// in the storage the *application* reads, which is the copy bundled into
+// \`handler.js\`. See ubugeeei-prod/uf#389.
+import { beginRequest, fetch as handle, routing } from ${JSON.stringify(handlerSpecifier)};
+
+const staticDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "static");
+
+export default createVercelHandler({ handle, beginRequest, staticDir, routing });
+`;
+}
+
 /**
  * The source of `lambda.js`: the AWS Lambda entry around that handler.
  *

package/index.js

@@ -62,7 +62,8 @@ import {
   auditTag,
 } from "./internal/a11y.js";
 import { assetPlugin } from "./internal/assets.js";
-import { barrelImportsPlugin, namespaceViewOf } from "./internal/barrel-imports.js";
+import { barrelImportsPlugin } from "./internal/barrel-imports.js";
+import { refuseServerErrorBoundaries } from "./internal/error-boundaries.js";
 import { emit, reportRenderError, errorEvent } from "./internal/events.js";
 import remarkFrontmatterExport from "./internal/frontmatter.js";
 import { highlightPlugin } from "./internal/highlight.js";
@@ -579,6 +580,11 @@ function flowPlugin({
         // `react-server` for nothing. The ssr graph gets exactly those two,
         // because every route it renders reaches it as a payload.
         if (flightState != null && this.environment?.name === RSC_ENVIRONMENT) {
+          // The graph that renders routes is where a boundary has to be a
+          // client reference, so this is where one that is not fails — the
+          // build, and `uf dev`'s table — rather than the first page that
+          // throws in production. See `./internal/error-boundaries.js`.
+          refuseServerErrorBoundaries(table, root);
           return routesModuleSource({ ...table, handlers: [], middleware: [] });
         }
         if (flightState != null && isSsr(this, loadOptions)) {
@@ -620,17 +626,11 @@ function flowPlugin({
       if (id === resolved(VIRTUAL.server)) {
         return flightState == null
           ? serverModuleSource(entryPath, routing, instrumentationFile(appRoot))
-          : flightServerSource(
-              entryPath,
-              VIRTUAL.routes,
-              VIRTUAL.actions,
-              routing,
-              instrumentationFile(appRoot),
-            );
+          : flightServerSource(entryPath, VIRTUAL.routes, routing, instrumentationFile(appRoot));
       }
       if (flightState != null) {
         if (id === resolved(FLIGHT_VIRTUAL.entry))
-          return rscEntrySource(VIRTUAL.routes, routing, flightState.deployment);
+          return rscEntrySource(VIRTUAL.routes, routing, flightState.deployment, VIRTUAL.actions);
         if (id === resolved(FLIGHT_VIRTUAL.compilerRuntime)) return compilerRuntimeSource();
         if (id === resolved(FLIGHT_VIRTUAL.bridge)) {
           if (server != null) return devBridgeSource();
@@ -651,10 +651,11 @@ function flowPlugin({
             : builtReferencesSource(flightState.chunkUrls);
         }
       }
-      // Only `virtual:uf/server` imports this, so it is only ever asked for in
-      // the server environment — but the table it carries is every callable
-      // endpoint of the build, so it is worth saying that a browser asking for
-      // it gets nothing rather than getting the list.
+      // Only the server entries import this — `virtual:uf/rsc` under React
+      // Server Components, `virtual:uf/server` otherwise — so it is only ever
+      // asked for in a server environment. But the table it carries is every
+      // callable endpoint of the build, so it is worth saying that a browser
+      // asking for it gets nothing rather than getting the list.
       if (id === resolved(VIRTUAL.actions)) {
         if (!isSsr(this, loadOptions))
           return "export const actions = [];\nexport default actions;\n";
@@ -705,9 +706,7 @@ function flowPlugin({
     },
 
     async transform(code, id, transformOptions) {
-      // A view of a barrel's namespace has the barrel's path and none of its
-      // source: `uf:barrel-imports` generates it as JavaScript.
-      if (!isFlowModule(id) || namespaceViewOf(id) != null) return null;
+      if (!isFlowModule(id)) return null;
       // What an earlier pass of this build wrote under `.uf/build/` — the ssr
       // pass imports the rsc graph's bundle — is already this transform's
       // output. See `isCompiledOutput`.
@@ -950,12 +949,20 @@ function flowPlugin({
           // depend on a clock.
           forgetActions();
           const nextActions = actionTables().modules;
-          invalidateActionModules(devServer.moduleGraph, previousActions);
-          invalidateActionModules(devServer.moduleGraph, nextActions);
-          const routes = devServer.moduleGraph.getModuleById(resolved(VIRTUAL.routes));
-          if (routes) devServer.moduleGraph.invalidateModule(routes);
-          const actions = devServer.moduleGraph.getModuleById(resolved(VIRTUAL.actions));
-          if (actions) devServer.moduleGraph.invalidateModule(actions);
+          // The action table and its modules live in the rsc graph too, where
+          // the endpoint is built (#1469), so that graph forgets them as well.
+          const graphs = [
+            devServer.moduleGraph,
+            devServer.environments?.[RSC_ENVIRONMENT]?.moduleGraph,
+          ].filter((graph) => graph != null);
+          for (const graph of graphs) {
+            invalidateActionModules(graph, previousActions);
+            invalidateActionModules(graph, nextActions);
+            const routes = graph.getModuleById(resolved(VIRTUAL.routes));
+            if (routes) graph.invalidateModule(routes);
+            const actions = graph.getModuleById(resolved(VIRTUAL.actions));
+            if (actions) graph.invalidateModule(actions);
+          }
           devServer.ws.send({ type: "full-reload", path: "*" });
         };
         devServer.watcher.on("add", onManifest);

package/internal/barrel-imports.js

@@ -30,9 +30,9 @@
 // # Read off the barrel the project resolves
 //
 // Which file defines a name is read from the barrel itself: its static
-// `import { A } from "./a.js"` and `export { A } from "./a.js"` statements, and
-// the object literals it builds its namespaces from. Not a table kept here,
-// because the barrel a project installed is the one whose names count.
+// `import { A } from "./a.js"`, `export { A } from "./a.js"` and
+// `export * as A from "./a.js"` statements. Not a table kept here, because the
+// barrel a project installed is the one whose names count.
 //
 // A name that reading cannot place stays an import from the barrel, and so does
 // every form that binds no name — `import * as ui`, `export * from` and
@@ -51,12 +51,20 @@
 //
 // # Namespaces
 //
-// `Dialog` is not an export of `dialog.js`. It is an object the barrel builds
-// from `dialog.js`'s parts, and `ContextMenu`'s is built from two modules. An
-// import of one is served from a view of the barrel, `index.js?uf-namespace=Dialog`:
-// a module generated here that imports those parts and builds the same object.
-// It is the barrel's own path with a query, so its relative imports resolve the
-// way the barrel's do.
+// `Dialog` is `dialog.js` itself: the barrel says `export * as Dialog from
+// "./dialog.js"` (ubugeeei-prod/uf#1453), so `import { Dialog } from
+// "@uniflowed/ui"` becomes `import * as Dialog from ".../dialog.js"` and
+// `export { Dialog as Modal } from "@uniflowed/ui"` becomes
+// `export * as Modal from ".../dialog.js"`. A module namespace is the same object
+// however many importers ask for it, so nothing is generated to stand in for
+// it. `ContextMenu` spans two modules and is still one: `context-menu.js`
+// re-exports `Menu`'s parts, and importing it reaches `menu.js` through that.
+//
+// Until #1453 the barrel built each namespace as an object literal, and a
+// generated `index.js?uf-namespace=Dialog` module rebuilt the object for an
+// importer. That form is no longer read: `@uniflowed/vite` and `@uniflowed/ui`
+// are released together, and an object literal the reading meets now is
+// `OPAQUE` — left on the barrel, which costs size and never correctness.
 
 import { readFileSync, statSync } from "node:fs";
 import path from "node:path";
@@ -66,9 +74,6 @@ import { normalizePath, parseAst } from "vite";
 /** The packages whose barrel imports are rewritten. */
 export const BARREL_PACKAGES = Object.freeze(["@uniflowed/ui"]);
 
-/** The query that makes a barrel's path a view of one of its namespaces. */
-export const NAMESPACE_QUERY = "uf-namespace";
-
 /** The module kinds whose imports are read, once earlier plugins made them JavaScript. */
 const SCRIPT = /\.(?:[cm]?[jt]sx?|mdx)$/;
 
@@ -93,7 +98,7 @@ export function barrelImportsPlugin() {
     name: "uf:barrel-imports",
 
     async transform(code, id) {
-      if (id.startsWith("\0") || namespaceViewOf(id) != null) return null;
+      if (id.startsWith("\0")) return null;
       if (!BARREL_PACKAGES.some((name) => code.includes(name))) return null;
       if (!SCRIPT.test(cleanId(id))) return null;
       let program;
@@ -134,29 +139,9 @@ export function barrelImportsPlugin() {
       if (edits.length === 0) return null;
       return { code: applyEdits(code, edits), map: null };
     },
-
-    load(id) {
-      const view = namespaceViewOf(id);
-      if (view == null) return null;
-      return namespaceViewSource(readBarrel(readings, view.file).exports, view.file, view.name);
-    },
   };
 }
 
-/**
- * The barrel and the namespace a view module stands for, or `null` for any
- * other id.
- *
- * `uf:flow` asks too: a view has the barrel's path and extension, and is not
- * the barrel's Flow source.
- */
-export function namespaceViewOf(id) {
-  const at = id.indexOf("?");
-  if (at === -1 || id.startsWith("\0")) return null;
-  const name = new URLSearchParams(id.slice(at + 1)).get(NAMESPACE_QUERY);
-  return name == null || name === "" ? null : { file: id.slice(0, at), name };
-}
-
 /**
  * Where each name a barrel exports is defined, read from its source.
  *
@@ -169,8 +154,8 @@ export function namespaceViewOf(id) {
  *
  *   * `{ kind: "binding", file, name }` — an export of another module, passed
  *     through under this name;
- *   * `{ kind: "namespace", parts }` — an object literal whose every property
- *     is such a binding, each part `{ key, file, name }`;
+ *   * `{ kind: "module", file }` — another module whole, re-exported as a
+ *     namespace with `export * as Name from "./file.js"`;
  *   * `OPAQUE` — anything else, which stays an import from the barrel.
  *
  * @param {string} source
@@ -185,10 +170,9 @@ export function barrelExports(source, file) {
       ? normalizePath(path.join(directory, node.value))
       : null;
 
-  // Every binding an import made, and every `const` object, before any export
-  // is read: `export { Dialog }` may come before the `const` it names.
+  // Every binding an import made, before any export is read: `export { A }`
+  // may come before the `import` it names.
   const bindings = new Map();
-  const objects = new Map();
   for (const node of program.body) {
     if (node.type === "ImportDeclaration" && node.importKind !== "type") {
       const from = fileOf(node.source);
@@ -206,21 +190,11 @@ export function barrelExports(source, file) {
         );
       }
     }
-    const declaration = node.type === "ExportNamedDeclaration" ? node.declaration : node;
-    if (declaration?.type === "VariableDeclaration" && declaration.kind === "const") {
-      for (const declarator of declaration.declarations) {
-        if (declarator.id.type === "Identifier" && declarator.init?.type === "ObjectExpression") {
-          objects.set(declarator.id.name, declarator.init);
-        }
-      }
-    }
   }
 
   const local = (name) => {
     const binding = bindings.get(name);
-    if (binding != null) return { kind: "binding", ...binding };
-    const object = objects.get(name);
-    return object == null ? OPAQUE : namespaceOf(object, bindings);
+    return binding == null ? OPAQUE : { kind: "binding", ...binding };
   };
 
   const exports = new Map();
@@ -228,6 +202,14 @@ export function barrelExports(source, file) {
     if (node.type === "ExportDefaultDeclaration") {
       exports.set("default", OPAQUE);
     }
+    // `export * as Dialog from "./dialog.js"`: the namespace is the module. A
+    // bare `export * from` names nothing, so it places nothing.
+    if (node.type === "ExportAllDeclaration" && node.exported != null) {
+      if (node.exportKind === "type") continue;
+      const from = fileOf(node.source);
+      exports.set(nameOf(node.exported), from == null ? OPAQUE : { kind: "module", file: from });
+      continue;
+    }
     if (node.type !== "ExportNamedDeclaration" || node.exportKind === "type") continue;
     const { declaration } = node;
     if (declaration != null) {
@@ -259,53 +241,6 @@ export function barrelExports(source, file) {
   return exports;
 }
 
-/**
- * The module a view of a barrel's namespace is: the parts, imported from their
- * files, and the object the barrel builds from them.
- *
- * A name that is not a namespace the barrel builds — the barrel changed under a
- * development server after an importer was rewritten — is re-exported from the
- * barrel itself, which answers correctly, if slowly, or with the bundler's own
- * error for a name that is gone.
- *
- * @param {Map<string, object>} exports what `barrelExports` read
- * @param {string} barrel the barrel's absolute path
- * @param {string} name the namespace
- */
-export function namespaceViewSource(exports, barrel, name) {
-  const target = exports.get(name);
-  const directory = path.dirname(barrel);
-  const specifierOf = (file) => {
-    const relative = normalizePath(path.relative(directory, file));
-    return JSON.stringify(relative.startsWith("../") ? relative : `./${relative}`);
-  };
-  if (target?.kind !== "namespace") {
-    return `export { ${printName(name)} } from ${specifierOf(barrel)};\n`;
-  }
-  const locals = new Map();
-  const taken = new Set();
-  const imports = new Map();
-  for (const part of target.parts) {
-    const key = `${part.file}\0${part.name}`;
-    if (locals.has(key)) continue;
-    let alias = IDENTIFIER.test(part.name) ? part.name : "part";
-    while (taken.has(alias)) alias = `${alias}$`;
-    taken.add(alias);
-    locals.set(key, alias);
-    const specifiers = imports.get(part.file) ?? [];
-    specifiers.push(alias === part.name ? alias : `${printName(part.name)} as ${alias}`);
-    imports.set(part.file, specifiers);
-  }
-  const lines = [...imports].map(
-    ([file, specifiers]) => `import { ${specifiers.join(", ")} } from ${specifierOf(file)};`,
-  );
-  const properties = target.parts.map(
-    (part) => `  ${printName(part.key)}: ${locals.get(`${part.file}\0${part.name}`)},`,
-  );
-  lines.push(`export const ${name} = {`, ...properties, "};");
-  return `${lines.join("\n")}\n`;
-}
-
 /** An import or re-export whose source is one of `BARREL_PACKAGES`. */
 function importsFromBarrel(node) {
   if (node.type === "ImportDeclaration") {
@@ -339,6 +274,8 @@ function rewriteStatement(node, exports, barrel) {
   const kept = [];
   let keptDefault = null;
   const moved = new Map();
+  // One statement each: `import * as Dialog` binds a single name.
+  const namespaces = [];
   for (const specifier of specifiers) {
     if (specifier.type === "ImportDefaultSpecifier") {
       keptDefault = specifier.local.name;
@@ -353,15 +290,21 @@ function rewriteStatement(node, exports, barrel) {
       kept.push(printed(exported));
       continue;
     }
-    const [source, name] =
-      target.kind === "binding"
-        ? [target.file, target.name]
-        : [`${normalizePath(barrel)}?${NAMESPACE_QUERY}=${encodeURIComponent(exported)}`, exported];
-    const list = moved.get(source) ?? [];
-    list.push(printed(name));
-    moved.set(source, list);
+    if (target.kind === "module") {
+      // A namespace binding has to be an identifier, which an import's local
+      // name always is and an export's exported name may not be.
+      if (!IDENTIFIER.test(binding)) {
+        kept.push(printed(exported));
+        continue;
+      }
+      namespaces.push({ file: target.file, binding });
+      continue;
+    }
+    const list = moved.get(target.file) ?? [];
+    list.push(printed(target.name));
+    moved.set(target.file, list);
   }
-  if (moved.size === 0) return null;
+  if (moved.size === 0 && namespaces.length === 0) return null;
 
   const keyword = isImport ? "import" : "export";
   const statements = [];
@@ -374,6 +317,9 @@ function rewriteStatement(node, exports, barrel) {
   for (const [source, list] of moved) {
     statements.push(`${keyword} { ${list.join(", ")} } from ${JSON.stringify(source)};`);
   }
+  for (const { file, binding } of namespaces) {
+    statements.push(`${keyword} * as ${binding} from ${JSON.stringify(file)};`);
+  }
   return statements.join("\n");
 }
 
@@ -402,27 +348,6 @@ function applyEdits(code, edits) {
   return out + code.slice(at);
 }
 
-/** An object literal of imported bindings, as a namespace, or `OPAQUE`. */
-function namespaceOf(object, bindings) {
-  const parts = [];
-  for (const property of object.properties) {
-    if (property.type !== "Property" || property.kind !== "init" || property.computed) {
-      return OPAQUE;
-    }
-    if (property.method || property.value.type !== "Identifier") return OPAQUE;
-    const key =
-      property.key.type === "Identifier"
-        ? property.key.name
-        : typeof property.key.value === "string"
-          ? property.key.value
-          : null;
-    const binding = bindings.get(property.value.name);
-    if (key == null || binding == null) return OPAQUE;
-    parts.push({ key, ...binding });
-  }
-  return { kind: "namespace", parts };
-}
-
 /** A barrel's reading, re-read only when its size or modification time changes. */
 function readBarrel(readings, file) {
   let stats;

package/internal/error-boundaries.js

@@ -0,0 +1,157 @@
+// @noflow
+//
+// Plain JavaScript: executed by the host that runs Vite, before any transform.
+//
+// Every `$error.js` has to be a client module, said while the route table is
+// generated rather than the first time a page throws.
+//
+// Under React Server Components an error boundary catches a throw while the
+// *browser* renders, so its component runs in the browser and the module has
+// to open with `"use client"`. `@uniflowed/router`'s `rsc.js` has always
+// refused a boundary that is not a client reference — but only when it is
+// needed, which is when a page throws. A project whose `$error.js` lacked the
+// directive built, deployed, and answered the first exception in production
+// with a bare `500` and the reason in the server log. The routing guide's own
+// example had no directive, so copying the documentation produced exactly
+// that.
+//
+// This is the same rule, asked of the files: the RSC graph loads the route
+// table, the table names every boundary module, and a boundary whose source
+// does not start with the directive fails the build — or the dev server's
+// route table, which is the same moment for `uf dev` — naming every such file
+// at once.
+//
+// What it is not: a parser. The directive prologue is the only part of a
+// module this reads (comments, then string-literal statements), which is all
+// the directive rule concerns; `crates/uf_rsc`'s scan decides the same thing
+// from a real parse for the client/server split, and a module that satisfies
+// this check but not that one is refused by the router at request time, as
+// before.
+
+import { readFileSync } from "node:fs";
+import path from "node:path";
+
+/**
+ * Whether `source` opens with a `"use client"` directive.
+ *
+ * Reads the directive prologue: leading whitespace, `//` and `/* *\/`
+ * comments (a `// @flow` header among them), then string-literal statements.
+ * `"use client"` anywhere in the prologue counts, as it does for React's own
+ * rule; the first thing that is not a comment or a string literal ends it.
+ *
+ * @param {string} source
+ * @returns {boolean}
+ */
+export function hasUseClientDirective(source) {
+  let at = source.charCodeAt(0) === 0xfeff ? 1 : 0;
+  const length = source.length;
+  for (;;) {
+    // Whitespace and comments between statements.
+    for (;;) {
+      while (at < length && /\s/.test(source[at])) at++;
+      if (source.startsWith("//", at)) {
+        const end = source.indexOf("\n", at);
+        at = end === -1 ? length : end + 1;
+      } else if (source.startsWith("/*", at)) {
+        const end = source.indexOf("*/", at + 2);
+        if (end === -1) return false;
+        at = end + 2;
+      } else {
+        break;
+      }
+    }
+    const quote = source[at];
+    if (quote !== '"' && quote !== "'") return false;
+    const close = source.indexOf(quote, at + 1);
+    if (close === -1) return false;
+    const value = source.slice(at + 1, close);
+    if (value.includes("\n")) return false;
+    at = close + 1;
+    // A directive is a whole statement: `;`, a line end, a comment, or the
+    // end. Anything else — `"use client".length` — is an expression.
+    while (at < length && (source[at] === " " || source[at] === "\t")) at++;
+    if (source[at] === ";") {
+      at++;
+    } else if (
+      at < length &&
+      source[at] !== "\n" &&
+      source[at] !== "\r" &&
+      !source.startsWith("//", at) &&
+      !source.startsWith("/*", at)
+    ) {
+      return false;
+    }
+    if (value === "use client") return true;
+  }
+}
+
+/**
+ * Every error-boundary module a scanned route table names, once each.
+ *
+ * `table.errors` is one entry per directory holding an `$error.js`; a slot's
+ * boundaries are only on the routes that render the slot, as an
+ * `errorBoundary`. Both are collected by walking the table rather than by
+ * knowing where each kind lives, so a boundary a later change puts somewhere
+ * new is still asked about.
+ *
+ * @param {object} table what `scanRoutes` answered
+ * @returns {string[]} absolute paths, sorted
+ */
+export function errorBoundaryModules(table) {
+  const found = new Set();
+  for (const entry of table.errors ?? []) {
+    if (typeof entry?.module === "string") found.add(entry.module);
+  }
+  const seen = new Set();
+  const walk = (value) => {
+    if (value == null || typeof value !== "object" || seen.has(value)) return;
+    seen.add(value);
+    if (Array.isArray(value)) {
+      for (const item of value) walk(item);
+      return;
+    }
+    for (const [key, child] of Object.entries(value)) {
+      if (key === "errorBoundary" && typeof child?.module === "string") found.add(child.module);
+      walk(child);
+    }
+  };
+  walk(table.routes ?? []);
+  return [...found].sort();
+}
+
+/**
+ * Fail when an error boundary in `table` is not a client module.
+ *
+ * Throws one error naming every such file, relative to `root`, with the fix;
+ * answers nothing otherwise. `read` is the file reader, for a test.
+ *
+ * @param {object} table what `scanRoutes` answered
+ * @param {string} root the project root, for the names in the message
+ * @param {(file: string) => string} [read]
+ */
+export function refuseServerErrorBoundaries(
+  table,
+  root,
+  read = (file) => readFileSync(file, "utf8"),
+) {
+  const missing = errorBoundaryModules(table).filter((file) => {
+    let source;
+    try {
+      source = read(file);
+    } catch {
+      // A boundary the scan found and nobody can read is the bundler's to
+      // report, with the error it gets opening it.
+      return false;
+    }
+    return !hasUseClientDirective(source);
+  });
+  if (missing.length === 0) return;
+  const names = missing.map((file) => path.relative(root, file).split(path.sep).join("/"));
+  throw new Error(
+    `uf: ${names.length === 1 ? "an error boundary is" : `${names.length} error boundaries are`} not ` +
+      `a client module: ${names.join(", ")}. An \`$error.js\` catches a throw while the browser ` +
+      'renders, so its component runs in the browser, and the module has to open with "use client" ' +
+      "as its first statement. Without it the page that throws is answered with a bare 500. Add " +
+      '"use client"; at the top of each. See docs/app/guide/routing.',
+  );
+}

package/internal/flight.js

@@ -18,9 +18,14 @@
 //     client directive is not evaluated here: it is replaced by a client
 //     reference per export, naming the chunk the browser loads it from.
 //   * **`ssr`**, Vite's own server environment. It holds the HTML renderer, the
-//     route handlers, the middleware, the action table — and the *server copy*
-//     of every client module, which is what renders a client component into
-//     HTML. It reaches the rsc graph through one module, the bridge.
+//     route handlers, the middleware — and the *server copy* of every client
+//     module, which is what renders a client component into HTML. It reaches
+//     the rsc graph through one module, the bridge, for the payload and for
+//     the server-action endpoint: the action table is the rsc graph's, so an
+//     action shares every module instance with the pages that show what it
+//     wrote (ubugeeei-prod/uf#1469). A route handler and a middleware do not
+//     yet: a module one of them imports and a page imports is evaluated once in
+//     each graph.
 //   * **`client`**, the browser's. Its entry hydrates from the payload the
 //     document carries, and it holds no page, layout or loader — only the
 //     client modules, each an entry of its own, loaded when a payload names it.
@@ -509,18 +514,30 @@ export function fsFileOf(pathname) {
  * build rendered it — a prerendered payload is a file, and nothing that serves
  * a file can say so for it. `null` under `uf dev`.
  */
-export function rscEntrySource(routesId, routing = {}, deployment = null) {
+export function rscEntrySource(routesId, routing = {}, deployment = null, actionsId = null) {
   const settings = {
     basePath: routing.basePath ?? "",
     trailingSlash: routing.trailingSlash ?? "ignore",
   };
-  return `import { createFlightRenderer, installRouting } from "@uniflowed/router/rsc";
+  // The action table is loaded here, in the graph the pages render in, and
+  // not in the ssr graph that answers the request. A module an action and a
+  // page both import is then one instance: a write the action makes is what
+  // the next render — the postback of a form posted before hydration
+  // included — reads. In the ssr graph it was a second copy, and the page
+  // never saw the write (ubugeeei-prod/uf#1469).
+  const actions =
+    actionsId == null
+      ? "export const callAction = createActionDispatcher({ actions: [] });"
+      : `import { actions } from ${JSON.stringify(actionsId)};
+export const callAction = createActionDispatcher({ actions });`;
+  return `import { createActionDispatcher, createFlightRenderer, installRouting } from "@uniflowed/router/rsc";
 import { routes, notFound, errors } from ${JSON.stringify(routesId)};
 installRouting(${JSON.stringify(settings)});
 export { routes, notFound, errors };
 export const renderFlight = createFlightRenderer({ routes, notFound, errors, deployment: ${JSON.stringify(
     deployment ?? null,
   )} });
+${actions}
 `;
 }
 
@@ -543,13 +560,16 @@ if (typeof load !== "function") {
 export async function renderFlight(url, options) {
   return (await load()).renderFlight(url, options);
 }
+export async function callAction(request, settings) {
+  return (await load()).callAction(request, settings);
+}
 export const { routes, notFound, errors } = await load();
 `;
 }
 
 /** `virtual:uf/rsc-bridge` in a build: the rsc build's output, bundled in. */
 export function builtBridgeSource(rscOutput) {
-  return `export { renderFlight, routes, notFound, errors } from ${JSON.stringify(rscOutput)};\n`;
+  return `export { renderFlight, callAction, routes, notFound, errors } from ${JSON.stringify(rscOutput)};\n`;
 }
 
 /**
@@ -697,12 +717,10 @@ ${clientInstrumentationSource(options.instrumentation)}hydrateFlight({ App${stri
 export function flightServerSource(
   appEntry,
   routesId,
-  actionsId,
   routing = { redirects: [], rewrites: [], headers: [], basePath: "", trailingSlash: "ignore" },
   instrumentation = null,
 ) {
   return `import {
-  createActionDispatcher,
   createInstrumentation,
   instrumentRender,
   traceRequestPhase,
@@ -712,8 +730,13 @@ export function flightServerSource(
 } from "@uniflowed/router/server";
 import { createDocumentRenderer } from "@uniflowed/router/rsc/ssr";
 import { handlers, middleware } from ${JSON.stringify(routesId)};
-import { actions } from ${JSON.stringify(actionsId)};
-import { renderFlight, routes, notFound, errors } from ${JSON.stringify(FLIGHT_VIRTUAL.bridge)};
+import {
+  renderFlight,
+  callAction as callActionInRsc,
+  routes,
+  notFound,
+  errors,
+} from ${JSON.stringify(FLIGHT_VIRTUAL.bridge)};
 import { loadClientModule } from ${JSON.stringify(FLIGHT_VIRTUAL.references)};
 import App from ${JSON.stringify(appEntry)};
 export const routing = ${JSON.stringify(routing)};
@@ -735,7 +758,8 @@ export const flight = (url, options = {}) => instrumentRender(
 export { shellDocument } from "@uniflowed/router/server";
 const dispatchRoute = createDispatcher({ handlers });
 export const dispatch = (request) => traceRequestPhase("route", () => dispatchRoute(request));
-export const callAction = createActionDispatcher({ actions });
+// Built in the rsc graph and reached through the bridge; see \`rscEntrySource\`.
+export const callAction = callActionInRsc;
 const guard = createMiddlewareRunner({ middleware });
 export const runMiddleware = (request) => traceRequestPhase("middleware", () => guard(request));
 `;

package/internal/http.js

@@ -34,9 +34,12 @@
  * @param {string} [path]
  */
 export async function toRequest(incoming, config, path) {
-  const host = incoming.headers.host ?? "localhost";
   const protocol = config?.server?.https == null ? "http" : "https";
-  const url = new URL(path ?? incoming.originalUrl ?? incoming.url ?? "/", `${protocol}://${host}`);
+  const url = requestUrl(
+    protocol,
+    incoming.headers.host,
+    path ?? incoming.originalUrl ?? incoming.url,
+  );
 
   const headers = new Headers();
   for (const [name, value] of Object.entries(incoming.headers)) {
@@ -67,8 +70,61 @@ export async function toRequest(incoming, config, path) {
  * @param {import("node:http").IncomingMessage} incoming
  */
 export function toAddressRequest(incoming) {
-  const host = incoming.headers.host ?? "localhost";
-  return new Request(new URL(incoming.originalUrl ?? incoming.url ?? "/", `http://${host}`));
+  return new Request(
+    requestUrl("http", incoming.headers.host, incoming.originalUrl ?? incoming.url),
+  );
+}
+
+/**
+ * The URL a Node request was for: `Host`'s authority and the request-target's
+ * path and query, joined as text so a target of `//evil.example/x` (or
+ * `/\evil.example/x`) cannot become the request's host, and an absolute-form
+ * target keeps only its path. A `Host` holding a path, a user name, a query or
+ * a fragment is not believed.
+ *
+ * The same function as `requestUrl` in `@uniflowed/server/node`, which has the
+ * argument for why; spelled twice because this file runs before any Flow
+ * transform and cannot import that one. `packages/server/serve.test.js` holds
+ * both to one answer.
+ *
+ * @param {string} protocol
+ * @param {unknown} host the `Host` header as Node parsed it
+ * @param {string | undefined} target the request-target
+ * @returns {URL}
+ */
+function requestUrl(protocol, host, target) {
+  const authority =
+    typeof host === "string" && host !== "" && isAuthority(host) ? host : "localhost";
+  let path = target ?? "/";
+  if (!path.startsWith("/")) {
+    try {
+      const absolute = new URL(path);
+      path = absolute.pathname + absolute.search;
+    } catch {
+      path = "/";
+    }
+  }
+  try {
+    return new URL(`${protocol}://${authority}${path}`);
+  } catch {
+    return new URL(`${protocol}://localhost/`);
+  }
+}
+
+/**
+ * Whether `value` has none of the characters that end a URL's authority.
+ *
+ * @param {string} value
+ */
+function isAuthority(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    // `/`, `\`, `?`, `#`, `@`, and every space and control character.
+    if (code === 47 || code === 92 || code === 63 || code === 35 || code === 64 || code <= 32) {
+      return false;
+    }
+  }
+  return true;
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniflowed/vite",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Vite, driven by uf.config.js: every Flow module through `uf transform`, MDX, the file-system router and static rendering as Vite plugins.",
   "type": "module",
   "license": "MIT",
@@ -35,10 +35,10 @@
     "@babel/core": "^7.29.7",
     "@mdx-js/rollup": "^3.1.1",
     "@shikijs/rehype": "^3.23.0",
-    "@uniflowed/host": "0.2.0",
-    "@uniflowed/router": "0.2.0",
-    "@uniflowed/server": "0.2.0",
-    "@uniflowed/validator": "0.2.0",
+    "@uniflowed/host": "0.3.0",
+    "@uniflowed/router": "0.3.0",
+    "@uniflowed/server": "0.3.0",
+    "@uniflowed/validator": "0.3.0",
     "babel-plugin-relay": "^21.0.1",
     "estree-util-value-to-estree": "^3.5.0",
     "rehype-slug": "^6.0.0",