@webjsdev/server 0.8.22 → 0.8.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/server",
-  "version": "0.8.22",
+  "version": "0.8.23",
   "type": "module",
   "description": "webjs dev/prod server: SSR, router, API, server actions, live reload",
   "main": "index.js",

package/src/ssr.js

@@ -82,7 +82,7 @@ export async function ssrPage(route, params, url, opts) {
   const metadata = await collectMetadata(route, ctx, opts.dev);
 
   try {
-    const suspenseCtx = { pending: [], nextId: 1, usedComponents: new Set() };
+    const suspenseCtx = { pending: [], nextId: 1, usedComponents: new Set(), dev: opts.dev };
     // Parse the partial-nav "have" header from the client. The header
     // lists comma-separated marker paths the client already has rendered
     // in its DOM. The server walks the target route's layout chain
@@ -183,6 +183,7 @@ export async function ssrPage(route, params, url, opts) {
       url,
       metadata,
       nonce,
+      opts.dev,
     );
     // Server HTML cache write (#241). The page opted in via `revalidate`, so
     // FLAG this candidate for the response funnel rather than writing here: the
@@ -233,7 +234,7 @@ export async function ssrPage(route, params, url, opts) {
         const mod = await loadModule(route.errors[i], opts.dev);
         if (!mod.default) continue;
         const tree = await mod.default({ ...ctx, error: err });
-        const body = await renderToString(tree);
+        const body = await renderToString(tree, { ssr: true, dev: opts.dev });
         const moduleUrls = [route.file, ...route.layouts].map((f) => toUrlPath(f, opts.appDir));
         const html = wrapInDocument(body, { metadata, moduleUrls, dev: opts.dev, nonce: errNonce });
         return htmlResponse(html, 500, opts.req, url);
@@ -333,7 +334,7 @@ async function ssrNotFoundHtml(notFoundFile, opts) {
   if (notFoundFile) {
     try {
       const mod = await loadModule(notFoundFile, opts.dev);
-      if (mod.default) body = await renderToString(await mod.default({}));
+      if (mod.default) body = await renderToString(await mod.default({}), { ssr: true, dev: opts.dev });
     } catch (e) {
       body = `<h1>404: Not found</h1><pre>${escapeHtml(String(e))}</pre>`;
     }
@@ -430,7 +431,7 @@ async function loadingTemplates(route, ctx, dev) {
       const mod = await loadModule(file, dev);
       if (!mod.default) continue;
       const tree = await mod.default(ctx);
-      const html = await renderToString(tree, { ssr: true });
+      const html = await renderToString(tree, { ssr: true, dev });
       const segmentPath = loadingSegmentPath(file);
       parts.push(`<template id="wj-loading:${segmentPath}">${html}</template>`);
     } catch { /* skip broken loading file */ }
@@ -1444,15 +1445,18 @@ function deduplicatedPreloads(componentUrls, moduleUrls, graph, entryFiles, appD
  * Build a streaming Response. Degrades to a single-flush response when
  * there are no pending Suspense boundaries.
  *
- * @param {string} headHtml
+ * @param {string} prefix
  * @param {string} bodyHtml
+ * @param {string} closer
  * @param {{ pending: {id: string, promise: Promise<unknown>}[], nextId: number }} ctx
  * @param {number} status
  * @param {Request | undefined} req
  * @param {URL | undefined} url
  * @param {Record<string, any>} [metadata]
+ * @param {string} [nonce]
+ * @param {boolean} [dev]  dev surfaces a streamed-boundary error message; prod stays silent
  */
-function streamingHtmlResponse(prefix, bodyHtml, closer, ctx, status, req, url, metadata, nonce) {
+function streamingHtmlResponse(prefix, bodyHtml, closer, ctx, status, req, url, metadata, nonce, dev) {
   const encoder = new TextEncoder();
   const headers = new Headers({ 'content-type': 'text/html; charset=utf-8' });
   // Default: no caching. Pages are dynamic by default: the developer
@@ -1499,14 +1503,19 @@ function streamingHtmlResponse(prefix, bodyHtml, closer, ctx, status, req, url,
             batch.map(async (p) => {
               try {
                 const resolved = await p.promise;
-                const sub = { pending: [], nextId: ctx.nextId };
+                const sub = { pending: [], nextId: ctx.nextId, dev: ctx.dev };
                 const html = await renderToString(resolved, { ssr: true, suspenseCtx: sub });
                 ctx.nextId = sub.nextId;
                 for (const n of sub.pending) ctx.pending.push(n);
                 return { id: p.id, html };
               } catch (e) {
+                // Match the SSR error-isolation policy (render-server.js's
+                // defaultSSRErrorTemplate): dev surfaces the message so the
+                // failure is obvious, prod stays SILENT so no internal detail
+                // (a DB error, a stack-derived path) leaks to the client (#478).
                 const msg = e instanceof Error ? e.message : String(e);
-                return { id: p.id, html: `<p>error: ${escapeHtml(msg)}</p>` };
+                const html = dev ? `<p>error: ${escapeHtml(msg)}</p>` : '';
+                return { id: p.id, html };
               }
             })
           );