@webjsdev/server 0.8.32 → 0.8.34

package/src/js-scan.js

@@ -81,9 +81,38 @@ const REGEX_PRECEDING_KEYWORDS = new Set([
  * @returns {string}
  */
 export function redactStringsAndTemplates(src, blankStrings = false) {
+  return scanLiterals(src, { placeholder: false, blankStrings }).out;
+}
+
+/**
+ * Core string / template / comment lexer shared by `redactStringsAndTemplates`
+ * (#179) and `redactToPlaceholders` (#634). ONE walker owns the
+ * regex-versus-division, tagged-template, and `${...}`-nesting disambiguation,
+ * so the two output modes can never drift apart.
+ *
+ * Two output modes, selected by `placeholder`:
+ *  - MASK (placeholder=false): position-preserving mask (same length, newlines
+ *    kept). Comment and regex bodies blank to spaces; template bodies blank,
+ *    recursing `${...}` holes as blanked code; plain-string bodies stay VERBATIM
+ *    so a caller can read `register('tag')`, UNLESS `blankStrings` is set (then
+ *    string bodies blank too and the verbatim-template fast path is disabled).
+ *    `literals` is empty.
+ *  - PLACEHOLDER (placeholder=true): each string / template-text body is
+ *    replaced by a `__STR_<idx>__` token (delimiters kept) and pushed to
+ *    `literals`, while `${...}` holes are scanned as REAL code. Lets a caller
+ *    tell a real top-level `register(...)` / `import` from one shown inside a
+ *    code-sample literal (resolve the token via `literals[idx]`). In this mode
+ *    code is never blanked, so the mask emit-formulas below reduce to verbatim.
+ *
+ * @param {string} src
+ * @param {{ placeholder?: boolean, blankStrings?: boolean }} [opts]
+ * @returns {{ out: string, literals: string[] }}
+ */
+function scanLiterals(src, { placeholder = false, blankStrings = false } = {}) {
   const n = src.length;
   let out = '';
   let i = 0;
+  const literals = [];
   // Previous significant token in code position, tracked as we walk (more
   // robust than scanning `out`, whose tail is blanked spaces inside a hole).
   // `lastSig` is the last non-whitespace source char; `lastWord` is the last
@@ -112,7 +141,7 @@ export function redactStringsAndTemplates(src, blankStrings = false) {
     if (/[\w$]/.test(lastSig)) return !lastWordIsProp && REGEX_PRECEDING_KEYWORDS.has(lastWord);
     return true;
   };
-  // A template is tagged when the previous token is a value.
+  // A template is tagged when the previous token is a value (mask mode only).
   const isTagged = () => /[\w$)\]'"`]/.test(lastSig);
 
   const scanLineComment = () => {
@@ -140,9 +169,25 @@ export function redactStringsAndTemplates(src, blankStrings = false) {
     }
     markValue();
   };
-  // Strings: KEEP the body verbatim at top level (so tag-name-has-hyphen can
+  // Strings. PLACEHOLDER: collect the body into `literals` and emit
+  // `q__STR_idx__q`. MASK: KEEP the body verbatim (so tag-name-has-hyphen can
   // read register('foo')); blank it when inside an already-blanked hole.
   const scanString = (q, blank) => {
+    if (placeholder) {
+      i++;
+      let body = '';
+      while (i < n) {
+        if (src[i] === '\\' && i + 1 < n) { body += src[i] + src[i + 1]; i += 2; continue; }
+        if (src[i] === q) { i++; break; }
+        if (src[i] === '\n') { i++; break; }
+        body += src[i]; i++;
+      }
+      const idx = literals.length;
+      literals.push(body);
+      out += q + `__STR_${idx}__` + q;
+      markValue();
+      return;
+    }
     out += q; i++;
     while (i < n) {
       if (src[i] === '\\' && i + 1 < n) { out += blank ? '  ' : src[i] + src[i + 1]; i += 2; continue; }
@@ -152,9 +197,47 @@ export function redactStringsAndTemplates(src, blankStrings = false) {
     }
     markValue();
   };
-  // Template literal. `forceBlank` is set when already inside a blanked hole
-  // (everything nested blanks regardless of tag/shape).
+  // Template literal. PLACEHOLDER: each text segment becomes a `__STR_idx__`
+  // token (collected) and each `${...}` hole is scanned as REAL code. MASK:
+  // verbatim fast path for a simple closed single-line untagged literal, else
+  // blank the text and recurse holes as blanked code (`forceBlank` is set when
+  // already inside a blanked hole, so everything nested blanks regardless).
   const scanTemplate = (forceBlank) => {
+    if (placeholder) {
+      out += '`'; i++;
+      while (i < n) {
+        const c = src[i];
+        if (c === '\\' && i + 1 < n) {
+          let body = '\\' + src[i + 1];
+          i += 2;
+          while (i < n && src[i] !== '`' && !(src[i] === '$' && src[i + 1] === '{')) {
+            if (src[i] === '\\' && i + 1 < n) { body += src[i] + src[i + 1]; i += 2; continue; }
+            body += src[i]; i++;
+          }
+          const idx = literals.length;
+          literals.push(body);
+          out += `__STR_${idx}__`;
+          continue;
+        }
+        if (c === '`') { out += '`'; i++; break; }
+        if (c === '$' && src[i + 1] === '{') {
+          out += '${'; i += 2;
+          scanCode(true, false);
+          if (i < n && src[i] === '}') { out += '}'; i++; }
+          continue;
+        }
+        let body = '';
+        while (i < n && src[i] !== '`' && !(src[i] === '$' && src[i + 1] === '{')) {
+          if (src[i] === '\\' && i + 1 < n) { body += src[i] + src[i + 1]; i += 2; continue; }
+          body += src[i]; i++;
+        }
+        const idx = literals.length;
+        literals.push(body);
+        out += `__STR_${idx}__`;
+      }
+      markValue();
+      return;
+    }
     const tagged = isTagged();
     let hasInterp = false, hasNewline = false, closed = false, depth = 0, k = i + 1;
     while (k < n) {
@@ -198,7 +281,9 @@ export function redactStringsAndTemplates(src, blankStrings = false) {
 
   // Scan code. `stopHole`: return at the `}` that closes the enclosing template
   // hole (the caller emits it). `blank`: emit spaces for code (inside a blanked
-  // hole). Literals are always lexed so braces/quotes inside them never count.
+  // hole; mask mode only, never set in placeholder mode so the formulas below
+  // reduce to verbatim). Literals are always lexed so braces/quotes inside them
+  // never count.
   function scanCode(stopHole, blank) {
     let brace = 0;
     while (i < n) {
@@ -228,7 +313,7 @@ export function redactStringsAndTemplates(src, blankStrings = false) {
   }
 
   scanCode(false, false);
-  return out;
+  return { out, literals };
 }
 
 /**
@@ -421,6 +506,73 @@ export function parsePropsFromObjectLiteral(obj, names) {
   }
 }
 
+/**
+ * Like {@link parsePropsFromObjectLiteral} but captures each entry's raw
+ * VALUE text alongside its key, so a rule can inspect the declaration
+ * (`prop<CommentFormatted[]>(Object)`) rather than just the name.
+ *
+ * The value is read with balanced depth across `()`, `{}`, `[]`, `<>`,
+ * and string/template literals, so an entry is split only on a
+ * TOP-LEVEL comma. That keeps a value's own commas intact, whether they
+ * sit inside an options object (`prop(Object, { default: () => [] })`),
+ * an array literal, or a nested generic (`prop<Map<string, number>>(…)`).
+ * Angle-bracket depth is decremented only when already open, so a stray
+ * `=>` arrow or `>=` does not unbalance a value with no generic.
+ *
+ * @param {string} obj object-literal body (no enclosing braces)
+ * @returns {{ key: string, value: string }[]}
+ */
+export function parsePropEntries(obj) {
+  /** @type {{ key: string, value: string }[]} */
+  const entries = [];
+  const n = obj.length;
+  let i = 0;
+  while (i < n) {
+    while (i < n && /[\s,]/.test(obj[i])) i++;
+    if (i >= n) break;
+    let key = '';
+    if (obj[i] === '"' || obj[i] === "'") {
+      const quote = obj[i++];
+      while (i < n && obj[i] !== quote) { key += obj[i++]; }
+      i++; // closing quote
+    } else {
+      while (i < n && /[A-Za-z0-9_$]/.test(obj[i])) key += obj[i++];
+    }
+    while (i < n && /\s/.test(obj[i])) i++;
+    if (obj[i] !== ':') break;
+    i++;
+    while (i < n && /\s/.test(obj[i])) i++;
+    let round = 0, curly = 0, square = 0, angle = 0;
+    let value = '';
+    while (i < n) {
+      const c = obj[i];
+      if (c === '"' || c === "'" || c === '`') {
+        const quote = c;
+        value += c; i++;
+        while (i < n && obj[i] !== quote) {
+          if (obj[i] === '\\') { value += obj[i] + (obj[i + 1] || ''); i += 2; continue; }
+          value += obj[i++];
+        }
+        if (i < n) value += obj[i++];
+        continue;
+      }
+      if (c === ',' && round === 0 && curly === 0 && square === 0 && angle === 0) break;
+      if (c === '}' && curly === 0) break; // end of the enclosing object literal
+      if (c === '(') round++;
+      else if (c === ')') { if (round > 0) round--; }
+      else if (c === '{') curly++;
+      else if (c === '}') curly--;
+      else if (c === '[') square++;
+      else if (c === ']') { if (square > 0) square--; }
+      else if (c === '<') angle++;
+      else if (c === '>') { if (angle > 0) angle--; }
+      value += obj[i++];
+    }
+    if (key) entries.push({ key, value: value.trim() });
+  }
+  return entries;
+}
+
 
 /**
  * Walk forward from `start` (just after an opening `(`) and return the
@@ -512,3 +664,22 @@ export function matchClosingBrace(s, start) {
   }
   return -1;
 }
+
+/**
+ * Return `src` with the BODY of every comment replaced by spaces, and the
+ * body of single-quoted, double-quoted, and template-literal segments
+ * replaced by placeholders like `__STR_index__`. Quote delimiters and template
+ * backticks are preserved so code structure is unchanged. Template holes
+ * `${...}` are left intact (and scanned recursively as code).
+ *
+ * Returns `{ redacted: string, literals: string[] }` where `literals` holds
+ * the original unquoted literal contents.
+ *
+ * @param {string} src
+ * @returns {{ redacted: string, literals: string[] }}
+ */
+export function redactToPlaceholders(src) {
+  const { out, literals } = scanLiterals(src, { placeholder: true });
+  return { redacted: out, literals };
+}
+

package/src/listener-bun.js

@@ -349,7 +349,7 @@ function maybeCompress(resp, req) {
  * on Bun too.
  * @param {{ requestTimeout?: number } | undefined} timeouts
  */
-function bunIdleTimeout(timeouts) {
+export function bunIdleTimeout(timeouts) {
   const reqMs = timeouts && timeouts.requestTimeout;
   if (reqMs === 0) return 0;
   let secs = Math.ceil((reqMs || 30_000) / 1000);

package/src/ssr.js

@@ -5,7 +5,6 @@ import { importMapTag, vendorIntegrityFor, publishedBuildId, basePath, vendorPre
 import { withBasePath } from './base-path.js';
 import { withAssetHash } from './asset-hash.js';
 import { jsonForScriptTag } from './script-tag-json.js';
-import { readToken, newToken, cookieHeader } from './csrf.js';
 import { transitiveDeps } from './module-graph.js';
 import { seedingEnabled, collectSeeds, buildSeedScript } from './action-seed.js';
 import { BUFFERED_MARKER, STREAM_MARKER } from './conditional-get.js';
@@ -148,10 +147,31 @@ export async function ssrPage(route, params, url, opts) {
     // zero application JS. The analysis is conservative (anything that
     // touches the client router, a signal, an event, an npm import, or a
     // shipping component keeps shipping).
+    //
+    // Import-only route modules (#605) go one step further: a page / layout
+    // whose only client relevance is importing shipping components is itself
+    // dead weight on the client (it never hydrates), so it is dropped and its
+    // component modules are emitted directly in its place. The component set is
+    // the STATIC closure the analyser computed (what loading the module would
+    // have registered), so a component imported but only conditionally rendered
+    // still registers. Dedup so a component shared across the page and a layout
+    // (or two layouts) is emitted once.
     const inert = opts.inertRouteModules;
-    const moduleUrls = [route.file, ...route.layouts]
-      .filter((f) => !(inert && inert.has(f)))
-      .map((f) => toUrlPath(f, opts.appDir));
+    const importOnly = opts.importOnlyRouteModules;
+    const moduleUrls = [];
+    {
+      const seen = new Set();
+      const push = (abs) => {
+        const u = toUrlPath(abs, opts.appDir);
+        if (!seen.has(u)) { seen.add(u); moduleUrls.push(u); }
+      };
+      for (const f of [route.file, ...route.layouts]) {
+        if (inert && inert.has(f)) continue;
+        const emit = importOnly && importOnly.get(f);
+        if (emit) emit.forEach(push);
+        else push(f);
+      }
+    }
     // Emit <link rel="modulepreload"> for every custom element that
     // actually rendered PLUS their transitive dependencies (from the
     // module graph). URLs are deduplicated so the browser never sees
@@ -295,7 +315,8 @@ export async function ssrNotFound(notFoundFile, opts) {
 }
 
 /**
- * Build an HTML Response and, if missing, attach the CSRF cookie.
+ * Build an HTML Response. Sets no cookie: action CSRF is an Origin /
+ * Sec-Fetch-Site check, so the page response is cookieless (CDN-cacheable).
  * @param {string} html
  * @param {number} status
  * @param {Request | undefined} req
@@ -314,10 +335,6 @@ function htmlResponse(html, status, req, url, metadata) {
   // final, so a warming response is reload-safe. See router-client.js
   // applySwap and publishedBuildId() in importmap.js.
   headers.set('x-webjs-build', publishedBuildId());
-  if (req && !readToken(req)) {
-    const secure = url ? url.protocol === 'https:' : false;
-    headers.append('set-cookie', cookieHeader(newToken(), { secure }));
-  }
   // Buffered (string) body: opt into the conditional-GET funnel so a
   // PUBLIC-cacheable page (metadata.cacheControl) gets a weak ETag + 304.
   // The funnel still excludes the no-store default, so a private page is
@@ -329,10 +346,10 @@ function htmlResponse(html, status, req, url, metadata) {
 /**
  * Rebuild a Response from a cached HTML record (#241). The stored body is
  * the stable per-page HTML; the per-response varying bits are re-minted
- * here so a new visitor still gets them: the CSRF cookie is freshly issued
- * when the request lacks one (it is a Set-Cookie header, never part of the
- * cached body), and the published build id is re-read so a post-deploy
- * client sees the current id. The BUFFERED marker opts the cached body into
+ * here so a new visitor still gets them: the published build id is re-read so
+ * a post-deploy client sees the current id. No cookie is set (action CSRF is
+ * an Origin / Sec-Fetch-Site check), which is what keeps a cached page
+ * cookieless and shareable. The BUFFERED marker opts the cached body into
  * the conditional-GET funnel exactly as a fresh render does, so a cached
  * PUBLIC-cacheable page still 304s. Output is observably identical to the
  * fresh render of the same route within the window.
@@ -345,10 +362,6 @@ function cachedHtmlResponse(rec, req, url) {
   const headers = new Headers({ 'content-type': rec.contentType });
   headers.set('cache-control', rec.cacheControl);
   headers.set('x-webjs-build', publishedBuildId());
-  if (req && !readToken(req)) {
-    const secure = url ? url.protocol === 'https:' : false;
-    headers.append('set-cookie', cookieHeader(newToken(), { secure }));
-  }
   headers.set(BUFFERED_MARKER, '1');
   return new Response(rec.body, { status: rec.status, headers });
 }
@@ -847,6 +860,19 @@ export function publicEnvShim(opts) {
     + `</script>`;
 }
 
+// Client-router opt-out (#629). Default ON (the framework's automatic-nav
+// thesis): the router auto-enables in the browser when `@webjsdev/core` loads.
+// `webjs.clientRouter: false` flips this off app-wide; `dev.js` reads the
+// config at boot / each rebuild and calls `setClientRouterEnabled`, and
+// `wrapHead` then emits a `window.__WEBJS_CLIENT_ROUTER__=false` flag BEFORE
+// the deferred boot module so the bundle's module-end auto-enable skips. A
+// module-level switch (mirrors setBasePath / setElisionFingerprint) so no opt
+// has to thread through every render path; default true keeps every existing
+// app and test byte-identical.
+let _clientRouterEnabled = true;
+export function setClientRouterEnabled(enabled) { _clientRouterEnabled = enabled !== false; }
+function clientRouterEnabled() { return _clientRouterEnabled; }
+
 function wrapHead(opts) {
   // CSP nonce: if provided, all inline <script> tags get nonce="…" so they
   // pass strict Content-Security-Policy headers. The nonce is extracted from
@@ -1355,7 +1381,7 @@ function wrapHead(opts) {
 ${opts.nonce ? `<meta name="csp-nonce" content="${escapeAttr(opts.nonce)}">` : ''}
 ${metaTags.join('\n')}
 <title>${escapeHtml(title)}</title>
-${publicEnvShim({ dev: opts.dev, nonce: opts.nonce })}
+${publicEnvShim({ dev: opts.dev, nonce: opts.nonce })}${clientRouterEnabled() ? '' : `\n<script${n}>window.__WEBJS_CLIENT_ROUTER__=false;</script>`}
 ${importMapTag({ nonce: opts.nonce })}
 ${linkTags.join('\n')}
 ${scriptTags.length ? scriptTags.join('\n') + '\n' : ''}${boot}
@@ -1491,10 +1517,6 @@ function streamingHtmlResponse(prefix, bodyHtml, closer, ctx, status, req, url,
   // See htmlResponse: published build id on every response for the
   // client router's importmap-mismatch detection on partial swaps.
   headers.set('x-webjs-build', publishedBuildId());
-  if (req && !readToken(req)) {
-    const secure = url ? url.protocol === 'https:' : false;
-    headers.append('set-cookie', cookieHeader(newToken(), { secure }));
-  }
 
   if (!ctx.pending.length) {
     // No pending boundaries: this degrades to a single buffered (string)

package/src/testing.d.ts

@@ -2,8 +2,8 @@
  * Type overlay for `@webjsdev/server/testing` (the handle() test harness, #267).
  *
  * The runtime is packages/server/src/testing.js (JSDoc-annotated JavaScript);
- * this overlay exists so a TypeScript app's `import { testRequest, getCsrf }
- * from '@webjsdev/server/testing'` resolves precise types instead of emitting
+ * this overlay exists so a TypeScript app's `import { testRequest,
+ * invokeActionForTest } from '@webjsdev/server/testing'` resolves precise types instead of emitting
  * TS7016. The same declarations are re-exported from the package's main
  * `index.d.ts` (the helpers ship from both entry points). Zero runtime cost.
  */
@@ -14,16 +14,6 @@ export type Handle = (req: Request) => Promise<Response> | Response;
 /** A `createRequestHandler` return value, or a bare `handle` function. */
 export type AppOrHandle = { handle: Handle; appDir: string } | Handle;
 
-/** A CSRF token + cookie + header-name triple minted off the first SSR response. */
-export interface CsrfPair {
-  /** The bare token value for the `x-webjs-csrf` request header. */
-  token: string;
-  /** The header NAME (`x-webjs-csrf`). */
-  header: string;
-  /** The `name=value` cookie string for the `Cookie` request header. */
-  cookie: string;
-}
-
 /**
  * Coerce a bare path, full URL string, or pre-built `Request` into a `Request`.
  * A bare path is prefixed with a dummy origin; `init` is merged when provided.
@@ -40,21 +30,12 @@ export declare function testRequest(
   init?: RequestInit,
 ): Promise<Response>;
 
-/** Read the `webjs_csrf` cookie value off a response's `Set-Cookie` header(s). */
-export declare function readCsrfCookie(res: Response): string | null;
-
 /** Collect all `Set-Cookie` header values off a response. */
 export declare function getSetCookies(res: Response): string[];
 
 /** Reduce raw `Set-Cookie` strings to a single `name=value; name2=value2` `Cookie` header value. */
 export declare function cookiesToHeader(setCookies: string[]): string;
 
-/**
- * Mint a `{ token, header, cookie }` CSRF triple off the first SSR response.
- * `path` is the GET path used to issue the cookie (default `/`).
- */
-export declare function getCsrf(handle: Handle, path?: string): Promise<CsrfPair>;
-
 /** Merge an extra cookie string into a `RequestInit`'s `Cookie` header. */
 export declare function withCookies(init: RequestInit | undefined, cookieValue: string): RequestInit;
 
@@ -89,7 +70,8 @@ export declare function actionEndpoint(
 
 /**
  * Round-trip an action through its REAL RPC endpoint (serializer + CSRF + prod
- * error sanitization) and return the parsed return value.
+ * error sanitization) and return the parsed return value. Models a same-origin
+ * browser POST, so it passes the Origin / Sec-Fetch-Site CSRF check.
  */
 export declare function invokeActionForTest<T = unknown>(
   app: AppOrHandle,
@@ -97,7 +79,6 @@ export declare function invokeActionForTest<T = unknown>(
   fnName: string,
   args?: unknown[],
   opts?: {
-    csrf?: CsrfPair;
     appDir?: string;
     extraCookies?: string;
     throwOnError?: boolean;
@@ -106,7 +87,9 @@ export declare function invokeActionForTest<T = unknown>(
 
 /**
  * Lower-level variant of `invokeActionForTest` that returns the raw `Response`
- * (never throws on a non-2xx), so a test can assert the status directly.
+ * (never throws on a non-2xx), so a test can assert the status directly. Set
+ * `crossOrigin` (true or a specific origin) to model a cross-site request and
+ * assert the 403.
  */
 export declare function rawActionRequest(
   app: AppOrHandle,
@@ -114,8 +97,7 @@ export declare function rawActionRequest(
   fnName: string,
   args?: unknown[],
   opts?: {
-    csrf?: CsrfPair | null;
-    omitCsrf?: boolean;
+    crossOrigin?: boolean | string;
     appDir?: string;
     extraCookies?: string;
     contentType?: string;

package/src/testing.js

@@ -18,7 +18,7 @@
  *
  * ```js
  * import { createRequestHandler } from '@webjsdev/server';
- * import { testRequest, getCsrf, invokeActionForTest } from '@webjsdev/server/testing';
+ * import { testRequest, invokeActionForTest } from '@webjsdev/server/testing';
  *
  * const app = await createRequestHandler({ appDir: process.cwd(), dev: true });
  *
@@ -33,7 +33,6 @@
  */
 
 import { hashFile, RPC_CONTENT_TYPE } from './actions.js';
-import { CSRF_COOKIE, CSRF_HEADER } from './csrf.js';
 import { getSerializer } from './serializer.js';
 import { join, sep } from 'node:path';
 
@@ -83,24 +82,6 @@ export function testRequest(handle, input, init) {
   return handle(toRequest(input, init));
 }
 
-/**
- * Read the `webjs_csrf` cookie value off a response's `Set-Cookie` header(s).
- * Returns null when the response set no CSRF cookie.
- *
- * @param {Response} res
- * @returns {string | null}
- */
-export function readCsrfCookie(res) {
-  const cookies = getSetCookies(res);
-  for (const c of cookies) {
-    const m = new RegExp(`(?:^|\\s)${CSRF_COOKIE}=([^;]+)`).exec(c);
-    if (m) {
-      try { return decodeURIComponent(m[1]); } catch { return m[1]; }
-    }
-  }
-  return null;
-}
-
 /**
  * Collect every `Set-Cookie` value off a `Response`, preferring the
  * structured `getSetCookie()` (which keeps multiple cookies separate) and
@@ -134,32 +115,6 @@ export function cookiesToHeader(setCookies) {
     .join('; ');
 }
 
-/**
- * Do an initial GET to mint a CSRF token, returning the `{ cookie, token }`
- * pair so a test can send a CSRF-valid action request. `cookie` is a ready-made
- * `Cookie` request-header value; `token` is the bare value for the
- * `x-webjs-csrf` header. Reuses the REAL cookie / header names from `csrf.js`.
- *
- * @param {Handle} handle
- * @param {string} [path] the GET path used to issue the cookie (default `/`)
- * @returns {Promise<{ cookie: string, token: string, header: string }>}
- */
-export async function getCsrf(handle, path = '/') {
-  const res = await testRequest(handle, path);
-  const token = readCsrfCookie(res);
-  if (!token) {
-    throw new Error(
-      `getCsrf: GET ${path} issued no ${CSRF_COOKIE} cookie. The first SSR ` +
-      `response issues it; hit a real page route (or pass a path that renders).`,
-    );
-  }
-  return {
-    token,
-    header: CSRF_HEADER,
-    cookie: `${CSRF_COOKIE}=${encodeURIComponent(token)}`,
-  };
-}
-
 /**
  * Merge an extra cookie string into a `RequestInit`'s `Cookie` header,
  * preserving any cookie already on `init.headers`.
@@ -301,7 +256,6 @@ function isAbsolutePath(p) {
  * @param {string} fnName the exported action function name
  * @param {unknown[]} [args] positional args (serialized as the stub sends an arg array)
  * @param {{
- *   csrf?: { cookie: string, token: string },
  *   appDir?: string,
  *   extraCookies?: string,
  *   throwOnError?: boolean,
@@ -320,23 +274,17 @@ export async function invokeActionForTest(app, serverFilePath, fnName, args = []
   const throwOnError = opts.throwOnError !== false;
 
   const endpoint = await actionEndpoint(appDir, serverFilePath, fnName);
-  const csrf = opts.csrf || (await getCsrf(handle));
 
   const serializer = getSerializer();
   const body = await serializer.serialize(args);
 
-  let cookie = csrf.cookie || `${CSRF_COOKIE}=${encodeURIComponent(csrf.token)}`;
-  if (opts.extraCookies) cookie = `${cookie}; ${opts.extraCookies}`;
+  // Model a same-origin browser POST (the action CSRF check reads
+  // `Sec-Fetch-Site`, no token / cookie needed).
+  /** @type {Record<string,string>} */
+  const headers = { 'content-type': RPC_CONTENT_TYPE, 'sec-fetch-site': 'same-origin' };
+  if (opts.extraCookies) headers.cookie = opts.extraCookies;
 
-  const res = await testRequest(handle, endpoint, {
-    method: 'POST',
-    headers: {
-      'content-type': RPC_CONTENT_TYPE,
-      [CSRF_HEADER]: csrf.token,
-      cookie,
-    },
-    body,
-  });
+  const res = await testRequest(handle, endpoint, { method: 'POST', headers, body });
 
   const text = await res.text();
   const ct = res.headers.get('content-type') || '';
@@ -357,17 +305,17 @@ export async function invokeActionForTest(app, serverFilePath, fnName, args = []
 
 /**
  * Lower-level variant of `invokeActionForTest` that returns the raw `Response`
- * (never throws on a non-2xx), so a test can assert on the status directly
- * (e.g. a CSRF-missing request returns 403). Send `opts.csrf = null` /
- * `opts.omitCsrf = true` to deliberately omit the CSRF header + cookie.
+ * (never throws on a non-2xx), so a test can assert on the status directly.
+ * By default it models a same-origin browser POST (passes the CSRF check); set
+ * `opts.crossOrigin` (true, or a specific origin string) to model a cross-site
+ * request and assert the 403.
  *
  * @param {{ handle: Handle, appDir: string } | Handle} app
  * @param {string} serverFilePath
  * @param {string} fnName
  * @param {unknown[]} [args]
  * @param {{
- *   csrf?: { cookie: string, token: string } | null,
- *   omitCsrf?: boolean,
+ *   crossOrigin?: boolean | string,
  *   appDir?: string,
  *   extraCookies?: string,
  *   contentType?: string,
@@ -386,15 +334,13 @@ export async function rawActionRequest(app, serverFilePath, fnName, args = [], o
 
   /** @type {Record<string,string>} */
   const headers = { 'content-type': opts.contentType || RPC_CONTENT_TYPE };
-  if (!opts.omitCsrf && opts.csrf !== null) {
-    const csrf = opts.csrf || (await getCsrf(handle));
-    headers[CSRF_HEADER] = csrf.token;
-    let cookie = csrf.cookie || `${CSRF_COOKIE}=${encodeURIComponent(csrf.token)}`;
-    if (opts.extraCookies) cookie = `${cookie}; ${opts.extraCookies}`;
-    headers.cookie = cookie;
-  } else if (opts.extraCookies) {
-    headers.cookie = opts.extraCookies;
+  if (opts.crossOrigin) {
+    headers['sec-fetch-site'] = 'cross-site';
+    headers.origin = typeof opts.crossOrigin === 'string' ? opts.crossOrigin : 'https://evil.example';
+  } else {
+    headers['sec-fetch-site'] = 'same-origin';
   }
+  if (opts.extraCookies) headers.cookie = opts.extraCookies;
 
   return testRequest(handle, endpoint, { method: 'POST', headers, body });
 }

package/src/vendor.js

@@ -100,12 +100,15 @@ export async function scanBareImports(dir, skipFiles) {
  * `'@tanstack/query'`   → `'@tanstack/query'`
  * `'@tanstack/query/x'` → `'@tanstack/query'`
  * `'./foo'`, `'../bar'`, `'/baz'` → `null` (relative/absolute)
+ * `'#components/x.ts'`, `'#lib/db'` → `null` (`#` path alias, #555: resolves to
+ *   a LOCAL file via `package.json` "imports", never an npm package, so it must
+ *   not be sent to the vendor resolver, #623)
  *
  * @param {string} spec
  * @returns {string | null}
  */
 export function extractPackageName(spec) {
-  if (!spec || spec.startsWith('.') || spec.startsWith('/') || spec.startsWith('__')) return null;
+  if (!spec || spec.startsWith('.') || spec.startsWith('/') || spec.startsWith('__') || spec.startsWith('#')) return null;
   if (/^[a-z]+:/.test(spec)) return null;
   if (spec.startsWith('@')) {
     const parts = spec.split('/');

package/webjs-config.schema.json

@@ -17,6 +17,11 @@
       "type": "boolean",
       "default": true
     },
+    "clientRouter": {
+      "description": "Client-router switch (#629). Default true: the client router auto-enables in the browser whenever @webjsdev/core loads, so any page with a component gets SPA-style navigation with no import. Set to false to opt the whole app out (pure MPA, full-page navigation). Read by readClientRouterEnabled in dev.js.",
+      "type": "boolean",
+      "default": true
+    },
     "headers": {
       "description": "Per-path response-header rules, shaped like Next's. Each rule pairs a URLPattern source against header directives. Read by compileHeaderRules in headers.js.",
       "type": "array",
@@ -91,6 +96,12 @@
       "type": "string",
       "default": ""
     },
+    "allowedOrigins": {
+      "description": "Cross-origin hosts (or full origins) the action CSRF check accepts even when the request is cross-site. The action endpoint defends with a Sec-Fetch-Site check plus an Origin-vs-host fallback; list additional origins a reverse-proxy / multi-domain setup must allow here. A bare host or a full origin are both accepted. Read by readAllowedOrigins in csrf.js. Default [] (same-origin only).",
+      "type": "array",
+      "items": { "type": "string" },
+      "default": []
+    },
     "csp": {
       "description": "Content-Security-Policy config. Off by default. true enables a strict nonce-based default policy. An object customizes directives and report-only mode. Read by readCspConfig in csp.js.",
       "oneOf": [