@webjsdev/server 0.8.41 → 0.8.43

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/server",
-  "version": "0.8.41",
+  "version": "0.8.43",
   "type": "module",
   "description": "webjs dev/prod server: SSR, router, API, server actions, live reload",
   "main": "index.js",

package/src/actions.js

@@ -267,7 +267,7 @@ export function serveServerOnlyStub(relPath) {
     `This file is server-only (a .server.{js,ts} file with no 'use server' directive). ` +
     `Either add 'use server' at the top of the file to expose its exports as RPC, ` +
     `or wrap the server-only logic in a separate *.server.{js,ts} action and import that instead. ` +
-    `Docs: https://docs.webjs.com/docs/server-actions`;
+    `Docs: https://docs.webjs.dev/docs/server-actions`;
   return `// webjs: server-only module stub for ${relPath} (no 'use server' directive)
 throw new Error(${JSON.stringify(msg)});
 `;

package/src/check.js

@@ -1079,6 +1079,41 @@ export async function checkConventions(appDir) {
   return violations;
 }
 
+/**
+ * BFS the module graph for the shortest import path from `from` to `to`,
+ * returning every hop `[from, ..., to]` so the `no-server-import-in-browser-module`
+ * message can print the FULL chain instead of an opaque `… ->` truncation (#804).
+ * Falls back to `[from, to]` if no path is found (defensive; the caller only
+ * calls this once `to` is known reachable).
+ *
+ * @param {Map<string, Set<string>>} graph
+ * @param {string} from
+ * @param {string} to
+ * @returns {string[]}
+ */
+function findImportChain(graph, from, to) {
+  const prev = new Map();
+  const seen = new Set([from]);
+  const queue = [from];
+  while (queue.length) {
+    const cur = queue.shift();
+    const deps = graph.get(cur);
+    if (!deps) continue;
+    for (const dep of deps) {
+      if (seen.has(dep)) continue;
+      seen.add(dep);
+      prev.set(dep, cur);
+      if (dep === to) {
+        const path = [];
+        for (let n = to; n !== undefined; n = prev.get(n)) path.unshift(n);
+        return path;
+      }
+      queue.push(dep);
+    }
+  }
+  return [from, to];
+}
+
 /**
  * Implements `no-server-import-in-browser-module`. Factored into its own
  * function (rather than an inline block) because it does the heavier
@@ -1241,11 +1276,12 @@ async function checkServerImportInBrowserModule(appDir, violations) {
     // module, the chain is just the two; otherwise show one intermediate hop
     // so the diagnostic points at where the edge enters (the full path is
     // recoverable from the graph, but one hop is enough to locate it).
-    const directDeps = moduleGraph.get(file);
-    const directlyImported = directDeps && directDeps.has(serverDep);
-    const chain = directlyImported
-      ? `${relFile} -> ${relServer}`
-      : `${relFile} -> … -> ${relServer}`;
+    const chainFiles = findImportChain(moduleGraph, file, serverDep);
+    const chain = chainFiles.map((f) => relative(appDir, f)).join(' -> ');
+    // If the edge into the server file comes from a types-shaped module, the
+    // idiomatic fix is to relocate that type to a browser-safe typedef (#804).
+    const importer = chainFiles.length >= 2 ? chainFiles[chainFiles.length - 2] : null;
+    const viaTypesModule = importer && /(^|\/)types(\.m?[jt]s$|\/)/.test(relative(appDir, importer));
 
     // The "register the component in a layout so it elides again" remedy only
     // applies to a page / layout, which CAN elide (it became browser-bound by
@@ -1253,9 +1289,12 @@ async function checkServerImportInBrowserModule(appDir, violations) {
     // ship and are never elided, so offering them an "elides again" fix is
     // wrong. Branch the fix text on whether the kind can elide.
     const canElide = kind === 'page' || kind === 'layout';
+    const typesHint = viaTypesModule
+      ? `The edge enters via a types-shaped module (${relative(appDir, importer)}); if it re-exports a runtime VALUE from a \`.server.{ts,js}\` file, relocate that to a browser-safe typedef (a plain \`interface\` / JSDoc, or an \`import type\` which the stripper erases) so the type is shared without pinning the module. `
+      : '';
     const fixText = canElide
-      ? `Keep the server call off this browser-shipped ${kind}. Options: (1) gate the route in \`middleware.ts\` (runs server-side, never ships); (2) move the server-only call behind a \`'use server'\` action in a \`.server.{ts,js}\` file and call it as an RPC; or (3) if this ${kind} only became browser-bound because it imports a component to register, register that component in a \`layout.{ts,js}\` instead so the ${kind} elides again and its server import is stripped.`
-      : `Keep the server call off this browser-shipped ${kind} (it always ships and is never elided). Options: (1) gate the route in \`middleware.ts\` (runs server-side, never ships); or (2) move the server-only call behind a \`'use server'\` action in a \`.server.{ts,js}\` file and call it as an RPC.`;
+      ? `${typesHint}Keep the server call off this browser-shipped ${kind}. Options: (1) gate the route in \`middleware.ts\` (runs server-side, never ships); (2) move the server-only call behind a \`'use server'\` action in a \`.server.{ts,js}\` file and call it as an RPC; or (3) if this ${kind} only became browser-bound because it imports a component to register, register that component in a \`layout.{ts,js}\` instead so the ${kind} elides again and its server import is stripped.`
+      : `${typesHint}Keep the server call off this browser-shipped ${kind} (it always ships and is never elided). Options: (1) gate the route in \`middleware.ts\` (runs server-side, never ships); or (2) move the server-only call behind a \`'use server'\` action in a \`.server.{ts,js}\` file and call it as an RPC.`;
 
     violations.push({
       rule: 'no-server-import-in-browser-module',

package/src/dev.js

@@ -1825,9 +1825,14 @@ async function handleCore(req, ctx) {
     return invokeAction(state.actionIndex, actMatch[1], actMatch[2], req, onActionError, allowedOrigins);
   }
 
-  // Static: /public/*
-  if (path.startsWith('/public/') || path === '/favicon.ico') {
-    const p = path === '/favicon.ico' ? '/public/favicon.ico' : path;
+  // Static: /public/*, plus a small set of ROOT assets that must serve at the
+  // site root even though they live under public/. A service worker registered
+  // at /sw.js scopes to the origin root, so it MUST serve at / (not
+  // /public/sw.js), and so must its offline fallback. Same remap shape as the
+  // /favicon.ico special-case below. (#830)
+  const ROOT_ASSETS = { '/sw.js': '/public/sw.js', '/offline.html': '/public/offline.html' };
+  if (path.startsWith('/public/') || path === '/favicon.ico' || path in ROOT_ASSETS) {
+    const p = path === '/favicon.ico' ? '/public/favicon.ico' : (ROOT_ASSETS[path] || path);
     const abs = join(appDir, p);
     // Containment check. `join` normalises `..` segments, so a path
     // like `/public/%2E%2E/secret/x.svg` decodes (after URL parsing,
@@ -1843,7 +1848,13 @@ async function handleCore(req, ctx) {
       return new Response(null, { status: 404 });
     }
     // A `?v=<hash>` public asset is content-addressed -> immutable (#243).
-    if (await exists(abs)) return fileResponse(abs, { dev, immutable: versioned });
+    if (await exists(abs)) {
+      const res = await fileResponse(abs, { dev, immutable: versioned });
+      // A worker served below its registration path only controls that subtree
+      // unless the response opts it up to the root scope. (#830)
+      if (path === '/sw.js') res.headers.set('Service-Worker-Allowed', '/');
+      return res;
+    }
   }
 
   // User source modules (served as ES modules, with action-file rewriting).
@@ -2369,7 +2380,7 @@ async function tsResponse(abs, dev, elideOpts, cache, immutable, reportDevError)
           `Replace enum / namespace / parameter-property / legacy-decorator / ` +
           `import = require constructs with their erasable equivalents. ` +
           `Run \`webjs check\` for guidance (no-non-erasable-typescript rule). ` +
-          `Docs: https://docs.webjs.com/docs/typescript`
+          `Docs: https://docs.webjs.dev/docs/typescript`
         // Prod: terse, no path leak, no Node-message leak (Node's
         // message can include source snippets). Operators get the
         // detail in server logs above.