dinou 4.0.14 → 4.0.16

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [4.0.16] - 2026-06-30
+
+### Fixed
+- **Cookie Deletion Attributes**: Reconstructed streaming cookie deletion to serialize and include `domain`, `secure`, and `sameSite` properties, ensuring browsers match scopes and delete cookies correctly.
+- **Defensive Redirects**: Added a safety check in `resolveRelativeUrl` to fallback to `/` if the destination path is invalid (such as undefined or null), avoiding server crashes.
+- **TypeScript Type Definitions**: Updated the `clearCookie` signature in `index.d.ts` to accept the full `CookieOptions` interface, resolving compilation errors when using `sameSite` or `secure` attributes.
+
+## [4.0.15] - 2026-06-29
+
+### Added
+- **VFS Routing Cache**: Introduced an in-memory Virtual File System (VFS) to cache filesystem structures under `src/` at production startup, resolving dynamic routes entirely in-memory and eliminating synchronous event loop-blocking disk I/O.
+
+### Fixed
+- **Cross-Platform Separators**: Normalized Server Functions manifest keys and runtime lookup checks to consistently use forward slashes (`/`), preventing OS path format mismatches (`\` vs `/`) and subsequent `400 Bad Request` execution errors.
+
 ## [4.0.14] - 2026-06-29
 ### Added
 - **Soft Redirects**: Exposes the SPA transition navigation internally via `window.__DINOU_ROUTER_NAVIGATE__` to enable smooth client-side redirects from both Server Functions and RSC payloads, keeping the React client state intact and preventing full browser page reloads.

package/dinou/core/get-error-jsx.js

@@ -1,5 +1,5 @@
 const path = require("path");
-const { existsSync } = require("fs");
+const { existsSync } = require("./vfs");
 const React = require("react");
 const {
   getFilePathAndDynamicParams,

package/dinou/core/get-file-path-and-dynamic-params.js

@@ -1,5 +1,5 @@
 const path = require("path");
-const { existsSync, readdirSync } = require("fs");
+const { existsSync, readdirSync } = require("./vfs");
 const React = require("react");
 
 function safeDecode(val) {

package/dinou/core/get-jsx.js

@@ -1,5 +1,5 @@
 const path = require("path");
-const { existsSync } = require("fs");
+const { existsSync } = require("./vfs");
 const React = require("react");
 const {
   getFilePathAndDynamicParams,

package/dinou/core/render-app-to-html.js

@@ -121,14 +121,21 @@ function renderAppToHtml(
           // --- CLEAR COOKIE (JS Injection - Only Non-HttpOnly) ---
           if (command === "clearCookie") {
             const [name, options] = args;
-            const path = options && options.path ? options.path : "/";
             console.log(
               `[Dinou] Streaming active. Clearing cookie '${name}' via JS.`,
             );
-            const safeName = JSON.stringify(name);
-            const safePath = JSON.stringify(path);
+            let cookieStr = `${name}=; Max-Age=0`;
+            const path = options?.path || "/";
+            cookieStr += `; path=${path}`;
+            if (options) {
+              if (options.domain) cookieStr += `; domain=${options.domain}`;
+              if (options.secure) cookieStr += `; secure`;
+              if (options.sameSite) cookieStr += `; samesite=${options.sameSite}`;
+            }
+            cookieStr += ";";
+            const safeCookieStr = JSON.stringify(cookieStr);
             res.write(
-              `<script>document.cookie = ${safeName} + "=; Max-Age=0; path=" + ${safePath} + ";";</script>`,
+              `<script>document.cookie = ${safeCookieStr};</script>`,
             );
             return;
           }

package/dinou/core/server.js

@@ -447,8 +447,6 @@ function getContextForServerFunctionEndpoint(req, res) {
       },
 
       clearCookie: (name, options) => {
-        const path = options?.path || "/";
-
         // SCENARIO A: Native
         if (!res.headersSent) {
           res.setHeader("Content-Type", "text/x-component");
@@ -457,7 +455,15 @@ function getContextForServerFunctionEndpoint(req, res) {
         }
 
         // SCENARIO B: Custom stream command
-        const cookieStr = `${name}=; Max-Age=0; path=${path};`;
+        let cookieStr = `${name}=; Max-Age=0`;
+        const path = options?.path || "/";
+        cookieStr += `; path=${path}`;
+        if (options) {
+          if (options.domain) cookieStr += `; domain=${options.domain}`;
+          if (options.secure) cookieStr += `; secure`;
+          if (options.sameSite) cookieStr += `; samesite=${options.sameSite}`;
+        }
+        cookieStr += ";";
         const safeCookieStr = JSON.stringify(cookieStr);
         res.write(`D:{"type":"cookie","cookie":${safeCookieStr}}\n`);
       },
@@ -918,10 +924,11 @@ app.post("/____server_function____", async (req, res) => {
       return res.status(404).json({ error: "File not found" });
     }
 
+    const normalizedKey = relativePath.replace(/\\/g, "/");
     let allowedExports;
     if (serverFunctionsManifest) {
       // Prod: use manifest (relativePath is already normalized)
-      allowedExports = serverFunctionsManifest[relativePath];
+      allowedExports = serverFunctionsManifest[normalizedKey];
     } else {
       if (!isDevelopment) {
         return res

package/dinou/core/url-resolver.js

@@ -1,4 +1,7 @@
 function resolveRelativeUrl(href, currentPathname) {
+  if (!href || typeof href !== "string") {
+    return "/";
+  }
   if (href.startsWith("/") || href.includes("://")) {
     return href;
   }

package/dinou/core/vfs.js

@@ -0,0 +1,68 @@
+const fs = require("fs");
+const path = require("path");
+
+const isDevelopment = process.env.NODE_ENV !== "production";
+const vfs = {};
+
+function buildVfs(dir) {
+  if (!fs.existsSync(dir)) return;
+  const entries = fs.readdirSync(dir, { withFileTypes: true });
+  const children = [];
+
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name);
+    const isDirectory = entry.isDirectory();
+    children.push({
+      name: entry.name,
+      isDirectory
+    });
+    if (isDirectory) {
+      buildVfs(fullPath);
+    } else {
+      vfs[fullPath] = { type: "file" };
+    }
+  }
+
+  vfs[dir] = {
+    type: "directory",
+    children
+  };
+}
+
+if (!isDevelopment) {
+  const srcDir = path.resolve(process.cwd(), "src");
+  buildVfs(srcDir);
+}
+
+function existsSync(filePath) {
+  if (isDevelopment) {
+    return fs.existsSync(filePath);
+  }
+  const normalized = path.resolve(filePath);
+  return !!vfs[normalized];
+}
+
+function readdirSync(dirPath, options) {
+  if (isDevelopment) {
+    return fs.readdirSync(dirPath, options);
+  }
+  const normalized = path.resolve(dirPath);
+  const entry = vfs[normalized];
+  if (!entry || entry.type !== "directory") {
+    throw new Error(`ENOTDIR: not a directory, readdir '${dirPath}'`);
+  }
+
+  if (options && options.withFileTypes) {
+    return entry.children.map(child => ({
+      name: child.name,
+      isDirectory: () => child.isDirectory,
+      isFile: () => !child.isDirectory
+    }));
+  }
+  return entry.children.map(child => child.name);
+}
+
+module.exports = {
+  existsSync,
+  readdirSync
+};

package/dinou/esbuild/plugins-esbuild/server-functions-plugin.mjs

@@ -19,7 +19,7 @@ export default function serverFunctionsPlugin(manifestData = {}) {
         const exports = parseExports(code);
         if (exports.length === 0) return null;
 
-        const relativePath = path.relative(root, args.path);
+        const relativePath = path.relative(root, args.path).replace(/\\/g, "/");
         serverFunctions.set(relativePath, new Set(exports)); // Save exports as a Set to guarantee uniqueness
 
         const fileUrl = `file:///${relativePath}`;

package/dinou/index.d.ts

@@ -55,7 +55,7 @@ export interface ResponseProxy {
    * @param name Name of the cookie to clear.
    * @param options Cookie options (e.g., domain, path).
    */
-  clearCookie(name: string, options?: { domain?: string; path?: string }): void;
+  clearCookie(name: string, options?: CookieOptions): void;
 
   /**
    * Sends a command to the main process to set an HTTP header.

package/dinou/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dinou-ejected",
-  "version": "4.0.14",
+  "version": "4.0.16",
   "main": "index.js",
   "private": true,
   "exports": {

package/dinou/rollup/rollup-plugins/rollup-plugin-server-functions.js

@@ -17,7 +17,7 @@ function serverFunctionsPlugin() {
       const exports = parseExports(code);
       if (exports.length === 0) return null;
 
-      const relativePath = path.relative(root, id);
+      const relativePath = path.relative(root, id).replace(/\\/g, "/");
       serverFunctions.set(relativePath, new Set(exports)); // Save exports as a Set for uniqueness
 
       const fileUrl = `file:///${relativePath}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dinou",
-  "version": "4.0.14",
+  "version": "4.0.16",
   "description": "Full-Stack React 19 framework with React Server Components, Server Functions, and Streaming SSR.",
   "main": "index.js",
   "bin": {