dinou 5.0.1 → 5.0.2

package/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [5.0.2] - 2026-07-08
+
+### 🛡️ Security & Route Control
+* **Route Validation in RSC Payload Endpoints**: Unified security checks across endpoints. Direct requests to fetch RSC payloads (`/____rsc_payload____/*`) now enforce `validateParams()` and `allowISG()` checks matching the main HTML document loader behavior. This prevents direct payload scraping or scanning of blocked/invalid dynamic route parameters.
+
+### 🐛 Bug Fixes
+* **Sequential Compilation in ISR & ISG**: Resolved a critical race condition that caused disk cache desynchronization and persistent hydration mismatch errors.
+  * **Issue**: `Promise.all` compiled the RSC payload and HTML page in parallel. The HTML generator read the `rsc.rsc` file from disk before the new payload finished writing, saving a stale timestamp/state in the static HTML file.
+  * **Solution**: Refactored `revalidating.js` and `generating-isg.js` to execute sequentially. The RSC payload is compiled and committed first, ensuring the HTML compiler reads the freshly generated RSC file.
+* **ESM Loader Compatibility for Slot Error Boundaries (`importModule` vs `require`)**: Fixed a server-side crash when using React client hooks inside slot error components (`error.tsx`).
+  * **Issue**: The framework used CommonJS `require()` to import the slot error components, bypassing the registered ESM custom loader (`register-loader.mjs`). This caused `"use client"` components to be evaluated as Server Components, failing with `useState is not a function`.
+  * **Solution**: Updated `get-jsx.js` and `get-error-jsx.js` to load slot error modules using `await importModule()`, ensuring they are correctly resolved as Client Component References.
+
 ## [5.0.1] - 2026-07-07
 
 ### Fixed

package/dinou/core/client.jsx

@@ -64,6 +64,12 @@ const getRSCPayload = (rscKey, isPrefetch = false) => {
     payloadUrl = "/____rsc_payload____" + url;
   }
 
+  const buildId = window.__DINOU_BUILD_ID__;
+  if (buildId) {
+    payloadUrl += (payloadUrl.includes("?") ? "&" : "?") + "buildId=" + buildId;
+    window.__DINOU_BUILD_ID__ = undefined;
+  }
+
   // 3. Fetch and Cache Storage
   const promise = createFromFetch(
     fetch(payloadUrl).then((res) => {

package/dinou/core/generating-isg.js

@@ -41,33 +41,28 @@ function generatingISG(reqPath, isDynamicFromServer) {
         return; // 👋 We exit without doing anything, the page is dynamic
       }
 
-      // B. Generate HTML and RSC (Same as ISR)
-      const [pageResult, rscResult] = await Promise.all([
-        generateStaticPage(reqPath),
-        generateStaticRSC(reqPath),
-      ]);
-
-      // C. Transactional Commit
-      if (pageResult.success && rscResult.success) {
-        await safeRename(pageResult.tempPath, pageResult.finalPath);
+      // B. Generate HTML and RSC sequentially (RSC first, then HTML)
+      const rscResult = await generateStaticRSC(reqPath);
+      if (!rscResult.success) {
+        console.warn(`⚠️ [ISG] RSC generation failed for ${reqPath}. Aborting.`);
+        await fs.unlink(rscResult.tempPath).catch(() => {});
+        return;
+      }
 
-        // 2. Rename RSC (.tmp -> .rsc)
-        // HERE is where the EPERM used to fail
-        await safeRename(rscResult.tempPath, rscResult.finalPath);
-        // // Rename .tmp -> Final
-        // await fs.rename(pageResult.tempPath, pageResult.finalPath);
-        // await fs.rename(rscResult.tempPath, rscResult.finalPath);
+      // Commit the RSC payload immediately so that generateStaticPage can read it
+      await safeRename(rscResult.tempPath, rscResult.finalPath);
 
-        // Update Manifest
+      const pageResult = await generateStaticPage(reqPath);
+      if (pageResult.success) {
+        await safeRename(pageResult.tempPath, pageResult.finalPath);
         updateStatus(reqPath, pageResult.status);
         isDynamicFromServer.value = false;
         console.log(`✅ [ISG] Successfully promoted ${reqPath} to static.`);
       } else {
-        // Cleanup if failed
-        await fs.unlink(pageResult.tempPath).catch(() => { });
-        await fs.unlink(rscResult.tempPath).catch(() => { });
-        console.warn(`⚠️ [ISG] Failed to generate HTML/RSC for ${reqPath}`);
+        await fs.unlink(pageResult.tempPath).catch(() => {});
+        console.warn(`⚠️ [ISG] HTML generation failed for ${reqPath}. Aborting commit.`);
       }
+
     } catch (e) {
       console.error(`[ISG] Critical error promoting ${reqPath}:`, e);
     } finally {

package/dinou/core/get-error-jsx.js

@@ -140,7 +140,7 @@ async function getErrorJSX(reqPath, query, error, isDevelopment = false) {
                 );
 
               if (slotErrorPath) {
-                const slotErrorModule = require(slotErrorPath);
+                const slotErrorModule = await importModule(slotErrorPath);
                 const SlotError = slotErrorModule.default ?? slotErrorModule;
 
                 const serializedError = {

package/dinou/core/get-jsx.js

@@ -196,7 +196,7 @@ async function getJSX(
               );
 
             if (slotErrorPath) {
-              const slotErrorModule = require(slotErrorPath);
+              const slotErrorModule = await importModule(slotErrorPath);
               const SlotError = slotErrorModule.default ?? slotErrorModule;
 
               const serializedError = {

package/dinou/core/revalidating.js

@@ -37,7 +37,9 @@ function revalidating(reqPath, isDynamicFromServer) {
               path.join(dist2Folder, reqPath, "rsc.rsc"),
               path.join(dist2Folder, reqPath, "rsc._old.rsc")
             );
-        } catch (e) {}
+        } catch (e) {
+          console.error("[ISR] copyFileSync error:", e);
+        }
 
         regenerating.add(reqPath);
 
@@ -55,14 +57,19 @@ function revalidating(reqPath, isDynamicFromServer) {
           return;
         }
 
-        const [pageResult, rscResult] = await Promise.all([
-          generateStaticPage(reqPath),
-          generateStaticRSC(reqPath),
-        ]);
+        const rscResult = await generateStaticRSC(reqPath);
+        if (!rscResult.success) {
+          console.warn(`⚠️ [ISR] RSC generation failed for ${reqPath}. Aborting.`);
+          await fs.unlink(rscResult.tempPath).catch(() => {});
+          return;
+        }
 
-        if (pageResult.success && rscResult.success) {
+        // Commit the RSC payload immediately so that generateStaticPage can read it
+        await safeRename(rscResult.tempPath, rscResult.finalPath);
+
+        const pageResult = await generateStaticPage(reqPath);
+        if (pageResult.success) {
           await safeRename(pageResult.tempPath, pageResult.finalPath);
-          await safeRename(rscResult.tempPath, rscResult.finalPath);
           updateStatus(reqPath, pageResult.status);
           isDynamicFromServer.value = false;
           console.log(
@@ -70,11 +77,9 @@ function revalidating(reqPath, isDynamicFromServer) {
           );
         } else {
           console.warn(
-            `⚠️ [ISR] Partial failure for ${reqPath}. Aborting commit.`
+            `⚠️ [ISR] HTML generation failed for ${reqPath}. Aborting commit.`
           );
-
           await fs.unlink(pageResult.tempPath).catch(() => {});
-          await fs.unlink(rscResult.tempPath).catch(() => {});
         }
       } catch (e) {
         console.error(`[ISR] Critical error regenerating ${reqPath}:`, e);

package/dinou/core/server.js

@@ -621,11 +621,28 @@ async function serveRSCPayload(req, res, isOld = false, isStatic = false) {
     //   reqPath
     // );
     if ((!isDevelopment && !dynamicState.value) || isStatic) {
+      let currentGeneratedAt = null;
+      try {
+        const metadataPath = path.join("dist2", reqPath, "metadata.json");
+        if (existsSync(metadataPath)) {
+          const metaObj = JSON.parse(readFileSync(metadataPath, "utf8"));
+          currentGeneratedAt = metaObj.generatedAt || null;
+        }
+      } catch (e) {}
+
+      const useOld =
+        isOld ||
+        regenerating.has(reqPath) ||
+        (req.query.buildId &&
+          currentGeneratedAt &&
+          req.query.buildId !== String(currentGeneratedAt));
+
       const payloadPath = path.resolve(
         "dist2",
         reqPath.replace(/^\//, ""),
-        isOld || regenerating.has(reqPath) ? "rsc._old.rsc" : "rsc.rsc",
+        useOld ? "rsc._old.rsc" : "rsc.rsc",
       );
+
       const distDir = path.resolve("dist2");
 
       if (!payloadPath.startsWith(distDir)) {
@@ -633,6 +650,7 @@ async function serveRSCPayload(req, res, isOld = false, isStatic = false) {
       }
       if (existsSync(payloadPath)) {
         res.setHeader("Content-Type", "application/octet-stream");
+        res.setHeader("Cache-Control", "no-store, no-cache, must-revalidate");
         try {
           const buffer = readFileSync(payloadPath);
           return res.send(buffer);
@@ -642,6 +660,103 @@ async function serveRSCPayload(req, res, isOld = false, isStatic = false) {
         }
       }
     }
+    let isPathBlocked = false;
+    const reqSegments = reqPath.split("/").filter(Boolean);
+    const srcFolder = path.resolve(process.cwd(), "src");
+    const [pagePath, dynamicParams] = getFilePathAndDynamicParams(
+      reqSegments,
+      req.query,
+      srcFolder,
+    );
+
+    if (pagePath) {
+      let cachedConfig = pageFunctionsConfigCache.get(pagePath);
+      if (!cachedConfig) {
+        const pageFolder = path.dirname(pagePath);
+        const [pageFunctionsPath] = getFilePathAndDynamicParams(
+          reqSegments,
+          req.query,
+          pageFolder,
+          "page_functions",
+          true,
+          true,
+          undefined,
+          reqSegments.length,
+        );
+
+        if (pageFunctionsPath) {
+          const pageFunctionsModule = await importModule(pageFunctionsPath);
+          const allowISGValue = pageFunctionsModule.allowISG
+            ? await pageFunctionsModule.allowISG()
+            : true;
+
+          let staticPathsSet = null;
+          if (pageFunctionsModule.getStaticPaths) {
+            const paths = await pageFunctionsModule.getStaticPaths();
+            staticPathsSet = new Set(
+              (paths || []).map((pathObj) => {
+                const sortedEntries = Object.entries(pathObj).sort((a, b) =>
+                  a[0].localeCompare(b[0])
+                );
+                return JSON.stringify(sortedEntries);
+              })
+            );
+          }
+
+          cachedConfig = {
+            allowISG: allowISGValue,
+            staticPathsSet,
+            validateParams: pageFunctionsModule.validateParams || null,
+          };
+        } else {
+          cachedConfig = {
+            allowISG: true,
+            staticPathsSet: null,
+            validateParams: null,
+          };
+        }
+
+        if (!isDevelopment) {
+          pageFunctionsConfigCache.set(pagePath, cachedConfig);
+        }
+      }
+
+      const { allowISG: allowISGValue, staticPathsSet, validateParams: validateParamsFn } = cachedConfig;
+      const hasParams = Object.keys(dynamicParams || {}).length > 0;
+      if (hasParams) {
+        if (validateParamsFn) {
+          const isValid = await validateParamsFn(dynamicParams);
+          if (!isValid) {
+            isPathBlocked = true;
+          }
+        }
+
+        if (!isPathBlocked && allowISGValue === false) {
+          let isPathAllowed = false;
+          if (staticPathsSet) {
+            const sortedQueryEntries = Object.entries(dynamicParams)
+              .sort((a, b) => a[0].localeCompare(b[0]))
+              .map(([k, v]) => {
+                if (Array.isArray(v)) return [k, v.join(",")];
+                return [k, String(v)];
+              });
+            const serializedQuery = JSON.stringify(sortedQueryEntries);
+            isPathAllowed = staticPathsSet.has(serializedQuery);
+          }
+          if (!isPathAllowed) {
+            if (isDevelopment) {
+              isPathBlocked = true;
+            } else {
+              const htmlPath = path.join("dist2", reqPath, "index.html");
+              if (!existsSync(htmlPath)) {
+                isPathBlocked = true;
+              }
+            }
+          }
+        }
+      }
+    }
+
     const context = getContext(req, res);
     const isNotFound = {};
     await requestStorage.run(context, async () => {
@@ -650,6 +765,7 @@ async function serveRSCPayload(req, res, isOld = false, isStatic = false) {
         { ...req.query },
         isNotFound,
         isDevelopment,
+        isPathBlocked,
       );
 
       if (isNotFound.value) {
@@ -868,6 +984,7 @@ app.get(/^\/.*\/?$/, async (req, res) => {
 
       if (existsSync(fileToRead) && !dynamicState.value) {
         res.setHeader("Content-Type", "text/html");
+        res.setHeader("Cache-Control", "no-store, no-cache, must-revalidate");
         const meta = getStatus[reqPath];
 
         if (meta && meta.status) {
@@ -876,13 +993,26 @@ app.get(/^\/.*\/?$/, async (req, res) => {
           res.statusCode = 200; // Default
         }
         try {
-          const htmlContent = readFileSync(fileToRead);
-          res.write(htmlContent);
+          let htmlContent = readFileSync(fileToRead, "utf8");
+          let buildId = "";
+          try {
+            const metadataPath = path.join("dist2", reqPath, "metadata.json");
+            if (existsSync(metadataPath)) {
+              const metaObj = JSON.parse(readFileSync(metadataPath, "utf8"));
+              buildId = metaObj.generatedAt || "";
+            }
+          } catch (e) {}
+
+          let scripts = `<script>window.__DINOU_USE_STATIC__=true;</script>`;
           if (htmlPathOld) {
-            res.write("<script>window.__DINOU_USE_OLD_RSC__=true;</script>");
+            scripts += `<script>window.__DINOU_USE_OLD_RSC__=true;</script>`;
           }
-          res.write("<script>window.__DINOU_USE_STATIC__=true;</script>");
-          res.end();
+          if (buildId) {
+            scripts += `<script>window.__DINOU_BUILD_ID__="${buildId}";</script>`;
+          }
+
+          htmlContent = htmlContent.replace("</head>", `${scripts}</head>`);
+          res.send(htmlContent);
         } catch (err) {
           console.error("Error reading HTML file:", err);
           if (!res.headersSent) res.status(500).send("Server Error");

package/dinou/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dinou-ejected",
-  "version": "5.0.1",
+  "version": "5.0.2",
   "main": "index.js",
   "private": true,
   "exports": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dinou",
-  "version": "5.0.1",
+  "version": "5.0.2",
   "description": "Lightweight-Ejectable Full-Stack React 19 Framework with support for React Server Components (RSC), Server Functions, Server-Side Rendering (SSR), Static Generation (SSG), Incremental Static Generation (ISG), and Incremental Static Regeneration (ISR)",
   "main": "index.js",
   "bin": {