one 1.10.6 → 1.11.0

package/dist/cjs/cli/build.cjs

@@ -37,6 +37,7 @@ module.exports = __toCommonJS(build_exports);
 var import_node_module = require("node:module"),
   import_node_os = require("node:os"),
   import_node_path = __toESM(require("node:path"), 1),
+  import_resolve = require("@vxrn/resolve"),
   import_fs_extra = __toESM(require("fs-extra"), 1),
   import_micromatch = __toESM(require("micromatch"), 1),
   import_vite = require("vite"),
@@ -56,7 +57,8 @@ var import_node_module = require("node:module"),
   import_workerPool = require("./workerPool.cjs"),
   import_generateSitemap = require("./generateSitemap.cjs"),
   import_label_process = require("./label-process.cjs"),
-  import_pLimit = require("../utils/pLimit.cjs");
+  import_pLimit = require("../utils/pLimit.cjs"),
+  import_criticalCSSPlugin = require("../vite/plugins/criticalCSSPlugin.cjs");
 const import_meta = {},
   {
     ensureDir,
@@ -74,11 +76,13 @@ async function build(args) {
  \u26A0\uFE0F  Warning: NODE_ENV is set to "${process.env.NODE_ENV}" (builds default to "production")
 `) : process.env.NODE_ENV = "production", (0, import_label_process.labelProcess)("build"), (0, import_checkNodeVersion.checkNodeVersion)(), (0, import_setServerGlobals.setServerGlobals)();
   const {
-      oneOptions
+      oneOptions,
+      config: viteLoadedConfig
     } = await (0, import_loadConfig.loadUserOneOptions)("build"),
     routerRoot = (0, import_getRouterRootFromOneOptions.getRouterRootFromOneOptions)(oneOptions);
   oneOptions.web?.defaultRenderMode && (process.env.ONE_DEFAULT_RENDER_MODE = oneOptions.web.defaultRenderMode);
-  const manifest = (0, import_getManifest.getManifest)({
+  const outDir = viteLoadedConfig?.config?.build?.outDir ?? "dist",
+    manifest = (0, import_getManifest.getManifest)({
       routerRoot
     }),
     serverOutputFormat = oneOptions.build?.server === !1 ? "esm" : oneOptions.build?.server?.outputFormat ?? "esm",
@@ -103,12 +107,23 @@ async function build(args) {
     {
       optimizeDeps
     } = (0, import_vxrn.getOptimizeDeps)("build"),
+    {
+      rolldownOptions: _rolldownOptions,
+      ...optimizeDepsNoRolldown
+    } = optimizeDeps,
     apiBuildConfig = (0, import_vite.mergeConfig)(
     // feels like this should build off the *server* build config not web
     vxrnOutput.webBuildConfig, {
       configFile: !1,
       appType: "custom",
-      optimizeDeps
+      optimizeDeps: optimizeDepsNoRolldown,
+      environments: {
+        client: {
+          optimizeDeps: {
+            rolldownOptions: _rolldownOptions
+          }
+        }
+      }
     });
   async function buildCustomRoutes(subFolder, routes) {
     const input = routes.reduce((entries, {
@@ -129,15 +144,22 @@ async function build(args) {
         ssr: {
           noExternal: !0,
           external: ["react", "react-dom"],
-          optimizeDeps
+          optimizeDeps: optimizeDepsNoRolldown
+        },
+        environments: {
+          ssr: {
+            optimizeDeps: {
+              rolldownOptions: _rolldownOptions
+            }
+          }
         },
         build: {
           ssr: !0,
           emptyOutDir: !1,
-          outDir: `dist/${subFolder}`,
+          outDir: `${outDir}/${subFolder}`,
           copyPublicDir: !1,
           minify: !1,
-          rollupOptions: {
+          rolldownOptions: {
             treeshake: treeshake ?? {
               moduleSideEffects: !1
             },
@@ -151,7 +173,7 @@ async function build(args) {
             // prevents it from shaking out the exports
             preserveEntrySignatures: "strict",
             input,
-            external: () => !1,
+            external: [],
             output: {
               entryFileNames: "[name]",
               exports: "auto",
@@ -198,7 +220,7 @@ async function build(args) {
       fullPath = (0, import_node_path.join)(absoluteRoot, routerRoot, middleware.file),
       chunk = middlewareBuildInfo.output.filter(x => x.type === "chunk").find(x => x.facadeModuleId === fullPath);
     if (!chunk) throw new Error("internal err finding middleware");
-    builtMiddlewares[middleware.file] = (0, import_node_path.join)("dist", "middlewares", chunk.fileName);
+    builtMiddlewares[middleware.file] = (0, import_node_path.join)(outDir, "middlewares", chunk.fileName);
   }
   globalThis.require = (0, import_node_module.createRequire)((0, import_node_path.join)(import_meta.url, ".."));
   const assets = [],
@@ -206,17 +228,21 @@ async function build(args) {
     sitemapData = [],
     collectImportsCache = /* @__PURE__ */new Map(),
     cssFileContentsCache = /* @__PURE__ */new Map(),
+    criticalCSSOutputPaths = (0, import_criticalCSSPlugin.getCriticalCSSOutputPaths)(vxrnOutput.clientManifest),
     limit = (0, import_pLimit.pLimit)(BUILD_CONCURRENCY),
     useWorkers = shouldUseWorkers(oneOptions),
     workerPool = useWorkers ? (0, import_workerPool.getWorkerPool)(BUILD_CONCURRENCY) : null;
-  workerPool && (await workerPool.initialize());
+  if (workerPool) {
+    const serializableOptions = JSON.parse(JSON.stringify(oneOptions, (_key, value) => typeof value == "function" ? void 0 : value));
+    await workerPool.initialize(serializableOptions);
+  }
   const staticStartTime = performance.now(),
     modeLabel = useWorkers ? `workers: ${workerPool?.size}` : `concurrency: ${BUILD_CONCURRENCY}`;
   console.info(`
  \u{1F528} build static routes (${modeLabel})
 `);
-  const staticDir = (0, import_node_path.join)("dist/static"),
-    clientDir = (0, import_node_path.join)("dist/client");
+  const staticDir = (0, import_node_path.join)(`${outDir}/static`),
+    clientDir = (0, import_node_path.join)(`${outDir}/client`);
   if (await ensureDir(staticDir), !vxrnOutput.serverOutput) throw new Error("No server output");
   const clientChunksBySource = /* @__PURE__ */new Map();
   if (vxrnOutput.clientOutput) for (const chunk of vxrnOutput.clientOutput) chunk.type === "chunk" && chunk.facadeModuleId && clientChunksBySource.set(chunk.facadeModuleId, {
@@ -340,15 +366,21 @@ async function build(args) {
       deferredPreloads = needsSeparatedPreloads ? [... /* @__PURE__ */new Set([...entryImports, ...layoutEntries.flatMap(entry => collectImports(entry))])].filter(path => !criticalPreloads.includes(`/${path}`)).map(path => `/${path}`) : void 0,
       preloads2 = needsSeparatedPreloads ? [...criticalPreloads, ...deferredPreloads] : allPreloads,
       allEntries = [clientManifestEntry, ...layoutEntries].filter(Boolean),
-      allCSS = [... /* @__PURE__ */new Set([
-      // css from entry imports
-      ...allEntries.flatMap(entry => collectImports(entry, {
+      layoutCSS = [...new Set(layoutEntries.flatMap(entry => collectImports(entry, {
         type: "css"
-      })).map(path => `/${path}`),
+      })).map(path => `/${path}`))],
+      allCSS = [... /* @__PURE__ */new Set([...layoutCSS,
+      // css from page entry
+      ...(clientManifestEntry ? collectImports(clientManifestEntry, {
+        type: "css"
+      }).map(path => `/${path}`) : []),
       // root-level css (handles cssCodeSplit: false)
-      ...Object.entries(vxrnOutput.clientManifest).filter(([key]) => key.endsWith(".css")).map(([, entry]) => `/${entry.file}`)])];
+      ...Object.entries(vxrnOutput.clientManifest).filter(([key]) => key.endsWith(".css")).map(([, entry]) => `/${entry.file}`)])],
+      hasCriticalCSS = allCSS.some(p => criticalCSSOutputPaths.has(p)),
+      needsCSSContents = oneOptions.web?.inlineLayoutCSS || hasCriticalCSS;
     let allCSSContents;
-    oneOptions.web?.inlineLayoutCSS && (allCSSContents = await Promise.all(allCSS.map(async cssPath => {
+    needsCSSContents && (allCSSContents = await Promise.all(allCSS.map(async cssPath => {
+      if (!oneOptions.web?.inlineLayoutCSS && !criticalCSSOutputPaths.has(cssPath)) return "";
       const cached = cssFileContentsCache.get(cssPath);
       if (cached !== void 0) return cached;
       const filePath = (0, import_node_path.join)(clientDir, cssPath);
@@ -364,7 +396,7 @@ async function build(args) {
       allEntries,
       allCSS
     });
-    const serverJsPath = (0, import_node_path.join)("dist/server", serverFileName);
+    const serverJsPath = (0, import_node_path.join)(`${outDir}/server`, serverFileName);
     let exported;
     try {
       exported = await import((0, import_toAbsolute.toAbsolute)(serverJsPath));
@@ -406,6 +438,7 @@ async function build(args) {
           serverJsPath,
           preloads: preloads2,
           allCSS,
+          layoutCSS,
           routePreloads,
           allCSSContents,
           criticalPreloads,
@@ -419,7 +452,7 @@ async function build(args) {
           console.info(`  \u21A6 route ${path}`);
           try {
             return {
-              built: await (0, import_one_server_only.runWithAsyncLocalContext)(async () => await (0, import_buildPage.buildPage)(vxrnOutput.serverEntry, path, relativeId, params, foundRoute, clientManifestEntry, staticDir, clientDir, builtMiddlewares, serverJsPath, preloads2, allCSS, routePreloads, allCSSContents, criticalPreloads, deferredPreloads, useAfterLCP, useAfterLCPAggressive)),
+              built: await (0, import_one_server_only.runWithAsyncLocalContext)(async () => await (0, import_buildPage.buildPage)(vxrnOutput.serverEntry, path, relativeId, params, foundRoute, clientManifestEntry, staticDir, clientDir, builtMiddlewares, serverJsPath, preloads2, allCSS, layoutCSS, routePreloads, allCSSContents, criticalPreloads, deferredPreloads, useAfterLCP, useAfterLCPAggressive)),
               path
             };
           } catch (err) {
@@ -475,6 +508,7 @@ async function build(args) {
     return buildInfo && (built.loaderPath = buildInfo.loaderPath), built;
   }
   const buildInfoForWriting = {
+    outDir,
     oneOptions,
     routeToBuildInfo,
     pathToRoute,
@@ -492,7 +526,7 @@ async function build(args) {
     loaders,
     useRolldown: await (0, import_isRolldown.isRolldown)()
   };
-  await writeJSON((0, import_toAbsolute.toAbsolute)("dist/buildInfo.json"), buildInfoForWriting), await import_fs_extra.default.writeFile((0, import_node_path.join)(clientDir, "version.json"), JSON.stringify({
+  await writeJSON((0, import_toAbsolute.toAbsolute)(`${outDir}/buildInfo.json`), buildInfoForWriting), await import_fs_extra.default.writeFile((0, import_node_path.join)(clientDir, "version.json"), JSON.stringify({
     version: constants.CACHE_KEY
   })), console.info(`
  \u{1F6E1} skew protection: emitted version.json
@@ -531,7 +565,7 @@ async function build(args) {
           apiRouteMap = [],
           middlewareRouteMap = [];
         for (const [routeFile, info] of Object.entries(buildInfoForWriting.routeToBuildInfo)) if (info.serverJsPath) {
-          const importPath = "./" + info.serverJsPath.replace(/^dist\//, "");
+          const importPath = "./" + info.serverJsPath.replace(new RegExp(`^${outDir}/`), "");
           pageRouteMap.push(`  '${routeFile}': () => import('${importPath}')`);
         }
         for (const route of buildInfoForWriting.manifest.apiRoutes) if (route.file) {
@@ -539,10 +573,10 @@ async function build(args) {
           apiRouteMap.push(`  '${route.page}': () => import('${importPath}')`);
         }
         for (const [, builtPath] of Object.entries(builtMiddlewares)) {
-          const importPath = "./" + builtPath.replace(/^dist\//, "");
+          const importPath = "./" + builtPath.replace(new RegExp(`^${outDir}/`), "");
           middlewareRouteMap.push(`  '${builtPath}': () => import('${importPath}')`);
         }
-        const workerSrcPath = (0, import_node_path.join)(options.root, "dist", "_worker-src.js"),
+        const workerSrcPath = (0, import_node_path.join)(options.root, outDir, "_worker-src.js"),
           workerCode = `// Polyfill MessageChannel for React SSR (not available in Cloudflare Workers by default)
 if (typeof MessageChannel === 'undefined') {
   globalThis.MessageChannel = class MessageChannel {
@@ -629,13 +663,14 @@ export default {
         await import_fs_extra.default.writeFile(workerSrcPath, workerCode), console.info(`
  [cloudflare] Bundling worker...`), await (0, import_vite.build)({
           root: options.root,
+          mode: "production",
           logLevel: "warn",
           build: {
-            outDir: "dist",
+            outDir,
             emptyOutDir: !1,
             // Use SSR mode with node target for proper Node.js module resolution
             ssr: workerSrcPath,
-            rollupOptions: {
+            rolldownOptions: {
               external: [
               // React Native dev tools - not needed in production
               "@react-native/dev-middleware", "@react-native/debugger-shell", "metro", "metro-core", "metro-runtime",
@@ -656,13 +691,28 @@ export default {
             "process.env.VITE_ENVIRONMENT": JSON.stringify("ssr")
           },
           resolve: {
-            conditions: ["workerd", "worker", "node", "module", "default"]
+            conditions: ["workerd", "worker", "node", "module", "default"],
+            alias: [
+            // rolldown can't parse react-native's Flow syntax; alias to react-native-web for ssr
+            {
+              find: /^react-native\/Libraries\/.*/,
+              replacement: (0, import_resolve.resolvePath)("@vxrn/vite-plugin-metro/empty", options.root)
+            }, {
+              find: "react-native/package.json",
+              replacement: (0, import_resolve.resolvePath)("react-native-web/package.json", options.root)
+            }, {
+              find: "react-native",
+              replacement: (0, import_resolve.resolvePath)("react-native-web", options.root)
+            }, {
+              find: "react-native-safe-area-context",
+              replacement: (0, import_resolve.resolvePath)("@vxrn/safe-area", options.root)
+            }]
           },
           ssr: {
             target: "node",
             noExternal: !0
           }
-        }), await import_fs_extra.default.remove(workerSrcPath), await import_fs_extra.default.writeFile((0, import_node_path.join)(options.root, "dist", "wrangler.jsonc"), `{
+        }), await import_fs_extra.default.remove(workerSrcPath), await import_fs_extra.default.writeFile((0, import_node_path.join)(options.root, outDir, "wrangler.jsonc"), `{
   "name": "one-app",
   "main": "worker.js",
   "compatibility_date": "2024-12-05",
@@ -675,10 +725,19 @@ export default {
   ],
   "assets": { "directory": "client", "binding": "ASSETS", "run_worker_first": true }
 }
-`), postBuildLogs.push("Cloudflare worker bundled at dist/worker.js"), postBuildLogs.push("To deploy: cd dist && wrangler deploy");
+`), postBuildLogs.push(`Cloudflare worker bundled at ${outDir}/worker.js`), postBuildLogs.push(`To deploy: cd ${outDir} && wrangler deploy`);
         break;
       }
   }
+  const securityScanOption = oneOptions.build?.securityScan,
+    securityScanLevel = securityScanOption === !1 ? null : securityScanOption === !0 || securityScanOption === void 0 ? "warn" : typeof securityScanOption == "string" ? securityScanOption : securityScanOption.level ?? "warn",
+    securitySafePatterns = typeof securityScanOption == "object" && securityScanOption !== null ? securityScanOption.safePatterns : void 0;
+  if (securityScanLevel) {
+    const {
+      runSecurityScan
+    } = await import("./securityScan");
+    (await runSecurityScan(clientDir, securityScanLevel, securitySafePatterns)) || process.exit(1);
+  }
   postBuildLogs.length && (console.info(`
 
 `), postBuildLogs.forEach(log => {

package/dist/cjs/cli/build.js

@@ -25,7 +25,7 @@ __export(build_exports, {
   build: () => build
 });
 module.exports = __toCommonJS(build_exports);
-var import_node_module = require("node:module"), import_node_os = require("node:os"), import_node_path = __toESM(require("node:path"), 1), import_fs_extra = __toESM(require("fs-extra"), 1), import_micromatch = __toESM(require("micromatch"), 1), import_vite = require("vite"), import_vxrn = require("vxrn"), constants = __toESM(require("../constants"), 1), import_setServerGlobals = require("../server/setServerGlobals"), import_getPathnameFromFilePath = require("../utils/getPathnameFromFilePath"), import_getRouterRootFromOneOptions = require("../utils/getRouterRootFromOneOptions"), import_isRolldown = require("../utils/isRolldown"), import_toAbsolute = require("../utils/toAbsolute"), import_buildVercelOutputDirectory = require("../vercel/build/buildVercelOutputDirectory"), import_getManifest = require("../vite/getManifest"), import_loadConfig = require("../vite/loadConfig"), import_one_server_only = require("../vite/one-server-only"), import_buildPage = require("./buildPage"), import_checkNodeVersion = require("./checkNodeVersion"), import_workerPool = require("./workerPool"), import_generateSitemap = require("./generateSitemap"), import_label_process = require("./label-process"), import_pLimit = require("../utils/pLimit");
+var import_node_module = require("node:module"), import_node_os = require("node:os"), import_node_path = __toESM(require("node:path"), 1), import_resolve = require("@vxrn/resolve"), import_fs_extra = __toESM(require("fs-extra"), 1), import_micromatch = __toESM(require("micromatch"), 1), import_vite = require("vite"), import_vxrn = require("vxrn"), constants = __toESM(require("../constants"), 1), import_setServerGlobals = require("../server/setServerGlobals"), import_getPathnameFromFilePath = require("../utils/getPathnameFromFilePath"), import_getRouterRootFromOneOptions = require("../utils/getRouterRootFromOneOptions"), import_isRolldown = require("../utils/isRolldown"), import_toAbsolute = require("../utils/toAbsolute"), import_buildVercelOutputDirectory = require("../vercel/build/buildVercelOutputDirectory"), import_getManifest = require("../vite/getManifest"), import_loadConfig = require("../vite/loadConfig"), import_one_server_only = require("../vite/one-server-only"), import_buildPage = require("./buildPage"), import_checkNodeVersion = require("./checkNodeVersion"), import_workerPool = require("./workerPool"), import_generateSitemap = require("./generateSitemap"), import_label_process = require("./label-process"), import_pLimit = require("../utils/pLimit"), import_criticalCSSPlugin = require("../vite/plugins/criticalCSSPlugin");
 const import_meta = {}, { ensureDir, writeJSON } = import_fs_extra.default, BUILD_CONCURRENCY = process.env.ONE_BUILD_CONCURRENCY ? Math.max(1, parseInt(process.env.ONE_BUILD_CONCURRENCY, 10)) : Math.max(1, Math.min((0, import_node_os.cpus)().length, 8));
 function shouldUseWorkers(oneOptions) {
   return process.env.ONE_BUILD_WORKERS === "0" ? !1 : process.env.ONE_BUILD_WORKERS === "1" ? !0 : oneOptions?.build?.workers !== !1;
@@ -39,9 +39,9 @@ async function build(args) {
  \u26A0\uFE0F  Warning: NODE_ENV is set to "${process.env.NODE_ENV}" (builds default to "production")
 `
   ) : process.env.NODE_ENV = "production", (0, import_label_process.labelProcess)("build"), (0, import_checkNodeVersion.checkNodeVersion)(), (0, import_setServerGlobals.setServerGlobals)();
-  const { oneOptions } = await (0, import_loadConfig.loadUserOneOptions)("build"), routerRoot = (0, import_getRouterRootFromOneOptions.getRouterRootFromOneOptions)(oneOptions);
+  const { oneOptions, config: viteLoadedConfig } = await (0, import_loadConfig.loadUserOneOptions)("build"), routerRoot = (0, import_getRouterRootFromOneOptions.getRouterRootFromOneOptions)(oneOptions);
   oneOptions.web?.defaultRenderMode && (process.env.ONE_DEFAULT_RENDER_MODE = oneOptions.web.defaultRenderMode);
-  const manifest = (0, import_getManifest.getManifest)({ routerRoot }), serverOutputFormat = oneOptions.build?.server === !1 ? "esm" : oneOptions.build?.server?.outputFormat ?? "esm", buildStartTime = performance.now(), vxrnOutput = await (0, import_vxrn.build)(
+  const outDir = viteLoadedConfig?.config?.build?.outDir ?? "dist", manifest = (0, import_getManifest.getManifest)({ routerRoot }), serverOutputFormat = oneOptions.build?.server === !1 ? "esm" : oneOptions.build?.server?.outputFormat ?? "esm", buildStartTime = performance.now(), vxrnOutput = await (0, import_vxrn.build)(
     {
       skipEnv: args.skipEnv ?? oneOptions.skipEnv,
       server: oneOptions.server,
@@ -58,13 +58,18 @@ async function build(args) {
  \u23F1\uFE0F  vite bundle: ${(bundleTime / 1e3).toFixed(2)}s
 `), !vxrnOutput || args.platform !== "web")
     return;
-  const options = await (0, import_vxrn.fillOptions)(vxrnOutput.options, { mode: "prod" }), { optimizeDeps } = (0, import_vxrn.getOptimizeDeps)("build"), apiBuildConfig = (0, import_vite.mergeConfig)(
+  const options = await (0, import_vxrn.fillOptions)(vxrnOutput.options, { mode: "prod" }), { optimizeDeps } = (0, import_vxrn.getOptimizeDeps)("build"), { rolldownOptions: _rolldownOptions, ...optimizeDepsNoRolldown } = optimizeDeps, apiBuildConfig = (0, import_vite.mergeConfig)(
     // feels like this should build off the *server* build config not web
     vxrnOutput.webBuildConfig,
     {
       configFile: !1,
       appType: "custom",
-      optimizeDeps
+      optimizeDeps: optimizeDepsNoRolldown,
+      environments: {
+        client: {
+          optimizeDeps: { rolldownOptions: _rolldownOptions }
+        }
+      }
     }
   );
   async function buildCustomRoutes(subFolder, routes) {
@@ -80,15 +85,20 @@ async function build(args) {
       ssr: {
         noExternal: !0,
         external: ["react", "react-dom"],
-        optimizeDeps
+        optimizeDeps: optimizeDepsNoRolldown
+      },
+      environments: {
+        ssr: {
+          optimizeDeps: { rolldownOptions: _rolldownOptions }
+        }
       },
       build: {
         ssr: !0,
         emptyOutDir: !1,
-        outDir: `dist/${subFolder}`,
+        outDir: `${outDir}/${subFolder}`,
         copyPublicDir: !1,
         minify: !1,
-        rollupOptions: {
+        rolldownOptions: {
           treeshake: treeshake ?? {
             moduleSideEffects: !1
           },
@@ -103,7 +113,7 @@ async function build(args) {
           // prevents it from shaking out the exports
           preserveEntrySignatures: "strict",
           input,
-          external: () => !1,
+          external: [],
           output: {
             entryFileNames: "[name]",
             exports: "auto",
@@ -147,16 +157,24 @@ async function build(args) {
     for (const middleware of manifest.middlewareRoutes) {
       const absoluteRoot = (0, import_node_path.resolve)(process.cwd(), options.root), fullPath = (0, import_node_path.join)(absoluteRoot, routerRoot, middleware.file), chunk = middlewareBuildInfo.output.filter((x) => x.type === "chunk").find((x) => x.facadeModuleId === fullPath);
       if (!chunk) throw new Error("internal err finding middleware");
-      builtMiddlewares[middleware.file] = (0, import_node_path.join)("dist", "middlewares", chunk.fileName);
+      builtMiddlewares[middleware.file] = (0, import_node_path.join)(outDir, "middlewares", chunk.fileName);
     }
   globalThis.require = (0, import_node_module.createRequire)((0, import_node_path.join)(import_meta.url, ".."));
-  const assets = [], builtRoutes = [], sitemapData = [], collectImportsCache = /* @__PURE__ */ new Map(), cssFileContentsCache = /* @__PURE__ */ new Map(), limit = (0, import_pLimit.pLimit)(BUILD_CONCURRENCY), useWorkers = shouldUseWorkers(oneOptions), workerPool = useWorkers ? (0, import_workerPool.getWorkerPool)(BUILD_CONCURRENCY) : null;
-  workerPool && await workerPool.initialize();
+  const assets = [], builtRoutes = [], sitemapData = [], collectImportsCache = /* @__PURE__ */ new Map(), cssFileContentsCache = /* @__PURE__ */ new Map(), criticalCSSOutputPaths = (0, import_criticalCSSPlugin.getCriticalCSSOutputPaths)(vxrnOutput.clientManifest), limit = (0, import_pLimit.pLimit)(BUILD_CONCURRENCY), useWorkers = shouldUseWorkers(oneOptions), workerPool = useWorkers ? (0, import_workerPool.getWorkerPool)(BUILD_CONCURRENCY) : null;
+  if (workerPool) {
+    const serializableOptions = JSON.parse(
+      JSON.stringify(
+        oneOptions,
+        (_key, value) => typeof value == "function" ? void 0 : value
+      )
+    );
+    await workerPool.initialize(serializableOptions);
+  }
   const staticStartTime = performance.now(), modeLabel = useWorkers ? `workers: ${workerPool?.size}` : `concurrency: ${BUILD_CONCURRENCY}`;
   console.info(`
  \u{1F528} build static routes (${modeLabel})
 `);
-  const staticDir = (0, import_node_path.join)("dist/static"), clientDir = (0, import_node_path.join)("dist/client");
+  const staticDir = (0, import_node_path.join)(`${outDir}/static`), clientDir = (0, import_node_path.join)(`${outDir}/client`);
   if (await ensureDir(staticDir), !vxrnOutput.serverOutput)
     throw new Error("No server output");
   const clientChunksBySource = /* @__PURE__ */ new Map();
@@ -294,17 +312,24 @@ async function build(args) {
         ...entryImports,
         ...layoutEntries.flatMap((entry) => collectImports(entry))
       ])
-    ].filter((path) => !criticalPreloads.includes(`/${path}`)).map((path) => `/${path}`) : void 0, preloads2 = needsSeparatedPreloads ? [...criticalPreloads, ...deferredPreloads] : allPreloads, allEntries = [clientManifestEntry, ...layoutEntries].filter(Boolean), allCSS = [
+    ].filter((path) => !criticalPreloads.includes(`/${path}`)).map((path) => `/${path}`) : void 0, preloads2 = needsSeparatedPreloads ? [...criticalPreloads, ...deferredPreloads] : allPreloads, allEntries = [clientManifestEntry, ...layoutEntries].filter(Boolean), layoutCSS = [
+      ...new Set(
+        layoutEntries.flatMap((entry) => collectImports(entry, { type: "css" })).map((path) => `/${path}`)
+      )
+    ], allCSS = [
       .../* @__PURE__ */ new Set([
-        // css from entry imports
-        ...allEntries.flatMap((entry) => collectImports(entry, { type: "css" })).map((path) => `/${path}`),
+        ...layoutCSS,
+        // css from page entry
+        ...clientManifestEntry ? collectImports(clientManifestEntry, { type: "css" }).map((path) => `/${path}`) : [],
         // root-level css (handles cssCodeSplit: false)
         ...Object.entries(vxrnOutput.clientManifest).filter(([key]) => key.endsWith(".css")).map(([, entry]) => `/${entry.file}`)
       ])
-    ];
+    ], hasCriticalCSS = allCSS.some((p) => criticalCSSOutputPaths.has(p)), needsCSSContents = oneOptions.web?.inlineLayoutCSS || hasCriticalCSS;
     let allCSSContents;
-    oneOptions.web?.inlineLayoutCSS && (allCSSContents = await Promise.all(
+    needsCSSContents && (allCSSContents = await Promise.all(
       allCSS.map(async (cssPath) => {
+        if (!oneOptions.web?.inlineLayoutCSS && !criticalCSSOutputPaths.has(cssPath))
+          return "";
         const cached = cssFileContentsCache.get(cssPath);
         if (cached !== void 0) return cached;
         const filePath = (0, import_node_path.join)(clientDir, cssPath);
@@ -321,7 +346,7 @@ async function build(args) {
       allEntries,
       allCSS
     });
-    const serverJsPath = (0, import_node_path.join)("dist/server", serverFileName);
+    const serverJsPath = (0, import_node_path.join)(`${outDir}/server`, serverFileName);
     let exported;
     try {
       exported = await import((0, import_toAbsolute.toAbsolute)(serverJsPath));
@@ -359,6 +384,7 @@ async function build(args) {
         serverJsPath,
         preloads: preloads2,
         allCSS,
+        layoutCSS,
         routePreloads,
         allCSSContents,
         criticalPreloads,
@@ -381,6 +407,7 @@ async function build(args) {
             serverJsPath,
             preloads2,
             allCSS,
+            layoutCSS,
             routePreloads,
             allCSSContents,
             criticalPreloads,
@@ -432,6 +459,7 @@ async function build(args) {
     return buildInfo && (built.loaderPath = buildInfo.loaderPath), built;
   }
   const buildInfoForWriting = {
+    outDir,
     oneOptions,
     routeToBuildInfo,
     pathToRoute,
@@ -447,7 +475,7 @@ async function build(args) {
     loaders,
     useRolldown: await (0, import_isRolldown.isRolldown)()
   };
-  await writeJSON((0, import_toAbsolute.toAbsolute)("dist/buildInfo.json"), buildInfoForWriting), await import_fs_extra.default.writeFile(
+  await writeJSON((0, import_toAbsolute.toAbsolute)(`${outDir}/buildInfo.json`), buildInfoForWriting), await import_fs_extra.default.writeFile(
     (0, import_node_path.join)(clientDir, "version.json"),
     JSON.stringify({ version: constants.CACHE_KEY })
   ), console.info(`
@@ -486,7 +514,7 @@ async function build(args) {
         buildInfoForWriting.routeToBuildInfo
       ))
         if (info.serverJsPath) {
-          const importPath = "./" + info.serverJsPath.replace(/^dist\//, "");
+          const importPath = "./" + info.serverJsPath.replace(new RegExp(`^${outDir}/`), "");
           pageRouteMap.push(`  '${routeFile}': () => import('${importPath}')`);
         }
       for (const route of buildInfoForWriting.manifest.apiRoutes)
@@ -495,10 +523,10 @@ async function build(args) {
           apiRouteMap.push(`  '${route.page}': () => import('${importPath}')`);
         }
       for (const [, builtPath] of Object.entries(builtMiddlewares)) {
-        const importPath = "./" + builtPath.replace(/^dist\//, "");
+        const importPath = "./" + builtPath.replace(new RegExp(`^${outDir}/`), "");
         middlewareRouteMap.push(`  '${builtPath}': () => import('${importPath}')`);
       }
-      const workerSrcPath = (0, import_node_path.join)(options.root, "dist", "_worker-src.js"), workerCode = `// Polyfill MessageChannel for React SSR (not available in Cloudflare Workers by default)
+      const workerSrcPath = (0, import_node_path.join)(options.root, outDir, "_worker-src.js"), workerCode = `// Polyfill MessageChannel for React SSR (not available in Cloudflare Workers by default)
 if (typeof MessageChannel === 'undefined') {
   globalThis.MessageChannel = class MessageChannel {
     constructor() {
@@ -584,13 +612,14 @@ export default {
       await import_fs_extra.default.writeFile(workerSrcPath, workerCode), console.info(`
  [cloudflare] Bundling worker...`), await (0, import_vite.build)({
         root: options.root,
+        mode: "production",
         logLevel: "warn",
         build: {
-          outDir: "dist",
+          outDir,
           emptyOutDir: !1,
           // Use SSR mode with node target for proper Node.js module resolution
           ssr: workerSrcPath,
-          rollupOptions: {
+          rolldownOptions: {
             external: [
               // React Native dev tools - not needed in production
               "@react-native/dev-middleware",
@@ -616,14 +645,33 @@ export default {
           "process.env.VITE_ENVIRONMENT": JSON.stringify("ssr")
         },
         resolve: {
-          conditions: ["workerd", "worker", "node", "module", "default"]
+          conditions: ["workerd", "worker", "node", "module", "default"],
+          alias: [
+            // rolldown can't parse react-native's Flow syntax; alias to react-native-web for ssr
+            {
+              find: /^react-native\/Libraries\/.*/,
+              replacement: (0, import_resolve.resolvePath)("@vxrn/vite-plugin-metro/empty", options.root)
+            },
+            {
+              find: "react-native/package.json",
+              replacement: (0, import_resolve.resolvePath)("react-native-web/package.json", options.root)
+            },
+            {
+              find: "react-native",
+              replacement: (0, import_resolve.resolvePath)("react-native-web", options.root)
+            },
+            {
+              find: "react-native-safe-area-context",
+              replacement: (0, import_resolve.resolvePath)("@vxrn/safe-area", options.root)
+            }
+          ]
         },
         ssr: {
           target: "node",
           noExternal: !0
         }
       }), await import_fs_extra.default.remove(workerSrcPath), await import_fs_extra.default.writeFile(
-        (0, import_node_path.join)(options.root, "dist", "wrangler.jsonc"),
+        (0, import_node_path.join)(options.root, outDir, "wrangler.jsonc"),
         `{
   "name": "one-app",
   "main": "worker.js",
@@ -638,10 +686,19 @@ export default {
   "assets": { "directory": "client", "binding": "ASSETS", "run_worker_first": true }
 }
 `
-      ), postBuildLogs.push("Cloudflare worker bundled at dist/worker.js"), postBuildLogs.push("To deploy: cd dist && wrangler deploy");
+      ), postBuildLogs.push(`Cloudflare worker bundled at ${outDir}/worker.js`), postBuildLogs.push(`To deploy: cd ${outDir} && wrangler deploy`);
       break;
     }
   }
+  const securityScanOption = oneOptions.build?.securityScan, securityScanLevel = securityScanOption === !1 ? null : securityScanOption === !0 || securityScanOption === void 0 ? "warn" : typeof securityScanOption == "string" ? securityScanOption : securityScanOption.level ?? "warn", securitySafePatterns = typeof securityScanOption == "object" && securityScanOption !== null ? securityScanOption.safePatterns : void 0;
+  if (securityScanLevel) {
+    const { runSecurityScan } = await import("./securityScan");
+    await runSecurityScan(
+      clientDir,
+      securityScanLevel,
+      securitySafePatterns
+    ) || process.exit(1);
+  }
   postBuildLogs.length && (console.info(`
 
 `), postBuildLogs.forEach((log) => {