one 1.10.6 → 1.11.0

package/src/cli/build.ts

@@ -1,9 +1,10 @@
 import { createRequire } from 'node:module'
 import { cpus } from 'node:os'
 import Path, { join, relative, resolve } from 'node:path'
+import { resolvePath } from '@vxrn/resolve'
 import FSExtra from 'fs-extra'
 import MicroMatch from 'micromatch'
-import type { OutputAsset, RollupOutput } from 'rollup'
+import type { OutputAsset, RolldownOutput } from 'rolldown'
 import { type InlineConfig, mergeConfig, build as viteBuild } from 'vite'
 import {
   type ClientManifestEntry,
@@ -30,6 +31,7 @@ import { getWorkerPool, terminateWorkerPool } from './workerPool'
 import { generateSitemap, type RouteSitemapData } from './generateSitemap'
 import { labelProcess } from './label-process'
 import { pLimit } from '../utils/pLimit'
+import { getCriticalCSSOutputPaths } from '../vite/plugins/criticalCSSPlugin'
 
 const { ensureDir, writeJSON } = FSExtra
 
@@ -74,7 +76,7 @@ export async function build(args: {
   checkNodeVersion()
   setServerGlobals()
 
-  const { oneOptions } = await loadUserOneOptions('build')
+  const { oneOptions, config: viteLoadedConfig } = await loadUserOneOptions('build')
   const routerRoot = getRouterRootFromOneOptions(oneOptions)
 
   // Set defaultRenderMode env var so getManifest knows the correct route types
@@ -82,6 +84,9 @@ export async function build(args: {
     process.env.ONE_DEFAULT_RENDER_MODE = oneOptions.web.defaultRenderMode
   }
 
+  // respect vite's build.outDir config, default to 'dist'
+  const outDir = viteLoadedConfig?.config?.build?.outDir ?? 'dist'
+
   const manifest = getManifest({ routerRoot })!
 
   const serverOutputFormat =
@@ -118,6 +123,7 @@ export async function build(args: {
   const options = await fillOptions(vxrnOutput.options, { mode: 'prod' })
 
   const { optimizeDeps } = getOptimizeDeps('build')
+  const { rolldownOptions: _rolldownOptions, ...optimizeDepsNoRolldown } = optimizeDeps
 
   const apiBuildConfig = mergeConfig(
     // feels like this should build off the *server* build config not web
@@ -125,7 +131,12 @@ export async function build(args: {
     {
       configFile: false,
       appType: 'custom',
-      optimizeDeps,
+      optimizeDeps: optimizeDepsNoRolldown,
+      environments: {
+        client: {
+          optimizeDeps: { rolldownOptions: _rolldownOptions },
+        },
+      },
     } satisfies InlineConfig
   )
 
@@ -154,16 +165,22 @@ export async function build(args: {
       ssr: {
         noExternal: true,
         external: ['react', 'react-dom'],
-        optimizeDeps,
+        optimizeDeps: optimizeDepsNoRolldown,
+      },
+
+      environments: {
+        ssr: {
+          optimizeDeps: { rolldownOptions: _rolldownOptions },
+        },
       },
 
       build: {
         ssr: true,
         emptyOutDir: false,
-        outDir: `dist/${subFolder}`,
+        outDir: `${outDir}/${subFolder}`,
         copyPublicDir: false,
         minify: false,
-        rollupOptions: {
+        rolldownOptions: {
           treeshake: treeshake ?? {
             moduleSideEffects: false,
           },
@@ -180,7 +197,7 @@ export async function build(args: {
           // prevents it from shaking out the exports
           preserveEntrySignatures: 'strict',
           input: input,
-          external: () => false,
+          external: [],
           output: {
             entryFileNames: '[name]',
             exports: 'auto',
@@ -228,7 +245,7 @@ export async function build(args: {
       finalApiBuildConf
     )
 
-    return output as RollupOutput
+    return output as RolldownOutput
   }
 
   // build api routes and middlewares in parallel
@@ -256,7 +273,7 @@ export async function build(args: {
       const outChunks = middlewareBuildInfo.output.filter((x) => x.type === 'chunk')
       const chunk = outChunks.find((x) => x.facadeModuleId === fullPath)
       if (!chunk) throw new Error(`internal err finding middleware`)
-      builtMiddlewares[middleware.file] = join('dist', 'middlewares', chunk.fileName)
+      builtMiddlewares[middleware.file] = join(outDir, 'middlewares', chunk.fileName)
     }
   }
 
@@ -272,6 +289,9 @@ export async function build(args: {
   const collectImportsCache = new Map<string, string[]>()
   const cssFileContentsCache = new Map<string, string>()
 
+  // css files with .inline.css extension — should be inlined as <style>
+  const criticalCSSOutputPaths = getCriticalCSSOutputPaths(vxrnOutput.clientManifest)
+
   // concurrency limiter for parallel page builds
   const limit = pLimit(BUILD_CONCURRENCY)
 
@@ -279,7 +299,13 @@ export async function build(args: {
   const useWorkers = shouldUseWorkers(oneOptions)
   const workerPool = useWorkers ? getWorkerPool(BUILD_CONCURRENCY) : null
   if (workerPool) {
-    await workerPool.initialize()
+    // strip non-cloneable values so workers skip re-loading vite config
+    const serializableOptions = JSON.parse(
+      JSON.stringify(oneOptions, (_key, value) =>
+        typeof value === 'function' ? undefined : value
+      )
+    )
+    await workerPool.initialize(serializableOptions)
   }
 
   const staticStartTime = performance.now()
@@ -288,8 +314,8 @@ export async function build(args: {
     : `concurrency: ${BUILD_CONCURRENCY}`
   console.info(`\n 🔨 build static routes (${modeLabel})\n`)
 
-  const staticDir = join(`dist/static`)
-  const clientDir = join(`dist/client`)
+  const staticDir = join(`${outDir}/static`)
+  const clientDir = join(`${outDir}/client`)
   await ensureDir(staticDir)
 
   if (!vxrnOutput.serverOutput) {
@@ -585,12 +611,24 @@ export async function build(args: {
       : allPreloads
 
     const allEntries = [clientManifestEntry, ...layoutEntries].filter(Boolean)
+
+    // layout css (from layout entries) - should load before scripts to prevent FOUC
+    const layoutCSS = [
+      ...new Set(
+        layoutEntries
+          .flatMap((entry) => collectImports(entry, { type: 'css' }))
+          .map((path) => `/${path}`)
+      ),
+    ]
+
+    // all css including page entry and root-level css
     const allCSS = [
       ...new Set([
-        // css from entry imports
-        ...allEntries
-          .flatMap((entry) => collectImports(entry, { type: 'css' }))
-          .map((path) => `/${path}`),
+        ...layoutCSS,
+        // css from page entry
+        ...(clientManifestEntry
+          ? collectImports(clientManifestEntry, { type: 'css' }).map((path) => `/${path}`)
+          : []),
         // root-level css (handles cssCodeSplit: false)
         ...Object.entries(vxrnOutput.clientManifest)
           .filter(([key]) => key.endsWith('.css'))
@@ -598,11 +636,22 @@ export async function build(args: {
       ]),
     ]
 
-    // Read CSS file contents if inlineLayoutCSS is enabled (with caching)
+    // check if any css needs inlining (inlineLayoutCSS option or .inline.css imports)
+    const hasCriticalCSS = allCSS.some((p) => criticalCSSOutputPaths.has(p))
+    const needsCSSContents = oneOptions.web?.inlineLayoutCSS || hasCriticalCSS
+
+    // read css file contents for inlining (with caching)
     let allCSSContents: string[] | undefined
-    if (oneOptions.web?.inlineLayoutCSS) {
+    if (needsCSSContents) {
       allCSSContents = await Promise.all(
         allCSS.map(async (cssPath) => {
+          // only read contents for css that should be inlined:
+          // - all css when inlineLayoutCSS is enabled
+          // - only .inline.css otherwise
+          if (!oneOptions.web?.inlineLayoutCSS && !criticalCSSOutputPaths.has(cssPath)) {
+            return ''
+          }
+
           // check cache first
           const cached = cssFileContentsCache.get(cssPath)
           if (cached !== undefined) return cached
@@ -630,7 +679,7 @@ export async function build(args: {
       })
     }
 
-    const serverJsPath = join('dist/server', serverFileName)
+    const serverJsPath = join(`${outDir}/server`, serverFileName)
 
     let exported
     try {
@@ -714,6 +763,7 @@ export async function build(args: {
             serverJsPath,
             preloads,
             allCSS,
+            layoutCSS,
             routePreloads,
             allCSSContents,
             criticalPreloads,
@@ -747,6 +797,7 @@ export async function build(args: {
               serverJsPath,
               preloads,
               allCSS,
+              layoutCSS,
               routePreloads,
               allCSSContents,
               criticalPreloads,
@@ -853,6 +904,7 @@ export async function build(args: {
   }
 
   const buildInfoForWriting: One.BuildInfo = {
+    outDir,
     oneOptions,
     routeToBuildInfo,
     pathToRoute,
@@ -869,7 +921,7 @@ export async function build(args: {
     useRolldown: await isRolldown(),
   }
 
-  await writeJSON(toAbsolute(`dist/buildInfo.json`), buildInfoForWriting)
+  await writeJSON(toAbsolute(`${outDir}/buildInfo.json`), buildInfoForWriting)
 
   // emit version.json for skew protection polling
   await FSExtra.writeFile(
@@ -938,7 +990,8 @@ export async function build(args: {
         buildInfoForWriting.routeToBuildInfo
       )) {
         if (info.serverJsPath) {
-          const importPath = './' + info.serverJsPath.replace(/^dist\//, '')
+          const importPath =
+            './' + info.serverJsPath.replace(new RegExp(`^${outDir}/`), '')
           pageRouteMap.push(`  '${routeFile}': () => import('${importPath}')`)
         }
       }
@@ -958,11 +1011,11 @@ export async function build(args: {
       // Generate lazy imports for middlewares
       // The key must match the contextKey used to look up the middleware (e.g., "dist/middlewares/_middleware.js")
       for (const [, builtPath] of Object.entries(builtMiddlewares)) {
-        const importPath = './' + builtPath.replace(/^dist\//, '')
+        const importPath = './' + builtPath.replace(new RegExp(`^${outDir}/`), '')
         middlewareRouteMap.push(`  '${builtPath}': () => import('${importPath}')`)
       }
 
-      const workerSrcPath = join(options.root, 'dist', '_worker-src.js')
+      const workerSrcPath = join(options.root, outDir, '_worker-src.js')
       const workerCode = `// Polyfill MessageChannel for React SSR (not available in Cloudflare Workers by default)
 if (typeof MessageChannel === 'undefined') {
   globalThis.MessageChannel = class MessageChannel {
@@ -1050,13 +1103,14 @@ export default {
       console.info('\n [cloudflare] Bundling worker...')
       await viteBuild({
         root: options.root,
+        mode: 'production',
         logLevel: 'warn',
         build: {
-          outDir: 'dist',
+          outDir,
           emptyOutDir: false,
           // Use SSR mode with node target for proper Node.js module resolution
           ssr: workerSrcPath,
-          rollupOptions: {
+          rolldownOptions: {
             external: [
               // React Native dev tools - not needed in production
               '@react-native/dev-middleware',
@@ -1083,6 +1137,25 @@ export default {
         },
         resolve: {
           conditions: ['workerd', 'worker', 'node', 'module', 'default'],
+          alias: [
+            // rolldown can't parse react-native's Flow syntax; alias to react-native-web for ssr
+            {
+              find: /^react-native\/Libraries\/.*/,
+              replacement: resolvePath('@vxrn/vite-plugin-metro/empty', options.root),
+            },
+            {
+              find: 'react-native/package.json',
+              replacement: resolvePath('react-native-web/package.json', options.root),
+            },
+            {
+              find: 'react-native',
+              replacement: resolvePath('react-native-web', options.root),
+            },
+            {
+              find: 'react-native-safe-area-context',
+              replacement: resolvePath('@vxrn/safe-area', options.root),
+            },
+          ],
         },
         ssr: {
           target: 'node',
@@ -1110,17 +1183,46 @@ export default {
 }
 `
       await FSExtra.writeFile(
-        join(options.root, 'dist', 'wrangler.jsonc'),
+        join(options.root, outDir, 'wrangler.jsonc'),
         wranglerConfig
       )
 
-      postBuildLogs.push(`Cloudflare worker bundled at dist/worker.js`)
-      postBuildLogs.push(`To deploy: cd dist && wrangler deploy`)
+      postBuildLogs.push(`Cloudflare worker bundled at ${outDir}/worker.js`)
+      postBuildLogs.push(`To deploy: cd ${outDir} && wrangler deploy`)
 
       break
     }
   }
 
+  // security scan for leaked secrets in client bundles
+  const securityScanOption = oneOptions.build?.securityScan
+  // default to 'warn', normalize all forms
+  const securityScanLevel: 'warn' | 'error' | null =
+    securityScanOption === false
+      ? null
+      : securityScanOption === true || securityScanOption === undefined
+        ? 'warn'
+        : typeof securityScanOption === 'string'
+          ? securityScanOption
+          : (securityScanOption.level ?? 'warn')
+
+  const securitySafePatterns =
+    typeof securityScanOption === 'object' && securityScanOption !== null
+      ? securityScanOption.safePatterns
+      : undefined
+
+  if (securityScanLevel) {
+    const { runSecurityScan } = await import('./securityScan')
+    const passed = await runSecurityScan(
+      clientDir,
+      securityScanLevel,
+      securitySafePatterns
+    )
+    if (!passed) {
+      process.exit(1)
+    }
+  }
+
   if (postBuildLogs.length) {
     console.info(`\n\n`)
     postBuildLogs.forEach((log) => {

package/src/cli/buildPage.ts

@@ -1,6 +1,7 @@
 import { join } from 'node:path'
 import FSExtra from 'fs-extra'
 import * as constants from '../constants'
+import { LOADER_JS_POSTFIX_UNCACHED } from '../constants'
 import type { LoaderProps } from '../types'
 import { getLoaderPath, getPreloadCSSPath, getPreloadPath } from '../utils/cleanUrl'
 import { isResponse } from '../utils/isResponse'
@@ -49,6 +50,7 @@ export async function buildPage(
   serverJsPath: string,
   preloads: string[],
   allCSS: string[],
+  layoutCSS: string[],
   routePreloads: Record<string, string>,
   allCSSContents?: string[],
   criticalPreloads?: string[],
@@ -63,7 +65,7 @@ export async function buildPage(
 
   const htmlPath = `${path.endsWith('/') ? `${removeTrailingSlash(path)}/index` : path}.html`
   const clientJsPath = clientManifestEntry
-    ? join(`dist/client`, clientManifestEntry.file)
+    ? join(clientDir, clientManifestEntry.file)
     : ''
   const htmlOutPath = toAbsolute(join(staticDir, htmlPath))
   const preloadPath = getPreloadPath(path)
@@ -190,8 +192,10 @@ prefetchCSS()
             if (!layoutServerPath) {
               return { contextKey: layout.contextKey, loaderData: undefined }
             }
+            // derive server dir from clientDir (e.g. dist/client -> dist/server)
+            const serverDir = join(clientDir, '..', 'server')
             const layoutExported = await import(
-              toAbsolute(join('./', 'dist/server', layoutServerPath))
+              toAbsolute(join(serverDir, layoutServerPath))
             )
             const layoutLoaderData = await layoutExported?.loader?.(loaderProps)
             return { contextKey: layout.contextKey, loaderData: layoutLoaderData }
@@ -253,6 +257,11 @@ prefetchCSS()
       if (clientJsPath) {
         const loaderPartialPath = join(clientDir, urlPathToFilePath(getLoaderPath(path)))
 
+        // uncached native loader path for native prod (metro can't inline cache keys)
+        const uncachedNativePath = loaderPartialPath
+          .replace(constants.LOADER_JS_POSTFIX, LOADER_JS_POSTFIX_UNCACHED)
+          .replace(/\.js$/, '.native.js')
+
         if (loaderRedirectInfo) {
           // generate a static redirect loader — the client detects __oneRedirect
           // and navigates before the protected page ever renders
@@ -264,6 +273,10 @@ prefetchCSS()
             loaderPartialPath,
             `export function loader(){return ${redirectData}}`
           )
+          // native-friendly CJS version
+          const nativeCjs = `exports.loader = function(){return ${redirectData}}`
+          await outputFile(loaderPartialPath.replace(/\.js$/, '.native.js'), nativeCjs)
+          await outputFile(uncachedNativePath, nativeCjs)
           loaderPath = getLoaderPath(path)
           loaderData = {}
         } else {
@@ -278,6 +291,10 @@ if (typeof document === 'undefined') globalThis.document = {}
               loaderData,
             })
           await outputFile(loaderPartialPath, withLoader)
+          // native-friendly CJS version with just the data (no ESM imports)
+          const nativeCjs = `exports.loader = function(){return ${JSON.stringify(loaderData)}}`
+          await outputFile(loaderPartialPath.replace(/\.js$/, '.native.js'), nativeCjs)
+          await outputFile(uncachedNativePath, nativeCjs)
           loaderPath = getLoaderPath(path)
         }
       }
@@ -372,36 +389,44 @@ if (typeof document === 'undefined') globalThis.document = {}
           await outputFile(htmlOutPath, html)
           recordTiming('writeHTML', performance.now() - t0)
         } else {
-          // Generate CSS - either inline styles or link tags
-          const cssOutput = allCSSContents
-            ? allCSSContents
-                .filter(Boolean)
-                .map((content) => `    <style>${content}</style>`)
-                .join('\n')
-            : allCSS
-                .map((file) => `    <link rel="stylesheet" href=${file} />`)
-                .join('\n')
+          // separate layout css (before scripts) from page css (after scripts)
+          const layoutCSSSet = new Set(layoutCSS)
+
+          // render css as either inline <style> (if content provided) or <link>
+          function renderCSSTag(file: string, index: number): string {
+            const content = allCSSContents?.[index]
+            if (content) {
+              return `    <style>${content}</style>`
+            }
+            return `    <link rel="stylesheet" href=${file} />`
+          }
+
+          const layoutCssOutput = allCSS
+            .map((file, i) => (layoutCSSSet.has(file) ? renderCSSTag(file, i) : ''))
+            .filter(Boolean)
+            .join('\n')
+
+          const pageCssOutput = allCSS
+            .map((file, i) => (!layoutCSSSet.has(file) ? renderCSSTag(file, i) : ''))
+            .filter(Boolean)
+            .join('\n')
 
           // Use separated preloads if available
           const criticalScripts = (criticalPreloads || preloads)
             .map((preload) => `   <script type="module" src="${preload}"></script>`)
             .join('\n')
 
-          // Non-critical scripts as modulepreload hints only
-          const deferredLinks = (deferredPreloads || [])
-            .map(
-              (preload) =>
-                `   <link rel="modulepreload" fetchPriority="low" href="${preload}"/>`
-            )
-            .join('\n')
+          // skip modulepreload hints for pure SPA pages - the JS module graph
+          // handles its own loading, and route preloading happens on hover intent
+          // emitting hundreds of modulepreload links saturates connections for no benefit
 
           await outputFile(
             htmlOutPath,
             `<!DOCTYPE html><html><head>
             ${constants.getSpaHeaderElements({ serverContext: { loaderProps, loaderData } })}
+            ${layoutCssOutput}
             ${criticalScripts}
-            ${deferredLinks}
-            ${cssOutput}
+            ${pageCssOutput}
           </head><body></body></html>`
           )
         }
@@ -431,6 +456,7 @@ params:\n\n${JSON.stringify(params || null, null, 2)}`
   return {
     type: foundRoute.type,
     css: allCSS,
+    layoutCSS,
     cssContents: allCSSContents,
     routeFile: foundRoute.file,
     middlewares,

package/src/cli/buildPageWorker.ts

@@ -22,8 +22,6 @@ let buildPageFn: typeof import('./buildPage').buildPage | null = null
 let runWithAsyncLocalContextFn:
   | typeof import('../vite/one-server-only').runWithAsyncLocalContext
   | null = null
-let loadUserOneOptionsFn: typeof import('../vite/loadConfig').loadUserOneOptions | null =
-  null
 let initialized = false
 
 async function ensureImports() {
@@ -41,35 +39,24 @@ async function ensureImports() {
     )
     runWithAsyncLocalContextFn = mod.runWithAsyncLocalContext
   }
-  if (!loadUserOneOptionsFn) {
-    const mod = await workerImport<typeof import('../vite/loadConfig')>(
-      '../vite/loadConfig',
-      import.meta.url
-    )
-    loadUserOneOptionsFn = mod.loadUserOneOptions
-  }
   return {
     buildPage: buildPageFn!,
     runWithAsyncLocalContext: runWithAsyncLocalContextFn!,
-    loadUserOneOptions: loadUserOneOptionsFn!,
   }
 }
 
-async function initializeWorker() {
+async function initializeWorker(oneOptions: any) {
   if (initialized) return
-  // load the user's vite config to get oneOptions
-  // this avoids needing to serialize config through postMessage
-  const { loadUserOneOptions } = await ensureImports()
-  const { oneOptions } = await loadUserOneOptions('build', true)
-  // set global plugin config that createManifest needs
+  if (!oneOptions) {
+    throw new Error('Worker must receive oneOptions from main thread')
+  }
   globalThis['__vxrnPluginConfig__'] = oneOptions
   initialized = true
 }
 
 parentPort.on('message', async (msg: any) => {
   if (msg.type === 'init') {
-    // initialize worker by loading config from vite.config
-    await initializeWorker()
+    await initializeWorker(msg.oneOptions)
     parentPort!.postMessage({ type: 'init-done', id: msg.id })
     return
   }
@@ -92,6 +79,7 @@ parentPort.on('message', async (msg: any) => {
           msg.args.serverJsPath,
           msg.args.preloads,
           msg.args.allCSS,
+          msg.args.layoutCSS,
           msg.args.routePreloads,
           msg.args.allCSSContents,
           msg.args.criticalPreloads,

package/src/cli/patch.ts

@@ -6,15 +6,15 @@ export async function run(args: { force?: boolean }) {
   const { patch } = await import('vxrn')
 
   const options = await loadUserOneOptions('build')
-  const deps = options.oneOptions.deps as SimpleDepPatchObject | undefined
+  const patches = options.oneOptions.patches as SimpleDepPatchObject | undefined
 
   if (process.env.DEBUG) {
-    console.info('User deps:', Object.keys(deps || {}))
+    console.info('User patches:', Object.keys(patches || {}))
   }
 
   await patch({
     root: process.cwd(),
-    deps,
+    deps: patches,
     force: args.force,
   } satisfies PatchOptions)
 }