one 1.10.6 → 1.11.0

package/src/cli/securityScan.ts

@@ -0,0 +1,189 @@
+import { readdir, readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+
+// patterns that should never appear in client bundles
+const SECRET_PATTERNS: Array<[string, RegExp]> = [
+  // api tokens / keys with known prefixes
+  ['Anthropic API key', /sk-ant-[A-Za-z0-9_-]{20,}/g],
+  ['OpenAI API key', /sk-proj-[A-Za-z0-9_-]{20,}/g],
+  ['Stripe secret key', /sk_live_[A-Za-z0-9]{20,}/g],
+  ['Stripe webhook secret', /whsec_[A-Za-z0-9]{20,}/g],
+  ['GitHub token', /gh[ps]_[A-Za-z0-9]{36,}/g],
+  ['GitHub PAT', /github_pat_[A-Za-z0-9_]{20,}/g],
+  ['AWS access key', /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g],
+  [
+    'Postmark server token',
+    /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/g,
+  ],
+  ['Bearer token assignment', /["']Bearer\s+[A-Za-z0-9_.-]{20,}["']/g],
+  [
+    'Generic secret assignment',
+    /(?:secret|password|api_key|apikey)\s*[:=]\s*["'][A-Za-z0-9_-]{16,}["']/gi,
+  ],
+  // known env var names that should never be inlined
+  ['BETTER_AUTH_SECRET value', /BETTER_AUTH_SECRET["']\s*[:=]\s*["'][^"']+["']/g],
+  ['POSTMARK_SERVER_TOKEN value', /POSTMARK_SERVER_TOKEN["']\s*[:=]\s*["'][^"']+["']/g],
+  ['ANTHROPIC_API_KEY value', /ANTHROPIC_API_KEY["']\s*[:=]\s*["'][^"']+["']/g],
+]
+
+// UUIDs that are known safe (WebRTC SDP constants, zero-uuid, etc.)
+const SAFE_UUIDS = new Set([
+  '00000000-0000-0000-0000-000000000000',
+  '09259e3b-7be8-46f6-9801-106bf1866e1c', // WebRTC SDP
+  '4ad15a19-80e2-4105-bf43-48039fd2963e', // WebRTC SDP
+])
+
+// known safe matches to ignore (doc examples, CSS tokens, etc.)
+const BUILTIN_SAFE_PATTERNS: RegExp[] = [
+  /sk_live_your_/,
+  /sk_live_your_key/,
+  /rk_\w+_\w+/, // tamagui theme tokens
+  /sk_all_element/, // DOM property names
+  /sk_personal_data/, // analytics property names
+]
+
+function createSafeMatcher(userPatterns?: (string | RegExp)[]) {
+  const safeStrings = new Set(SAFE_UUIDS)
+  const safeRegexes = [...BUILTIN_SAFE_PATTERNS]
+
+  if (userPatterns) {
+    for (const p of userPatterns) {
+      if (typeof p === 'string') {
+        safeStrings.add(p)
+      } else {
+        safeRegexes.push(p)
+      }
+    }
+  }
+
+  return (match: string): boolean => {
+    if (safeStrings.has(match)) return true
+    return safeRegexes.some((p) => p.test(match))
+  }
+}
+
+export type SecurityFinding = {
+  file: string
+  label: string
+  match: string
+  line: number
+}
+
+// recursively collect all .js files from a directory
+async function collectJSFiles(dir: string): Promise<string[]> {
+  const files: string[] = []
+
+  async function walk(currentDir: string) {
+    let entries
+    try {
+      entries = await readdir(currentDir, { withFileTypes: true })
+    } catch {
+      return
+    }
+    for (const entry of entries) {
+      const fullPath = join(currentDir, entry.name)
+      if (entry.isDirectory()) {
+        await walk(fullPath)
+      } else if (entry.name.endsWith('.js')) {
+        files.push(fullPath)
+      }
+    }
+  }
+
+  await walk(dir)
+  return files
+}
+
+export async function scanBundleForSecrets(
+  distDir: string,
+  userSafePatterns?: (string | RegExp)[]
+): Promise<{
+  clean: boolean
+  findings: SecurityFinding[]
+}> {
+  const isSafe = createSafeMatcher(userSafePatterns)
+  const files = await collectJSFiles(distDir)
+  const findings: SecurityFinding[] = []
+
+  for (const fullPath of files) {
+    const relativePath = fullPath.slice(distDir.length + 1)
+    let content: string
+    try {
+      content = await readFile(fullPath, 'utf-8')
+    } catch {
+      continue
+    }
+
+    for (const [label, pattern] of SECRET_PATTERNS) {
+      // reset regex state
+      pattern.lastIndex = 0
+      let match: RegExpExecArray | null
+
+      while ((match = pattern.exec(content)) !== null) {
+        const matched = match[0]
+        if (isSafe(matched)) continue
+
+        // find approximate line number
+        const beforeMatch = content.slice(0, match.index)
+        const line = (beforeMatch.match(/\n/g)?.length ?? 0) + 1
+
+        findings.push({
+          file: relativePath,
+          label,
+          match:
+            matched.length > 40
+              ? `${matched.slice(0, 20)}...${matched.slice(-10)}`
+              : matched,
+          line,
+        })
+      }
+    }
+  }
+
+  return { clean: findings.length === 0, findings }
+}
+
+/**
+ * runs the security scan based on config level
+ * returns true if the build should continue, false if it should fail
+ */
+export async function runSecurityScan(
+  clientDir: string,
+  level: 'warn' | 'error',
+  safePatterns?: (string | RegExp)[]
+): Promise<boolean> {
+  console.info(`\n 🔒 scanning client bundles for leaked secrets...\n`)
+
+  const { clean, findings } = await scanBundleForSecrets(clientDir, safePatterns)
+
+  if (clean) {
+    console.info(` 🔒 security scan passed — no secrets found\n`)
+    return true
+  }
+
+  const icon = level === 'error' ? '🚨' : '⚠️'
+  const header =
+    level === 'error'
+      ? `${icon} ${findings.length} secret(s) leaked into client bundle:`
+      : `${icon} ${findings.length} potential secret(s) found in client bundle:`
+
+  console.error(`\n ${header}\n`)
+
+  for (const f of findings) {
+    console.error(`   ${f.label}`)
+    console.error(`     file: ${f.file}:${f.line}`)
+    console.error(`     match: ${f.match}\n`)
+  }
+
+  if (level === 'error') {
+    console.error(
+      ` Set build.securityScan to 'warn' to continue building despite findings.\n`
+    )
+    return false
+  }
+
+  console.warn(
+    ` Set build.securityScan to 'error' to fail builds when secrets are detected.\n`
+  )
+  return true
+}

package/src/cli/workerPool.ts

@@ -83,13 +83,12 @@ export class BuildWorkerPool {
     return this.workers.length
   }
 
-  // initialize all workers - they load config themselves from vite.config
-  async initialize() {
+  // initialize all workers with pre-loaded config from main thread
+  async initialize(oneOptions?: any) {
     await this._ready
-    // send init message to all workers
-    // workers load the vite config themselves to avoid serialization issues
+    // pass oneOptions via postMessage so workers skip loading vite config
     for (const worker of this.workers) {
-      worker.postMessage({ type: 'init', id: this.nextId++ })
+      worker.postMessage({ type: 'init', id: this.nextId++, oneOptions })
     }
     // wait for all workers to be initialized
     await this._initialized
@@ -117,6 +116,7 @@ export class BuildWorkerPool {
     serverJsPath: string
     preloads: string[]
     allCSS: string[]
+    layoutCSS: string[]
     routePreloads: Record<string, string>
     allCSSContents?: string[]
     criticalPreloads?: string[]

package/src/cli.ts

@@ -180,16 +180,27 @@ const serveCommand = defineCommand({
     loadEnv: {
       type: 'boolean',
     },
+    outDir: {
+      type: 'string',
+      description: 'Build output directory (default: dist)',
+    },
+    cluster: {
+      type: 'string',
+      description: 'Enable cluster mode with N workers (default: cpu count)',
+    },
   },
   async run({ args }) {
     const { serve } = await import('./serve')
     const port = lastValue(args.port)
     const host = lastValue(args.host)
+    const clusterArg = lastValue(args.cluster)
     await serve({
       port: port ? +port : undefined,
       host,
       compress: args.compress,
       loadEnv: !!args.loadEnv,
+      outDir: lastValue(args.outDir),
+      cluster: clusterArg !== undefined ? (clusterArg ? +clusterArg : true) : undefined,
     })
   },
 })

package/src/createApp.tsx

@@ -11,8 +11,8 @@ import { setupSkewProtection } from './skewProtection'
 import type { RenderAppProps } from './types'
 import { getServerHeadInsertions } from './useServerHeadInsertion'
 import { ensureExists } from './utils/ensureExists'
-import { safeJsonStringify } from './utils/htmlEscape'
 import { SERVER_CONTEXT_POST_RENDER_STRING } from './vite/constants'
+import { safeJsonStringify } from './utils/htmlEscape'
 import { getServerContext, setServerContext } from './vite/one-server-only'
 import type { One } from './vite/types'
 
@@ -29,6 +29,13 @@ export type CreateAppProps = {
 
 export function createApp(options: CreateAppProps) {
   if (import.meta.env.SSR) {
+    // cache server module imports across requests
+    let cachedReactDOMServer: any
+    let cachedServerRender: any
+    let cachedRenderToStaticMarkup: any
+    let cachedRenderToString: any
+    let setupDone = false
+
     return {
       options,
       render: async (props: RenderAppProps) => {
@@ -36,20 +43,26 @@ export function createApp(options: CreateAppProps) {
         const renderMode = props.mode === 'spa-shell' ? 'spa' : props.mode
         process.env.ONE_RENDER_MODE = renderMode
 
-        if (options.getSetupPromise) {
+        if (!setupDone && options.getSetupPromise) {
           await options.getSetupPromise()
+          setupDone = true
         }
 
-        // Dynamic imports for server-only modules to avoid bundling in client
-        const [ReactDOMServer, serverRender] = await Promise.all([
-          import('react-dom/server.browser'),
-          import('./server-render'),
-        ])
+        // cache dynamic imports - only resolve once
+        if (!cachedReactDOMServer) {
+          const [rds, sr] = await Promise.all([
+            import('react-dom/server.browser'),
+            import('./server-render'),
+          ])
+          cachedReactDOMServer = rds
+          cachedServerRender = sr
+          cachedRenderToStaticMarkup =
+            rds.renderToStaticMarkup || rds.default?.renderToStaticMarkup
+          cachedRenderToString = sr.renderToString
+        }
 
-        const renderToStaticMarkup =
-          ReactDOMServer.renderToStaticMarkup ||
-          ReactDOMServer.default?.renderToStaticMarkup
-        const renderToString = serverRender.renderToString
+        const renderToStaticMarkup = cachedRenderToStaticMarkup
+        const renderToString = cachedRenderToString
 
         const {
           loaderData,
@@ -75,50 +88,50 @@ export function createApp(options: CreateAppProps) {
 
         let renderId: string | undefined
 
-        const App = () => {
-          return (
-            <Root
-              flags={options.flags}
-              onRenderId={(id) => {
-                renderId = id
-              }}
-              routes={options.routes}
-              routerRoot={options.routerRoot}
-              {...props}
-            />
-          )
-        }
-
-        AppRegistry.registerComponent('App', () => App)
-
-        // @ts-expect-error
-        const Application = AppRegistry.getApplication('App', {})
-
-        // we've got to remove the outer containers because it messes up the fact we render root html
-        const rootElement = Application.element.props.children
+        // render Root directly, skip AppRegistry overhead on server
+        const rootElement = (
+          <Root
+            flags={options.flags}
+            onRenderId={(id) => {
+              renderId = id
+            }}
+            routes={options.routes}
+            routerRoot={options.routerRoot}
+            {...props}
+          />
+        )
 
         let html = await renderToString(rootElement, {
           preloads: props.preloads,
-          deferredPreloads: props.deferredPreloads,
         })
 
+        // post-render: inject any extra head elements (RNW styles + head insertions)
         try {
           const extraHeadElements: React.ReactElement[] = []
 
-          const styleTag = Application.getStyleElement({
-            nonce: process.env.ONE_NONCE,
-          })
-          if (styleTag) {
-            extraHeadElements.push(styleTag)
+          // get style elements from AppRegistry (for react-native-web styles)
+          try {
+            AppRegistry.registerComponent('__oneStyles', () => () => null)
+            // @ts-expect-error
+            const app = AppRegistry.getApplication('__oneStyles', {})
+            const styleTag = app.getStyleElement({
+              nonce: process.env.ONE_NONCE,
+            })
+            if (styleTag) {
+              extraHeadElements.push(styleTag)
+            }
+          } catch {
+            // ok if no styles
           }
 
-          ensureExists(renderId)
-          const insertions = getServerHeadInsertions(renderId)
-          if (insertions) {
-            for (const insertion of insertions) {
-              const out = insertion()
-              if (out) {
-                extraHeadElements.push(out)
+          if (renderId) {
+            const insertions = getServerHeadInsertions(renderId)
+            if (insertions) {
+              for (const insertion of insertions) {
+                const out = insertion()
+                if (out) {
+                  extraHeadElements.push(out)
+                }
               }
             }
           }
@@ -127,24 +140,18 @@ export function createApp(options: CreateAppProps) {
             const extraHeadHTML = renderToStaticMarkup(
               <>{extraHeadElements.map((x, i) => cloneElement(x, { key: i }))}</>
             )
-
             if (extraHeadHTML) {
               html = html.replace(`</head>`, `${extraHeadHTML}</head>`)
             }
           }
         } catch (err) {
-          // react-native-web-lite has a bug but its fine we don't need it for now
-          // but TODO is fix this in react-native-web-lite
-          if (`${err}`.includes(`sheet is not defined`)) {
-            // ok
-          } else {
+          if (!`${err}`.includes(`sheet is not defined`)) {
             throw err
           }
         }
 
-        // now we can grab and serialize in our zero queries
+        // replace postRenderData placeholder with actual data set during render
         const postRenderData = getServerContext()?.postRenderData
-
         if (postRenderData) {
           html = html.replace(
             safeJsonStringify(SERVER_CONTEXT_POST_RENDER_STRING),
@@ -154,9 +161,104 @@ export function createApp(options: CreateAppProps) {
 
         return html
       },
+
+      // streaming SSR - returns ReadableStream, no post-processing
+      renderStream: async (props: RenderAppProps): Promise<ReadableStream> => {
+        const renderMode = props.mode === 'spa-shell' ? 'spa' : props.mode
+        process.env.ONE_RENDER_MODE = renderMode
+
+        if (!setupDone && options.getSetupPromise) {
+          await options.getSetupPromise()
+          setupDone = true
+        }
+
+        if (!cachedServerRender) {
+          const [rds, sr] = await Promise.all([
+            import('react-dom/server.browser'),
+            import('./server-render'),
+          ])
+          cachedReactDOMServer = rds
+          cachedServerRender = sr
+          cachedRenderToStaticMarkup =
+            rds.renderToStaticMarkup || rds.default?.renderToStaticMarkup
+          cachedRenderToString = sr.renderToString
+        }
+
+        const {
+          loaderData,
+          loaderProps,
+          css,
+          cssContents,
+          mode,
+          loaderServerData,
+          routePreloads,
+          matches,
+        } = props
+
+        setServerContext({
+          postRenderData: loaderServerData,
+          loaderData,
+          loaderProps,
+          mode,
+          css,
+          cssContents,
+          routePreloads,
+          matches,
+        })
+
+        const rootElement = (
+          <Root
+            flags={options.flags}
+            routes={options.routes}
+            routerRoot={options.routerRoot}
+            {...props}
+          />
+        )
+
+        return cachedServerRender.renderToStream(rootElement, {
+          preloads: props.preloads,
+        })
+      },
     }
   }
 
+  // find root layout in routes regardless of render mode suffix (+ssg, +ssr, +spa)
+  // the glob keys include the suffix (e.g., /app/_layout+ssg.tsx) but we need to
+  // match any root layout variant to ensure it's preloaded before rendering
+  function findAndPreloadRootLayout(
+    routes: Record<string, () => Promise<unknown>>,
+    routerRoot: string
+  ): Promise<unknown> | undefined {
+    // try exact match first (no suffix)
+    const exactKey = `/${routerRoot}/_layout.tsx`
+    if (routes[exactKey]) {
+      return routes[exactKey]()
+    }
+
+    // try with render mode suffixes
+    for (const suffix of ['+ssg', '+ssr', '+spa']) {
+      const key = `/${routerRoot}/_layout${suffix}.tsx`
+      if (routes[key]) {
+        return routes[key]()
+      }
+    }
+
+    // try .ts extension variants
+    const exactKeyTs = `/${routerRoot}/_layout.ts`
+    if (routes[exactKeyTs]) {
+      return routes[exactKeyTs]()
+    }
+
+    for (const suffix of ['+ssg', '+ssr', '+spa']) {
+      const key = `/${routerRoot}/_layout${suffix}.ts`
+      if (routes[key]) {
+        return routes[key]()
+      }
+    }
+
+    return undefined
+  }
+
   // skew protection: auto-reload on chunk load failures
   if (typeof window !== 'undefined' && process.env.ONE_SKEW_PROTECTION !== 'false') {
     window.addEventListener('vite:preloadError', (e) => {
@@ -177,8 +279,15 @@ export function createApp(options: CreateAppProps) {
   const routePreloads = serverContext.routePreloads
 
   // initialize client matches from server context for useMatches hook
+  // restore page loaderData into matches (stripped during SSR to avoid double-serialization)
   if (serverContext.matches) {
-    initClientMatches(serverContext.matches)
+    const restoredMatches = serverContext.matches.map((m: any) => {
+      if (!m.loaderData && serverContext.loaderData) {
+        return { ...m, loaderData: serverContext.loaderData }
+      }
+      return m
+    })
+    initClientMatches(restoredMatches)
   }
 
   // NOTE: for SSG 404 pages, we DON'T set notFoundState before initial render
@@ -198,11 +307,11 @@ export function createApp(options: CreateAppProps) {
   // for SPA/dev mode, fall back to importing root layout directly
   const preloadPromises = routePreloads
     ? Object.entries(routePreloads).map(async ([routeKey, bundlePath]) => {
-        const mod = await import(/* @vite-ignore */ bundlePath)
+        const mod = await import(/* @vite-ignore */ bundlePath as string)
         registerPreloadedRoute(routeKey, mod)
         return mod
       })
-    : [options.routes[`/${options.routerRoot}/_layout.tsx`]?.()]
+    : [findAndPreloadRootLayout(options.routes, options.routerRoot)]
 
   // for 404 pages, use history.state.__tempLocation to route to notFoundPath
   // without changing the browser URL. the router checks __tempLocation and uses