one 1.10.6 → 1.11.0

package/src/vite/plugins/criticalCSSPlugin.ts

@@ -0,0 +1,74 @@
+import { relative } from 'node:path'
+import type { Plugin } from 'vite'
+
+/**
+ * Tracks CSS files with `.inline.css` extension.
+ * These CSS files will be inlined as <style> tags before scripts.
+ *
+ * Usage:
+ *   import './layout.inline.css'
+ *
+ * The plugin records which source CSS files should be inlined. After the build,
+ * getCriticalCSSOutputPaths() maps source paths to output paths
+ * using the client manifest.
+ */
+
+const INLINE_CSS_EXT = '.inline.css'
+
+// source paths of CSS files with .inline.css extension (relative to root)
+const criticalCSSSources = new Set<string>()
+
+let root = ''
+
+export function getCriticalCSSSources(): Set<string> {
+  return criticalCSSSources
+}
+
+/**
+ * Given the client manifest, returns the set of output CSS paths
+ * that use .inline.css extension.
+ */
+export function getCriticalCSSOutputPaths(
+  clientManifest: Record<string, { file: string; css?: string[] }>
+): Set<string> {
+  const outputPaths = new Set<string>()
+
+  for (const [sourceKey, entry] of Object.entries(clientManifest)) {
+    // direct CSS manifest entries: key is source path, entry.file is output
+    if (sourceKey.endsWith('.css') && criticalCSSSources.has(sourceKey)) {
+      outputPaths.add(`/${entry.file}`)
+    }
+
+    // also check if JS entries import critical CSS via their css array
+    // by checking if the JS entry's source file imported any critical CSS
+    // (this handles cssCodeSplit where CSS is grouped by chunk)
+  }
+
+  return outputPaths
+}
+
+export function criticalCSSPlugin(): Plugin {
+  return {
+    name: 'one:critical-css',
+    enforce: 'pre',
+
+    configResolved(config) {
+      root = config.root
+    },
+
+    async resolveId(id, importer) {
+      if (!id.endsWith(INLINE_CSS_EXT)) return null
+
+      const resolved = await this.resolve(id, importer, { skipSelf: true })
+
+      if (resolved) {
+        // store as relative path to match manifest keys
+        const relativePath = relative(root, resolved.id)
+        criticalCSSSources.add(relativePath)
+        return resolved
+      }
+
+      return null
+    },
+  }
+}

package/src/vite/plugins/fileSystemRouterPlugin.tsx

@@ -487,10 +487,11 @@ export function createFileSystemRouterPlugin(options: One.PluginOptions): Plugin
 
           const platform = url.searchParams.get('platform')
 
-          if (platform === 'ios' || platform === 'android') {
+          if (platform === 'ios' || platform === 'android' || platform === 'native') {
             // Need to transpile to CommonJS for React Native
 
-            const environment = server.environments[platform || '']
+            const environment =
+              server.environments[platform === 'native' ? 'ios' : platform || '']
             if (!environment) {
               throw new Error(
                 `[handleLoader] No Vite environment found for platform '${platform}'`

package/src/vite/plugins/fixDependenciesPlugin.ts

@@ -1,35 +1,23 @@
 import type { Plugin } from 'vite'
-import { applyDependencyPatches, applyOptimizePatches, type DepPatch } from 'vxrn'
+import { applyDependencyPatches, type DepPatch } from 'vxrn'
 import type { One } from '../types'
 
-let hasAppliedOptimizePatches = false
-
 export function fixDependenciesPlugin(options?: One.FixDependencies): Plugin {
   const patches: DepPatch[] = []
   for (const key in options) {
     const value = options[key]
-    patches.push({
-      module: key,
-      patchFiles:
-        value && typeof value === 'object'
-          ? value
-          : {
-              optimize: value as any,
-            },
-    })
+    if (value && typeof value === 'object') {
+      patches.push({
+        module: key,
+        patchFiles: value,
+      })
+    }
   }
 
   return {
     name: 'one-fix-dependencies',
     enforce: 'pre',
 
-    async config(config) {
-      if (!hasAppliedOptimizePatches && patches.length) {
-        hasAppliedOptimizePatches = true
-        await applyOptimizePatches(patches, config)
-      }
-    },
-
     async configResolved(config) {
       await applyDependencyPatches(patches, config)
     },

package/src/vite/plugins/removeReactNativeWebAnimatedPlugin.ts

@@ -12,26 +12,19 @@ export function removeReactNativeWebAnimatedPlugin(opts?: {
     : /(react-native\/Animated\/Animated|PlatformPressable)/
 
   const optimizeDeps = {
-    esbuildOptions: {
+    rolldownOptions: {
       plugins: [
         {
           name: 'remove-react-native-web-animated',
-          setup(build) {
-            build.onResolve(
-              {
-                filter,
-              },
-              (args) => {
-                return { path: args.path, namespace: 'proxy-wormify' }
-              }
-            )
-
-            build.onLoad({ filter: /.*/, namespace: 'proxy-wormify' }, (args) => {
-              return {
-                contents: `export * from "@tamagui/proxy-worm";`,
-                loader: 'js',
-              }
-            })
+          resolveId(source: string) {
+            if (filter.test(source)) {
+              return `\0proxy-wormify:${source}`
+            }
+          },
+          load(id: string) {
+            if (id.startsWith('\0proxy-wormify:')) {
+              return `export * from "@tamagui/proxy-worm";`
+            }
           },
         },
       ],

package/src/vite/plugins/sourceInspectorPlugin.ts

@@ -168,34 +168,39 @@ export function sourceInspectorPlugin(): Plugin[] {
       enforce: 'pre',
       apply: 'serve',
 
-      async transform(code, id) {
-        const envName = this.environment?.name
-        // Skip native environments only - transform both client and SSR for consistency
-        if (envName === 'ios' || envName === 'android') return
-
-        if (
-          id.includes('node_modules') ||
-          id.includes('?raw') ||
-          id.includes('dist') ||
-          id.includes('build')
-        ) {
-          return
-        }
+      transform: {
+        // must run before clientTreeShakePlugin which also uses order: 'pre'
+        // (within same order, plugin array position determines precedence)
+        order: 'pre',
+        async handler(code, id) {
+          const envName = this.environment?.name
+          // skip native environments only - transform both client and SSR for consistency
+          if (envName === 'ios' || envName === 'android') return
+
+          if (
+            id.includes('node_modules') ||
+            id.includes('?raw') ||
+            id.includes('dist') ||
+            id.includes('build')
+          ) {
+            return
+          }
 
-        if (!id.endsWith('.jsx') && !id.endsWith('.tsx')) return
+          if (!id.endsWith('.jsx') && !id.endsWith('.tsx')) return
 
-        if (cache.has(code)) {
-          return cache.get(code)
-        }
+          if (cache.has(code)) {
+            return cache.get(code)
+          }
 
-        const out = await injectSourceToJsx(code, id)
-        cache.set(code, out)
+          const out = await injectSourceToJsx(code, id)
+          cache.set(code, out)
 
-        if (cache.size > 100) {
-          cache.clear()
-        }
+          if (cache.size > 100) {
+            cache.clear()
+          }
 
-        return out
+          return out
+        },
       },
     },
 

package/src/vite/plugins/warmRoutesPlugin.ts

@@ -0,0 +1,156 @@
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs'
+import { join, dirname } from 'node:path'
+import type { Plugin, ResolvedConfig } from 'vite'
+
+const WARM_DEPS_FILE = 'one-warm-deps.json'
+
+// how long after server start to track new deps (ms)
+const TRACKING_WINDOW = 5 * 60 * 1000
+
+/**
+ * Passively tracks deps that Vite discovers during normal dev use.
+ * On next startup, pre-includes them in optimizeDeps to avoid reload cascades.
+ *
+ * Use as a top-level plugin in vite.config.ts:
+ *
+ *   import { autoWarmPlugin } from 'one/vite'
+ *   plugins: [autoWarmPlugin(), ...]
+ *
+ * Pass a path string to persist permanently instead of in .vite cache:
+ *
+ *   autoWarmPlugin('./src/dev/warmDeps.json')
+ */
+export function autoWarmPlugin(persistPath?: string): Plugin {
+  let cacheFile: string
+  let cachedDeps: string[] = []
+  let excludeSet: Set<string>
+
+  return {
+    name: 'one:auto-warm',
+    apply: 'serve',
+
+    config() {
+      const volatileCache = join(process.cwd(), 'node_modules', '.vite', WARM_DEPS_FILE)
+      cacheFile =
+        typeof persistPath === 'string' ? join(process.cwd(), persistPath) : volatileCache
+
+      try {
+        if (existsSync(cacheFile)) {
+          const cached = JSON.parse(readFileSync(cacheFile, 'utf-8'))
+          if (Array.isArray(cached.deps) && cached.deps.length > 0) {
+            cachedDeps = cached.deps
+            console.info(`[one] loading ${cached.deps.length} cached warm deps`)
+            // inject as include, will be filtered in configResolved
+            return {
+              optimizeDeps: {
+                include: cached.deps,
+              },
+            }
+          }
+        }
+      } catch {
+        // cache corrupted, ignore
+      }
+    },
+
+    configResolved(config: ResolvedConfig) {
+      // build the exclude set from the resolved config
+      excludeSet = new Set(config.optimizeDeps.exclude || [])
+
+      if (cachedDeps.length > 0 && excludeSet.size > 0) {
+        // remove any cached deps that are in the exclude list
+        const conflicts = cachedDeps.filter((d) => excludeSet.has(d))
+        if (conflicts.length > 0) {
+          console.info(`[one] filtered ${conflicts.length} excluded deps from warm cache`)
+
+          // mutate the resolved include to remove conflicts
+          if (config.optimizeDeps.include) {
+            ;(config.optimizeDeps as any).include = config.optimizeDeps.include.filter(
+              (d: string) => !excludeSet.has(d)
+            )
+          }
+        }
+      }
+    },
+
+    configureServer(server) {
+      let lastDepsCount = 0
+      let timer: ReturnType<typeof setInterval>
+
+      // deps that were already in the user's config before we added ours
+      const userInclude = new Set(
+        (server.config.optimizeDeps.include || []).filter((d) => !cachedDeps.includes(d))
+      )
+
+      function snapshotDeps() {
+        try {
+          const optimizer =
+            (server as any).environments?.client?.depsOptimizer ??
+            (server as any)._depsOptimizer
+
+          if (!optimizer?.metadata) return
+
+          const optimized = optimizer.metadata.optimized as Record<string, unknown>
+          const discovered = optimizer.metadata.discovered as Record<string, unknown>
+
+          const currentDeps = [
+            ...Object.keys(optimized || {}),
+            ...Object.keys(discovered || {}),
+          ]
+
+          if (currentDeps.length === 0 || currentDeps.length === lastDepsCount) return
+          lastDepsCount = currentDeps.length
+
+          // only cache deps that:
+          // 1. aren't in the user's original config (no point caching what they already have)
+          // 2. aren't in the exclude list
+          const depsToCache = currentDeps.filter(
+            (d) => !userInclude.has(d) && !excludeSet.has(d)
+          )
+
+          // merge with existing cache
+          const allDeps = new Set(depsToCache)
+          try {
+            if (existsSync(cacheFile)) {
+              const existing = JSON.parse(readFileSync(cacheFile, 'utf-8'))
+              if (Array.isArray(existing.deps)) {
+                for (const d of existing.deps) {
+                  if (!excludeSet.has(d)) allDeps.add(d)
+                }
+              }
+            }
+          } catch {}
+
+          const sorted = [...allDeps].sort()
+          const dir = dirname(cacheFile)
+          if (!existsSync(dir)) mkdirSync(dir, { recursive: true })
+
+          writeFileSync(cacheFile, JSON.stringify({ deps: sorted }, null, 2))
+          console.info(`[one] cached ${sorted.length} deps for next startup`)
+        } catch {
+          // not ready yet, will retry
+        }
+      }
+
+      server.httpServer?.once('listening', () => {
+        timer = setInterval(snapshotDeps, 5000)
+
+        setTimeout(() => {
+          clearInterval(timer)
+          snapshotDeps()
+        }, TRACKING_WINDOW)
+      })
+
+      // snapshot on server close
+      const origClose = server.close.bind(server)
+      server.close = async () => {
+        clearInterval(timer)
+        snapshotDeps()
+        return origClose()
+      }
+    },
+  }
+}
+
+// keep old name as alias
+export const warmRoutesPlugin = autoWarmPlugin

package/src/vite/replaceLoader.ts

@@ -1,7 +1,8 @@
 // matches the routeId stub return value in both minified and non-minified code:
 //   non-minified: return "./loader-refetch/index.tsx"
 //   minified:     return"./loader-refetch/index.tsx"
-const routeIdReturnRegex = /return\s*"\.\/[^"]+"/
+//   minified (rolldown): return`./loader-refetch/index.tsx`
+const routeIdReturnRegex = /return\s*["'`]\.\/[^"'`]+["'`]/
 
 export function replaceLoader({
   code,

package/src/vite/resolveResponse.ts

@@ -2,25 +2,41 @@ import { isResponse } from '../utils/isResponse'
 import {
   asyncHeadersCache,
   mergeHeaders,
+  requestAsyncLocalStore,
   runWithAsyncLocalContext,
 } from './one-server-only'
 
-export function resolveResponse(getResponse: () => Promise<Response>) {
-  return new Promise<Response>((res, rej) => {
-    runWithAsyncLocalContext(async (id) => {
+export async function resolveResponse(getResponse: () => Promise<Response>) {
+  // inline ALS to reduce async nesting (each await = microtask = event loop pressure)
+  const store = requestAsyncLocalStore
+  if (store) {
+    const id = { _id: Math.random() }
+    let response: Response
+    await store.run(id, async () => {
       try {
-        const response = await getResponse()
-        const modifiedResponse = await getResponseWithAddedHeaders(response, id)
-        res(modifiedResponse)
+        response = await getResponse()
+        response = await getResponseWithAddedHeaders(response!, id)
       } catch (err) {
-        // allow throwing a response
         if (isResponse(err)) {
-          res(err)
+          response = err as Response
         } else {
-          rej(err) // reject the promise on any other error
+          throw err
         }
       }
     })
+    return response!
+  }
+  // fallback for non-SSR contexts
+  return runWithAsyncLocalContext(async (id) => {
+    try {
+      const response = await getResponse()
+      return await getResponseWithAddedHeaders(response, id)
+    } catch (err) {
+      if (isResponse(err)) {
+        return err as Response
+      }
+      throw err
+    }
   })
 }
 

package/src/vite/types.ts

@@ -1,9 +1,7 @@
 import type { GetTransform } from '@vxrn/compiler'
 import type { metroPlugin } from '@vxrn/vite-plugin-metro'
-import type { PluginOptions as TSConfigPluginOptions } from 'vite-tsconfig-paths'
 import type {
   AutoDepOptimizationOptions,
-  DepOptimize,
   DepPatch,
   AfterBuildProps as VXRNAfterBuildProps,
   VXRNBuildOptions,
@@ -45,7 +43,7 @@ export namespace One {
 
   // todo move into vxrn
   export type FixDependencies = {
-    [key: string]: DepOptimize | DepPatch['patchFiles']
+    [key: string]: DepPatch['patchFiles']
   }
 
   type PluginPlatformTarget = 'native' | 'web'
@@ -268,15 +266,15 @@ export namespace One {
       ensureTSConfig?: false
 
       /**
-       * One automatically adds vite-tsconfig-paths, set this to false to disable, or
-       * pass in an object to pass options down. If you add your own vite-tsconfig-paths
-       * we will avoid adding it again internally.
+       * One enables Vite's native resolve.tsconfigPaths by default.
+       * Set this to false to disable tsconfig path resolution.
        *
-       * See: https://github.com/aleclarson/vite-tsconfig-paths
+       * Pass an object for fine-grained control (options are accepted for
+       * backwards-compatibility; the built-in resolver always ignores config errors).
        *
-       * @default false
+       * @default true
        */
-      tsConfigPaths?: boolean | TSConfigPluginOptions
+      tsConfigPaths?: boolean | { ignoreConfigErrors?: boolean }
     }
 
     native?: {
@@ -499,9 +497,52 @@ export namespace One {
        * @default true
        */
       workers?: boolean
+
+      /**
+       * Scan client bundles for leaked secrets (API keys, tokens, passwords)
+       * after building. Catches accidental exposure of server-side secrets
+       * in client-facing JavaScript.
+       *
+       * - `'warn'` (default): Log warnings but don't fail the build
+       * - `'error'`: Fail the build if secrets are found
+       * - `false`: Disable scanning entirely
+       *
+       * Pass an object for fine-grained control:
+       *
+       * @example
+       * securityScan: {
+       *   level: 'error',
+       *   safePatterns: [
+       *     'sk_live_test_placeholder',
+       *     /my-custom-uuid-[a-f0-9-]+/,
+       *   ]
+       * }
+       *
+       * For production deployments, we recommend setting this to `'error'`
+       * to prevent secrets from being shipped to clients.
+       *
+       * @default 'warn'
+       */
+      securityScan?:
+        | boolean
+        | 'warn'
+        | 'error'
+        | {
+            /**
+             * @default 'warn'
+             */
+            level?: 'warn' | 'error'
+
+            /**
+             * Strings or regex patterns that should be considered safe
+             * and ignored by the scanner. Useful for test tokens, known
+             * UUIDs, or domain-specific patterns.
+             */
+            safePatterns?: (string | RegExp)[]
+          }
     }
 
-    deps?: FixDependencies
+    patches?: FixDependencies
 
     ssr?: {
       /**
@@ -551,6 +592,7 @@ export namespace One {
   }
 
   export type BuildInfo = {
+    outDir?: string
     constants: {
       CACHE_KEY: string
     }
@@ -596,6 +638,8 @@ export namespace One {
     /** Non-critical preloads that are modulepreload hints only */
     deferredPreloads?: string[]
     css: string[]
+    /** CSS from layout entries only - loaded before scripts to prevent FOUC */
+    layoutCSS: string[]
     /** When inlineLayoutCSS is enabled, contains the actual CSS content */
     cssContents?: string[]
   }

package/src/vite-auto-warm.ts

@@ -0,0 +1 @@
+export { autoWarmPlugin } from './vite/plugins/warmRoutesPlugin'

package/src/vite.ts

@@ -12,3 +12,4 @@ export { clientTreeShakePlugin } from './vite/plugins/clientTreeShakePlugin'
 export { createFileSystemRouterPlugin } from './vite/plugins/fileSystemRouterPlugin'
 export { removeReactNativeWebAnimatedPlugin } from './vite/plugins/removeReactNativeWebAnimatedPlugin'
 export { SSRCSSPlugin } from './vite/plugins/SSRCSSPlugin'
+export { autoWarmPlugin } from './vite/plugins/warmRoutesPlugin'

package/types/Root.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Root.d.ts","sourceRoot":"","sources":["../src/Root.tsx"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,SAAS,EAMf,MAAM,OAAO,CAAA;AAUd,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAKlD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAEvC,KAAK,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG;IAC7C,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,mBAAmB,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,GAAG,CAAC,YAAY,CAAA;IAC/B,KAAK,CAAC,EAAE,GAAG,CAAC,KAAK,CAAA;CAClB,CAAA;AAED,KAAK,UAAU,GAAG;IAChB,OAAO,EAAE,GAAG,CAAC,YAAY,CAAA;IACzB,QAAQ,CAAC,EAAE,GAAG,CAAA;IACd,OAAO,CAAC,EAAE,iBAAiB,CAAC;QAAE,QAAQ,EAAE,SAAS,CAAA;KAAE,CAAC,CAAA;IACpD,wBAAwB,CAAC,EAAE,wBAAwB,GAAG;QACpD,KAAK,CAAC,EAAE;YACN,IAAI,EAAE,OAAO,CAAA;YACb,MAAM,EAAE;gBACN,OAAO,EAAE,MAAM,CAAA;gBACf,UAAU,EAAE,MAAM,CAAA;gBAClB,IAAI,EAAE,MAAM,CAAA;gBACZ,IAAI,EAAE,MAAM,CAAA;gBACZ,MAAM,EAAE,MAAM,CAAA;gBACd,YAAY,EAAE,MAAM,CAAA;aACrB,CAAA;SACF,CAAA;KACF,CAAA;CACF,CAAA;AAQD,wBAAgB,IAAI,CAAC,KAAK,EAAE,SAAS,kDA8HpC"}
+{"version":3,"file":"Root.d.ts","sourceRoot":"","sources":["../src/Root.tsx"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,SAAS,EAMf,MAAM,OAAO,CAAA;AAYd,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAKlD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAEvC,KAAK,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG;IAC7C,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,mBAAmB,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,GAAG,CAAC,YAAY,CAAA;IAC/B,KAAK,CAAC,EAAE,GAAG,CAAC,KAAK,CAAA;CAClB,CAAA;AAED,KAAK,UAAU,GAAG;IAChB,OAAO,EAAE,GAAG,CAAC,YAAY,CAAA;IACzB,QAAQ,CAAC,EAAE,GAAG,CAAA;IACd,OAAO,CAAC,EAAE,iBAAiB,CAAC;QAAE,QAAQ,EAAE,SAAS,CAAA;KAAE,CAAC,CAAA;IACpD,wBAAwB,CAAC,EAAE,wBAAwB,GAAG;QACpD,KAAK,CAAC,EAAE;YACN,IAAI,EAAE,OAAO,CAAA;YACb,MAAM,EAAE;gBACN,OAAO,EAAE,MAAM,CAAA;gBACf,UAAU,EAAE,MAAM,CAAA;gBAClB,IAAI,EAAE,MAAM,CAAA;gBACZ,IAAI,EAAE,MAAM,CAAA;gBACZ,MAAM,EAAE,MAAM,CAAA;gBACd,YAAY,EAAE,MAAM,CAAA;aACrB,CAAA;SACF,CAAA;KACF,CAAA;CACF,CAAA;AAQD,wBAAgB,IAAI,CAAC,KAAK,EAAE,SAAS,kDAgIpC"}

package/types/babel-plugins/inline-one-server-url.d.ts

@@ -0,0 +1,10 @@
+/**
+ * babel plugin that inlines process.env.ONE_SERVER_URL at build time
+ * so native prod bundles know where to fetch loaders from.
+ */
+export default function pluginInlineOneServerUrl(): {
+    visitor: {
+        MemberExpression(nodePath: any): void;
+    };
+};
+//# sourceMappingURL=inline-one-server-url.d.ts.map

package/types/babel-plugins/inline-one-server-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline-one-server-url.d.ts","sourceRoot":"","sources":["../../src/babel-plugins/inline-one-server-url.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,OAAO,UAAU,wBAAwB;;mCAKf,GAAG;;EAgBnC"}

package/types/cli/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AAuDA,wBAAsB,KAAK,CAAC,IAAI,EAAE;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,SAAS,CAAA;IACpC,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,iBA+iCA"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AAyDA,wBAAsB,KAAK,CAAC,IAAI,EAAE;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,SAAS,CAAA;IACpC,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,iBAmpCA"}

package/types/cli/buildPage.d.ts

@@ -1,4 +1,4 @@
 import type { One, RouteInfo } from '../vite/types';
 export declare function printBuildTimings(): void;
-export declare function buildPage(serverEntry: string, path: string, relativeId: string, params: any, foundRoute: RouteInfo<string>, clientManifestEntry: any, staticDir: string, clientDir: string, builtMiddlewares: Record<string, string>, serverJsPath: string, preloads: string[], allCSS: string[], routePreloads: Record<string, string>, allCSSContents?: string[], criticalPreloads?: string[], deferredPreloads?: string[], useAfterLCP?: boolean, useAfterLCPAggressive?: boolean): Promise<One.RouteBuildInfo>;
+export declare function buildPage(serverEntry: string, path: string, relativeId: string, params: any, foundRoute: RouteInfo<string>, clientManifestEntry: any, staticDir: string, clientDir: string, builtMiddlewares: Record<string, string>, serverJsPath: string, preloads: string[], allCSS: string[], layoutCSS: string[], routePreloads: Record<string, string>, allCSSContents?: string[], criticalPreloads?: string[], deferredPreloads?: string[], useAfterLCP?: boolean, useAfterLCPAggressive?: boolean): Promise<One.RouteBuildInfo>;
 //# sourceMappingURL=buildPage.d.ts.map

package/types/cli/buildPage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"buildPage.d.ts","sourceRoot":"","sources":["../../src/cli/buildPage.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAkBnD,wBAAgB,iBAAiB,SAUhC;AAED,wBAAsB,SAAS,CAC7B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,GAAG,EACX,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,EAC7B,mBAAmB,EAAE,GAAG,EACxB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACxC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAAE,EAClB,MAAM,EAAE,MAAM,EAAE,EAChB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,cAAc,CAAC,EAAE,MAAM,EAAE,EACzB,gBAAgB,CAAC,EAAE,MAAM,EAAE,EAC3B,gBAAgB,CAAC,EAAE,MAAM,EAAE,EAC3B,WAAW,CAAC,EAAE,OAAO,EACrB,qBAAqB,CAAC,EAAE,OAAO,GAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAyY7B"}
+{"version":3,"file":"buildPage.d.ts","sourceRoot":"","sources":["../../src/cli/buildPage.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAkBnD,wBAAgB,iBAAiB,SAUhC;AAED,wBAAsB,SAAS,CAC7B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,GAAG,EACX,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,EAC7B,mBAAmB,EAAE,GAAG,EACxB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACxC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAAE,EAClB,MAAM,EAAE,MAAM,EAAE,EAChB,SAAS,EAAE,MAAM,EAAE,EACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,cAAc,CAAC,EAAE,MAAM,EAAE,EACzB,gBAAgB,CAAC,EAAE,MAAM,EAAE,EAC3B,gBAAgB,CAAC,EAAE,MAAM,EAAE,EAC3B,WAAW,CAAC,EAAE,OAAO,EACrB,qBAAqB,CAAC,EAAE,OAAO,GAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAia7B"}

package/types/cli/securityScan.d.ts

@@ -0,0 +1,16 @@
+export type SecurityFinding = {
+    file: string;
+    label: string;
+    match: string;
+    line: number;
+};
+export declare function scanBundleForSecrets(distDir: string, userSafePatterns?: (string | RegExp)[]): Promise<{
+    clean: boolean;
+    findings: SecurityFinding[];
+}>;
+/**
+ * runs the security scan based on config level
+ * returns true if the build should continue, false if it should fail
+ */
+export declare function runSecurityScan(clientDir: string, level: 'warn' | 'error', safePatterns?: (string | RegExp)[]): Promise<boolean>;
+//# sourceMappingURL=securityScan.d.ts.map

package/types/cli/securityScan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityScan.d.ts","sourceRoot":"","sources":["../../src/cli/securityScan.ts"],"names":[],"mappings":"AAgEA,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AA2BD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,gBAAgB,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GACrC,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,eAAe,EAAE,CAAA;CAC5B,CAAC,CAyCD;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,OAAO,EACvB,YAAY,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GACjC,OAAO,CAAC,OAAO,CAAC,CAmClB"}

package/types/cli/workerPool.d.ts

@@ -13,7 +13,7 @@ export declare class BuildWorkerPool {
     private _terminated;
     constructor(size?: number);
     get size(): number;
-    initialize(): Promise<void>;
+    initialize(oneOptions?: any): Promise<void>;
     private dispatch;
     buildPage(args: {
         serverEntry: string;
@@ -28,6 +28,7 @@ export declare class BuildWorkerPool {
         serverJsPath: string;
         preloads: string[];
         allCSS: string[];
+        layoutCSS: string[];
         routePreloads: Record<string, string>;
         allCSSContents?: string[];
         criticalPreloads?: string[];