one 1.12.6 → 1.12.7

package/src/babel-plugins/remove-server-code.ts

@@ -1,34 +1,34 @@
 /**
  * Babel plugin to remove server-only code (loader, generateStaticParams) from native bundles.
  *
- * This plugin transforms route files to remove server-only exports so they don't
- * get included in the native bundle. It's the Metro equivalent of clientTreeShakePlugin.
+ * This is the Metro equivalent of clientTreeShakePlugin. It:
+ * 1. Captures referenced identifiers BEFORE removing exports (critical for DCE)
+ * 2. Removes server-only exports (loader, generateStaticParams)
+ * 3. Re-parses the modified code and runs standalone DCE with the pre-removal references
+ * 4. Adds empty stubs back to prevent "missing export" errors
  *
- * What it does:
- * 1. Captures referenced identifiers BEFORE removing exports
- * 2. Removes `export function loader() { ... }` and `export const loader = ...`
- * 3. Removes `export function generateStaticParams() { ... }` and `export const generateStaticParams = ...`
- * 4. Runs dead code elimination to remove imports that were only used by removed functions
- * 5. Adds empty stubs back to prevent "missing export" errors
- *
- * Options:
- * - routerRoot: The router root directory (e.g., 'app'). Only files in this directory are transformed.
+ * The re-parse step is necessary because babel-dead-code-elimination uses NodePath
+ * identity (Set.has) which breaks when called within a babel plugin's traversal context
+ * due to different NodePath instances across traversal boundaries.
  */
 
 import type { NodePath, PluginObj } from '@babel/core'
+import BabelGenerate from '@babel/generator'
+import { parse } from '@babel/parser'
+import BabelTraverse from '@babel/traverse'
 import * as t from '@babel/types'
 import {
   deadCodeElimination,
   findReferencedIdentifiers,
 } from 'babel-dead-code-elimination'
 
-const SERVER_EXPORTS = ['loader', 'generateStaticParams'] as const
+const generate = (BabelGenerate['default'] ||
+  BabelGenerate) as any as typeof BabelGenerate
+const traverse = (BabelTraverse['default'] || BabelTraverse) as typeof BabelTraverse
 
+const SERVER_EXPORTS = ['loader', 'generateStaticParams'] as const
 type ServerExport = (typeof SERVER_EXPORTS)[number]
-
-type PluginOptions = {
-  routerRoot?: string
-}
+type PluginOptions = { routerRoot?: string }
 
 function removeServerCodePlugin(_: unknown, options: PluginOptions): PluginObj {
   const { routerRoot = 'app' } = options
@@ -37,198 +37,125 @@ function removeServerCodePlugin(_: unknown, options: PluginOptions): PluginObj {
     name: 'one-remove-server-code',
     visitor: {
       Program: {
-        enter(
-          path: NodePath<t.Program>,
-          state: { filename?: string; referenced?: Set<string> }
-        ) {
+        exit(path: NodePath<t.Program>, state: { filename?: string }) {
           const filename = state.filename
+          if (!filename) return
 
-          // Only process route files in the router root
-          if (!filename) {
-            return
-          }
-
-          // Check if file is in the router root directory
           const routerRootPattern = new RegExp(`[/\\\\]${routerRoot}[/\\\\]`)
-          if (!routerRootPattern.test(filename)) {
-            return
-          }
-
-          // Skip node_modules
-          if (filename.includes('node_modules')) {
-            return
-          }
+          if (!routerRootPattern.test(filename)) return
+          if (filename.includes('node_modules')) return
 
-          // Quick check if file even has these exports
           const code = path.toString()
-          if (!/generateStaticParams|loader/.test(code)) {
-            return
-          }
-
-          // Capture referenced identifiers BEFORE removing exports
-          // This is critical for dead code elimination to work
+          if (!/generateStaticParams|loader/.test(code)) return
+
+          // mirror the clientTreeShakePlugin approach exactly:
+          // 1. parse fresh AST from the current code
+          // 2. capture referenced identifiers BEFORE removing exports
+          // 3. remove server exports
+          // 4. run DCE with pre-removal references
+          // 5. replace the program body
           try {
-            state.referenced = findReferencedIdentifiers(path.node as any) as any
-          } catch (error) {
-            console.warn(
-              `[one/metro] Skipping tree shaking for ${filename} due to identifier analysis error:`,
-              error instanceof Error ? error.message : String(error)
-            )
-          }
-        },
-
-        exit(
-          path: NodePath<t.Program>,
-          state: { filename?: string; referenced?: Set<string> }
-        ) {
-          const filename = state.filename
-
-          // Only process route files in the router root
-          if (!filename) {
-            return
-          }
-
-          // Check if file is in the router root directory
-          const routerRootPattern = new RegExp(`[/\\\\]${routerRoot}[/\\\\]`)
-          if (!routerRootPattern.test(filename)) {
-            return
-          }
-
-          // Skip node_modules
-          if (filename.includes('node_modules')) {
-            return
-          }
-
-          // If we don't have referenced set from enter, skip
-          if (!state.referenced) {
-            return
-          }
-
-          const removedExports: Set<ServerExport> = new Set()
-
-          // Find and remove server exports
-          // Note: babel-preset-expo may have already transformed async functions like:
-          //   export async function loader() { ... }
-          // into:
-          //   function _loader() { _loader = _asyncToGenerator(...); return _loader.apply(...) }
-          //   export function loader() { return _loader.apply(...) }
-          // So we need to handle both the original form and the transformed form
-          path.traverse({
-            ExportNamedDeclaration(exportPath: NodePath<t.ExportNamedDeclaration>) {
-              const declaration = exportPath.node.declaration
-
-              // Handle: export function loader() { ... }
-              if (t.isFunctionDeclaration(declaration) && declaration.id) {
-                const name = declaration.id.name as ServerExport
-                if (SERVER_EXPORTS.includes(name)) {
-                  removedExports.add(name)
-                  exportPath.remove()
-                }
-              }
-              // Handle: export const loader = async () => { ... }
-              // Handle: export const loader = route.createLoader(...)
-              else if (t.isVariableDeclaration(declaration)) {
-                for (let i = declaration.declarations.length - 1; i >= 0; i--) {
-                  const declarator = declaration.declarations[i]
-                  if (t.isIdentifier(declarator.id)) {
-                    const name = declarator.id.name as ServerExport
-                    if (SERVER_EXPORTS.includes(name)) {
-                      removedExports.add(name)
-
-                      // Remove just this declarator
-                      if (declaration.declarations.length === 1) {
-                        exportPath.remove()
-                      } else {
-                        declaration.declarations.splice(i, 1)
-                      }
+            const freshAst = parse(code, {
+              sourceType: 'module',
+              plugins: ['typescript', 'jsx'],
+            }) as any
+
+            // capture references BEFORE removal (critical for DCE to work)
+            const referenced = findReferencedIdentifiers(freshAst)
+
+            const removed = { loader: false, generateStaticParams: false }
+
+            // remove server exports from the fresh AST
+            traverse(freshAst, {
+              ExportNamedDeclaration(expPath) {
+                const declaration = expPath.node.declaration
+                if (!declaration) return
+
+                if (declaration.type === 'FunctionDeclaration' && declaration.id) {
+                  const name = declaration.id.name
+                  if (name === 'loader' || name === 'generateStaticParams') {
+                    expPath.remove()
+                    removed[name] = true
+                  }
+                } else if (declaration.type === 'VariableDeclaration') {
+                  const decl = expPath.get(
+                    'declaration'
+                  ) as NodePath<t.VariableDeclaration>
+                  const declarators = decl.get('declarations')
+                  // iterate in reverse so indices stay valid after removal
+                  for (let i = declarators.length - 1; i >= 0; i--) {
+                    const declarator = declarators[i]
+                    const id = declarator.node.id
+                    if (
+                      id.type === 'Identifier' &&
+                      (id.name === 'loader' || id.name === 'generateStaticParams')
+                    ) {
+                      declarator.remove()
+                      removed[id.name as ServerExport] = true
                     }
                   }
-                }
-              }
-            },
-
-            // Also remove helper functions created by babel's async-to-generator transform
-            // These are named _loader, _generateStaticParams, etc.
-            FunctionDeclaration(funcPath: NodePath<t.FunctionDeclaration>) {
-              if (!funcPath.node.id) return
-              const name = funcPath.node.id.name
-              // Check for helper functions like _loader, _generateStaticParams
-              for (const serverExport of SERVER_EXPORTS) {
-                if (name === `_${serverExport}`) {
-                  // Verify this is indeed a babel-generated async helper
-                  // by checking if it contains _asyncToGenerator
-                  let isAsyncHelper = false
-                  funcPath.traverse({
-                    Identifier(idPath) {
-                      if (idPath.node.name === '_asyncToGenerator') {
-                        isAsyncHelper = true
-                        idPath.stop()
-                      }
-                    },
-                  })
-                  if (isAsyncHelper) {
-                    removedExports.add(serverExport)
-                    funcPath.remove()
+                  // if all declarators were removed, clean up the empty export
+                  if (decl.node && decl.node.declarations.length === 0) {
+                    expPath.remove()
                   }
                 }
-              }
-            },
-          })
+              },
+            })
 
-          // Only proceed if we removed something
-          if (removedExports.size === 0) {
-            return
-          }
-
-          // Run dead code elimination to remove imports that were only used by removed functions
-          try {
-            deadCodeElimination(path.node as any, state.referenced as any)
-          } catch (error) {
-            console.warn(
-              `[one/metro] Dead code elimination failed for ${filename}:`,
-              error instanceof Error ? error.message : String(error)
+            const removedFunctions = Object.keys(removed).filter(
+              (key) => removed[key as keyof typeof removed]
             )
-          }
 
-          // Add back empty stubs for removed exports to prevent "missing export" errors
-          const stubs: t.Statement[] = []
-
-          if (removedExports.has('loader')) {
-            // export function loader() { return "__vxrn__loader__"; }
-            stubs.push(
-              t.exportNamedDeclaration(
-                t.functionDeclaration(
-                  t.identifier('loader'),
-                  [],
-                  t.blockStatement([
-                    t.returnStatement(t.stringLiteral('__vxrn__loader__')),
-                  ])
+            if (removedFunctions.length === 0) return
+
+            // run DCE with pre-removal references (same as clientTreeShakePlugin)
+            deadCodeElimination(freshAst, referenced)
+
+            // add empty stubs to prevent "missing export" errors
+            if (removed.loader) {
+              freshAst.program.body.push(
+                t.exportNamedDeclaration(
+                  t.functionDeclaration(
+                    t.identifier('loader'),
+                    [],
+                    t.blockStatement([
+                      t.returnStatement(t.stringLiteral('__vxrn__loader__')),
+                    ])
+                  )
                 )
               )
-            )
-          }
-
-          if (removedExports.has('generateStaticParams')) {
-            // export function generateStaticParams() { }
-            stubs.push(
-              t.exportNamedDeclaration(
-                t.functionDeclaration(
-                  t.identifier('generateStaticParams'),
-                  [],
-                  t.blockStatement([])
+            }
+            if (removed.generateStaticParams) {
+              freshAst.program.body.push(
+                t.exportNamedDeclaration(
+                  t.functionDeclaration(
+                    t.identifier('generateStaticParams'),
+                    [],
+                    t.blockStatement([])
+                  )
                 )
               )
-            )
-          }
+            }
 
-          // Add stubs at the end of the file
-          for (const stub of stubs) {
-            path.pushContainer('body', stub)
-          }
+            // generate cleaned code and re-parse to get proper NodePaths for babel
+            const out = generate(freshAst, { retainLines: true })
+            const finalAst = parse(out.code, {
+              sourceType: 'module',
+              plugins: ['typescript', 'jsx'],
+            }) as any
+
+            path.node.body = finalAst.program.body
+            path.node.directives = finalAst.program.directives
 
-          if (process.env.DEBUG) {
-            console.info(
-              ` 🧹 [one/metro] ${filename} removed ${removedExports.size} server-only exports`
+            if (process.env.DEBUG) {
+              console.info(
+                ` 🧹 [one/metro] ${filename} removed ${removedFunctions.length} server-only exports`
+              )
+            }
+          } catch (error) {
+            console.warn(
+              `[one/metro] Tree shaking failed for ${filename}:`,
+              error instanceof Error ? error.message : String(error)
             )
           }
         },

package/src/cli/build.ts

@@ -148,7 +148,7 @@ export async function build(args: {
 
     if (url) {
       process.env.ONE_SERVER_URL = url
-      console.info(`\n ☁️  ONE_SERVER_URL: ${url}\n`)
+      console.info(`\n ☁️ ONE_SERVER_URL: ${url}\n`)
     }
   }
 
@@ -182,7 +182,7 @@ export async function build(args: {
   )
 
   const bundleTime = performance.now() - buildStartTime
-  console.info(`\n ⏱️  vite bundle: ${(bundleTime / 1000).toFixed(2)}s\n`)
+  console.info(`\n ⏱️ vite bundle: ${(bundleTime / 1000).toFixed(2)}s\n`)
 
   if (!vxrnOutput || args.platform !== 'web') {
     return
@@ -912,7 +912,7 @@ export async function build(args: {
 
   const staticTime = performance.now() - staticStartTime
   console.info(
-    `\n ⏱️  static routes: ${(staticTime / 1000).toFixed(2)}s (${builtRoutes.length} pages)\n`
+    `\n ⏱️ static routes: ${(staticTime / 1000).toFixed(2)}s (${builtRoutes.length} pages)\n`
   )
   printBuildTimings()
 
@@ -1302,7 +1302,7 @@ export default {
     })
   }
 
-  console.info(`\n\n  💛 build complete\n\n`)
+  console.info(`\n 💛 build complete\n`)
 }
 
 const TRAILING_INDEX_REGEX = /\/index(\.(web))?/

package/src/cli/dev.ts

@@ -24,7 +24,8 @@ export async function dev(args: {
   const root = process.cwd()
   let daemonServerId: string | undefined
   let useDaemon = false
-  let effectivePort = args.port ? +args.port : DEFAULT_PORT
+  // only set port if user explicitly passed --port; otherwise let vite.config.ts decide
+  let effectivePort: number | undefined = args.port ? +args.port : undefined
 
   // check if daemon is running
   const {
@@ -79,7 +80,7 @@ export async function dev(args: {
   if (useDaemon && bundleId) {
     try {
       daemonServerId = await registerWithDaemon({
-        port: effectivePort,
+        port: effectivePort!,
         bundleId,
         root,
       })
@@ -89,7 +90,7 @@ export async function dev(args: {
         )
       )
       // persist for daemon restart recovery
-      writeServerFile({ port: effectivePort, bundleId, root, pid: process.pid })
+      writeServerFile({ port: effectivePort!, bundleId, root, pid: process.pid })
     } catch (err) {
       console.log(colors.yellow(`[daemon] Failed to register: ${err}`))
     }

package/src/cli/securityScan.ts

@@ -157,7 +157,7 @@ export async function runSecurityScan(
   const { clean, findings } = await scanBundleForSecrets(clientDir, safePatterns)
 
   if (clean) {
-    console.info(` 🔒 security scan passed — no secrets found\n`)
+    console.info(`\n 🔒 security scan passed — no secrets found\n`)
     return true
   }
 

package/src/createApp.tsx

@@ -8,6 +8,7 @@ import { render } from './render'
 import { initClientMatches } from './router/router'
 import { registerPreloadedRoute } from './router/useViteRoutes'
 import { setupSkewProtection } from './skewProtection'
+import { findRootLayout } from './utils/findRootLayout'
 import type { RenderAppProps } from './types'
 import { getServerHeadInsertions } from './useServerHeadInsertion'
 import { ensureExists } from './utils/ensureExists'
@@ -228,43 +229,6 @@ export function createApp(options: CreateAppProps) {
     }
   }
 
-  // find root layout in routes regardless of render mode suffix (+ssg, +ssr, +spa)
-  // the glob keys include the suffix (e.g., /app/_layout+ssg.tsx) but we need to
-  // match any root layout variant to ensure it's preloaded before rendering
-  function findAndPreloadRootLayout(
-    routes: Record<string, () => Promise<unknown>>,
-    routerRoot: string
-  ): Promise<unknown> | undefined {
-    // try exact match first (no suffix)
-    const exactKey = `/${routerRoot}/_layout.tsx`
-    if (routes[exactKey]) {
-      return routes[exactKey]()
-    }
-
-    // try with render mode suffixes
-    for (const suffix of ['+ssg', '+ssr', '+spa']) {
-      const key = `/${routerRoot}/_layout${suffix}.tsx`
-      if (routes[key]) {
-        return routes[key]()
-      }
-    }
-
-    // try .ts extension variants
-    const exactKeyTs = `/${routerRoot}/_layout.ts`
-    if (routes[exactKeyTs]) {
-      return routes[exactKeyTs]()
-    }
-
-    for (const suffix of ['+ssg', '+ssr', '+spa']) {
-      const key = `/${routerRoot}/_layout${suffix}.ts`
-      if (routes[key]) {
-        return routes[key]()
-      }
-    }
-
-    return undefined
-  }
-
   // skew protection: auto-reload on chunk load failures
   if (typeof window !== 'undefined' && process.env.ONE_SKEW_PROTECTION !== 'false') {
     window.addEventListener('vite:preloadError', (e) => {
@@ -317,7 +281,7 @@ export function createApp(options: CreateAppProps) {
         registerPreloadedRoute(routeKey, mod)
         return mod
       })
-    : [findAndPreloadRootLayout(options.routes, options.routerRoot)]
+    : [findRootLayout(options.routes, options.routerRoot)]
 
   // for 404 pages, use history.state.__tempLocation to route to notFoundPath
   // without changing the browser URL. the router checks __tempLocation and uses

package/src/fork/getStateFromPath-mods.ts

@@ -41,8 +41,19 @@ export function getUrlWithReactNavigationConcessions(
     if (hashIndex >= 0) {
       hash = path.slice(hashIndex)
     }
-    const end = hashIndex >= 0 ? hashIndex : queryIndex >= 0 ? queryIndex : path.length
+    // pathname ends before query or hash, whichever comes first
+    let end = path.length
+    if (queryIndex >= 0) end = Math.min(end, queryIndex)
+    if (hashIndex >= 0) end = Math.min(end, hashIndex)
     pathname = path.slice(0, end)
+
+    // strip origin from absolute URLs (e.g. https://acme.com/path -> /path)
+    if (pathname.startsWith('http://') || pathname.startsWith('https://')) {
+      const originEnd = pathname.indexOf('/', pathname.indexOf('//') + 2)
+      if (originEnd >= 0) {
+        pathname = pathname.slice(originEnd)
+      }
+    }
   } catch {
     // Do nothing with invalid URLs.
   }
@@ -386,8 +397,11 @@ export function parseQueryParamsExtended(
   hash?: string
 ) {
   const queryIndex = path.indexOf('?')
+  const hashIndex = path.indexOf('#')
+  // only parse between ? and # to avoid hash leaking into search params
+  const queryEnd = hashIndex >= 0 && hashIndex > queryIndex ? hashIndex : undefined
   const searchParams = new URLSearchParams(
-    queryIndex >= 0 ? path.slice(queryIndex + 1) : ''
+    queryIndex >= 0 ? path.slice(queryIndex + 1, queryEnd) : ''
   )
   const params: Record<string, string | string[]> = Object.create(null)
 

package/src/getDevServer.native.ts

@@ -1,3 +1,9 @@
 // Isolated to suppress deprecation warning for deep import
 // React Native 0.81+ discourages deep imports but doesn't provide official alternative yet
-export { default as getDevServer } from 'react-native/Libraries/Core/Devtools/getDevServer'
+import getDevServerDefault from 'react-native/Libraries/Core/Devtools/getDevServer'
+
+// handle CJS/ESM interop — Metro may wrap the default export in a module object
+export const getDevServer: () => { url: string; bundleLoadedFromServer: boolean } =
+  typeof getDevServerDefault === 'function'
+    ? getDevServerDefault
+    : ((getDevServerDefault as any).default ?? getDevServerDefault)

package/src/headless.tsx

@@ -0,0 +1,46 @@
+import './setup'
+
+import { Root } from './Root'
+import { resolveClientLoader } from './clientLoaderResolver'
+import { render } from './render'
+import { findRootLayout } from './utils/findRootLayout'
+import type { One } from './vite/types'
+
+export { Root }
+
+export type CreateHeadlessAppProps = {
+  routes: Record<string, () => Promise<unknown>>
+  routerRoot: string
+  path?: string
+  flags?: One.Flags
+  getSetupPromise?: () => Promise<unknown>
+}
+
+export function createApp(options: CreateHeadlessAppProps) {
+  // always spa mode — render() checks this to use createRoot instead of hydrateRoot
+  globalThis['__vxrnIsSPA'] = true
+
+  const setupComplete = options.getSetupPromise
+    ? options.getSetupPromise()
+    : Promise.resolve()
+
+  return setupComplete
+    .then(() => findRootLayout(options.routes, options.routerRoot))
+    .then(() => resolveClientLoader({}))
+    .then(() => {
+      render(
+        <Root
+          isClient
+          flags={options.flags}
+          routes={options.routes}
+          routerRoot={options.routerRoot}
+          path={
+            options.path || (typeof window !== 'undefined' ? window.location.href : '/')
+          }
+        />
+      )
+    })
+    .catch((err) => {
+      console.error(`[one/headless] Error during initialization:`, err)
+    })
+}

package/src/metro-config/getViteMetroPluginOptions.ts

@@ -135,6 +135,22 @@ export function getViteMetroPluginOptions({
               }
             }
 
+            // react-native-svg's package.json has "react-native": "src/index.ts"
+            // which points to TS source that only type-exports Svg/Circle/Path etc.
+            // force resolution to the compiled JS which has proper named value exports.
+            if (moduleName === 'react-native-svg') {
+              const defaultResolveRequest =
+                defaultConfig?.resolver?.resolveRequest || context.resolveRequest
+              const res = defaultResolveRequest(context, moduleName, platform)
+              if (res && 'filePath' in res && res.filePath.includes('/src/index.ts')) {
+                return {
+                  ...res,
+                  filePath: res.filePath.replace('/src/index.ts', '/lib/commonjs/index.js'),
+                }
+              }
+              return res
+            }
+
             const defaultResolveRequest =
               defaultConfig?.resolver?.resolveRequest || context.resolveRequest
             const res = defaultResolveRequest(context, moduleName, platform)

package/src/utils/findRootLayout.ts

@@ -0,0 +1,25 @@
+// find root layout in routes regardless of render mode suffix (+ssg, +ssr, +spa)
+// the glob keys include the suffix (e.g., /app/_layout+ssg.tsx) but we need to
+// match any root layout variant to ensure it's preloaded before rendering
+export function findRootLayout(
+  routes: Record<string, () => Promise<unknown>>,
+  routerRoot: string
+): Promise<unknown> | undefined {
+  const exactKey = `/${routerRoot}/_layout.tsx`
+  if (routes[exactKey]) return routes[exactKey]()
+
+  for (const suffix of ['+ssg', '+ssr', '+spa']) {
+    const key = `/${routerRoot}/_layout${suffix}.tsx`
+    if (routes[key]) return routes[key]()
+  }
+
+  const exactKeyTs = `/${routerRoot}/_layout.ts`
+  if (routes[exactKeyTs]) return routes[exactKeyTs]()
+
+  for (const suffix of ['+ssg', '+ssr', '+spa']) {
+    const key = `/${routerRoot}/_layout${suffix}.ts`
+    if (routes[key]) return routes[key]()
+  }
+
+  return undefined
+}