one 1.24.9 → 1.25.3

package/src/vite/plugins/imageDataPlugin.test.ts

@@ -35,29 +35,17 @@ describe('imageDataPlugin', () => {
   })
 
   describe('resolveId', () => {
-    it('should return null for non-imagedata imports', async () => {
+    // these ids are now rejected by the rust-side hook filter, so the handler
+    // never runs for them. assert the filter itself does that.
+    it('filters out ids without a trailing ?imagedata', async () => {
       const { imageDataPlugin } = await import('./imageDataPlugin')
       const plugin = imageDataPlugin()
+      const filter = (plugin.resolveId as any).filter.id as RegExp
 
-      if (plugin.configResolved) {
-        ;(plugin.configResolved as any)(mockConfig())
-      }
-
-      const result = await (plugin.resolveId as any)('./image.jpg', undefined)
-      expect(result).toBeNull()
-    })
-
-    it('should return null for imports with imagedata not as suffix', async () => {
-      const { imageDataPlugin } = await import('./imageDataPlugin')
-      const plugin = imageDataPlugin()
-
-      if (plugin.configResolved) {
-        ;(plugin.configResolved as any)(mockConfig())
-      }
-
+      expect(filter.test('./image.jpg')).toBe(false)
       // ?imagedata in the middle should not match
-      const result = await (plugin.resolveId as any)('./image?imagedata.jpg', undefined)
-      expect(result).toBeNull()
+      expect(filter.test('./image?imagedata.jpg')).toBe(false)
+      expect(filter.test('./image.jpg?imagedata')).toBe(true)
     })
 
     it('should resolve public dir paths starting with /', async () => {
@@ -68,7 +56,7 @@ describe('imageDataPlugin', () => {
         ;(plugin.configResolved as any)(mockConfig())
       }
 
-      const result = await (plugin.resolveId as any)(
+      const result = await (plugin.resolveId as any).handler(
         '/test-image.jpg?imagedata',
         undefined
       )
@@ -83,7 +71,7 @@ describe('imageDataPlugin', () => {
         ;(plugin.configResolved as any)(mockConfig())
       }
 
-      const result = await (plugin.resolveId as any)(
+      const result = await (plugin.resolveId as any).handler(
         './test-image.jpg?imagedata',
         HERO_FILE
       )
@@ -98,7 +86,7 @@ describe('imageDataPlugin', () => {
         ;(plugin.configResolved as any)(mockConfig())
       }
 
-      const result = await (plugin.resolveId as any)(
+      const result = await (plugin.resolveId as any).handler(
         '/nonexistent.jpg?imagedata',
         undefined
       )
@@ -115,7 +103,7 @@ describe('imageDataPlugin', () => {
         ;(plugin.configResolved as any)(mockConfig())
       }
 
-      const result = await (plugin.resolveId as any)(
+      const result = await (plugin.resolveId as any).handler(
         '/../../../etc/passwd?imagedata',
         undefined
       )
@@ -130,7 +118,7 @@ describe('imageDataPlugin', () => {
         ;(plugin.configResolved as any)(mockConfig())
       }
 
-      const result = await (plugin.resolveId as any)(
+      const result = await (plugin.resolveId as any).handler(
         '../../../../etc/passwd?imagedata',
         HERO_FILE
       )
@@ -145,7 +133,7 @@ describe('imageDataPlugin', () => {
         ;(plugin.configResolved as any)(mockConfig())
       }
 
-      const result = await (plugin.resolveId as any)(
+      const result = await (plugin.resolveId as any).handler(
         '../../../etc/passwd?imagedata',
         undefined
       )
@@ -162,7 +150,7 @@ describe('imageDataPlugin', () => {
 
       // Going up and back down should still work if within bounds
       // From /project/src/components, ../.. goes to /project, then src/test-image.jpg
-      const result = await (plugin.resolveId as any)(
+      const result = await (plugin.resolveId as any).handler(
         '../../src/test-image.jpg?imagedata',
         HERO_FILE
       )
@@ -171,20 +159,13 @@ describe('imageDataPlugin', () => {
   })
 
   describe('load', () => {
-    it('should return null for non-virtual modules', async () => {
+    it('filters out non-virtual modules before the handler runs', async () => {
       const { imageDataPlugin } = await import('./imageDataPlugin')
       const plugin = imageDataPlugin()
+      const filter = (plugin.load as any).filter.id as RegExp
 
-      if (plugin.configResolved) {
-        ;(plugin.configResolved as any)(mockConfig())
-      }
-
-      const mockContext = {
-        addWatchFile: vi.fn(),
-      }
-
-      const result = await (plugin.load as any).call(mockContext, './image.jpg')
-      expect(result).toBeNull()
+      expect(filter.test('./image.jpg')).toBe(false)
+      expect(filter.test('\0imagedata:/abs/path/image.jpg')).toBe(true)
     })
 
     it('should return fallback data when sharp fails', async () => {
@@ -203,7 +184,7 @@ describe('imageDataPlugin', () => {
 
       // This will fail because the file doesn't actually exist
       // But it should gracefully fallback
-      const result = await (plugin.load as any).call(
+      const result = await (plugin.load as any).handler.call(
         mockContext,
         '\0imagedata:' + testFilePath
       )
@@ -248,7 +229,7 @@ describe('imageDataPlugin output format', () => {
 
     const testFilePath = resolve(PUBLIC_DIR, 'test-image.jpg')
 
-    const result = await (plugin.load as any).call(
+    const result = await (plugin.load as any).handler.call(
       mockContext,
       '\0imagedata:' + testFilePath
     )

package/src/vite/plugins/imageDataPlugin.ts

@@ -1,11 +1,14 @@
 import { existsSync } from 'node:fs'
 import { dirname, relative, resolve, sep } from 'node:path'
+import { prefixRegex } from 'rolldown/filter'
 import type { Plugin, ResolvedConfig } from 'vite'
 import { normalizePath } from 'vite'
 import { processImageMeta } from '../../image/getImageData'
 
 const IMAGEDATA_SUFFIX = '?imagedata'
 const VIRTUAL_PREFIX = '\0imagedata:'
+// rust-side hook filter, exactly equivalent to the endsWith guard it replaced
+const IMAGEDATA_SUFFIX_RE = /\?imagedata$/
 
 export function imageDataPlugin(): Plugin {
   let publicDir: string
@@ -36,55 +39,57 @@ export function imageDataPlugin(): Plugin {
       root = resolvedConfig.root
     },
 
-    async resolveId(id, importer) {
-      if (!id.endsWith(IMAGEDATA_SUFFIX)) return null
-
-      const cleanId = id.slice(0, -IMAGEDATA_SUFFIX.length)
-      let filePath: string
-      let allowedDir: string
-
-      // Handle public dir paths (starting with /)
-      if (cleanId.startsWith('/')) {
-        filePath = resolve(publicDir, cleanId.slice(1))
-        allowedDir = publicDir
-      } else if (importer) {
-        // Handle relative imports
-        filePath = resolve(dirname(importer.replace(VIRTUAL_PREFIX, '')), cleanId)
-        allowedDir = root
-      } else {
-        filePath = resolve(root, cleanId)
-        allowedDir = root
-      }
-
-      // Security: prevent path traversal outside allowed directory
-      if (!isPathWithinBounds(filePath, allowedDir)) {
-        console.warn(`[one] ?imagedata: Path traversal blocked: ${cleanId}`)
-        return null
-      }
-
-      if (!existsSync(filePath)) {
-        console.warn(`[one] ?imagedata: File not found: ${filePath}`)
-        return null
-      }
-
-      return VIRTUAL_PREFIX + filePath
+    resolveId: {
+      filter: { id: IMAGEDATA_SUFFIX_RE },
+      async handler(id, importer) {
+        const cleanId = id.slice(0, -IMAGEDATA_SUFFIX.length)
+        let filePath: string
+        let allowedDir: string
+
+        // Handle public dir paths (starting with /)
+        if (cleanId.startsWith('/')) {
+          filePath = resolve(publicDir, cleanId.slice(1))
+          allowedDir = publicDir
+        } else if (importer) {
+          // Handle relative imports
+          filePath = resolve(dirname(importer.replace(VIRTUAL_PREFIX, '')), cleanId)
+          allowedDir = root
+        } else {
+          filePath = resolve(root, cleanId)
+          allowedDir = root
+        }
+
+        // Security: prevent path traversal outside allowed directory
+        if (!isPathWithinBounds(filePath, allowedDir)) {
+          console.warn(`[one] ?imagedata: Path traversal blocked: ${cleanId}`)
+          return null
+        }
+
+        if (!existsSync(filePath)) {
+          console.warn(`[one] ?imagedata: File not found: ${filePath}`)
+          return null
+        }
+
+        return VIRTUAL_PREFIX + filePath
+      },
     },
 
-    async load(id) {
-      if (!id.startsWith(VIRTUAL_PREFIX)) return null
+    load: {
+      filter: { id: prefixRegex(VIRTUAL_PREFIX) },
+      async handler(id) {
+        const filePath = id.slice(VIRTUAL_PREFIX.length)
+        const src = getSrcPath(filePath)
 
-      const filePath = id.slice(VIRTUAL_PREFIX.length)
-      const src = getSrcPath(filePath)
+        // Track file for rebuild on change
+        this.addWatchFile(filePath)
 
-      // Track file for rebuild on change
-      this.addWatchFile(filePath)
+        const meta = await processImageMeta(filePath)
+        if (!meta) {
+          return createImageDataExport(src)
+        }
 
-      const meta = await processImageMeta(filePath)
-      if (!meta) {
-        return createImageDataExport(src)
-      }
-
-      return createImageDataExport(src, meta.width, meta.height, meta.blurDataURL)
+        return createImageDataExport(src, meta.width, meta.height, meta.blurDataURL)
+      },
     },
   }
 }

package/src/vite/plugins/virtualEntryPlugin.test.ts

@@ -29,7 +29,7 @@ function loadEntry(
   const ctx = {
     environment: { name: envName, mode: envMode },
   }
-  return plugin.load.call(ctx, '\0virtual:one-entry')
+  return plugin.load.handler.call(ctx, '\0virtual:one-entry')
 }
 
 describe('virtualEntryPlugin', () => {

package/src/vite/plugins/virtualEntryPlugin.ts

@@ -20,6 +20,15 @@ import {
   virtualEntryIdNative,
 } from './virtualEntryConstants'
 
+// rust-side hook filters, derived from the ids so they can't drift
+const escapeRe = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+const VIRTUAL_ENTRY_SOURCE_RE = new RegExp(
+  `^(?:${escapeRe(virtualEntryId)}|${escapeRe(virtualEntryIdNative)})$`
+)
+const VIRTUAL_ENTRY_RESOLVED_RE = new RegExp(
+  `^(?:${escapeRe(resolvedVirtualEntryId)}|${escapeRe(resolvedVirtualEntryIdNative)})$`
+)
+
 type NormalizedSetupFiles = {
   client?: string
   server?: string
@@ -142,128 +151,135 @@ export function createVirtualEntry(options: {
       isDevMode = config.command === 'serve'
     },
 
-    resolveId(id) {
-      if (id === virtualEntryId) {
-        return resolvedVirtualEntryId
-      }
-      if (id === virtualEntryIdNative) {
-        return resolvedVirtualEntryIdNative
-      }
+    // only the two virtual entry ids reach js; every other import in the graph
+    // is rejected rust-side
+    resolveId: {
+      filter: { id: VIRTUAL_ENTRY_SOURCE_RE },
+      handler(id) {
+        if (id === virtualEntryId) {
+          return resolvedVirtualEntryId
+        }
+        if (id === virtualEntryIdNative) {
+          return resolvedVirtualEntryIdNative
+        }
+      },
     },
 
-    load(id) {
-      if (id === resolvedVirtualEntryId) {
-        const isNative = isNativeEnvironment(this.environment)
-        const isSSR = this.environment.name === 'ssr'
-        const serverSpaRouteFiles = isSSR
-          ? options.routeIndex
-              .getPaths()
-              .map((file) => file.replace(/^\.\//, ''))
-              .filter((file) => /\.tsx?$/.test(file))
-              .filter(
-                (file) => !micromatch.isMatch(file, ROUTE_WEB_EXCLUSION_GLOB_PATTERNS)
-              )
-              .filter((file) => {
-                const parts = file.split('/')
-                const filename = parts.at(-1) || ''
-                if (
-                  filename.startsWith('_layout') ||
-                  filename.startsWith('_middleware')
-                ) {
-                  return false
-                }
+    load: {
+      filter: { id: VIRTUAL_ENTRY_RESOLVED_RE },
+      handler(id) {
+        if (id === resolvedVirtualEntryId) {
+          const isNative = isNativeEnvironment(this.environment)
+          const isSSR = this.environment.name === 'ssr'
+          const serverSpaRouteFiles = isSSR
+            ? options.routeIndex
+                .getPaths()
+                .map((file) => file.replace(/^\.\//, ''))
+                .filter((file) => /\.tsx?$/.test(file))
+                .filter(
+                  (file) => !micromatch.isMatch(file, ROUTE_WEB_EXCLUSION_GLOB_PATTERNS)
+                )
+                .filter((file) => {
+                  const parts = file.split('/')
+                  const filename = parts.at(-1) || ''
+                  if (
+                    filename.startsWith('_layout') ||
+                    filename.startsWith('_middleware')
+                  ) {
+                    return false
+                  }
 
-                const fileMode = matchFileRenderMode(filename)
-                if (fileMode) return fileMode === 'spa'
+                  const fileMode = matchFileRenderMode(filename)
+                  if (fileMode) return fileMode === 'spa'
 
-                let parentMode: One.RouteRenderMode | 'api' | undefined
-                for (const directory of parts.slice(0, -1)) {
-                  parentMode =
-                    matchDirectoryRenderMode(directory)?.renderMode ?? parentMode
-                }
-                return parentMode === 'spa'
-              })
-          : []
-        const serverSpaRouteStubs = serverSpaRouteFiles
-          .map(
-            (file) =>
-              `${JSON.stringify(`/${options.root}/${file}`)}: () => Promise.resolve({})`
+                  let parentMode: One.RouteRenderMode | 'api' | undefined
+                  for (const directory of parts.slice(0, -1)) {
+                    parentMode =
+                      matchDirectoryRenderMode(directory)?.renderMode ?? parentMode
+                  }
+                  return parentMode === 'spa'
+                })
+            : []
+          const serverSpaRouteStubs = serverSpaRouteFiles
+            .map(
+              (file) =>
+                `${JSON.stringify(`/${options.root}/${file}`)}: () => Promise.resolve({})`
+            )
+            .join(',\n    ')
+          const serverSpaBuildGlobs = serverSpaRouteFiles.map(
+            (file) => `/${options.root}/${file}`
           )
-          .join(',\n    ')
-        const serverSpaBuildGlobs = serverSpaRouteFiles.map(
-          (file) => `/${options.root}/${file}`
-        )
-        const serverSpaBuildRoutes = serverSpaBuildGlobs.length
-          ? `{
+          const serverSpaBuildRoutes = serverSpaBuildGlobs.length
+            ? `{
   loader: import.meta.glob(${JSON.stringify(serverSpaBuildGlobs)}, { exhaustive: true, import: 'loader', query: '?one-spa-build' }),
   generateStaticParams: import.meta.glob(${JSON.stringify(serverSpaBuildGlobs)}, { exhaustive: true, import: 'generateStaticParams', query: '?one-spa-build' }),
   sitemap: import.meta.glob(${JSON.stringify(serverSpaBuildGlobs)}, { exhaustive: true, import: 'sitemap', query: '?one-spa-build' })
 }`
-          : '{}'
-        const webRouteGlobs = [
-          ...routeGlobs,
-          ...ROUTE_WEB_EXCLUSION_GLOB_PATTERNS.map((pattern) => `!${pattern}`),
-          ...serverSpaRouteFiles.map((file) => `!/${options.root}/${file}`),
-        ]
-        // native always needs static import. SSR in dev mode uses static import
-        // so Vite crawls the setupFile's dep tree (including react) and pre-bundles
-        // them before the first request. SSR in build mode uses lazy import so the
-        // setupFile doesn't execute during the build phase.
-        const useStaticImport = isNative || (isSSR && isDevMode)
-        const setupResult = getSetupFileImport(
-          this.environment.name,
-          setupFiles,
-          useStaticImport,
-          viteRoot
-        )
-        // When nativewind is enabled, import the components module to register Text, View, etc. with cssInterop
-        const nativewindImport = configuration.enableNativewind
-          ? `import 'react-native-css-interop/dist/runtime/components'`
-          : ''
-        // For web/SSR, pass getSetupPromise to createApp so it can call it at runtime
-        const setupPromiseArg = setupResult.promiseVarName
-          ? `getSetupPromise: ${setupResult.promiseVarName},`
-          : ''
-        const linkingArg = options.router?.linking
-          ? `linking: ${JSON.stringify(options.router.linking)},`
-          : ''
+            : '{}'
+          const webRouteGlobs = [
+            ...routeGlobs,
+            ...ROUTE_WEB_EXCLUSION_GLOB_PATTERNS.map((pattern) => `!${pattern}`),
+            ...serverSpaRouteFiles.map((file) => `!/${options.root}/${file}`),
+          ]
+          // native always needs static import. SSR in dev mode uses static import
+          // so Vite crawls the setupFile's dep tree (including react) and pre-bundles
+          // them before the first request. SSR in build mode uses lazy import so the
+          // setupFile doesn't execute during the build phase.
+          const useStaticImport = isNative || (isSSR && isDevMode)
+          const setupResult = getSetupFileImport(
+            this.environment.name,
+            setupFiles,
+            useStaticImport,
+            viteRoot
+          )
+          // When nativewind is enabled, import the components module to register Text, View, etc. with cssInterop
+          const nativewindImport = configuration.enableNativewind
+            ? `import 'react-native-css-interop/dist/runtime/components'`
+            : ''
+          // For web/SSR, pass getSetupPromise to createApp so it can call it at runtime
+          const setupPromiseArg = setupResult.promiseVarName
+            ? `getSetupPromise: ${setupResult.promiseVarName},`
+            : ''
+          const linkingArg = options.router?.linking
+            ? `linking: ${JSON.stringify(options.router.linking)},`
+            : ''
 
-        // the react-refresh preamble has to be installed before the first
-        // compiler-wrapped module evaluates, or that module throws "React refresh
-        // preamble was not loaded" and client init aborts. /@one/dev.js installs
-        // it, but it cannot be relied on to win: it is a DEFERRED module script,
-        // so it waits for the document to finish parsing, while the client entry
-        // is async and runs the moment it arrives. that race is decided by
-        // document size. a SPA shell is a few hundred bytes and dev.js wins; a
-        // prerendered +ssg/ssr page is hundreds of KB and the entry regularly
-        // wins, throws on the first route module, and leaves the page unhydrated
-        // and unthemed on the very same server. bundled dev has no working
-        // /@one/dev.js at all, since it imports /@vite/client, which does not
-        // exist there.
-        // so install it from the entry, whose body is the one point guaranteed to
-        // run before the lazily-globbed route modules in every dev client. the
-        // !$RefreshReg$ guard makes this a no-op when dev.js already won, and
-        // dev.js keeps its own install because injectIntoGlobalHook wants to run
-        // before react evaluates. ('one' and /@react-refresh are node_modules /
-        // the runtime, so neither is refresh-wrapped, and on the client the setup
-        // file is imported lazily rather than statically.)
-        // this must stay gated to a dev CLIENT. `isBundled` is true for EVERY
-        // environment during build, so it cannot gate this on its own, and a prod
-        // build emitting an import of /@react-refresh would reference a module
-        // that only exists while serving.
-        const isDevClient =
-          this.environment.mode === 'dev' && this.environment.name === 'client'
-        const refreshPreambleImport = isDevClient
-          ? `import { injectIntoGlobalHook as __oneInjectRefresh } from '/@react-refresh'`
-          : ''
-        const refreshPreambleSetup = isDevClient
-          ? `if (typeof window !== 'undefined' && !window.$RefreshReg$) {
+          // the react-refresh preamble has to be installed before the first
+          // compiler-wrapped module evaluates, or that module throws "React refresh
+          // preamble was not loaded" and client init aborts. /@one/dev.js installs
+          // it, but it cannot be relied on to win: it is a DEFERRED module script,
+          // so it waits for the document to finish parsing, while the client entry
+          // is async and runs the moment it arrives. that race is decided by
+          // document size. a SPA shell is a few hundred bytes and dev.js wins; a
+          // prerendered +ssg/ssr page is hundreds of KB and the entry regularly
+          // wins, throws on the first route module, and leaves the page unhydrated
+          // and unthemed on the very same server. bundled dev has no working
+          // /@one/dev.js at all, since it imports /@vite/client, which does not
+          // exist there.
+          // so install it from the entry, whose body is the one point guaranteed to
+          // run before the lazily-globbed route modules in every dev client. the
+          // !$RefreshReg$ guard makes this a no-op when dev.js already won, and
+          // dev.js keeps its own install because injectIntoGlobalHook wants to run
+          // before react evaluates. ('one' and /@react-refresh are node_modules /
+          // the runtime, so neither is refresh-wrapped, and on the client the setup
+          // file is imported lazily rather than statically.)
+          // this must stay gated to a dev CLIENT. `isBundled` is true for EVERY
+          // environment during build, so it cannot gate this on its own, and a prod
+          // build emitting an import of /@react-refresh would reference a module
+          // that only exists while serving.
+          const isDevClient =
+            this.environment.mode === 'dev' && this.environment.name === 'client'
+          const refreshPreambleImport = isDevClient
+            ? `import { injectIntoGlobalHook as __oneInjectRefresh } from '/@react-refresh'`
+            : ''
+          const refreshPreambleSetup = isDevClient
+            ? `if (typeof window !== 'undefined' && !window.$RefreshReg$) {
   __oneInjectRefresh(window)
   window.$RefreshReg$ = () => {}
   window.$RefreshSig$ = () => (type) => type
 }`
-          : ''
-        return `
+            : ''
+          return `
 ${setupResult.promiseDeclaration}
 ${nativewindImport}
 ${refreshPreambleImport}
@@ -299,20 +315,20 @@ export default createApp({
   ${linkingArg}
 })
         `
-      }
+        }
 
-      if (id === resolvedVirtualEntryIdNative) {
-        const isNative = isNativeEnvironment(this.environment)
-        const setupResult = getSetupFileImport(
-          this.environment.name,
-          setupFiles,
-          isNative,
-          viteRoot
-        )
-        const linkingArg = options.router?.linking
-          ? `linking: ${JSON.stringify(options.router.linking)},`
-          : ''
-        return `
+        if (id === resolvedVirtualEntryIdNative) {
+          const isNative = isNativeEnvironment(this.environment)
+          const setupResult = getSetupFileImport(
+            this.environment.name,
+            setupFiles,
+            isNative,
+            viteRoot
+          )
+          const linkingArg = options.router?.linking
+            ? `linking: ${JSON.stringify(options.router.linking)},`
+            : ''
+          return `
 import { createApp } from 'one'
 ${setupResult.importStatement}
 
@@ -324,7 +340,8 @@ export default createApp({
   ${linkingArg}
 })
         `
-      }
+        }
+      },
     },
   }
 }

package/src/vite/plugins/warmRoutesPlugin.ts

@@ -53,22 +53,48 @@ export function autoWarmPlugin(persistPath?: string): Plugin {
       }
     },
 
-    configResolved(config: ResolvedConfig) {
-      // build the exclude set from the resolved config
+    async configResolved(config: ResolvedConfig) {
       excludeSet = new Set(config.optimizeDeps.exclude || [])
 
-      if (cachedDeps.length > 0 && excludeSet.size > 0) {
-        // remove any cached deps that are in the exclude list
-        const conflicts = cachedDeps.filter((d) => excludeSet.has(d))
-        if (conflicts.length > 0) {
-          console.info(`[one] filtered ${conflicts.length} excluded deps from warm cache`)
+      if (cachedDeps.length > 0) {
+        const resolve = config.createResolver()
+        const staleDeps = new Set<string>()
+
+        await Promise.all(
+          cachedDeps.map(async (dep) => {
+            if (excludeSet.has(dep)) {
+              staleDeps.add(dep)
+              return
+            }
+
+            try {
+              if (!(await resolve(dep))) staleDeps.add(dep)
+            } catch {
+              staleDeps.add(dep)
+            }
+          })
+        )
+
+        if (staleDeps.size > 0) {
+          cachedDeps = cachedDeps.filter((dep) => !staleDeps.has(dep))
+          console.info(`[one] pruned ${staleDeps.size} stale deps from warm cache`)
 
-          // mutate the resolved include to remove conflicts
           if (config.optimizeDeps.include) {
-            ;(config.optimizeDeps as any).include = config.optimizeDeps.include.filter(
-              (d: string) => !excludeSet.has(d)
+            config.optimizeDeps.include = config.optimizeDeps.include.filter(
+              (dep) => !staleDeps.has(dep)
             )
           }
+
+          try {
+            const nextRaw = JSON.stringify({ deps: [...cachedDeps].sort() }, null, 2)
+            if (!existsSync(cacheFile) || readFileSync(cacheFile, 'utf-8') !== nextRaw) {
+              const dir = dirname(cacheFile)
+              if (!existsSync(dir)) mkdirSync(dir, { recursive: true })
+              writeFileSync(cacheFile, nextRaw)
+            }
+          } catch {
+            // a future snapshot can retry the cache write
+          }
         }
       }
     },

package/src/vite/types.ts

@@ -546,11 +546,16 @@ export namespace One {
       suspendRoutes?: boolean
 
       /**
-       * Experimental: serve the web client through Vite 8.1's bundled dev mode
+       * Experimental: serve the web client through Vite's bundled dev mode
        * (rolldown-powered FullBundleDevEnvironment) instead of unbundled ESM dev.
        * Fewer requests / faster parse, especially for apps with large icon/util
        * imports. Dev-only; ignored for builds.
        *
+       * Covered by tests/test-bundled-dev. It is easy to break without noticing,
+       * because a broken client bundle still serves a 200 with correct SSR html
+       * and only fails to hydrate, so that test asserts interactivity rather
+       * than response status.
+       *
        * @experimental
        * @default false
        */