react-bun-ssr 0.3.1 → 0.4.0

package/framework/runtime/head-reconcile.ts

@@ -0,0 +1,270 @@
+import {
+  RBSSR_HEAD_MARKER_END_ATTR,
+  RBSSR_HEAD_MARKER_START_ATTR,
+} from "./runtime-constants";
+
+const ELEMENT_NODE = 1;
+const TEXT_NODE = 3;
+const COMMENT_NODE = 8;
+
+export function isContentInsensitiveHeadTag(tagName: string): boolean {
+  const normalized = tagName.toLowerCase();
+  return normalized === "script" || normalized === "style" || normalized === "noscript";
+}
+
+function normalizeNodeText(value: string): string {
+  return value.replace(/\s+/g, " ").trim();
+}
+
+export function nodeSignature(node: Node): string {
+  if (node.nodeType === TEXT_NODE) {
+    return `text:${node.textContent ?? ""}`;
+  }
+
+  if (node.nodeType === COMMENT_NODE) {
+    return `comment:${node.textContent ?? ""}`;
+  }
+
+  if (node.nodeType !== ELEMENT_NODE) {
+    return `node:${node.nodeType}`;
+  }
+
+  const element = node as Element;
+  const tagName = element.tagName.toLowerCase();
+  const attrs = Array.from(element.attributes)
+    .map(attribute => `${attribute.name}=${attribute.value}`)
+    .sort((a, b) => a.localeCompare(b))
+    .join("|");
+
+  if (isContentInsensitiveHeadTag(tagName)) {
+    return `element:${tagName}:${attrs}`;
+  }
+
+  if (tagName === "title") {
+    return `element:${tagName}:${attrs}:${normalizeNodeText(element.textContent ?? "")}`;
+  }
+
+  // Keep generic element identity structural and cheap: no innerHTML serialization.
+  return `element:${tagName}:${attrs}:${normalizeNodeText(element.textContent ?? "")}:${element.childElementCount}`;
+}
+
+function isIgnorableTextNode(node: Node): boolean {
+  return node.nodeType === TEXT_NODE && (node.textContent ?? "").trim().length === 0;
+}
+
+function getManagedHeadNodes(startMarker: Element, endMarker: Element): Node[] {
+  const nodes: Node[] = [];
+  let cursor = startMarker.nextSibling;
+  while (cursor && cursor !== endMarker) {
+    nodes.push(cursor);
+    cursor = cursor.nextSibling;
+  }
+  return nodes;
+}
+
+function removeNode(node: Node): void {
+  if (node.parentNode) {
+    node.parentNode.removeChild(node);
+  }
+}
+
+function isStylesheetLinkNode(node: Node): node is HTMLLinkElement {
+  if (node.nodeType !== ELEMENT_NODE) {
+    return false;
+  }
+
+  const element = node as Element;
+  return (
+    element.tagName.toLowerCase() === "link"
+    && (element.getAttribute("rel")?.toLowerCase() ?? "") === "stylesheet"
+    && Boolean(element.getAttribute("href"))
+  );
+}
+
+function toAbsoluteHref(href: string, baseUri: string): string {
+  return new URL(href, baseUri).toString();
+}
+
+function resolveBaseUri(documentRef: Document): string {
+  const candidate = documentRef.baseURI;
+  if (typeof candidate === "string" && candidate.length > 0) {
+    try {
+      const parsed = new URL(candidate);
+      if (parsed.protocol !== "about:") {
+        return candidate;
+      }
+    } catch {
+      // fall back below
+    }
+  }
+
+  return "http://localhost/";
+}
+
+function waitForStylesheetLoad(link: HTMLLinkElement): Promise<void> {
+  if (!link.ownerDocument.defaultView || link.sheet) {
+    return Promise.resolve();
+  }
+
+  return new Promise(resolve => {
+    const finish = () => {
+      link.removeEventListener("load", finish);
+      link.removeEventListener("error", finish);
+      resolve();
+    };
+
+    link.addEventListener("load", finish, { once: true });
+    link.addEventListener("error", finish, { once: true });
+  });
+}
+
+async function reconcileStylesheetLinks(options: {
+  head: HTMLHeadElement;
+  desiredStylesheetHrefs: string[];
+  baseUri: string;
+}): Promise<void> {
+  const desiredAbsoluteHrefs = options.desiredStylesheetHrefs.map(href => toAbsoluteHref(href, options.baseUri));
+  const existingLinks = Array.from(
+    options.head.querySelectorAll('link[rel="stylesheet"][href]'),
+  ) as HTMLLinkElement[];
+
+  const existingByAbsoluteHref = new Map<string, HTMLLinkElement[]>();
+  for (const link of existingLinks) {
+    const href = link.getAttribute("href");
+    if (!href) {
+      continue;
+    }
+    const absoluteHref = toAbsoluteHref(href, options.baseUri);
+    const list = existingByAbsoluteHref.get(absoluteHref) ?? [];
+    list.push(link);
+    existingByAbsoluteHref.set(absoluteHref, list);
+  }
+
+  const waitForLoads: Promise<void>[] = [];
+  for (let index = 0; index < options.desiredStylesheetHrefs.length; index += 1) {
+    const href = options.desiredStylesheetHrefs[index]!;
+    const absoluteHref = desiredAbsoluteHrefs[index]!;
+    const existing = existingByAbsoluteHref.get(absoluteHref)?.[0];
+    if (existing) {
+      waitForLoads.push(waitForStylesheetLoad(existing));
+      continue;
+    }
+
+    const link = options.head.ownerDocument.createElement("link");
+    link.setAttribute("rel", "stylesheet");
+    link.setAttribute("href", href);
+    options.head.appendChild(link);
+    waitForLoads.push(waitForStylesheetLoad(link));
+  }
+
+  const seen = new Set<string>();
+  for (const link of Array.from(options.head.querySelectorAll('link[rel="stylesheet"][href]'))) {
+    const href = link.getAttribute("href");
+    if (!href) {
+      continue;
+    }
+
+    const absoluteHref = toAbsoluteHref(href, options.baseUri);
+    if (seen.has(absoluteHref)) {
+      removeNode(link);
+      continue;
+    }
+
+    seen.add(absoluteHref);
+  }
+
+  await Promise.all(waitForLoads);
+}
+
+export async function replaceManagedHead(
+  headHtml: string,
+  options: {
+    documentRef?: Document;
+    startMarkerAttr?: string;
+    endMarkerAttr?: string;
+  } = {},
+): Promise<void> {
+  const documentRef = options.documentRef ?? document;
+  const startMarkerAttr = options.startMarkerAttr ?? RBSSR_HEAD_MARKER_START_ATTR;
+  const endMarkerAttr = options.endMarkerAttr ?? RBSSR_HEAD_MARKER_END_ATTR;
+
+  const head = documentRef.head;
+  const startMarker = head.querySelector(`meta[${startMarkerAttr}]`);
+  const endMarker = head.querySelector(`meta[${endMarkerAttr}]`);
+
+  if (!startMarker || !endMarker || startMarker === endMarker) {
+    return;
+  }
+
+  const template = documentRef.createElement("template");
+  template.innerHTML = headHtml;
+
+  const desiredStylesheetHrefs = Array.from(template.content.querySelectorAll('link[rel="stylesheet"][href]'))
+    .map(link => link.getAttribute("href"))
+    .filter((value): value is string => Boolean(value));
+  for (const styleNode of Array.from(template.content.querySelectorAll('link[rel="stylesheet"][href]'))) {
+    removeNode(styleNode);
+  }
+
+  const desiredNodes = Array.from(template.content.childNodes).filter(node => !isIgnorableTextNode(node));
+  const currentNodes = getManagedHeadNodes(startMarker, endMarker).filter(node => {
+    if (isIgnorableTextNode(node)) {
+      return false;
+    }
+
+    if (isStylesheetLinkNode(node)) {
+      return false;
+    }
+
+    return true;
+  });
+  const unusedCurrentNodes = new Set(currentNodes);
+
+  let cursor = startMarker.nextSibling;
+
+  // Structural identity only: avoid subtree HTML serialization in signature checks.
+  for (const desiredNode of desiredNodes) {
+    while (cursor && cursor !== endMarker && isIgnorableTextNode(cursor)) {
+      const next = cursor.nextSibling;
+      removeNode(cursor);
+      cursor = next;
+    }
+
+    const desiredSignature = nodeSignature(desiredNode);
+
+    if (cursor && cursor !== endMarker && nodeSignature(cursor) === desiredSignature) {
+      unusedCurrentNodes.delete(cursor);
+      cursor = cursor.nextSibling;
+      continue;
+    }
+
+    let matchedNode: Node | null = null;
+    for (const currentNode of currentNodes) {
+      if (!unusedCurrentNodes.has(currentNode)) {
+        continue;
+      }
+      if (nodeSignature(currentNode) === desiredSignature) {
+        matchedNode = currentNode;
+        break;
+      }
+    }
+
+    if (matchedNode) {
+      unusedCurrentNodes.delete(matchedNode);
+      head.insertBefore(matchedNode, cursor ?? endMarker);
+      continue;
+    }
+
+    head.insertBefore(desiredNode.cloneNode(true), cursor ?? endMarker);
+  }
+
+  for (const leftover of unusedCurrentNodes) {
+    removeNode(leftover);
+  }
+
+  await reconcileStylesheetLinks({
+    head,
+    desiredStylesheetHrefs,
+    baseUri: resolveBaseUri(documentRef),
+  });
+}

package/framework/runtime/helpers.ts

@@ -1,5 +1,6 @@
-import type { FrameworkConfig, RedirectResult } from "./types";
+import type { FrameworkConfig, RedirectResult, RequestContext } from "./types";
 import { defer as deferValue } from "./deferred";
+import { routeError } from "./route-errors";
 
 export function json(data: unknown, init: ResponseInit = {}): Response {
   const headers = new Headers(init.headers);
@@ -30,6 +31,79 @@ export function defineConfig(config: FrameworkConfig): FrameworkConfig {
 
 export const defer = deferValue;
 
+function toNormalizedFallback(value: string): string {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return "/";
+  }
+  if (trimmed.startsWith("/")) {
+    return trimmed.startsWith("//") ? "/" : trimmed;
+  }
+  if (trimmed.startsWith("?") || trimmed.startsWith("#")) {
+    return `/${trimmed}`;
+  }
+  if (/^[a-zA-Z][a-zA-Z\d+\-.]*:/.test(trimmed)) {
+    return "/";
+  }
+  return `/${trimmed.replace(/^\/+/, "")}`;
+}
+
+export function sanitizeRedirectTarget(value: string | null | undefined, fallback = "/"): string {
+  const normalizedFallback = toNormalizedFallback(fallback);
+  if (typeof value !== "string") {
+    return normalizedFallback;
+  }
+
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return normalizedFallback;
+  }
+
+  if (trimmed.startsWith("//") || trimmed.startsWith("\\\\")) {
+    return normalizedFallback;
+  }
+
+  let parsed: URL;
+  try {
+    parsed = new URL(trimmed, "http://rbssr.local");
+  } catch {
+    return normalizedFallback;
+  }
+
+  if (parsed.origin !== "http://rbssr.local") {
+    return normalizedFallback;
+  }
+
+  const normalizedTarget = `${parsed.pathname}${parsed.search}${parsed.hash}`;
+  if (!normalizedTarget.startsWith("/")) {
+    return normalizedFallback;
+  }
+
+  return normalizedTarget;
+}
+
+export function assertSameOriginAction(ctx: Pick<RequestContext, "request" | "url">): void {
+  if (ctx.request.method.toUpperCase() === "GET" || ctx.request.method.toUpperCase() === "HEAD") {
+    return;
+  }
+
+  const originHeader = ctx.request.headers.get("origin");
+  if (!originHeader) {
+    return;
+  }
+
+  let origin: URL;
+  try {
+    origin = new URL(originHeader);
+  } catch {
+    throw routeError(403, { message: "Invalid Origin header." });
+  }
+
+  if (origin.origin !== ctx.url.origin) {
+    throw routeError(403, { message: "Cross-origin form submissions are not allowed." });
+  }
+}
+
 export function isRedirectResult(value: unknown): value is RedirectResult {
   return Boolean(
     value &&

package/framework/runtime/index.ts

@@ -1,29 +1,59 @@
-export type {
-  Action,
-  ActionContext,
-  ActionResult,
-  ApiRouteModule,
-  BuildManifest,
-  BuildRouteAsset,
-  DeferredLoaderResult,
-  DeferredToken,
-  FrameworkConfig,
-  Loader,
-  LoaderContext,
-  LoaderResult,
-  Middleware,
-  Params,
-  RedirectResult,
-  ResponseHeaderRule,
-  RequestContext,
-  RouteCatchContext,
-  RouteErrorContext,
-  RouteErrorResponse,
-  RouteModule,
+import type {
+  Action as RuntimeAction,
+  ActionContext as RuntimeActionContext,
+  ActionResult as RuntimeActionResult,
+  ApiRouteModule as RuntimeApiRouteModule,
+  BuildManifest as RuntimeBuildManifest,
+  BuildRouteAsset as RuntimeBuildRouteAsset,
+  DeferredLoaderResult as RuntimeDeferredLoaderResult,
+  DeferredToken as RuntimeDeferredToken,
+  FrameworkConfig as RuntimeFrameworkConfig,
+  Loader as RuntimeLoader,
+  LoaderContext as RuntimeLoaderContext,
+  LoaderResult as RuntimeLoaderResult,
+  Middleware as RuntimeMiddleware,
+  Params as RuntimeParams,
+  RedirectResult as RuntimeRedirectResult,
+  RequestContext as RuntimeRequestContext,
+  ResponseContext as RuntimeResponseContext,
+  ResponseCookies as RuntimeResponseCookies,
+  ResponseCookieOptions as RuntimeResponseCookieOptions,
+  ResponseHeaderRule as RuntimeResponseHeaderRule,
+  RouteCatchContext as RuntimeRouteCatchContext,
+  RouteErrorContext as RuntimeRouteErrorContext,
+  RouteErrorResponse as RuntimeRouteErrorResponse,
+  RouteModule as RuntimeRouteModule,
 } from "./types";
 
+export interface AppRouteLocals extends Record<string, unknown> {}
+
+export type Action = RuntimeAction<AppRouteLocals>;
+export type ActionContext = RuntimeActionContext<AppRouteLocals>;
+export type ActionResult = RuntimeActionResult;
+export type ApiRouteModule = RuntimeApiRouteModule;
+export type BuildManifest = RuntimeBuildManifest;
+export type BuildRouteAsset = RuntimeBuildRouteAsset;
+export type DeferredLoaderResult = RuntimeDeferredLoaderResult;
+export type DeferredToken = RuntimeDeferredToken;
+export type FrameworkConfig = RuntimeFrameworkConfig;
+export type Loader = RuntimeLoader<AppRouteLocals>;
+export type LoaderContext = RuntimeLoaderContext<AppRouteLocals>;
+export type LoaderResult = RuntimeLoaderResult;
+export type Middleware = RuntimeMiddleware<AppRouteLocals>;
+export type Params = RuntimeParams;
+export type RedirectResult = RuntimeRedirectResult;
+export type RequestContext = RuntimeRequestContext<AppRouteLocals>;
+export type ResponseContext = RuntimeResponseContext;
+export type ResponseCookies = RuntimeResponseCookies;
+export type ResponseCookieOptions = RuntimeResponseCookieOptions;
+export type ResponseHeaderRule = RuntimeResponseHeaderRule;
+export type RouteCatchContext = RuntimeRouteCatchContext;
+export type RouteErrorContext = RuntimeRouteErrorContext;
+export type RouteErrorResponse = RuntimeRouteErrorResponse;
+export type RouteModule = RuntimeRouteModule;
+
 export { createServer, startHttpServer } from "./server";
-export { defer, json, redirect, defineConfig } from "./helpers";
+export { assertSameOriginAction, defer, defineConfig, json, redirect, sanitizeRedirectTarget } from "./helpers";
 export { isRouteErrorResponse, notFound, routeError } from "./route-errors";
 export { Link, type LinkProps } from "./link";
 export { useRouter, type Router, type RouterNavigateInfo, type RouterNavigateListener, type RouterNavigateOptions } from "./router";

package/framework/runtime/io.ts

@@ -80,7 +80,7 @@ export function sha256Short(input: HashInput): string {
 }
 
 export async function ensureDir(dirPath: string): Promise<void> {
-  runPosix(["mkdir", "-p", dirPath], `Failed to create directory: ${dirPath}`);
+  await runPosix(["mkdir", "-p", dirPath], `Failed to create directory: ${dirPath}`);
 }
 
 export async function ensureCleanDir(dirPath: string): Promise<void> {
@@ -89,7 +89,7 @@ export async function ensureCleanDir(dirPath: string): Promise<void> {
 }
 
 export async function removePath(targetPath: string): Promise<void> {
-  runPosix(["rm", "-rf", targetPath], `Failed to remove path: ${targetPath}`);
+  await runPosix(["rm", "-rf", targetPath], `Failed to remove path: ${targetPath}`);
 }
 
 export async function listEntries(dirPath: string): Promise<FileEntry[]> {
@@ -127,20 +127,23 @@ export async function makeTempDir(prefix: string): Promise<string> {
   return dirPath;
 }
 
-function runPosix(cmd: string[], context: string): void {
-  const result = Bun.spawnSync({
+async function runPosix(cmd: string[], context: string): Promise<void> {
+  const result = Bun.spawn({
     cmd,
     stdout: "pipe",
     stderr: "pipe",
   });
 
-  if (result.exitCode === 0) {
+  const exitCode = await result.exited;
+  if (exitCode === 0) {
     return;
   }
 
-  const decoder = new TextDecoder();
-  const stderr = result.stderr.length > 0 ? decoder.decode(result.stderr).trim() : "";
-  const stdout = result.stdout.length > 0 ? decoder.decode(result.stdout).trim() : "";
-  const details = stderr || stdout || `exit code ${result.exitCode}`;
+  const [stderr, stdout] = await Promise.all([
+    result.stderr ? new Response(result.stderr).text() : Promise.resolve(""),
+    result.stdout ? new Response(result.stdout).text() : Promise.resolve(""),
+  ]);
+
+  const details = stderr.trim() || stdout.trim() || `exit code ${exitCode}`;
   throw new Error(`[io] ${context} (${cmd.join(" ")}): ${details}`);
 }

package/framework/runtime/matcher.ts

@@ -6,8 +6,10 @@ import type {
   RouteSegment,
 } from "./types";
 
-// Bun FileSystemRouter is the runtime matcher used by the server.
-// This matcher is retained for lightweight unit coverage and internal utilities.
+// Bun FileSystemRouter is the runtime matcher used by the server for projected routes.
+// This matcher is used by server fallbacks and client transition matching.
+// It intentionally does first-match linear scanning and expects routes to be pre-ordered
+// by specificity (higher score first, then longer segment length, then routePath).
 function normalizePathname(pathname: string): string[] {
   if (!pathname || pathname === "/") {
     return [];